Edit tour

Windows Analysis Report
pK6oGXjugD.exe

Overview

General Information

Sample Name:	pK6oGXjugD.exe
Analysis ID:	752683
MD5:	0a68b271537063af4fa3c46895389b6d
SHA1:	ff106ad1e92511cae026f3d1f772dc8c04d694a2
SHA256:	fa3b15251b20a7b8bba32fdd02993989d28c7a4deecf1b2992e558355bc14584
Tags:	exe
Infos:

Detection

Score:	7
Range:	0 - 100
Whitelisted:	false
Confidence:	20%

Signatures

Uses 32bit PE files

Drops files with a non-matching file extension (content does not match file extension)

Drops PE files

Tries to load missing DLLs

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Uses code obfuscation techniques (call, push, ret)

File is packed with WinRar

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Contains functionality to communicate with device drivers

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample searches for specific file, try point organization specific fake files to the analysis machine

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Process Tree

System is w10x64

pK6oGXjugD.exe (PID: 4104 cmdline: C:\Users\user\Desktop\pK6oGXjugD.exe MD5: 0A68B271537063AF4FA3C46895389B6D)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: pK6oGXjugD.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: pK6oGXjugD.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: pK6oGXjugD.exe
Source:	Binary string: vulkan-1.dll.pdb source: vulkan-1.dll.0.dr
Source:	Binary string: .$ac_ext \| .xcoff \| .tds \| .d \| .pdb \| .xSYM \| .bb \| .bbg \| .map \| .inf \| *.dSYM ) ;; source: configure.0.dr
Source:	Binary string: .$ac_ext \| .xcoff \| .tds \| .d \| .pdb \| .xSYM \| .bb \| .bbg \| .map \| .inf \| .dSYM \| .o \| *.obj ) ;; source: configure.0.dr
Source:	Binary string: .$ac_ext \| .xcoff \| .tds \| .d \| .pdb \| .xSYM \| .bb \| .bbg \| .map \| .inf \| .dSYM \| .o \| *.obj ) source: configure.0.dr
Source:	Binary string: vulkan-1.dll.pdb@ source: vulkan-1.dll.0.dr
Source:	Binary string: C:\projects\node-ffi-napi\build\Release\ffi_bindings.pdb source: node.napi.uv1.node1.0.dr

Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A69C91 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_00A69C91
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A7994E SendDlgItemMessageW,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	0_2_00A7994E
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A87561 FindFirstFileExA,	0_2_00A87561

Source: C:\Users\user\Desktop\pK6oGXjugD.exe	File opened: C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\differentialDownloader\DifferentialDownloader.js	Jump to behavior
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	File opened: C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\differentialDownloader\DataSplitter.js	Jump to behavior
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	File opened: C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\differentialDownloader\DifferentialDownloader.js.map	Jump to behavior
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	File opened: C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\differentialDownloader	Jump to behavior
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	File opened: C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\differentialDownloader\DataSplitter.js.map	Jump to behavior
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	File opened: C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\BaseUpdater.js.map	Jump to behavior

Source: MacUpdater.js.0.dr	String found in binary or memory: http://127.0.0.1:$
Source: .editorconfig0.0.dr, .editorconfig1.0.dr, .editorconfig2.0.dr	String found in binary or memory: http://EditorConfig.org
Source: package.json24.0.dr	String found in binary or memory: http://allyoucanleet.com/
Source: configure.0.dr	String found in binary or memory: http://austingroupbugs.net/view.php?id=542
Source: clear.js.0.dr	String found in binary or memory: http://closure-library.googlecode.com/svn/docs/
Source: dlmalloc.c.0.dr	String found in binary or memory: http://creativecommons.org/licenses/publicdomain.
Source: ltmain.sh.0.dr	String found in binary or memory: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=16452
Source: compact.js.0.dr	String found in binary or memory: http://documentcloud.github.com/underscore/#compact
Source: index.js64.0.dr	String found in binary or memory: http://ecma-international.org/ecma-262/6.0/#sec-object.prototype.tostring)
Source: index.js64.0.dr	String found in binary or memory: http://ecma-international.org/ecma-262/6.0/#sec-patterns).
Source: da.pak.0.dr	String found in binary or memory: http://eksempel.dk
Source: dbcs-data.js.0.dr	String found in binary or memory: http://encoding.spec.whatwg.org/#big5-encoder
Source: ltmain.sh.0.dr	String found in binary or memory: http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59788
Source: ffi.h0.0.dr, ffi.h.0.dr	String found in binary or memory: http://gcc.gnu.org/ml/java/1999-q3/msg00138.html
Source: ffi.h0.0.dr, ffi.h.0.dr	String found in binary or memory: http://gcc.gnu.org/ml/java/1999-q3/msg00174.html
Source: dlmalloc.c.0.dr	String found in binary or memory: http://gee.cs.oswego.edu/dl/html/malloc.html
Source: README.md.0.dr	String found in binary or memory: http://github.com/libffi/libffi.
Source: configure.0.dr	String found in binary or memory: http://github.com/libffi/libffi/issues
Source: package.json3.0.dr	String found in binary or memory: http://github.com/node-ffi-napi/node-ffi-napi
Source: dlmalloc.c.0.dr	String found in binary or memory: http://hackersdelight.org/).
Source: LICENSE11.0.dr	String found in binary or memory: http://hdl.handle.net/1895.22/1013
Source: dbcs-data.js.0.dr	String found in binary or memory: http://icu-project.org/docs/papers/gb18030.html
Source: shim.js7.0.dr	String found in binary or memory: http://mathiasbynens.be/notes/javascript-encoding#surrogate-formulae
Source: string.js.0.dr	String found in binary or memory: http://mathiasbynens.be/notes/javascript-unicode#iterating-over-symbols
Source: dbcs-data.js.0.dr	String found in binary or memory: http://me.abelcheung.org/articles/research/what-is-cp951/
Source: dbcs-data.js.0.dr	String found in binary or memory: http://moztw.org/docs/big5/
Source: shim.js13.0.dr	String found in binary or memory: http://norbertlindenberg.com/2012/05/ecmascript-supplementary-characters/
Source: dbcs-data.js.0.dr	String found in binary or memory: http://source.icu-project.org/repos/icu/data/trunk/charset/data/xml/gb-18030-2000.xml
Source: README.md.0.dr	String found in binary or memory: http://sourceware.org/libffi/
Source: index.js57.0.dr	String found in binary or memory: http://stackoverflow.com/a/6155063/376773
Source: js-yaml.mjs.0.dr, exception.js.0.dr	String found in binary or memory: http://stackoverflow.com/questions/8458984
Source: index.js64.0.dr	String found in binary or memory: http://underscorejs.org/LICENSE
Source: is.js.0.dr	String found in binary or memory: http://wiki.ecmascript.org/doku.php?id=harmony:egal
Source: shim.js11.0.dr	String found in binary or memory: http://www.2ality.com/2014/01/efficient-string-repeat.html
Source: LICENSE11.0.dr	String found in binary or memory: http://www.cnri.reston.va.us)
Source: texinfo.tex.0.dr	String found in binary or memory: http://www.ctan.org/tex-archive/fonts/eurosym.
Source: LICENSE11.0.dr	String found in binary or memory: http://www.cwi.nl)
Source: ltmain.sh.0.dr	String found in binary or memory: http://www.gnu.org/gethelp/
Source: ltmain.sh.0.dr, bhaible.exp.0.dr, libtool.m4.0.dr	String found in binary or memory: http://www.gnu.org/licenses/
Source: ltmain.sh.0.dr	String found in binary or memory: http://www.gnu.org/software/libtool/
Source: dbcs-data.js.0.dr	String found in binary or memory: http://www.haible.de/bruno/charsets/conversion-tables/Big5.html
Source: dbcs-data.js.0.dr	String found in binary or memory: http://www.khngai.com/chinese/charmap/tblgbk.php?page=0
Source: dlmalloc.c.0.dr	String found in binary or memory: http://www.malloc.de).
Source: package.json10.0.dr, package.json25.0.dr	String found in binary or memory: http://www.medikoo.com/)
Source: texinfo.tex.0.dr	String found in binary or memory: http://www.ntg.nl/pipermail/ntg-pdftex/2004-July/000654.html
Source: dbcs-data.js.0.dr	String found in binary or memory: http://www.ogcio.gov.hk/en/business/tech_promotion/ccli/terms/doc/2003cmp_2008.txt
Source: dbcs-data.js.0.dr	String found in binary or memory: http://www.ogcio.gov.hk/tc/business/tech_promotion/ccli/terms/doc/hkscs-2008-big5-iso.txt
Source: LICENSE11.0.dr	String found in binary or memory: http://www.opensource.org
Source: LICENSE11.0.dr	String found in binary or memory: http://www.pythonlabs.com/logos.html
Source: dbcs-data.js.0.dr	String found in binary or memory: http://www.unicode.org/Public/MAPPINGS/OBSOLETE/EASTASIA/OTHER/BIG5.TXT)
Source: dbcs-data.js.0.dr	String found in binary or memory: http://www.unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP950.TXT
Source: dlmalloc.c.0.dr	String found in binary or memory: http://www.unix.org).
Source: dlmalloc.c.0.dr	String found in binary or memory: http://www.usenix.org/events/lisa03/tech/robertson.html
Source: js-yaml.mjs.0.dr	String found in binary or memory: http://www.yaml.org/spec/1.2/spec.html#id2799784
Source: dbcs-data.js.0.dr	String found in binary or memory: http://www8.plala.or.jp/tkubota1/unicode-symbols-map2.html
Source: default.js.0.dr	String found in binary or memory: http://yaml.org/type/)
Source: sr.pak.0.dr, ko.pak.0.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/entry?template=Safety
Source: dbcs-data.js.0.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=162431
Source: dbcs-data.js.0.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=310299
Source: dbcs-data.js.0.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=912470#c31
Source: README.md.0.dr	String found in binary or memory: https://ci.appveyor.com/api/projects/status/8lko9vagbx4w2kxq?svg=true)
Source: README.md.0.dr	String found in binary or memory: https://ci.appveyor.com/project/atgreen/libffi)
Source: texinfo.tex.0.dr	String found in binary or memory: https://ctan.org/texarchive/macros/texinfo/texinfo/doc/epsf.tex.
Source: includes.md.0.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/includes)
Source: BintrayProvider.js.0.dr	String found in binary or memory: https://dl.bintray.com/$
Source: da.pak.0.dr	String found in binary or memory: https://eksempel.dk.Brug
Source: dbcs-data.js.0.dr	String found in binary or memory: https://encoding.spec.whatwg.org/#index-big5-pointer)
Source: dbcs-data.js.0.dr	String found in binary or memory: https://encoding.spec.whatwg.org/#index-big5-pointer:
Source: texinfo.tex.0.dr	String found in binary or memory: https://ftp.gnu.org/gnu/texinfo
Source: texinfo.tex.0.dr	String found in binary or memory: https://ftp.gnu.org/gnu/texinfo/
Source: texinfo.tex.0.dr	String found in binary or memory: https://ftpmirror.gnu.org/texinfo/
Source: node.js0.0.dr	String found in binary or memory: https://git.io/debug_fd)
Source: index.js62.0.dr	String found in binary or memory: https://github.com/ashtuchkin/iconv-lite/wiki/Javascript-source-file-encodings
Source: index.js62.0.dr	String found in binary or memory: https://github.com/ashtuchkin/iconv-lite/wiki/Use-Buffers-when-decoding
Source: http.js0.0.dr	String found in binary or memory: https://github.com/axios/axios/issues/69
Source: package.json11.0.dr, package.json0.0.dr	String found in binary or memory: https://github.com/electron-userland/electron-builder
Source: package.json0.0.dr	String found in binary or memory: https://github.com/electron-userland/electron-builder).
Source: package.json11.0.dr, package.json0.0.dr	String found in binary or memory: https://github.com/electron-userland/electron-builder.git
Source: AppUpdater.js.0.dr	String found in binary or memory: https://github.com/electron-userland/electron-builder/issues/1105
Source: AppUpdater.js.0.dr	String found in binary or memory: https://github.com/electron-userland/electron-builder/issues/1150#issuecomment-436891159
Source: AppImageUpdater.js.0.dr	String found in binary or memory: https://github.com/electron-userland/electron-builder/issues/2964
Source: AppUpdater.js.0.dr	String found in binary or memory: https://github.com/electron-userland/electron-builder/issues/3021
Source: AppUpdater.js.0.dr	String found in binary or memory: https://github.com/electron-userland/electron-builder/pull/3111#issuecomment-405030797
Source: AppUpdater.js.0.dr	String found in binary or memory: https://github.com/electron-userland/electron-builder/pull/3111#issuecomment-405033227
Source: MacUpdater.js.0.dr	String found in binary or memory: https://github.com/electron-userland/electron-builder/pull/5524
Source: electronHttpExecutor.js.0.dr	String found in binary or memory: https://github.com/electron/electron/issues/11505
Source: AppAdapter.js.0.dr	String found in binary or memory: https://github.com/electron/electron/issues/1404#issuecomment-194391247
Source: package.json8.0.dr	String found in binary or memory: https://github.com/isaacs/node-graceful-fs#readme
Source: package.json8.0.dr	String found in binary or memory: https://github.com/isaacs/node-graceful-fs.git
Source: polyfills.js.0.dr	String found in binary or memory: https://github.com/isaacs/node-graceful-fs/issues/4
Source: node.js0.0.dr	String found in binary or memory: https://github.com/joyent/node/issues/1726
Source: copy.js.0.dr	String found in binary or memory: https://github.com/jprichardson/node-fs-extra/issues/269
Source: package.json24.0.dr	String found in binary or memory: https://github.com/lodash/lodash.git
Source: package.json12.0.dr	String found in binary or memory: https://github.com/mafintosh/end-of-stream
Source: shim.js13.0.dr	String found in binary or memory: https://github.com/mathiasbynens/String.fromCodePoint/blob/master
Source: shim.js7.0.dr	String found in binary or memory: https://github.com/mathiasbynens/String.prototype.codePointAt
Source: shim.js11.0.dr	String found in binary or memory: https://github.com/mathiasbynens/String.prototype.repeat/blob/4a4b567def/repeat.js
Source: AppUpdater.js.0.dr	String found in binary or memory: https://github.com/megahertz/electron-log)
Source: package.json7.0.dr	String found in binary or memory: https://github.com/node-ffi-napi/get-symbol-from-current-process-h#readme
Source: js-yaml.mjs.0.dr	String found in binary or memory: https://github.com/nodeca/js-yaml
Source: package.json2.0.dr	String found in binary or memory: https://github.com/nodejs/node-addon-api
Source: index.js16.0.dr	String found in binary or memory: https://github.com/nodejs/node/blob/master/lib/internal/url.js
Source: index.js16.0.dr	String found in binary or memory: https://github.com/nodejs/node/issues/22066
Source: package.json1.0.dr	String found in binary or memory: https://github.com/npm/node-semver#readme
Source: package.json1.0.dr	String found in binary or memory: https://github.com/npm/node-semver.git
Source: shim.js19.0.dr	String found in binary or memory: https://github.com/paulmillr/es6-shim/
Source: argparse.js.0.dr	String found in binary or memory: https://github.com/python/cpython/blob/v3.9.0rc1/Lib/argparse.py
Source: global-this.md.0.dr	String found in binary or memory: https://github.com/tc39/proposal-global)
Source: missing.0.dr	String found in binary or memory: https://github.com/westes/flex
Source: AppUpdater.js.0.dr	String found in binary or memory: https://github.com/winstonjs/winston)
Source: package.json21.0.dr	String found in binary or memory: https://github.com/zeit/ms#readme
Source: package.json21.0.dr	String found in binary or memory: https://github.com/zeit/ms.git
Source: dependabot.yml.0.dr	String found in binary or memory: https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updat
Source: index.js64.0.dr	String found in binary or memory: https://jquery.org/
Source: configure.0.dr	String found in binary or memory: https://lists.gnu.org/archive/html/automake/2012-07/msg00001.html
Source: configure.0.dr	String found in binary or memory: https://lists.gnu.org/archive/html/automake/2012-07/msg00014.html
Source: texinfo.tex.0.dr	String found in binary or memory: https://lists.gnu.org/archive/html/bug-texinfo/2019-08/msg00031.html
Source: index.js64.0.dr, package.json24.0.dr	String found in binary or memory: https://lodash.com/
Source: index.js64.0.dr	String found in binary or memory: https://lodash.com/)
Source: package.json24.0.dr	String found in binary or memory: https://lodash.com/icon.svg
Source: index.js64.0.dr	String found in binary or memory: https://lodash.com/license
Source: js-yaml.mjs.0.dr	String found in binary or memory: https://mathiasbynens.be/notes/javascript-encoding#surrogate-formulae
Source: copy.js.0.dr	String found in binary or memory: https://nodejs.org/api/fs.html#fs_stat_time_values)
Source: AppImageUpdater.js.0.dr	String found in binary or memory: https://stackoverflow.com/a/1712051/1910191
Source: ro.pak.0.dr, da.pak.0.dr, nb.pak.0.dr, fa.pak.0.dr, hr.pak.0.dr, hu.pak.0.dr, pt-BR.pak.0.dr, sk.pak.0.dr, bn.pak.0.dr, pt-PT.pak.0.dr, fil.pak.0.dr, ca.pak.0.dr, de.pak.0.dr, pl.pak.0.dr, en-GB.pak.0.dr, sr.pak.0.dr, ko.pak.0.dr	String found in binary or memory: https://support.google.com/chrome/answer/6098869
Source: es.pak.0.dr	String found in binary or memory: https://support.google.com/chrome/answer/6098869?hl=es
Source: README.md.0.dr	String found in binary or memory: https://travis-ci.org/libffi/libffi)
Source: README.md.0.dr	String found in binary or memory: https://travis-ci.org/libffi/libffi.svg?branch=master)
Source: code-of-conduct.md.0.dr	String found in binary or memory: https://www.contributor-covenant.org
Source: code-of-conduct.md.0.dr	String found in binary or memory: https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
Source: ax_gcc_x86_cpuid.m4.0.dr, ax_compiler_vendor.m4.0.dr, ax_enable_builddir.m4.0.dr, missing.0.dr, texinfo.tex.0.dr, alignof.h.0.dr, ax_cc_maxopt.m4.0.dr	String found in binary or memory: https://www.gnu.org/licenses/
Source: missing.0.dr	String found in binary or memory: https://www.gnu.org/software
Source: ax_cc_maxopt.m4.0.dr	String found in binary or memory: https://www.gnu.org/software/autoconf-archive/ax_cc_maxopt.html
Source: ax_compiler_vendor.m4.0.dr	String found in binary or memory: https://www.gnu.org/software/autoconf-archive/ax_compiler_vendor.html
Source: ax_enable_builddir.m4.0.dr	String found in binary or memory: https://www.gnu.org/software/autoconf-archive/ax_enable_builddir.html
Source: ax_gcc_x86_cpuid.m4.0.dr	String found in binary or memory: https://www.gnu.org/software/autoconf-archive/ax_gcc_x86_cpuid.html
Source: ax_require_defined.m4.0.dr	String found in binary or memory: https://www.gnu.org/software/autoconf-archive/ax_require_defined.html
Source: configure.0.dr	String found in binary or memory: https://www.gnu.org/software/coreutils/
Source: texinfo.tex.0.dr	String found in binary or memory: https://www.gnu.org/software/texinfo.
Source: texinfo.tex.0.dr	String found in binary or memory: https://www.gnu.org/software/texinfo/
Source: missing.0.dr	String found in binary or memory: https://www.perl.org/
Source: LICENSE11.0.dr	String found in binary or memory: https://www.python.org/psf/)

Source: pK6oGXjugD.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Section loaded: dxgidebug.dll	Jump to behavior

Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A67E20	0_2_00A67E20
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A6263E	0_2_00A6263E
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A63087	0_2_00A63087
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A7E88E	0_2_00A7E88E
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A7E024	0_2_00A7E024
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A8E064	0_2_00A8E064
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A75071	0_2_00A75071
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A6D1BC	0_2_00A6D1BC
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A82168	0_2_00A82168
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A75AA1	0_2_00A75AA1
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A6E2E1	0_2_00A6E2E1
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A89ADE	0_2_00A89ADE
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A72207	0_2_00A72207
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A75490	0_2_00A75490
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A6B4F7	0_2_00A6B4F7
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A6DC24	0_2_00A6DC24
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A7DC0C	0_2_00A7DC0C
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A7246B	0_2_00A7246B
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A65C44	0_2_00A65C44
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A7E459	0_2_00A7E459
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A63D4C	0_2_00A63D4C
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A706C5	0_2_00A706C5
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A89630	0_2_00A89630
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A74658	0_2_00A74658
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A6D7BA	0_2_00A6D7BA
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A72795	0_2_00A72795
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A7D710	0_2_00A7D710

Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: String function: 00A7CB60 appears 31 times
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: String function: 00A7C240 appears 52 times
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: String function: 00A7C16C appears 34 times

Source: C:\Users\user\Desktop\pK6oGXjugD.exe

Code function: 0_2_00A66BC9: __EH_prolog,_wcslen,_wcslen,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

0_2_00A66BC9

Source: C:\Users\user\Desktop\pK6oGXjugD.exe

File read: C:\Users\user\Desktop\pK6oGXjugD.exe

Jump to behavior

Source: pK6oGXjugD.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\pK6oGXjugD.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\pK6oGXjugD.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\pK6oGXjugD.exe

File created: C:\Program Files (x86)\????????

Jump to behavior

Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Command line argument: sfxname	0_2_00A7B52F
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Command line argument: sfxstime	0_2_00A7B52F
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Command line argument: STARTDLG	0_2_00A7B52F

Source: README.md.0.dr

Binary or memory string: aarch64/Ffi_staticLib.sln

Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\ffi-napi\node_modules\node-addon-api\common.gypi
Source: pK6oGXjugD.exe	String found in binary or memory: 3K resources\app\node_modules\ffi-napi\node_modules\node-addon-api\common.gypi
Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\ffi-napi\node_modules\node-addon-api\except.gypiUP
Source: pK6oGXjugD.exe	String found in binary or memory: 3K resources\app\node_modules\ffi-napi\node_modules\node-addon-api\except.gypiUP
Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\ffi-napi\node_modules\node-addon-api\index.js
Source: pK6oGXjugD.exe	String found in binary or memory: 3H resources\app\node_modules\ffi-napi\node_modules\node-addon-api\index.js
Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\ffi-napi\node_modules\node-addon-api\LICENSE.md
Source: pK6oGXjugD.exe	String found in binary or memory: 3J resources\app\node_modules\ffi-napi\node_modules\node-addon-api\LICENSE.md
Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\ffi-napi\node_modules\node-addon-api\napi-inl.deprecated.h
Source: pK6oGXjugD.exe	String found in binary or memory: 3U resources\app\node_modules\ffi-napi\node_modules\node-addon-api\napi-inl.deprecated.h
Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\ffi-napi\node_modules\node-addon-api\napi-inl.h
Source: pK6oGXjugD.exe	String found in binary or memory: 3J resources\app\node_modules\ffi-napi\node_modules\node-addon-api\napi-inl.h
Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\ffi-napi\node_modules\node-addon-api\napi.h
Source: pK6oGXjugD.exe	String found in binary or memory: 3F resources\app\node_modules\ffi-napi\node_modules\node-addon-api\napi.h
Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\ffi-napi\node_modules\node-addon-api\node_api.gyp
Source: pK6oGXjugD.exe	String found in binary or memory: 3L resources\app\node_modules\ffi-napi\node_modules\node-addon-api\node_api.gyp
Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\ffi-napi\node_modules\node-addon-api\noexcept.gypi
Source: pK6oGXjugD.exe	String found in binary or memory: 3M resources\app\node_modules\ffi-napi\node_modules\node-addon-api\noexcept.gypi
Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\ffi-napi\node_modules\node-addon-api\nothing.c
Source: pK6oGXjugD.exe	String found in binary or memory: 0I resources\app\node_modules\ffi-napi\node_modules\node-addon-api\nothing.c
Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\ffi-napi\node_modules\node-addon-api\package-support.json
Source: pK6oGXjugD.exe	String found in binary or memory: 3T resources\app\node_modules\ffi-napi\node_modules\node-addon-api\package-support.json
Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\ffi-napi\node_modules\node-addon-api\package.json
Source: pK6oGXjugD.exe	String found in binary or memory: 3L resources\app\node_modules\ffi-napi\node_modules\node-addon-api\package.json
Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\ffi-napi\node_modules\node-addon-api\tools\check-napi.js
Source: pK6oGXjugD.exe	String found in binary or memory: 3S resources\app\node_modules\ffi-napi\node_modules\node-addon-api\tools\check-napi.js
Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\ffi-napi\node_modules\node-addon-api\tools\clang-format.js
Source: pK6oGXjugD.exe	String found in binary or memory: 3U resources\app\node_modules\ffi-napi\node_modules\node-addon-api\tools\clang-format.js
Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\ffi-napi\node_modules\node-addon-api\tools\conversion.js
Source: pK6oGXjugD.exe	String found in binary or memory: 3S resources\app\node_modules\ffi-napi\node_modules\node-addon-api\tools\conversion.js
Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\ffi-napi\node_modules\node-addon-api\tools\README.md
Source: pK6oGXjugD.exe	String found in binary or memory: 3O resources\app\node_modules\ffi-napi\node_modules\node-addon-api\tools\README.md
Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\iconv-lite\encodings\tables\big5-added.json
Source: pK6oGXjugD.exe	String found in binary or memory: 3F resources\app\node_modules\iconv-lite\encodings\tables\big5-added.json
Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\iconv-lite\encodings\tables\gbk-added.json
Source: pK6oGXjugD.exe	String found in binary or memory: 3E resources\app\node_modules\iconv-lite\encodings\tables\gbk-added.json
Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\ref-napi\node_modules\node-addon-api\common.gypi
Source: pK6oGXjugD.exe	String found in binary or memory: 3K resources\app\node_modules\ref-napi\node_modules\node-addon-api\common.gypi
Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\ref-napi\node_modules\node-addon-api\except.gypiUP
Source: pK6oGXjugD.exe	String found in binary or memory: 3K resources\app\node_modules\ref-napi\node_modules\node-addon-api\except.gypiUP
Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\ref-napi\node_modules\node-addon-api\index.js
Source: pK6oGXjugD.exe	String found in binary or memory: 3H resources\app\node_modules\ref-napi\node_modules\node-addon-api\index.js
Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\ref-napi\node_modules\node-addon-api\LICENSE.md
Source: pK6oGXjugD.exe	String found in binary or memory: 3J resources\app\node_modules\ref-napi\node_modules\node-addon-api\LICENSE.md
Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\ref-napi\node_modules\node-addon-api\napi-inl.deprecated.h
Source: pK6oGXjugD.exe	String found in binary or memory: 3U resources\app\node_modules\ref-napi\node_modules\node-addon-api\napi-inl.deprecated.h
Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\ref-napi\node_modules\node-addon-api\napi-inl.h
Source: pK6oGXjugD.exe	String found in binary or memory: 3J resources\app\node_modules\ref-napi\node_modules\node-addon-api\napi-inl.h
Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\ref-napi\node_modules\node-addon-api\napi.h
Source: pK6oGXjugD.exe	String found in binary or memory: 3F resources\app\node_modules\ref-napi\node_modules\node-addon-api\napi.h
Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\ref-napi\node_modules\node-addon-api\node_api.gyp
Source: pK6oGXjugD.exe	String found in binary or memory: 3L resources\app\node_modules\ref-napi\node_modules\node-addon-api\node_api.gyp
Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\ref-napi\node_modules\node-addon-api\noexcept.gypi
Source: pK6oGXjugD.exe	String found in binary or memory: 3M resources\app\node_modules\ref-napi\node_modules\node-addon-api\noexcept.gypi
Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\ref-napi\node_modules\node-addon-api\nothing.c
Source: pK6oGXjugD.exe	String found in binary or memory: 0I resources\app\node_modules\ref-napi\node_modules\node-addon-api\nothing.c
Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\ref-napi\node_modules\node-addon-api\package-support.json
Source: pK6oGXjugD.exe	String found in binary or memory: 3T resources\app\node_modules\ref-napi\node_modules\node-addon-api\package-support.json
Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\ref-napi\node_modules\node-addon-api\package.json
Source: pK6oGXjugD.exe	String found in binary or memory: 3L resources\app\node_modules\ref-napi\node_modules\node-addon-api\package.json
Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\ref-napi\node_modules\node-addon-api\tools\check-napi.js
Source: pK6oGXjugD.exe	String found in binary or memory: 3S resources\app\node_modules\ref-napi\node_modules\node-addon-api\tools\check-napi.js
Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\ref-napi\node_modules\node-addon-api\tools\clang-format.js
Source: pK6oGXjugD.exe	String found in binary or memory: 3U resources\app\node_modules\ref-napi\node_modules\node-addon-api\tools\clang-format.js
Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\ref-napi\node_modules\node-addon-api\tools\conversion.js
Source: pK6oGXjugD.exe	String found in binary or memory: 3S resources\app\node_modules\ref-napi\node_modules\node-addon-api\tools\conversion.js
Source: pK6oGXjugD.exe	String found in binary or memory: resources\app\node_modules\ref-napi\node_modules\node-addon-api\tools\README.md
Source: pK6oGXjugD.exe	String found in binary or memory: 3O resources\app\node_modules\ref-napi\node_modules\node-addon-api\tools\README.md

Source: classification engine

Classification label: clean7.winEXE@1/1025@0/0

Source: C:\Users\user\Desktop\pK6oGXjugD.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: pK6oGXjugD.exe

Static file information: File size 20968188 > 1048576

Source: pK6oGXjugD.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: pK6oGXjugD.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: pK6oGXjugD.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: pK6oGXjugD.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: pK6oGXjugD.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: pK6oGXjugD.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: pK6oGXjugD.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: pK6oGXjugD.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: pK6oGXjugD.exe
Source:	Binary string: vulkan-1.dll.pdb source: vulkan-1.dll.0.dr
Source:	Binary string: .$ac_ext \| .xcoff \| .tds \| .d \| .pdb \| .xSYM \| .bb \| .bbg \| .map \| .inf \| *.dSYM ) ;; source: configure.0.dr
Source:	Binary string: .$ac_ext \| .xcoff \| .tds \| .d \| .pdb \| .xSYM \| .bb \| .bbg \| .map \| .inf \| .dSYM \| .o \| *.obj ) ;; source: configure.0.dr
Source:	Binary string: .$ac_ext \| .xcoff \| .tds \| .d \| .pdb \| .xSYM \| .bb \| .bbg \| .map \| .inf \| .dSYM \| .o \| *.obj ) source: configure.0.dr
Source:	Binary string: vulkan-1.dll.pdb@ source: vulkan-1.dll.0.dr
Source:	Binary string: C:\projects\node-ffi-napi\build\Release\ffi_bindings.pdb source: node.napi.uv1.node1.0.dr

Source: pK6oGXjugD.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: pK6oGXjugD.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: pK6oGXjugD.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: pK6oGXjugD.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: pK6oGXjugD.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A7C16C push eax; ret		0_2_00A7C18A
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A7CBA6 push ecx; ret		0_2_00A7CBB9

Source: C:\Users\user\Desktop\pK6oGXjugD.exe

File created: C:\Program Files (x86)\????????\__tmp_rar_sfx_access_check_5515546

Jump to behavior

Source: C:\Users\user\Desktop\pK6oGXjugD.exe	File created: C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\prebuilds\win32-x64\node.napi.uv1.node			Jump to dropped file
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	File created: C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\prebuilds\win32-ia32\node.napi.uv1.node			Jump to dropped file

Source: C:\Users\user\Desktop\pK6oGXjugD.exe	File created: C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\prebuilds\win32-ia32\node.napi.uv1.node	Jump to dropped file
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	File created: C:\Program Files (x86)\????????\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	File created: C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\prebuilds\win32-x64\node.napi.uv1.node	Jump to dropped file

Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Dropped PE file which has not been started: C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\prebuilds\win32-ia32\node.napi.uv1.node	Jump to dropped file
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Dropped PE file which has not been started: C:\Program Files (x86)\????????\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Dropped PE file which has not been started: C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\prebuilds\win32-x64\node.napi.uv1.node	Jump to dropped file

Source: C:\Users\user\Desktop\pK6oGXjugD.exe

Code function: 0_2_00A7BCBF VirtualQuery,GetSystemInfo,

0_2_00A7BCBF

Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A69C91 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_00A69C91
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A7994E SendDlgItemMessageW,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	0_2_00A7994E
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A87561 FindFirstFileExA,	0_2_00A87561

Source: C:\Users\user\Desktop\pK6oGXjugD.exe

API call chain: ExitProcess graph end node

graph_0-23461

Source: C:\Users\user\Desktop\pK6oGXjugD.exe	File opened: C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\differentialDownloader\DifferentialDownloader.js	Jump to behavior
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	File opened: C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\differentialDownloader\DataSplitter.js	Jump to behavior
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	File opened: C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\differentialDownloader\DifferentialDownloader.js.map	Jump to behavior
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	File opened: C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\differentialDownloader	Jump to behavior
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	File opened: C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\differentialDownloader\DataSplitter.js.map	Jump to behavior
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	File opened: C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\BaseUpdater.js.map	Jump to behavior

Source: libffi.exp.0.dr

Binary or memory string: # We get this with some qemu emulated systems (eg. ppc64le-linux-gnu)

Source: C:\Users\user\Desktop\pK6oGXjugD.exe

Code function: 0_2_00A8533D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00A8533D

Source: C:\Users\user\Desktop\pK6oGXjugD.exe

Code function: 0_2_00A84299 mov eax, dword ptr fs:[00000030h]

0_2_00A84299

Source: C:\Users\user\Desktop\pK6oGXjugD.exe

Code function: 0_2_00A8822F GetProcessHeap,

0_2_00A8822F

Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A7CEFE SetUnhandledExceptionFilter,	0_2_00A7CEFE
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A7D0B7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00A7D0B7
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A8533D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00A8533D
Source: C:\Users\user\Desktop\pK6oGXjugD.exe	Code function: 0_2_00A7CD6C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00A7CD6C

Source: C:\Users\user\Desktop\pK6oGXjugD.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

0_2_00A78830

Source: C:\Users\user\Desktop\pK6oGXjugD.exe

Code function: 0_2_00A6E961 cpuid

0_2_00A6E961

Source: C:\Users\user\Desktop\pK6oGXjugD.exe

Code function: 0_2_00A6A2FA GetVersionExW,

0_2_00A6A2FA

Source: C:\Users\user\Desktop\pK6oGXjugD.exe

Code function: 0_2_00A7B52F OleInitialize,GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,LoadBitmapW,DialogBoxParamW,Sleep,CloseHandle,

0_2_00A7B52F

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	3 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	11 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Software Packing	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 DLL Side-Loading	NTDS	24 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://www.ogcio.gov.hk/en/business/tech_promotion/ccli/terms/doc/2003cmp_2008.txt	0%	Avira URL Cloud	safe
http://closure-library.googlecode.com/svn/docs/	0%	Avira URL Cloud	safe
http://www8.plala.or.jp/tkubota1/unicode-symbols-map2.html	0%	Avira URL Cloud	safe
http://www.medikoo.com/)	0%	Avira URL Cloud	safe
http://eksempel.dk	0%	Avira URL Cloud	safe
http://www.haible.de/bruno/charsets/conversion-tables/Big5.html	0%	Avira URL Cloud	safe
http://norbertlindenberg.com/2012/05/ecmascript-supplementary-characters/	0%	Avira URL Cloud	safe
https://eksempel.dk.Brug	0%	Avira URL Cloud	safe
http://www.ogcio.gov.hk/en/business/tech_promotion/ccli/terms/doc/2003cmp_2008.txt	0%	Virustotal		Browse
https://git.io/debug_fd)	0%	Avira URL Cloud	safe
http://eksempel.dk	0%	Virustotal		Browse
http://www.pythonlabs.com/logos.html	0%	Avira URL Cloud	safe
http://www.cwi.nl)	0%	Avira URL Cloud	safe
http://www.ogcio.gov.hk/tc/business/tech_promotion/ccli/terms/doc/hkscs-2008-big5-iso.txt	0%	Avira URL Cloud	safe
http://www.medikoo.com/)	1%	Virustotal		Browse
http://www.malloc.de).	0%	Avira URL Cloud	safe
http://wiki.ecmascript.org/doku.php?id=harmony:egal	0%	Avira URL Cloud	safe
http://www.ntg.nl/pipermail/ntg-pdftex/2004-July/000654.html	0%	Avira URL Cloud	safe
http://www.unix.org).	0%	Avira URL Cloud	safe
http://me.abelcheung.org/articles/research/what-is-cp951/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://travis-ci.org/libffi/libffi.svg?branch=master)	README.md.0.dr	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=310299	dbcs-data.js.0.dr	false		high
http://eksempel.dk	da.pak.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ftp.gnu.org/gnu/texinfo/	texinfo.tex.0.dr	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=912470#c31	dbcs-data.js.0.dr	false		high
https://support.google.com/chrome/answer/6098869?hl=es	es.pak.0.dr	false		high
https://support.google.com/chrome/answer/6098869	ro.pak.0.dr, da.pak.0.dr, nb.pak.0.dr, fa.pak.0.dr, hr.pak.0.dr, hu.pak.0.dr, pt-BR.pak.0.dr, sk.pak.0.dr, bn.pak.0.dr, pt-PT.pak.0.dr, fil.pak.0.dr, ca.pak.0.dr, de.pak.0.dr, pl.pak.0.dr, en-GB.pak.0.dr, sr.pak.0.dr, ko.pak.0.dr	false		high
https://github.com/electron/electron/issues/1404#issuecomment-194391247	AppAdapter.js.0.dr	false		high
http://stackoverflow.com/a/6155063/376773	index.js57.0.dr	false		high
https://www.gnu.org/software/autoconf-archive/ax_require_defined.html	ax_require_defined.m4.0.dr	false		high
http://www.medikoo.com/)	package.json10.0.dr, package.json25.0.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP950.TXT	dbcs-data.js.0.dr	false		high
https://dl.bintray.com/$	BintrayProvider.js.0.dr	false		high
http://ecma-international.org/ecma-262/6.0/#sec-patterns).	index.js64.0.dr	false		high
http://encoding.spec.whatwg.org/#big5-encoder	dbcs-data.js.0.dr	false		high
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/includes)	includes.md.0.dr	false		high
http://www.yaml.org/spec/1.2/spec.html#id2799784	js-yaml.mjs.0.dr	false		high
http://www.ogcio.gov.hk/en/business/tech_promotion/ccli/terms/doc/2003cmp_2008.txt	dbcs-data.js.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/mathiasbynens/String.prototype.repeat/blob/4a4b567def/repeat.js	shim.js11.0.dr	false		high
https://github.com/node-ffi-napi/get-symbol-from-current-process-h#readme	package.json7.0.dr	false		high
https://nodejs.org/api/fs.html#fs_stat_time_values)	copy.js.0.dr	false		high
https://lodash.com/)	index.js64.0.dr	false		high
https://github.com/mathiasbynens/String.fromCodePoint/blob/master	shim.js13.0.dr	false		high
http://closure-library.googlecode.com/svn/docs/	clear.js.0.dr	false	Avira URL Cloud: safe	unknown
https://bugs.chromium.org/p/chromium/issues/entry?template=Safety	sr.pak.0.dr, ko.pak.0.dr	false		high
https://github.com/winstonjs/winston)	AppUpdater.js.0.dr	false		high
https://github.com/electron-userland/electron-builder/pull/5524	MacUpdater.js.0.dr	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=162431	dbcs-data.js.0.dr	false		high
http://mathiasbynens.be/notes/javascript-unicode#iterating-over-symbols	string.js.0.dr	false		high
http://github.com/libffi/libffi.	README.md.0.dr	false		high
http://www8.plala.or.jp/tkubota1/unicode-symbols-map2.html	dbcs-data.js.0.dr	false	Avira URL Cloud: safe	unknown
https://lodash.com/icon.svg	package.json24.0.dr	false		high
http://www.haible.de/bruno/charsets/conversion-tables/Big5.html	dbcs-data.js.0.dr	false	Avira URL Cloud: safe	unknown
https://github.com/isaacs/node-graceful-fs.git	package.json8.0.dr	false		high
http://norbertlindenberg.com/2012/05/ecmascript-supplementary-characters/	shim.js13.0.dr	false	Avira URL Cloud: safe	unknown
http://gee.cs.oswego.edu/dl/html/malloc.html	dlmalloc.c.0.dr	false		high
http://documentcloud.github.com/underscore/#compact	compact.js.0.dr	false		high
https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updat	dependabot.yml.0.dr	false		high
https://eksempel.dk.Brug	da.pak.0.dr	false	Avira URL Cloud: safe	unknown
https://www.perl.org/	missing.0.dr	false		high
https://github.com/ashtuchkin/iconv-lite/wiki/Javascript-source-file-encodings	index.js62.0.dr	false		high
https://github.com/electron/electron/issues/11505	electronHttpExecutor.js.0.dr	false		high
http://EditorConfig.org	.editorconfig0.0.dr, .editorconfig1.0.dr, .editorconfig2.0.dr	false		high
http://www.khngai.com/chinese/charmap/tblgbk.php?page=0	dbcs-data.js.0.dr	false		high
https://github.com/electron-userland/electron-builder/issues/1105	AppUpdater.js.0.dr	false		high
https://github.com/tc39/proposal-global)	global-this.md.0.dr	false		high
https://git.io/debug_fd)	node.js0.0.dr	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/a/1712051/1910191	AppImageUpdater.js.0.dr	false		high
https://www.python.org/psf/)	LICENSE11.0.dr	false		high
http://www.opensource.org	LICENSE11.0.dr	false		high
https://github.com/npm/node-semver.git	package.json1.0.dr	false		high
https://github.com/python/cpython/blob/v3.9.0rc1/Lib/argparse.py	argparse.js.0.dr	false		high
http://www.pythonlabs.com/logos.html	LICENSE11.0.dr	false	Avira URL Cloud: safe	unknown
http://underscorejs.org/LICENSE	index.js64.0.dr	false		high
https://www.gnu.org/software/coreutils/	configure.0.dr	false		high
https://jquery.org/	index.js64.0.dr	false		high
http://github.com/node-ffi-napi/node-ffi-napi	package.json3.0.dr	false		high
http://www.cwi.nl)	LICENSE11.0.dr	false	Avira URL Cloud: safe	low
http://moztw.org/docs/big5/	dbcs-data.js.0.dr	false		high
https://github.com/isaacs/node-graceful-fs#readme	package.json8.0.dr	false		high
http://www.ogcio.gov.hk/tc/business/tech_promotion/ccli/terms/doc/hkscs-2008-big5-iso.txt	dbcs-data.js.0.dr	false	Avira URL Cloud: safe	unknown
http://yaml.org/type/)	default.js.0.dr	false		high
https://github.com/axios/axios/issues/69	http.js0.0.dr	false		high
http://www.ctan.org/tex-archive/fonts/eurosym.	texinfo.tex.0.dr	false		high
https://github.com/electron-userland/electron-builder/issues/2964	AppImageUpdater.js.0.dr	false		high
https://github.com/nodejs/node/blob/master/lib/internal/url.js	index.js16.0.dr	false		high
https://www.gnu.org/software/autoconf-archive/ax_compiler_vendor.html	ax_compiler_vendor.m4.0.dr	false		high
https://ctan.org/texarchive/macros/texinfo/texinfo/doc/epsf.tex.	texinfo.tex.0.dr	false		high
https://github.com/electron-userland/electron-builder/pull/3111#issuecomment-405033227	AppUpdater.js.0.dr	false		high
http://www.malloc.de).	dlmalloc.c.0.dr	false	Avira URL Cloud: safe	low
https://github.com/mathiasbynens/String.prototype.codePointAt	shim.js7.0.dr	false		high
http://wiki.ecmascript.org/doku.php?id=harmony:egal	is.js.0.dr	false	Avira URL Cloud: safe	unknown
http://www.2ality.com/2014/01/efficient-string-repeat.html	shim.js11.0.dr	false		high
https://github.com/joyent/node/issues/1726	node.js0.0.dr	false		high
https://www.gnu.org/software/texinfo/	texinfo.tex.0.dr	false		high
https://lists.gnu.org/archive/html/automake/2012-07/msg00001.html	configure.0.dr	false		high
https://www.gnu.org/software/texinfo.	texinfo.tex.0.dr	false		high
http://www.unicode.org/Public/MAPPINGS/OBSOLETE/EASTASIA/OTHER/BIG5.TXT)	dbcs-data.js.0.dr	false		high
http://www.gnu.org/gethelp/	ltmain.sh.0.dr	false		high
https://github.com/electron-userland/electron-builder/issues/3021	AppUpdater.js.0.dr	false		high
https://github.com/jprichardson/node-fs-extra/issues/269	copy.js.0.dr	false		high
https://lists.gnu.org/archive/html/automake/2012-07/msg00014.html	configure.0.dr	false		high
http://gcc.gnu.org/ml/java/1999-q3/msg00174.html	ffi.h0.0.dr, ffi.h.0.dr	false		high
http://stackoverflow.com/questions/8458984	js-yaml.mjs.0.dr, exception.js.0.dr	false		high
https://travis-ci.org/libffi/libffi)	README.md.0.dr	false		high
https://github.com/electron-userland/electron-builder).	package.json0.0.dr	false		high
http://www.ntg.nl/pipermail/ntg-pdftex/2004-July/000654.html	texinfo.tex.0.dr	false	Avira URL Cloud: safe	unknown
http://mathiasbynens.be/notes/javascript-encoding#surrogate-formulae	shim.js7.0.dr	false		high
https://ci.appveyor.com/project/atgreen/libffi)	README.md.0.dr	false		high
https://encoding.spec.whatwg.org/#index-big5-pointer:	dbcs-data.js.0.dr	false		high
http://www.unix.org).	dlmalloc.c.0.dr	false	Avira URL Cloud: safe	low
https://github.com/electron-userland/electron-builder/issues/1150#issuecomment-436891159	AppUpdater.js.0.dr	false		high
http://www.gnu.org/software/libtool/	ltmain.sh.0.dr	false		high
https://www.gnu.org/software	missing.0.dr	false		high
https://encoding.spec.whatwg.org/#index-big5-pointer)	dbcs-data.js.0.dr	false		high
https://github.com/zeit/ms.git	package.json21.0.dr	false		high
https://github.com/megahertz/electron-log)	AppUpdater.js.0.dr	false		high
https://www.gnu.org/software/autoconf-archive/ax_cc_maxopt.html	ax_cc_maxopt.m4.0.dr	false		high
http://me.abelcheung.org/articles/research/what-is-cp951/	dbcs-data.js.0.dr	false	Avira URL Cloud: safe	unknown
http://www.gnu.org/licenses/	ltmain.sh.0.dr, bhaible.exp.0.dr, libtool.m4.0.dr	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	752683
Start date and time:	2022-11-23 19:01:57 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	pK6oGXjugD.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean7.winEXE@1/1025@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 99.6% (good quality ratio 95.2%) Quality average: 80.3% Quality standard deviation: 27.3%
HCA Information:	Successful, ratio: 100% Number of executed functions: 83 Number of non-executed functions: 102
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, conhost.exe, backgroundTaskHost.exe
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Program Files (x86)\????????\locales\am.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	154369
Entropy (8bit):	5.008301713077239
Encrypted:	false
SSDEEP:	3072:nJ1NSM/92t7Rh4rgEkDvuHq/VoZLokijEG/yZJjh6oVjUWRSuo90kef97ZVt1nnu:nzym+u9QfCx30jH8+x
MD5:	5C617F3833923FCA5717A549FA57ADCA
SHA1:	0102AC3C8041FAB6A1A65A3BCAF7E79C0B7FD719
SHA-256:	5F323C0BD185D5BD5F7EA737018F14FD6EA500BA5440BC74F5C09B635518EADC
SHA-512:	87034E798355875F3459567ED1F11E5455FC5ADC9634EEC33E9DB2446451FEBF7F35F617709A9B09BF3BC52F195EDEA0CB47D474D2C11CA93A8B5383142D45E9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	............j.f4..k.u4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..5..\|..5..}..5.... 5....%5....-5....55....=5....D5....K5....R5....S5....T5.....5.....5.....5.....5.....6.....6.....6.....6...."6....>6....p6.....6.....6.....6.....6.....6.....6.....6.....7.....7....$7....+7....B7....N7....[7....}7....7..+..7..,..7../..7..0..7..1.88..2.T8..3.d8..4..8..5..8..6.69..7.^9..>..9..?..9..N..9..g..9..i..9..j..9..k..9..l..9...I.9...I.:...I3;...I<;...J{;...J.;...J.;...J.;...J.;...J.;...J.<...J#<...J\|<...J.<...J.<...J.<...J.<...J.=.. J.=..!J.=.."J.=..#J.=..$J.=..%J(>..&J.>..'J??..)J.?..J.@..+JL@..,Jb@../J.@..0JlA..1J\|B..2J.B..3J.B..5J+C..6J.C..7J.D..8J.D..9J.E..:J@E..;J_G..<J\|H..=JWI..>J.I..@J.J..BJ.J..CJ4J..DJGJ..EJ`J..FJ.J..KJ2K..LJsK..MJ*L..NJFL..OJrL..PJ.L..QJ-M..RJ.M..SJ.N..TJXN..WJ.O..ZJUO..\JdO..]JjO..^JsO.._J.O..`J.O..aJ.O..bJ.O..cJ.P..dJ.P..eJGP..fJxP..gJ.P..hJ.Q..iJYQ..kJrQ..mJ.Q..nJ.Q..oJ.Q..pJ.Q..qJzR..tJqU..wJ.U..xJ.U..yJ.V..zJ#V..{JSV..}JwV...J.V...J.W...J\|W

C:\Program Files (x86)\????????\locales\ar.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	156996
Entropy (8bit):	5.084198860333123
Encrypted:	false
SSDEEP:	3072:91mmOGHNSNRZaJTGxRh+7iMuxHSM2uZtE9yKBZ1F/R2bKSI1+/BI1Iir2L2p:zjOlNRQs+7i0g/BI1Zp
MD5:	8F9C8DD93B03202220B5E226C6956025
SHA1:	8290DBA9B8DCC89928821EAD04F7CF599C0BA557
SHA-256:	E7F9A474399C0CA0DAF28C6153F6EC7AE87423E66C8FFE0849407471D20B6237
SHA-512:	3EB0B80CC7243ED646CFC7BE31EB27F0AA15F2AA8A5D2C50C3E5EFD8A81759637E3F986C5C294262FF3BC94A939BB3803268B4EDA46B3CFE224F596BFB4ED00A
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	............j.Z4..k.i4..l.t4..n.\|4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..4..\|..4..}..5.....5.....5....!5....)5....15....85....?5....F5....H5.....5.....5.....5.....5....'6....6.....6....86....X6....x6.....6.....6.....6.....6.....6.....6.....6.....6.....7.....7.....7....17....97....L7....n7....7..+..7..,..7../..7..0..7..1..8..2..8..3.08..4.W8..5.~8..6..8..7..9..>.79..?.B9..N.]9..g.k9..i.n9..j.r9..k.w9..l..9...I.9...I.9...I.:...I.:...J#;...J+;...J<;...JO;...Js;...J.;...J.;...J.;...J.<...J.<...J=<...JC<...Jh<...J}<.. J.<..!J"=.."J<=..#JW=..$J[=..%J}=..&J.=..'JP>..(J.>..)J.?..*J.?..+J.?..,J.@../JG@..0J.@..1J.A..2J.B..3J1B..5JpB..6J.C..7J.D..8J.D..9J.D..:J!E..;J>I..<J.K..=J.L..>J.M..@JRM..BJ\M..CJsM..DJ.M..EJ.M..FJ.M..KJ.N..LJ.N..MJmO..NJ.O..OJ.O..PJ(P..QJ.P..RJ5Q..SJ.Q..TJ.R..WJ.S..ZJmS..[J{S..\J.S..]J.S..^J.S.._J.S..`J.S..aJ.T..bJ.T..cJ.T..dJNT..eJ.T..fJ.T..gJXU..hJwU..iJ.U..kJ.U..mJ.U..nJ.U..oJ.V..pJ=V..qJBW..tJB_..wJ._..xJ._..zJ._..{J.`..}J>`...JS`...J.`...JDa...J.a

C:\Program Files (x86)\????????\locales\bg.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	170110
Entropy (8bit):	4.813810055718465
Encrypted:	false
SSDEEP:	3072:P3504qAG1u0PSFq8HyyW4nSpbBqjnUmIKW3RZzrzCLy8Asgiamd3vNgT72eM+sUS:P35vqpTPaTo4njmZzrmLy8ADINW72eMz
MD5:	00D012A55A50BBA5DE8B2FC2E0D163B2
SHA1:	89163FA9905876167A0C7D3446BCB0BD30F88EF4
SHA-256:	BD3A3AACC3CEE9864404755EEE9542E0F21EFBEBD4A71E5333D15783D4CE18C9
SHA-512:	3BD6C774729F3531D316917DEB7D8FE977C5BF5A3E85846F061C4AF5FB6C45F79D8A3557A47D4569AD52819B3CCAB13D386A9F5C1801E25E969E194A956D40A2
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	........(...j..4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..5..y..5..z..5..\|."5..}.45....<5....A5....I5....Q5....Y5....`5....g5....n5....o5....p5.....5.....5.....5.....6....96....;6....?6....K6....^6....y6.....6.....6.....7....77....>7....A7....B7....V7....l7.....7.....7.....7.....7.....7.....7.....8...)8..+.,8..,.J8../..8..0..8..1..9..2.+9..3.N9..4..9..5..9..6.8:..7.\:..>..:..?..:..N..:..g..:..i..:..j..:..k..:..l..:...I.:...I1;...I.<...I.<...J.<...J.<...J.=...J!=...JW=...J.=...J.=...J.>...J >...JF>...JX>...J.>...J.>.. J(?..!Jo?.."J.?..#J.?..$J.?..%J.@..&JT@..'J0A..(J.A..)J.B..J.B..+J.C..,J7C../JhC..0JSD..1J.E..2J.E..3J.E..5J7F..6J.G..7J.G..8J.G..9J.G..:J!H..;J.I..<J.J..=JXK..>J.K..@J.L..BJ.L..CJ.L..DJ@L..EJhL..FJ.L..KJ]M..LJ.M..MJqN..NJ.N..OJ.N..PJ1O..QJ.O..RJrP..SJ.Q..TJ^Q..WJ.R..ZJ.R..\J.R..]J.S..^J.S.._J?S..`JjS..aJ.S..bJ.S..cJ.S..dJ.S..eJ6T..fJlT..gJ.T..hJ.U..iJ^U..kJkU..mJ.U..nJ.U..oJ.U..pJ.V..qJ.V..tJ>Y..wJ.Y..xJ.Y..yJ)Z..zJ7Z..{JKZ..}J}Z...J.Z...Jt[...J.[

C:\Program Files (x86)\????????\locales\bn.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	221799
Entropy (8bit):	4.419808794496792
Encrypted:	false
SSDEEP:	768:fPjRXprzuB7CPIqPp2nKEZ3UzKoZ4CfrNuduY0Jri0CI58JRKgqZBiCYWY0PnxRB:fbbNp2KGCDjr58JMgqbxRRImv7hfUHm/
MD5:	80C804A82C617E7E0FC1E7F0DF63290C
SHA1:	A81F3AC6E92785E4C96E7DBD01FCA8BFD446071A
SHA-256:	B4ED891E8B38452623348DA12D325B52407446114CBA664A8E25A26A7CFAF773
SHA-512:	919856917F185DCAA6204A0B990E49498EF59B72CF93F8B6DA44785F4E889B70C0B05300AC15009260DDB36A8D4F06FEE5D8C4796E60A43C2957EA436F7316BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	............j.j4..k.y4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..5..\|..5..}..5....%5....5....25....:5....?5....G5....N5....U5....\5....]5....^5.....5.....6....=6....h6.....6.....6.....6.....6.....6.....7....A7....o7.....7.....7.....7.....7.....7.....7.....8.....8....28....S8....b8....z8.....8....8..,..8../..9..0..9..1..9..2..9..3..9..4..:..5.x:..6..:..7.4;..>..;..?..;..N..;..g..;..i..;..j..;..k..;..l..<...I.<...I]<...I=>...IY>...J.>...J.>...J.>...J.>...J/?...JK?...J}?...J.?...J.@...J'@...JR@...Jh@...J.@...J.@.. JdA..!J.A.."J.A..#J.B..$J2B..%J.B..&J.B..'J0D..(J7E..)JAF..*JlF..+J.F..,J.F../JDG..0J.H..1J.J..2J.J..3J.J..5JqK..6J.L..7J.M..8J.N..9J,N..:J.N..;J.Q..<J.S..=J.T..>J.U..@J.U..BJ.U..CJ.V..DJ'V..EJVV..FJ.V..KJ.W..LJ)X..MJ3Y..NJPY..OJ.Y..PJ.Y..QJ.Z..RJJ[..SJ.\..TJh\..WJ.]..ZJ<^..[JX^..\Jt^..]J}^..^J.^.._J.^..`J._..aJb_..bJc_..cJ._..dJ._..eJ.`..fJ?`..gJ.`..hJ.a..iJEa..kJXa..mJ.a..nJ.a..oJ.a..pJQb..qJSc..tJ.h..wJ.h..xJ.i..yJsi..zJ.i..{J.i..}J.j...J/j...J6k

C:\Program Files (x86)\????????\locales\ca.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	108499
Entropy (8bit):	5.413075728378605
Encrypted:	false
SSDEEP:	3072:Em2DPcgrI54tBL8l/oq7O5awat8PU02he8X/FS0bzRhqRRhnAkpxlCEtT3nRA39u:EvPcgkoqO5a78PUzhe8X/80nEznAkpxl
MD5:	79EC325651589F138C7840C61316D8F5
SHA1:	37503EDCAE710E2D61F390064FA2D9893D4B9C8D
SHA-256:	9A4E286A58BB9A58E9E30D982783663C9BCE40730CB6DAD4C37980038040919E
SHA-512:	F00A9354871C77947D2B99E83B54BABCB46B5A45C24702C1B5F750156ABCB2A00D12C6B4C2E15634D4D560DE0AFA5B9C368D31F08CF447F2209F51C0B8EF6384
Malicious:	false
Preview:	........&...j.~4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..5..y..5..z..5..\|..5..}.05....85....=5....E5....M5....U5....\5....c5....j5....k5....l5.....5.....5.....5.....5.....6.....6.....6.....6.... 6....06....F6....]6....r6.....6.....6.....6.....6.....6.....6.....6.....6.....6.....6.....6.....6.....6....7..+..7..,.!7../.K7..0.P7..1..7..2..7..3..7..4..7..5..7..6..8..7.08..>.D8..?.N8..N.a8..g.n8..i.q8..j.u8..k.z8..l..8...I.8...I.8...I.9...I.9...J.9...J.9...J.9...J.9...J.9...J.9...J.:...J$:...Ja:...Jm:...J.:...J.:...J.:...J.:.. J.:..!J ;.."J5;..#JJ;..$JM;..%Jg;..&J.;..'J.<..(J.<..)J.=..J"=..+JL=..,J[=../Jz=..0J.>..1J.>..2J.>..3J.?..5JC?..6J.?..7J)@..8J:@..9JF@..:Jl@..;J.A..<J.B..=J.B..>J.B..@J.C..BJ.C..CJ.C..DJ(C..EJ<C..FJaC..KJ.C..LJ.C..MJ?D..NJaD..OJtD..PJ.D..QJ.E..RJeE..SJ.E..TJ.E..WJ.F..ZJ.F..[J.F..\J.F..]J.F..^J.F.._J.F..`J.G..aJ$G..bJ%G..cJ:G..dJ=G..eJkG..fJ.G..gJ.G..hJ.G..iJ.H..kJ.H..mJBH..nJGH..oJUH..pJ.H..qJ.H..tJxJ..wJ.J..xJ.J..yJ.J..zJ.J..{J.K..}J2K...JFK

C:\Program Files (x86)\????????\locales\cs.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	110242
Entropy (8bit):	5.8210765375728135
Encrypted:	false
SSDEEP:	1536:6G+wdXqt5qYSP7ymjLEwoVD33zSYoYlBw/dhRRkP+8QUQdbiE:JvXPjyfaYl6/P2+8QUQdbd
MD5:	0325D16A747CCA73A3A2B0C94FAC123D
SHA1:	E5989627742ECEE5F8996001002E97627BFBE10D
SHA-256:	C00829FC57C7E1E5419FE3202F114D394A590B8B32B1E55AF42772C93755945D
SHA-512:	B824297DF25C097251432FA72AE1258092E692FF3E4C527599897D7D3E71007CBD80E300DE54B87146889F71D537C7D297C1B3CAC04B6E08D7CE29132EC9E5DC
Malicious:	false
Preview:	............j.j4..k.y4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..5..\|..5..}..5....$5....)5....15....95....A5....H5....O5....V5....W5....X5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....)6....86....I6....P6....S6....T6....a6....n6....u6....}6.....6.....6.....6.....6.....6....6..+..6..,..6../..7..0..7..1.I7..2.W7..3.e7..4..7..5..7..6..7..7..7..>..8..?..8..N.#8..g.8..i.-8..j.18..k.68..l.A8...IF8...I_8...I.9...I.9...JA9...JH9...JN9...JT9...Jo9...Jz9...J.9...J.9...J.9...J.9...J.9...J.9...J.:...J.:.. Jd:..!J.:.."J.:..#J.:..$J.:..%J.:..&J.:..'JK;..(J.;..)J.<..*J1<..+J_<..,Jn<../J.<..0J.=..1J.=..2J.=..3J.=..5J'>..6J.>..7JP?..8Jb?..9Ju?..:J.?..;J.A..<J.B..=JPC..>J.C..@J.C..BJ.C..CJ.C..DJ.C..EJ.C..FJ.D..KJTD..LJrD..MJ.D..NJ.D..OJ.E..PJDE..QJ.E..RJ.E..SJ&F..TJQF..WJ.F..ZJ.G..[J.G..\J.G..]J"G..^J%G.._J;G..`JSG..aJbG..bJeG..cJvG..dJyG..eJ.G..fJ.G..gJ.H..hJ.H..iJ3H..kJ:H..mJ]H..nJdH..oJqH..pJ.H..qJ.I..tJ&L..wJ;L..xJOL..zJ.L..{J.L..}J.L...J.L...JZM

C:\Program Files (x86)\????????\locales\da.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	100898
Entropy (8bit):	5.423694312690139
Encrypted:	false
SSDEEP:	1536:mjAsKH2oFmMFyHlqByQxTdofWfZg5Q4+xEGqZ4w8pOmPEFh/j4O:mM9WohFyFnQBf2+xgL1/r
MD5:	29F37A66AD8035D0657A1C7176330C40
SHA1:	EBF26AFA557B44FF5248207425083C750A397F49
SHA-256:	6DA77A20FD6FBB228B2DE5F197225342DA18CBC58D26EBF542CF20D23E00F033
SHA-512:	4C360F13C499A9B4B8E2B6F29EFECEDCC571130B90CB93A3C21486642704711DB0A182B63B3BE307B39C382DE73787269822AF76AF9032E4F9C4A5596EAE8E50
Malicious:	false
Preview:	........)...j..4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..5..y..5..z..5..\|.$5..}.65....>5....C5....K5....S5....[5....b5....i5....p5....q5....r5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....#6....76....I6....P6....S6....T6....[6....d6....j6....m6....t6.....6.....6.....6.....6....6..+..6..,..6../..6..0..6..1..7..2..7..3.&7..4.@7..5.X7..6..7..7..7..>..7..?..7..N..7..g..7..i..7..j..7..k..7..l..7...I.7...I.8...I.8...I.8...J.8...J.8...J.8...J.9...J/9...J79...JF9...JR9...J.9...J.9...J.9...J.9...J.9...J.9.. J.:..!J,:.."J::..#JJ:..$JP:..%Jf:..&J.:..'J.:..(JH;..)J.;..J.;..+J.;..,J.;../J.<..0J\|<..1J.=..2J.=..3J<=..5Jg=..6J.=..7JF>..8JO>..9J^>..:Jx>..;J.?..<J/@..=J.@..>J.@..@J.A..BJ.A..CJ.A..DJ#A..EJ-A..FJgA..KJ.A..LJ.A..MJFB..NJ_B..OJpB..PJ.B..QJ.B..RJ2C..SJ}C..TJ.C..WJ4D..ZJ]D..\JeD..]JkD..^JnD.._J.D..`J.D..aJ.D..bJ.D..cJ.D..dJ.D..eJ.D..fJ.E..gJRE..hJdE..iJzE..kJ.E..mJ.E..nJ.E..oJ.E..pJ.E..qJ0F..tJLH..wJcH..xJ~H..yJ.H..zJ.H..{J.H..}J.H...J.H...JfI

C:\Program Files (x86)\????????\locales\de.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	108417
Entropy (8bit):	5.4792271676996425
Encrypted:	false
SSDEEP:	1536:hHbausrKfikXgkNahUnNqRPIYvfrxWRQNCLubXpkHxQ1NlkGfChxCPQl9v83Opra:pinhUnN1dLq+H8Nr40PyqyrsS0
MD5:	5F9F5187B2C3A4BBE6077A329EF5C2C1
SHA1:	68AB6991F89F5C41C055B07FD97EA6D394D87F12
SHA-256:	E964D841B9588B7412F1FF86F004E6B052F993BF2153E4DC4BEE6C5536BE1744
SHA-512:	560A90D24C5FBA776AE526033163CE61662978599C4B171F0BDBC80C72206A9443ED1AAB58819AE71345ECAFA795527C0673C12B73BA7AC381B7DEF7BBBEE118
Malicious:	false
Preview:	............j.T4..k.c4..l.n4..n.v4..o.{4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..4..\|..4..}..5.....5.....5.....5....#5....+5....25....95....@5....A5....B5....{5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6....(6....A6....Z6....a6....d6....e6....o6....y6.....6.....6.....6.....6.....6.....6.....6....6..+..6..,..6../..7..0..7..1.;7..2.I7..3.R7..4.y7..5..7..6..7..7..7..>..8..?..8..N.+8..g.68..i.98..j.=8..k.F8..l.L8...IY8...Iv8...IJ9...IT9...Jx9...J.9...J.9...J.9...J.9...J.9...J.9...J.9...J):...J7:...JG:...JP:...J`:...Jo:.. J.:..!J.:.."J.:..#J.:..$J.;..%J(;..&JY;..'J.;..(Jp<..)J.=..J*=..+JS=..,Jd=../Jx=..0J.>..1J.>..2J.>..3J.?..5J8?..6J.?..7J"@..8J)@..9J4@..:JU@..;JsA..<J.A..=J.B..>J.B..@J.C..BJ.C..CJ.C..DJ C..EJ/C..FJfC..KJ.C..LJ.C..MJpD..NJ.D..OJ.D..PJ.D..QJ!E..RJuE..SJ.E..TJ.F..WJ.F..ZJ.F..\J.F..]J.F..^J.F.._J.F..`J.G..aJ,G..bJ-G..cJ@G..dJCG..eJmG..fJ.G..gJ.G..hJ.G..iJ.H..kJ%H..mJCH..nJMH..oJ[H..pJ~H..qJ.H..tJ}J..wJ.J..xJ.J..yJ.J..zJ.J..{J.K..}J!K...J0K...J.K

C:\Program Files (x86)\????????\locales\el.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	188491
Entropy (8bit):	4.875423021643058
Encrypted:	false
SSDEEP:	3072:lA6xGMCiJFTYkDuTX9yGwSREF3IVMRm5ppFFSqu/EFMeELO+niKh52hfZPXYlXSG:lAACiJFMkDuTyF3IiRm5ppFLzFMeF+n/
MD5:	F4083CF1C56EDB2D8701FC1809C9D8EC
SHA1:	909337883E1F898C98DE9B35F7889D257E5455B2
SHA-256:	B624633365C19E6E3CBE200B39889711994809796DBEE7988883165D0CC1D6C2
SHA-512:	27726B5CF51760D6938C17E3B1346F0F9C36940A94FBB9428D9BA8809598E07D7C5429FCFC3EC56EA795D65555B4D19676CDC299D0F8937C503D92CB87B80EE4
Malicious:	false
Preview:	............j.n4..k.}4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..5..\|..5..}. 5....(5....-5....55....=5....E5....L5....S5....Z5....[5....\5.....5.....5.....6....C6....\|6....~6.....6.....6.....6.....6.....6.....7....=7....j7....q7....t7....u7.....7.....7.....7.....7.....7.....7.....8.....8....J8..._8..+.b8..,..8../..8..0..8..1.m9..2..9..3..9..4..9..5.;:..6..:..7..:..>..;..?.;..N.K;..g._;..i.b;..j.f;..k.k;..l.u;...Iz;...I.;...I8=...IP=...J.=...J.=...J.=...J.=...J.>...J.>...Jc>...Jw>...J.>...J.?...J0?...JD?...Jf?...J.?.. J&@..!Jm@.."J.@..#J.@..$J.@..%J.A..&J.A..'JxB..(JDC..)J<D..*JbD..+J.D..,J.D../J.E..0J3F..1J.G..2J.G..3J.H..5JSH..6JNI..7J.I..8J.J..9J8J..:J}J..;JrL..<JOM..=JTN..>J.N..@J.O..BJ#O..CJ>O..DJOO..EJnO..FJ.O..KJ8P..LJ.P..MJ.Q..NJ.Q..OJ.Q..PJtR..QJ8S..RJ.S..SJ.T..TJ.T..WJ.V..ZJqV..[J.V..\J.V..]J.V..^J.V.._J.V..`J.W..aJ#W..bJ$W..cJCW..dJFW..eJsW..fJ.W..gJSX..hJkX..iJ.X..kJ.X..mJ.X..nJ.Y..oJ.Y..pJVY..qJ.Y..tJ.\..wJ.]..xJ=]..yJ.]..zJ.]..{J.^..}J>^...J[^

C:\Program Files (x86)\????????\locales\en-GB.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	89514
Entropy (8bit):	5.4765832263521075
Encrypted:	false
SSDEEP:	1536:c1BQQyiGUaBWTHjrDXApScz4RrgasTX65iBxgwSOiJedMJrV0h5BvVfm3ggl+qRR:c/QJDU9HjHBVsdBxgXM523ggl+qH
MD5:	B8B8DE138E6CD2AD1EEE182F2BEFC905
SHA1:	ACB5FBB8D3026D2CF0D5AFCC0B2407F7DC7F7CEE
SHA-256:	4A5E6439C6731A5273970C8C053B4A89018C57F1D9BE81D85F24978233675442
SHA-512:	C5575F68AEE1284A82A47E4D412DF6175550BDE1D8FFD3845D295F88687ECE4A7C04F0AB9FCAB78182FCABB6876CCB9A1F6EE815B0ABC0EB96FE59F5FF849E4B
Malicious:	false
Preview:	........(...j..4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..5..y..5..z..5..\|."5..}.45....<5....A5....I5....Q5....Y5....`5....g5....n5....o5....p5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....%6....:6....A6....D6....E6....M6....U6....\6....a6....f6....q6....u6....\|6.....6....6..+..6..,..6../..6..0..6..1..7..2..7..3..7..4.-7..5.D7..6.v7..7..7..>..7..?..7..N..7..g..7..i..7..j..7..k..7..l..7...I.7...I.7...Ir8...Ix8...J.8...J.8...J.8...J.8...J.8...J.8...J.8...J.8...J!9...J+9...J:9...J>9...JH9...JQ9.. J.9..!J.9.."J.9..#J.9..$J.9..%J.9..&J.:..'J]:..(J.:..)J.;..J.;..+J=;..,JI;../JZ;..0J.;..1J.<..2J.<..3J.<..5J.<..6J/=..7J.=..8J.=..9J.=..:J.=..;J.>..<J+?..=J.?..>J.?..@J.?..BJ.?..CJ.?..DJ.@..EJ.@..FJ*@..KJ`@..LJ.@..MJ.@..NJ.@..OJ.A..PJ(A..QJ~A..RJ.A..SJ.B..TJ'B..WJ.B..ZJ.B..[J.B..\J.B..]J.B..^J.B.._J.B..`J.C..aJ C..bJ!C..cJ,C..dJ/C..eJPC..fJjC..gJ.C..hJ.C..iJ.C..kJ.C..mJ.C..nJ.C..oJ.D..pJ!D..qJoD..tJ.E..wJ.E..xJ.E..yJ.F..zJ.F..{J!F..}J;F...JEF

C:\Program Files (x86)\????????\locales\en-US.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	90228
Entropy (8bit):	5.468679281798329
Encrypted:	false
SSDEEP:	1536:lnI8PwZKfs9B0fYSED0TI4RVQ2trM8M5Xx5dBxgZSO0JedMVrBHhBeVfD3ggl+CA:LEKE2YStRdMLBxgsvBq3ggl+CGwG
MD5:	AF5C77E1D94DC4F772CB641BD310BC87
SHA1:	0CEEB456E2601E22D873250BCC713BAB573F2247
SHA-256:	781EF5AA8DCE072A3E7732F39A7E991C497C70BFAEC2264369D0D790AB7660A4
SHA-512:	8C3217B7D9B529D00785C7A1B2417A3297C234DEC8383709C89C7FF9296F8ED4E9E6184E4304838EDC5B4DA9C9C3FE329B792C462E48B7175250EA3EA3ACC70C
Malicious:	false
Preview:	........2...j..4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..5..w..5..y.!5..z.05..\|.65..}.H5....P5....U5....]5....e5....m5....t5....{5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....$6....96....N6....U6....X6....Y6....a6....i6....p6....u6....z6.....6.....6.....6.....6....6..+..6..,..6../..6..0..6..1..7..2.&7..3.,7..4.@7..5.W7..6..7..7..7..>..7..?..7..N..7..g..7..i..7..j..7..k..7..l..7...I.7...I.7...I.8...I.8...J.8...J.8...J.8...J.8...J.8...J.8...J.8...J.8...J49...J=9...JL9...JP9...JZ9...Jc9.. J.9..!J.9.."J.9..#J.9..$J.9..%J.9..&J.:..'Jf:..(J.:..)J.;..J";..+JG;..,JS;../Jh;..0J.;..1J.<..2J.<..3J.<..5J.<..6J7=..7J.=..8J.=..9J.=..:J.=..;J.>..<J_?..=J.?..>J.@..@J(@..BJ.@..CJ8@..DJ?@..EJJ@..FJf@..KJ.@..LJ.@..MJ.A..NJ0A..OJ@A..PJhA..QJ.A..RJ.B..SJDB..TJhB..WJ.B..ZJ.C..[J.C..\J.C..]J#C..^J'C.._J9C..`JOC..aJbC..bJcC..cJnC..dJqC..eJ.C..fJ.C..gJ.C..hJ.C..iJ.D..kJ.D..mJ4D..nJ8D..oJGD..pJcD..qJ.D..tJ.F..wJ3F..xJBF..yJaF..zJgF..{J~F..}J.F...J.F

C:\Program Files (x86)\????????\locales\es-419.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	106030
Entropy (8bit):	5.373963649438172
Encrypted:	false
SSDEEP:	1536:Y1zfcN6nwhQppC6SGDYjRbqZrtlaUuzHjqXGiMdePcHYD9KeO0KWFsMH5BthDViT:ahnwhQu6Psl6pMFmI2Be
MD5:	84A1995559E8FC00C3E46BA63EFF51A6
SHA1:	24B57BABEE3291419FC29AAB9C9A2FC0FE9C3D8A
SHA-256:	2E1CF9D3E3EEBE607DA44873CFE37B9A84615962E3450313C3947920D4DE4FDA
SHA-512:	1B8453367BBEB12F237F850EB0EF67D4B6CAA973F2E6ACCDAE6FF5B7B3991D5BE2C5D76F787D2C7CA5A10D2D0A92B47FD55141C9D900C850F80CD916ABF5425A
Malicious:	false
Preview:	........%...j.\|4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..5..y..5..z..5..\|..5..}..5....65....;5....C5....K5....S5....Z5....a5....h5....i5....j5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....06....H6....`6....g6....j6....k6....t6....}6.....6.....6.....6.....6.....6.....6.....6....6..+..6..,..7../.&7..0./7..1.e7..2.y7..3..7..4..7..5..7..6..8..7."8..>.:8..?.D8..N.Y8..g.e8..i.h8..j.l8..k.q8..l.y8...I~8...I.8...If9...Io9...J.9...J.9...J.9...J.9...J.9...J.9...J.9...J.9...J':...J2:...JL:...JS:...Jp:...J.:.. J.:..!J.;.."J.;..#J%;..$J;..%JH;..&Jv;..'J.;..(Ja<..)J.<..*J.=..+J1=..,JD=../Jd=..0J.=..1J.>..2J.>..3J.>..5J$?..6J.?..7J.@..8J.@..9J!@..:JF@..;J'A..<J.A..=J(B..>J.B..@J.B..BJ.B..CJ.B..DJ.B..EJ.B..FJ.C..KJKC..LJ{C..MJ.C..NJ.D..OJ.D..PJGD..QJ.D..RJ.E..SJ\E..TJ.E..WJWF..ZJ.F..[J.F..\J.F..]J.F..^J.F.._J.F..`J.F..aJ.F..bJ.F..cJ.F..dJ.F..eJ'G..fJEG..gJ.G..hJ.G..iJ.G..kJ.G..mJ.G..nJ.G..oJ.G..pJ.H..qJzH..tJ.J..wJ.J..xJ;J..yJkJ..zJtJ..{J.J..}J.J...J.J

C:\Program Files (x86)\????????\locales\es.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	108109
Entropy (8bit):	5.35370843761187
Encrypted:	false
SSDEEP:	1536:CPOLX5pxZkWBvJdYx/TFKYM3vtdThgFW9XlhgoThoK/rh2L1w3Oy:C2vkwcx4v5F1tYC3z
MD5:	4ACAD14261FA458CBC61451F4255C891
SHA1:	BFBF2429190B85F692BC97D12822CEDD53A70742
SHA-256:	B927984D25359F3D7A20D71AA4B16D2EC4C574461177825B5221865F416D1E71
SHA-512:	24A71134F5C8F3E03B29491E11D0D0D2B9988C2528593C753893986C6DB6FF2BD88E2E5389B086E0785E24141894441EFE3DB976111E2AD5EE5AFBF7374FEC1D
Malicious:	false
Preview:	........)...j..4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..5..y..5..z..5..\|.$5..}.65....>5....C5....K5....S5....[5....b5....i5....p5....q5....r5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....16....D6....\6....t6....{6....~6.....6.....6.....6.....6.....6.....6.....6.....6.....6.....6....6..+..6..,..7../..7..0.57..1.j7..2.~7..3..7..4..7..5..7..6..8..7.'8..>.<8..?.F8..N.[8..g.g8..i.j8..j.n8..k.w8..l..8...I.8...I.8...I.9...I.9...J.9...J.9...J.9...J.9...J.9...J.9...J.:...J.:...JZ:...Je:...J.:...J.:...J.:...J.:.. J.:..!J2;.."JB;..#JT;..$JY;..%Jw;..&J.;..'J.<..(J.<..)J.=..J+=..+JV=..,Jf=../J.=..0J.>..1J.>..2J.>..3J.>..5J.?..6J.?..7J.?..8J.?..9J.@..:J0@..;J+A..<J.A..=J.B..>JwB..@J.B..BJ.B..CJ.B..DJ.B..EJ.B..FJ.B..KJNC..LJ~C..MJ.C..NJ.D..OJ'D..PJjD..QJ.D..RJ:E..SJ.E..TJ.E..WJuF..ZJ.F..[J.F..\J.F..]J.F..^J.F.._J.F..`J.F..aJ.G..bJ.G..cJ.G..dJ.G..eJCG..fJfG..gJ.G..hJ.G..iJ.G..kJ.G..mJ.H..nJ.H..oJ.H..pJCH..qJ.H..tJ.J..wJ3J..xJQJ..yJyJ..zJ.J..{J.J..}J.J...J.J

C:\Program Files (x86)\????????\locales\et.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	96956
Entropy (8bit):	5.455086908059335
Encrypted:	false
SSDEEP:	1536:BnHIHEpX0aM3DS4xyGXcen6dg9NzuLECchVjpsPQHXG:BnHiEiaMe4x06NyLiV2PQHW
MD5:	3F2F42E0E8FFE5C26295F5E15480EDCA
SHA1:	E183E93FE99145CE0471687E930926018B1FCC19
SHA-256:	9CDEFC472C67247E67DA040B984E800CC8B903A1B39C742E6962FF5C423F391E
SHA-512:	BB61DA1665100B59433D03D05FCD074D36E07EA3C29F2F7C5305E2B560E2A2A8FC508D38B45798D98CD3C1987165667CD723726397E3D1E4BE006C17EFE11C3B
Malicious:	false
Preview:	............j..4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..5..w..5..y..5..z.(5..\|..5..}.@5....H5....M5....U5....]5....e5....l5....s5....z5....{5....\|5.....5.....5.....5.....5.....5.....5.....6.....6.....6...."6....26....A6....V6....j6....q6....t6....u6....~6.....6.....6.....6.....6.....6.....6.....6.....6....6..+..6..,..6../..7..0..7..1.G7..2.R7..3.^7..4.u7..5..7..6..7..7..7..>..7..?..8..N..8..g..8..i.!8..j.%8..k.,8..l.38...I>8...IZ8...I.9...I.9...J69...J=9...JI9...JR9...Ji9...Jo9...J.9...J.9...J.9...J.9...J.9...J.9...J.:...J.:.. Ja:..!J.:.."J.:..#J.:..$J.:..%J.:..&J.:..'JG;..(J.;..)J.<..J1<..+JT<..,Jb<../J{<..0J.<..1J.=..2J.=..3J.=..5J.=..6Ji>..7J.>..8J.>..9J.>..:J.?..;J.@..<J.@..=J.@..>J%A..@J?A..BJGA..CJSA..DJZA..EJlA..FJ.A..KJ.A..LJ.A..MJVB..NJvB..OJ.B..PJ.B..QJ.C..RJXC..SJ.C..TJ.C..WJ:D..ZJXD..\J_D..]JbD..^JgD.._J}D..`J.D..aJ.D..bJ.D..cJ.D..dJ.D..eJ.D..fJ.E..gJcE..hJ.E..iJ.E..kJ.E..mJ.E..nJ.E..oJ.E..pJ.F..qJ^F..tJ.G..wJ.G..xJ.G..yJ.H..zJ.H..{J0H..}JPH...J^H...J.H

C:\Program Files (x86)\????????\locales\fa.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	151026
Entropy (8bit):	5.181938015353535
Encrypted:	false
SSDEEP:	3072:QXP4Rawpa8C96NS9/W2ESEmGzR2XQmN4o6TwNv7fizfb8YIO8jdr8TwatK/E3oLF:QXP4Rawpa8C96NS9/W2ESEmGV2XQmN4s
MD5:	0FBE88D360ABC020EF6D511FF5CB70A5
SHA1:	8ABC47BC30BB0128B84CA4335DC09A67B051EDF4
SHA-256:	7E8F7F42300178F001EA5F74C63DB25D813B7C25989114DC7673C76FD92A72C9
SHA-512:	1EB2F414521B4EAD4ECCC26305CF89EDDF2A9E26BC5E8D100946A8B442694E48DF6FDCDE858197B23CDD47C83ED7C316D280A642017E7516C5DB73C3322FBA26
Malicious:	false
Preview:	............j.B4..k.Q4..l.\4..n.d4..o.i4..p.v4..q.\|4..r..4..s..4..t..4..v..4..w..4..y..4..z..4..\|..4..}..4.....4.....5.....5.....5.....5.... 5....'5.....5....05....x5.....5.....5.....5.....5.....6.....6.....6....#6....:6....`6....}6.....6.....6.....6.....6.....6.....6.....6.....6.....6.....7.....7....27....`7...s7..+.v7..,..7../..7..0..7..1..8..2..8..3.,8..4.]8..5..8..6..8..7.'9..>.`9..?.k9..N..9..g..9..i..9..j..9..k..9..l..9...I.9...I.9...I.:...I.;...JO;...JW;...Jl;...Jy;...J.;...J.;...J.;...J.;...JQ<...Jb<...J.<...J.<...J.<...J.<.. J-=..!Ja=.."J\|=..#J.=..$J.=..%J.=..&J0>..'J.?..(J.?..)J.@..J.@..+J*A..,J;A../JbA..0JMB..1J.C..2J.C..3J.C..5J,D..6J.D..7J.E..8J.E..9J.E..:J+F..;J.H..<J.I..=J.J..>J.J..BJ!K..CJ=K..DJKK..EJbK..FJ.K..KJ-L..LJ.L..MJ.M..NJ<M..OJcM..PJ.M..QJ-N..RJ.N..SJ#O..TJ`O..WJ,P..ZJ{P..\J.P..]J.P..^J.P.._J.P..`J.P..aJ.P..bJ.P..cJ.Q..dJ.Q..eJ]Q..fJ.Q..gJ.R..hJ>R..iJvR..kJ.R..mJ.R..nJ.R..oJ.R..pJ.S..qJ.S..tJ!W..wJ.W..xJ.W..yJ.X..zJ!X..{J_X..}J.X...J.X...JGY...J.Y...J.Z...JEZ

C:\Program Files (x86)\????????\locales\fi.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	99485
Entropy (8bit):	5.416956540869923
Encrypted:	false
SSDEEP:	3072:6EsQoWFTTTqWU9S0JEji18vlhROdA0EjjNM1TO9mRX:6EFf7iE218vUd4shX
MD5:	0C5F18712C639646E37FED054781B147
SHA1:	FAECB7CB6838783E15BC52C8DC019736A334D59B
SHA-256:	4E538A14F1DBC872A85FDB4BE1E19145553ECFA3B07EE7C810B690C52B889684
SHA-512:	EF9F1158C35045BBEF92FE70D9006CD7DCC3C834F5A4BEBA5B269AD6C16F9790E316B7E2617100567919AD647A1353CFA8B80D5EDE23CEC9E5F7AE9B4E49C154
Malicious:	false
Preview:	............j.h4..k.w4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..5..\|..5..}..5...."5....'5..../5....75....?5....F5....M5....T5....U5....V5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....(6....76....>6....A6....B6....K6....S6....Z6...._6....f6....u6....}6.....6.....6....6..+..6..,..6../..6..0..6..1.'7..2.57..3.D7..4.`7..5.z7..6..7..7..7..>..7..?..7..N..8..g.&8..i.)8..j.-8..k.28..l.:8...I?8...I\8...I.9...I)9...JZ9...Ja9...Ji9...Jt9...J.9...J.9...J.9...J.9...J.9...J.9...J.:...J.:...J.:...J-:.. Js:..!J.:.."J.:..#J.:..$J.:..%J.:..&J.;..'Js;..(J.;..)J5<..JH<..+Jr<..,J.<../J.<..0J,=..1J.=..2J.=..3J.>..5J?>..6J.>..7J.?..8J.?..9J$?..:JG?..;J3@..<J.@..=J.A..>JRA..@JrA..BJvA..CJ.A..DJ.A..EJ.A..FJ.A..KJ.B..LJ)B..MJ}B..NJ.B..OJ.B..PJ.B..QJ.C..RJ[C..SJ.C..TJ.C..WJ5D..ZJ_D..\JgD..]JoD..^JtD.._J.D..`J.D..aJ.D..bJ.D..cJ.D..dJ.D..eJ.D..fJ.E..gJQE..hJhE..iJ.E..kJ.E..mJ.E..nJ.E..oJ.E..pJ.E..qJKF..tJ.G..wJ.G..xJ.G..yJ.G..zJ.G..{J.H..}J2H...JBH...J.H

C:\Program Files (x86)\????????\locales\fil.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	110288
Entropy (8bit):	5.196308788997154
Encrypted:	false
SSDEEP:	1536:3NqmgtbTGldYzVgQNjLeyspz4NvuNpEWnGkuljgOAM64CzPEchYkZzk17PaXmAMD:sbTEd07PjgOAaCzh7VSKmAW
MD5:	249AC7111D6310C67B42E973F6AA7646
SHA1:	DB19F2FA4EEEEC09906ED31BF6295E7831BF9E2C
SHA-256:	CB536B478FEFFD3B55EC53676CCE84CEFC9E000C1205273BAFCDAF6EE6EDD381
SHA-512:	E96D000925BE9FAE898602F5D62AE3E642E91AA2957D723FFDFE9CAC9BD277BA2155BE31620FBC326D5CC43D47A0E08314FE27688A6EAF786491D6B39A52A00A
Malicious:	false
Preview:	........(...j..4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..5..y..5..z..5..\|."5..}.45....<5....A5....I5....Q5....Y5....`5....g5....n5....o5....p5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....!6....:6....Q6....j6....q6....t6....u6.....6.....6.....6.....6.....6.....6.....6.....6.....6....6..+..6..,..7../..7..0.77..1.k7..2.\|7..3..7..4..7..5..7..6..7..7..8..>..8..?.68..N.I8..g.T8..i.W8..j.[8..k.`8..l.n8...Is8...I.8...ID9...IL9...J.9...J.9...J.9...J.9...J.9...J.9...J.9...J.9...J.:...J+:...J::...J@:...JP:...J_:.. J.:..!J.:.."J.:..#J.:..$J.;..%J.;..&J?;..'J.;..(J.<..)J.<..J.<..+J.<..,J.<../J.=..0J.=..1JY>..2Jk>..3J.>..5J.>..6J#?..7J.?..8J.?..9J.?..:J.@..;JxA..<J:B..=J.B..>J*C..@JKC..BJUC..CJiC..DJqC..EJ.C..FJ.C..KJ.C..LJ.D..MJ~D..NJ.D..OJ.D..PJ.D..QJOE..RJ.E..SJ.E..TJ"F..WJ.F..ZJ.F..[J.F..\J.G..]J.G..^J.G.._J'G..`JCG..aJXG..bJYG..cJjG..dJmG..eJ.G..fJ.G..gJ.H..hJ"H..iJ>H..kJJH..mJrH..nJxH..oJ.H..pJ.H..qJ!I..tJMK..wJmK..xJ.K..yJ.K..zJ.K..{J.K..}J.K...J.L

C:\Program Files (x86)\????????\locales\fr.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	116529
Entropy (8bit):	5.3861872833068585
Encrypted:	false
SSDEEP:	3072:40CdiDv3ixbJPRQUClLZky86mQKyIwKByroFDuFcZYjlguPyNn/Uv:4/sPixdPR3ClLZky86myIwKgrwDuFAHE
MD5:	A9552C30B27ACA538388BA34C2374D75
SHA1:	39173220E9DA4C3D591BDB1D0DBBA77DC8FBA6DE
SHA-256:	F3BFCD6A297A7634C24F2FBD3DE96F02588B0603D4A7618BB7588F6C091BEB2E
SHA-512:	F6D01A2B0C03741092858B7616DE8B52662B73A00E49B2D7B5E1A05195EDDAE507C432557B2BF8697EC0B8E3B620FA3F38BA577A7EDD909556D73498FCFFB9DA
Malicious:	false
Preview:	............j.l4..k.{4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..5..\|..5..}..5....&5....+5....35....;5....C5....J5....Q5....X5....Y5....Z5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6....,6....D6....K6....N6....O6....W6...._6....h6....n6....u6.....6.....6.....6.....6....6..+..6..,..6../..6..0..7..1.C7..2.V7..3.`7..4.~7..5..7..6..7..7..7..>..8..?..8..N.08..g.<8..i.?8..j.C8..k.H8..l.N8...IQ8...Ip8...IB9...II9...Jm9...Jx9...J.9...J.9...J.9...J.9...J.9...J.9...J5:...J>:...JT:...J_:...Jv:...J.:.. J.:..!J.;.."J.;..#J0;..$J2;..%JV;..&J.;..'J.<..(J.<..)J5=..JQ=..+Jw=..,J.=../J.=..0J8>..1J.?..2J.?..3J4?..5Jf?..6J.?..7J.@..8J.@..9J.@..:J.A..;J.B..<J.C..=JLD..>J.D..BJ.D..CJ.D..DJ.D..EJ.D..FJ E..KJnE..LJ.E..MJ.F..NJ2F..OJEF..PJzF..QJ.F..RJeG..SJ.G..TJ.G..WJ.H..ZJ.H..[J.H..\J.H..]J.H..^J.I.._J.I..`J(I..aJ;I..bJ<I..cJSI..dJ^I..eJ.I..fJ.I..gJ.I..hJ.J..iJ'J..kJ5J..mJXJ..nJ`J..oJnJ..pJ.J..qJ.K..tJ.M..wJ.M..xJ.M..zJ.N..{J!N..}J=N...JRN...J.N...J.O

C:\Program Files (x86)\????????\locales\gu.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	212334
Entropy (8bit):	4.468693017407305
Encrypted:	false
SSDEEP:	3072:vLx83is0a1A626ZO8n308LcKHdO3C362oY5maBeQOo5qP2G/KO4ue5GS2TsfWsjE:vL18qxv
MD5:	CF428ECEC583B73172FA789BA3F9AA6B
SHA1:	9A7456009B5A53C4F6470A370319395DA394E462
SHA-256:	1D4D407233A4C78D5A9A242B43B21AA89FB68A0632BC52B0A515D69491632E85
SHA-512:	2F86F9679E04B8188D7CE44BF0A7BF4B998D9771E9A8A83B4BE4DBA5E5D21EBF6A00091792896D9A8D4ED38EAECD43D8D2CAD920237AF1EA702DADC0341BE9C9
Malicious:	false
Preview:	............j.n4..k.}4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..5..\|..5..}. 5....(5....-5....55....=5....E5....L5....S5....Z5....[5....\5.....5.....5....)6....Z6.....6.....6.....6.....6.....6.....7....$7....C7....p7.....7.....7.....7.....7.....7.....7.....7.....8....'8....H8....T8....v8.....8....8..+..8..,..8../..9..0.=9..1..9..2..9..3..9..4..:..5.H:..6..:..7..:..>.9;..?.L;..N..;..g..;..i..;..j..;..k..;..l..;...I.;...I.;...Ij=...I.=...J.=...J.=...J.=...J.>...J@>...JS>...J.>...J.>...Jw?...J.?...J.?...J.?...J.?...J.@.. J.@..!J.A.."J.A..#JWA..$JjA..%J.A..&J.B..'J&C..(J'D..)J0E..J^E..+J.E..,J.E../J#F..0JkG..1J)I..2JFI..3J.I..5J.J..6J8K..7J[L..8J.L..9J.L..:J5M..;J.P..<JRR..=JxS..>J.S..@J`T..BJpT..CJ.T..DJ.T..EJ.T..FJ!U..KJ.U..LJ2V..MJ9W..NJcW..OJ.W..PJ.W..QJ.X..RJ.Y..SJ`Z..TJ.Z..WJ.[..ZJD\..[J`\..\J.\..]J.\..^J.\.._J.\..`JK]..aJ.]..bJ.]..cJ.]..dJ.]..eJ.^..fJc^..gJ._..hJ-_..iJ._..kJ._..mJ.`..nJ.`..oJ8`..pJ.`..qJla..tJ.f..wJ.f..xJ4g..yJ.g..zJ.g..{J.g..}J*h...JMh

C:\Program Files (x86)\????????\locales\he.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	132154
Entropy (8bit):	4.844933793112407
Encrypted:	false
SSDEEP:	3072:IH8reuJQWaOKXLpiglHN58nX3XTnw2FCC9V:DeuJWhXLpiglHN58nHXTnw2FCC9V
MD5:	A275C3557E819C6E9FB029643E38FA17
SHA1:	8C005CB081417FF2BE0D7D8FB6356519A96F5703
SHA-256:	4A9862EE8E139AE74E6336E0207D484E1A1AE0F689B5F1CC06B6FEA66D2090D9
SHA-512:	72936FFB29AD5B7FAB17357286EEE7FA9A6B933423FC8618B19FDD841B37D9CC613A35E04614CB74F69F49A4E8BF7A8B48BB55A10E160D8363DBDF697BC314C6
Malicious:	false
Preview:	............j.T4..k.c4..l.n4..n.v4..o.{4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..4..\|..4..}..5.....5.....5.....5....#5....+5....25....95....@5....A5....B5.....5.....5.....5.....5.....5.....5.....5.....6.....6....A6....X6....k6.....6.....6.....6.....6.....6.....6.....6.....6.....6.....6.....6.....6.....7..../7...:7..+.=7..,.[7../.l7..0.y7..1..7..2..7..3..7..4..8..5.18..6.u8..7..8..>..8..?..8..N..8..g..8..i..8..j..8..k..8..l..8...I.8...I.9...I.:...I.:...JM:...JW:...Ja:...Jv:...J.:...J.:...J.:...J.:...J1;...J>;...JS;...J];...Jz;...J.;.. J.;..!J#<.."J8<..#JQ<..$JY<..%J.<..&J.<..'JR=..(J.=..)J.>..J.>..+J.>..,J.>../J.?..0J.?..1J.@..2J.@..3J.@..5J0A..6J.A..7J.B..8J.B..9J.B..:J.C..;J.E..<J.F..=J.H..>JZH..@J.H..BJ.H..CJ.H..DJ.H..EJ.H..FJ.I..KJfI..LJ.I..MJ.J..NJJJ..OJaJ..PJ.J..QJ'K..RJ{K..SJ.K..TJ.L..WJ.L..ZJ.L..[J.M..\J.M..]J.M..^J M.._JEM..`JcM..aJ}M..bJ~M..cJ.M..dJ.M..eJ.M..fJ.N..gJ.N..hJ.N..iJ.N..kJ.N..mJ.O..nJ.O..oJ)O..pJdO..qJ.P..tJ.S..wJ.S..xJ.S..yJ.T..zJ(T..{JET..}JeT...JzT

C:\Program Files (x86)\????????\locales\hi.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	219113
Entropy (8bit):	4.437297845271283
Encrypted:	false
SSDEEP:	3072:+8UrfNIncwfKSIv73cdEVhkAovrCFO/S/+fm2BfvTH+f+aJBKfzzruE3b8RLljlB:/Urfm+59R
MD5:	EB017AC26477D54C707D3E965EC352C5
SHA1:	112001C7A38D9B95D3D0E422E10C585079356018
SHA-256:	06424570167C9BDD7E13B115A632D6AB58DE7A4FA14F8D094627BD12D85E9318
SHA-512:	8DFB1F8B18AE62841A40DE244CE725B9AD865B4DE7D250C0D5799F6896D274276E73672E3DE455D0312A397D20598C768462895E4A768511B7CA530717611837
Malicious:	false
Preview:	............j.P4..k._4..l.j4..n.r4..o.w4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..4..\|..4..}..5.....5.....5.....5.....5....'5.....5....55....<5....=5....>5.....5.....5.....6....B6....s6....u6....y6.....6.....6.....6.....6.....7....L7....v7....}7.....7.....7.....7.....7.....7.....7.....8....08....I8...._8.....8....8..+..8..,..8../..9..0..9..1..9..2..9..3..9..4..:..5.I:..6..:..7..:..>.C;..?.V;..N..;..g..;..i..;..j..;..k..;..l..;...I.;...I.<...I+>...ID>...J.>...J.>...J.>...J.>...J ?...J9?...J~?...J.?...JU@...Jy@...J.@...J.@...J.@...J.@.. J.A..!J.A.."J-B..#JbB..$JrB..%J.B..&J6C..'J-D..(J.E..)J.F..J:F..+JyF..,J.F../J.F..0J.H..1J.I..2J.I..3J#J..5J.J..6J.K..7J.M..8J?M..9JpM..:J.M..;J.P..<J!R..=J\S..>J.S..@J!T..BJ7T..CJVT..DJhT..EJ.T..FJ)U..KJZV..LJ.V..MJ.W..NJ.W..OJ.X..PJMX..QJ#Y..RJ.Y..SJ.Z..TJ_[..WJ.\..ZJ.\..\J.]..]J.]..^J.].._Jj]..`J.]..aJ.^..bJ.^..cJ8^..dJ;^..eJ._..fJa_..gJ._..hJ0`..kJp`..mJ.`..nJ.`..oJ.`..pJ]a..qJCb..tJ.i..wJwi..xJ.i..yJ$j..zJ:j..{J.j..}J.j...J.j...J.k...J.l

C:\Program Files (x86)\????????\locales\hr.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	105383
Entropy (8bit):	5.507562593845028
Encrypted:	false
SSDEEP:	3072:MMN0LeqtKRxAGCyle77l/XpUa+tbakWlMMoLu87R53Kkx9i:Mfyr5nKp
MD5:	551026FCBD640C1B911ED5B4CB7ADA68
SHA1:	3AAC7631C7F23E15A1ABC4FA1CEE98ACB695AADB
SHA-256:	CC48D7DEAF73103E22E3E5900503396E2A2C9E5BF1450A4DF8CE94179B1E47A2
SHA-512:	7BED851ACC8A137C481968902006917C6EABDF1476C4CD74DEA7BFA731BD45EFF6B742C4B4EF48BA9C9EB4B2BA86C09C14878C05FF797BF56DA075DA9E53BFC9
Malicious:	false
Preview:	........'...j..4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..5..y..5..z..5..\|. 5..}.25....:5....?5....G5....O5....W5....^5....e5....l5....m5....n5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....06....F6....M6....P6....Q6....\6....h6....m6....t6....\|6.....6.....6.....6.....6....6..+..6..,..6../..6..0..7..1.77..2.I7..3.X7..4.u7..5..7..6..7..7..7..>..8..?..8..N."8..g.+8..i..8..j.28..k.98..l.A8...IF8...Id8...I#9...I+9...JS9...JZ9...J`9...Jo9...J.9...J.9...J.9...J.9...J.9...J.9...J.:...J.:...J+:...J<:.. J.:..!J.:.."J.:..#J.:..$J.:..%J.:..&J&;..'J.;..(J.;..)JW<..Jk<..+J.<..,J.<../J.<..0J0=..1J.=..2J.=..3J.>..5JM>..6J.>..7J.?..8J.?..9J.?..:J.?..;J.A..<J.B..=J.C..>J.C..@J.C..BJ.C..CJ.C..DJ.D..EJ.D..FJ<D..KJ{D..LJ.D..MJ.E..NJ!E..OJ8E..PJ`E..QJ.E..RJ.F..SJeF..TJ.F..WJ G..ZJEG..\JLG..]JRG..^JXG.._JpG..`J.G..aJ.G..bJ.G..cJ.G..dJ.G..eJ.G..fJ.H..gJPH..hJeH..iJ.H..kJ.H..mJ.H..nJ.H..oJ.H..pJ.H..qJgI..tJ2L..wJGL..xJfL..yJ.L..zJ.L..{J.L..}J.L...J.L...JNM

C:\Program Files (x86)\????????\locales\hu.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	113044
Entropy (8bit):	5.646517078166082
Encrypted:	false
SSDEEP:	3072:srCzB7nRkbJiKw7UiGKAWEc2dA3RdpEtL1543ICJ:srCV2bOUiGlc1RdpEPu3ICJ
MD5:	E51AFBBA3250E655BC01E424A29E3162
SHA1:	D7AAF2F2F9629BA9F7CF8A513C2905A13D0B6A8F
SHA-256:	61AE4E65474CB4ECF5EDB2EC9BB9EA2B7A47BBF769F81C8FEE1282C13B209783
SHA-512:	57FC72149761CDF1DE5C021BF7E63D79D91EF2E54DEA57B9BD9F659DBB2C2F76DC43904C53518C00FE4CA80B92B6FC57489E275FD0006B2295F31DD45C0618EC
Malicious:	false
Preview:	............j.n4..k.}4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..5..\|..5..}. 5....(5....-5....55....=5....E5....L5....S5....Z5....[5....\5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....-6....G6....g6.....6.....6.....6.....6.....6.....6.....6.....6.....6.....6.....6.....6.....7....7..+."7..,.@7../.Q7..0.[7..1..7..2..7..3..7..4..7..5..7..6."8..7.=8..>.^8..?.k8..N.~8..g..8..i..8..j..8..k..8..l..8...I.8...I.8...Iw9...I.9...J.9...J.9...J.9...J.9...J.9...J.9...J.:...J :...Ja:...Jq:...J.:...J.:...J.:...J.:.. J.:..!J.;.."J#;..#J6;..$J;;..%JX;..&Jx;..'J.;..(J\<..)J.<..J.<..+J.=..,J,=../JI=..0J.=..1J.>..2J.>..3J.>..5J.?..6J.?..7J.?..8J.@..9J.@..:J<@..;JUA..<J.A..=JDB..>J.B..@J.B..BJ.B..CJ.B..DJ.B..EJ.B..FJ)C..KJ{C..LJ.C..MJ.D..NJ7D..OJLD..PJ.D..QJ.E..RJXE..SJ.E..TJ.E..WJ.F..ZJ.F..[J.F..\J.F..]J.F..^J.F.._J.G..`J.G..aJ?G..bJ@G..cJTG..dJWG..eJ.G..fJ.G..gJ.H..hJ0H..iJIH..kJPH..mJ.H..nJ.H..oJ.H..pJ.H..qJ&I..tJ.J..wJ.J..xJ.K..yJ.K..zJ7K..{JSK..}JpK...J.K

C:\Program Files (x86)\????????\locales\id.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	96881
Entropy (8bit):	5.341301770866197
Encrypted:	false
SSDEEP:	1536:M+zgmloUhrsGEKhU95/SWpEmNUwRKUEJ4eI8B4X1CPXsAzb2ZghlrRajcCdAbJ:M+HlukU95KWy4eIn8XsAzaZGlccCdO
MD5:	0B9E5F5651AED9D1299F3246597AC182
SHA1:	62AA835853C07E66D027D129265429ADC6779491
SHA-256:	E07BE6B1A095F235A4BABB2AD5E8018C8C1B2F7CD6FEAB170124D25898E764C6
SHA-512:	9D4C238F9506F41A43D531A762F7B8426DB83AE093433E075237EC5211451EA6F888CEB14B8A055B67E5C6BE43C0087D1C35DE558CBC6D828DA96043B98338F2
Malicious:	false
Preview:	............j.b4..k.q4..l.\|4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..4..\|..5..}..5.....5....!5....)5....15....95....@5....G5....N5....O5....P5....s5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6....'6.....6....16....26....:6....B6....J6....O6....U6....a6....h6....l6.....6....6..+..6..,..6../..6..0..6..1..6..2..7..3..7..4.67..5.H7..6.~7..7..7..>..7..?..7..N..7..g..7..i..7..j..7..k..7..l..7...I.7...I.7...I.8...I.8...J.8...J.8...J.8...J.8...J.9...J.9...J'9...J49...Js9...J\|9...J.9...J.9...J.9...J.9.. J.9..!J.:.."J.:..#J.:..$J#:..%J>:..&Jp:..'J.:..(JE;..)J.;..J.;..+J.;..,J.;../J.<..0J.<..1J]=..2Jl=..3J~=..5J.=..6J.>..7J{>..8J.>..9J.>..:J.>..;J.?..<J.@..=J.@..>J.@..@J.@..BJ.@..CJ.@..DJ.A..EJ.A..FJ&A..KJhA..LJ.A..MJ.A..NJ.A..OJ.B..PJ5B..QJ.B..RJ.B..SJ.C..TJGC..WJ.C..ZJ.C..[J.C..\J.D..]J.D..^J.D.._J#D..`J;D..aJ\D..bJ]D..cJkD..dJnD..eJ.D..fJ.D..gJ.E..hJ.E..iJ0E..kJ?E..mJ^E..nJbE..oJqE..pJ.E..qJ.E..tJOG..wJaG..xJrG..yJ.G..zJ.G..{J.G..}J.G...J.G

C:\Program Files (x86)\????????\locales\it.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	105591
Entropy (8bit):	5.277422916407698
Encrypted:	false
SSDEEP:	3072:Ub5255TLQ2Vxyi9yN4tA7kxA78dgDufZfW01c:UFw5TLQ2Vwi9yN4tA7kxA78qkZOac
MD5:	FA6ECEAAA453FB66BD631AA9BABE0026
SHA1:	790BFEFC29597D09F313C08E7B23FF298D60FA23
SHA-256:	4E2089D3FD90977F9A3A88B2AF7FA9FF3B9864969D2F4582431626AE1F37C158
SHA-512:	88EB70A25A6B76E5B3272D4BAE0721F23610DDD1284F54CB991EEF3AD78ECA13F47C6A8D79D5FB73F8FE171D5ABEA770B6902D0A1541884CBD5677F3DD4920F5
Malicious:	false
Preview:	........#...j.x4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..5..z..5..\|..5..}.5....25....75....?5....G5....O5....V5....]5....d5....e5....f5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6....!6....46....L6....b6....i6....l6....m6....{6.....6.....6.....6.....6.....6.....6.....6.....6....6..+..6..,..7../..7..0..7..1.d7..2.x7..3..7..4..7..5..7..6..8..7..8..>.08..?.;8..N.L8..g.V8..i.Y8..j.]8..k.d8..l.k8...Iq8...I.8...I]9...Id9...J.9...J.9...J.9...J.9...J.9...J.9...J.9...J.9...J:...J3:...JL:...JQ:...Jb:...Jm:.. J.:..!J.:.."J.:..#J.:..$J.;..%J.;..&JJ;..'J.;..(J.<..)J.<..J.<..+J.<..,J.<../J.=..0J.=..1Jv>..2J.>..3J.>..5J.>..6JL?..7J.?..8J.?..9J.?..:J.?..;J.A..<J.A..=J(B..>JvB..BJ.B..CJ.B..DJ.B..EJ.B..FJ.B..KJ/C..LJcC..MJ.C..NJ.C..OJ.D..PJ@D..QJ.D..RJ.D..SJSE..TJ.E..WJ+F..ZJ]F..[JeF..\JmF..]JqF..^JuF.._J.F..`J.F..aJ.F..bJ.F..cJ.F..dJ.F..eJ.F..fJ.G..gJUG..hJfG..iJ.G..kJ.G..mJ.G..nJ.G..oJ.G..pJ.G..qJ8H..tJ.J..wJ%J..xJ7J..yJ^J..zJcJ..{J.J..}J.J...J.J...J/K

C:\Program Files (x86)\????????\locales\ja.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	127428
Entropy (8bit):	5.826025776360829
Encrypted:	false
SSDEEP:	1536:T0gtNfSwl76rsWg4AkDiQ492E46Tesg+ahB+nLi0doNHVQ:Ig3fjl76IWA+4TiiAB+Li2oNHVQ
MD5:	932A8B529D16E79C1471FB8C92109EEB
SHA1:	4CEC50AF799472BEA97FC1B1A127C31D9D08B176
SHA-256:	275307A3A9708C0698565F10941C57D42E1D2F55709A025D37E588699B5A985E
SHA-512:	F2DDB70F819EF08B51C73748F2898EBC987D1D46DFA8E8EA00D2309AC51E37973310BB4F2A3503BB7AD5EF68150B01F3FE5492470D1E30FAB374159EF44F8F4B
Malicious:	false
Preview:	............j..4..k.+4..l.44..m.<4..o.Q4..p.^4..q.d4..v.s4..w..4..y..4..z..4..\|..4..}..4.....4.....4.....4.....4.....4.....4.....4.....4.....4.....4.....5.....5....D5....]5....{5.....5.....5.....5.....5.....5.....5.....5.....5.....6....@6....i6....p6....s6....\|6.....6.....6.....6.....6.....6.....6.....6.....6....6..+..6..,..7../.'7..0.07..1.u7..2..7..3..7..4..7..5..7..6.58..7.P8..>.n8..?.x8..N..8..g..8..i..8..j..8..k..8..l..8...I.8...I.8...I.9...I.9...J.:...J.:...J.:...J.:...JF:...JL:...Jm:...J.:...J.:...J.:...J.:...J.:...J.;...J-;.. J.;..!J.;.."J.;..#J.;..$J.;..%J.<..&JB<..'J.<..(JP=..)J.=..J.=..+J">..,J1>../JF>..0J.>..1J.?..2J.?..3J.?..5J;@..6J.@..7JJA..8JhA..9JzA..:J.A..;J.B..<J?C..=J.C..>J.D..@J?D..BJND..CJ`D..DJfD..EJxD..FJ.D..KJ.E..LJ:E..MJ.E..NJ.E..OJ.E..PJ.F..QJeF..RJ.F..SJ#G..TJZG..WJ.G..ZJ:H..\J@H..]JCH..^JFH.._JjH..`J.H..aJ.H..bJ.H..cJ.H..dJ.H..eJ.I..fJ4I..gJ.I..hJ.I..iJ.I..kJ.I..mJ.I..nJ.I..oJ.J..pJ.J..qJ.J..tJeL..wJ.L..xJ.L..zJ.L..{J)M..}JaM...JyM...J.N...J]N...J.N...J.O

C:\Program Files (x86)\????????\locales\kn.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	243013
Entropy (8bit):	4.364997137141875
Encrypted:	false
SSDEEP:	3072:VwI+rxPrIbgMkipVLe4wrZELNm7SIY/u5ZDu6oSPE7JQO5/d/OACAGAfKI:OI+B0bg4m7S3+ZDu6oSs7JQOV5GAfF
MD5:	9224BEB43327CAF18C4FDE76482AE12A
SHA1:	EBAA89421838C093E36D74CEC8BB3521772F29CF
SHA-256:	1A3FA5261B58113AE1A5CF140ABD93E812B4A866A19A4C54929FFFEE5F42B18B
SHA-512:	2C3AE5FD43607F34562B935BF6FB5DC62D083073F430959C4D883C188F744F49AC38D3A3BFA8C3E61113A2E4813D06FCB499FFE3CBFD07979B405B0CD6EB2432
Malicious:	false
Preview:	........"...j.v4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..5..z..5..\|..5..}.(5....05....55....=5....E5....M5....T5....[5....b5....c5....d5.....5....-6....d6.....6.....6.....6.....6.....7....57....f7.....7.....7.....8....H8....O8....R8....T8....l8.....8.....8.....8.....8.....9.....9....-9....h9....9..+..9..,..9../..9..0..9..1..:..2..:..3..:..4..;..5.c;..6..;..7..<..>.b<..?.u<..N..<..g..<..i..<..j..<..k..<..l..<...I.<...Ig=...Ib?...I.?...J.?...J.?...J.@...J5@...J.@...J.@...J.@...J.A...J.A...J.B...JIB...JXB...J.B...J.B.. JYC..!J.C.."J.C..#J,D..$JDD..%J.D..&J.E..'JNF..(JRG..)JdH..J.H..+J.H..,J(I../J.I..0J.K..1J(M..2J?M..3J.M..5J'N..6JqO..7J.P..8J+Q..9JVQ..:J.Q..;J.U..<J?W..=J.X..>JZY..BJ.Y..CJ.Z..DJ.Z..EJEZ..FJ.Z..KJ.[..LJ.\..MJ:]..NJm]..OJ.]..PJ6^..QJ3_..RJ.`..SJ.`..TJYa..WJ.b..ZJ6c..[JQc..\Jlc..]J~c..^J.c.._J.c..`J9d..aJwd..bJxd..cJ.d..dJ.d..eJ.d..fJFe..gJ.f..hJ$f..iJrf..kJ.f..mJ.f..nJ.f..oJ.g..pJsg..qJ.h..tJ.n..wJ&o..xJyo..yJ.o..zJ.o..{J9p..}Jip...J.p...J.q

C:\Program Files (x86)\????????\locales\ko.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	107006
Entropy (8bit):	6.13524501321474
Encrypted:	false
SSDEEP:	3072:L6jlXiuY72PcT5t4CuAJq/4KiWgDqbYSwnT:WjllY7e6teKQezSwT
MD5:	D6C5199671535C5B644D730C9D8C9063
SHA1:	7BC876A53B0DA752FC93A088AF1ECD043DEA6AD0
SHA-256:	0A46CCE08401A72E44178349A61CDBAE5FD78CA4F071BFF2BF5F2E8C877A25F8
SHA-512:	71F8C2A676C7E672476D578EC36D8E9B16F823FE257F7DA7C22B84DCDEBFB7C18480FB52A386F14B9D60D2AAC6C322AAEDE7D61F3032842D3BF713EDDA8CF857
Malicious:	false
Preview:	............j..4..k..4..l.'4..m./4..o.54..p.<4..q.B4..r.Q4..s.b4..t.k4..y..4..z..4..\|..4..}..4.....4.....4.....4.....4.....4.....4.....4.....4.....4.....4..../5....;5....K5....^5....n5....p5....t5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6.....6.....6....,6....26....;6....M6...Z6..+.]6..,..6../..6..0..6..1..6..2..7..3..7..4.17..5.Y7..6..7..7..7..>..7..?..7..N..7..g..7..i..7..j..7..k..7..l..8...I.8...I;8...I.8...I.9...J)9...J29...J;9...JG9...J[9...Ja9...Jn9...J~9...J.9...J.9...J.9...J.9...J.:...J':.. Jm:..!J.:.."J.:..#J.:..$J.:..%J.:..&J.;..'J.;..(J.<..)J.<..J.<..+J.<..,J.<../J.<..0J.=..1J.>..2J.>..3J.>..5J.>..6Jo?..7J.?..8J.?..9J.?..:J.@..;JA..<J.A..=J>B..>J.B..BJ.B..CJ.B..DJ.B..EJ.B..FJ.C..KJ[C..LJ.C..MJ.C..NJ.D..OJD..PJTD..QJ.D..RJ.D..SJRE..TJwE..WJ.F..ZJ3F..\J9F..]J<F..^JBF.._JVF..`JvF..aJ.F..bJ.F..cJ.F..dJ.F..eJ.F..fJ.G..gJPG..hJdG..iJ.G..kJ.G..mJ.G..nJ.G..oJ.G..pJ.G..qJ*H..tJ.I..wJ.I..xJ.I..zJ.I..{J.J..}J J...J0J...J.J...J.J...J;K...J.K...J.K...J.K

C:\Program Files (x86)\????????\locales\lt.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	114368
Entropy (8bit):	5.628766403232453
Encrypted:	false
SSDEEP:	1536:RmrvD38onfyORY5gaJzU5R8FYlKUxnaJGN5c0z5PEAy6K5rmz3MWbhg5m1NqF6Sb:Y738oKGyQfKenaIcApbXdtrqF6S05nI
MD5:	29AEEB61DF906C770E43ED477160F5BC
SHA1:	D3224DFF1967DDD1618D1573D91C3149DED8AE3E
SHA-256:	225E5784A7A616F83D81E6F3FDC5510E975E9FBDE741B673DEECE5DED1604A9D
SHA-512:	09F601216EF230C20E58391C566CAF388B0ED5421CACBC06FD50BEF242ACAC599E09F92FE63AA055DD314E0EBE9985B76016D82D32B426E51B1F63C7B888AC9A
Malicious:	false
Preview:	........!...j.t4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..5..\|..5..}.&5.....5....35....;5....C5....K5....R5....Y5....`5....a5....b5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....'6....?6....V6....]6....`6....a6....k6....v6....}6.....6.....6.....6.....6.....6.....6....6..+..6..,..6../.)7..0.,7..1.]7..2.n7..3..7..4..7..5..7..6..8..7.98..>.Y8..?.b8..N.u8..g..8..i..8..j..8..k..8..l..8...I.8...I.8...I.9...I.9...J.9...J.9...J.9...J.9...J.9...J.:...J.:...J,:...Je:...Jo:...J.:...J.:...J.:...J.:.. J.;..!J0;.."JC;..#JT;..$J[;..%Jx;..&J.;..'J"<..(J.<..)J9=..JS=..+J.=..,J.=../J.=..0JF>..1J.?..2J.?..3J4?..5J]?..6J.?..7J.@..8J.A..9J.A..:J/A..;JYC..<J.D..=J.E..>J.F..@J)F..BJ2F..CJHF..DJQF..EJdF..FJ.F..KJ.F..LJ)G..MJ.G..NJ.G..OJ.G..PJ.H..QJ.H..RJ.H..SJ7I..TJwI..WJBJ..ZJjJ..\JuJ..]J{J..^J.J.._J.J..`J.J..aJ.J..bJ.J..cJ.J..dJ.J..eJ.K..fJ$K..gJeK..hJ.K..iJ.K..kJ.K..mJ.K..nJ.K..oJ.K..pJ.L..qJ.L..tJ.P..wJ.Q..xJ&Q..yJMQ..zJUQ..{JvQ..}J.Q...J.Q...J.R

C:\Program Files (x86)\????????\locales\lv.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	113868
Entropy (8bit):	5.628642662789089
Encrypted:	false
SSDEEP:	1536:0rv+yaMchZGB5nDJSM+hzyez0YNUc8YjJ8I4WSuAhaIphcmE425BaYK/faVdX1:0rvdapZGTmUc8Yd8ScVfaVdF
MD5:	CE3CB88E12F86EB6F6AD23A4D34F49E5
SHA1:	31ED4DDBFE6BEFA49C6C28089EDB1B1617D896BD
SHA-256:	D58B6308B64A1CDA4EE0B2B395672728CE7ABB73C44961FC911386569CAEE60E
SHA-512:	5DB77B4E3FE2A2C76FC15134B7DB1C4ACDCD08CD296AA1657A08B55871353FC7F911222FF16078379A8596D401A66272A431FA9FEFF8BDA5BEDAC9D7479D02F4
Malicious:	false
Preview:	...........j..4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..5..y..5..z. 5..\|.&5..}.85....@5....E5....M5....U5....]5....d5....k5....r5....s5....t5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....,6....>6....W6....o6....v6....y6....z6.....6.....6.....6.....6.....6.....6.....6.....6.....6....6..+..6..,..7../.=7..0.M7..1..7..2..7..3..7..4..7..5..7..6..8..7.88..>.L8..?.T8..N.d8..g.n8..i.q8..j.u8..k.z8..l..8...I.8...I.8...IT9...I]9...J}9...J.9...J.9...J.9...J.9...J.9...J.9...J.9...J::...JF:...JW:...J`:...Jt:...J.:.. J.:..!J.:.."J.;..#J";..$J(;..%J=;..&Jb;..'J.;..(JT<..)J.<..J.<..+J.=..,J"=../J==..0J.=..1J.>..2J.>..3J.>..5J.?..6Jz?..7JD@..8JK@..9J\@..:J.@..;J.B..<J.C..=J=D..>J.D..@J.D..BJ.D..CJ.D..DJ.D..EJ.D..FJ.E..KJRE..LJvE..MJ.E..NJ.E..OJ.F..PJ:F..QJ.F..RJ.F..SJ&G..TJUG..WJ.G..ZJ.H..[J.H..\J"H..]JH..^J.H.._JOH..`JeH..aJ.H..bJ.H..cJ.H..dJ.H..eJ.H..fJ.H..gJ8I..hJOI..iJtI..kJ{I..mJ.I..nJ.I..oJ.I..pJ.I..qJaJ..tJIM..wJdM..xJ.M..yJ.M..zJ.M..{J.M..}J.M...J.N

C:\Program Files (x86)\????????\locales\ml.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	256394
Entropy (8bit):	4.3824317738273235
Encrypted:	false
SSDEEP:	1536:ipt3yrxsIaPEL+YBkW4m/rvFdq2C1TmHh03m:mtGpaPk/XJdPETS03m
MD5:	AA549352CE43C7F3AADCF24DB4B28039
SHA1:	52F9DE28A67E438A4B055B0988F2C4DC480A61FA
SHA-256:	E51D9A02AD11CB9825368DA9A17AF7294B7E6BF11079E2072E4BEC028ECAF20F
SHA-512:	D220AC779B5AA363E4837430FB66FC3833FE0331FBA3C634AD920F8DBA8DBB1F32FDE0EB6DA26CABD9C089326A46252DF22ADE62299D6BC37C9B0F3694E8AB51
Malicious:	false
Preview:	............j.p4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..5..\|..5..}."5....5..../5....75....?5....G5....N5....U5....\5....]5....^5.....5.....6....I6.....6.....6.....6.....6.....7.....7....?7.....7.....7.....7....(8..../8....28....48....U8....s8.....8.....8.....8.....9....09....N9....y9....9..+..9..,..9../..:..0..:..1..:..2..:..3..;..4.P;..5..;..6.J<..7..<..>..=..?.&=..N.Z=..g.\|=..i..=..j..=..k..=..l..=...I.=...I.>...I.@...I)@...J.@...J.@...J.@...J.@...J+A...J=A...J.A...J.A...JfB...J.B...J.B...J.B...J.C...J@C.. J.C..!JED.."JvD..#J.D..$J.D..%J-E..&J.E..'J.F..(J.G..)J=I..*J{I..+J.I..,J,J../JyJ..0J.L..1J:N..2JQN..3J.N..5J?O..6J.P..7J.Q..8J.Q..9J.R..:J~R..;JJU..<J]V..=J<W..>J.X..@JcX..BJ~X..CJ.X..DJ.X..EJ.X..FJlY..KJ~Z..LJ.Z..MJ.\..NJ>\..OJ.\..PJ.]..QJ.^..RJ.^..SJ._..TJ@`..WJ.a..ZJ[b..\J.b..]J.b..^J.b.._J.b..`J<c..aJvc..bJwc..cJ.c..dJ.c..eJ.d..fJPd..gJ.e..hJDe..iJ.e..kJ.e..mJ2f..nJ]f..oJ.f..pJ.f..qJ.g..tJdk..wJ.k..xJ.k..yJtl..zJ.l..{J.m..}JCm...Jkm...J.n

C:\Program Files (x86)\????????\locales\mr.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	209573
Entropy (8bit):	4.450668379803355
Encrypted:	false
SSDEEP:	3072:LM82qbqMB6D/W502ZleTc7eegSZhBFvWSLQEDE5dEBZt+TYjDR6KAu:Jwtu
MD5:	896759A28D38E5D8F415570DD6F4D85E
SHA1:	23F55CDE464192839434A1E727CEB285B8B1F82B
SHA-256:	4293AFACF1C4DCE2423C368A45FEC4B33AAC7232E7B7C1919AA8A5A20FB026A1
SHA-512:	4392943394E2EBC257ED230F993D6F0280AD4106E2623BD9A498C8CBB8DCAF05A49FB998F855FBBA637030F43E68D15DC429D71604EF285F211A9C86480C4E60
Malicious:	false
Preview:	............j.T4..k.c4..l.n4..n.v4..o.{4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..4..\|..4..}..5.....5.....5.....5....#5....+5....25....95....@5....A5....B5.....5.....5.....6...."6....o6....q6....u6.....6.....6.....6.....6.....7....>7....b7....i7....l7....n7.....7.....7.....7.....7.....7.....8.....8.... 8....U8...y8..+.\|8..,..8../..8..0..8..1.]9..2.t9..3..9..4..9..5..:..6.o:..7..:..>..:..?..;..N.0;..g.F;..i.I;..j.M;..k.R;..l.c;...Ih;...I.;...Ix=...I.=...J.=...J.=...J.=...J.>...JU>...Jn>...J.>...J.>...JZ?...Jq?...J.?...J.?...J.?...J.@.. J.@..!J+A.."JWA..#J.A..$J.A..%J.A..&J[B..'JcC..(JZD..)JTE..J.E..+J.E..,J.F../JRF..0J.G..1J.I..2J.I..3J.I..5JUJ..6J.K..7J.L..8J.L..9J.M..:JhM..;J.O..<J.P..=J.Q..>J)R..@J.R..BJ.R..CJ.R..DJ.R..EJ.S..FJaS..KJ T..LJ}T..MJsU..NJ.U..OJ.U..PJlV..QJXW..RJ.X..SJ.X..TJUY..WJ.Z..ZJ.[..[J.[..\JA[..]JP[..^J\[.._J.[..`J.[..aJ(\..bJ)\..cJR\..dJU\..eJ.\..fJ.\..gJW]..hJt]..iJ.]..kJ.]..mJ+^..nJ=^..oJT^..pJ.^..qJ2_..tJyb..wJ.b..xJ.c..yJcc..zJrc..{J.c..}J.c...J.d

C:\Program Files (x86)\????????\locales\ms.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	99639
Entropy (8bit):	5.243278535485018
Encrypted:	false
SSDEEP:	1536:Hcy5Z74bI/tcHEry1GQ/ApwYXBSBYOYSjfhos036Kw+8uDe:8yT4bIKEGqwYXBSdJo76Kp8uDe
MD5:	407DD10484A99B21FFDAE6016132BF26
SHA1:	D1D7A5524FDF026A49391522C42D059406BD0442
SHA-256:	83248A2AAEFB87FC19454AFA34BF5DF99B95B98F823B534DE0BAE552C8260D93
SHA-512:	908B71411E34EC56E77C5837A856898F929DDDC81D95A7E2B6D47F4F4E1D72B499D627A8CEC7233E4F39292F592B6A90354E6325AAFACC145C994ABEA1FF6F64
Malicious:	false
Preview:	............j.d4..k.s4..l.~4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..4..\|..5..}..5.....5....#5....+5....35....;5....B5....I5....P5....Q5....R5....\|5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....'6....@6....W6....^6....a6....b6....l6....w6.....6.....6.....6.....6.....6.....6.....6....6..+..6..,..6../..6..0..7..1.77..2.D7..3.O7..4.n7..5..7..6..7..7..7..>..7..?..7..N..8..g..8..i..8..j..8..k."8..l.8...I/8...IG8...I.8...I.8...J.9...J$9...J9...J19...JH9...JP9...Jn9...J{9...J.9...J.9...J.9...J.9...J.9...J.9.. JH:..!Jc:.."Jo:..#Jw:..$J~:..%J.:..&J.:..'J$;..(J.;..)J.;..J.<..+J(<..,J3<../JO<..0J.<..1J.=..2J.=..3J.=..5J.=..6J4>..7J.>..8J.>..9J.>..:J.>..;J.?..<JI@..=J.@..>J.@..@J.A..BJ.A..CJ!A..DJ*A..EJ9A..FJUA..KJ.A..LJ.A..MJ.B..NJ,B..OJ;B..PJhB..QJ.B..RJ.C..SJaC..TJ.C..WJ.D..ZJ@D..\JFD..]JKD..^JPD.._JbD..`JyD..aJ.D..bJ.D..cJ.D..dJ.D..eJ.D..fJ.D..gJ<E..hJQE..iJeE..kJsE..mJ.E..nJ.E..oJ.E..pJ.E..qJ.F..tJ.G..wJ.G..xJ.G..yJ.H..zJ.H..{JAH..}J\H...JlH...J.H

C:\Program Files (x86)\????????\locales\nb.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	98518
Entropy (8bit):	5.395332505716346
Encrypted:	false
SSDEEP:	1536:gom2lbcn3CeEFoivwBiXEHZqFdIm8VUvCAchEHAxF:gc4nymDHZqFdIwC7F
MD5:	1BDFC009F54C1E5BC8EEEB5017F9DE53
SHA1:	7427D3F37771886AF1C0AF1D20468960C524377D
SHA-256:	21F3EFE54A2A0ED9E2F618B2A50F89B44957BC7C779E7F88C1F10B310CEA8BD5
SHA-512:	EEE4AED543D30C7A74A64350CF67B454EC4AD56DC6A51F88DEC648B80A33146F5BD3FFADAB16A1F0B8E1FFE427F56F58A86DA748ED1B118EA7FA72610D84C07A
Malicious:	false
Preview:	............j.n4..k.}4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..5..\|..5..}. 5....(5....-5....55....=5....E5....L5....S5....Z5....[5....\5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....%6....(6....)6....06....86....C6....G6....N6....Y6....`6....d6....\|6....6..+..6..,..6../..6..0..6..1..6..2..6..3..7..4.$7..5.97..6.p7..7..7..>..7..?..7..N..7..g..7..i..7..j..7..k..7..l..7...I.7...I.7...I.8...I.8...J.8...J.8...J.8...J.8...J 9...J(9...J@9...JM9...J.9...J.9...J.9...J.9...J.9...J.9.. J.:..!J1:.."JA:..#JQ:..$JW:..%Jl:..&J.:..'J.;..(Jv;..)J.;..J.;..+J.<..,J.<../J*<..0J.<..1J2=..2JA=..3JQ=..5J}=..6J.=..7JG>..8JW>..9Jd>..:J.>..;Jn?..<J.?..=JR@..>J.@..@J.@..BJ.@..CJ.@..DJ.@..EJ.@..FJ.A..KJBA..LJmA..MJ.A..NJ.B..OJ.B..PJQB..QJ.B..RJ.B..SJCC..TJnC..WJ.D..ZJCD..\JJD..]JPD..^JSD.._JgD..`J.D..aJ.D..bJ.D..cJ.D..dJ.D..eJ.D..fJ.D..gJ/E..hJAE..iJZE..kJbE..mJ.E..nJ.E..oJ.E..pJ.E..qJ.F..tJsG..wJ.G..xJ.G..yJ.G..zJ.G..{J.G..}J.H...J!H...J.H

C:\Program Files (x86)\????????\locales\nl.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	101895
Entropy (8bit):	5.3499106046374685
Encrypted:	false
SSDEEP:	3072:u6KTrYE5am7spkFjegH7IINejowGTielwo6ytW9:kNjeKqRmUyc9
MD5:	FA16E91633AA0F20E49B7E19BB57AACB
SHA1:	595D392D20DF35ED71F4461CD5C85B77A68612F1
SHA-256:	E94551CA94505F068ECD0619AF676B7B3A869F6068AF87F0F537CACE8055BA4B
SHA-512:	D3FA50F247CB216E07D4905BFEC4AB39D15BBC9B60CF0E3DC733BDCD2A0CBB1F8513589C40111335797248119E59AB2D2D46C2CF18C496796FD4B7233A829A30
Malicious:	false
Preview:	........$...j.z4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..5..z..5..\|..5..}.,5....45....95....A5....I5....Q5....X5...._5....f5....g5....h5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....)6....D6....U6....\6...._6....`6....m6....z6.....6.....6.....6.....6.....6.....6.....6....6..+..6..,..6../..6..0..7..1.B7..2.N7..3.[7..4.v7..5..7..6..7..7..7..>..7..?..8..N..8..g.'8..i.8..j..8..k.58..l.;8...I@8...I\8...I/9...I89...JV9...J^9...Jd9...Jn9...J.9...J.9...J.9...J.9...J.9...J.9...J.9...J.:...J.:...J.:.. J]:..!J{:.."J.:..#J.:..$J.:..%J.:..&J.:..'JK;..(J.;..)J.<..*J%<..+JR<..,Ja<../Ju<..0J.<..1J.=..2J.=..3J.=..5J.=..6Jc>..7J.>..8J.>..9J.>..:J.?..;J.@..<J.@..=J.A..>JNA..@JqA..BJzA..CJ.A..DJ.A..EJ.A..FJ.A..KJ.B..LJ=B..MJ.B..NJ.B..OJ.B..PJ.C..QJoC..RJ.C..SJ.C..TJ+D..WJ.D..ZJ.D..[J.D..\J.E..]J.E..^J.E.._J#E..`J=E..aJOE..bJPE..cJ[E..dJ^E..eJ.E..fJ.E..gJ.E..hJ.F..iJ'F..kJ.F..mJJF..nJRF..oJ`F..pJ.F..qJ.F..tJ.H..wJ.H..xJ.H..yJ.H..zJ.H..{J.I..}J/I...JBI

C:\Program Files (x86)\????????\locales\pl.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	110678
Entropy (8bit):	5.741625091591969
Encrypted:	false
SSDEEP:	1536:t8ZTz/RoRMa8odxIQW6AeJJzg349OM4oNsNYyhIi+3ZyL5kA:t8Nz/eIQDg3Y4rYIIi+3Ze
MD5:	DA0BFC4EF754490879E8DD567961064A
SHA1:	F331C571422C5BB85F90FE915756AD9787103C24
SHA-256:	C57C2E534DA554E42388815CD3E848630ED46E1E61E640A6F3D4FD7CBDFB2AED
SHA-512:	1CCDE932C1354FC0880AFB7EB1FE9A8B93297CFBB21E0DBDB78A07B116B951672A2D1DD25E0DC94FA1384AC7BB22A007B468A391457851BF8C88EFB9708A7F37
Malicious:	false
Preview:	........%...j.\|4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..5..y..5..z..5..\|..5..}..5....65....;5....C5....K5....S5....Z5....a5....h5....i5....j5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....(6....>6....U6....\6...._6....`6....k6....w6.....6.....6.....6.....6.....6.....6.....6....6..+..6..,..6../..7..0.&7..1.U7..2.d7..3.m7..4..7..5..7..6..7..7..7..>..8..?..8..N./8..g.98..i.<8..j.@8..k.E8..l.L8...IQ8...Io8...I=9...ID9...Jp9...Jw9...J}9...J.9...J.9...J.9...J.9...J.9...J.:...J.:...J.:...J3:...J@:.. J.:..!J.:.."J.:..#J.:..$J.:..%J.:..&J.;..'J.;..(J.;..)Ju<..J.<..+J.<..,J.<../J.<..0Ji=..1J.>..2J)>..3J;>..5Js>..6J.>..7J.?..8J.?..9J.?..:J.?..;J.A..<J.B..=JRC..>J.C..@J.C..BJ.C..CJ.C..DJ.C..EJ.C..FJ.D..KJFD..LJjD..MJ.D..NJ.D..OJ.D..PJ!E..QJxE..RJ.E..SJ.F..TJ5F..WJ.F..ZJ.F..[J.F..\J.F..]J.F..^J.G.._J.G..`J.G..aJHG..bJIG..cJ`G..dJcG..eJ.G..fJ.G..gJ.G..hJ.G..iJ.H..kJ.H..mJ?H..nJEH..oJRH..pJrH..qJ.H..tJ.K..wJ.K..xJ.L..yJDL..zJLL..{J^L..}JyL...J.L...J.M

C:\Program Files (x86)\????????\locales\pt-BR.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	105311
Entropy (8bit):	5.420675337894776
Encrypted:	false
SSDEEP:	1536:TTEl8e6Vb//PtDjipJtpm/QzrKj0Y0X4xhBc6x0xGUY3yDeMTwO5e:fEl8eyb/XR9/QrKJL5XMTlk
MD5:	31E00C1FDFB9F86D7F5B5B285689CFF8
SHA1:	C5131466499D78C7282F29B3B12F8934A139991F
SHA-256:	ED9ADACAD575344216EE986E9C04908A5093AA7A0EBFBF2549DF4C668A35F356
SHA-512:	B36B87330B29F99CA32D781175F1FD485FA034EAFA2458F4191B70BDBFB2866FD56EDB0E97CE7232B0DC3135B939EB7AC1161B1002D9322DBC7EE016B8069F09
Malicious:	false
Preview:	........%...j.\|4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..5..y..5..z..5..\|..5..}..5....65....;5....C5....K5....S5....Z5....a5....h5....i5....j5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6.....6..../6....E6....[6....b6....e6....f6....o6....x6.....6.....6.....6.....6.....6.....6.....6....6..+..6..,..6../..7..0..7..1.;7..2.N7..3.X7..4.\|7..5..7..6..7..7..7..>..7..?..8..N..8..g.%8..i.(8..j.,8..k.18..l.88...I=8...IX8...I.9...I.9...J?9...JG9...JM9...J^9...J.9...J.9...J.9...J.9...J.9...J.9...J.9...J.9...J.:...J.:.. J[:..!J}:.."J.:..#J.:..$J.:..%J.:..&J.:..'Jf;..(J.;..)JN<..Jh<..+J.<..,J.<../J.<..0JW=..1J+>..2JA>..3JU>..5J.>..6J.>..7J\|?..8J.?..9J.?..:J.?..;J?A..<J.A..=J.B..>J.B..@J!C..BJ)C..CJ5C..DJ?C..EJNC..FJqC..KJ.C..LJ.C..MJHD..NJZD..OJoD..PJ.D..QJ.E..RJUE..SJ.E..TJ.E..WJvF..ZJ.F..\J.F..]J.F..^J.F.._J.F..`J.F..aJ.F..bJ.F..cJ.G..dJ.G..eJ0G..fJWG..gJ.G..hJ.G..iJ.G..kJ.G..mJ.G..nJ.H..oJ.H..pJ3H..qJ.H..tJ.J..wJ.J..xJ.J..yJ.K..zJ.K..{J7K..}JWK...JiK...J.K

C:\Program Files (x86)\????????\locales\pt-PT.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	106331
Entropy (8bit):	5.4055438207415145
Encrypted:	false
SSDEEP:	1536:tcJdPoUL5qsr/y2VfgE5fcBw4d6hrxz2qKHWhLtOAZ12kR9C:+ksrbr0Bw9VtOAz2kzC
MD5:	F33190E2616875ED2349115E128A54FB
SHA1:	27E44FB2CDFECC19F5C91FF2F2E69956CD59BE57
SHA-256:	DA64B5178BB41BE0684CB3EF1204BECB457520FE4960C3252F5CCD6A9EE9E29A
SHA-512:	3020DA0FDCF7984557EF7AF1C9F0E7CBD1BF364A8841E6671CEC4B517AC89E9C4BED680A2A2E76B18DB5E2D10C7F1A41C5758306E3F20EB248796B2BE6E02FCB
Malicious:	false
Preview:	...........j..4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..5..y..5..z. 5..\|.&5..}.85....@5....E5....M5....U5....]5....d5....k5....r5....s5....t5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6.... 6....46....K6....b6....i6....l6....m6....v6.....6.....6.....6.....6.....6.....6.....6.....6....6..+..6..,..6../..7..0..7..1.N7..2.a7..3.k7..4..7..5..7..6..7..7..8..>.$8..?./8..N.D8..g.P8..i.S8..j.W8..k.\8..l.c8...Ih8...I.8...II9...IO9...Jt9...J~9...J.9...J.9...J.9...J.9...J.9...J.9...J&:...J4:...JL:...JS:...Jn:...J}:.. J.:..!J.:.."J.:..#J.;..$J.;..%J9;..&Jo;..'J.;..(JN<..)J.<..*J.<..+J.=..,J.=../J6=..0J.=..1J.>..2J.>..3J.>..5J%?..6J.?..7J.@..8J#@..9J;@..:J]@..;JxA..<J.A..=J.B..>J.B..@J.B..BJ.B..CJ.B..DJ.C..EJ.C..FJKC..KJ.C..LJ.C..MJ7D..NJcD..OJsD..PJ.D..QJ.E..RJVE..SJ.E..TJ.E..WJzF..ZJ.F..[J.F..\J.F..]J.F..^J.F.._J.F..`J.F..aJ.G..bJ.G..cJ.G..dJ.G..eJOG..fJzG..gJ.G..hJ.G..iJ.H..kJ.H..mJ;H..nJAH..oJNH..pJwH..qJ.H..tJ.J..wJ.J..xJ.J..yJ.J..zJ.J..{J.K..}J#K...J5K

C:\Program Files (x86)\????????\locales\ro.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	108582
Entropy (8bit):	5.453389680590652
Encrypted:	false
SSDEEP:	1536:pvGWGGi3mp16a3y5/zOSoPMyVwPgJe2DLpsPlJtWIhx5h6/uxFDv32B+A:purMpsIFJe2iPzx5h6/uxFr38/
MD5:	4C4112B99FDA13B8FA5373D379F476FB
SHA1:	2422AFA9EA5B204FE84CC241CF6EDA2C8B319FA2
SHA-256:	99730524E53CA07481F8CDBBDACE228AED42ABC19D2277D26C42F47653F3CF07
SHA-512:	C663A678D0EEB66697F430E785C32FDB021A40C6456807F3842FA0E2C9AE3450FD59C3EE15E9A0975B8D100FC7C7118A06AFD595404A29D777780106C8E1AD4F
Malicious:	false
Preview:	...........j..4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..5..y..5..z. 5..\|.&5..}.85....@5....E5....M5....U5....]5....d5....k5....r5....s5....t5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....%6....86....S6....q6....x6....{6....\|6.....6.....6.....6.....6.....6.....6.....6.....6.....6....6..+..6..,..7../.67..0.G7..1.s7..2..7..3..7..4..7..5..7..6..8..7.!8..>.88..?.@8..N.O8..g.]8..i.`8..j.d8..k.i8..l.n8...Is8...I.8...IL9...IV9...J.9...J.9...J.9...J.9...J.9...J.9...J.9...J.9...J.:...J.:...J:...J3:...JB:...JR:.. J.:..!J.:.."J.:..#J.:..$J.:..%J.;..&J1;..'J.;..(J.<..)J{<..J.<..+J.<..,J.<../J.<..0J[=..1J.>..2J.>..3J1>..5J]>..6J.>..7Jg?..8Jr?..9J.?..:J.?..;J.A..<J.A..=JMB..>J.B..BJ.B..CJ.B..DJ.B..EJ.B..FJ.C..KJMC..LJyC..MJ.C..NJ.C..OJ.D..PJ8D..QJ.D..RJ.D..SJ.E..TJUE..WJ.E..ZJ.F..\J.F..]J.F..^J.F.._J0F..`JJF..aJ]F..bJ^F..cJrF..dJuF..eJ.F..fJ.F..gJ.F..hJ.G..iJ$G..kJ+G..mJJG..nJSG..oJaG..pJ.G..qJ.H..tJ$J..wJ?J..xJ[J..yJ.J..zJ.J..{J.J..}J.J...J.J...JgK...J.K

C:\Program Files (x86)\????????\locales\ru.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	170643
Entropy (8bit):	4.97301585978007
Encrypted:	false
SSDEEP:	3072:KWFppsemP4lV+TQUXEmOAdOiOFIQgIvZfbRrK5VH934RzDqa7BLuW1LV2Lle9X+p:KWFpp9mQLPQVOAdOwQgIv1RcVH9IRzhM
MD5:	5D77BC0C2AA843EC5BE6A3614C062359
SHA1:	0B22C3376169A5BBB4697D586E4A0D3094739DD5
SHA-256:	EC6654FFD877EC62D8AFCF90469ECEF5790E17C7306654CFE4B905DE449B06D8
SHA-512:	A2CF1FF9F7020BA1998A7091B802DD1AEB59BF2B800A41FF221152E2D017435372BFCD52EC454DB543E856288E2DC381DC46A7926D4BB4B917B8749657FEE0AB
Malicious:	false
Preview:	............j.L4..k.[4..l.f4..n.n4..o.s4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..4..\|..4..}..4.....5.....5.....5.....5....#5....5....15....85....95....:5.....5.....5.....5.....5.....6.....6.....6.....6....66....H6....g6.....6.....6.....6.....6.....6.....6.....6.....6.....7.....7....47....L7....V7....b7.....7....7..+..7..,..7../..7..0..7..1.H8..2._8..3.y8..4..8..5..8..6.S9..7.w9..>..9..?..9..N..9..g..9..i..9..j..9..k..9..l..9...I.:...I7:...I.;...I.;...J.<...J.<...J)<...J@<...Jt<...J.<...J.<...J.<...J,=...JI=...Jf=...Jx=...J.=...J.=.. J.>..!JX>.."Ju>..#J.>..$J.>..%J.>..&J.?..'J.@..(J.@..)JeA..*J.A..+J.A..,J.A../J B..0J.C..1JLD..2JeD..3J.D..5J.D..6J.E..7J.F..8J.G..9J%G..:J}G..;J.K..<J.L..=J9N..>J.N..BJ.N..CJ.N..DJ.O..EJ%O..FJgO..KJ.O..LJ1P..MJ.P..NJ.Q..OJ/Q..PJsQ..QJ.R..RJfR..SJ.S..TJHS..WJ.T..ZJfT..\J\|T..]J.T..^J.T.._J.T..`J.T..aJ.U..bJ.U..cJCU..dJFU..eJ.U..fJ.U..gJ.V..hJ;V..iJgV..kJxV..nJ.V..oJ.V..pJ.V..qJ.W..tJw^..wJ.^..xJ.^..zJ.^..{J._..}Jf_...J._...J._...JA`...J.`...J.`

C:\Program Files (x86)\????????\locales\sk.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	111961
Entropy (8bit):	5.78637987197169
Encrypted:	false
SSDEEP:	1536:ufxhFgi4HHK9eDpYaQWQtTe7hukM+zBHCYaiggGP352wmQPE:hBSaQWI2ukM+zBHCYauGPp2wLPE
MD5:	BA56090D9658733694473C7861D04040
SHA1:	DDE05B47D06FA81ABADC1B8F74E5993D0EA61CA1
SHA-256:	D7BAA6B1C0355E1CE9088C6EB508235C7A640BA70CC7AD84C9AC607026400495
SHA-512:	ED49F76F2EF4975E105FE13850258A51E44D0FFA7167A52B398276898237636AA50F62209757DCD756E3FAEF5581E314E261BAA3A1E46B183A3B93AF68605C59
Malicious:	false
Preview:	........)...j..4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..5..y..5..z..5..\|.$5..}.65....>5....C5....K5....S5....[5....b5....i5....p5....q5....r5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6...."6....36....C6....V6....]6....`6....a6....o6....}6.....6.....6.....6.....6.....6.....6....6..+..6..,..6../..7..0..7..1.E7..2.S7..3.c7..4..7..5..7..6..7..7..7..>..8..?..8..N."8..g..8..i.18..j.58..k.>8..l.H8...IM8...Im8...I'9...I19...J[9...Jc9...Ji9...Jy9...J.9...J.9...J.9...J.9...J.:...J.:...J1:...J9:...JH:...JV:.. J.:..!J.:.."J.:..#J.:..$J.:..%J.;..&J5;..'J.;..(J.<..)J.<..J.<..+J.<..,J.<../J.<..0J~=..1J?>..2JN>..3Jc>..5J.>..6J.?..7J.?..8J.?..9J.?..:J.@..;J.A..<J.B..=J.C..>J.D..@J.D..BJ6D..CJED..DJND..EJ_D..FJ.D..KJ.D..LJ.E..MJ}E..NJ.E..OJ.E..PJ.E..QJ7F..RJtF..SJ.F..TJ.F..WJ.G..ZJ.G..[J.G..\J.G..]J.G..^J.G.._J.G..`J.G..aJ.H..bJ.H..cJ+H..dJ.H..eJnH..fJ.H..gJ.H..hJ.H..iJ.I..kJ.I..mJ1I..nJ9I..oJNI..pJsI..qJ.I..tJ{M..wJ.M..xJ.M..yJ.M..zJ.M..{J.N..}J6N...JHN...J.N

C:\Program Files (x86)\????????\locales\sl.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	106585
Entropy (8bit):	5.474857990972114
Encrypted:	false
SSDEEP:	1536:RU1M1nublajdqz6HYogW4xVivgnUhXaA99DqJdIqTCORahNNi/fzU1BwwRqt:RUpZWqzon6x8DgIqTCO6Li/fzMwoqt
MD5:	B1E33BBB0ABBE113A024694BF4608C5B
SHA1:	A157C8578685F5084FD805C9D0734BC7646D77D9
SHA-256:	48E9004441F8AFB200601EC2843A03892076DEB1706E1D3A7BBDBFCDD137AB57
SHA-512:	94854EB7021AB112B710332A410AF53E59A42C4A501EB02098A41004613E5B2F7727A192C74E2A1C17BFC584A85477E75BD1EEA0187E79DB1DE83C8253BEC322
Malicious:	false
Preview:	............j.f4..k.u4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..5..\|..5..}..5.... 5....%5....-5....55....=5....D5....K5....R5....S5....T5....~5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....56....<6....?6....@6....K6....S6....Y6....^6....f6....q6....v6....\|6.....6....6..+..6..,..6../..6..0..6..1.#7..2.27..3.?7..4.[7..5.p7..6..7..7..7..>..7..?..7..N..7..g..8..i..8..j..8..k..8..l..8...I.8...IF8...I.9...I.9...J09...J79...JL9...JS9...Jo9...J.9...J.9...J.9...J.9...J.9...J.9...J.:...J.:.. J^:..!J.:.."J.:..#J.:..$J.:..%J.:..&J.:..'Jh;..(J.;..)JE<..JY<..+J.<..,J.<../J.<..0J.=..1J.=..2J.=..3J.=..5J.>..6J.>..7Jd?..8Ju?..9J.?..:J.?..;JTB..<JJC..=J;D..>JuD..@J.D..BJ.D..CJ.D..DJ.D..EJ.D..FJ.D..KJ0E..LJXE..MJ.E..NJ.E..OJ.E..PJ.F..QJZF..RJ.F..SJ.F..TJ.G..WJ.G..ZJ.G..[J.G..\J.G..]J.G..^J.G.._J.G..`J.G..aJ.H..bJ.H..cJ.H..dJ.H..eJBH..fJrH..gJ.H..hJ.H..iJ.H..kJ.H..mJ.I..nJ.I..oJ#I..pJJI..qJ.I..tJVM..wJuM..xJ.M..yJ.M..zJ.M..{J.M..}J.N...J.N...J.N

C:\Program Files (x86)\????????\locales\sr.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	161804
Entropy (8bit):	4.913015445699687
Encrypted:	false
SSDEEP:	3072:u6umjOFT3hFmGK7vVsY+f1GX20Dl370BQn0yh9K3Y+Nst3r1GLTL6itWYJ/k/Zp:HT+TP0B7XDp370+n59URV/k/Zp
MD5:	C56D29BCF5FB38EA25AB1A855690F9A9
SHA1:	F3161F2890971EF929473C58654DAC0718983957
SHA-256:	68A04BAE37629675C49D9AAEB68A1DA974AAC427B61151A18F3210499702202D
SHA-512:	551A72041772737139190894F5DEE50963F5597A2271BD2E94AF390CAE34967CC435BF5504601C061CF6C2CCCCD19E7BB708538A6789F185412FC715E85D54BE
Malicious:	false
Preview:	........,...j..4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..5..w..5..y..5..z.$5..\|.5..}.<5....D5....I5....Q5....Y5....a5....h5....o5....v5....w5....x5.....5.....5.....6....96....n6....p6....t6.....6.....6.....6.....6.....6.....7....47....;7....>7....?7....I7....U7....n7....\|7.....7.....7.....7.....7.....7....8..+..8..,.$8../.L8..0.U8..1..8..2..8..3..8..4.#9..5.T9..6..9..7..9..>..:..?.$:..N.E:..g.[:..i.^:..j.b:..k.g:..l.u:...Iz:...I.:...I.<...I.<...JU<...Jc<...Jo<...J.<...J.<...J.<...J.=...J.=...Jw=...J.=...J.=...J.=...J.=...J.>.. J.>..!J.>.."J.>..#J ?..$J,?..%J]?..&J.?..'J_@..(J.@..)J.A..*J.A..+J.A..,J.B../J<B..0J.B..1J.D..2J.D..3JBD..5J.D..6JrE..7J.F..8J.F..9J.F..:J.F..;J.J..<JRK..=J.L..>J-M..@JbM..BJnM..CJ.M..DJ.M..EJ.M..FJ.M..KJZN..LJ.N..MJLO..NJuO..OJ.O..PJ.O..QJrP..RJ.P..SJpQ..TJ.Q..WJsR..ZJ.R..[J.R..\J.R..]J.R..^J.R.._J.S..`JDS..aJfS..bJgS..cJ.S..dJ.S..eJ.S..fJ T..gJmT..hJ.T..iJ.T..kJ.T..mJ.T..nJ.U..oJ.U..pJRU..qJ'V..tJ.Z..wJ)[..xJ^[..yJ.[..zJ.[..{J.[..}J.\...J$\

C:\Program Files (x86)\????????\locales\sv.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	98495
Entropy (8bit):	5.49554714075014
Encrypted:	false
SSDEEP:	1536:49G15Swi3ANlCXU8qwJ4Ey9HdSfvlALur/WLdP/ldO12D2CMqeLKBqQOPXE9b3cY:JTvi3AKT8OCbU+Vn3
MD5:	2BEFBABEABBBAE5E7C57934ACC5CD41F
SHA1:	D48E9FD4D73627F4DCC57EC31924D97F6FD6B8D1
SHA-256:	C63E812FEE929492974C9B5DFA14A7587258E6FABED355A105015B296246B068
SHA-512:	8E06850701C6BC2A4A5ED8B9D59F68B68D631BE7B037E2DF2A738B5A44D36A37B1419E739341A00EE7681249A434CA69BA53BBC58FF0F204322F7DFDE2D43405
Malicious:	false
Preview:	............j.j4..k.y4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..5..\|..5..}..5....$5....)5....15....95....A5....H5....O5....V5....W5....X5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6....&6....-6....06....16....96....A6....L6....R6....Z6....e6....q6....x6.....6....6..+..6..,..6../..6..0..6..1..7..2..7..3..7..4.>7..5.S7..6..7..7..7..>..7..?..7..N..7..g..7..i..7..j..7..k..7..l..7...I.7...I.8...I.8...I.8...J.8...J.8...J.8...J.8...J.9...J.9...J19...J?9...Jz9...J.9...J.9...J.9...J.9...J.9.. J.:..!J&:.."J8:..#JD:..$JI:..%Jg:..&J.:..'J.:..(J[;..)J.;..J.;..+J.<..,J.<../J9<..0J.<..1Jb=..2Jt=..3J.=..5J.=..6J(>..7J.>..8J.>..9J.>..:J.>..;J.?..<J.@..=J.@..>J.@..@J.A..BJ.A..CJ.A..DJ.A..EJ&A..FJMA..KJ.A..LJ.A..MJ.B..NJ1B..OJAB..PJgB..QJ.B..RJ.B..SJHC..TJoC..WJ.C..ZJ.D..[J.D..\J!D..]J'D..^J*D.._JAD..`JWD..aJrD..bJsD..cJ.D..dJ.D..eJ.D..fJ.D..gJ0E..hJEE..iJYE..kJ`E..mJ\|E..nJ.E..oJ.E..pJ.E..qJ.F..tJeG..wJzG..xJ.G..yJ.G..zJ.G..{J.G..}J.H...J.H

C:\Program Files (x86)\????????\locales\sw.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	100164
Entropy (8bit):	5.339155264286809
Encrypted:	false
SSDEEP:	3072:AUaDx9XlYKed5nDi5jXmQtVPGoHLeH+jKHw9E:AU8MnDiZmIVaH+jKHw9E
MD5:	2490296567A1CD3C7B0852E1ED7D115D
SHA1:	04B527742CEA9487344AE08C463D6FD4BA16B1CE
SHA-256:	8B07BFAFA5C97BE2DA9B6146535B7848D88A44D43A45AB06DFAE286D93FD64CE
SHA-512:	B930C14847012E12BB19BF217C79516C569FC163204D9C2B21A36F6F5061A50C3EC057882970517FC3BC4BEEBCF3D1B1402CCD521404CBA827309940A5496B3F
Malicious:	false
Preview:	............j.^4..k.m4..l.x4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..4..\|..4..}..5.....5.....5....%5....-5....55....<5....C5....J5....K5....L5....p5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6....%6....;6....B6....E6....F6....M6....R6....Y6....^6....e6....q6....{6.....6.....6....6..+..6..,..6../..6..0..6..1.+7..2.A7..3.K7..4.a7..5.~7..6..7..7..7..>..7..?..7..N..8..g..8..i..8..j. 8..k.%8..l.+8...I/8...Ib8...I69...I;9...J^9...Jb9...Jp9...Jy9...J.9...J.9...J.9...J.9...J.:...J.:...J:...J1:...JJ:...JV:.. J.:..!J.:.."J.:..#J.:..$J.;..%J.;..&JM;..'J.;..(J%<..)J.<..J.<..+J.<..,J.<../J.=..0J.=..1Jt>..2J.>..3J.>..5J.>..6J.?..7J.?..8J.?..9J.?..:J.?..;J.@..<J~A..=J.A..>J+B..@JGB..BJMB..CJYB..DJiB..EJsB..FJ.B..KJ.B..LJ.C..MJvC..NJ.C..OJ.C..PJ.C..QJ'D..RJoD..SJ.D..TJ.D..WJkE..ZJ.E..\J.E..]J.E..^J.E.._J.E..`J.E..aJ.E..bJ.E..cJ.F..dJ.F..eJ3F..fJSF..gJ.F..hJ.F..iJ.F..kJ.F..mJ.F..nJ.F..oJ.G..pJ+G..qJsG..tJ.H..wJ.H..xJ.H..yJ!I..zJI..{JCI..}J`I...JiI...J.I

C:\Program Files (x86)\????????\locales\ta.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	251131
Entropy (8bit):	4.183819952310117
Encrypted:	false
SSDEEP:	1536:ow9AvDLcYemZ9w7towiy+bvnTDE2k4ca6QVW0LlGJfB1okotPttRmL+EG5aIAuwA:39I/cXmHw2tRBp
MD5:	8C8B63DFB6DBF75603D3E2E4FE981F9D
SHA1:	3E7C9A1A01526367B016DF20822A41E430328E94
SHA-256:	22EB9D73331E92C898B27546A9E775FA8DF0FDADA391734A9291B2A016662652
SHA-512:	978AF09738B4E00BA58F91B82DB6CD455FFB3CB4951C25ABAF79B8159C6FCD9212348373EF5A5A421F9FF5B4604A3F5B54AEA3257DCF566807B6A84824CA54BC
Malicious:	false
Preview:	............j.`4..k.o4..l.z4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..4..\|..5..}..5.....5.....5....'5..../5....75....>5....E5....L5....M5....N5.....5.....6....D6.....6.....6.....6.....6.....7....(7....G7.....7.....7.....7....38....:8....=8....>8....\8....z8.....8.....8.....8.....8.....9....,9....u9....9..+..9..,..9../..9..0..:..1..:..2..:..3..:..4.J;..5..;..6.m<..7..<..>..=..?..=..N.S=..g.l=..i.o=..j.s=..k.x=..l..=...I.=...I.=...I.?...I.?...JE@...JW@...Jo@...J.@...J.@...J.@...J'A...JTA...J.A...J.B...J2B...J>B...JsB...J.B.. JfC..!J.C.."J.C..#J,D..$JGD..%J.D..&J3E..'J.F..(J.G..)J.I..JTI..+J.I..,J&J../JsJ..0J.K..1J.N..2J.N..3JeN..5J.O..6JiP..7JkQ..8J.Q..9J.R..:J.R..;J$U..<JUV..=JcW..>JcX..@J.X..BJ.X..CJ.Y..DJ.Y..EJIY..FJ.Y..KJ.Z..LJ.Z..MJ.[..NJ(\..OJ.\..PJ.]..QJE^..RJ._..SJ._..TJn`..WJ.b..ZJ{b..[J.b..\J.b..]J.b..^J.b.._J.c..`Jac..aJ.c..bJ.c..cJ.c..dJ.c..eJ2d..fJ.d..gJ.e..hJ.e..iJ.e..kJ(f..mJ.f..nJ.f..oJ.f..pJ=g..qJ<h..tJel..wJ.l..xJ.l..yJrm..zJ.m..{J.n..}JCn...Jen

C:\Program Files (x86)\????????\locales\te.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	233512
Entropy (8bit):	4.394219369228384
Encrypted:	false
SSDEEP:	6144:O9cJA6UspbDcUSanSBXvQBgIiCQvWSsxU/dUVo9wLwxEE:ocJA6UspbDcUSanSBXvQBgIiCQvWSsxU
MD5:	C370F82FF93880C0F32E63CECA8F1050
SHA1:	A1190895EA7E699621F930C9B4B672B786FE1D9A
SHA-256:	2DD8A542EE0778EE39639380208C584D9EEC8932D1307BD5563E1EAB320FE0D8
SHA-512:	BE8FEBB9CE42731F6F3DBE0775D2BAE10267F0790CE7BB8B437C4DD5E736FC28772812231B0A4A39B28DAFC63D54D27FBBFD94375DBCEB317FC43DEBBD566844
Malicious:	false
Preview:	...........j..4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..5..y..5..z. 5..\|.&5..}.85....@5....E5....M5....U5....]5....d5....k5....r5....s5....t5.....5....+6...._6.....6.....6.....6.....6.....7....:7....k7.....7.....7.....7.....8.....8...."8....$8....K8....r8.....8.....8.....8.....8.....8.....9....^9....9..+..9..,..9../..9..0..9..1..:..2..:..3..:..4..;..5.w;..6..;..7.)<..>..<..?..<..N..<..g..<..i..<..j..<..k..=..l..=...I.=...I.=...Ig?...I.?...J.?...J.?...J.@...J)@...Js@...J.@...J.@...J.A...J.A...J.A...J)B...JBB...J~B...J.B.. JuC..!J.C.."J.D..#JID..$JgD..%J.D..&J.E..'J8F..(J@G..)JeH..*J.H..+J.H..,J.I../JoI..0J&K..1J'M..2J>M..3J.M..5J.N..6JhO..7JBP..8J~P..9J.P..:J.Q..;JYS..<JDT..=J"U..>J.U..@JPV..BJlV..CJ.V..DJ.V..EJ.V..FJRW..KJ)X..LJ.X..MJ.Y..NJ.Y..OJAZ..PJ.Z..QJ.[..RJI\..SJ.]..TJi]..WJ.^..ZJ.^..[J._..\J1_..]J:_..^JR_.._J._..`J._..aJ6`..bJ7`..cJ~`..dJ.`..eJ.`..fJ/a..gJ.a..hJ.b..iJnb..kJ.b..mJ.b..nJ.b..oJ.c..pJxc..qJOd..tJ.g..wJ.g..xJ"h..yJ.h..zJ.h..{J.i..}JEi...J.i

C:\Program Files (x86)\????????\locales\th.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	199961
Entropy (8bit):	4.471892692957686
Encrypted:	false
SSDEEP:	6144:aMMGozCJFkcSCkIOBrQrUXFIw3reJZK8Q9w1p7ETsGpY0bhdxPtA0kC5/0:aMMnzsFkcSCkIOBrQrUXFIw3reJZK8Qm
MD5:	F265EC50E0EB62893FBC187C1C962DD9
SHA1:	5A60FF7287E5D4E35F000D229A4CBB37DB76ACC0
SHA-256:	CFFD61F7954CA10038529D14FDA6A4E34C8EA1A9F202EAD0B0C2DB93143EF485
SHA-512:	696140D16655B6D1C17D59B3E280F3F387ADB8AD58C4A0D369925BD01CF03A3FD934C3B8E02E9E868BB64F81E7CFBFA532E732D1CD705C52C7B0F588765ECBEA
Malicious:	false
Preview:	............j.,4..k.;4..l.A4..o.I4..p.V4..q.\4..r.k4..s.\|4..t..4..v..4..w..4..y..4..z..4..\|..4..}..4.....4.....4.....4.....4.....4.....5.....5.....5.....5.....5.... 5....k5.....5.....5.....6....R6....T6....X6....j6.....6.....6.....6.....6.....7....17....87....;7....Y7....z7.....7.....7.....7.....7.....7.....7.... 8...A8..+.D8..,.U8../..8..0..8..1..9..2.J9..3.b9..4..9..5..9..6.q:..7..:..>..:..?..:..N..;..g.';..i.;..j..;..k.3;..l.P;...IU;...I.;...I.=...I;=...J.=...J.=...J.=...J.=...J.>...J.>...Je>...J.>...J.?...J1?...J.?...J.?...J.?...J.?.. J}@..!J.@.."J.@..#J.A..$J0A..%J`A..&J.A..'J.B..(J.C..)J.D..*J(E..+JuE..,J.E../J.E..0J.G..1J.H..2J.H..3J.I..5JmI..6JBJ..7J.K..8J,K..9JVK..:J.K..;J.N..<J.O..=J.O..>JlP..@J.P..BJ.P..CJ.P..DJ.P..EJ.Q..FJXQ..KJ.Q..LJ5R..MJ#S..NJIS..OJgS..PJ.S..QJtT..RJ&U..SJ.U..TJ.V..WJ6W..ZJ.W..\J.W..]J.W..^J.W.._J.W..`JAX..aJbX..bJcX..cJ.X..dJ.X..eJ.X..fJ.X..gJUY..hJlY..iJ.Y..kJ.Y..mJ Z..nJ/Z..oJCZ..pJ.Z..qJ.[..tJ.^..wJ.^..xJ.^..yJx_..zJ._..{J._..}J.`...J&`...J=a...J.a

C:\Program Files (x86)\????????\locales\tr.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	103632
Entropy (8bit):	5.620092397160877
Encrypted:	false
SSDEEP:	3072:uTJeZiainAmSngesR/Rv2NEiOwi1PNpskBa5Y8GKhEtJj3:bZMAe8NEhwiBNps2r
MD5:	D8373D7BC1BDEE4CFB48D85694A78FF9
SHA1:	323408E39B2C953728420E5F21B1D1EB25DE6C2B
SHA-256:	B1B66BFEC0AFF21C64EC8BA3F19008501F196F80E7E41B2E8AE73114357DF458
SHA-512:	6960D7C0481985E0F151D66D047A02E7C31CDD670AFD71A0A3949B9B0AB9E083A5CA55FAA48E38C8793EBBF1218A4503043867D1999B163A923E5AFCE8058888
Malicious:	false
Preview:	........"...j.v4..k..4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..5..z..5..\|..5..}.(5....05....55....=5....E5....M5....T5....[5....b5....c5....d5.....5.....5.....5.....5.....5.....5.....6.....6.....6....#6....36....E6....\6....u6....\|6.....6.....6.....6.....6.....6.....6.....6.....6.....6.....6.....6....6..+..6..,..6../..7..0..7..1.T7..2.a7..3.o7..4..7..5..7..6..7..7..8..>.%8..?..8..N.<8..g.G8..i.J8..j.N8..k.S8..l.Y8...Ib8...I.8...Ir9...I~9...J.9...J.9...J.9...J.9...J.9...J.9...J.9...J.:...JP:...Je:...Jr:...Jx:...J.:...J.:.. J.:..!J.;.."J.;..#J#;..$J(;..%J;;..&J];..'J.;..)JP<..Jc<..+J.<..,J.<../J.<..0JE=..1J.>..2J.>..3J*>..5Jj>..6J.>..7JB?..8JW?..9Ji?..:J.?..;J.@..<J/A..=J.A..>J.A..@J.A..BJ.A..CJ.B..DJ.B..EJ.B..FJCB..KJ.B..LJ.B..MJ.C..NJ8C..OJQC..PJ.C..QJ.C..RJ/D..SJ.D..TJ.D..WJ2E..ZJ[E..[JaE..\JiE..]JkE..^JoE.._J.E..`J.E..aJ.E..bJ.E..cJ.E..dJ.E..eJ.E..fJ.F..gJdF..hJ{F..iJ.F..kJ.F..mJ.F..nJ.F..oJ.F..pJ.G..qJUG..tJ.H..wJ.H..xJ.I..yJ9I..zJEI..{JfI..}J.I...J.I...J.J

C:\Program Files (x86)\????????\locales\uk.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	171613
Entropy (8bit):	5.007044552893733
Encrypted:	false
SSDEEP:	3072:fxJB3IjwWDCj+KU/TI7Yf7/QLNiXMMQOCqbCEb4UdL+v:5JB3IjwSrILNiXMoCqbbW
MD5:	E87CBE2CFFA7D3A95A8F837231D6F44F
SHA1:	40F7D1602B47C7A7AD445FE04377E3145F8CAFF7
SHA-256:	FA035595C375522D09F9DE5A545F5339FCD3DDB224FB19F1828A7958B7DFF3E8
SHA-512:	4A8B970B50DA8B92B824C92C6075C8B4440826DA5A581C91AD6E5B78BC65E3B80BE0080E4FBB20AD91E3EE30F8A3A05CA6925E93C76C8D2474CDB9A8825ACC74
Malicious:	false
Preview:	............j.h4..k.w4..l..4..n..4..o..4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..5..\|..5..}..5...."5....'5..../5....75....?5....F5....M5....T5....U5....V5.....5.....5.....5.....6....^6....`6....d6....v6.....6.....6.....6.....6.....7..../7....67....97....:7....J7....\7....n7....\|7.....7.....7.....7.....7.....7....8..+..8..,.#8../.g8..0.y8..1..8..2..8..3..9..4.M9..5.\|9..6..9..7..9..>.$:..?.3:..N.T:..g.`:..i.c:..j.g:..k.n:..l.z:...I.:...I.:...I.<...I0<...Jw<...J.<...J.<...J.<...J.<...J.<...J.=...J%=...J.=...J.=...J.=...J.=...J.=...J.=.. J.>..!J.>.."J.>..#J.?..$J.?..&JJ?..'J.?..(J.@..)JnA..J.A..+J.A..,J.B../JUB..0J0C..1JoD..2J.D..3J.D..5J.E..6J.E..7J{G..8J.G..9J.G..:J.G..;J.L..<J.N..=J.O..>J.O..@J.P..BJ.P..CJ>P..DJWP..EJtP..FJ.P..KJ>Q..LJ.Q..MJ%R..NJLR..OJxR..PJ.R..QJ\|S..RJ.S..SJoT..TJ.T..WJ.U..ZJ.V..\J/V..]J;V..^JAV.._JxV..`J.V..aJ.V..bJ.V..cJ.V..dJ.V..eJ9W..fJsW..gJ.W..hJ.X..iJLX..kJ[X..mJ.X..nJ.X..oJ.X..pJ.X..qJ.Y..tJ(`..wJ]`..xJp`..yJ.`..zJ.`..{J.a..}J7a...JRa...J.b...Jfb

C:\Program Files (x86)\????????\locales\vi.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	122329
Entropy (8bit):	5.79701593057625
Encrypted:	false
SSDEEP:	3072:2KqJQj44KMPnMpPiz+sEqOa2WYmc/14Ca1bNeqhzi5OZpW8uTtdLpFeSZTzeNQ:86Zac1bNjzioZWN1
MD5:	DBF8363FE244C7D45D44E987D7194566
SHA1:	C3BF0058F956FBD6FA0AD89218A22C7668964B30
SHA-256:	044C48581C2395A8EB0F85B5905E1B4CCE1FC1FEF2196710CEF06E197AFDFA99
SHA-512:	0953C455581F045A17E2AE35712487F36603B942F754805011047E4DCF531062D1DC1C8755F022177F7E21B7AB52FA71DB5EAC7C524424E1E5A2563429318E34
Malicious:	false
Preview:	............j.L4..k.[4..l.f4..n.n4..o.s4..p..4..q..4..r..4..s..4..t..4..v..4..w..4..y..4..z..4..\|..4..}..4.....5.....5.....5.....5....#5....5....15....85....95....:5....]5....n5.....5.....5.....5.....5.....5.....5.....5.....5.....6....'6....76....O6....V6....Y6....Z6....c6....l6....x6....~6.....6.....6.....6.....6.....6....6..+..6..,..6../..7..0.'7..1.[7..2.h7..3.s7..4..7..5..7..6..7..7..7..>.&8..?.28..N.T8..g.Z8..i.]8..j.a8..k.f8..l.o8...It8...I.8...I.9...I.9...J.9...J.9...J.9...J.:...J:...J6:...JX:...Jh:...J.:...J.:...J.:...J.;...J.;...J.;.. J~;..!J.;.."J.;..#J.;..$J.;..%J.;..&J3<..'J.<..(J@=..)J.=..J.=..+J.>..,J.>../J3>..0J.>..1J.?..2J.?..3J.@..5JA@..6J.@..7J)A..8J@A..9JQA..:JsA..;J.B..<J?C..=J.C..>J.D..@J*D..BJ/D..CJ8D..DJKD..EJUD..FJ.D..KJ.D..LJ.D..MJzE..NJ.E..OJ.E..PJ.E..QJWF..RJ.F..SJ.G..TJCG..WJ-H..ZJ_H..[JjH..\JsH..]JyH..^J}H.._J.H..`J.H..aJ.H..bJ.H..cJ.H..dJ.H..eJ.I..fJ5I..gJ.I..hJ.I..iJ.I..kJ.I..mJ.J..nJ$J..oJ3J..pJKJ..qJ.J..tJ.L..wJ.L..xJ.M..yJMM..zJUM..{JzM..}J.M...J.M

C:\Program Files (x86)\????????\locales\zh-CN.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	90960
Entropy (8bit):	6.704102795095848
Encrypted:	false
SSDEEP:	1536:fS4xPz13JLazuzqWI3EnkHhE9vcolEclL:K4Zz13euz3+B8pl9L
MD5:	D9FB680D115846809114DE2B35AB4CE3
SHA1:	D1F68E0181233C98FFBE91B09910B9D87C1E35EB
SHA-256:	690DAFDEB5BE360E8B3A84C711D0D48B3CFC74C871B89A8F03F8058738CA9834
SHA-512:	5968BBA15BEBF047DF19B519DA87BDE959CCF1E564012043EA390B3C1E572BBAED79B8BE6BFB884F4F9DA8F1C25F3E6709D6620C582910DEAF723906FDB04525
Malicious:	false
Preview:	............j.&4..k.54..l.<4..m.D4..o.J4..p.O4..q.U4..r.d4..s.u4..t.~4..v..4..w..4..\|..4..}..4.....4.....4.....4.....4.....4.....4.....4.....4.....5.....5....55....>5....J5....\5....n5....p5....t5....z5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6.....6.....6...."6....66...?6..+.B6..,.o6../..6..0..6..1..6..2..6..3..6..4..6..5..7..6.F7..7.[7..>.p7..?..7..N..7..g..7..i..7..j..7..k..7..l..7...I.7...I.7...Ia8...Ig8...J.8...J.8...J.8...J.8...J.8...J.8...J.8...J.9...JE9...JW9...Ji9...Jo9...J~9...J.9.. J.9..!J.:.."J.:..#J.:..$J$:..%J3:..&JZ:..'J.:..(JT;..)J.;..J.;..+J.<..,J.<../J0<..0J.<..1Je=..2Jv=..3J.=..5J.=..6J.>..7J.>..8J.>..9J.>..:J.>..;J.?..<J.@..=JZ@..>J.@..@J.@..BJ.@..CJ.@..DJ.@..EJ.@..FJ.A..KJNA..LJlA..MJ.A..NJ.A..OJ.B..PJ<B..QJ.B..RJ.B..SJ7C..TJhC..WJ.D..ZJ3D..[J9D..\J?D..]JBD..^JED.._J]D..`JuD..aJ.D..bJ.D..cJ.D..dJ.D..eJ.D..fJ.D..gJHE..hJ\E..iJkE..kJwE..mJ.E..nJ.E..oJ.E..pJ.E..qJ.F..tJ.G..wJ.G..xJ.G..yJ.G..zJ.H..{J.H..}J<H...JHH...J.H...J.H

C:\Program Files (x86)\????????\locales\zh-TW.pak

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	90921
Entropy (8bit):	6.701067465304723
Encrypted:	false
SSDEEP:	1536:Nx0gkZ46QB0MYZ2wcxAhdmDMQ+23mVcb7/8sfjkMQP1Rh5u/UxLiow5No4V3XiP9:PXkZkaMs2TAhdmSYkg35N/9XiPm45ycd
MD5:	D0141FD3E851CDB790549C069A76ABCD
SHA1:	3DA3787A8EA94AA066C5E5D17E42481330E0CAFF
SHA-256:	8187E67CDE3292C6F18EA0A40F8F8D3F2CD604E62FEEC9EC40C71B5D2BCDEC9D
SHA-512:	947E19E8FAD3A761E5E1D0380547A8F9BC06F28CF8103D80865EB9CED9E3ED3D601BD92710EF1CB9FA68D56EB62AE95C1AAD78145D455BCB6DDA1B8C280F4162
Malicious:	false
Preview:	............j. 4..k./4..l.:4..n.B4..o.G4..p.O4..q.U4..r.d4..s.u4..t.~4..v..4..w..4..y..4..z..4..\|..4..}..4.....4.....4.....4.....4.....4.....4.....4.....5....95....B5....N5....]5....l5....p5....t5....z5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....5.....6.....6.....6...."6....(6.....6....B6...K6..+.N6..,.~6../..6..0..6..1..6..2..6..3..6..4..6..5..7..6.T7..7.i7..>.{7..?..7..N..7..g..7..i..7..j..7..k..7..l..7...I.7...I.7...I.8...I.8...J.8...J.8...J.8...J.8...J.8...J.8...J.9...J'9...Jc9...Ju9...J.9...J.9...J.9...J.9.. J.9..!J-:.."J<:..#JH:..$JN:..%J`:..&J.:..'J.;..(Jr;..)J.;..J.;..+J*<..,J6<../JE<..0J.<..1Js=..2J.=..3J.=..5J.=..6J'>..7J.>..8J.>..9J.>..:J.>..;J.?..<J.@..=J`@..>J.@..@J.@..BJ.@..CJ.@..DJ.@..EJ.@..FJ.A..KJDA..LJeA..MJ.A..NJ.A..OJ.A..PJ.B..QJtB..RJ.B..SJ.C..TJ+C..WJ.C..ZJ.C..[J.C..\J.C..]J.C..^J.C.._J.D..`J5D..aJMD..bJND..cJ]D..dJ`D..eJ.D..fJ.D..gJ.D..hJ.E..iJ.E..kJ.E..mJ8E..nJ>E..oJOE..pJdE..qJ.E..tJXG..wJuG..xJ.G..yJ.G..zJ.G..{J.G..}J.G...J.G...JTH...J.H

C:\Program Files (x86)\????????\resources\app\favicon.ico

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	146095
Entropy (8bit):	5.89863577878037
Encrypted:	false
SSDEEP:	1536:2z9/xrvGvXsGOrWzEu5iVAUQvdFDtiE0WFRRFYuFNBUY7I9Usf/IJZ6o0M0wWnYx:2pp7LKWWLp06LYu/Cgx4s69Tc
MD5:	C9A2F7496D135104EEB8C253BE5BD5FC
SHA1:	D454ECDFDDC251809254C9BD11F2DB933E13ABCC
SHA-256:	68ED8A35904AD6859A51861182335FF9A0F60AC9E6321684B567561FEA175394
SHA-512:	031183540B54A33A609A208FA9D95B08CE846B883D599FFF03BFD97580301612CEEA124C96A031BC9979143A891C3EB1716358DC5F5464338D46FAA2AF09FAB9
Malicious:	false
Preview:	............ .)Y..v......... .(....Y..``.... ......a..00.... ..%..o... .... ............... ......,........ .h...G6...PNG........IHDR.............\r.f....pHYs..........o.d.. .IDATx..}y..Gu.w......h.7K.,.;...}.....a.....-.e........d...0.`.q...&..-Y.H..f_......{....}......Z.N...>Uu..a.b.O..LB..8.....-..A..f........K.G.J(W.I..t2Iw..,....d..!..v:=..d. D...1...~.s.V..S..(.~S....?r..)........?.-...T..U....v...3[..y"/H.(.W..i...lr.....+..y...T#.JF.<.$..L..p<%}.....$...J.$ujLy...f..ATm..E#....L...K...."....D....pzJ..}..O.q.}.NU@KIQ6.......Z.g.6....p5...LN^...TH...;.H#...#.w.....-..].w...w.,3...I........@~R...d..E .$....#...$.f..NE@c.0o.0..v.D...S .LD..L...J......y.H........E..g..\|B@..(9.D...Y.....A.{A$[.B.B....l..I...8.A..K@..>...Z.%#......u1....z.@!..Z!..tW$..UH@.\|Gyx............f..$....j.k.0b.......p.^!..2......<..K.P..>..).3.BQ.`v.>..[... ......E....uz......KG.\..G.i.......F.........1.g j.,.B....J..........1.....o.[>7+p.c...f........MD..........B.s.\..#...

C:\Program Files (x86)\????????\resources\app\node_modules\argparse\LICENSE

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	12775
Entropy (8bit):	5.1107663553625375
Encrypted:	false
SSDEEP:	192:kkeqR42OdnxCZHmKUOz1gq9w/4NfaTsHCbUFT5uOGH/FRm84xihY4wjJvQpzHt:kkeqREdxCZad9iqsibQtKNC9zpQpzN
MD5:	203A6DBC802EE896020A47161E759642
SHA1:	8C99330B2C56B327357927017FEE2FFBB6ACE001
SHA-256:	DE4D1F2D2AD5AD0CFD1657A106476B31CB5DB5EF9D1FF842B237C0C81F0C8A23
SHA-512:	0D089BFC01C7EC5E02CE46FEA4E5F554E4CFEDDB03763CF58D22C20C89114E7A6116FA4908FEF6AB065BD7F16948687216C3B93A56D07FED0B592079F0C96004
Malicious:	false
Preview:	A. HISTORY OF THE SOFTWARE.==========================..Python was created in the early 1990s by Guido van Rossum at Stichting.Mathematisch Centrum (CWI, see http://www.cwi.nl) in the Netherlands.as a successor of a language called ABC. Guido remains Python's.principal author, although it includes many contributions from others...In 1995, Guido continued his work on Python at the Corporation for.National Research Initiatives (CNRI, see http://www.cnri.reston.va.us).in Reston, Virginia where he released several versions of the.software...In May 2000, Guido and the Python core development team moved to.BeOpen.com to form the BeOpen PythonLabs team. In October of the same.year, the PythonLabs team moved to Digital Creations, which became.Zope Corporation. In 2001, the Python Software Foundation (PSF, see.https://www.python.org/psf/) was formed, a non-profit organization.created specifically to own Python-related Intellectual Property..Zope Corporation was a sponsoring member of the PSF.

C:\Program Files (x86)\????????\resources\app\node_modules\argparse\argparse.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	129714
Entropy (8bit):	4.272452074678955
Encrypted:	false
SSDEEP:	1536:N/vPlu9e9gVUfyWqwcdYjH9X4yr9uXinhYf3M3T:pFuPmJjHRxuX+hYf3Mj
MD5:	1A4680402726BB811869938FCE0BD394
SHA1:	7D94781CCC8562050C15B90153227F0DAD178CD4
SHA-256:	2E73E7A3167BA840DBCF41FEEAFC3544A3E2B39220B5E997133C519861FEBF16
SHA-512:	F85F46809ECF7666E114743CCC43DA07A8DCE0DD05FC2349673DF95FC1C97D99BF57F856B6F258031B07225B6793F6EF7281F0ADC197FC27DC809098D5C4F7E2
Malicious:	false
Preview:	// Port of python's argparse module, version 3.9.0:.// https://github.com/python/cpython/blob/v3.9.0rc1/Lib/argparse.py..'use strict'..// Copyright (C) 2010-2020 Python Software Foundation..// Copyright (C) 2020 argparse.js authors../. Command-line parsing library. . This module is an optparse-inspired command-line parsing library that:. . - handles both optional and positional arguments. * - produces highly informative usage messages. * - supports parsers that dispatch to sub-parsers. . The following is a simple usage example that sums integers from the. * command-line and writes the result to a file::. . parser = argparse.ArgumentParser(. * description='sum the integers at the command line'). * parser.add_argument(. * 'integers', metavar='int', nargs='+', type=int,. * help='an integer to be summed'). * parser.add_argument(. * '--log', default=sys.stdout, type=argparse.FileType('w'),. * help='the file where

C:\Program Files (x86)\????????\resources\app\node_modules\argparse\lib\sub.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2252
Entropy (8bit):	4.312968870600061
Encrypted:	false
SSDEEP:	48:5qhHP/apJvPQTh0O4+vGdGC50/+aqF23vnU:5qxiQThY+vllvqo3vnU
MD5:	5EDF55299638E603E506A2005D8FAFCB
SHA1:	757F59221515E7DE37F85C4AE8BCFC3E47F11846
SHA-256:	2BC4EF9E87C47F1A4E0CFCB3706D886E0D73EDCE88149E300D2364066F396ED6
SHA-512:	49DE57BA53767952E0947572A4FC3744780F904E45089ABBADDD1B876E528A23524A5DA72BDBF07712B11D9814F03EA6C5C213A3E4D6FE45A38D00BD2F7AF5AA
Malicious:	false
Preview:	// Limited implementation of python % string operator, supports only %s and %r for now.// (other formats are not used here, but may appear in custom templates)..'use strict'..const { inspect } = require('util')...module.exports = function sub(pattern, ...values) {. let regex = /%(?:(%)\|(-)?(\)?(?:$(\w+)$)?([A-Za-z]))/g.. let result = pattern.replace(regex, function (_, is_literal, is_left_align, is_padded, name, format) {. if (is_literal) return '%'.. let padded_count = 0. if (is_padded) {. if (values.length === 0) throw new TypeError('not enough arguments for format string'). padded_count = values.shift(). if (!Number.isInteger(padded_count)) throw new TypeError(' wants int'). }.. let str. if (name !== undefined) {. let dict = values[0]. if (typeof dict !== 'object' \|\| dict === null) throw new TypeError('format requires a mapping'). if (!(name in dict)) throw new TypeE

C:\Program Files (x86)\????????\resources\app\node_modules\argparse\lib\textwrap.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	17391
Entropy (8bit):	4.2964394524622564
Encrypted:	false
SSDEEP:	192:462k2baZprkuK+UHWaEWbwiGcsuSlPYcse8y3lqLuqXbjADZqSS2UDZqWASgXlEg:46fauK52HNVJCAtWtYdGZKaM8aB6tk
MD5:	32F3C10F519C3D10F41F86C29DD67809
SHA1:	1FD8C341ED281E33D43B3A21A311149D772274EF
SHA-256:	2550466C9A0425FA583A70E25BB93E190FE09B61F7DE4861EA8EC54B7B899DB0
SHA-512:	7E179E588DA5C9C500AD2C464F425DF8D1140706924C710E4F16F82E4554CFE42849A0FFCE6672A83DC052FA3E845A9E76C10505741804FCC1DFCE56F16D004A
Malicious:	false
Preview:	// Partial port of python's argparse module, version 3.9.0 (only wrap and fill functions):.// https://github.com/python/cpython/blob/v3.9.0b4/Lib/textwrap.py..'use strict'../. Text wrapping and filling.. /..// Copyright (C) 1999-2001 Gregory P. Ward..// Copyright (C) 2002, 2003 Python Software Foundation..// Copyright (C) 2020 argparse.js authors.// Originally written by Greg Ward <gward@python.net>..// Hardcode the recognized whitespace characters to the US-ASCII.// whitespace characters. The main reason for doing this is that.// some Unicode spaces (like \u00a0) are non-breaking whitespaces..//.// This less funky little regex just split on recognized spaces. E.g..// "Hello there -- you goof-ball, use the -b option!".// splits into.// Hello/ /there/ /--/ /you/ /goof-ball,/ /use/ /the/ /-b/ /option!/.const wordsep_simple_re = /([\t\n\x0b\x0c\r ]+)/..class TextWrapper {. /. * Object for wrapping/filling text. The public interface consists of. * the wrap() and fil

C:\Program Files (x86)\????????\resources\app\node_modules\argparse\package.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	570
Entropy (8bit):	4.750218661393428
Encrypted:	false
SSDEEP:	12:mDyEMJWu+Gy0BLCu6WmPk3SuRANSaiuliQbmWAuPqV1Gg:mDfMJr+H0BLB6WB+32cI1Gg
MD5:	0AAFC11E21FB5114577F81BB97BDEB3A
SHA1:	2076A6D110B278DB6312544B218ABB231834C7A8
SHA-256:	31B990F430F2AD2719011D02DEEE965BDF79F4B990F8EEAB593ADEE33C6B2780
SHA-512:	437F91C8C6057BF8E8CD5933D638707AE74516CE2144184069A59EE629964061AC77379A949A055E294B757A76792AA49CAD7FBE1593F63C1F4B94E5668B03C4
Malicious:	false
Preview:	{. "description": "CLI arguments parser. Native port of python's argparse.",. "devDependencies": {. "@babel/eslint-parser": "^7.11.0",. "@babel/plugin-syntax-class-properties": "^7.10.4",. "eslint": "^7.5.0",. "mocha": "^8.0.1",. "nyc": "^15.1.0". },. "files": [. "argparse.js",. "lib/". ],. "homepage": "https://github.com/nodeca/argparse#readme",. "license": "Python-2.0",. "main": "argparse.js",. "name": "argparse",. "repository": {. "type": "git",. "url": "git+https://github.com/nodeca/argparse.git". },. "version": "2.0.1".}

C:\Program Files (x86)\????????\resources\app\node_modules\array-index\History.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1385
Entropy (8bit):	4.924278191110684
Encrypted:	false
SSDEEP:	24:7EBRYUeB6+6FzofmS1UZULc731O6UPYYvdGEw20elkLN87dd0he2:7EB+PXg8fL1UZUA731O6Uwwd/r0pLG76
MD5:	64CA9068EBA1B9F2597CA946674EFE83
SHA1:	777352C67E14410830F4FE5BA735B09BE2551C51
SHA-256:	A3AA645B97EB9FE6CF7B8EC7795CE7637FDB99E0F860F9F5A394512281877542
SHA-512:	9AF5CAC02E5A6D519E34D46A5D59A3915CFB6CD49D71A2B672AB753F92EB4A38D4B1D783D12A5E65A5C83DB7122D54AD5120E5DD61327517E8345FFCD2C2FE12
Malicious:	false
Preview:	.1.0.0 / 2016-01-02.==================.. * remove `__get__` and `__set__` functionality. * README: s/->/./..0.9.1 / 2015-12-29.==================.. * fix backwards compat with tests. * README: update samples for new Symbols API. * travis: attempt to fix node v8..0.9.0 / 2015-12-27.==================.. * add backwards compat logic with deprecate message. * add LICENSE field and entry in package.json. * convert to using es6 Symbols. * remove extraneous debug() calls. * travis: test moar Node.js versions..0.2.0 / 2015-12-02.==================.. * add support for invoking as a Mixin. * travis: test node v0.6..0.1.1 / 2014-11-03.==================.. * index: use `%o` debug formatters. * .travis: don't test node v0.9.x. * README: use svg for Travis badge. * add .jshintrc file..0.1.0 / 2013-12-01.==================.. * add `History.md` file. * .travis.yml: test node v0.8-v0.11. * add component.json. * package: update "main" field. * package: beautify..0.0.4 / 2013-09-27

C:\Program Files (x86)\????????\resources\app\node_modules\array-index\LICENSE

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1102
Entropy (8bit):	5.123194000410463
Encrypted:	false
SSDEEP:	24:yiIB4J5X30yP1gtOHw1Gg9QH+sUu8Ok4F+dxoBoqMSPz:rIiJ5HlP1E9ICQH+szIt6BoE7
MD5:	694E396551033371686C80D3A1A69E88
SHA1:	29E2EC2D24A38C009DFB6F3C1B8D1B57E3EC492B
SHA-256:	662A1B0115251CFB29C6AED0F221F8847BC49C6365D1C53A62C9F4BCCC2489C3
SHA-512:	61350295B92C37BADF148826FF25CE1404B4DFA1008878E64B20D9C930A6DD801BA8269A7EA85A8F21C115D7C4E4BCCC231D24A05A88CFC80EC7CA42BA03E95D
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2012 Nathan Rajlich <nathan@tootallnate.net>..Permission is hereby granted, free of charge, to any person.obtaining a copy of this software and associated documentation.files (the "Software"), to deal in the Software without.restriction, including without limitation the rights to use,.copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the.Software is furnished to do so, subject to the following.conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES.OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT.HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,.WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,

C:\Program Files (x86)\????????\resources\app\node_modules\array-index\Makefile

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	166
Entropy (8bit):	4.517494258634697
Encrypted:	false
SSDEEP:	3:BnnAEp7hIVK0xPCvdke0QA4KYOK0CVLUveDMJ6KLAEmUEm7yBtDEb:RnLp7K3CVFn2agXdLLEbYb
MD5:	07D4581708000F278A7E483B9681F481
SHA1:	3AC3791057BCF3B34CF3F8E730456A0550D03F78
SHA-256:	12D0D5159FAAD57C36FFCCD43037D1F6BD72B079CE1343D458C92B152B9CD2B0
SHA-512:	15E9313DCFB01AF7CD871ED3BCFEAA367950FB0CB2E6BD1237A0578E89B8025B3F8CE1C4C4BF972F3DE38B1773A1894E113276EF81E42B519557FF1F7C7E8B4F
Malicious:	false
Preview:	.build: components index.js..@component build --dev..components: component.json..@component install --dev..clean:..rm -fr build components template.js...PHONY: clean.

C:\Program Files (x86)\????????\resources\app\node_modules\array-index\component.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	399
Entropy (8bit):	4.4773654718849425
Encrypted:	false
SSDEEP:	12:xMayUSa7qrZ0GzuRTCrCsV18wL0+QI6aDGCx:Kasa78nPWsV1qLM
MD5:	BB3BBEB6208341FC18B43F05E3E37BEE
SHA1:	B50CB600EB3E6C7994745BE4D62C02F3449D5B8D
SHA-256:	8405611A67564B1FCE43F03569C4F91FB4F90CC2BEFF30A223DA9F1F8F5DEB47
SHA-512:	0D86318414B0672D9B8950D7222FDA15BD481A0186B98FC18AD6B59E4EE11A332C73518C772B61165158ED882A5A9E443066B46B06907E37C87A1E6CFF2A752A
Malicious:	false
Preview:	{. "name": "array-index",. "repo": "TooTallNate/array-index",. "description": "Invoke getter/setter functions on array-like objects",. "keywords": [. "index",. "array",. "getter",. "setter",. "proxy". ],. "version": "1.0.0",. "dependencies": {. "visionmedia/debug": "*". },. "development": {},. "license": "MIT",. "main": "index.js",. "scripts": [. "index.js". ].}.

C:\Program Files (x86)\????????\resources\app\node_modules\array-index\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3743
Entropy (8bit):	4.984577190485509
Encrypted:	false
SSDEEP:	96:qmpS3liXl9nTWzPj4NiWRj1Agu1owt9PDGUp8DwWInc+:qm8gX0YiuWPyA8kbnc+
MD5:	BF2AA17360CC3CB2C803145EAD64DB68
SHA1:	550B0A14433998A8E5F2FE80DEBA40B79EA6B5ED
SHA-256:	536DB9952569B434CBBA4BEE8770DE687DCD7F809471A0D5543982D9352EBA57
SHA-512:	581AB1370242722CB27BD749C6F7D1A6D8A059C27C042701E645E375BF3A9E6ADC1532B5B3E4E2292D1C140DDF6F21181E83C1434CB47ECDC4E17764746E5563
Malicious:	false
Preview:	./*. Module dependencies.. /..var Symbol = require('es6-symbol');.var debug = require('debug')('array-index');..var get = Symbol('get');.var set = Symbol('set');.var length = Symbol('length');../. JavaScript Array "length" is bound to an unsigned 32-bit int.. * See: http://stackoverflow.com/a/6155063/376773. /..var MAX_LENGTH = Math.pow(2, 32);../. Module exports.. /..module.exports = ArrayIndex;.ArrayIndex.get = get;.ArrayIndex.set = set;../. Subclass this.. /..function ArrayIndex (_length) {. Object.defineProperty(this, 'length', {. get: getLength,. set: setLength,. enumerable: false,. configurable: true. });.. this[length] = 0;.. if (arguments.length > 0) {. setLength.call(this, _length);. }.}../. You overwrite the "get" Symbol in your subclass.. /..ArrayIndex.prototype[ArrayIndex.get] = function () {. throw new Error('you must implement the `ArrayIndex.get` Symbol');.};../. You overwrite the "set" Symbol in your subclass.. */..ArrayI

C:\Program Files (x86)\????????\resources\app\node_modules\array-index\node_modules\debug\LICENSE

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	5.12256218715534
Encrypted:	false
SSDEEP:	24:kr4/HHHP0yPP3gtqHw1hH9MPHcv48Ok4MdboHoqDFz:k8/vlPvERdMPHhIjcHoOFz
MD5:	DDD815A475E7338B0BE7A14D8EE35A99
SHA1:	D16A2786962571280A11CAE01D5E59AEB1351C9A
SHA-256:	98C970DE440DCFC77471610AEC2377C9D9B0DB2B3BE6D1ADD524A586E1D7F422
SHA-512:	47B612EF4E93F1AF62891E295E9FBAC05E02CF1726F56C36FAD5314376E28CBCAF7C8355527BC0BDA54C26CBE097BC8CA5CB4F79AA9E3AB6F1D875DCA41D4AAC
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2014 TJ Holowaychuk <tj@vision-media.ca>..Permission is hereby granted, free of charge, to any person obtaining a copy of this software .and associated documentation files (the 'Software'), to deal in the Software without restriction, .including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, .and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so,.subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or substantial .portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT .LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. .IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, .WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWIS

C:\Program Files (x86)\????????\resources\app\node_modules\array-index\node_modules\debug\Makefile

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1059
Entropy (8bit):	5.556812469512553
Encrypted:	false
SSDEEP:	24:0VZxRBMWsQWs17QHHi0cEsvnxLMkcyacxH6kjS4zwbjhNav+yx6bn/JygknmhrU:mZjLsQWs5GHildvnWk5ach6kb1un/Jy/
MD5:	F8739CAB4AE015EE84820716A8AC193A
SHA1:	89EB5A7B8385734EF7FF4F910D4605CDE0BC12FD
SHA-256:	F6466507E02C62F14E477AF08E4A13EC883152B54D87FEEFFB8F0D6DE6E9013B
SHA-512:	EF875B744303169B5600CE5C42A0791A38BF933983F5011BA2EA9560AC5449E6FE9D4AE706EFC970B40096B9533A425FFC53265353EAD256BE44606790688BF1
Malicious:	false
Preview:	# get Makefile directory name: http://stackoverflow.com/a/5982798/376773.THIS_MAKEFILE_PATH:=$(word $(words $(MAKEFILE_LIST)),$(MAKEFILE_LIST)).THIS_DIR:=$(shell cd $(dir $(THIS_MAKEFILE_PATH));pwd)..# BIN directory.BIN := $(THIS_DIR)/node_modules/.bin..# Path.PATH := node_modules/.bin:$(PATH).SHELL := /bin/bash..# applications.NODE ?= $(shell which node).YARN ?= $(shell which yarn).PKG ?= $(if $(YARN),$(YARN),$(NODE) $(shell which npm)).BROWSERIFY ?= $(NODE) $(BIN)/browserify...FORCE:..install: node_modules..node_modules: package.json..@NODE_ENV= $(PKG) install..@touch node_modules..lint: .FORCE..eslint browser.js debug.js index.js node.js..test-node: .FORCE..istanbul cover node_modules/mocha/bin/_mocha -- test/**.js..test-browser: .FORCE..mkdir -p dist...@$(BROWSERIFY) \...--standalone debug \.... > dist/debug.js...karma start --single-run..rimraf dist..test: .FORCE..concurrently \..."make test-node" \..."make test-browser"..coveralls:..cat ./coverage/lcov.info \| ./node_modules/cover

C:\Program Files (x86)\????????\resources\app\node_modules\array-index\node_modules\debug\component.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	321
Entropy (8bit):	4.465851094571166
Encrypted:	false
SSDEEP:	6:vX6aLWJd/k9ExRcUS1YpuXH+HQ6MEwHQJIxKHlOXdHhXdBA7SF9CVNkQ:SaLAh3XI1YpYY5MNsSKOdhdBAmCJ
MD5:	510AF4D67A35446E6DCCEA1429399C3A
SHA1:	4963889B7905ABD5A8955B8D27C3079E2D449564
SHA-256:	2E5AB9AE90F41699E00D00FCA16765024F437300A0568C2208669CC281BA7656
SHA-512:	BB8D1E0E4C99A82D32FB40DAA9A79E2ABF3A3F495B3DC9AFA883021110B3CA9EB93E052D71E98D6494722DF947EC280D66F4BCA36BB0AE975F05D710E8C47415
Malicious:	false
Preview:	{. "name": "debug",. "repo": "visionmedia/debug",. "description": "small debugging utility",. "version": "2.6.9",. "keywords": [. "debug",. "log",. "debugger". ],. "main": "src/browser.js",. "scripts": [. "src/browser.js",. "src/debug.js". ],. "dependencies": {. "rauchg/ms.js": "0.7.1". }.}.

C:\Program Files (x86)\????????\resources\app\node_modules\array-index\node_modules\debug\node.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.362814895472354
Encrypted:	false
SSDEEP:	3:3BBBbJCfv:xBBa
MD5:	79F3814F32362C1C6F9DBB8A1E3B01BF
SHA1:	AA7655EE80C9A485313675F9379C2F18D33EA061
SHA-256:	996B381F353555CB172EBB2802BB2A7323442FF67B7B530CC26834058D7F31A2
SHA-512:	61367EC2AFF9349E203A295FE1BC28FADDC6D80B556660F56EA49D6625D6228212FE82D7398114509A3B8D9AD4026429F0EBB849579C7481928F47F37C8632D5
Malicious:	false
Preview:	module.exports = require('./src/node');.

C:\Program Files (x86)\????????\resources\app\node_modules\array-index\node_modules\debug\package.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	947
Entropy (8bit):	4.719000084065857
Encrypted:	false
SSDEEP:	12:S11YpubmF26PhB3XaES6FA0UdpHPxmNZJBQ1yhc7lyaGtBYWJ3VuYkdFsjnydI7:S11clxHaDeUPANZJW1kWmYWJUYUeL57
MD5:	7ABA40BB4BB615BAA501A036807CA5CA
SHA1:	ABC836CB12C91289A5EAE71C6B13FF56C7429D1F
SHA-256:	9EAF6733D4C4FE3DD77ABADF7EBAFA6ACAFBFE9A9484E717C262CA8A0EE88E3A
SHA-512:	240654924FA43B311F2C6DE86831B74A790024A7226CEB120F796DC49D184C10381FF6022D77718DACC5016821F4FC07892009D7B7DBA3A525322A5A3CCAF51C
Malicious:	false
Preview:	{. "name": "debug",. "version": "2.6.9",. "repository": {. "type": "git",. "url": "git://github.com/visionmedia/debug.git". },. "description": "small debugging utility",. "author": "TJ Holowaychuk <tj@vision-media.ca>",. "license": "MIT",. "dependencies": {. "ms": "2.0.0". },. "devDependencies": {. "browserify": "9.0.3",. "chai": "^3.5.0",. "concurrently": "^3.1.0",. "coveralls": "^2.11.15",. "eslint": "^3.12.1",. "istanbul": "^0.4.5",. "karma": "^1.3.0",. "karma-chai": "^0.1.0",. "karma-mocha": "^1.3.0",. "karma-phantomjs-launcher": "^1.0.2",. "karma-sinon": "^1.0.5",. "mocha": "^3.2.0",. "mocha-lcov-reporter": "^1.2.0",. "rimraf": "^2.5.4",. "sinon": "^1.17.6",. "sinon-chai": "^2.8.0". },. "main": "./src/index.js",. "browser": "./src/browser.js",. "component": {. "scripts": {. "debug/index.js": "browser.js",. "debug/debug.js": "debug.js". }. }.}

C:\Program Files (x86)\????????\resources\app\node_modules\array-index\node_modules\debug\src\browser.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4734
Entropy (8bit):	4.98143252477633
Encrypted:	false
SSDEEP:	96:Yl2YeMOqXjS+qBAyJN3spJaRCWqS9KynCYBPVQPVI8rxjpXTjjnZwEKlTDDFanP/:EHX2+FyisIWznCwPVQPVIIlpDjjnZwju
MD5:	62CFEE6D6DD5FFEC5D3ED35073791AEC
SHA1:	C41ADC79487F377D3DFB397C531812FB9CC429A2
SHA-256:	0144AB6A52B9330C567DE11A5C3A4AEA35CDAC47A4C106482AA24AE8054CDC6F
SHA-512:	920AEA250D98E29E8005EF0185DF5E34BC426D321785DF07CBABACE60BDBCFC6C92E2FF0C9F226A54925D2C7D595035EFEABABC935C7F1A4C704E7A7EF641339
Malicious:	false
Preview:	/*. This is the web browser implementation of `debug()`.. . Expose `debug()` as the module.. /..exports = module.exports = require('./debug');.exports.log = log;.exports.formatArgs = formatArgs;.exports.save = save;.exports.load = load;.exports.useColors = useColors;.exports.storage = 'undefined' != typeof chrome. && 'undefined' != typeof chrome.storage. ? chrome.storage.local. : localstorage();../. Colors.. /..exports.colors = [. 'lightseagreen',. 'forestgreen',. 'goldenrod',. 'dodgerblue',. 'darkorchid',. 'crimson'.];../. Currently only WebKit-based Web Inspectors, Firefox >= v31,. * and the Firebug extension (any Firefox version) are known. * to support "%c" CSS customizations.. . TODO: add a `localStorage` variable to explicitly enable/disable colors. */..function useColors() {. // NB: In an Electron preload script, document will be defined but not fully. // initialized. Since we know we're in Chrome, we'll

C:\Program Files (x86)\????????\resources\app\node_modules\array-index\node_modules\debug\src\debug.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4394
Entropy (8bit):	4.818652396947732
Encrypted:	false
SSDEEP:	96:TlGI0EEQUGReeJ57vPukDprmTC70WWnuOV123LwdVVktI15wHlL6ci6:JR7Jprp70JX23KVVkWsHZ06
MD5:	74BDCCF347345D27FE8A4AC3ADD99C60
SHA1:	A2B8A915C86FC750F56A7137860F19EC1182EE21
SHA-256:	D8D1C1D6C387AB67C3F28D78FD0B20B9BECD69442DB9D3EFE110CA464B509C8A
SHA-512:	C2D47EFEE2A4442BE6375D623F46B4C7EE9552C132B9229EB284BDD98629EDD02664167805B0AF9B3FAAA9B1906E9ED0C5E383396D4995CEF7051F9A450E1B99
Malicious:	false
Preview:	./*. This is the common logic for both the Node.js and web browser. * implementations of `debug()`.. . Expose `debug()` as the module.. /..exports = module.exports = createDebug.debug = createDebug['default'] = createDebug;.exports.coerce = coerce;.exports.disable = disable;.exports.enable = enable;.exports.enabled = enabled;.exports.humanize = require('ms');../. The currently active debug mode names, and names to skip.. /..exports.names = [];.exports.skips = [];../. Map of special "%n" handling functions, for the debug "format" argument.. . Valid key names are a single, lower or upper-case letter, i.e. "n" and "N".. /..exports.formatters = {};../. Previous log timestamp.. /..var prevTime;../. Select a color.. * @param {String} namespace. * @return {Number}. * @api private. */..function selectColor(namespace) {. var hash = 0, i;.. for (i in namespace) {. hash = ((hash << 5) - hash) + namespace.charCodeAt(i);. hash \|= 0; // Convert to 32bit integer.

C:\Program Files (x86)\????????\resources\app\node_modules\array-index\node_modules\debug\src\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	263
Entropy (8bit):	4.632071401695598
Encrypted:	false
SSDEEP:	3:UV9WQYXu2CXK/FzGXMC4dF2PvbhEAS30vaFAVhVEE71ADKL5DVg6VAi1LKLkyBbb:U+DX74LNSkvaFwDEEtU6nsLZBf3bjBOY
MD5:	DD13897EA2EED92695BB7E4E744A9148
SHA1:	182314D32E789E4F9C29E3150AE392F1630F171C
SHA-256:	9A34FEDEB2D269C46ED94E6F13039EB0D16D866DD460EC66FA3ACD78122FA9FE
SHA-512:	0B53BC984178336AC516601E72D477D2BEEEF6936800DA17D3A79C153E0036F7428517EBD75D296729F65856C7E07749029F5AA192B2AC071EFC4D3E39750A32
Malicious:	false
Preview:	/*. Detect Electron renderer process, which is node, but we should. * treat as a browser.. */..if (typeof process !== 'undefined' && process.type === 'renderer') {. module.exports = require('./browser.js');.} else {. module.exports = require('./node.js');.}.

C:\Program Files (x86)\????????\resources\app\node_modules\array-index\node_modules\debug\src\inspector-log.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	373
Entropy (8bit):	4.732381821992279
Encrypted:	false
SSDEEP:	6:xBBzsUKU2aEmL3L3MHOMcGLuGIOWA9zFtqMKKb1dCWB6kmG7TNXxn:xBBgARbDL3GF/ut/G6q1L4Ux
MD5:	B22697B673C7C3586F22AE0206258FDE
SHA1:	B2F2996B1F38B6CEC0B1746BE6CFE458F2585EAC
SHA-256:	949AE67EC1B655694F83DCE57D47D9D77234F9E7D698616932A90E69C7AFEE91
SHA-512:	4FFD89DBC519A1F6C2F56A1B26F1AAD445DF8D5096DA1453645DBB67DC58B17AE9143906357CA4AF60059740C3BA34F7233049652B805D1AFED3FD206CD55A0C
Malicious:	false
Preview:	module.exports = inspectorLog;..// black hole.const nullStream = new (require('stream').Writable)();.nullStream._write = () => {};../*. Outputs a `console.log()` to the Node.js Inspector console only.. */.function inspectorLog() {. const stdout = console._stdout;. console._stdout = nullStream;. console.log.apply(console, arguments);. console._stdout = stdout;.}.

C:\Program Files (x86)\????????\resources\app\node_modules\array-index\node_modules\debug\src\node.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6015
Entropy (8bit):	4.983354444087808
Encrypted:	false
SSDEEP:	96:2l2OYeMOqXfMWj7/UZIjh7X7QcYX82ue1jGVLE9RlbME6tCUXXuVTtAH1ReKLGH/:WAX3tJ7nYMu1jGVLE9RlbDECQoTtAHbC
MD5:	25807A97FBB1FCC42A013ABC7D7768C4
SHA1:	F24D52CBC9144B011DEF218234FF7B50E7DDCB19
SHA-256:	A3E83594A4CE88997E2E4FC66BC942B17B9D736290AD62560C7F09D6D0989AD0
SHA-512:	8D316B63700126D7C8965A886E9B35A332D3F7E68D28F2264D235C0AFAD28066F877F25821E1983DDDE5F2D5052716CC73338779B41B6F4D1B90AD33DC3E9F24
Malicious:	false
Preview:	/*. Module dependencies.. /..var tty = require('tty');.var util = require('util');../. This is the Node.js implementation of `debug()`.. . Expose `debug()` as the module.. /..exports = module.exports = require('./debug');.exports.init = init;.exports.log = log;.exports.formatArgs = formatArgs;.exports.save = save;.exports.load = load;.exports.useColors = useColors;../. Colors.. /..exports.colors = [6, 2, 3, 4, 5, 1];../. Build up the default `inspectOpts` object from the environment variables.. . $ DEBUG_COLORS=no DEBUG_DEPTH=10 DEBUG_SHOW_HIDDEN=enabled node script.js. */..exports.inspectOpts = Object.keys(process.env).filter(function (key) {. return /^debug_/i.test(key);.}).reduce(function (obj, key) {. // camel-case. var prop = key. .substring(6). .toLowerCase(). .replace(/_([a-z])/g, function (_, k) { return k.toUpperCase() });.. // coerce string value into JS value. var val = process.env[key];. if (/^(yes\|on\|true\|enabled)$/i.test(val)) val

C:\Program Files (x86)\????????\resources\app\node_modules\array-index\node_modules\ms\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2764
Entropy (8bit):	4.722254619992073
Encrypted:	false
SSDEEP:	48:1I4pOT+6FLQFChYQlCrFWn5q4W55i8vBeH321aEEg1JPzC3yheCLy0C+ywC8jyGc:iNy6FLQU2SChWn5q4W55F0XeaEru3ylW
MD5:	AE157C9A8E70902576C2D8A06DBCDE32
SHA1:	0D10EE921436FA5FF5988445CC67676219DFFFBE
SHA-256:	4BD92209CB9DACF3E3773E725ACB7AAEC43EA9E78540324E4D0F73E5CE9ADEF7
SHA-512:	4C2F31F1F2A297AB6C55A21D58A5C26CAD22C1ED1913E7A48605111D217257AE2D9F26EA889E8610E011BA9B9C487C91ECDB4CEA3437534FAF905E8FB89BA248
Malicious:	false
Preview:	/*. Helpers.. /..var s = 1000;.var m = s 60;.var h = m * 60;.var d = h * 24;.var y = d * 365.25;../*. Parse or format the given `val`.. . Options:. . - `long` verbose formatting [false]. . @param {String\|Number} val. * @param {Object} [options]. * @throws {Error} throw an error if val is not a non-empty string or a number. * @return {String\|Number}. * @api public. /..module.exports = function(val, options) {. options = options \|\| {};. var type = typeof val;. if (type === 'string' && val.length > 0) {. return parse(val);. } else if (type === 'number' && isNaN(val) === false) {. return options.long ? fmtLong(val) : fmtShort(val);. }. throw new Error(. 'val is not a non-empty string or a valid number. val=' +. JSON.stringify(val). );.};../. Parse the given `str` and return milliseconds.. . @param {String} str. * @return {Number}. * @api private. */..function parse(str) {. str = String(str);. if (str.length > 100) {. return;. }. var ma

C:\Program Files (x86)\????????\resources\app\node_modules\array-index\node_modules\ms\license.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1077
Entropy (8bit):	5.1041829250749355
Encrypted:	false
SSDEEP:	24:buyDrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:bBDaJHlxE3dQHOs5exm3ogFh
MD5:	FD56FD5F1860961DFA92D313167C37A6
SHA1:	884E84EBFDDAFD93B5BB814DF076D2EBD1757BA8
SHA-256:	6652830C2607C722B66F1B57DE15877AB8FC5DCA406CC5B335AFEB365D0F32C1
SHA-512:	2BEC1EFB4DC59FA436C38A1B45B3DBD54A368460BCBBB3D9791B65275B5DC3C71A4C54BE458F4C74761DCCB8897EFAAB46DF5A407723DA5C48F3DB02D555D5B9
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2016 Zeit, Inc...Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR I

C:\Program Files (x86)\????????\resources\app\node_modules\array-index\node_modules\ms\package.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	469
Entropy (8bit):	4.474088868079662
Encrypted:	false
SSDEEP:	12:7t134gRJxQwK/GCqs5RBR74J3YqeCVCSW9:513pRXQwPs1R76YfCISW9
MD5:	F42378FDBF68684B3182D97FD2D513AB
SHA1:	DA3112449313FFE6CF6049DF3227A24CEBF67D8C
SHA-256:	72A34B18A15CAEC1A2090E28951128F015F6E92D882E4211F08E8284C0F8C3D3
SHA-512:	E39C7328C76A780751CEF8E4C9D8685ECEC5A5AFC857DBAC6FB3E2226B75BA6A21AF0D38593113665E21D07220070A0FFAFFDA28ECDF68B416BD2805520E7EEA
Malicious:	false
Preview:	{. "name": "ms",. "version": "2.0.0",. "description": "Tiny milisecond conversion utility",. "repository": "zeit/ms",. "main": "./index",. "files": [. "index.js". ],. "lint-staged": {. "*.js": [. "npm run lint",. "prettier --single-quote --write",. "git add". ]. },. "license": "MIT",. "devDependencies": {. "eslint": "3.19.0",. "expect.js": "0.3.1",. "husky": "0.13.3",. "lint-staged": "3.4.1",. "mocha": "3.4.1". }.}

C:\Program Files (x86)\????????\resources\app\node_modules\array-index\package.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	455
Entropy (8bit):	4.722908204656419
Encrypted:	false
SSDEEP:	6:vgyMQTb/q6AVddS18tg3enM1ywBP8wn/Ly+T6zRRPEklUSc2JnIhc67OKCeHQNwe:xMa7qrQ18K1y7EbmF2YUS7P6awqwGuPy
MD5:	B5E1BEC057EA40F05BA9BB7384C81730
SHA1:	2F759EBE2A433C699225C5DDC21B74BAFB01C723
SHA-256:	04587301C21459C786FC89362CE3090C749AAED9D6E8B70EEC07639E6B099C11
SHA-512:	EDA6FD04F7BD8E921BFEEF5B98AF0B0D6C4C72B41395CB9E4014E95475DDC8AFE15E99A9F5DA9D2EB95395E8CC8176C874EFA1FE8C81DCCA9874DD5DA531B913
Malicious:	false
Preview:	{. "name": "array-index",. "description": "Invoke getter/setter functions on array-like objects",. "version": "1.0.0",. "license": "MIT",. "author": "Nathan Rajlich <nathan@tootallnate.net> (http://tootallnate.net)",. "repository": {. "type": "git",. "url": "git://github.com/TooTallNate/array-index.git". },. "main": "index.js",. "dependencies": {. "debug": "^2.2.0",. "es6-symbol": "^3.0.2". },. "engines": {. "node": "*". }.}

C:\Program Files (x86)\????????\resources\app\node_modules\axios\dist\axios.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	63819
Entropy (8bit):	5.012519512711335
Encrypted:	false
SSDEEP:	768:/Yn7dDzAiWITHUnOLVRm5RjIyHJUoJeP+xjKKx7AXO+yAiRhAq7:/Y7dDcLOLVQHx7A27
MD5:	AE78AE65630D6FEB3C0D7F460E8D24CF
SHA1:	91D15FEC92BE3F2E74AFE99B0E86CE9D9414C6C0
SHA-256:	8B1412094B57823CD552FA441AAE1A373652CF76C50FC6D28CE71DBD633D05B4
SHA-512:	30D5BA21BA4DB99676547F6780587387A714B7C2FFD2B4956BAD05F0BDB62B51FBDABA382A2DCCFFCD7A7920CB9E1202BBBBF01FFFBFC9BF2807706D04B84CB0
Malicious:	false
Preview:	(function webpackUniversalModuleDefinition(root, factory) {..if(typeof exports === 'object' && typeof module === 'object')...module.exports = factory();..else if(typeof define === 'function' && define.amd)...define([], factory);..else if(typeof exports === 'object')...exports["axios"] = factory();..else...root["axios"] = factory();.})(this, function() {.return /****/ (function(modules) { // webpackBootstrap./**/ .// The module cache./**/ .var installedModules = {};./**/./**/ .// The require function./**/ .function __webpack_require__(moduleId) {./**/./**/ ..// Check if module is in cache./**/ ..if(installedModules[moduleId]) {./**/ ...return installedModules[moduleId].exports;./**/ ..}./**/ ..// Create a new module (and put it into the cache)./**/ ..var module = installedModules[moduleId] = {./**/ ...i: moduleId,./**/ ...l: false,./**/ ...exports: {}./**/ ..};./**/./**/ ..// Execute the module function./****/ .

C:\Program Files (x86)\????????\resources\app\node_modules\axios\dist\axios.map

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	69233
Entropy (8bit):	5.0617917067534535
Encrypted:	false
SSDEEP:	768:aB/l4/nLbPT1Ch/5RFSIMymT7Sg9oqosqNFd4GysbNgb//hWhAB1qOnayRsWh:aB/m/nLbPYh/TdmT7ZlHhWhA7
MD5:	8BE1B894AA4C1C78C70DBE0B24C5E410
SHA1:	03728D4CEBE3E1AE8ACE51AC9E0A9F29B93E1757
SHA-256:	7AE5C4571C6F84EFDCA00143068474F9AE16532746D4BEA34E70E3D1AC87AD62
SHA-512:	A957B9A73879F8ABFA0301D020C6D69F8B922C347E4CD350720FAC3BCE338DD803A14198BD99A52C6EE5022415E7F2397429B686F47D78FFFD0ACD54772DD50A
Malicious:	false
Preview:	{"version":3,"sources":["webpack://axios/webpack/universalModuleDefinition","webpack://axios/webpack/bootstrap","webpack://axios/./index.js","webpack://axios/./lib/adapters/xhr.js","webpack://axios/./lib/axios.js","webpack://axios/./lib/cancel/Cancel.js","webpack://axios/./lib/cancel/CancelToken.js","webpack://axios/./lib/cancel/isCancel.js","webpack://axios/./lib/core/Axios.js","webpack://axios/./lib/core/InterceptorManager.js","webpack://axios/./lib/core/buildFullPath.js","webpack://axios/./lib/core/createError.js","webpack://axios/./lib/core/dispatchRequest.js","webpack://axios/./lib/core/enhanceError.js","webpack://axios/./lib/core/mergeConfig.js","webpack://axios/./lib/core/settle.js","webpack://axios/./lib/core/transformData.js","webpack://axios/./lib/defaults.js","webpack://axios/./lib/env/data.js","webpack://axios/./lib/helpers/bind.js","webpack://axios/./lib/helpers/buildURL.js","webpack://axios/./lib/helpers/combineURLs.js","webpack://axios/./lib/helpers/cookies.js","webpack:

C:\Program Files (x86)\????????\resources\app\node_modules\axios\dist\axios.min.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	17753
Entropy (8bit):	5.156215588587156
Encrypted:	false
SSDEEP:	384:3/v6SEJEL21DaP9epzrPtjBL3jXDDnrxytZ5CwSD1ViQCKq:H5qgP9exrtBrxrifp
MD5:	45CBE3D18B7C2198A680656563A329B6
SHA1:	197FDCEA00F136E97D9A50B6F05A8A0A26804749
SHA-256:	9DE7375B7AFD386E037872A35AF5AA58E089986CFE9E5E2C783976528EFB5F2F
SHA-512:	6CF877BB0814E6A10C8A94BF54E991AB29E7317186491BFEEF61FF376EB43107976482B83C6E3CE34D41B1BCBD36AE4FE5FCFB872E5418D982FD6D59E7587619
Malicious:	false
Preview:	!function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.axios=t():e.axios=t()}(this,(function(){return function(e){var t={};function n(r){if(t[r])return t[r].exports;var o=t[r]={i:r,l:!1,exports:{}};return e[r].call(o.exports,o,o.exports,n),o.l=!0,o.exports}return n.m=e,n.c=t,n.d=function(e,t,r){n.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:r})},n.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},n.t=function(e,t){if(1&t&&(e=n(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var r=Object.create(null);if(n.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var o in e)n.d(r,o,function(t){return e[t]}.bind(null,o));return r},n.n=function(e){var t=e&&e.__esModule?function(){return e.defaul

C:\Program Files (x86)\????????\resources\app\node_modules\axios\dist\axios.min.map

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	81171
Entropy (8bit):	5.350402800463438
Encrypted:	false
SSDEEP:	1536:aGtP7MVgSL0baJuO/RL11LbPc/h/J5yhRAVVmT7r:aMQXb0/TshmrmT/
MD5:	B6822251FB93F725FC3BAC420DEC50BC
SHA1:	004AC8307B982ADAFAA6A24491F6FA94E8178B58
SHA-256:	FC60630DB4062C9FB69254C3E0D45C9BB8E39A3314C1ED29624E455BF94463A7
SHA-512:	404EF3D1FD5B3F1950774A8FD81D6F48F28A4CFA186FB2037602788F26699F196E8AA0C1F3FE13A5BB6A8F9127169FC7E39BC9F53026AE2BB1679778005CE0A9
Malicious:	false
Preview:	{"version":3,"sources":["webpack://axios/webpack/universalModuleDefinition","webpack://axios/webpack/bootstrap","webpack://axios/./lib/utils.js","webpack://axios/./lib/defaults.js","webpack://axios/./lib/cancel/Cancel.js","webpack://axios/./lib/helpers/bind.js","webpack://axios/./lib/helpers/buildURL.js","webpack://axios/./lib/core/enhanceError.js","webpack://axios/./lib/adapters/xhr.js","webpack://axios/./lib/core/createError.js","webpack://axios/./lib/cancel/isCancel.js","webpack://axios/./lib/core/mergeConfig.js","webpack://axios/./lib/env/data.js","webpack://axios/./index.js","webpack://axios/./lib/axios.js","webpack://axios/./lib/core/Axios.js","webpack://axios/./lib/core/InterceptorManager.js","webpack://axios/./lib/core/dispatchRequest.js","webpack://axios/./lib/core/transformData.js","webpack://axios/./lib/helpers/normalizeHeaderName.js","webpack://axios/./lib/core/settle.js","webpack://axios/./lib/helpers/cookies.js","webpack://axios/./lib/core/buildFullPath.js","webpack://axi

C:\Program Files (x86)\????????\resources\app\node_modules\axios\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.365311532225101
Encrypted:	false
SSDEEP:	3:3BBBbJu0imn:xBBc0im
MD5:	7057C14DACB26642C8E57ACD1FEBB0B8
SHA1:	C8D173EA3C2CD2E5D6D84C83A7188F42107295C9
SHA-256:	8B785B48DB6AE7996D6CEFC4BF461E1C35EB893B20C3ACFD0A17D9888CFA0663
SHA-512:	175817F7BC0B2EB28E2D8924B6D34AD1EC27F93D4CAF73A40C108C68CD912DF7AAC8F40932C9E2E6F08824ADA29A2CCBEAE7DFADA16A32C7E6215BC062333BF9
Malicious:	false
Preview:	module.exports = require('./lib/axios');

C:\Program Files (x86)\????????\resources\app\node_modules\axios\lib\adapters\README.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	915
Entropy (8bit):	4.469576130417574
Encrypted:	false
SSDEEP:	24:XHHhQpc4Fhd6BBR5FK9HDENUnTzAKOLYglwn+PAX54i:XHHMvPd6XzQypwn+IN
MD5:	CBCBAA4FA2446B9CDDF40CDA0037FB17
SHA1:	C2FB161DB24F3066109F92C2CBE2FA5735510917
SHA-256:	9B5964E5282869527662DA5236C9136098456F71E1CB29FF3E14363ACC9B6B22
SHA-512:	3C8274F57E22EB58F658F0302713EBD1BF516D880A258FAEB1309A9551A5867AFB86016FB30A4BB2B50B6B6EC5E8D32C87EA4C36B33E16F8D0A428337E0947D0
Malicious:	false
Preview:	# axios // adapters..The modules under `adapters/` are modules that handle dispatching a request and settling a returned `Promise` once a response is received...## Example..```js.var settle = require('./../core/settle');..module.exports = function myAdapter(config) {. // At this point:. // - config has been merged with defaults. // - request transformers have already run. // - request interceptors have already run. . // Make the request using config provided. // Upon response settle the Promise.. return new Promise(function(resolve, reject) {. . var response = {. data: responseData,. status: request.status,. statusText: request.statusText,. headers: responseHeaders,. config: config,. request: request. };.. settle(resolve, reject, response);.. // From here:. // - response transformers will run. // - response interceptors will run. });.}.```.

C:\Program Files (x86)\????????\resources\app\node_modules\axios\lib\adapters\http.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	13498
Entropy (8bit):	4.670320872239038
Encrypted:	false
SSDEEP:	192:MilCWUiS+ag1lEFXUrh0iRiNFNnrLx9yaq24OMqoJYDW4Vsw/iQ+vZCZDCrI6Pgf:vpfGk9R6f0J0V1/iNZCZDiMH3
MD5:	6DC6C84F44D072C75D20A46FC6B83501
SHA1:	207BAC87A0AFF3FD508B1B1066322C9143F0066F
SHA-256:	A8875E52EDBEF03FA2B23CCD9045F88A8261467DAE4A31D79F7E38B602397021
SHA-512:	4E30778E5FCC041C9723F80537CD1D3598075569A6F633A8740752F12C5A93B121973B0ED54C71EB758201D1C2D29CFB05445CC11797A22483D40D915200FB6C
Malicious:	false
Preview:	'use strict';..var utils = require('./../utils');.var settle = require('./../core/settle');.var buildFullPath = require('../core/buildFullPath');.var buildURL = require('./../helpers/buildURL');.var http = require('http');.var https = require('https');.var httpFollow = require('follow-redirects').http;.var httpsFollow = require('follow-redirects').https;.var url = require('url');.var zlib = require('zlib');.var VERSION = require('./../env/data').version;.var createError = require('../core/createError');.var enhanceError = require('../core/enhanceError');.var defaults = require('../defaults');.var Cancel = require('../cancel/Cancel');..var isHttps = /https:?/;../*. . * @param {http.ClientRequestArgs} options. * @param {AxiosProxyConfig} proxy. * @param {string} location. */.function setProxy(options, proxy, location) {. options.hostname = proxy.host;. options.host = proxy.host;. options.port = proxy.port;. options.path = location;.. // Basic proxy authorization. if (proxy.auth)

C:\Program Files (x86)\????????\resources\app\node_modules\axios\lib\adapters\xhr.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6954
Entropy (8bit):	4.635377489507681
Encrypted:	false
SSDEEP:	192:wjURu+FE1A1+IOq77IMRTRpK2CQI2HaRM2rR:wg/ndDMft9
MD5:	4449DBBF1397A91D49AA9F0D82966F71
SHA1:	682CF784FC89F1316D389C438BD2550F172F070F
SHA-256:	544FC57A252B43728B00983D15FE085A94E5DBAC72BCD40EF8703A4991244215
SHA-512:	5D536DCB81CA8A7B51B7E57D2928986F46EFA1590F5EA59F92CF8052378DB540AB89FAAC387FCC14AFBD5DB705B020B908374D20AF706C6CD108BCC7197483B4
Malicious:	false
Preview:	'use strict';..var utils = require('./../utils');.var settle = require('./../core/settle');.var cookies = require('./../helpers/cookies');.var buildURL = require('./../helpers/buildURL');.var buildFullPath = require('../core/buildFullPath');.var parseHeaders = require('./../helpers/parseHeaders');.var isURLSameOrigin = require('./../helpers/isURLSameOrigin');.var createError = require('../core/createError');.var defaults = require('../defaults');.var Cancel = require('../cancel/Cancel');..module.exports = function xhrAdapter(config) {. return new Promise(function dispatchXhrRequest(resolve, reject) {. var requestData = config.data;. var requestHeaders = config.headers;. var responseType = config.responseType;. var onCanceled;. function done() {. if (config.cancelToken) {. config.cancelToken.unsubscribe(onCanceled);. }.. if (config.signal) {. config.signal.removeEventListener('abort', onCanceled);. }. }.. if (utils.isFormData(reque

C:\Program Files (x86)\????????\resources\app\node_modules\axios\lib\axios.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1560
Entropy (8bit):	4.795330651316382
Encrypted:	false
SSDEEP:	48:HDbzGOCGALGPEnzGC+GRlGROLGDOGuxIlk+GKGblGscXoT9mMrkAMp:j/etnvZKkkXoLkAMp
MD5:	B4B47877883B5C027E2A12A00125E096
SHA1:	981A7C28EA2710846B1899D6F61E22958A08DC29
SHA-256:	275D139768870BE210299E4CCA1E3456A46FD09991A324D7384949874F546AAD
SHA-512:	B65F772CD0C8FF0FB776DC7836D059DB4C76FE52CC0ED4A8E5341F37D52E9F47A57C3F9CA372223C6411F175E12FBC94DD669A8F304DFAC0FEA96C83568CBCCC
Malicious:	false
Preview:	'use strict';..var utils = require('./utils');.var bind = require('./helpers/bind');.var Axios = require('./core/Axios');.var mergeConfig = require('./core/mergeConfig');.var defaults = require('./defaults');../*. Create an instance of Axios. . @param {Object} defaultConfig The default config for the instance. * @return {Axios} A new instance of Axios. */.function createInstance(defaultConfig) {. var context = new Axios(defaultConfig);. var instance = bind(Axios.prototype.request, context);.. // Copy axios.prototype to instance. utils.extend(instance, Axios.prototype, context);.. // Copy context to instance. utils.extend(instance, context);.. // Factory for creating new instances. instance.create = function create(instanceConfig) {. return createInstance(mergeConfig(defaultConfig, instanceConfig));. };.. return instance;.}..// Create the default instance to be exported.var axios = createInstance(defaults);..// Expose Axios class to allow class inheritance.axios.Axios

C:\Program Files (x86)\????????\resources\app\node_modules\axios\lib\cancel\Cancel.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	385
Entropy (8bit):	4.778019556894335
Encrypted:	false
SSDEEP:	6:QQNQlsf1Bjxw9luybvW4H9im1IcqLs1vxgkvS1ikfKit42TcqLzXBZ6:zGg1ul7/dZIFs1vxgD1ZiG42TF7Bg
MD5:	E583D0DCCA1CC1D22A26E5482D99E599
SHA1:	EFEE0BD8003BF407B00C974D99609F553825E82C
SHA-256:	1F9A7C6171F0112F617F883927623169A52D2B1C3DEDDCCE2D36C1A823362AF3
SHA-512:	D6BAD7A53036D5C4FBC7F39495BB081D600AA1F2AE1D4CA531D6A46F2DE3350B229992E463AD208387D178A6844DAC0BFB0ADC66525CB1E99658010E56876955
Malicious:	false
Preview:	'use strict';../*. A `Cancel` is an object that is thrown when an operation is canceled.. . @class. * @param {string=} message The message.. */.function Cancel(message) {. this.message = message;.}..Cancel.prototype.toString = function toString() {. return 'Cancel' + (this.message ? ': ' + this.message : '');.};..Cancel.prototype.__CANCEL__ = true;..module.exports = Cancel;.

C:\Program Files (x86)\????????\resources\app\node_modules\axios\lib\cancel\CancelToken.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2469
Entropy (8bit):	4.671343895832232
Encrypted:	false
SSDEEP:	48:YlHXNZeV5RkcH9803wI9WlA9LtcYGK5sD551j3K8KrT:YlSLRkEe0PeYLtwK5A55xYT
MD5:	6A33BBE9255E6D20E4DDAE386644B899
SHA1:	E4F01C8B29829E185D8DC46E5ABEFC205D659AF2
SHA-256:	004CB2D853758FBDD45917CB08679A3C9646816B445DC93BF0EAC523DDBA372E
SHA-512:	9C54CB5669DE9F754332AD2C15CAD98EEBE17F5E00C235652AF56DF6ADC81087F52CE40A165E2F9AAB15D9F2D8B998B01AE6EA85C5505AD778B340AC84A60FB6
Malicious:	false
Preview:	'use strict';..var Cancel = require('./Cancel');../*. A `CancelToken` is an object that can be used to request cancellation of an operation.. . @class. * @param {Function} executor The executor function.. */.function CancelToken(executor) {. if (typeof executor !== 'function') {. throw new TypeError('executor must be a function.');. }.. var resolvePromise;.. this.promise = new Promise(function promiseExecutor(resolve) {. resolvePromise = resolve;. });.. var token = this;.. // eslint-disable-next-line func-names. this.promise.then(function(cancel) {. if (!token._listeners) return;.. var i;. var l = token._listeners.length;.. for (i = 0; i < l; i++) {. token._listeners[i](cancel);. }. token._listeners = null;. });.. // eslint-disable-next-line func-names. this.promise.then = function(onfulfilled) {. var _resolve;. // eslint-disable-next-line func-names. var promise = new Promise(function(resolve) {. token.subscribe(resolve);.

C:\Program Files (x86)\????????\resources\app\node_modules\axios\lib\cancel\isCancel.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	102
Entropy (8bit):	4.7878271866816124
Encrypted:	false
SSDEEP:	3:agWLBBbf2AJkMFwQ++EMfFBkzpqern:QFB6PEDEMfFBlO
MD5:	0A6A3B3ADE1A42F61F2C7EBF56B38419
SHA1:	02ABE1CAD49D0EE69AD732C43F3ECD2526D55A16
SHA-256:	2357B93DAE3EAD850F3F61CE960A90DC6275F67B339A68DA6F50348149081222
SHA-512:	8BF97F2F8385896B631E9B8918881C426C17593CBB1A666758B9808901358653E7D9F03C1DE39C781436FDC66B0AF20B84443F8476F0699A2EF919697A0F9A4A
Malicious:	false
Preview:	'use strict';..module.exports = function isCancel(value) {. return !!(value && value.__CANCEL__);.};.

C:\Program Files (x86)\????????\resources\app\node_modules\axios\lib\core\Axios.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4237
Entropy (8bit):	4.847006113925413
Encrypted:	false
SSDEEP:	96:F47FXje899iLmbZ6eES3SDSLCcfRbIEv+vbb1a49Saga6c:8FXa86mb8enSKDfRb3v+zb1a49Hga6c
MD5:	D4773E2FDE09CAC3FCD0A29B83D8F846
SHA1:	7A8750564C7AEEA7F0B37CDDD7235D48F739CB9C
SHA-256:	4075390276D6F1036B13CFAE07F352ABD6935AA82A2E817BBBB94A24A262DE74
SHA-512:	F3D63E969C1BA8AC8D145917D2B6AF109BAA8756794F0B44BACB17B42AEF185BD5EA66C9A50D80BA2FCE80A0280AA8D358F8C8E731DE2EFAF62ECF142BE556A5
Malicious:	false
Preview:	'use strict';..var utils = require('./../utils');.var buildURL = require('../helpers/buildURL');.var InterceptorManager = require('./InterceptorManager');.var dispatchRequest = require('./dispatchRequest');.var mergeConfig = require('./mergeConfig');.var validator = require('../helpers/validator');..var validators = validator.validators;./*. Create a new instance of Axios. . @param {Object} instanceConfig The default config for the instance. /.function Axios(instanceConfig) {. this.defaults = instanceConfig;. this.interceptors = {. request: new InterceptorManager(),. response: new InterceptorManager(). };.}../. Dispatch a request. . @param {Object} config The config specific for this request (merged with this.defaults). /.Axios.prototype.request = function request(configOrUrl, config) {. /eslint no-param-reassign:0*/. // Allow for axios('example/url'[, config]) a la fetch API. if (typeof configOrUrl === 'string') {. config = config \|\| {};. config.url =

C:\Program Files (x86)\????????\resources\app\node_modules\axios\lib\core\InterceptorManager.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1363
Entropy (8bit):	4.767623390648152
Encrypted:	false
SSDEEP:	24:A+WWAjgzYM6KZZpsaoENmP5cCZdC8l4m9lT6DYL0/T0Tu0Dx5YE1J5LBc:AVWA0B6KTpsao6mPdc8lHT6z/V0FiiJY
MD5:	6683B2BA1919842D15638A32675BFA27
SHA1:	695E74842C5C8A3D563BCCF56231059D2A3BC39B
SHA-256:	DB8154428C6365E4C6A84D6098C12BE35794218034DC251A6407C7D550981257
SHA-512:	92E93689B732D288308A33C173C946FADF64A0EBD9FE6D402A79C7D0773B70DD11EC054DE55D8B6F29C58271ADC581D02711BCCDA9EA97D845DE2A89A38A159E
Malicious:	false
Preview:	'use strict';..var utils = require('./../utils');..function InterceptorManager() {. this.handlers = [];.}../*. Add a new interceptor to the stack. . @param {Function} fulfilled The function to handle `then` for a `Promise`. * @param {Function} rejected The function to handle `reject` for a `Promise`. . @return {Number} An ID used to remove interceptor later. /.InterceptorManager.prototype.use = function use(fulfilled, rejected, options) {. this.handlers.push({. fulfilled: fulfilled,. rejected: rejected,. synchronous: options ? options.synchronous : false,. runWhen: options ? options.runWhen : null. });. return this.handlers.length - 1;.};../. Remove an interceptor from the stack. . @param {Number} id The ID that was returned by `use`. /.InterceptorManager.prototype.eject = function eject(id) {. if (this.handlers[id]) {. this.handlers[id] = null;. }.};../. Iterate over all the registered interceptors. . This method is particularly useful for

C:\Program Files (x86)\????????\resources\app\node_modules\axios\lib\core\README.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	399
Entropy (8bit):	4.525060298003178
Encrypted:	false
SSDEEP:	12:ZLH94e6RHdzJonm8rzrRO6GXlX61TdVmHlI:tdvkH9JKrzFSXlXK2Hq
MD5:	DF521092DB35E36209448669A64264DE
SHA1:	3B2ABB091FC59CE28A44E729EEDB38481204B58E
SHA-256:	6982A869F4DA4405A7B74E182CA2EEA0DA2ADE583EDD606D182BFC49AEE4CD2A
SHA-512:	B5D4365B51992ED68B1694687961133E5FB248C0D73D8C8BD72843C2C68D43DCB36ACC68990EA14F864C27308438B71E69D36C3E8BF59D37D55FA32F44EE5E9C
Malicious:	false
Preview:	# axios // core..The modules found in `core/` should be modules that are specific to the domain logic of axios. These modules would most likely not make sense to be consumed outside of the axios module, as their logic is too specific. Some examples of core modules are:..- Dispatching requests. - Requests sent via `adapters/` (see lib/adapters/README.md).- Managing interceptors.- Handling config.

C:\Program Files (x86)\????????\resources\app\node_modules\axios\lib\core\buildFullPath.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	695
Entropy (8bit):	4.783639792696207
Encrypted:	false
SSDEEP:	12:KUb8Un0t0Apt/iwzRx6mzRiJv2mzRfn/idzRYPAOzRbWB2tgEBFJNX2R3TmztXX7:ppApNlxRiJNs7O9bWQtgEBF7X2qz1X2C
MD5:	FA83814D8B074AFBF7585C716A7D0F9B
SHA1:	9CE888D557A5DB3CCA64E675FFC34289EF1F6EA7
SHA-256:	0638DE5FCBC775B6F5201831791FB9ECFB89A2B690B3FE814C8E3DE80BF2AFFB
SHA-512:	659FE1B94B84B0DC2DF59484959A722FF7E85E2F1EBDB3AEC053F892FF83FC88528D305D8B85D5415BE4F99F26449F86BBE7F5B90F3FE44202CF0AFE7BBD431D
Malicious:	false
Preview:	'use strict';..var isAbsoluteURL = require('../helpers/isAbsoluteURL');.var combineURLs = require('../helpers/combineURLs');../*. Creates a new URL by combining the baseURL with the requestedURL,. * only when the requestedURL is not already an absolute URL.. * If the requestURL is absolute, this function returns the requestedURL untouched.. . @param {string} baseURL The base URL. * @param {string} requestedURL Absolute or relative URL to combine. * @returns {string} The combined full path. */.module.exports = function buildFullPath(baseURL, requestedURL) {. if (baseURL && !isAbsoluteURL(requestedURL)) {. return combineURLs(baseURL, requestedURL);. }. return requestedURL;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\axios\lib\core\createError.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	625
Entropy (8bit):	4.684759958766649
Encrypted:	false
SSDEEP:	12:h4wEQyCmR4FnbsFPFYW4brL/yzRZH7BNWImRjK2HImRju:Kj4FnIPFYW4nL/aZbBCD6
MD5:	47B9E8B556CBBFAFAA16494DF8C5A343
SHA1:	50DDC0220BEB5EDDED3742E6124A8052A2AB2D72
SHA-256:	FA8EBE583FDC730E1189239195EE8B0DED0ABE7A5E50320496F6718E5B96F764
SHA-512:	21D1D8F33127242D70FBE4AA0195550AB8B1754AE28FD409D64DF797DD94EBD327BE709CFF0AB8A8393D3757A9042B5CE22B88233A4576D7A89F24FE7041D177
Malicious:	false
Preview:	'use strict';..var enhanceError = require('./enhanceError');../*. Create an Error with the specified message, config, error code, request and response.. . @param {string} message The error message.. * @param {Object} config The config.. * @param {string} [code] The error code (for example, 'ECONNABORTED').. * @param {Object} [request] The request.. * @param {Object} [response] The response.. * @returns {Error} The created error.. */.module.exports = function createError(message, config, code, request, response) {. var error = new Error(message);. return enhanceError(error, config, code, request, response);.};.

C:\Program Files (x86)\????????\resources\app\node_modules\axios\lib\core\dispatchRequest.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2122
Entropy (8bit):	4.662344528120091
Encrypted:	false
SSDEEP:	24:aySanGmK59W9W1J8E+HRt3amTHB/9WJs6FxNxyZWdYxmAdyi5KzZLZi3OlF9WH53:at3iE+HRtHhWkDdN5K/i3OlYaMnURO
MD5:	5A8F96CFAD24EE1E00C10F9492E2A22E
SHA1:	5175EDFFC216D9BEEEB754A4686919BEE9B6FF6D
SHA-256:	DF36F9C6A29E522133AEBF31F24824153E138E59E0EC787B936EC31F9B55C443
SHA-512:	C09AAC5A672AE4601CC507F4D26C07AAC5F548CC34D0A55AD4B62E87437FEB88D895AE573995A43A1E6B5C8AA32B9974E1C1176493B6B5B8886403FCC137FECE
Malicious:	false
Preview:	'use strict';..var utils = require('./../utils');.var transformData = require('./transformData');.var isCancel = require('../cancel/isCancel');.var defaults = require('../defaults');.var Cancel = require('../cancel/Cancel');../*. Throws a `Cancel` if cancellation has been requested.. /.function throwIfCancellationRequested(config) {. if (config.cancelToken) {. config.cancelToken.throwIfRequested();. }.. if (config.signal && config.signal.aborted) {. throw new Cancel('canceled');. }.}../. Dispatch a request to the server using the configured adapter.. . @param {object} config The config that is to be used for the request. * @returns {Promise} The Promise to be fulfilled. */.module.exports = function dispatchRequest(config) {. throwIfCancellationRequested(config);.. // Ensure headers exist. config.headers = config.headers \|\| {};.. // Transform request data. config.data = transformData.call(. config,. config.data,. config.headers,. config.transformReq

C:\Program Files (x86)\????????\resources\app\node_modules\axios\lib\core\enhanceError.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1132
Entropy (8bit):	4.627504581144047
Encrypted:	false
SSDEEP:	24:0e46IPFYW4nL/aZ7Bftqflfxj2p+h3LaMzBGS3IYRWmuXmTY6:FNIPmW4LI7iPj2peLak3I0WmuXm1
MD5:	0D257EC2EC8D52A18E33BDF2CCD5B027
SHA1:	6CAF5B44633C7819A459D0DCF47BF7B5D9C9CC7E
SHA-256:	A258F625E22F7A0F883D5DEC130EAD1BA87780892DA7EE0BB0E2657C6652914D
SHA-512:	DC29C1C067380CEF0D1FB5E2CCF9D729E67116BC7E0B9485A9C3EE6337F9793E6B113842F4BE43F7DF0F973242575B6A6ABA1A05BA7200076395D547C343D1D9
Malicious:	false
Preview:	'use strict';../*. Update an Error with the specified config, error code, and response.. . @param {Error} error The error to update.. * @param {Object} config The config.. * @param {string} [code] The error code (for example, 'ECONNABORTED').. * @param {Object} [request] The request.. * @param {Object} [response] The response.. * @returns {Error} The error.. */.module.exports = function enhanceError(error, config, code, request, response) {. error.config = config;. if (code) {. error.code = code;. }.. error.request = request;. error.response = response;. error.isAxiosError = true;.. error.toJSON = function toJSON() {. return {. // Standard. message: this.message,. name: this.name,. // Microsoft. description: this.description,. number: this.number,. // Mozilla. fileName: this.fileName,. lineNumber: this.lineNumber,. columnNumber: this.columnNumber,. stack: this.stack,. // Axios. config: this.config,.

C:\Program Files (x86)\????????\resources\app\node_modules\axios\lib\core\mergeConfig.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3195
Entropy (8bit):	4.90707300742587
Encrypted:	false
SSDEEP:	48:bY1+Pf1htZQLIiBHsKsiBIkIoXBWYqjWOY9Jb+:Z17ZQL9NthWkDXcpWd9JK
MD5:	CB831E4394CB0D63F7E5DD0EF080600E
SHA1:	36ABAB1684AE143409886AADEAE6333A2CCBDD86
SHA-256:	ADD547DDA161B894827EC7E9C78AC0C4CE746D7DA1D49D588B65AE4613744289
SHA-512:	E00E1F12B9F3548F6F733CBEFA669BFD5E49F48E65762A1730648F99FAB53170C45CAC4FC6AFBF4611F7134F429683EA5973779BE74D25C14A3769D452A70417
Malicious:	false
Preview:	'use strict';..var utils = require('../utils');../*. Config-specific merge-function which creates a new config-object. * by merging two configuration objects together.. . @param {Object} config1. * @param {Object} config2. * @returns {Object} New object resulting from merging config2 to config1. */.module.exports = function mergeConfig(config1, config2) {. // eslint-disable-next-line no-param-reassign. config2 = config2 \|\| {};. var config = {};.. function getMergedValue(target, source) {. if (utils.isPlainObject(target) && utils.isPlainObject(source)) {. return utils.merge(target, source);. } else if (utils.isPlainObject(source)) {. return utils.merge({}, source);. } else if (utils.isArray(source)) {. return source.slice();. }. return source;. }.. // eslint-disable-next-line consistent-return. function mergeDeepProperties(prop) {. if (!utils.isUndefined(config2[prop])) {. return getMergedValue(config1[prop], config2[prop]);. } else

C:\Program Files (x86)\????????\resources\app\node_modules\axios\lib\core\settle.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	706
Entropy (8bit):	4.525270872185212
Encrypted:	false
SSDEEP:	12:uNRoqnOzsXNVWrtg/5tMWLAiBhhwDq2xTKkg6I4t02/iqJgNWTiJNBn:KoqOzsdVWrE5oiB32Af6IR2/ZlTWb
MD5:	3393E100F33B6B0FA6494D06D94044A5
SHA1:	44A6A3752464BDF900DD54F81C05410EED1870BA
SHA-256:	8B9CDD20F12DD87D035DE99F2C9EDC5762CAE78E0D79AEBD8FE018423C7635F2
SHA-512:	8EEC3E07F606EE05C222A7F7A2159EEE194E1C1DFF297ABAAD788609DBE07A3FB7CB6FE15D5ACDDE249FCB979B99F4F7C049D822681EE88E9645FFEC2CDDE672
Malicious:	false
Preview:	'use strict';..var createError = require('./createError');../*. Resolve or reject a Promise based on response status.. . @param {Function} resolve A function that resolves the promise.. * @param {Function} reject A function that rejects the promise.. * @param {object} response The response.. */.module.exports = function settle(resolve, reject, response) {. var validateStatus = response.config.validateStatus;. if (!response.status \|\| !validateStatus \|\| validateStatus(response.status)) {. resolve(response);. } else {. reject(createError(. 'Request failed with status code ' + response.status,. response.config,. null,. response.request,. response. ));. }.};.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\builder-util-runtime\out\xml.js.map

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6841
Entropy (8bit):	4.851336697469934
Encrypted:	false
SSDEEP:	192:fzN0JjXl1YmlngB8g7MSh73LlD6HZkAb7UadVYqOZWhcX8CiH8hnhx:fzdLlD6HZkM7NdVYqCWhcX8CiH8hnhx
MD5:	4172A067229526A7E94F6D761489702A
SHA1:	E05B6AC1A287463C5C618EFC54634BCB0C5B6329
SHA-256:	3A31542BC0E0970CF86E72D756E378795EEE75BBF48CF7221910A1CC4B3402A5
SHA-512:	98BD9C26BBF1D3950BED677B929D6992EA3A091541D52A2E96940857DBA27F7CE323DF1D5270247AEE6BBCE44F6977C0FED61DE4660EDF5773595CF153D3F09B
Malicious:	false
Preview:	{"version":3,"file":"xml.js","sourceRoot":"","sources":["../src/xml.ts"],"names":[],"mappings":";;;AAAA,2BAA0B;AAC1B,mCAAkC;AAElC,MAAa,QAAQ;IAMnB,YAAqB,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;QALjC,UAAK,GAAG,EAAE,CAAA;QACV,eAAU,GAAqC,IAAI,CAAA;QACnD,YAAO,GAAG,KAAK,CAAA;QACf,aAAQ,GAA2B,IAAI,CAAA;QAGrC,IAAI,CAAC,IAAI,EAAE;YACT,MAAM,gBAAQ,CAAC,8BAA8B,EAAE,4BAA4B,CAAC,CAAA;SAC7E;QACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE;YACtB,MAAM,gBAAQ,CAAC,yBAAyB,IAAI,EAAE,EAAE,8BAA8B,CAAC,CAAA;SAChF;IACH,CAAC;IAED,SAAS,CAAC,IAAY;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QACtE,IAAI,MAAM,IAAI,IAAI,EAAE;YAClB,MAAM,gBAAQ,CAAC,iBAAiB,IAAI,GAAG,EAAE,0BAA0B,CAAC,CAAA;SACrE;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,eAAe,CAAC,IAAY;QAC1B,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE;YAC5B,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;SAC7B;IACH,CAAC;IAED,OAAO,CAAC,IAAY,EAAE,UAAU,GAAG,KAAK,EAAE,gBAA+B,IAAI;QAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;QACnD

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\builder-util-runtime\package.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	719
Entropy (8bit):	4.799775220503189
Encrypted:	false
SSDEEP:	12:0Cx+YC7rtJBCAJnLKz4gSYknuP/ki/MKzyTnifbmWKz+BoEGH10:0C9Cd3CARA4gSYke3yTJ3C2H10
MD5:	15557C9E15071ABD7477F746EDE9F266
SHA1:	CEBFD5F2964E72589D67A54168D848F6230393B5
SHA-256:	FB65C85C40D23D4FC7B54E9B19D805BD5702E1C6C0919F7F871E33C8CD7D6031
SHA-512:	9EF2D4443B689879788DAB3F7D64EAC12278ACD4F2A85A2A2EA12D23ED4B6944973B5B06DEAE851C1C2AEB7A5C5119A4469BF33D329444BE6B54DADE22F9C824
Malicious:	false
Preview:	{. "author": {. "name": "Vladimir Krivosheev". },. "dependencies": {. "debug": "^4.3.2",. "sax": "^1.2.4". },. "description": "HTTP utilities. Used by [electron-builder](https://github.com/electron-userland/electron-builder).",. "devDependencies": {. "@types/debug": "^4.1.5",. "@types/sax": "^1.2.1". },. "engines": {. "node": ">=12.0.0". },. "files": [. "out". ],. "homepage": "https://github.com/electron-userland/electron-builder",. "license": "MIT",. "main": "out/index.js",. "name": "builder-util-runtime",. "repository": {. "type": "git",. "url": "git+https://github.com/electron-userland/electron-builder.git". },. "types": "./out/index.d.ts",. "version": "8.7.5".}

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\LICENSE

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	765
Entropy (8bit):	4.999520559493967
Encrypted:	false
SSDEEP:	12:9FM9Z7TES4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3t:9SZvICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	82703A69F6D7411DDE679954C2FD9DCA
SHA1:	BB408E929CAEB1731945B2BA54BC337EDB87CC66
SHA-256:	4EC3D4C66CD87F5C8D8AD911B10F99BF27CB00CDFCFF82621956E379186B016B
SHA-512:	3FA748E59FB3AF0C5293530844FAA9606D9271836489D2C8013417779D10CC180187F5E670477F9EC77D341E0EF64EAB7DCFB876C6390F027BC6F869A12D0F46
Malicious:	false
Preview:	The ISC License..Copyright (c) Isaac Z. Schlueter and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\bin\semver.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4363
Entropy (8bit):	4.536523695426418
Encrypted:	false
SSDEEP:	96:iwzOoe3EkZMZMkFeEw0XAJCnpV5vmXFSxdWYHInKxRfet:soe3C4fedQFSxdWYOKxRfk
MD5:	A52CB6EEAF7CBCEF0E338FE338997448
SHA1:	E2B3CA8F99494B325CF7086A3954870EF9203ACD
SHA-256:	59AB5BFD6C6D4F124269D7419FDE08368AC3462E2FB17D2F707D8816FF9764C0
SHA-512:	67528499A98F717ADCDADED73EFB7F3658D5AA853608E2DF4221B5CAE2B5D224F2B31D65A0931CAE871D7AF1A514E8D06F0AFCF443CE4947A0CA7CC699346B54
Malicious:	false
Preview:	#!/usr/bin/env node.// Standalone semver comparison program..// Exits successfully and prints matching version(s) if.// any supplied version is valid and passes all tests...const argv = process.argv.slice(2)..let versions = []..const range = []..let inc = null..const version = require('../package.json').version..let loose = false..let includePrerelease = false..let coerce = false..let rtl = false..let identifier..const semver = require('../')..let reverse = false..const options = {}..const main = () => {. if (!argv.length) return help(). while (argv.length) {. let a = argv.shift(). const indexOfEqualSign = a.indexOf('='). if (indexOfEqualSign !== -1) {. a = a.slice(0, indexOfEqualSign). argv.unshift(a.slice(indexOfEqualSign + 1)). }. switch (a) {. case '-rv': case '-rev': case '--rev': case '--reverse':. reverse = true. break. case '-l': case '--loose':. loose = true. break. case '-p': case '--include-prerelease':.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\classes\comparator.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3606
Entropy (8bit):	4.5717743799691535
Encrypted:	false
SSDEEP:	48:/tYTGb8/RHyDxO/lszVoA7vLAqPcol7nE9SZGb+CbioG/7ZCirckz/gvF:/tYoQNszV/vrPNRnE9SJSivIDkzS
MD5:	BC9136288D9D4010AC32164EECAF72B9
SHA1:	5CD5951CFF53C21FC4B6D83EB70BF44371A4391C
SHA-256:	738695E7AAC6E4AED86DA77A71C5684EC216E770DD61D34A74D7C5D63C5809CE
SHA-512:	86C2F0CF4DDA42AD39295A09CDE01DBBFF384FB6CAD4AE9FBAE96863A6B65A562AE9537F6B9986F13FEBBD0694F12F05726DE938EE480E666B12394B628DAFA3
Malicious:	false
Preview:	const ANY = Symbol('SemVer ANY').// hoisted class for cyclic dependency.class Comparator {. static get ANY () {. return ANY. }. constructor (comp, options) {. options = parseOptions(options).. if (comp instanceof Comparator) {. if (comp.loose === !!options.loose) {. return comp. } else {. comp = comp.value. }. }.. debug('comparator', comp, options). this.options = options. this.loose = !!options.loose. this.parse(comp).. if (this.semver === ANY) {. this.value = ''. } else {. this.value = this.operator + this.semver.version. }.. debug('comp', this). }.. parse (comp) {. const r = this.options.loose ? re[t.COMPARATORLOOSE] : re[t.COMPARATOR]. const m = comp.match(r).. if (!m) {. throw new TypeError(`Invalid comparator: ${comp}`). }.. this.operator = m[1] !== undefined ? m[1] : ''. if (this.operator === '=') {. this.operator = ''. }.. // if it literally is just '>' or '' then a

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\classes\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	128
Entropy (8bit):	4.637004655993838
Encrypted:	false
SSDEEP:	3:3BBBbm+BylxQWfMMFNELCuTQALoFc1UQW5iXv:xBBS+wiM/ELCzuom/
MD5:	54D1648BF911578A91E1E0789BA29ECD
SHA1:	93C82F6C681D0B323C8365BAB7B4041AF6D9F5EF
SHA-256:	F1F923F068E89FCA8E8D52B3706185CACE306455DC1BABD24A9A7328757C0B53
SHA-512:	5825C4562A6A06CF47BD085B11C14C1C58A2E382108C283176E6F692825409C4AE5D3B610A0BEA1D1722626C8E69AAE699DA814F1E10546418E11BFD7D3A4818
Malicious:	false
Preview:	module.exports = {. SemVer: require('./semver.js'),. Range: require('./range.js'),. Comparator: require('./comparator.js').}.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\classes\range.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	13989
Entropy (8bit):	4.808915829166198
Encrypted:	false
SSDEEP:	384:0FVd+ttPe0kiy+BO/Qxkgg8bGWpgIVF3kaZ3y5xUerl:d/e0q/QnpVFK
MD5:	9532ADD2B296251873F3BAC3E0F905BB
SHA1:	16A0B6777E408734737C857485D74CB31D4EE692
SHA-256:	0170FEA41AED46DD5EEB9493284CC16CC6DC27CB9F65029CE33B76BE82FFA5FE
SHA-512:	7D0085ED40A5A9F41505862EB7E4A194D1B4CA8C822A39384F9CB5F4AA46EFDE495E59F4A09EF0DCE389B747976EC90F185DFA9C1272D87CEFEE73E01E61D5E1
Malicious:	false
Preview:	// hoisted class for cyclic dependency.class Range {. constructor (range, options) {. options = parseOptions(options).. if (range instanceof Range) {. if (. range.loose === !!options.loose &&. range.includePrerelease === !!options.includePrerelease. ) {. return range. } else {. return new Range(range.raw, options). }. }.. if (range instanceof Comparator) {. // just put it in the set and return. this.raw = range.value. this.set = [[range]]. this.format(). return this. }.. this.options = options. this.loose = !!options.loose. this.includePrerelease = !!options.includePrerelease.. // First, split based on boolean or \|\|. this.raw = range. this.set = range. .split(/\s\\|\\|\s/). // map the range to a 2d array of comparators. .map(range => this.parseRange(range.trim())). // throw out any comparator lists that are empty. // this generally means that it was not a

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\classes\semver.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7985
Entropy (8bit):	4.451966872511604
Encrypted:	false
SSDEEP:	192:+/ecQgOy9ZQwI1xdeSeOSyC6FwF9VpHpXqzyG8byJPN83X:US/GPvJYhaX
MD5:	4DF0DCED8768198F30D1D9431CA70D49
SHA1:	D5B92BAB9A416D4F9DC6FF0C300613038A24B8DC
SHA-256:	A6643325E9A77FF84FEF9A7E77BC36098F4848F13DD9EBC135C5E5134544EF37
SHA-512:	E65082F2D2DB21F1692EC2156066DD04D901A6E187A2048A616CD74CA22E950308EC2263A95F5B190368027949B2085B74B866FEC7986A510FA912937FF4CC79
Malicious:	false
Preview:	const debug = require('../internal/debug').const { MAX_LENGTH, MAX_SAFE_INTEGER } = require('../internal/constants').const { re, t } = require('../internal/re')..const parseOptions = require('../internal/parse-options').const { compareIdentifiers } = require('../internal/identifiers').class SemVer {. constructor (version, options) {. options = parseOptions(options).. if (version instanceof SemVer) {. if (version.loose === !!options.loose &&. version.includePrerelease === !!options.includePrerelease) {. return version. } else {. version = version.version. }. } else if (typeof version !== 'string') {. throw new TypeError(`Invalid Version: ${version}`). }.. if (version.length > MAX_LENGTH) {. throw new TypeError(. `version is longer than ${MAX_LENGTH} characters`. ). }.. debug('SemVer', version, options). this.options = options. this.loose = !!options.loose. // this isn't actually relevant for versi

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\functions\clean.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	191
Entropy (8bit):	4.547907993879497
Encrypted:	false
SSDEEP:	3:FGzHWMVLzmAu9wKSFvChug+/KINMwCY/4OSFCC4O/QRIsFadstAJAfBQJyBbYhb:FGTWcmAg/SFvCYHBMwCE4OSFCC4+EbgD
MD5:	11C3585ADC46A11A14D248C2AB2B061E
SHA1:	92466E73DBB620C7B0C58B16E8D39A6D0FF22BC5
SHA-256:	F539E00FDD674E57CEC16AC7AA8C0D10483B31BF01C1C3F1F4BB202014B280CA
SHA-512:	3C178F961525F0AA9BF295C988DF696EC7EE3FC5963CFB0C6F6E71069598270E7952C9BAAAEA42A4EEA0E39A0495DCD33E99DD47E4404CAE21748C847032A0D6
Malicious:	false
Preview:	const parse = require('./parse').const clean = (version, options) => {. const s = parse(version.trim().replace(/^[=v]+/, ''), options). return s ? s.version : null.}.module.exports = clean.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\functions\cmp.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.2728473907258815
Encrypted:	false
SSDEEP:	24:uQyAQlGQHh6HSH0h8Hh6HSH0l/LjMDqgDigDYc9gDjrgDqgD2g+h9Bb0BXv:ugiB6yUSB6yUiOzQ9K3rdYN
MD5:	4E300FE26F79F92AA031B9807CCB1B93
SHA1:	8D58F3B53636B7EE84B5E3CDD318B8D9DD259EDF
SHA-256:	4C8E75FD14416C2D8A461682A5D67157EFE0C637969DDD8AEB563733A836B62F
SHA-512:	05D9500DAEDF1790708053BD70268F26B87EFDCFB9917F2F37D1524429AAF4E65652DAF86E93B90C018CE49C535CD5F50E026F8F81B21CF860D418EA6A281F75
Malicious:	false
Preview:	const eq = require('./eq').const neq = require('./neq').const gt = require('./gt').const gte = require('./gte').const lt = require('./lt').const lte = require('./lte')..const cmp = (a, op, b, loose) => {. switch (op) {. case '===':. if (typeof a === 'object'). a = a.version. if (typeof b === 'object'). b = b.version. return a === b.. case '!==':. if (typeof a === 'object'). a = a.version. if (typeof b === 'object'). b = b.version. return a !== b.. case '':. case '=':. case '==':. return eq(a, b, loose).. case '!=':. return neq(a, b, loose).. case '>':. return gt(a, b, loose).. case '>=':. return gte(a, b, loose).. case '<':. return lt(a, b, loose).. case '<=':. return lte(a, b, loose).. default:. throw new TypeError(`Invalid operator: ${op}`). }.}.module.exports = cmp.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\functions\coerce.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1497
Entropy (8bit):	4.756992650843296
Encrypted:	false
SSDEEP:	24:l2BDC1Gbhfgt60+T9/oigigug9XeUGBFeA5nztWrEdPRLtTgatn44QhRHOELjoGI:lbGbOt6D9Q5ig3jlA5nhW4dPRJTTt44n
MD5:	66557AA1D67BCED331F05D8C5342DCBE
SHA1:	11C199CA6EF37688C35300095B5729D5A54F3A10
SHA-256:	8BD46B4C9A2058FAA4144F29FFEFEED4EE32CAFD6D7B5347A91C499EA52893F3
SHA-512:	A6A1DBD09333723C522C54BB7CFC82224772FF75D261D142D54ED48DB54B39A86C625F43A6183B7341064C6A1EF10ADFD1E1B0A3C35B9774685F3EAB03FD1980
Malicious:	false
Preview:	const SemVer = require('../classes/semver').const parse = require('./parse').const {re, t} = require('../internal/re')..const coerce = (version, options) => {. if (version instanceof SemVer) {. return version. }.. if (typeof version === 'number') {. version = String(version). }.. if (typeof version !== 'string') {. return null. }.. options = options \|\| {}.. let match = null. if (!options.rtl) {. match = version.match(re[t.COERCE]). } else {. // Find the right-most coercible string that does not share. // a terminus with a more left-ward coercible string.. // Eg, '1.2.3.4' wants to coerce '2.3.4', not '3.4' or '4'. //. // Walk through the string checking with a /g regexp. // Manually set the index so as to pick up overlapping matches.. // Stop when we get a match that ends at the string end, since no. // coercible string can be more right-ward without the same terminus.. let next. while ((next = re[t.COERCERTL].exec(version)) &&.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\functions\compare-build.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	267
Entropy (8bit):	4.591710924094639
Encrypted:	false
SSDEEP:	6:l2mcfGTR7HwFvC7PqESROP57z/L8ujjZpF/vn2fTb0BQvp:l2YTR7QF8PZSoP57zT8ujj9v2fX0BQvp
MD5:	AA3189CA2CB7077AE7263DB0D6AFE6C4
SHA1:	97AC51143C3F5C2255BA09C0EC0F952A2AECD8D1
SHA-256:	56191FA0ED27633A33FED9C99D657E305CF5452B1E677DD38610948A050146E0
SHA-512:	39A5BB534542E0E128BBC6B1520F82F34C1B76C6FF6D237199518D46F6A88EC5E92C942A07226F59FC4CB65E5359C4CE1452E0ED5861A32CE727305F5E453D7D
Malicious:	false
Preview:	const SemVer = require('../classes/semver').const compareBuild = (a, b, loose) => {. const versionA = new SemVer(a, loose). const versionB = new SemVer(b, loose). return versionA.compare(versionB) \|\| versionA.compareBuild(versionB).}.module.exports = compareBuild.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\functions\compare-loose.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	118
Entropy (8bit):	4.344787925666776
Encrypted:	false
SSDEEP:	3:ipAU5TwmRaE9bFdIVkLWA7JyBbbohRPn:/moE9g2Wk0BQhl
MD5:	2A96F1EB367AC64C30183597763341CD
SHA1:	1C581D61F0AB057AF7FED4AD01C66D0998D1AA03
SHA-256:	9B75AECE458D05E13A299AFDD745DE6AE6069287862E1D5BC718FACB24DA7692
SHA-512:	37823FE283A02D5278264CF2DAC6811389C795A2074FF9528E34676E4E2E177988573A51B19FF462F061C3203EF641F85323DA9125ACF23304A871CB38B4F3D2
Malicious:	false
Preview:	const compare = require('./compare').const compareLoose = (a, b) => compare(a, b, true).module.exports = compareLoose.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\functions\compare.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	156
Entropy (8bit):	4.45211640587454
Encrypted:	false
SSDEEP:	3:YI2mTtpEAuqeNz+jWAtjFnPqESIZ3SFPjFqAab0Bbbonn:l2mcfM7t5nPqES++57aYBQnn
MD5:	C4B3073651FDC985032E3D4654077CD8
SHA1:	33EC903E117BA1FE05CDDEDB86A9601D94E193A7
SHA-256:	CF3E198A250760CF344E0B575DBAAD7D8B470CB56E25CE2152ADBDF82FA3E5E8
SHA-512:	BDC425D93D9A18A75B211B8E2FCF4CC30BDC1390A57824FC080471C8F89376F5BAAC8696D74E6A80E720AA168A2F2B21BC444F1FEE8CDA9F1B55924CB4A2D886
Malicious:	false
Preview:	const SemVer = require('../classes/semver').const compare = (a, b, loose) =>. new SemVer(a, loose).compare(new SemVer(b, loose))..module.exports = compare.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\functions\diff.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	634
Entropy (8bit):	4.511635761246572
Encrypted:	false
SSDEEP:	12:faqYOTQFBU0TTtorHatzcCXgmSscNYPL5yQdDMu5eCaiQkjGAKLb0BcHn:owQBUaT+r6tzcLE82lqvCaiQeGjb0BcH
MD5:	69354346709CA13593132D2A53A3D395
SHA1:	1E1841D00816B6F923A4BF0EC2A2AFD147026B2E
SHA-256:	431E82902F7604755BA826F922866EA63D245986136AC520FA3CB882A8C34FDD
SHA-512:	468FB6ABEEB4EBEA620C3C271FC5353290BE367C0156B9DCD9541718D291B86D342CA01F2CBA9A1B23E7A09207AA0FE09FFCE9E36F40936E0E809B344BCF54D9
Malicious:	false
Preview:	const parse = require('./parse').const eq = require('./eq')..const diff = (version1, version2) => {. if (eq(version1, version2)) {. return null. } else {. const v1 = parse(version1). const v2 = parse(version2). const hasPre = v1.prerelease.length \|\| v2.prerelease.length. const prefix = hasPre ? 'pre' : ''. const defaultResult = hasPre ? 'prerelease' : ''. for (const key in v1) {. if (key === 'major' \|\| key === 'minor' \|\| key === 'patch') {. if (v1[key] !== v2[key]) {. return prefix + key. }. }. }. return defaultResult // may be undefined. }.}.module.exports = diff.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\functions\eq.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.373185265762586
Encrypted:	false
SSDEEP:	3:ipAU5TVOjWAHdIVkLjWAlyKm0Bbn:/D7HK27lZzBj
MD5:	AC255BE167064433906949ED2EE45C65
SHA1:	498639A97E5682386B94C24096F133DB4FD163D0
SHA-256:	EE5DC50B4A4B35219E016730AA8631B25D122447DD7DF56EC447DD202FD79AD4
SHA-512:	1836E5681CBC7C309661630F5AEEB625A0C1F5A962E4859FD5285569D7439B8CD0398401F59FBCF4B5476218FC21DFC02FCCA04D250BA66499D5EC3247281296
Malicious:	false
Preview:	const compare = require('./compare').const eq = (a, b, loose) => compare(a, b, loose) === 0.module.exports = eq.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\functions\gt.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.4399873523544855
Encrypted:	false
SSDEEP:	3:ipAU5TnFQ+jWAHdIVkLjWASvIKBQ0Bbcv:/gFQ+7HK27SvIaBBIv
MD5:	10A39EC1811071BABB91462C19B950BC
SHA1:	D5E2D5E6294E56EE0A42E92E3A89D8CF294CB833
SHA-256:	0776ECA71F280F369A20F6EDBD03C192B1722DFE6A0681C40D63798BB81A6459
SHA-512:	73E18AC95079FD936ECFA2D8FD25EED970E932AEA3D4E5347F876A28F286E1627B411FA0D6A299B1E6BA73DEE7E803D75E497C8ACAD7EB0AE1E617937A8F1784
Malicious:	false
Preview:	const compare = require('./compare').const gt = (a, b, loose) => compare(a, b, loose) > 0.module.exports = gt.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\functions\gte.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.424736281041866
Encrypted:	false
SSDEEP:	3:ipAU5TnAXjWAHdIVkLjWATQb0BbcK:/gI7HK27TQYBIK
MD5:	07110CE00D60765B5D12A015C53F0634
SHA1:	B9C50A385C8E3877108A001FB8548B122A155193
SHA-256:	67F27BD87586A498C22954FD41F45971C079AEA34CEC7D63563BECD62DE0C810
SHA-512:	88513BF0230E123B80BA46A772DFD324B580237C8556A5CC69C1580822221DE42E4732B84D337BF839D0295A1AA02EC96DD04D2727013F9857759C3EC984A04C
Malicious:	false
Preview:	const compare = require('./compare').const gte = (a, b, loose) => compare(a, b, loose) >= 0.module.exports = gte.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\functions\inc.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	336
Entropy (8bit):	4.415504582716645
Encrypted:	false
SSDEEP:	6:l2mcitsACAJ+vFM+bR1FlyVuYnPjMcj+oT4DvgtYAQb0Bjv:l2pACAAvFbjFsVuYnPwy9TSvgtbQb0BT
MD5:	573CBAB27A1C299918A457F4722A6439
SHA1:	5E7469AFA896C0B9A5D3EE8F72DBF1085811F0BE
SHA-256:	477208D3FE69872827B8D7F7C97E3EA9EC786A7DD1E24D6C42A3839B29EE3EBA
SHA-512:	5A8D37321BCDDEE4B1B858EFDACDD96100160AC34A67DAA9F642D3129966D5015D8BB97BD3E18EBF47DAAAF99E312770B23D03F2A9A43EDC65D239EBB658A0AA
Malicious:	false
Preview:	const SemVer = require('../classes/semver')..const inc = (version, release, options, identifier) => {. if (typeof (options) === 'string') {. identifier = options. options = undefined. }.. try {. return new SemVer(version, options).inc(release, identifier).version. } catch (er) {. return null. }.}.module.exports = inc.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\functions\lt.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.414035052606546
Encrypted:	false
SSDEEP:	3:ipAU5TKmojWAHdIVkLjWA2Q0Bb9v:/8o7HK272BBx
MD5:	F7AD1B995249DB3335EF22E54B5A0A23
SHA1:	FAD43EE11CD4B18E2FBAF50593AE540F27365A87
SHA-256:	124F2039C547D2A4FE83B9A56E6C3B911D383289D47238F4F558EA4061C4348E
SHA-512:	6185CE4D300C1A186C459E38E1F4772CA42392FA3496F878AF7CAE4CF6CC18FE94A4C67D17767F4B6687020685ADF77B688E8CA85AA462B9C289AD4720D356FB
Malicious:	false
Preview:	const compare = require('./compare').const lt = (a, b, loose) => compare(a, b, loose) < 0.module.exports = lt.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\functions\lte.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.399472980402279
Encrypted:	false
SSDEEP:	3:ipAU5TKgpjWAHdIVkLjWA3Y0Bb9Kn:/ip7HK27JBw
MD5:	8FE11B589AA4D476331B1A20A178F4E6
SHA1:	BD1875ED01C16E0BF753352E775CFC3D993CC228
SHA-256:	5AD1CE1860079CCF25A7FE62211361FE6CD2AC06A9FC4616A288FA3BB6FFA648
SHA-512:	324BE943100472421548197477FCF94AFC065A2BAF60247A47C9448614102B6CCF372013540B696D24A31EC92A66BDDD6E49591672F7824E4BB1B0E65484799F
Malicious:	false
Preview:	const compare = require('./compare').const lte = (a, b, loose) => compare(a, b, loose) <= 0.module.exports = lte.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\functions\major.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	122
Entropy (8bit):	4.463798361747419
Encrypted:	false
SSDEEP:	3:YI2mTtpEAuqehMmO5HrF2APqESAyBb0v:l2mcfxO5HrFnPqESFBS
MD5:	29D9C74715E8D0A66A1205421C909D34
SHA1:	5E2668D635CA6C7BDE9BC1B7F763F26674E83C11
SHA-256:	C7E03FBB9BC1528EA1681C2433AD73D241B023C6200A7B13FA63EC083B81E017
SHA-512:	A2D077809B4124C8D39C96B02A3CD5A1C560C9444F8A5A80CFD085EAFB2D65F45080D683AC137AC943312A0379A4B98D19C096D0F12E9A1E61C736DFE5EE62E8
Malicious:	false
Preview:	const SemVer = require('../classes/semver').const major = (a, loose) => new SemVer(a, loose).major.module.exports = major.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\functions\minor.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	122
Entropy (8bit):	4.437199078978267
Encrypted:	false
SSDEEP:	3:YI2mTtpEAuqedMmO5HrF2APqESdOyBb2Xv:l2mcfFO5HrFnPqESdDBq/
MD5:	EE42AB1E884352CC1BEAC06780D0EA47
SHA1:	4BC0BC3EC293449F5FEA1CBCFE976C8D2A26CCE5
SHA-256:	A1BD5B53471EAF3D551C3BFB4B611F64832A0BE79D82BC0A2D5EE0FF8B6892E4
SHA-512:	2A8D5F064666F700D1C9C7D0E16F5A09472B2909A1BBBDCEF3446883CD004CA3614D839270522177705E1ACCFE2BDE93F79B55D318E9D1F9CA3F2D2F3A139B02
Malicious:	false
Preview:	const SemVer = require('../classes/semver').const minor = (a, loose) => new SemVer(a, loose).minor.module.exports = minor.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\functions\neq.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	114
Entropy (8bit):	4.425124294384342
Encrypted:	false
SSDEEP:	3:ipAU5T7+jWAHdIVkLjWAb3m0Bbz:/i+7HK27rzB/
MD5:	27E4A0AF52EAECE331029C0750443868
SHA1:	DFA93428B2368CFF5AEFD91D812BED067CB31AD6
SHA-256:	E1ACDF7FBB4CD40E372A37443D2EF2504FE1524E0F214317912418ED5A0A246E
SHA-512:	B3A8DD461DCE659F1F278941F0FCB762168B98E483DBDFDFBF5C0FB90A02445AFA66776453293B18FA0B388F1B5D8D94A81F57C0D21EEE0B9510F9C771951561
Malicious:	false
Preview:	const compare = require('./compare').const neq = (a, b, loose) => compare(a, b, loose) !== 0.module.exports = neq.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\functions\parse.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	660
Entropy (8bit):	4.682035910799645
Encrypted:	false
SSDEEP:	12:hX8uyw2b8FA1Gbhfgt6MFKtT0EtmD1FP19j7ttYnPwivgtbTBY/:p12Q0Gbhfgt6TTEL7f8wiIBTBM
MD5:	218375AC039F2017876D18C52BE480DD
SHA1:	8E55800536763FB821E78CAAA7ACE8E65188DA0F
SHA-256:	ABFFF75A5C8C6B4392195E681E93A64AB695B4F101FB4B90A247AAD876BF4BC4
SHA-512:	7344DC136ECC1951186166141DFE2BBBFA918766F1D8323C89BCB4B50EF608DBFC923FDE588EE0165F7612BBE6E0AEAE54A9BA684C1DB1227EC4A497A7D60B9F
Malicious:	false
Preview:	const {MAX_LENGTH} = require('../internal/constants').const { re, t } = require('../internal/re').const SemVer = require('../classes/semver')..const parseOptions = require('../internal/parse-options').const parse = (version, options) => {. options = parseOptions(options).. if (version instanceof SemVer) {. return version. }.. if (typeof version !== 'string') {. return null. }.. if (version.length > MAX_LENGTH) {. return null. }.. const r = options.loose ? re[t.LOOSE] : re[t.FULL]. if (!r.test(version)) {. return null. }.. try {. return new SemVer(version, options). } catch (er) {. return null. }.}..module.exports = parse.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\functions\patch.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	122
Entropy (8bit):	4.539331208171522
Encrypted:	false
SSDEEP:	3:YI2mTtpEAuqe+4oYHrF2APqESrf0BbcSn:l2mcf+vYHrFnPqESr8BYS
MD5:	354989B490295AC9C8B7A4B1E14DE9F4
SHA1:	A78EF0C69E82D2A7B1F4F697E620AEF6AD1DE458
SHA-256:	6BC095689E62EB2AA401033B090870D24373AA4E992089C2256773133C994969
SHA-512:	CE9466FC26D5566B731B12AD1E8761DDFEC6D6F73BB747D1D2FAB4DB893CA03A78BE3E62C80E7F055FEC2586113BD1BA2CBF248A373FB1C63BB665E3A00AF783
Malicious:	false
Preview:	const SemVer = require('../classes/semver').const patch = (a, loose) => new SemVer(a, loose).patch.module.exports = patch.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\functions\prerelease.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	220
Entropy (8bit):	4.308893320201711
Encrypted:	false
SSDEEP:	6:FGTWa2g/SFvCuGR+18ELdFuXHyC+cOfBQ0B0U:fVFwmLHuXHyCuBQ0Bb
MD5:	8D6459821A046A48B04C1F3FDF0250D9
SHA1:	40A72FE55E64EFCC0A5C6B859A0378AB030837DB
SHA-256:	683E026B74F0D18374161C14C4B367FF0848E568DA9FB8BFB3196BC985C26D95
SHA-512:	338C73E2DE00B4D79C3D3BA9DB8801CA10BC761D947652F83E3FCF00FFDB8170B3FA80FDF127AFE9742DA2B53B58F2EA9AC880A0D7C4F4A8CD20D32F084AA9D8
Malicious:	false
Preview:	const parse = require('./parse').const prerelease = (version, options) => {. const parsed = parse(version, options). return (parsed && parsed.prerelease.length) ? parsed.prerelease : null.}.module.exports = prerelease.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\functions\rcompare.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	118
Entropy (8bit):	4.30308109257168
Encrypted:	false
SSDEEP:	3:ipAU5Trg+jWAHdIV+jHqmJyBbzgn:/a7HK6H70BYn
MD5:	4375B6D0D0A7CED1F709F810BB52E9DA
SHA1:	51F8192667AA9E1320E7FE0616B583039E8042C0
SHA-256:	5C95FF2FA2F8533041579F34835E2B4F5680EA9F4D8D08FF1F4D537CFD9F7896
SHA-512:	AE503150BAB2E293F2F66008C97485C5E2A51F2938989B4A075382CD256EF4BA54FE5D56AE5E2D8DB546B0FD5E15A83AB45142D665D72F7C76EAC68DC532661B
Malicious:	false
Preview:	const compare = require('./compare').const rcompare = (a, b, loose) => compare(b, a, loose).module.exports = rcompare.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\functions\rsort.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	149
Entropy (8bit):	4.504151050441294
Encrypted:	false
SSDEEP:	3:ioZ6tj5xIBPVnMW91HCcrNvibFdIVvZNwJFjHqKBQJyBbDXJ:JCAVnMW91HCINvigVzwJ9Hqb0Bh
MD5:	2E50A97BD158129F5DC59CF94D1050B0
SHA1:	1E99DCF8AA9518558B2A6945302273AC7B8D69BC
SHA-256:	89DBDB1542343CB549ECD12CD8C79AE01E6111215445EA6B091F337FADDD6EBE
SHA-512:	501426E6DD39A324B75B8503147DFAB0EEDDADB4004658025EE5B33ECCA8FCFB6C8FAF906EB5468805C0A253D239F6BA5219167AAED591C2D5F150682DD83D4B
Malicious:	false
Preview:	const compareBuild = require('./compare-build').const rsort = (list, loose) => list.sort((a, b) => compareBuild(b, a, loose)).module.exports = rsort.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\functions\satisfies.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	233
Entropy (8bit):	4.40796333020284
Encrypted:	false
SSDEEP:	6:O/i65QAwgtiDJUWSFAhnFVEqbUDvgvzDXW0B3QAon:O5QtqvFAhnX6vgvzDm0BgD
MD5:	B0F79B194E24E3E4F2A2881C4FAECB96
SHA1:	47A3E3141433768A2CA6A03841C842D15CF419C2
SHA-256:	DAC3A0AF5BBD5EBD2E9B8486582ED61DDEC694A9FC9D6AFB343B185A1FB3E59F
SHA-512:	A5F99518C40A72FB921071BAB560D2C68576A5B9AA8A9C03E97B1DB945B32A89B96F9B7BF8AA0825CA70D7602FFCEB1CAD9B6CEBD6124F676BA3593F8998B44E
Malicious:	false
Preview:	const Range = require('../classes/range').const satisfies = (version, range, options) => {. try {. range = new Range(range, options). } catch (er) {. return false. }. return range.test(version).}.module.exports = satisfies.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\functions\sort.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	147
Entropy (8bit):	4.512507853400447
Encrypted:	false
SSDEEP:	3:ioZ6tj5xIBPVsXIMW91HCcrNvibFdIVvZOJrFjWAqKBQJyBbrBv:JCAVNMW91HCINvigVC7qb0BB
MD5:	B6B1E8291BA15107B6F474A9A6791499
SHA1:	B7FC2BC365D5F6F9E2AD842441755E7B8B19DE5C
SHA-256:	5E3E30991733D8C977AFB5CEF564A855C2BCCD96C080D83E5422E3876CD512FD
SHA-512:	75F7C1440676ABE497571B86ED843A60CFE03464D1986864B685CDA5B31326C88090A845883E37CAC3D58F862312F94BA8107BF558C97C3672270CDC1CFB72AD
Malicious:	false
Preview:	const compareBuild = require('./compare-build').const sort = (list, loose) => list.sort((a, b) => compareBuild(a, b, loose)).module.exports = sort.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\functions\valid.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.409730435040831
Encrypted:	false
SSDEEP:	3:FGzHWMVLUBFQx9wKSFvCJYv9+9wn/QRIpAHWLQtAJAfBQJyBbyAvn:FGTWrcb/SFvCR8EjHWLQtAOfBQ0B2K
MD5:	4C97CED41F4870AF4043608388E7A762
SHA1:	EDC5B800B8F302AC7CE238A419A02810CDEED8F2
SHA-256:	D60B69794E2094B2AEF35ABBED5D17B9E14B41A4FEF2AD5A38DA4E2171D1C49F
SHA-512:	56999BF144A820BB8F89B4F483AF70B2A67ADAB5C12356508ACEBD8A3C497D45518BDBFF5954389E3FD4CD822AF53CE64C47F5AC7919264D4D90152DC354F94D
Malicious:	false
Preview:	const parse = require('./parse').const valid = (version, options) => {. const v = parse(version, options). return v ? v.version : null.}.module.exports = valid.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1982
Entropy (8bit):	4.737961344880944
Encrypted:	false
SSDEEP:	24:24uKBRtfWnDtFOVaI6awEeBSzHtuouN8K68dMhshSaxIRWHC7BdzvCgDxeqcfqCA:UKlfwxUaI6awrSzt4Z6bmxefz6gDAhA
MD5:	512745B65AE9369DC64AAF17C7ABF459
SHA1:	2CDCD33699E4CD0B427E72D413DCD184CFEECEF5
SHA-256:	57C39B74AFB746B028051E583E46079EBFAE110B2E9A24B56070185E14C381B6
SHA-512:	B8AF4E794705F82330CFCD4D9204FA4D90866EA6A67703B5CF49E96B0F0A8284695C34DF6A8657F1F7C846A868DD3EB814EBE471DD709B0D3A9207219695EF55
Malicious:	false
Preview:	// just pre-load all the stuff that index.js lazily exports.const internalRe = require('./internal/re').module.exports = {. re: internalRe.re,. src: internalRe.src,. tokens: internalRe.t,. SEMVER_SPEC_VERSION: require('./internal/constants').SEMVER_SPEC_VERSION,. SemVer: require('./classes/semver'),. compareIdentifiers: require('./internal/identifiers').compareIdentifiers,. rcompareIdentifiers: require('./internal/identifiers').rcompareIdentifiers,. parse: require('./functions/parse'),. valid: require('./functions/valid'),. clean: require('./functions/clean'),. inc: require('./functions/inc'),. diff: require('./functions/diff'),. major: require('./functions/major'),. minor: require('./functions/minor'),. patch: require('./functions/patch'),. prerelease: require('./functions/prerelease'),. compare: require('./functions/compare'),. rcompare: require('./functions/rcompare'),. compareLoose: require('./functions/compare-loose'),. compareBuild: require('./functions/compar

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\internal\constants.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	468
Entropy (8bit):	5.302739117197029
Encrypted:	false
SSDEEP:	12:jfJVRtjXl8RZOlPtQHa5BRFWpjeuqtzBVgetm0ot+xqY:7DYSPtQ6DjW8B7tmHu
MD5:	F4C0CE21D1133AA56074D70771605453
SHA1:	31D8DB16ABDAE6F6B3EE6C04B8210672889F13D2
SHA-256:	202467005E522B35CE855A948E615C55A9345DBE6284240E8961CED00ED70604
SHA-512:	EE098D7145EFDDCB7B91496DD48BC9EDBC5E4E7B91B07BA5FC609212BAF7A5EDC80CEC491074C9EA4C4B5DD8B418A2CD8586225BCF1F28171CB109E6B083E6F6
Malicious:	false
Preview:	// Note: this is the semver.org version of the spec that it implements.// Not necessarily the package version of this code..const SEMVER_SPEC_VERSION = '2.0.0'..const MAX_LENGTH = 256.const MAX_SAFE_INTEGER = Number.MAX_SAFE_INTEGER \|\|. /* istanbul ignore next */ 9007199254740991..// Max safe segment length for coercion..const MAX_SAFE_COMPONENT_LENGTH = 16..module.exports = {. SEMVER_SPEC_VERSION,. MAX_LENGTH,. MAX_SAFE_INTEGER,. MAX_SAFE_COMPONENT_LENGTH.}.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\internal\debug.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	226
Entropy (8bit):	4.940800841253999
Encrypted:	false
SSDEEP:	6:t3FQH+DEY1FsCcycWKlMv57hrfMcWyCx2lZaXcC5Is3zBQ3v:JkocycVlMv5xfMcjCx2lsWWBQf
MD5:	139A1CD83EE340FB2F1220BDB1BA608F
SHA1:	D6166E7A8EDA16340619CB02EE09C19A422B8333
SHA-256:	9557F905ECF6E36F97653841E08FD30074BA37AD529070A090BA352986DE4FA2
SHA-512:	68135CA671F5A8849699FFCBE6189EF0E2D7B7D4A8B18119A790C2334BBBEA732DE8B4777CCF1843F66AD6D2B2043E61C5D69BB76347E92708BB5234B173738D
Malicious:	false
Preview:	const debug = (. typeof process === 'object' &&. process.env &&. process.env.NODE_DEBUG &&. /\bsemver\b/i.test(process.env.NODE_DEBUG).) ? (...args) => console.error('SEMVER', ...args). : () => {}..module.exports = debug.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\internal\identifiers.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	409
Entropy (8bit):	4.5350740091099375
Encrypted:	false
SSDEEP:	12:Tq8mW9SFbW4yWZB7aeTPAI2/zmW9gPzBlL4LK:3vstyueI2bvmPzBl6K
MD5:	F8E6FC119491AB3246EE64EAD7BE2995
SHA1:	712CB25BEFB9BC32E0FC4F6E22D337918FF28F33
SHA-256:	4890A2816353AEC02B4275986521B2EFC6281E16F68F6568926D2D53AEC14738
SHA-512:	4483A83474BE8E4FD834AD374F88F682A0450DC233081B16DDEF7F23406E334FA38A8E827BE00DFA8155FA7A747B4EAA08E296F80DEDB2C0D4DD83C4AD636CC0
Malicious:	false
Preview:	const numeric = /^[0-9]+$/.const compareIdentifiers = (a, b) => {. const anum = numeric.test(a). const bnum = numeric.test(b).. if (anum && bnum) {. a = +a. b = +b. }.. return a === b ? 0. : (anum && !bnum) ? -1. : (bnum && !anum) ? 1. : a < b ? -1. : 1.}..const rcompareIdentifiers = (a, b) => compareIdentifiers(b, a)..module.exports = {. compareIdentifiers,. rcompareIdentifiers.}.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\internal\parse-options.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	401
Entropy (8bit):	4.520441823976611
Encrypted:	false
SSDEEP:	6:jyBNPeTQ47ub5s60o0eZ1Ch/K/CEGtaLuSfdrOmSgKOsew7g3vF5MKF6h10BY+G:jiyQ5XPZUh/ujsmGO7rfF5ZghuBY/
MD5:	81D1603893C83B24DC26D72A13BA42A4
SHA1:	C2F785832604917202B7B0FC2E24C7EE977C1C16
SHA-256:	E7633192E95455D51E72617D01A00974DC359E29FF8F2239FE28639AAFC7B6F2
SHA-512:	F3E903EF760D989412FDF574142A0491D3EF68C4AD843D309DEA6CDA4ED4CB3491A09B02D00AE0B17B231444B40701B3CBAD29EA1DDA0BC730C4B06857E93804
Malicious:	false
Preview:	// parse out just the options we care about so we always get a consistent.// obj with keys in a consistent order..const opts = ['includePrerelease', 'loose', 'rtl'].const parseOptions = options =>. !options ? {}. : typeof options !== 'object' ? { loose: true }. : opts.filter(k => options[k]).reduce((options, k) => {. options[k] = true. return options. }, {}).module.exports = parseOptions.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\internal\re.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6662
Entropy (8bit):	5.485990570887274
Encrypted:	false
SSDEEP:	96:yilBCMDnFbSx4LVCnBy1ONM4VGIXIXIsEOa49CvwmUd7i0wriepSxV:xB3DFbzLfsjXY4POaCCBbriF
MD5:	FD5F45FEFB03130284C21C2CE85FB1C5
SHA1:	BD05F7635CF776E9E1C40020684F27BE51BC4867
SHA-256:	84C9DFE64B1903428441188089B3844DF6A1741B1A2A35CBA0F2644B41EF9683
SHA-512:	CFC00E188F24FDF64EA6E8D152144752B0B5010D20A18A2EC4C96E4792EFEA3B16722BA7C21A25F9348206C3FCD58D178357850B7D7376E446E7B73808EE8010
Malicious:	false
Preview:	const { MAX_SAFE_COMPONENT_LENGTH } = require('./constants').const debug = require('./debug').exports = module.exports = {}..// The actual regexps go on exports.re.const re = exports.re = [].const src = exports.src = [].const t = exports.t = {}.let R = 0..const createToken = (name, value, isGlobal) => {. const index = R++. debug(index, value). t[name] = index. src[index] = value. re[index] = new RegExp(value, isGlobal ? 'g' : undefined).}..// The following Regular Expressions can be used for tokenizing,.// validating, and parsing SemVer version strings...// ## Numeric Identifier.// A single `0`, or a non-zero digit followed by zero or more digits...createToken('NUMERICIDENTIFIER', '0\|[1-9]\\d').createToken('NUMERICIDENTIFIERLOOSE', '[0-9]+')..// ## Non-numeric Identifier.// Zero or more digits, followed by a letter or hyphen, and then zero or.// more letters, digits, or hyphens...createToken('NONNUMERICIDENTIFIER', '\\d[a-zA-Z-][a-zA-Z0-9-]*')..// ## Main Version.// Three dot-se

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\package.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	744
Entropy (8bit):	4.629724943381442
Encrypted:	false
SSDEEP:	12:h/yQsWBZMC7ouPuokB/HXsGaaftjyc7R6aNbmWydopfOHZeFV1x:h/ZZMC7Nu1TD29LHID1x
MD5:	DA7F0A27C47EA69181E55A57E4464A0F
SHA1:	939CF0523ECB33D8A37A2E7FB3B47D677A8E0921
SHA-256:	D01996D0A5E8D575A4803C5E4600DF31810128D57DF392D024EF2E50B72E7459
SHA-512:	9CD2F086EE1D819F677A6AAB97E782B19C4B3DCA100D15FA341BA4321B266D8181B63BB8B22F26BFF73C907D6A5F7B335747C62AB6DA61A287240EA9CA6C3C5B
Malicious:	false
Preview:	{. "bin": {. "semver": "bin/semver.js". },. "dependencies": {. "lru-cache": "^6.0.0". },. "description": "The semantic version parser used by npm.",. "devDependencies": {. "tap": "^14.10.7". },. "engines": {. "node": ">=10". },. "files": [. "bin/*/.js",. "range.bnf",. "classes/*/.js",. "functions/*/.js",. "internal/*/.js",. "ranges/*/.js",. "index.js",. "preload.js". ],. "homepage": "https://github.com/npm/node-semver#readme",. "license": "ISC",. "main": "index.js",. "name": "semver",. "repository": {. "type": "git",. "url": "git+https://github.com/npm/node-semver.git". },. "tap": {. "check-coverage": true,. "coverage-map": "map.js". },. "version": "7.3.5".}

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\preload.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.459993935591871
Encrypted:	false
SSDEEP:	3:RFf9FITAkTvbQJyBbJfKIn:jf9FEbBB5KI
MD5:	A9FDDC15CDA0D52DB33CFB922545DE04
SHA1:	14FCBEDA941017ACA47B9D4A613CD186DEB6441D
SHA-256:	4117401437CCB64A0438E0B65F92215706FB892A4A1161367FBEE215A4627716
SHA-512:	DD2A1A07C9B2C8447F1FB1BC377A036557D010D6D0213801A7081583103A6C0DF314E34022A32DC8FD8B8916EAF7379C84BEE1CF3CA9CE4F48766F50C7471AAB
Malicious:	false
Preview:	// XXX remove in v8 or beyond.module.exports = require('./index.js').

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\range.bnf

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	619
Entropy (8bit):	4.24704903804356
Encrypted:	false
SSDEEP:	12:ZSKHT453/EVrNozPqxvrbyVc8F56l5cZpEQQMUSFnc/UCF:Z65vEvQq9reVc8F56yhQP2nc/UC
MD5:	76D83B46734A4604DA9DF9998FE7D19E
SHA1:	5C6F063E0EC60F2D04686F73A12BA5F389988A2B
SHA-256:	ED628FDAFF64BE366D07F6CC4559EAE4DE109826F743EA7F5E1588C370BCA49A
SHA-512:	40559A2C4890535B3F265AC188E40C0E38E43CF99C82B576117419DFDF05F3075B1ACCEE5609A4A890BFC8F279CC40D718AB2016D791527A4623811DE132E71B
Malicious:	false
Preview:	range-set ::= range ( logical-or range ) .logical-or ::= ( ' ' ) '\|\|' ( ' ' ) .range ::= hyphen \| simple ( ' ' simple ) \| ''.hyphen ::= partial ' - ' partial.simple ::= primitive \| partial \| tilde \| caret.primitive ::= ( '<' \| '>' \| '>=' \| '<=' \| '=' ) partial.partial ::= xr ( '.' xr ( '.' xr qualifier ? )? )?.xr ::= 'x' \| 'X' \| '' \| nr.nr ::= '0' \| [1-9] ( [0-9] ) .tilde ::= '~' partial.caret ::= '^' partial.qualifier ::= ( '-' pre )? ( '+' build )?.pre ::= parts.build ::= parts.parts ::= part ( '.' part ) *.part ::= nr \| [-0-9A-Za-z]+.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\ranges\gtr.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	217
Entropy (8bit):	4.398234423194857
Encrypted:	false
SSDEEP:	6:j9AkusZvQYLY8BmbX1XetiDJUWr2BXtiDJk70b0BI/:j9Nu/L8BmXqg2OC70YBI/
MD5:	F5279B6DF246C6A31456515749287981
SHA1:	4F69FB02E28923FE7126531D80862DC85BF94C19
SHA-256:	3584A1C39F7482B8A2733CC4630777A6881C627CF2FB1065E7B3387134AE0899
SHA-512:	51AF17FD45BD230BFCE1BC1375EC9EB1C0BC3DDA5B4B7A425C0251C1B275E81544C4ABF80246C8372524DF40A086557621138A107A9749A9D77C82884F9AFBE4
Malicious:	false
Preview:	// Determine if version is greater than all the versions possible in the range..const outside = require('./outside').const gtr = (version, range, options) => outside(version, range, '>', options).module.exports = gtr.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\ranges\intersects.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	201
Entropy (8bit):	4.456422778822251
Encrypted:	false
SSDEEP:	3:OJtpFieMeKLY8NXC7RSFLx1yDFv/CFRyDF6/QRItSKFAbMKWJyBbw6Z:O/i6b8kNSFL+xCFoAEjroX0BtZ
MD5:	99D43054CD2B943B75F38BFCEAC76342
SHA1:	43B437D867046A40A5ADE9B9356435E568564C53
SHA-256:	A1D70B5EB41CEA2AF321CF2240D2577E26A0E75D7C04CAD527E5D71A45510341
SHA-512:	022B05ABFDF98C70B169D2251AB11F230E8C310D2043BC3C49F929AD76055822B455692BCB481EB0990111BD44C72C8780B80E91F182D71E05BF3D504EB95F70
Malicious:	false
Preview:	const Range = require('../classes/range').const intersects = (r1, r2, options) => {. r1 = new Range(r1, options). r2 = new Range(r2, options). return r1.intersects(r2).}.module.exports = intersects.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\ranges\ltr.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	213
Entropy (8bit):	4.394460276573096
Encrypted:	false
SSDEEP:	6:JmbXZAkuseQYLYP6tiDJUWr2BXtiDJu0b0Bhn:JmpNugLPtqg2Oo0YBhn
MD5:	9B1635BD6D604358D733514B28CC8B29
SHA1:	D4948B6F660390895F8AC0CFE4CAD97BC1F15190
SHA-256:	9B2B8CAD227317839A7E47C5B835A7F45E3E861270CA3E335C2BB693C1BD425A
SHA-512:	53782C3A28EBC0C68D365AB5AC25285DACB77A11F9D2F363C09CEF2966292BF85CC7779EBB6F31C2FE1058B82A114653FCF1EBEBAADF33A6457AAA25364E1EB9
Malicious:	false
Preview:	const outside = require('./outside').// Determine if version is less than all the versions possible in the range.const ltr = (version, range, options) => outside(version, range, '<', options).module.exports = ltr.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\ranges\max-satisfying.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	579
Entropy (8bit):	4.56750149483721
Encrypted:	false
SSDEEP:	12:l23WEqvFY58En85Kn8f6vgtvCFo+0ADqjIwYLhUKP1k0M+Q0BAv:l23WEMMV5IhG3VwYLhUq1kr+Q0BAv
MD5:	6813760C0301CEF7A84E2CEA77E91641
SHA1:	4DCEF246781158EEF12758041375D1BCE437A383
SHA-256:	CBC560048C06FB1A3C75412638BF89DDB9782F373A744FFC4D8F2AA0B8D11C3C
SHA-512:	39A4D2E14C604F7F0C30AD4976EE9F08DB39B2F3E0BFAAD966B0E8FE023AADB8708FA7E9CE0AAD55871B34EB9661DACB5AE5939CA5495951C202118D2136B1FC
Malicious:	false
Preview:	const SemVer = require('../classes/semver').const Range = require('../classes/range')..const maxSatisfying = (versions, range, options) => {. let max = null. let maxSV = null. let rangeObj = null. try {. rangeObj = new Range(range, options). } catch (er) {. return null. }. versions.forEach((v) => {. if (rangeObj.test(v)) {. // satisfies(v, range, options). if (!max \|\| maxSV.compare(v) === -1) {. // compare(max, v, true). max = v. maxSV = new SemVer(max, options). }. }. }). return max.}.module.exports = maxSatisfying.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\ranges\min-satisfying.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	577
Entropy (8bit):	4.510123167756403
Encrypted:	false
SSDEEP:	12:l2t9WEqvFq38En85Kn8f6vgtvCFo+0ADqjIOjmWrJbPfk0PBQ0BWVv:l2tEEM0V5IhG3VOmWrJ7fkt0Byv
MD5:	D724F0E2C17A599C3B82EC456BB60348
SHA1:	2155AEA4B92343159E1B803F878A47297CA9AA66
SHA-256:	9EA81EB30019B58FD6218FF40F565AF60E9E52574AC1CC882E6841FC75B3E8BD
SHA-512:	3330356B84605AC3E575A24DD94FD42E7687303658E39D5CFA7216C7F3708CA9581706F8A9C98AF9A4E522A919DBC60A3D73C45E1DFC1F697B9DEDE94BD6B56C
Malicious:	false
Preview:	const SemVer = require('../classes/semver').const Range = require('../classes/range').const minSatisfying = (versions, range, options) => {. let min = null. let minSV = null. let rangeObj = null. try {. rangeObj = new Range(range, options). } catch (er) {. return null. }. versions.forEach((v) => {. if (rangeObj.test(v)) {. // satisfies(v, range, options). if (!min \|\| minSV.compare(v) === 1) {. // compare(min, v, true). min = v. minSV = new SemVer(min, options). }. }. }). return min.}.module.exports = minSatisfying.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\ranges\min-version.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1492
Entropy (8bit):	4.4023867657921745
Encrypted:	false
SSDEEP:	24:l2tiw8XQ8Sgzo9/zo96zo3C9BIdrce9gVTXR451wTzC5GXijcuZfOc5CVwfWoeMF:l6BgHSfP2C9BSc+gFh451w65lsSfIMGG
MD5:	CEC901F700B8C97E3333398146C7CB94
SHA1:	4F72B59E3177419A800219DF9CCF9D1531A6B58D
SHA-256:	59C0401CDD9324CAE64BD411A0A785679AF747F04E6B7E871425F645480BC0BE
SHA-512:	EF49147AB5918DD71BF5FE4F2A14D3504E407BE546D4302EEC16380E6FAC0C3B8151601FB9F55B121077A3171238E72BD2914644604C8FB02C1CD601709DA045
Malicious:	false
Preview:	const SemVer = require('../classes/semver').const Range = require('../classes/range').const gt = require('../functions/gt')..const minVersion = (range, loose) => {. range = new Range(range, loose).. let minver = new SemVer('0.0.0'). if (range.test(minver)) {. return minver. }.. minver = new SemVer('0.0.0-0'). if (range.test(minver)) {. return minver. }.. minver = null. for (let i = 0; i < range.set.length; ++i) {. const comparators = range.set[i].. let setMin = null. comparators.forEach((comparator) => {. // Clone to avoid manipulating the comparator's semver object.. const compver = new SemVer(comparator.semver.version). switch (comparator.operator) {. case '>':. if (compver.prerelease.length === 0) {. compver.patch++. } else {. compver.prerelease.push(0). }. compver.raw = compver.format(). /* fallthrough */. case '':. case '>=':. if (!setMin \|\| gt(co

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\ranges\outside.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2188
Entropy (8bit):	4.492396327400508
Encrypted:	false
SSDEEP:	48:lYO9TnyQa4q+fEvnK4MJTcx9B383s0aTa9xPTOu:eO9TyQC1nKHcx9N83s0a291TOu
MD5:	E9BBDBC4C695C025998B3271F44B8BDB
SHA1:	E1B66781D22D3D9C36B2744415C5D8876303AEDA
SHA-256:	02851F81E9DBB9812F84569687AF8D1C0B5C004B37274E93C1F71070B6BAB303
SHA-512:	DF41F9540742313671FF4F3C97DA60E7CBFC1CF96424F2E2DB779570F6734A0183BB6FB2BCE84F3338891F4953647C8834E4F90BBA62232F0B2CA2F8F5BA707B
Malicious:	false
Preview:	const SemVer = require('../classes/semver').const Comparator = require('../classes/comparator').const {ANY} = Comparator.const Range = require('../classes/range').const satisfies = require('../functions/satisfies').const gt = require('../functions/gt').const lt = require('../functions/lt').const lte = require('../functions/lte').const gte = require('../functions/gte')..const outside = (version, range, hilo, options) => {. version = new SemVer(version, options). range = new Range(range, options).. let gtfn, ltefn, ltfn, comp, ecomp. switch (hilo) {. case '>':. gtfn = gt. ltefn = lte. ltfn = lt. comp = '>'. ecomp = '>='. break. case '<':. gtfn = lt. ltefn = gte. ltfn = gt. comp = '<'. ecomp = '<='. break. default:. throw new TypeError('Must provide a hilo val of "<" or ">"'). }.. // If it satisfies the range it is not outside. if (satisfies(version, range, options)) {. return false. }.. // From now on,

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\ranges\simplify.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1287
Entropy (8bit):	4.53315489618282
Encrypted:	false
SSDEEP:	24:nTHtTtNBzMkLi5nzF8sINIQlGQlqOMLcDmlML4nG8vn95OnkLqnh/knkL3cSkIz:zlrHWPINIQlG2qOMg4MuG8v950k0h/2g
MD5:	B29CBFADF9FEE53715F13173504A9DF4
SHA1:	EB6C1D5401887F73E9F9054942827CF854F709BB
SHA-256:	58F8F458BE4892DC7B15DAF21E2DB1E7DF07CD1470BE9825B16FADDAE1F44F61
SHA-512:	98998FA3DA2184893380660E630BBB3DE94DD9907C7C0C03FA454A13A0C7FFD8893494741ED2462D59E8201DD0C3956F72F8C5BA4CDBB8BFA8F42B7BF5548B8B
Malicious:	false
Preview:	// given a set of versions and a range, create a "simplified" range.// that includes the same versions that the original range does.// If the original range is shorter than the simplified one, return that..const satisfies = require('../functions/satisfies.js').const compare = require('../functions/compare.js').module.exports = (versions, range, options) => {. const set = []. let min = null. let prev = null. const v = versions.sort((a, b) => compare(a, b, options)). for (const version of v) {. const included = satisfies(version, range, options). if (included) {. prev = version. if (!min). min = version. } else {. if (prev) {. set.push([min, prev]). }. prev = null. min = null. }. }. if (min). set.push([min, null]).. const ranges = []. for (const [min, max] of set) {. if (min === max). ranges.push(min). else if (!max && min === v[0]). ranges.push('*'). else if (!max). ranges.push(`>=${min}`). el

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\ranges\subset.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7224
Entropy (8bit):	4.702436328740145
Encrypted:	false
SSDEEP:	192:JMUYEQ019bR9QEKGuLA2aeXJipHE7Uznrnsa5wragQU4zKFyZ:JMUYEQ019N91KGuLRaeMxnRZ
MD5:	DE7B854D50B6C428E0BBC02391589D63
SHA1:	B6AA24D30719BF9586AD160B1D8845FD64E3D14B
SHA-256:	ED3716983CD04132502CC0247090253D0E955EA9EF44C17F70763DEE4165431F
SHA-512:	6266378F9311E1A60DA4B4451617C95D176F6A57A15D8931C9DD8B920FF6E109044AF7C67F79D1FB35C96FC5D625D8C3DAD6C4407DE50ACA271873E4CDE2F926
Malicious:	false
Preview:	const Range = require('../classes/range.js').const Comparator = require('../classes/comparator.js').const { ANY } = Comparator.const satisfies = require('../functions/satisfies.js').const compare = require('../functions/compare.js')..// Complex range `r1 \|\| r2 \|\| ...` is a subset of `R1 \|\| R2 \|\| ...` iff:.// - Every simple range `r1, r2, ...` is a null set, OR.// - Every simple range `r1, r2, ...` which is not a null set is a subset of.// some `R1, R2, ...`.//.// Simple range `c1 c2 ...` is a subset of simple range `C1 C2 ...` iff:.// - If c is only the ANY comparator.// - If C is only the ANY comparator, return true.// - Else if in prerelease mode, return false.// - else replace c with `[>=0.0.0]`.// - If C is only the ANY comparator.// - if in prerelease mode, return true.// - else replace C with `[>=0.0.0]`.// - Let EQ be the set of = comparators in c.// - If EQ is more than one, return true (null set).// - Let GT be the highest > or >= comparator in c.// - Let LT be the

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\ranges\to-comparators.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	268
Entropy (8bit):	4.654298672676647
Encrypted:	false
SSDEEP:	6:O/imuTAOk0qPiE2fWlmEqL2cKFWXxmLTNiRNGPYzBqqPvn:auTDqPihf/L2csWXx8BiRNmqBdv
MD5:	045401FED046B3ED05E1F5E7B56EE970
SHA1:	4D609454B2E81450D85BE8F56109AF8BA6B61B92
SHA-256:	C809EF2C27B2E9E47CEA6781D1B61E92ADABCCB139ABFAC009DF253CFC4F6FD3
SHA-512:	88B6F9FBB485049767807714E6881D75D88B06198E602408022F8017A16B0A43C75E6274E8C0728944F09CDA8E43E78284EEA74D9D007CD3BF40EA6EDCF9AF26
Malicious:	false
Preview:	const Range = require('../classes/range')..// Mostly just for testing and legacy API reasons.const toComparators = (range, options) =>. new Range(range, options).set. .map(comp => comp.map(c => c.value).join(' ').trim().split(' '))..module.exports = toComparators.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\node_modules\semver\ranges\valid.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	312
Entropy (8bit):	4.555760117843104
Encrypted:	false
SSDEEP:	6:O/i6FyLZYE2fWSFA9GShZsdKRRvIACY3WEqCCC74DvgtYAQb0B23Lz:OFyLofvFA9G6fvIPYkY+vgtbQb0BGLz
MD5:	1DC94773E37EE1D033F066FFD157BCB6
SHA1:	7A1C6AFBE83E28264A384B43AB8F6765F7649114
SHA-256:	4F6B4EB0D05FDA0E9774ECB1B7464D6FC25C75F1D9DF3423ACE4CBB2EC466FC4
SHA-512:	AE86B83933F7A9F3016F963576A57FC65BEA9ECC309B07ACBA6E8D41B98F518BAA8257DD2CDA8F1609A6C115EA60AD00E1AFF4FE9ECCFFCE3D505645B3FBCC63
Malicious:	false
Preview:	const Range = require('../classes/range').const validRange = (range, options) => {. try {. // Return '' instead of '' so that truthiness works.. // This will throw if it's invalid anyway. return new Range(range, options).range \|\| ''. } catch (er) {. return null. }.}.module.exports = validRange.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\AppAdapter.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	785
Entropy (8bit):	5.024419363805105
Encrypted:	false
SSDEEP:	24:KRyFUktiIWvdSBsGXaXu/rT2MQcoRFDaAH:KEF38I8SLXaXu/rT2MQcoRF+U
MD5:	0A26F804F3CAECD5862DEFB3DBA93D42
SHA1:	3918D0ECC7325F9C80C4BB4BEA4A47ADD429BE6B
SHA-256:	EBA29782DF66F10CF2DBBC61ABEEA38A9B6BA7EF2747C2B0574A6640E62B7C06
SHA-512:	E693B9C8DAC19116D117E7CA84D8DBFBC44CD2ED1F44A8F1EEFB4266B3B8D513F927BE4166DF5BD0E5EED8E22A6F7DB08A1C5A9658E20BCEE7D64F1276DC141C
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.getAppCacheDir = void 0;.const path = require("path");.const os_1 = require("os");.function getAppCacheDir() {. const homedir = os_1.homedir();. // https://github.com/electron/electron/issues/1404#issuecomment-194391247. let result;. if (process.platform === "win32") {. result = process.env.LOCALAPPDATA \|\| path.join(homedir, "AppData", "Local");. }. else if (process.platform === "darwin") {. result = path.join(homedir, "Library", "Application Support", "Caches");. }. else {. result = process.env.XDG_CACHE_HOME \|\| path.join(homedir, ".cache");. }. return result;.}.exports.getAppCacheDir = getAppCacheDir;.//# sourceMappingURL=AppAdapter.js.map

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\AppAdapter.js.map

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1771
Entropy (8bit):	5.188988895252847
Encrypted:	false
SSDEEP:	48:YWLRmrrGrfvWrKh9rDkzfxrsASdo3pwr3S8iRfvB0LpEexSAU92X:fe6fccEiASdo36r3S8iRXB0yextVX
MD5:	6DA7CF6114ED04A1E5DA8E391F3B9A98
SHA1:	BA02C2912788E467FDC479BF366995D4AAFC71E4
SHA-256:	A6D9822EF9B2781202CA85A8CF51D576C64C50E87081B1C437BA4950FB37A658
SHA-512:	C88EA184EC8E123B90CEE6FF04223E570F93F0286F62AA4B4F0B356DAEFF6CDEF27B7B459395D5414D5C969E24B487A162799DD09C15D8386857B17D83749539
Malicious:	false
Preview:	{"version":3,"file":"AppAdapter.js","sourceRoot":"","sources":["../src/AppAdapter.ts"],"names":[],"mappings":";;;AAAA,6BAA4B;AAC5B,2BAA0C;AA8B1C,SAAgB,cAAc;IAC5B,MAAM,OAAO,GAAG,YAAU,EAAE,CAAA;IAC5B,0EAA0E;IAC1E,IAAI,MAAc,CAAA;IAClB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE;QAChC,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;KAC5E;SAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE;QACxC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,QAAQ,CAAC,CAAA;KACxE;SAAM;QACL,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;KACpE;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAZD,wCAYC","sourcesContent":["import * as path from \"path\"\nimport { homedir as getHomedir } from \"os\"\n\nexport interface AppAdapter {\n readonly version: string\n readonly name: string\n\n readonly isPackaged: boolean\n\n /*\n Path to update metadata file.\n /\n readonly appUpdateConfigPath: string\n\n /\n Path to user data directory.\n

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\AppImageUpdater.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5113
Entropy (8bit):	4.629808966490244
Encrypted:	false
SSDEEP:	96:KEecnZP0EAPMuwHQ4Hs12haL/9t2AGDLtnQXVWnaX5P6lbiGev:KhEZP0EUMuwHQ4HsEhaL/9wdL5QXEna1
MD5:	EF8E76A3B68213786BA591CC441E519B
SHA1:	38F4CC57AB48621B0D720633ACD6B0911D3110F1
SHA-256:	EF3BF86E9D4A717364C4FB5800C75E207349DD0BC89A141EB144EC3C494F5C17
SHA-512:	0CA4F5F960D9541522956072F408E5E6D0CEAFF5929626264C4BCAEC1177C4897D65CC1CD74844D64D77968A5EE5468F7AA1A618B327F0F09F7727096469F3C7
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.AppImageUpdater = void 0;.const builder_util_runtime_1 = require("builder-util-runtime");.const child_process_1 = require("child_process");.const fs_extra_1 = require("fs-extra");.const fs_1 = require("fs");.const path = require("path");.const BaseUpdater_1 = require("./BaseUpdater");.const FileWithEmbeddedBlockMapDifferentialDownloader_1 = require("./differentialDownloader/FileWithEmbeddedBlockMapDifferentialDownloader");.const main_1 = require("./main");.const Provider_1 = require("./providers/Provider");.class AppImageUpdater extends BaseUpdater_1.BaseUpdater {. constructor(options, app) {. super(options, app);. }. isUpdaterActive() {. if (process.env.APPIMAGE == null) {. if (process.env.SNAP == null) {. this._logger.warn("APPIMAGE env is not defined, current application is not an AppImage");. }. else {. this._logg

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\AppImageUpdater.js.map

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7836
Entropy (8bit):	5.078908554285205
Encrypted:	false
SSDEEP:	192:fzvEcfQ/7pSotwj7/dZeZeoscPLWXJa/HSj:frmtwPeDpuaqj
MD5:	6D20913A379222CC50A19CAC773D06C0
SHA1:	03DFF1B833918AF30F8393574741705795351BAF
SHA-256:	69D793DCE82BCE2BC744ACF3AE7BC31C93673DD1BE6017BD04E0B26D5C7695CE
SHA-512:	1CA522F91FEB087DB2B62317F97793A9506756A0672E2825D7D7EBF738A5A96989E7F3C681D3C5031DE158814CA690B2EEA323DEB1E371050DE43AFDA5AEA143
Malicious:	false
Preview:	{"version":3,"file":"AppImageUpdater.js","sourceRoot":"","sources":["../src/AppImageUpdater.ts"],"names":[],"mappings":";;;AAAA,+DAAkE;AAClE,iDAAmD;AACnD,uCAAgC;AAChC,2BAA+B;AAC/B,6BAA4B;AAE5B,+CAA2D;AAE3D,4IAAwI;AACxI,iCAA0C;AAC1C,mDAA+C;AAE/C,MAAa,eAAgB,SAAQ,yBAAW;IAC9C,YAAY,OAAkC,EAAE,GAAS;QACvD,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IACrB,CAAC;IAEM,eAAe;QACpB,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,IAAI,EAAE;YAChC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE;gBAC5B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAA;aACzF;iBAAM;gBACL,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAA;aAC9D;YACD,OAAO,KAAK,CAAA;SACb;QACD,OAAO,KAAK,CAAC,eAAe,EAAE,CAAA;IAChC,CAAC;IAED,gBAAgB;IACN,gBAAgB,CAAC,qBAA4C;QACrE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,qBAAqB,CAAC,QAAQ,CAAA;QACrE,MAAM,QAAQ,GAAG,mBAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,UAAU,CAAE,CAAA;QAC/G,OAAO,IAAI,CAAC,eAAe,CAAC;YAC1B,aAAa,EAAE,UAAU;YACzB,QAAQ;YACR,qBAAqB;YACrB,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,EAAE;gBAC1C,MAAM,OAAO,GAAG,O

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\AppUpdater.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	23410
Entropy (8bit):	4.642287415305467
Encrypted:	false
SSDEEP:	384:zzISX4j0Cy2cyMAvoxNV3TNXAxxOxezhwyTxTtJQD/wGY:zzIuDV2cyMAvoxNV3TNXAvOxQ+vjwGY
MD5:	CD3A3688B4630DD2026644AFCBC577CC
SHA1:	0DA8A0A2FB34AD7ADF3E661EDC135E7EF36CA5C2
SHA-256:	AF67F419C507113203CCAEC40660F4A9C320E2A407CFCF584B6860D39E23CD64
SHA-512:	D858CA3D8BA38729FDB7E8D76722E2A12F89193D73DAAA89513B898FC3C08110FBF3A5E179C307AAC585AF8E228E8DA64A36F9F9DDB4772F7C18E77E7B6C93FC
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.NoOpLogger = exports.AppUpdater = void 0;.const builder_util_runtime_1 = require("builder-util-runtime");.const crypto_1 = require("crypto");.const events_1 = require("events");.const fs_extra_1 = require("fs-extra");.const js_yaml_1 = require("js-yaml");.const lazy_val_1 = require("lazy-val");.const path = require("path");.const semver_1 = require("semver");.const DownloadedUpdateHelper_1 = require("./DownloadedUpdateHelper");.const ElectronAppAdapter_1 = require("./ElectronAppAdapter");.const electronHttpExecutor_1 = require("./electronHttpExecutor");.const GenericProvider_1 = require("./providers/GenericProvider");.const main_1 = require("./main");.const providerFactory_1 = require("./providerFactory");.class AppUpdater extends events_1.EventEmitter {. constructor(options, app) {. super();. /*. Whether to automatically download an update when it is found.. */.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\AppUpdater.js.map

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	40458
Entropy (8bit):	5.077721967267479
Encrypted:	false
SSDEEP:	768:f6H7gZSH73xTMa1+WISHS0v0jM7vH+NqjPNC/UmU+BD9Hy+:f6bgZSHbxn1nCjM7vH+NqjPNC/5UED9l
MD5:	AFAD78D4F8420736777135719628FB00
SHA1:	685DE5A5D66BDA3DF698A65EE34072E2A5C3DFB8
SHA-256:	E86D9294D953D280786D98080F25F2E2BF597E96176C7D0FDE48DC171C3B7682
SHA-512:	6B69ACDE33027353171F35469B81C7A3D7D70C09E812C8E827405AB67F1D50276A548ABED71D6AA466AFF414195F55667CE0B54C14C9EDB0931554A3E274F944
Malicious:	false
Preview:	{"version":3,"file":"AppUpdater.js","sourceRoot":"","sources":["../src/AppUpdater.ts"],"names":[],"mappings":";;;AAAA,+DAA0K;AAC1K,mCAAoC;AACpC,mCAAqC;AACrC,uCAA0E;AAE1E,qCAA8B;AAC9B,uCAA+B;AAC/B,6BAA4B;AAC5B,mCAA8K;AAE9K,qEAAuF;AACvF,6DAAyD;AACzD,iEAA4E;AAC5E,iEAA6D;AAC7D,iCAAgK;AAChK,uDAAwF;AAIxF,MAAsB,UAAW,SAAQ,qBAAY;IAgInD,YAAsB,OAA6C,EAAE,GAAgB;QACnF,KAAK,EAAE,CAAA;QAhIT;;WAEG;QACH,iBAAY,GAAG,IAAI,CAAA;QAEnB;;WAEG;QACH,yBAAoB,GAAG,IAAI,CAAA;QAE3B;;;;WAIG;QACH,oBAAe,GAAG,KAAK,CAAA;QAEvB;;;WAGG;QACH,kBAAa,GAAG,KAAK,CAAA;QAErB;;;;;;WAMG;QACH,mBAAc,GAAG,KAAK,CAAA;QAOd,aAAQ,GAAkB,IAAI,CAAA;QAE5B,2BAAsB,GAAkC,IAAI,CAAA;QA4BtE;;WAEG;QACH,mBAAc,GAA+B,IAAI,CAAA;QAEvC,YAAO,GAAW,OAAO,CAAA;QAmBnC,qCAAqC;QACrC;;WAEG;QACM,YAAO,GAAG,IAAI,oBAAa,CAAC,IAAI,CAAC,CAAA;QAElC,yBAAoB,GAAkB,IAAI,CAAA;QAa1C,kBAAa,GAAkC,IAAI,CAAA;QAExC,yBAAoB,GAAG,IAAI,eAAI,CAAS,GAAG,EAAE,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,CAAA;QAEjG,8CAA8C;QAC9C,gBAAgB;QAChB,iBAAY,GAAG,IAAI,eAAI,CAAM,GAAG,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\BaseUpdater.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3340
Entropy (8bit):	4.371628521103612
Encrypted:	false
SSDEEP:	96:KEjfvlwDinzcKPga4zJDzxiXCC6S6lwRaS2RS0FX:KGfvlwDin/PgBh1irT0yz2ga
MD5:	0046003910171B5DC999D9741A83158E
SHA1:	BDF870D21321023ED0F81E2CCA994CDCE33B8670
SHA-256:	CD9B1DD5E4A2D7636F2A11AE927FCEFEBF8A2CB36E552D136D6F832149762F47
SHA-512:	010B62A32FF7C1443BE6057591D85EEDA2761582CA1163144812B4D30A36C2F5FEF7426F87EC495C1160306DF83DD51C20A4704E73060D8A7D663A1B4F580E8A
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.BaseUpdater = void 0;.const AppUpdater_1 = require("./AppUpdater");.class BaseUpdater extends AppUpdater_1.AppUpdater {. constructor(options, app) {. super(options, app);. this.quitAndInstallCalled = false;. this.quitHandlerAdded = false;. }. quitAndInstall(isSilent = false, isForceRunAfter = false) {. this._logger.info(`Install on explicit quitAndInstall`);. const isInstalled = this.install(isSilent, isSilent ? isForceRunAfter : true);. if (isInstalled) {. setImmediate(() => {. this.app.quit();. });. }. else {. this.quitAndInstallCalled = false;. }. }. executeDownload(taskOptions) {. return super.executeDownload({. ...taskOptions,. done: event => {. this.dispatchUpdateDownloaded(event);. this.addQuitHandler();.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\BaseUpdater.js.map

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5888
Entropy (8bit):	4.941479060123014
Encrypted:	false
SSDEEP:	96:fBxJL7UbT0nD1+6wpvUvatW2Kao7zDScd+ueSmnIk3wRYPVr8pb:fOkD5wp1sreyYP8
MD5:	95FADE3A8D37E4F3B0C02C14FD3B66AF
SHA1:	D35B9919E33E3E13362307BEB974804F5D8DC310
SHA-256:	FC7E5DAB38CE7147E38C208108292F91E61AA4A73B0648B24F5AF88BC1B419FD
SHA-512:	01D589B73B00B0828CCED8684DC5DD8F2B818AD069102B6BF37EB2396646D48FCD4BBAEDBA32B9B2CAA4AEAD3F46AAB872F69BB995789AD8A58F401E0DC50E1E
Malicious:	false
Preview:	{"version":3,"file":"BaseUpdater.js","sourceRoot":"","sources":["../src/BaseUpdater.ts"],"names":[],"mappings":";;;AAEA,6CAA+D;AAE/D,MAAsB,WAAY,SAAQ,uBAAU;IAIlD,YAAsB,OAAkC,EAAE,GAAgB;QACxE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAJX,yBAAoB,GAAG,KAAK,CAAA;QAC9B,qBAAgB,GAAG,KAAK,CAAA;IAIhC,CAAC;IAED,cAAc,CAAC,QAAQ,GAAG,KAAK,EAAE,eAAe,GAAG,KAAK;QACtD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAA;QACvD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAC7E,IAAI,WAAW,EAAE;YACf,YAAY,CAAC,GAAG,EAAE;gBAChB,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;YACjB,CAAC,CAAC,CAAA;SACH;aAAM;YACL,IAAI,CAAC,oBAAoB,GAAG,KAAK,CAAA;SAClC;IACH,CAAC;IAES,eAAe,CAAC,WAAiC;QACzD,OAAO,KAAK,CAAC,eAAe,CAAC;YAC3B,GAAG,WAAW;YACd,IAAI,EAAE,KAAK,CAAC,EAAE;gBACZ,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAA;gBACpC,IAAI,CAAC,cAAc,EAAE,CAAA;gBACrB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;YAC1B,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;IAKD,wDAAwD;IAC9C,OAAO,CAAC,QAAiB,EAAE,eAAwB;QAC3D,IAAI,IAAI,CAAC,oBAAoB,EAAE;YAC7

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\DownloadedUpdateHelper.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6954
Entropy (8bit):	4.625450440375773
Encrypted:	false
SSDEEP:	192:Khkv2Sigbcw7OyblIQiAQFi69x/VS3vu4XAA4oIVb3yBGt9uiQ8Xsl:M9jnnCgRXsl
MD5:	23CF81049B091B063520BF67AA053E24
SHA1:	21EAE2CAA5218909BA7FE396BCBF2E1B4CD590CF
SHA-256:	C1DB2AF92CA378D1A92A9088CC4560E3B95C871875CAADD782D42D16226894D4
SHA-512:	782D508546E7FB289C9FDC5286E92614029B8257F3103666C644908FEFAC402EFAEDEF3A8E7ED0230C2D15C5996A5B2E48EBA8EF0EE227ECD5D7847C85A0233A
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.createTempUpdateFile = exports.DownloadedUpdateHelper = void 0;.const crypto_1 = require("crypto");.const fs_1 = require("fs");.// @ts-ignore.const isEqual = require("lodash.isequal");.const fs_extra_1 = require("fs-extra");.const path = require("path");./ @private /.class DownloadedUpdateHelper {. constructor(cacheDir) {. this.cacheDir = cacheDir;. this._file = null;. this._packageFile = null;. this.versionInfo = null;. this.fileInfo = null;. this._downloadedFileInfo = null;. }. get downloadedFileInfo() {. return this._downloadedFileInfo;. }. get file() {. return this._file;. }. get packageFile() {. return this._packageFile;. }. get cacheDirForPendingUpdate() {. return path.join(this.cacheDir, "pending");. }. async validateDownloadedPath(updateFile, updateInfo, fileInfo, logger) {. if (thi

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\DownloadedUpdateHelper.js.map

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	11997
Entropy (8bit):	5.06252634516013
Encrypted:	false
SSDEEP:	192:fHtg2AwP4IMBXff0WHOquSvB9EP+zWwnmuYNgbD7aI:fNSwEX4mzWAmhiDGI
MD5:	A960B8543BB6DCF2539DA5FEEEDEC38E
SHA1:	343804158A46D0DA77EAF38F07BE512C99C1B8AA
SHA-256:	3BAE2647272CE787F6D80B1F07CA34EFCF1E842CF33C71FADC3B292ED8E59D1C
SHA-512:	52CF7693B2C293282D0C6444E8843ECC41FC8BFC16328FC97AE53D0B000622B157DE0D80AB039B0520FC370207449539954AFE989310A640F8888C77B66255B8
Malicious:	false
Preview:	{"version":3,"file":"DownloadedUpdateHelper.js","sourceRoot":"","sources":["../src/DownloadedUpdateHelper.ts"],"names":[],"mappings":";;;AACA,mCAAmC;AACnC,2BAAqC;AACrC,aAAa;AACb,0CAAyC;AAEzC,uCAA6E;AAC7E,6BAA4B;AAE5B,gBAAgB;AAChB,MAAa,sBAAsB;IAOjC,YAAqB,QAAgB;QAAhB,aAAQ,GAAR,QAAQ,CAAQ;QAN7B,UAAK,GAAkB,IAAI,CAAA;QAC3B,iBAAY,GAAkB,IAAI,CAAA;QAElC,gBAAW,GAAsB,IAAI,CAAA;QACrC,aAAQ,GAAkC,IAAI,CAAA;QAI9C,wBAAmB,GAA4B,IAAI,CAAA;IAFnB,CAAC;IAGzC,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,mBAAmB,CAAA;IACjC,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,YAAY,CAAA;IAC1B,CAAC;IAED,IAAI,wBAAwB;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IAC5C,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,UAAkB,EAAE,UAAsB,EAAE,QAAgC,EAAE,MAAc;QACvH,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE;YACjF,gEAAgE;YAChE,0CAA0C;YAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAA

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\ElectronAppAdapter.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	4.671988836548914
Encrypted:	false
SSDEEP:	24:KRykvLMsXM4p7njnu6b2U4nKahEXia+ZDMcRkwpWM:KEqXtp7jn90KahEXL+ZfRh
MD5:	703308C3A7DFA272D6FBAE68EB9894CB
SHA1:	89324CFFE05CBB3B6E52214E84CD89B88905DAC1
SHA-256:	55E12978B3750369D97F9D65FED8C6F67035AC6EDF3D9820F750D29EAD431A2E
SHA-512:	D943626FB34EFDBDE5F82132BF1A5EC787710E3A98EE92792E151DDB9C925BED69A43C74EAB5BD283EE80C6858CBCDBEB506F1E74DFD79F9833F1BB119DACF06
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.ElectronAppAdapter = void 0;.const path = require("path");.const AppAdapter_1 = require("./AppAdapter");.class ElectronAppAdapter {. constructor(app = require("electron").app) {. this.app = app;. }. whenReady() {. return this.app.whenReady();. }. get version() {. return this.app.getVersion();. }. get name() {. return this.app.getName();. }. get isPackaged() {. return this.app.isPackaged === true;. }. get appUpdateConfigPath() {. return this.isPackaged ? path.join(process.resourcesPath, "app-update.yml") : path.join(this.app.getAppPath(), "dev-app-update.yml");. }. get userDataPath() {. return this.app.getPath("userData");. }. get baseCachePath() {. return AppAdapter_1.getAppCacheDir();. }. quit() {. this.app.quit();. }. onQuit(handler) {. this.app.once("quit", (_, exitCode) =>

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\ElectronAppAdapter.js.map

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2160
Entropy (8bit):	4.932091557502077
Encrypted:	false
SSDEEP:	48:YWLtUlzCFybJEv//vvfLNyWAzY56dOgzbvuxrIxDDiLZdsXxV6LpER6mxi:f+lOFK4noWA61WCQ3iLsXxsybi
MD5:	EE00AA2DF28672BC445CEF9ABAFC2561
SHA1:	2988991F6FC1D7A2C59420D15C1A1DBA8E48564D
SHA-256:	CC7F72E0A739D10572EE656004711D00C8954DF6C7C03E4DBDD6A1B8454C3278
SHA-512:	0F7E2F12FBC903ECCB5743B85FBB7EDECE5455719D87FBEC05CADFD95857FCC39518F5AE96666CCBF8F39CA5B471A8D338005546CD632617857E736309277D97
Malicious:	false
Preview:	{"version":3,"file":"ElectronAppAdapter.js","sourceRoot":"","sources":["../src/ElectronAppAdapter.ts"],"names":[],"mappings":";;;AAAA,6BAA4B;AAC5B,6CAAyD;AAEzD,MAAa,kBAAkB;IAC7B,YAA6B,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG;QAA7B,QAAG,GAAH,GAAG,CAA0B;IAAG,CAAC;IAE9D,SAAS;QACP,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAA;IAC7B,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAA;IAC9B,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;IAC3B,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,CAAA;IACrC,CAAC;IAED,IAAI,mBAAmB;QACrB,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAc,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,oBAAoB,CAAC,CAAA;IACvI,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IACrC,CAAC;IAED,IAAI,aAAa;QACf,OAAO,2BAAc,EAAE,CAAA;IACzB,CAAC;IAED,IAAI;QACF,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;IACjB,CAAC;IAED,MAAM,CAAC,OAAmC;QACxC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\MacUpdater.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6832
Entropy (8bit):	4.121398044967914
Encrypted:	false
SSDEEP:	192:KQnfm0z1+oss0P1IbdtvlQYHhcwrMECnfaXF4NC1i+GAD:lwBx4
MD5:	EFAA8C1D00145DED4499C03C14FF7616
SHA1:	43F5D55812F144A1DABC11DC84B8AC4EAB52B7C3
SHA-256:	BD985D0DC4E6E756B68F435C0D6466A91EBBAB34335C374A86D09FF36A4CDB07
SHA-512:	62384153177C55AFAD3A7508CF480083835A47994B3C733185F133DB5C942AD4626949CAC3C8C61CFEC576291E47B14BDD3A04C79EDF36FCC30AAD395778E49E
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.MacUpdater = void 0;.const builder_util_runtime_1 = require("builder-util-runtime");.const fs_extra_1 = require("fs-extra");.const fs_1 = require("fs");.const http_1 = require("http");.const AppUpdater_1 = require("./AppUpdater");.const Provider_1 = require("./providers/Provider");.class MacUpdater extends AppUpdater_1.AppUpdater {. constructor(options, app) {. super(options, app);. this.nativeUpdater = require("electron").autoUpdater;. this.squirrelDownloadedUpdate = false;. this.nativeUpdater.on("error", it => {. this._logger.warn(it);. this.emit("error", it);. });. this.nativeUpdater.on("update-downloaded", () => {. this.squirrelDownloadedUpdate = true;. });. }. doDownloadUpdate(downloadUpdateOptions) {. let files = downloadUpdateOptions.updateInfoAndProvider.provider.resolveFiles(downloadUpdateOptions.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\MacUpdater.js.map

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10778
Entropy (8bit):	4.8917180441065025
Encrypted:	false
SSDEEP:	192:fgu6rZjVJUFCXXi4XAXTM7hxMHssRh/0HBFRpuGj4Sbm:fgpZjVJUFCXXi4XAXTKJdhM
MD5:	B5669BC2A172D516864F957FBB8ED105
SHA1:	B73DB1CB5ECB9645D9DDF059CC77892B06AB1B14
SHA-256:	BEE57B39AA7028EC63772FFF6DC6EE17F729E8B97159DE80DA6DB7271095524E
SHA-512:	FBAFC93F75402D39C0FC9A378E591C80B3189CE14233485439EB90AA6B856444A4C95C0C7CAC212BE3A153786A4DF14115C8AA6BC93C22AE96491ED2340D45CE
Malicious:	false
Preview:	{"version":3,"file":"MacUpdater.js","sourceRoot":"","sources":["../src/MacUpdater.ts"],"names":[],"mappings":";;;AAAA,+DAAqF;AACrF,uCAA+B;AAC/B,2BAAqC;AACrC,+BAAoE;AAGpE,6CAAgE;AAEhE,mDAA+C;AAG/C,MAAa,UAAW,SAAQ,uBAAU;IAKxC,YAAY,OAA2B,EAAE,GAAgB;QACvD,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QALJ,kBAAa,GAAgB,OAAO,CAAC,UAAU,CAAC,CAAC,WAAW,CAAA;QAErE,6BAAwB,GAAG,KAAK,CAAA;QAKtC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE;YAClC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACrB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;QACxB,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;YAC9C,IAAI,CAAC,wBAAwB,GAAG,IAAI,CAAA;QACtC,CAAC,CAAC,CAAA;IACJ,CAAC;IAES,gBAAgB,CAAC,qBAA4C;QACrE,IAAI,KAAK,GAAG,qBAAqB,CAAC,qBAAqB,CAAC,QAAQ,CAAC,YAAY,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAA;QAE/H,2HAA2H;QAC3H,MAAM,OAAO,GAAG,CAAC,IAA4B,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QACrF,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;YACvB,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\NoOpLogger.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	529
Entropy (8bit):	4.688675416475498
Encrypted:	false
SSDEEP:	12:BETNy6DCHqlvusLzNWjibtiilvusLzNWhgtiilvusLzNW54t0cRevAp:KRyWCdsfEjCUFsfEhgUFsfEK+cR/p
MD5:	E0440A2B051FE12A47F5BA352D7AEA38
SHA1:	5F4753AE5FCDEEE4B2F01F4AF431F61355E61779
SHA-256:	525AF56E7699E786F7B77FA09308A6A34FA325E8B9F2BC6007FD79BA2152D51F
SHA-512:	F4552D2123C1AA6108EBFBB64A47408D4D75FDE0806975A57017EC212EB0AAE6830CF9B51353768957A36E738B6577301BBFD7190ABF0BDA3D99B019AE556222
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.NoOpLogger = void 0;.class NoOpLogger {. // eslint-disable-next-line @typescript-eslint/no-unused-vars. info(message) {. // ignore. }. // eslint-disable-next-line @typescript-eslint/no-unused-vars. warn(message) {. // ignore. }. // eslint-disable-next-line @typescript-eslint/no-unused-vars. error(message) {. // ignore. }.}.exports.NoOpLogger = NoOpLogger;.//# sourceMappingURL=NoOpLogger.js.map

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\NoOpLogger.js.map

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	750
Entropy (8bit):	5.173693619025993
Encrypted:	false
SSDEEP:	12:YWLSyZwFUHXr2RcMLivcMLivNx09eowHZppHqIDZHTColvusLzNWxiJdwrlvusLj:YWLSySU3KRLsLOEerppHLZHGzsfExmw3
MD5:	0649E456ACC9072955EF599F17D9CE6E
SHA1:	BC552F8B10FD2448D527C4670D9F04B8BA7E5CE8
SHA-256:	CBD3BF7C3C5DD451F2FE9359D870F9AE45F3723E9BB58C0BBDA2E704CC459301
SHA-512:	E3B4C0CD4E97D3E6EF052B1D90844B2149069473A478E3D20F21C50E83DAB522B4C2CD3C925B6753A8C98CBC1F50D91328A7A5BF4819E43A8BCE53780C11525F
Malicious:	false
Preview:	{"version":3,"file":"NoOpLogger.js","sourceRoot":"","sources":["../src/NoOpLogger.ts"],"names":[],"mappings":";;;AAEA,MAAa,UAAU;IACrB,6DAA6D;IAC7D,IAAI,CAAC,OAAa;QAChB,SAAS;IACX,CAAC;IAED,6DAA6D;IAC7D,IAAI,CAAC,OAAa;QAChB,SAAS;IACX,CAAC;IAED,6DAA6D;IAC7D,KAAK,CAAC,OAAa;QACjB,SAAS;IACX,CAAC;CACF;AAfD,gCAeC","sourcesContent":["import { Logger } from \"./main\"\n\nexport class NoOpLogger implements Logger {\n // eslint-disable-next-line @typescript-eslint/no-unused-vars\n info(message?: any) {\n // ignore\n }\n\n // eslint-disable-next-line @typescript-eslint/no-unused-vars\n warn(message?: any) {\n // ignore\n }\n\n // eslint-disable-next-line @typescript-eslint/no-unused-vars\n error(message?: any) {\n // ignore\n }\n}\n"]}

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\NsisUpdater.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10637
Entropy (8bit):	4.582983700450776
Encrypted:	false
SSDEEP:	192:KhK620X4HQ4Hsla4QeFoDVmiS6FUNy/miXyTF26M+drWYT9XxtOWl8LfF8+DKFiU:kkylhx55
MD5:	0C8E3F83B60A43D52651B11529110EE4
SHA1:	FDB75B16003DC1CFCF51F1C9AAF2BA5AFEA1B62E
SHA-256:	28929F5EFA437B8D9D3975F824209098709034D6D3E8A3876CD3AB9788B821DA
SHA-512:	DF6CD94E897F31025FDF8934C206D27B8326BD805FD41FBE8EE4472A61C402435FB7E058E46CF8804D3D3020DD0503B8F2438721EC6FFDC33339B083DBACF1E3
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.NsisUpdater = void 0;.const builder_util_runtime_1 = require("builder-util-runtime");.const child_process_1 = require("child_process");.const path = require("path");.const BaseUpdater_1 = require("./BaseUpdater");.const FileWithEmbeddedBlockMapDifferentialDownloader_1 = require("./differentialDownloader/FileWithEmbeddedBlockMapDifferentialDownloader");.const GenericDifferentialDownloader_1 = require("./differentialDownloader/GenericDifferentialDownloader");.const main_1 = require("./main");.const util_1 = require("./util");.const Provider_1 = require("./providers/Provider");.const fs_extra_1 = require("fs-extra");.const windowsExecutableCodeSignatureVerifier_1 = require("./windowsExecutableCodeSignatureVerifier");.const url_1 = require("url");.const zlib_1 = require("zlib");.class NsisUpdater extends BaseUpdater_1.BaseUpdater {. constructor(options, app) {. super(options, app);. }. /***

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\NsisUpdater.js.map

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	17084
Entropy (8bit):	5.063761153146674
Encrypted:	false
SSDEEP:	192:fopCe3lqDCdiUwgFk8DkmuzzWv0ossddLhzlykXysLo+cjGLNTGL:fDegYdwgm8gzmjTalL
MD5:	BF2435AA1B2650B7A83AA436A46C08D5
SHA1:	8DC4E51CB6773F2D838BA1AA282D41757F25B4FE
SHA-256:	60D9CEB8261BFD0A04BD8121D3DC88C2809F0BBD9B7C5F3A2C1C5C703A420CD8
SHA-512:	02F7B247A118BA65D521E6F843D55248EBECCE1123FB1D888DA87A4D671F0C5B211C5167C6E0D1906CDB6E5923B3837176D6998F5B5E50D3EFE5E699ACE2F9A6
Malicious:	false
Preview:	{"version":3,"file":"NsisUpdater.js","sourceRoot":"","sources":["../src/NsisUpdater.ts"],"names":[],"mappings":";;;AAAA,+DAA6J;AAC7J,iDAAqC;AACrC,6BAA4B;AAG5B,+CAA2D;AAE3D,4IAAwI;AACxI,0GAAsG;AACtG,iCAAkE;AAClE,iCAAsC;AACtC,mDAAyD;AACzD,uCAAiC;AACjC,qGAA0E;AAC1E,6BAAyB;AACzB,+BAAiC;AAEjC,MAAa,WAAY,SAAQ,yBAAW;IAC1C,YAAY,OAAkC,EAAE,GAAgB;QAC9D,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IACrB,CAAC;IAED,gBAAgB;IACN,gBAAgB,CAAC,qBAA4C;QACrE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,qBAAqB,CAAC,QAAQ,CAAA;QACrE,MAAM,QAAQ,GAAG,mBAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,KAAK,CAAE,CAAA;QAC1G,OAAO,IAAI,CAAC,eAAe,CAAC;YAC1B,aAAa,EAAE,KAAK;YACpB,qBAAqB;YACrB,QAAQ;YACR,IAAI,EAAE,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,WAAW,EAAE,kBAAkB,EAAE,EAAE;gBAChF,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAA;gBACxC,MAAM,cAAc,GAAG,WAAW,IAAI,IAAI,IAAI,WAAW,IAAI,IAAI,CAAA;gBACjE,IAAI,cAAc,IAAI,CAAC,MAAM,IAAI,CAAC,6BAA6B,CAAC,QAAQ,EAAE,qBAAqB,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC,EAAE;oBAC5H,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAA

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\differentialDownloader\DataSplitter.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7975
Entropy (8bit):	4.47670941662735
Encrypted:	false
SSDEEP:	192:Kj2ps8fOPyeynyyj9FAdE7Dmd2ClJrrwjZdIhWdoBpVS2bXG3dsCk3mcyi89JwAg:Q1eq/2pJCYBo
MD5:	A42DDB65E0CC2204CB8BCAC7810AAB4D
SHA1:	471D34AA5827D19262E2F353E5E6D320A71DA1A2
SHA-256:	1F01F2F61145DE1FA80FA8460D52A18988952349FCE646B9836690EAA343DE5D
SHA-512:	A893B7DAEA0F45449407443E42AF3D224FFD40BCD6D4C94C70C00FCFC4CFDC1166B2266271D482A3F0F82245584FD6B9AE2D6FBBC84B571E83292CE28801DC65
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.DataSplitter = exports.copyData = void 0;.const builder_util_runtime_1 = require("builder-util-runtime");.const fs_1 = require("fs");.const stream_1 = require("stream");.const downloadPlanBuilder_1 = require("./downloadPlanBuilder");.const DOUBLE_CRLF = Buffer.from("\r\n\r\n");.var ReadState;.(function (ReadState) {. ReadState[ReadState["INIT"] = 0] = "INIT";. ReadState[ReadState["HEADER"] = 1] = "HEADER";. ReadState[ReadState["BODY"] = 2] = "BODY";.})(ReadState \|\| (ReadState = {}));.function copyData(task, out, oldFileFd, reject, resolve) {. const readStream = fs_1.createReadStream("", {. fd: oldFileFd,. autoClose: false,. start: task.start,. // end is inclusive. end: task.end - 1,. });. readStream.on("error", reject);. readStream.once("end", resolve);. readStream.pipe(out, {. end: false,. });.}.exports.copyData = copyData;.class Dat

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\differentialDownloader\DataSplitter.js.map

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	13889
Entropy (8bit):	4.911450513738818
Encrypted:	false
SSDEEP:	384:fhneRssxUbBfIuVeYoAS2/l+Z/HfbGETn:54ssibddb/gZn
MD5:	2FD6FBCE3B1101B7C082857BBB9636EC
SHA1:	592CCD8BAF30E37F17FD890ADF4C2D0B7617EA44
SHA-256:	C12E7A4C19DEAD6707C08DF2C0D6CCEA619988DC31F3F10637EF1A3098FA4861
SHA-512:	6C24C29173F92FAD0A4C26C30E17482A71D7626331B9FFE0422281CF26E0DAAB0209AB2E74300881F2FFA288907C8BCF5CC46BCFD3DDA452BF5C030403E72975
Malicious:	false
Preview:	{"version":3,"file":"DataSplitter.js","sourceRoot":"","sources":["../../src/differentialDownloader/DataSplitter.ts"],"names":[],"mappings":";;;AAAA,+DAA+C;AAC/C,2BAAqC;AACrC,mCAAiC;AACjC,+DAAgE;AAEhE,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;AAE3C,IAAK,SAIJ;AAJD,WAAK,SAAS;IACZ,yCAAI,CAAA;IACJ,6CAAM,CAAA;IACN,yCAAI,CAAA;AACN,CAAC,EAJI,SAAS,KAAT,SAAS,QAIb;AASD,SAAgB,QAAQ,CAAC,IAAe,EAAE,GAAa,EAAE,SAAiB,EAAE,MAA8B,EAAE,OAAmB;IAC7H,MAAM,UAAU,GAAG,qBAAgB,CAAC,EAAE,EAAE;QACtC,EAAE,EAAE,SAAS;QACb,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,mBAAmB;QACnB,GAAG,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC;KAClB,CAAC,CAAA;IACF,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC9B,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IAC/B,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE;QACnB,GAAG,EAAE,KAAK;KACX,CAAC,CAAA;AACJ,CAAC;AAbD,4BAaC;AAED,MAAa,YAAa,SAAQ,iBAAQ;IAUxC,YACmB,GAAa,EACb,OAAyB,EACzB,oBAAyC,EAC1D,QAAgB,EACC,iBAAgC,EAChC,aAAwB;QAEzC,KAAK,EAAE,CAAA;QAPU,QAAG,GAAH,GAAG,CAAU;QACb,YAAO,GAAP,OAAO,CAAkB;QACzB,yBAAoB,

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\differentialDownloader\DifferentialDownloader.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	12136
Entropy (8bit):	4.325037658830203
Encrypted:	false
SSDEEP:	192:Kmxb8POzf7i4lNyx5HOS/KISw6sic2yPsSYb8Hxl3CHVpolUNyXCd32wZ6DsI3nk:2UmsWReLzN3
MD5:	6F2A85C1F62BD6796F81144ECD624146
SHA1:	F5499A4978BFA961F196FC93837CA4943A83C9A5
SHA-256:	F9F4A7CF4EB00F3D4A2BC53C40F6AE61B4AF5A69A5D78AF41532F399C83AEA60
SHA-512:	8704EE48FBD4DB8B22F1584BB21D6CE76403734B36F9FCEFF915B748044165ADC7424699CF86E77A363FECFD0582D74AB0BDE0DA3E05E2808E9DE1E38A8457CD
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.DifferentialDownloader = void 0;.const builder_util_runtime_1 = require("builder-util-runtime");.const fs_extra_1 = require("fs-extra");.const fs_1 = require("fs");.const DataSplitter_1 = require("./DataSplitter");.const url_1 = require("url");.const downloadPlanBuilder_1 = require("./downloadPlanBuilder");.const multipleRangeDownloader_1 = require("./multipleRangeDownloader");.const ProgressDifferentialDownloadCallbackTransform_1 = require("./ProgressDifferentialDownloadCallbackTransform");.class DifferentialDownloader {. // noinspection TypeScriptAbstractClassConstructorCanBeMadeProtected. constructor(blockAwareFileInfo, httpExecutor, options) {. this.blockAwareFileInfo = blockAwareFileInfo;. this.httpExecutor = httpExecutor;. this.options = options;. this.fileMetadataBuffer = null;. this.logger = options.logger;. }. createRequestOptions() {. cons

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\differentialDownloader\DifferentialDownloader.js.map

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	20354
Entropy (8bit):	4.944026434447207
Encrypted:	false
SSDEEP:	192:fGM61TW7dHSkDownl7s7mdthj+Zkhhs9Kmtbu8qxQSkpgWozwdRDeX3s1bjdTj2C:fyULfjv/sImZu8EQRSs1bpfgB6tqkoNi
MD5:	7116FDE1986E00D65D9194CE9A4845F2
SHA1:	5B130A9C79238017745AF54DD4648D06AEA6F561
SHA-256:	D48E9FC73879F3D8CF625A26F1ECE72E64939157E04BA0AF47A1AC20835A4689
SHA-512:	54C6ADE835ADC2CE0746B2145822725459A936DD1EFF300EFEFC24B0A9DEE9B0D2B31477236EE3433C163DFAE7187F3071346730AF504763D32809333678E78C
Malicious:	false
Preview:	{"version":3,"file":"DifferentialDownloader.js","sourceRoot":"","sources":["../../src/differentialDownloader/DifferentialDownloader.ts"],"names":[],"mappings":";;;AAAA,+DAAuJ;AAEvJ,uCAAsC;AACtC,2BAAsC;AAItC,iDAAyC;AACzC,6BAAyB;AACzB,+DAAmF;AACnF,uEAA0G;AAC1G,mHAAiJ;AAgBjJ,MAAsB,sBAAsB;IAK1C,oEAAoE;IACpE,YAA+B,kBAAsC,EAAW,YAA+B,EAAW,OAAsC;QAAjI,uBAAkB,GAAlB,kBAAkB,CAAoB;QAAW,iBAAY,GAAZ,YAAY,CAAmB;QAAW,YAAO,GAAP,OAAO,CAA+B;QALhK,uBAAkB,GAAkB,IAAI,CAAA;QAMtC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;IAC9B,CAAC;IAED,oBAAoB;QAClB,MAAM,MAAM,GAAG;YACb,OAAO,EAAE;gBACP,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc;gBAC9B,MAAM,EAAE,KAAK;aACd;SACF,CAAA;QACD,0CAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAChD,qDAAqD;QACrD,8CAAuB,CAAC,MAAM,CAAC,CAAA;QAC/B,OAAO,MAAM,CAAA;IACf,CAAC;IAES,UAAU,CAAC,WAAqB,EAAE,WAAqB;QAC/D,yIAAyI;QACzI,IAAI,WAAW,CAAC,OAAO,KAAK,WAAW,CAAC,OAAO,EAAE;YAC/C,MAAM,IAAI,KAAK,CAAC,yBAAyB,WAAW,CAAC,OAAO,MAAM,WAAW,CAAC,OAAO,8BAA8B,CAAC,CAAA;SACrH;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QA

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\differentialDownloader\FileWithEmbeddedBlockMapDifferentialDownloader.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1826
Entropy (8bit):	4.909750982280308
Encrypted:	false
SSDEEP:	24:KRyfpvkmCpeDVpqpK79hgAxatU/2cRV2VWllVllo5seyekey8KYFQa5F5:KERQ6jjhg/UVRV2VW7Vl6xtbNb5
MD5:	60C3173A4CF4EF6F145CCB2409C83541
SHA1:	6070C5C6D3D752AA9D3A1702BA2082BB45F24C10
SHA-256:	F27AD5FBE1379D4C33C668CDACCBF80E3693EE52CD55BE748D2382EF4864A0C1
SHA-512:	38E67C9FBA496F63AD107F8AB5868D8B5960FF6DBD93164648CA31CC5372571E73B2C58AC4AB8CE5402F5A2989C7406176BC6C7F4A60588D51CF0865486DAFA7
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.FileWithEmbeddedBlockMapDifferentialDownloader = void 0;.const fs_extra_1 = require("fs-extra");.const DifferentialDownloader_1 = require("./DifferentialDownloader");.const zlib_1 = require("zlib");.class FileWithEmbeddedBlockMapDifferentialDownloader extends DifferentialDownloader_1.DifferentialDownloader {. async download() {. const packageInfo = this.blockAwareFileInfo;. const fileSize = packageInfo.size;. const offset = fileSize - (packageInfo.blockMapSize + 4);. this.fileMetadataBuffer = await this.readRemoteBytes(offset, fileSize - 1);. const newBlockMap = readBlockMap(this.fileMetadataBuffer.slice(0, this.fileMetadataBuffer.length - 4));. await this.doDownload(await readEmbeddedBlockMapData(this.options.oldFile), newBlockMap);. }.}.exports.FileWithEmbeddedBlockMapDifferentialDownloader = FileWithEmbeddedBlockMapDifferentialDownloader;.function read

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\differentialDownloader\FileWithEmbeddedBlockMapDifferentialDownloader.js.map

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3152
Entropy (8bit):	4.971553051553139
Encrypted:	false
SSDEEP:	96:fU/PY3uH7HO7HY6ImLNW9hgDU/+VKfBnId:fU/Pv7HO7HYK0G
MD5:	AC2BA238785521D7CDC297D438DE6058
SHA1:	B71D0DC6B5FE86947102F7B18E5AD7AED457755C
SHA-256:	54D9412C57882C7C26712383B913A2D2A5AA437D410AA3EA979079E9B9651714
SHA-512:	48BFC9279C117B28A6DA91D151792DB337ACEDED2529FA8C2C55989A7C47FAE236BE05C08CD6B1B2594984CD4E5C5469AA7E9BB6B9F217DC045EEE4FE713C800
Malicious:	false
Preview:	{"version":3,"file":"FileWithEmbeddedBlockMapDifferentialDownloader.js","sourceRoot":"","sources":["../../src/differentialDownloader/FileWithEmbeddedBlockMapDifferentialDownloader.ts"],"names":[],"mappings":";;;AACA,uCAAmD;AACnD,qEAAiE;AACjE,+BAAqC;AAErC,MAAa,8CAA+C,SAAQ,+CAAsB;IACxF,KAAK,CAAC,QAAQ;QACZ,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAA;QAC3C,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAK,CAAA;QAClC,MAAM,MAAM,GAAG,QAAQ,GAAG,CAAC,WAAW,CAAC,YAAa,GAAG,CAAC,CAAC,CAAA;QACzD,IAAI,CAAC,kBAAkB,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAA;QAC1E,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAA;QACtG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,CAAA;IAC1F,CAAC;CACF;AATD,wGASC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,CAAC,KAAK,CAAC,qBAAc,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;AACpD,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,IAAY;IAClD,MAAM,EAAE,GAAG,MAAM,eAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IA

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\differentialDownloader\GenericDifferentialDownloader.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	524
Entropy (8bit):	4.780632906257521
Encrypted:	false
SSDEEP:	12:BETNyeBqGS4oBWySo+5hO8vDXy8vbcReBlBaIB5:KRyeQGqBhRucRe/QI3
MD5:	0D71279F638166B9173EE68734728CA8
SHA1:	BCA1D950402C9ABA788DACB0D48FD334110AE98A
SHA-256:	62CA9A1D3CA12DECA41AD902A24D8FEC34EC150CDC194478D5B4FC987A66921B
SHA-512:	BF23EF9DA6D827CD30F37693F45812D13915F0BC35EFA446481797BC00D292356BBF8840F33F8872F3E952EA55607BA3587AC137D9BECEFAC88BB2258E83DE6B
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.GenericDifferentialDownloader = void 0;.const DifferentialDownloader_1 = require("./DifferentialDownloader");.class GenericDifferentialDownloader extends DifferentialDownloader_1.DifferentialDownloader {. download(oldBlockMap, newBlockMap) {. return this.doDownload(oldBlockMap, newBlockMap);. }.}.exports.GenericDifferentialDownloader = GenericDifferentialDownloader;.//# sourceMappingURL=GenericDifferentialDownloader.js.map

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\differentialDownloader\GenericDifferentialDownloader.js.map

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	709
Entropy (8bit):	5.168970508440863
Encrypted:	false
SSDEEP:	12:YWLSybBnxBfiUHDUSpucsb/bXkeR+QH0vTTYWiyShJR6BWySCk8vcJhqwLqy8v7j:YWLSybf9iUjUSUcsb/bUe0RvTMA0GBPF
MD5:	303332526165205D575FD98F439EDA01
SHA1:	1108ABAF5A78D391BA61B0D7E7AAED4AE0DB6481
SHA-256:	37A09DAB5AF73258527D65396A02363F10DF71C1D4C60555B4492EE5C847AADA
SHA-512:	C9163E2E7BAD107D941CBA90BAFAF613D4E45B8F71C039D7A6E9613B7C532AC1D2C4EBE3B8CAADADD7B4DB02C1BEBBCDFA308D41C7426AB0DC3A4C33E03E8E4C
Malicious:	false
Preview:	{"version":3,"file":"GenericDifferentialDownloader.js","sourceRoot":"","sources":["../../src/differentialDownloader/GenericDifferentialDownloader.ts"],"names":[],"mappings":";;;AACA,qEAAiE;AAEjE,MAAa,6BAA8B,SAAQ,+CAAsB;IACvE,QAAQ,CAAC,WAAqB,EAAE,WAAqB;QACnD,OAAO,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,CAAA;IAClD,CAAC;CACF;AAJD,sEAIC","sourcesContent":["import { BlockMap } from \"builder-util-runtime/out/blockMapApi\"\nimport { DifferentialDownloader } from \"./DifferentialDownloader\"\n\nexport class GenericDifferentialDownloader extends DifferentialDownloader {\n download(oldBlockMap: BlockMap, newBlockMap: BlockMap): Promise<any> {\n return this.doDownload(oldBlockMap, newBlockMap)\n }\n}\n"]}

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\differentialDownloader\ProgressDifferentialDownloadCallbackTransform.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3824
Entropy (8bit):	4.624162234508601
Encrypted:	false
SSDEEP:	96:KE1YEQXbfYX4Cf7CUB07K77PColB0di7GtClBFtH4:KWk7YXVfeUBZ77PC0B8iC0lBXY
MD5:	B2F717CF5C64BD87BE0031AB715274A5
SHA1:	9C1DC25E72166FC113EA6D4AA6DD2420B78ED337
SHA-256:	D4B62C2F8EEC10BB8EDCC0227CDE609734EF344BD3E727A48CDB806EA3608EF4
SHA-512:	8154D61A04588F9421C664D6DD2A36867E6D877FDCE9DD73F24ADC650108A4A3FB21EF693A7099AD313B82921DC02264C7B43E90C1C4AC32CD8099B60D29C95C
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.ProgressDifferentialDownloadCallbackTransform = void 0;.const stream_1 = require("stream");.var OperationKind;.(function (OperationKind) {. OperationKind[OperationKind["COPY"] = 0] = "COPY";. OperationKind[OperationKind["DOWNLOAD"] = 1] = "DOWNLOAD";.})(OperationKind \|\| (OperationKind = {}));.class ProgressDifferentialDownloadCallbackTransform extends stream_1.Transform {. constructor(progressDifferentialDownloadInfo, cancellationToken, onProgress) {. super();. this.progressDifferentialDownloadInfo = progressDifferentialDownloadInfo;. this.cancellationToken = cancellationToken;. this.onProgress = onProgress;. this.start = Date.now();. this.transferred = 0;. this.delta = 0;. this.expectedBytes = 0;. this.index = 0;. this.operationType = OperationKind.COPY;. this.nextUpdate = this.start + 1000;. }. _transform(chun

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\differentialDownloader\ProgressDifferentialDownloadCallbackTransform.js.map

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6539
Entropy (8bit):	4.964140381150436
Encrypted:	false
SSDEEP:	192:fREvYdxc4uemBsq7pZT1z8p3DBbJBf6Bai:fREvYdxc43mF7pZxz23pXni
MD5:	242534A6ADB70A9C417AA4DCE55E1865
SHA1:	763C999A3E73AD994E9B5179EFA023B8F723301E
SHA-256:	DBA29C2296F41A84E4B3E4A1C4ED9CF0DA4CAFDBE8E27FA1FF0CCD2B7EFA4046
SHA-512:	D49DFED47E268C41570395143BA28901A2FBF6578EA0E4B2E3A91D876204FE58443E9D8562C83C124C332A5F60E41384B45EEC76B9052392F5BE521E84A8FC3E
Malicious:	false
Preview:	{"version":3,"file":"ProgressDifferentialDownloadCallbackTransform.js","sourceRoot":"","sources":["../../src/differentialDownloader/ProgressDifferentialDownloadCallbackTransform.ts"],"names":[],"mappings":";;;AAAA,mCAAkC;AAGlC,IAAK,aAGJ;AAHD,WAAK,aAAa;IAChB,iDAAI,CAAA;IACJ,yDAAQ,CAAA;AACV,CAAC,EAHI,aAAa,KAAb,aAAa,QAGjB;AAeD,MAAa,6CAA8C,SAAQ,kBAAS;IAU1E,YACmB,gCAAkE,EAClE,iBAAoC,EACpC,UAAuC;QAExD,KAAK,EAAE,CAAA;QAJU,qCAAgC,GAAhC,gCAAgC,CAAkC;QAClE,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,eAAU,GAAV,UAAU,CAA6B;QAZlD,UAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAClB,gBAAW,GAAG,CAAC,CAAA;QACf,UAAK,GAAG,CAAC,CAAA;QACT,kBAAa,GAAG,CAAC,CAAA;QACjB,UAAK,GAAG,CAAC,CAAA;QACT,kBAAa,GAAG,aAAa,CAAC,IAAI,CAAA;QAElC,eAAU,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;IAQtC,CAAC;IAED,UAAU,CAAC,KAAU,EAAE,QAAgB,EAAE,QAAa;QACpD,IAAI,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE;YACpC,QAAQ,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAA;YACtC,OAAM;SACP;QAED,oDAAoD;QACpD,IAAI,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,IAAI,EAAE;YAC5C,QAAQ,CAAC,IAAI,EAAE,KAAK,CAA

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\differentialDownloader\downloadPlanBuilder.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5627
Entropy (8bit):	4.753907996868328
Encrypted:	false
SSDEEP:	96:KEnVYw+8sq4oRilMYwdyq0yiuQInrywW3Gi5E9YBFIjQFePP2Qa:K83+8sPoRilMYwdyq0yiuQwrywW3Gi5n
MD5:	9AE82238ABD4B0F44237360A9749E492
SHA1:	7A9CEE0940D0163506C15EEE178374DD8391B1E8
SHA-256:	0160ADBC49A56759D32F34ADC6CAB048278FFDA903C1462B4976C7ADF8A597E8
SHA-512:	0EF04B344F68B40E315AEA865F81B374B95EFB7179622343A1AC219732B104BF7BB8423FA0DFC5AA8FAA5E48DFD95FB43DA6AFE6A4F6633D5247AE1F3CDEB128
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.computeOperations = exports.OperationKind = void 0;.var OperationKind;.(function (OperationKind) {. OperationKind[OperationKind["COPY"] = 0] = "COPY";. OperationKind[OperationKind["DOWNLOAD"] = 1] = "DOWNLOAD";.})(OperationKind = exports.OperationKind \|\| (exports.OperationKind = {}));.function computeOperations(oldBlockMap, newBlockMap, logger) {. const nameToOldBlocks = buildBlockFileMap(oldBlockMap.files);. const nameToNewBlocks = buildBlockFileMap(newBlockMap.files);. let lastOperation = null;. // for now only one file is supported in block map. const blockMapFile = newBlockMap.files[0];. const operations = [];. const name = blockMapFile.name;. const oldEntry = nameToOldBlocks.get(name);. if (oldEntry == null) {. // new file (unrealistic case for now, because in any case both blockmap contain the only file named as "file"). throw new Error(`no file ${na

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\differentialDownloader\downloadPlanBuilder.js.map

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10134
Entropy (8bit):	5.015701502584596
Encrypted:	false
SSDEEP:	192:fEzr1EzwndZx7sC7bRdJYRsGxxVlwvrb45OjRS6dBQL9FwWucj9bqm0Bc:fEzrdrGOJIDbsrb48jR9rI9FwWucgzc
MD5:	D9EA5E5992380BA6FA2816359D240AA6
SHA1:	C20D75587CF5A112384532CF975FF7ECBB907608
SHA-256:	6DEC1740300F2BA4B7273873A9C3A71D8537D798E13963AA86CF6048A84D507E
SHA-512:	A57F55E1E43AF3F9043340E8F6BD3D4CCEB0F30FFF9A6B7DA0510B122C91A85B7CC32F2C808B23BAEEA4BE9CCF43140859A28B75FAD308E39BC0EF96EC1B48B1
Malicious:	false
Preview:	{"version":3,"file":"downloadPlanBuilder.js","sourceRoot":"","sources":["../../src/differentialDownloader/downloadPlanBuilder.ts"],"names":[],"mappings":";;;AAGA,IAAY,aAGX;AAHD,WAAY,aAAa;IACvB,iDAAI,CAAA;IACJ,yDAAQ,CAAA;AACV,CAAC,EAHW,aAAa,GAAb,qBAAa,KAAb,qBAAa,QAGxB;AAcD,SAAgB,iBAAiB,CAAC,WAAqB,EAAE,WAAqB,EAAE,MAAc;IAC5F,MAAM,eAAe,GAAG,iBAAiB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;IAC5D,MAAM,eAAe,GAAG,iBAAiB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;IAE5D,IAAI,aAAa,GAAqB,IAAI,CAAA;IAE1C,kDAAkD;IAClD,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACzC,MAAM,UAAU,GAAqB,EAAE,CAAA;IACvC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAA;IAC9B,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC1C,IAAI,QAAQ,IAAI,IAAI,EAAE;QACpB,+GAA+G;QAC/G,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,kBAAkB,CAAC,CAAA;KACnD;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAE,CAAA;IAC1C,IAAI,iBAAiB,GAAG,CAAC,CAAA;IAEzB,MAAM,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,GAAG,gBAAgB,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAE1I,

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\differentialDownloader\multipleRangeDownloader.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4942
Entropy (8bit):	4.622944275098296
Encrypted:	false
SSDEEP:	96:KEc0/rCPkuFa69AJpL4j58i2SzJ6miJXHc7PyJ4/7pyjMCfCmFkCwTF1C3MYF+0/:KN0/usus6SJwKi3zJTEXHJJ4z4jMpm7d
MD5:	6F997958C19406BBD219681DC546E865
SHA1:	E1A2A744BC526C47FBB8255C7D2B764DE239ED04
SHA-256:	6D1829ADED9904915F1C33300178372963B8645232EA8D5BEFE9EDE43A56871A
SHA-512:	D60A11D278BA48B5271B5697AE75E9B27DDFC447F3FF40DA31B6F4CBD10D784EAA416E44C31207513DEB132F48FF0897865AE1FBF95FAD24ED29FE3A45FCFFE8
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.checkIsRangesSupported = exports.executeTasksUsingMultipleRangeRequests = void 0;.const builder_util_runtime_1 = require("builder-util-runtime");.const DataSplitter_1 = require("./DataSplitter");.const downloadPlanBuilder_1 = require("./downloadPlanBuilder");.function executeTasksUsingMultipleRangeRequests(differentialDownloader, tasks, out, oldFileFd, reject) {. const w = (taskOffset) => {. if (taskOffset >= tasks.length) {. if (differentialDownloader.fileMetadataBuffer != null) {. out.write(differentialDownloader.fileMetadataBuffer);. }. out.end();. return;. }. const nextOffset = taskOffset + 1000;. doExecuteTasks(differentialDownloader, {. tasks,. start: taskOffset,. end: Math.min(tasks.length, nextOffset),. oldFileFd,. }, out, () => w(nextOffset), reject);.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\differentialDownloader\multipleRangeDownloader.js.map

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8721
Entropy (8bit):	4.960554002156199
Encrypted:	false
SSDEEP:	192:fMEQ30OJNdBb3q/4emxnIZ3Jx+nptJ02ZHn8Qh:fMEOJNrb3qCIron102ZHX
MD5:	6CB52E92CC375973091C95467262F06F
SHA1:	70B10A437BB6FF33766E84CE5409DF996BF84521
SHA-256:	D0EC4F12427F91F5D258D7D90B9301A2DD96EA0AB2ACFB9280849DF4EDD881B2
SHA-512:	EDC736C5F4873D997855736976FF8E273AA51CAE812CC67E8E9945648272B75F25989E79512D35B0631B23AA90C7270A9FF1B431F95E563A1C69389F9C96F7C0
Malicious:	false
Preview:	{"version":3,"file":"multipleRangeDownloader.js","sourceRoot":"","sources":["../../src/differentialDownloader/multipleRangeDownloader.ts"],"names":[],"mappings":";;;AAAA,+DAAqE;AAGrE,iDAAyE;AAEzE,+DAAgE;AAEhE,SAAgB,sCAAsC,CACpD,sBAA8C,EAC9C,KAAuB,EACvB,GAAa,EACb,SAAiB,EACjB,MAA8B;IAE9B,MAAM,CAAC,GAAG,CAAC,UAAkB,EAAQ,EAAE;QACrC,IAAI,UAAU,IAAI,KAAK,CAAC,MAAM,EAAE;YAC9B,IAAI,sBAAsB,CAAC,kBAAkB,IAAI,IAAI,EAAE;gBACrD,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,CAAA;aACrD;YACD,GAAG,CAAC,GAAG,EAAE,CAAA;YACT,OAAM;SACP;QAED,MAAM,UAAU,GAAG,UAAU,GAAG,IAAI,CAAA;QACpC,cAAc,CACZ,sBAAsB,EACtB;YACE,KAAK;YACL,KAAK,EAAE,UAAU;YACjB,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC;YACvC,SAAS;SACV,EACD,GAAG,EACH,GAAG,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,EACnB,MAAM,CACP,CAAA;IACH,CAAC,CAAA;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AA/BD,wFA+BC;AAED,SAAS,cAAc,CAAC,sBAA8C,EAAE,OAAyB,EAAE,GAAa,EAAE,OAAmB,EAAE,MAA8B;IACnK,IAAI,MAAM,GAAG,QAAQ,CAAA;IACrB,IAAI,SAAS,GAAG,CAAC,CAAA;IACjB,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAkB,CAA

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\electronHttpExecutor.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3272
Entropy (8bit):	4.472588024638555
Encrypted:	false
SSDEEP:	48:KE8SvWSEAmO6S+DROEjjva/eeDZAjEKr/VO2dAFPZWWRk6/oBbHWBYLv0VERU:KE5OOWNOEfbeyRDVOOo7G6/oBbj7i4U
MD5:	264C61860AA802EE15694BAD31BA84B8
SHA1:	69CA26BDDE083D94EC847802330A00FF71A0050D
SHA-256:	EC9A54DFC223B13272C393D6704319575E0D06516C8506629FDE9812CCE1B156
SHA-512:	94AE805845AC1CE21AB3A39F310A12E2B99C2A0B1260867588613A1CC4CE90EAB38FAF897A428B32B77A07CB56B12345D4B9319DC3C735386E88578B5963708F
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.ElectronHttpExecutor = exports.getNetSession = exports.NET_SESSION_NAME = void 0;.const builder_util_runtime_1 = require("builder-util-runtime");.exports.NET_SESSION_NAME = "electron-updater";.function getNetSession() {. return require("electron").session.fromPartition(exports.NET_SESSION_NAME, {. cache: false,. });.}.exports.getNetSession = getNetSession;.class ElectronHttpExecutor extends builder_util_runtime_1.HttpExecutor {. constructor(proxyLoginCallback) {. super();. this.proxyLoginCallback = proxyLoginCallback;. this.cachedSession = null;. }. async download(url, destination, options) {. return await options.cancellationToken.createPromise((resolve, reject, onCancel) => {. const requestOptions = {. headers: options.headers \|\| undefined,. redirect: "manual",. };. builder_util_runtime_1.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\electronHttpExecutor.js.map

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5399
Entropy (8bit):	5.010230530692549
Encrypted:	false
SSDEEP:	96:fLjOLXWeMhI0Uj34D3Fp3liDSvT240HQ6vTqdaFU7iIeng7yTiHLzQZTVBi9F:fuLXHzsz+bOAuq0QZ52F
MD5:	580E41628892712F07AD4368B8F724D2
SHA1:	2C8FCBBC31918CCD329974B183091AB4B2434A70
SHA-256:	AD1BCAFBA43A8A4C4D129C9718EEF999B856E3446E809AF6D70F09D0C2094C23
SHA-512:	E059DE19E7CFF517DEF99BFF7C2C154E6BD1A772DDEF3802D3FEDB4C75798AB830F856C9AF81A0B832974897BE126D5079BF50F3BAE76A386A8CB5DF9E2FEE44
Malicious:	false
Preview:	{"version":3,"file":"electronHttpExecutor.js","sourceRoot":"","sources":["../src/electronHttpExecutor.ts"],"names":[],"mappings":";;;AAAA,+DAAkH;AAMrG,QAAA,gBAAgB,GAAG,kBAAkB,CAAA;AAElD,SAAgB,aAAa;IAC3B,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,wBAAgB,EAAE;QACjE,KAAK,EAAE,KAAK;KACb,CAAC,CAAA;AACJ,CAAC;AAJD,sCAIC;AAED,MAAa,oBAAqB,SAAQ,mCAAoC;IAG5E,YAA6B,kBAAqE;QAChG,KAAK,EAAE,CAAA;QADoB,uBAAkB,GAAlB,kBAAkB,CAAmD;QAF1F,kBAAa,GAAmB,IAAI,CAAA;IAI5C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAQ,EAAE,WAAmB,EAAE,OAAwB;QACpE,OAAO,MAAM,OAAO,CAAC,iBAAiB,CAAC,aAAa,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE;YACzF,MAAM,cAAc,GAAG;gBACrB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,SAAS;gBACrC,QAAQ,EAAE,QAAQ;aACnB,CAAA;YACD,0CAAmB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;YACxC,8CAAuB,CAAC,cAAc,CAAC,CAAA;YACvC,IAAI,CAAC,UAAU,CACb,cAAc,EACd;gBACE,WAAW;gBACX,OAAO;gBACP,QAAQ;gBACR,QAAQ,EAAE,KAAK,CAAC,EAAE;oBAChB,IAAI,KAAK,IAAI,IAAI,EAAE;wBACjB,OAAO,CAAC,WAAW,CAAC,CAAA;qBACrB;yBAAM;wBACL,MAAM,CAAC,KAAK,CAAC,CAAA;qBACd;gBACH,CAAC;gB

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\event.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1280
Entropy (8bit):	4.9401131814383925
Encrypted:	false
SSDEEP:	24:KRygYPSH49XYRn4xcFrf0R6v6/tVKa/zFVXxwag3VX5aNQVgXccRTRVyhrec:KEhSH49q4xYfFv6/tlrF5xtg35ANQ2rk
MD5:	86DC7400D1A38C9914A08BCF02DECDA8
SHA1:	A4746BED246F04D293269CB4F702E687256FC8D7
SHA-256:	618EDE1CAFCFF3F941663B868CDF572BE4E6F2384F650B462E5F1D31463B4759
SHA-512:	0AA58D0E052EF42A03C4072A7CEB4BB6748CA3B58960CFD873DBD2823629BF236E7497FA1AF52516693849091BC27B75070E4B2963B3BF0878ADBF102740A69F
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.UpdaterSignal = exports.UPDATE_DOWNLOADED = exports.DOWNLOAD_PROGRESS = void 0;.exports.DOWNLOAD_PROGRESS = "download-progress";.exports.UPDATE_DOWNLOADED = "update-downloaded";.class UpdaterSignal {. constructor(emitter) {. this.emitter = emitter;. }. /*. Emitted when an authenticating proxy is [asking for user credentials](https://github.com/electron/electron/blob/master/docs/api/client-request.md#event-login).. */. login(handler) {. addHandler(this.emitter, "login", handler);. }. progress(handler) {. addHandler(this.emitter, exports.DOWNLOAD_PROGRESS, handler);. }. updateDownloaded(handler) {. addHandler(this.emitter, exports.UPDATE_DOWNLOADED, handler);. }. updateCancelled(handler) {. addHandler(this.emitter, "update-cancelled", handler);. }.}.exports.UpdaterSignal = UpdaterSignal;.const isLogEvent = false;.function addH

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\event.js.map

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3256
Entropy (8bit):	5.199909581412105
Encrypted:	false
SSDEEP:	96:fja63qs6AKekdy2PtfkH9fDfCwYfFM9ryIpNNtfFuBBauyKB:fdmAKd2oNMA6uuux
MD5:	D70452C8C25612958B4372F24340B655
SHA1:	B09D61BB6A501BDAA99BF71BE455FCD7FDBDA83F
SHA-256:	E82EE81C28D7F5BA617422BC6A755D3E32B4448664C1424EA541FA9910ACFEEF
SHA-512:	E531B72554FE4994293860B8AEC0B8C8759A194047A5B912123B7E924112B2AA724F1B06229DC16A9A74EB0681C58CCC1A760FBBF5159D21511C19D93A8FE547
Malicious:	false
Preview:	{"version":3,"file":"event.js","sourceRoot":"","sources":["../src/event.ts"],"names":[],"mappings":";;;AAOa,QAAA,iBAAiB,GAAkB,mBAAmB,CAAA;AACtD,QAAA,iBAAiB,GAAkB,mBAAmB,CAAA;AAInE,MAAa,aAAa;IACxB,YAAoB,OAAqB;QAArB,YAAO,GAAP,OAAO,CAAc;IAAG,CAAC;IAE7C;;OAEG;IACH,KAAK,CAAC,OAAqB;QACzB,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IAC5C,CAAC;IAED,QAAQ,CAAC,OAAqC;QAC5C,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,yBAAiB,EAAE,OAAO,CAAC,CAAA;IACtD,CAAC;IAED,gBAAgB,CAAC,OAA8C;QAC7D,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,yBAAiB,EAAE,OAAO,CAAC,CAAA;IACtD,CAAC;IAED,eAAe,CAAC,OAAmC;QACjD,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAA;IACvD,CAAC;CACF;AArBD,sCAqBC;AAED,MAAM,UAAU,GAAG,KAAK,CAAA;AAExB,SAAS,UAAU,CAAC,OAAqB,EAAE,KAAoB,EAAE,OAAsC;IACrG,IAAI,UAAU,EAAE;QACd,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,IAAgB,EAAE,EAAE;YACxC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;YACjC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAA;QAClB,CAAC,CAAC,CAAA;KACH;SAAM;QACL,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;KAC3B;A

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\log.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	522
Entropy (8bit):	4.680525880253631
Encrypted:	false
SSDEEP:	12:BETNy6DCHqlvusLzNWjibtiilvusLzNWhgtiilvusLzNW54t0cRevA3:KRyWCdsfEjCUFsfEhgUFsfEK+cR/3
MD5:	92E25740EFE184901EB2F0B376FBE963
SHA1:	C7204BAFBF2423299D632E810804B998E48AE969
SHA-256:	DBA03B9D69E56A9BB736F922F64DFEB2D5A386C87B859F00F5B14369E44FF952
SHA-512:	7BB9A18CC5191640357F151F101A0C23B864A5BEC32DB650FC077BB3250B9B4FDE33DCD975463A798F19F5A2DAA68F979B6DCC0713F2AAC13DF619158ADF7236
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.NoOpLogger = void 0;.class NoOpLogger {. // eslint-disable-next-line @typescript-eslint/no-unused-vars. info(message) {. // ignore. }. // eslint-disable-next-line @typescript-eslint/no-unused-vars. warn(message) {. // ignore. }. // eslint-disable-next-line @typescript-eslint/no-unused-vars. error(message) {. // ignore. }.}.exports.NoOpLogger = NoOpLogger;.//# sourceMappingURL=log.js.map

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\log.js.map

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	858
Entropy (8bit):	5.15095962054084
Encrypted:	false
SSDEEP:	24:YWLSyYUKRLsLOEeA2mrxQFO0SF8FEXEZHGzsfExmwksfEfswksfET:YWL/72maeW6UZTsfkfU
MD5:	3A445D25EFA30863C3C1714FE3521E30
SHA1:	29D9A4FB2E0AACB0DC8DFC9182F702BCB644ED96
SHA-256:	CCF99DD56F3CBC10D778F46ADF7F2A72AE8745D4A4134A796F057F17399277CA
SHA-512:	D6FACF364FCE8C54540C78EC98D847FC87E9E9A969A5E971056160D3941856BE6D56D9ABA448E98B14C0C82C6E0655C0462AF1B70762F607FF5543F7F7319900
Malicious:	false
Preview:	{"version":3,"file":"log.js","sourceRoot":"","sources":["../src/log.ts"],"names":[],"mappings":";;;AAUA,MAAa,UAAU;IACrB,6DAA6D;IAC7D,IAAI,CAAC,OAAa;QAChB,SAAS;IACX,CAAC;IAED,6DAA6D;IAC7D,IAAI,CAAC,OAAa;QAChB,SAAS;IACX,CAAC;IAED,6DAA6D;IAC7D,KAAK,CAAC,OAAa;QACjB,SAAS;IACX,CAAC;CACF;AAfD,gCAeC","sourcesContent":["export interface Logger {\n info(message?: any): void\n\n warn(message?: any): void\n\n error(message?: any): void\n\n debug?(message: string): void\n}\n\nexport class NoOpLogger implements Logger {\n // eslint-disable-next-line @typescript-eslint/no-unused-vars\n info(message?: any) {\n // ignore\n }\n\n // eslint-disable-next-line @typescript-eslint/no-unused-vars\n warn(message?: any) {\n // ignore\n }\n\n // eslint-disable-next-line @typescript-eslint/no-unused-vars\n error(message?: any) {\n // ignore\n }\n}\n"]}

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\main.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3288
Entropy (8bit):	4.991131234817572
Encrypted:	false
SSDEEP:	96:KE4zFqsHU2WHUhEH60Pi+Hg2p2NHP2aHB2kHad2/7MQR3y9QmfxYfFyf7gqDFWW:KNFqs02W0ma0Pi+A2p2Nv2ah2k6d2/7i
MD5:	437E9882B526B0F9A597334CE6A5696F
SHA1:	DD78D4473D0E3481FA42DE5CEC30F92700AD451B
SHA-256:	15AF6F8C4AFB5AE96823116AFAA9F367176E6EDA40DE6C37A699BC2F9334FE13
SHA-512:	B323730631D7CF34B7B4F49B0B360824DCC1180F247BFEB07CAF00E67198CE82084BC07C55891FCDE48C6DEFAD6DB89D600551E5D7875CA82B1B903F5FCB75B7
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.UpdaterSignal = exports.UPDATE_DOWNLOADED = exports.DOWNLOAD_PROGRESS = exports.NsisUpdater = exports.MacUpdater = exports.AppImageUpdater = exports.Provider = exports.CancellationToken = exports.NoOpLogger = exports.AppUpdater = void 0;.const builder_util_runtime_1 = require("builder-util-runtime");.Object.defineProperty(exports, "CancellationToken", { enumerable: true, get: function () { return builder_util_runtime_1.CancellationToken; } });.var AppUpdater_1 = require("./AppUpdater");.Object.defineProperty(exports, "AppUpdater", { enumerable: true, get: function () { return AppUpdater_1.AppUpdater; } });.Object.defineProperty(exports, "NoOpLogger", { enumerable: true, get: function () { return AppUpdater_1.NoOpLogger; } });.var Provider_1 = require("./providers/Provider");.Object.defineProperty(exports, "Provider", { enumerable: true, get: function () { return Provider_1.Provider; } });.var AppImageU

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\main.js.map

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5342
Entropy (8bit):	5.181208471862106
Encrypted:	false
SSDEEP:	96:f5hBjEJhYWX36X3XaSna63qs6YKekdy2PtfkH9xXDtC6kLq8kuavBBBauIpNNtf7:f5njghJWmYKd21v2kuavBuu6+NMR3N
MD5:	74F8875871A660351D383BC6B98EDBF9
SHA1:	7701667F483875BC04E604287AEB1DE1A32F7CC9
SHA-256:	1A68CE072FC19D87B2E66ADBF7C786CE2C2B1FECF0112D167BB57BE9C5E4FE35
SHA-512:	3FE42B9CE89CCA368116A3BB20A5B3F46E4C381990FD470E382F89343C57157E01AB703C7335EDBBBB24296C5B10BD95C6A4F46BF636B70EEAA371E98C6AD65A
Malicious:	false
Preview:	{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";;;AAAA,+DAAmH;AAO1G,kGAPA,wCAAiB,OAOA;AAD1B,2CAAqD;AAA5C,wGAAA,UAAU,OAAA;AAAE,wGAAA,UAAU,OAAA;AAE/B,iDAA+C;AAAtC,oGAAA,QAAQ,OAAA;AACjB,qDAAmD;AAA1C,kHAAA,eAAe,OAAA;AACxB,2CAAyC;AAAhC,wGAAA,UAAU,OAAA;AACnB,6CAA2C;AAAlC,0GAAA,WAAW,OAAA;AAEpB,oDAAoD;AACpD,IAAI,YAAiB,CAAA;AAKrB,SAAS,iBAAiB;IACxB,+CAA+C;IAC/C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE;QAChC,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,WAAW,CAAC,EAAE,CAAA;KAC5D;SAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE;QACxC,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,UAAU,CAAC,EAAE,CAAA;KAC1D;SAAM;QACL,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,eAAe,CAAC,EAAE,CAAA;KACpE;IACD,OAAO,YAAY,CAAA;AACrB,CAAC;AAED,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,aAAa,EAAE;IAC5C,UAAU,EAAE,IAAI;IAChB,GAAG,EAAE,GAAG,EAAE;QACR,OAAO,YAAY,IAAI,iBAAiB,EAAE,CAAA;IAC5C,CAAC;CACF,CAAC,CAAA;AAsBW,QAAA,iBAAiB,GAAkB,mBAAmB,CAAA;AACtD,QAAA,iBAAiB,GAAkB,mBAAmB,CAAA;AAInE,MAAa,aAAa;IACxB,YAA

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\providerFactory.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.85136789262167
Encrypted:	false
SSDEEP:	48:KEwY684uTc/TCQGo0RK3oLG8VTCoJuVMp8zLqRG8WyuZBIOO8/VRDVZBz4KuopVs:KEB6fuTc/TCpooK3V8VTCoJuVMp8zmRb
MD5:	C69786BFBAEC252123EB338AB16E307E
SHA1:	1800FDA2F243AF15B3938DE1DB68AC23A4EB3BDA
SHA-256:	B8C1238DF17F956E29018CF93A51181F5CA6302B650F28235FB9A768432A8A73
SHA-512:	944BEB512DE8E625207FCCD5D218B12580FAB1E2C97E7EE5203FA22EB3BB0DA6F18FA436E6C49C8F16126F9BD10CE15DE70EA15DC65054C6407985324D1E8511
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.createClient = exports.isUrlProbablySupportMultiRangeRequests = void 0;.const builder_util_runtime_1 = require("builder-util-runtime");.const BintrayProvider_1 = require("./providers/BintrayProvider");.const GenericProvider_1 = require("./providers/GenericProvider");.const GitHubProvider_1 = require("./providers/GitHubProvider");.const PrivateGitHubProvider_1 = require("./providers/PrivateGitHubProvider");.function isUrlProbablySupportMultiRangeRequests(url) {. return !url.includes("s3.amazonaws.com");.}.exports.isUrlProbablySupportMultiRangeRequests = isUrlProbablySupportMultiRangeRequests;.function createClient(data, updater, runtimeOptions) {. // noinspection SuspiciousTypeOfGuard. if (typeof data === "string") {. throw builder_util_runtime_1.newError("Please pass PublishConfiguration object", "ERR_UPDATER_INVALID_PROVIDER_CONFIGURATION");. }. const provider = data.provider;.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\providerFactory.js.map

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4130
Entropy (8bit):	5.158440108191338
Encrypted:	false
SSDEEP:	96:f6cEhwZnHfHbQ11byZ3cC1DCNvCVSC0kuA6/tHuXymnFuYI8N8ndEbhn4Kml8DAD:f6zwdARyW2DKv4SvkuFlHInFuYI8N8nJ
MD5:	AFF098C16426A8FC359F17D9405E736C
SHA1:	46BF46AF4DF9C576367F56805471DDA70C1E825C
SHA-256:	D335197D1B24BCF0C1913EF710B9FDC68526EE10CFEDE1CD5DF919B4E44ED990
SHA-512:	A15710A46EAF76D4F60A5D3E412AFD925192F0D4AAB2103B7A4355E4DE63DA09A4198AD2CD4C61553E7F14CBDA01CD28FEA16E4CA22C5F4EDB6F8008A96F132E
Malicious:	false
Preview:	{"version":3,"file":"providerFactory.js","sourceRoot":"","sources":["../src/providerFactory.ts"],"names":[],"mappings":";;;AAAA,+DAS6B;AAE7B,iEAA6D;AAC7D,iEAA6D;AAC7D,+DAA2D;AAC3D,6EAAyE;AAGzE,SAAgB,sCAAsC,CAAC,GAAW;IAChE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;AAC1C,CAAC;AAFD,wFAEC;AAED,SAAgB,YAAY,CAAC,IAA8C,EAAE,OAAmB,EAAE,cAAsC;IACtI,qCAAqC;IACrC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE;QAC5B,MAAM,+BAAQ,CAAC,yCAAyC,EAAE,4CAA4C,CAAC,CAAA;KACxG;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAA;IAC9B,QAAQ,QAAQ,EAAE;QAChB,KAAK,QAAQ,CAAC,CAAC;YACb,MAAM,aAAa,GAAG,IAAqB,CAAA;YAC3C,MAAM,KAAK,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,KAAK,CAAA;YACtH,IAAI,KAAK,IAAI,IAAI,EAAE;gBACjB,OAAO,IAAI,+BAAc,CAAC,aAAa,EAAE,OAAO,EAAE,cAAc,CAAC,CAAA;aAClE;iBAAM;gBACL,OAAO,IAAI,6CAAqB,CAAC,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,CAAC,CAAA;aAChF;SACF;QAED,KAAK,IAAI,CAAC;QACV,KAAK,QAAQ;YACX,OAAO,IAAI,iCAAe,CACxB;gBACE,QAAQ,EAAE,SAAS;gB

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\providers\BintrayProvider.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2433
Entropy (8bit):	4.927144189323181
Encrypted:	false
SSDEEP:	48:KEyqsnz1r20N9TkM4F7mCmBpN1R1VebapSQO6j4FkgEEim9rnlmiQpVPRycI6:KEyqUz1r2gYF7OpNz1Veba3aFkqim9rK
MD5:	446E90B9EE99FE4419FBEBFD08127DDC
SHA1:	7EA25C52BC9759A8C7CFF751BA4ECF7BFE402C9A
SHA-256:	A3EC1E62C758719AF4B9F7F997AB2E488542A84BD575CFED57520629EEB9CC41
SHA-512:	FCA3DBD0D931C85EA216047546097C1C9DCA203CEEBDD79709FB41D6BDAD6C4E865C06331ABDCA87AC93684CDA1186B8B35E2B0E8C0E8024488B1BFA3B529B7C
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.BintrayProvider = void 0;.const builder_util_runtime_1 = require("builder-util-runtime");.const bintray_1 = require("builder-util-runtime/out/bintray");.const url_1 = require("url");.const util_1 = require("../util");.const Provider_1 = require("./Provider");.class BintrayProvider extends Provider_1.Provider {. constructor(configuration, runtimeOptions) {. super(runtimeOptions);. this.client = new bintray_1.BintrayClient(configuration, runtimeOptions.executor, new builder_util_runtime_1.CancellationToken());. this.baseUrl = util_1.newBaseUrl(`https://dl.bintray.com/${this.client.owner}/${this.client.repo}`);. }. setRequestHeaders(value) {. super.setRequestHeaders(value);. this.client.setRequestHeaders(value);. }. async getLatestVersion() {. try {. const data = await this.client.getVersion("_latest");. const channelFilename =

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\providers\BintrayProvider.js.map

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4311
Entropy (8bit):	5.077336246109306
Encrypted:	false
SSDEEP:	96:fZwOBIdKg1+jnSl/5KIJBuw4Brr7d6FT3cLhi1a+FLtiARtN:fZw/Kg8oBuBrr7d6FQJ+FRiaT
MD5:	254C7EC6D062B37E88D03B2509437A5D
SHA1:	6E03CAE814DA3957D9E17AA8005448CDF52D728C
SHA-256:	C506F6AA5BC0B6FD8DD2DD8E988DC63477D1C95E0259F85866F80CCA242FA8FE
SHA-512:	7403CF72F8F1D3E02DBD4D0DF41E53D37E3F399F8C16DA390A8965FB0F250B28C19FBE8D5058088DB4AE4B847DD5D2C84111EB728F8B97C2159EE2679ACD8D97
Malicious:	false
Preview:	{"version":3,"file":"BintrayProvider.js","sourceRoot":"","sources":["../../src/providers/BintrayProvider.ts"],"names":[],"mappings":";;;AAAA,+DAA8F;AAC9F,8DAAgE;AAChE,6BAAyB;AAEzB,kCAAwD;AACxD,yCAA4F;AAE5F,MAAa,eAAgB,SAAQ,mBAAoB;IAIvD,YAAY,aAA6B,EAAE,cAAsC;QAC/E,KAAK,CAAC,cAAc,CAAC,CAAA;QAErB,IAAI,CAAC,MAAM,GAAG,IAAI,uBAAa,CAAC,aAAa,EAAE,cAAc,CAAC,QAAQ,EAAE,IAAI,wCAAiB,EAAE,CAAC,CAAA;QAChG,IAAI,CAAC,OAAO,GAAG,iBAAU,CAAC,0BAA0B,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IAC9F,CAAC;IAED,iBAAiB,CAAC,KAAU;QAC1B,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAA;QAC9B,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAA;IACtC,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,IAAI;YACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;YACpD,MAAM,eAAe,GAAG,yBAAkB,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAA;YACxE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC1D,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,eAAe,EAAE,CAAC

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\providers\GenericProvider.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2222
Entropy (8bit):	4.435776944392572
Encrypted:	false
SSDEEP:	48:KEWYzNr20CIQvyT4WqagEEiZGGbf81VQAzbonSmyiQpVPRW0Q6:KEWYzNr2FzvPW1qiZF81VfXonSmyiQpn
MD5:	6D3048CF4B07A6087FC227DF3DE40375
SHA1:	6000E815EECEC9CB701F9F8AC2D9E45FD4941010
SHA-256:	B197AFEA3371DAE9B511FD54529F4B54C689065B5AEB9DE4B70C32911D4C2F14
SHA-512:	4C4DDDFCC20278A98593805E5BAA0F35F57C8EF903A646429DD884AAF673039AC0A9C8F658B22F8DDF925DE9D9C481F9AC0D5DC7EDA5E7A803B8F482051633E9
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.GenericProvider = void 0;.const builder_util_runtime_1 = require("builder-util-runtime");.const util_1 = require("../util");.const Provider_1 = require("./Provider");.class GenericProvider extends Provider_1.Provider {. constructor(configuration, updater, runtimeOptions) {. super(runtimeOptions);. this.configuration = configuration;. this.updater = updater;. this.baseUrl = util_1.newBaseUrl(this.configuration.url);. }. get channel() {. const result = this.updater.channel \|\| this.configuration.channel;. return result == null ? this.getDefaultChannelName() : this.getCustomChannelName(result);. }. async getLatestVersion() {. const channelFile = util_1.getChannelFilename(this.channel);. const channelUrl = util_1.newUrlFromBase(channelFile, this.baseUrl, this.updater.isAddNoCacheQuery);. for (let attemptNumber = 0;; attemptNumber+

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\providers\GenericProvider.js.map

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3633
Entropy (8bit):	5.022340865399084
Encrypted:	false
SSDEEP:	96:fxonO5nLJo3QkK8I+uE1+2/snB1lG2JBuw4BvrRdkaVti0m1VOr:fxonoixKF+u5JvBuBvrRdkGi09
MD5:	2E0D1F4F4CEE6670C549C27B33ACE037
SHA1:	FA2AC640B7B35C151D494FD96EB99CAD2B1E2528
SHA-256:	E8E89F40C703CDE202539A9430D528F972E034A78E6CF9E8B263308FF8EDA67B
SHA-512:	AE0FEA3042F29943821CC12AD8560511D2FC1B7E6D9AD5FB11B4D2C7DCDDC1E1C033FF907CB03FC59E54F8BA816057698645382D0DF7FB701A751633866FB661
Malicious:	false
Preview:	{"version":3,"file":"GenericProvider.js","sourceRoot":"","sources":["../../src/providers/GenericProvider.ts"],"names":[],"mappings":";;;AAAA,+DAA4F;AAG5F,kCAAwE;AACxE,yCAA4F;AAE5F,MAAa,eAAgB,SAAQ,mBAAoB;IAGvD,YAA6B,aAAmC,EAAmB,OAAmB,EAAE,cAAsC;QAC5I,KAAK,CAAC,cAAc,CAAC,CAAA;QADM,kBAAa,GAAb,aAAa,CAAsB;QAAmB,YAAO,GAAP,OAAO,CAAY;QAFrF,YAAO,GAAG,iBAAU,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;IAI7D,CAAC;IAED,IAAY,OAAO;QACjB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,aAAa,CAAC,OAAO,CAAA;QACjE,OAAO,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAC1F,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,MAAM,WAAW,GAAG,yBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACpD,MAAM,UAAU,GAAG,qBAAc,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAA;QAC5F,KAAK,IAAI,aAAa,GAAG,CAAC,GAAI,aAAa,EAAE,EAAE;YAC7C,IAAI;gBACF,OAAO,0BAAe,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,CAAA;aACpF;YAAC,OAAO,CAAC,EAAE;gBACV,IAAI,CAAC,YAAY,gC

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\providers\GitHubProvider.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7056
Entropy (8bit):	4.816163902280506
Encrypted:	false
SSDEEP:	192:KSQGzxr2DeX6LA5RHOAR91o/BBSCyShOzmeCqC1uK5l30ciAsQX+vz2MPwr/UiQ9:fv2/kA0O/Yh
MD5:	8094B562C2FDB3CBAC774EFCF091BA1A
SHA1:	B95244244183FE99CFC1D5D3F5911CA3F5438080
SHA-256:	EFCF4B3699014C1915F314F286B26352F6D43B62041C5629A062C3C8FD4BE084
SHA-512:	DDB31488517DF1119BE8AD49CD7B8E60437838292AA4E268D3A2E9EB7AFA79245586402BCD108B887BFB7AA04DB364E2793C4ABEDDF469ABB3E6D9B39B75903B
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.computeReleaseNotes = exports.GitHubProvider = exports.BaseGitHubProvider = void 0;.const builder_util_runtime_1 = require("builder-util-runtime");.const semver = require("semver");.const url_1 = require("url");.const util_1 = require("../util");.const Provider_1 = require("./Provider");.const hrefRegExp = /\/tag\/v?([^/]+)$/;.class BaseGitHubProvider extends Provider_1.Provider {. constructor(options, defaultHost, runtimeOptions) {. super({. ...runtimeOptions,. /* because GitHib uses S3 */. isUseMultipleRangeRequest: false,. });. this.options = options;. this.baseUrl = util_1.newBaseUrl(builder_util_runtime_1.githubUrl(options, defaultHost));. const apiHost = defaultHost === "github.com" ? "api.github.com" : defaultHost;. this.baseApiUrl = util_1.newBaseUrl(builder_util_runtime_1.githubUrl(options, apiHost));. }. compu

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\providers\GitHubProvider.js.map

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	12596
Entropy (8bit):	5.0672345082240335
Encrypted:	false
SSDEEP:	192:fZKp9ma7SQ2adEp5Lwyw3BuBLUXAMdE9a5k2d0YuobnDYWmuqO1ntt4Dv98d:f49maVfe/+NnDGZI4DvO
MD5:	E8FDAF4C0231BA9320F42AB268FEA75F
SHA1:	6A65DCAFD451EB751203FA7BEAB86BD5A97501C9
SHA-256:	62118E94EE12DBED5EAB3C377E7DCBA58B815B7EF82AD61B3DE2F47847BBA053
SHA-512:	286E5EA71B47AFDFDF0D07A60A0150301413BB4B389A660684A2829F96B1F65C03B39F7C86321C0DC473FBC07D25BA37DEF647399B32952C3B221D0831CC75CE
Malicious:	false
Preview:	{"version":3,"file":"GitHubProvider.js","sourceRoot":"","sources":["../../src/providers/GitHubProvider.ts"],"names":[],"mappings":";;;AAAA,+DAAwJ;AACxJ,iCAAgC;AAChC,6BAAyB;AAGzB,kCAAwE;AACxE,yCAA4F;AAE5F,MAAM,UAAU,GAAG,mBAAmB,CAAA;AAEtC,MAAsB,kBAAyC,SAAQ,mBAAW;IAKhF,YAAyC,OAAsB,EAAE,WAAmB,EAAE,cAAsC;QAC1H,KAAK,CAAC;YACJ,GAAG,cAAc;YACjB,4BAA4B;YAC5B,yBAAyB,EAAE,KAAK;SACjC,CAAC,CAAA;QALqC,YAAO,GAAP,OAAO,CAAe;QAO7D,IAAI,CAAC,OAAO,GAAG,iBAAU,CAAC,gCAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAA;QAC1D,MAAM,OAAO,GAAG,WAAW,KAAK,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,WAAW,CAAA;QAC7E,IAAI,CAAC,UAAU,GAAG,iBAAU,CAAC,gCAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAA;IAC3D,CAAC;IAES,qBAAqB,CAAC,MAAc;QAC5C,2FAA2F;QAC3F,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAA;QAC9B,OAAO,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,UAAU,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAA;IACzG,CAAC;CACF;AAtBD,gDAsBC;AAED,MAAa,cAAe,SAAQ,kBAA8B;IAChE,YAA+B,OAAsB,EAAmB,OAAmB,EAAE,cAAsC;QACjI,KAAK,CAAC,OAAO,EAAE,YAAY,EAA

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\providers\PrivateGitHubProvider.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4193
Entropy (8bit):	4.768573134586913
Encrypted:	false
SSDEEP:	96:KErjsJirz0ck2tO1vslQ1L59EFM16mv/lik8H/zyS1liLOdQpVCuo1O1+krBd6:KYjskrz0ck2tevsq9E3mnlik8H/zyci0
MD5:	13E3BB12D695E1C0CC866DFA8D5F839A
SHA1:	DD5AF608A1BDA0446533ECD99509C097DD716841
SHA-256:	C13547D2DE69256B523E235E5306146FAD99A5034AA982DA030D24FEBB6B364B
SHA-512:	870A672102B183214FB56CC4F67C4A0DF6C5208DEB790DA66C13989594FCB80A935FCEABCB85EA9490DDBC996DEF825550B1C47EAABA4B2459B449EB9624E2DF
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.PrivateGitHubProvider = void 0;.const builder_util_runtime_1 = require("builder-util-runtime");.const js_yaml_1 = require("js-yaml");.const path = require("path");.const url_1 = require("url");.const util_1 = require("../util");.const GitHubProvider_1 = require("./GitHubProvider");.const Provider_1 = require("./Provider");.class PrivateGitHubProvider extends GitHubProvider_1.BaseGitHubProvider {. constructor(options, updater, token, runtimeOptions) {. super(options, "api.github.com", runtimeOptions);. this.updater = updater;. this.token = token;. }. createRequestOptions(url, headers) {. const result = super.createRequestOptions(url, headers);. result.redirect = "manual";. return result;. }. async getLatestVersion() {. const cancellationToken = new builder_util_runtime_1.CancellationToken();. const channelFile = util_1.getChannelFile

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\providers\PrivateGitHubProvider.js.map

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7702
Entropy (8bit):	5.093689526346731
Encrypted:	false
SSDEEP:	192:fYFI6WFK72olcndXfja+6Z58Dd3v12UMHvFQx0h:fDa7Mi+vbsFQx0h
MD5:	73AB7552B72DFA3AA8E4CF7DF54758D3
SHA1:	0FE5FF9E14AB19662CEFDA0579A8813379FD6DA7
SHA-256:	ED646EF419AAE3D846F638B5698E3C6246F2C9C0C041365F356B558338374776
SHA-512:	9150A146EC4C107B89A0BE522C957ABC051B28AADF959656CDEEB6F12300FD215114342D02567F6DF327DE5948D00EF6E483904CE29FDCAE8E4F3877E5877FFB
Malicious:	false
Preview:	{"version":3,"file":"PrivateGitHubProvider.js","sourceRoot":"","sources":["../../src/providers/PrivateGitHubProvider.ts"],"names":[],"mappings":";;;AAAA,+DAAwG;AAExG,qCAA8B;AAC9B,6BAA4B;AAE5B,6BAAyB;AACzB,kCAA4D;AAC5D,qDAAqD;AAErD,yCAAgE;AAMhE,MAAa,qBAAsB,SAAQ,mCAA2C;IACpF,YAAY,OAAsB,EAAmB,OAAmB,EAAmB,KAAa,EAAE,cAAsC;QAC9I,KAAK,CAAC,OAAO,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAA;QADG,YAAO,GAAP,OAAO,CAAY;QAAmB,UAAK,GAAL,KAAK,CAAQ;IAExG,CAAC;IAES,oBAAoB,CAAC,GAAQ,EAAE,OAAoC;QAC3E,MAAM,MAAM,GAAG,KAAK,CAAC,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CACtD;QAAC,MAAc,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACpC,OAAO,MAAM,CAAA;IACf,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,MAAM,iBAAiB,GAAG,IAAI,wCAAiB,EAAE,CAAA;QACjD,MAAM,WAAW,GAAG,yBAAkB,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAA;QAEpE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,CAAA;QACtE,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,WAAW,CAAC,CAAA;QACpE,IAAI,KAAK,IAAI,IAAI,EAAE;YACjB,+CAA+C;YAC/C,MAAM,+BAAQ,CAAC,eAAe,WAAW,mBAAmB,WAAW,CAAC,QA

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\providers\Provider.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5075
Entropy (8bit):	4.8331638346177765
Encrypted:	false
SSDEEP:	96:KEvQKjIqnVIv45O0z7iU0VUOd2tYEprO1QOy7HBOjtIaOTiyTTPts1XT1cS1XXQP:KjKjIqnVIv45O0z7ixuOd2t/reQOy7Hd
MD5:	416C55AACCE3762419BA74F5640A74F0
SHA1:	388C51AE7B157F28F7CC2CD86B73630B0CB63568
SHA-256:	F232A34787CE1A8F057D6445992A6335E001FD024348771DA720BB3D004E924B
SHA-512:	BBD0498C66E55EE5D7618691F75FE2EF14018642BBFD66A51637644D8125BEF781D15AB69F367382E7AA2BBB785E5FFC8948E158C84631A220B944AF7E5A109B
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.resolveFiles = exports.getFileList = exports.parseUpdateInfo = exports.findFile = exports.Provider = void 0;.const builder_util_runtime_1 = require("builder-util-runtime");.const js_yaml_1 = require("js-yaml");.const util_1 = require("../util");.class Provider {. constructor(runtimeOptions) {. this.runtimeOptions = runtimeOptions;. this.requestHeaders = null;. this.executor = runtimeOptions.executor;. }. get isUseMultipleRangeRequest() {. return this.runtimeOptions.isUseMultipleRangeRequest !== false;. }. getChannelFilePrefix() {. if (this.runtimeOptions.platform === "linux") {. const arch = process.env.TEST_UPDATER_ARCH \|\| process.arch;. const archSuffix = arch === "x64" ? "" : `-${arch}`;. return "-linux" + archSuffix;. }. else {. return this.runtimeOptions.platform === "darwin" ? "-mac" : "";.

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\providers\Provider.js.map

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9725
Entropy (8bit):	5.115655293968698
Encrypted:	false
SSDEEP:	192:fmZD5EhiXlLNRJzW/fkV/n2oY00Ghd3g5VD2sJu3ThetGS+:fFCx1VJozD3Ju3T0kv
MD5:	4FCA33FA07D4F204C1B0BD25E91EA691
SHA1:	261A7FBDF15C90560929F0B21363C4326D011DD6
SHA-256:	4CBE10BEEB921C4EE78B03E7931791F296E32D847A1DE0A1A49CF3823A812843
SHA-512:	8A7B04195D2AD7A49BE801F9B20F104FE4497E003522B09B34942635D5852C49CA0464EAE18E7665B6CDC633BD5C4624BAD05B7F04D8E8B82FE9F7ED88FE39E0
Malicious:	false
Preview:	{"version":3,"file":"Provider.js","sourceRoot":"","sources":["../../src/providers/Provider.ts"],"names":[],"mappings":";;;AAAA,+DAAuK;AAEvK,qCAA8B;AAG9B,kCAAwC;AAWxC,MAAsB,QAAQ;IAI5B,YAAuC,cAAsC;QAAtC,mBAAc,GAAd,cAAc,CAAwB;QAHrE,mBAAc,GAA+B,IAAI,CAAA;QAIvD,IAAI,CAAC,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAA;IACzC,CAAC;IAED,IAAI,yBAAyB;QAC3B,OAAO,IAAI,CAAC,cAAc,CAAC,yBAAyB,KAAK,KAAK,CAAA;IAChE,CAAC;IAEO,oBAAoB;QAC1B,IAAI,IAAI,CAAC,cAAc,CAAC,QAAQ,KAAK,OAAO,EAAE;YAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAA;YAC1D,MAAM,UAAU,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAA;YACnD,OAAO,QAAQ,GAAG,UAAU,CAAA;SAC7B;aAAM;YACL,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;SAC/D;IACH,CAAC;IAED,uFAAuF;IAC7E,qBAAqB;QAC7B,OAAO,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IAC5C,CAAC;IAES,oBAAoB,CAAC,OAAe;QAC5C,OAAO,GAAG,OAAO,GAAG,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAA;IACnD,CAAC;IAED,IAAI,wBAAwB;QAC1B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,iBAAiB,C

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\util.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1827
Entropy (8bit):	4.973605261067705
Encrypted:	false
SSDEEP:	48:KEAwPru86YQLQcoRg6HSF86JrC2QcoRjzgbRX6hmbRRj3:KEFCkQLQpg6oBXQpvg1Kh23j3
MD5:	0C519CADEF622D6BE65BFDB83E5BCE9C
SHA1:	4A0CD14B178B754126B8C5FCBAF261737DBD1815
SHA-256:	1A3FD42D0E1B0C55C923A048735F9BBDC8EC2C2D0A2959445848D64A647890FF
SHA-512:	21158831913A560AF5FB1DF4A57E6F688A91748B9C2E504445BCA165403CB18CE1E6F69BBFFF1945271196FB1C74CD97D3CBABF876A12870F6365F5A123BDE9F
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.blockmapFiles = exports.getChannelFilename = exports.newUrlFromBase = exports.newBaseUrl = void 0;.// if baseUrl path doesn't ends with /, this path will be not prepended to passed pathname for new URL(input, base).const url_1 = require("url");.// @ts-ignore.const escapeRegExp = require("lodash.escaperegexp");./** @internal */.function newBaseUrl(url) {. const result = new url_1.URL(url);. if (!result.pathname.endsWith("/")) {. result.pathname += "/";. }. return result;.}.exports.newBaseUrl = newBaseUrl;.// addRandomQueryToAvoidCaching is false by default because in most cases URL already contains version number,.// so, it makes sense only for Generic Provider for channel files.function newUrlFromBase(pathname, baseUrl, addRandomQueryToAvoidCaching = false) {. const result = new url_1.URL(pathname, baseUrl);. // search is not propagated (search is an empty string if not specifi

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\util.js.map

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2817
Entropy (8bit):	5.11831129012367
Encrypted:	false
SSDEEP:	48:YWLhHDzT3bbP60n3DvZn3rrpX/frxrR2jfpPPXvZvpPTPHvhbv2Ev34OcpOQY0wH:fRHXBnTBn7R+jVPXhFTPHZqc34OaOQYv
MD5:	3BAD4842E4C390866FE860CD5A9AFAA3
SHA1:	A9C56F19D6D8440993E26C39060156E8E6E799F4
SHA-256:	FDF43475E6321FFD37845690957B7B13550C3ADE6152F8CA635D1224F22374F8
SHA-512:	DEA8FEA5A7DD5C92F21CE174E4F3564E11E283D13EDA3FBDF26E707F4B8D49B79ABD2A5C23CD3177C80E359AAB7CAB7EDDEC7FEA7EA606EF21005D8728A295B3
Malicious:	false
Preview:	{"version":3,"file":"util.js","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":";;;AAAA,mHAAmH;AACnH,6BAAyB;AACzB,aAAa;AACb,oDAAmD;AAEnD,gBAAgB;AAChB,SAAgB,UAAU,CAAC,GAAW;IACpC,MAAM,MAAM,GAAG,IAAI,SAAG,CAAC,GAAG,CAAC,CAAA;IAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;QAClC,MAAM,CAAC,QAAQ,IAAI,GAAG,CAAA;KACvB;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAND,gCAMC;AAED,8GAA8G;AAC9G,iEAAiE;AACjE,SAAgB,cAAc,CAAC,QAAgB,EAAE,OAAY,EAAE,4BAA4B,GAAG,KAAK;IACjG,MAAM,MAAM,GAAG,IAAI,SAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IACzC,wEAAwE;IACxE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;IAC7B,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE;QACzC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAA;KACvB;SAAM,IAAI,4BAA4B,EAAE;QACvC,MAAM,CAAC,MAAM,GAAG,WAAW,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAA;KACrD;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAVD,wCAUC;AAED,SAAgB,kBAAkB,CAAC,OAAe;IAChD,OAAO,GAAG,OAAO,MAAM,CAAA;AACzB,CAAC;AAFD,gDAEC;AAED,SAAgB,aAAa,CAAC,OAAY,EAAE,UAAkB,EAAE,UAAkB;IAChF,MAAM,cAAc,GAAG,cAAc,CAA

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\windowsExecutableCodeSignatureVerifier.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5453
Entropy (8bit):	4.74045682924227
Encrypted:	false
SSDEEP:	96:KEroy1ziUVHhXjP9j3GnqhIVwmClniR4yS+D5cUyXSgbTt1tOpUV1eyAc1eyD7UA:KY1ziyBKqhIemlbS+D5ceCteUfA+fD7R
MD5:	F821E2BC4181F670C0362594B294798E
SHA1:	C33CA418275725F9A9319B799ADD4E63EE024E51
SHA-256:	8657A8C4E1172205C40B62E28118C176966DD65789763140AE1B8693FD0D35E4
SHA-512:	E2E36C61C4A8E2EFEEBD9C78270700C2E6BC1BCEF49721F7A2CDAD35EB53B64C87003892766C8CF82C2A96BBE02BA71C1F1D5BFE272C24ED7DB4BB0C18494451
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.verifySignature = void 0;.const builder_util_runtime_1 = require("builder-util-runtime");.const child_process_1 = require("child_process");.const os = require("os");.// $certificateInfo = (Get-AuthenticodeSignature 'xxx\yyy.exe'.// \| where {$_.Status.Equals([System.Management.Automation.SignatureStatus]::Valid) -and $_.SignerCertificate.Subject.Contains("CN=siemens.com")}).// \| Out-String ; if ($certificateInfo) { exit 0 } else { exit 1 }.function verifySignature(publisherNames, unescapedTempUpdateFile, logger) {. return new Promise(resolve => {. // Escape quotes and backticks in filenames to prevent user from breaking the. // arguments and perform a remote command injection.. //. // Consider example powershell command:. // ```powershell. // Get-AuthenticodeSignature 'C:\\path\\my-bad-';calc;'filename.exe'. // ```. // The above would work expec

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\out\windowsExecutableCodeSignatureVerifier.js.map

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8287
Entropy (8bit):	5.126712623819867
Encrypted:	false
SSDEEP:	96:fWLVN0Vr9NqHh9dxnprYDUB5QqSE7E456Lq81ePJmn4UFHhXRPLmqse+BpPOsjST:frVq/p1B5YE7EJ3Rn4u0qrhYS4y/BOU
MD5:	35BF610E89AA194F7B409FE0731131CC
SHA1:	02982E7FD4898B5CD1A2263EA5209149F13DA0E7
SHA-256:	E7DAFB96A58A91597137949FDB70F20A880419397603085BD2D240BD6707705A
SHA-512:	6D55413B15071385ECF54B52FCBFFCBF228CEE72CC94B1741BF0F2CD6E878E7C79090C6D93316A5AF493ACB39BC916256ABD1AAC42A85762C3E25E650A34C051
Malicious:	false
Preview:	{"version":3,"file":"windowsExecutableCodeSignatureVerifier.js","sourceRoot":"","sources":["../src/windowsExecutableCodeSignatureVerifier.ts"],"names":[],"mappings":";;;AAAA,+DAA8C;AAC9C,iDAAsD;AACtD,yBAAwB;AAGxB,8DAA8D;AAC9D,kJAAkJ;AAClJ,kEAAkE;AAClE,SAAgB,eAAe,CAAC,cAA6B,EAAE,uBAA+B,EAAE,MAAc;IAC5G,OAAO,IAAI,OAAO,CAAgB,OAAO,CAAC,EAAE;QAC1C,6EAA6E;QAC7E,oDAAoD;QACpD,EAAE;QACF,uCAAuC;QACvC,gBAAgB;QAChB,oEAAoE;QACpE,MAAM;QACN,+FAA+F;QAC/F,wCAAwC;QACxC,EAAE;QACF,iCAAiC;QACjC,2HAA2H;QAC3H,0EAA0E;QAC1E,sEAAsE;QACtE,4EAA4E;QAC5E,EAAE;QACF,0FAA0F;QAC1F,mFAAmF;QACnF,sEAAsE;QACtE,MAAM,cAAc,GAAG,uBAAuB,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAEtF,oEAAoE;QACpE,oEAAoE;QACpE,wBAAQ,CACN,gBAAgB,EAChB;YACE,YAAY;YACZ,iBAAiB;YACjB,cAAc;YACd,MAAM;YACN,UAAU;YACV,8BAA8B,cAAc,wHAAwH;SACrK,EACD;YACE,OAAO,EAAE,EAAE,GAAG,IAAI;SACnB,EACD,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACxB,IAAI;gBACF,IAAI,KAAK,IAAI,IAAI,IAAI,MAAM,EAAE;oBAC3B,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,

C:\Program Files (x86)\????????\resources\app\node_modules\electron-updater\package.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	952
Entropy (8bit):	4.7980359955656375
Encrypted:	false
SSDEEP:	24:0CzdzBZBQcat8gu9+qwYUzyT8LFi3CC1Cl:Tdt/Qcaugu9+qwYUzLk3No
MD5:	0FD0934FC941955B2FEE302758999DC4
SHA1:	900B14D18044EBBF4D4C2A6A2C0408DD5F61F206
SHA-256:	B15BBB23D06C4D3571EA99B14A6A059CFD83CA40D1C75132024DD12011C01D25
SHA-512:	CDC3085CD490F6E7C9CBE7C1A062A5FADC6AA65DDB1F21BC20BFC2EA18CA8E1DA2F75E7E4A7D2114098629CF21252F2EBD7BD2C100D64835F1433607CC1BC7EC
Malicious:	false
Preview:	{. "author": {. "name": "Vladimir Krivosheev". },. "dependencies": {. "@types/semver": "^7.3.5",. "builder-util-runtime": "8.7.5",. "fs-extra": "^10.0.0",. "js-yaml": "^4.1.0",. "lazy-val": "^1.0.4",. "lodash.escaperegexp": "^4.1.2",. "lodash.isequal": "^4.5.0",. "semver": "^7.3.5". },. "description": "Cross platform updater for electron applications",. "devDependencies": {. "@types/fs-extra": "^9.0.11",. "@types/js-yaml": "^4.0.1",. "@types/lodash.escaperegexp": "^4.1.6",. "@types/lodash.isequal": "^4.5.5". },. "files": [. "out". ],. "homepage": "https://github.com/electron-userland/electron-builder",. "license": "MIT",. "main": "out/main.js",. "name": "electron-updater",. "publishConfig": {. "tag": "next". },. "repository": {. "type": "git",. "url": "git+https://github.com/electron-userland/electron-builder.git". },. "typings": "./out/main.d.ts",. "version": "4.3.9".}

C:\Program Files (x86)\????????\resources\app\node_modules\end-of-stream\LICENSE

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1078
Entropy (8bit):	5.101372122926712
Encrypted:	false
SSDEEP:	24:bHrmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5/:bHaJHlxE35QHOs5exm3ogF5/
MD5:	9BEFE7026BF915886CD566A98117C80E
SHA1:	A95AB3A4B0E4BD978897F09B3B430A449DA20A08
SHA-256:	3FE8D55A98DBF260EACE67C00CF9BC53EDB46234E840098A0B93DF3096B97FB6
SHA-512:	B52BA143042812D6DD1031A12946AFDDB6E8F8EBBC7169C59C138D16AAFC5E261AAE92FE6B1EA94A3D80E39D2415C4B219710EF46939A2DF135DB24A0CF712FB
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2014 Mathias Buus..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR

C:\Program Files (x86)\????????\resources\app\node_modules\end-of-stream\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2678
Entropy (8bit):	4.848403663371877
Encrypted:	false
SSDEEP:	48:hu9jPstgVMD8dBA1PR2oQ0tAN9lmvANqWqJTUEK+EVGgqfmExZ+umbyDEWo06tfp:kZJ08BA1PdlANjmvANqS60Xp
MD5:	2C81E5E7DAE5854BDBA5BE8E0D5B4C79
SHA1:	4764AB17A6F6138154139D0841FFF7C351E69B6A
SHA-256:	3E912DF226EE90EE3EDC5FF69CD3E8313FA1DA13795E10FB0B0F05727BDABB58
SHA-512:	D2FCCC9E7CEF57C295CC3A1701B9A64BDBC01AB5154F857A548249C8BDEB9857B4BC93853ECB05F7163DE6B34600F621D7E885BD773015D7C8A11110887E5F2C
Malicious:	false
Preview:	var once = require('once');..var noop = function() {};..var isRequest = function(stream) {..return stream.setHeader && typeof stream.abort === 'function';.};..var isChildProcess = function(stream) {..return stream.stdio && Array.isArray(stream.stdio) && stream.stdio.length === 3.};..var eos = function(stream, opts, callback) {..if (typeof opts === 'function') return eos(stream, null, opts);..if (!opts) opts = {};...callback = once(callback \|\| noop);...var ws = stream._writableState;..var rs = stream._readableState;..var readable = opts.readable \|\| (opts.readable !== false && stream.readable);..var writable = opts.writable \|\| (opts.writable !== false && stream.writable);..var cancelled = false;...var onlegacyfinish = function() {...if (!stream.writable) onfinish();..};...var onfinish = function() {...writable = false;...if (!readable) callback.call(stream);..};...var onend = function() {...readable = false;...if (!writable) callback.call(stream);..};...var onexit = function(exitCode) {.

C:\Program Files (x86)\????????\resources\app\node_modules\end-of-stream\package.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	566
Entropy (8bit):	4.681133836801422
Encrypted:	false
SSDEEP:	12:z4SMADQPcnY9BZV5ObRF+k/GC28l+06aAwbmF28l+uV1oGn:MSZDccaZbObRFY9jQ01oG
MD5:	AB92952956A99FEC0B7D2527C4F8E06F
SHA1:	7EB37FDC4245FDA1819BEFB8FB40E895AB3DF519
SHA-256:	0EE476C745713E8B68E13452C85FAC2A2564CD8C986AB8DFC4BA2B6DB59A1E4E
SHA-512:	B3F7C4AC3097EB678BDC40F89C1B3BB97F81229393E0140440E9DB46BD008B6BFD1784C5FA3B44474C80C72B8AD1D76D8D501714A317C36906147A428B501083
Malicious:	false
Preview:	{. "author": {. "name": "Mathias Buus",. "email": "mathiasbuus@gmail.com". },. "dependencies": {. "once": "^1.4.0". },. "description": "Call a callback when a readable/writable/duplex stream has completed or failed.",. "devDependencies": {. "tape": "^4.11.0". },. "files": [. "index.js". ],. "homepage": "https://github.com/mafintosh/end-of-stream",. "license": "MIT",. "main": "index.js",. "name": "end-of-stream",. "repository": {. "type": "git",. "url": "git://github.com/mafintosh/end-of-stream.git". },. "version": "1.4.4".}

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\@@iterator\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	222
Entropy (8bit):	4.8669812598348905
Encrypted:	false
SSDEEP:	6:0iPbeA4oLFVosqJ7sR4KXmTE3Yc6nLTewFR5FX9DE7xuOfFR15Md:PTQqXjyMmI3o7FnrDIfBMd
MD5:	7D930427D7E65741ABDC48E562FC8FC9
SHA1:	AE18115DE3200F72EDBC2D7E309259887001AEFC
SHA-256:	0758F8215053E21FB4B1BF61EC29A40BF398B74B834445B9AEB62ED43989CA9E
SHA-512:	DC64A01F9A9246CFC109C6833691B63C636484E064BDB2FAE24B6FE74A3204F730C4B384A58153BC3E1566E75324E786857CCB8F096001592A2F29F46B9C5BCF
Malicious:	false
Preview:	"use strict";..if (!require("./is-implemented")()) {..Object.defineProperty(Array.prototype, require("es6-symbol").iterator, {...value: require("./shim"),...configurable: true,...enumerable: false,...writable: true..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\@@iterator\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	135
Entropy (8bit):	4.690273377737004
Encrypted:	false
SSDEEP:	3:jTqhBBbJAXPbJYRAKkeXx9sqdJN4scy4KXiRUQWANcw:4BWPbeAeLsqdJusR4KXiRU4cw
MD5:	579A6E5BC413AC368A94827A552F6DBA
SHA1:	5D53FBFD0A58CBEFE0D8D65BEE506C154C44679C
SHA-256:	3C2473D659062EB624F5E3BB51C34C2DDAC0110DD299B1E66142A136FDA9D291
SHA-512:	0E115FDD6D6185107BFD21215ACB32FA4FDF3D123EC8F8021DD4CC2F3FDAD3BC88A0BCA688649E8A88027D19A4184A0488901C485373A8FA3C3307463BA6A10E
Malicious:	false
Preview:	"use strict";..module.exports = require("./is-implemented")()..? Array.prototype[require("es6-symbol").iterator]..: require("./shim");.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\@@iterator\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	481
Entropy (8bit):	4.5918996164090835
Encrypted:	false
SSDEEP:	6:dXxY7sR4KXDYBgL9X71qemX2eXyXutsXEQR17XSaAU3XWIJuRkbQ/4:V9yMDYBgL17cT2IEu0Z1TSdUnWIwRUV
MD5:	8E890AD7E521CC96AD7F20363ED30500
SHA1:	738ED1779A51D66C21DDDB2C064EAF5F5675375D
SHA-256:	8BB3C026CCA121263905A814124AA31A9FB9930B52D6835D7054086C33DCDD74
SHA-512:	20682C25CD22B8D2D37652A3EB2940D73DEB46CC8B8921984D3A00AD05D125A5AF61E0C281D20942F51329BB44F8871F4F2B942524494F458F7CC74216B43750
Malicious:	false
Preview:	"use strict";..var iteratorSymbol = require("es6-symbol").iterator;..module.exports = function () {..var arr = ["foo", 1], iterator, result;..if (typeof arr[iteratorSymbol] !== "function") return false;..iterator = arr[iteratorSymbol]();..if (!iterator) return false;..if (typeof iterator.next !== "function") return false;..result = iterator.next();..if (!result) return false;..if (result.value !== "foo") return false;..if (result.done !== false) return false;..return true;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\@@iterator\shim.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.443764185131652
Encrypted:	false
SSDEEP:	3:jTqhBBbJA+pANWe6Mw:4B9henw
MD5:	526E842A529D4FB9D027AD23D701B2C8
SHA1:	9B45BEEB9D7E7A35366E8098253AF1944B08217F
SHA-256:	F4B06629674145B2A92498891ECEFAB6360EC7824550C1B4CDD082BB63B46A46
SHA-512:	CA24B8E0B5A127A36AEA61E1589CDC94200BED63CD0823C3ECA53EDA8D1DA156914C3B1EF2B665EA6497376C12C9FEF8622C39905531E3B525943F574287A0C8
Malicious:	false
Preview:	"use strict";..module.exports = require("../values/shim");.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\_compare-by-length.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	222
Entropy (8bit):	4.718548136255567
Encrypted:	false
SSDEEP:	6:jbyY0R8REcFJRRKuR+mMb3zBqSXqRtuYR6Nx:jeYxREaKuMm03zBqIqVA7
MD5:	AF49FCA140879B0ABF5DFBD9B3C46095
SHA1:	BBBA07E94F870439D6B8A6E9CF9527B732A8122F
SHA-256:	4B51C15086F85A280065783CA569D6E205CE5DADFF2B8ECCB9C30EA07152459D
SHA-512:	EE2CD97D19EC3680959A7E1981ED1A47544BA3760CA1DC42A3E830D31E3C91756959DA05BF05782A8314F16611FA77D5423FC8A873EB6DBF85CA4059363D3FC9
Malicious:	false
Preview:	// Used internally to sort array of lists by length.."use strict";..var toPosInt = require("../../number/to-pos-integer");..module.exports = function (arr1, arr2) { return toPosInt(arr1.length) - toPosInt(arr2.length); };.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\binary-search.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	600
Entropy (8bit):	4.941919498279226
Encrypted:	false
SSDEEP:	12:xKuMmDpKhbCI1FohIJtClQWBRGg0HBeNGXRdc/fGd55/Swsw26y:xKurEbyIvLWBRGzHBqGXRdEGEzr
MD5:	83E3B17AF447064A1706B341ACCF8072
SHA1:	A163BB2AE866AA0C51D0A3A27B9FB6FCEA91C4E0
SHA-256:	F68E4B101DEDEEDC88352C7B34B465FE469F3860454A0883D8EA16AA1E63FFF6
SHA-512:	F1A35C2440FFE23F2D240D247B0B0914425C0C770EC341C129ABBF21FF2893DE4DDC6CB3019FA0193E7494E6B480001EC2057B7A2719B2B0E54C5E839729AE1D
Malicious:	false
Preview:	"use strict";..var toPosInt = require("../../number/to-pos-integer"). , callable = require("../../object/valid-callable"). , value = require("../../object/valid-value"). , floor = Math.floor;..module.exports = function (compareFn) {..var length, low, high, middle;...value(this);..callable(compareFn);...length = toPosInt(this.length);..low = 0;..high = length - 1;...while (low <= high) {...middle = floor((low + high) / 2);...if (compareFn(this[middle]) < 0) high = middle - 1;...else low = middle + 1;..}...if (high < 0) return 0;..if (high >= length) return length - 1;..return high;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\clear.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	274
Entropy (8bit):	4.887046847894861
Encrypted:	false
SSDEEP:	6:jHvKFhSSRwQBTqhKR/CCoElztNzAIIJt/zBP/22+5:jIS4xRYElJNhIJt/zB2F
MD5:	449CE1CA56308348553E4EB2766BD133
SHA1:	9B8609ECEBE30A21186AD863BAC34A3150237EAD
SHA-256:	3AE2EB5568665B2C97D758958B2C6237D45A0E5868D43FE5B13433929F0052C9
SHA-512:	78E07967DBC48254DCEB88413B9C66E19B51B667CAD7DF6FB1EF714FC48FB297E7EA25CD700D8FE569F765BFB05F371417A093A3E9B683925E73CD9FCBBB08E4
Malicious:	false
Preview:	// Inspired by Google Closure:.// http://closure-library.googlecode.com/svn/docs/.// closure_goog_array_array.js.html#goog.array.clear.."use strict";..var value = require("../../object/valid-value");..module.exports = function () {..value(this).length = 0;..return this;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\compact.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	273
Entropy (8bit):	4.861842656147734
Encrypted:	false
SSDEEP:	6:jHSiIrE2K2eriztN8vrozxsqLcRaYBshrZFDZq3CBWzziMwD:jOEF2eStNkrIrcRxBMNFdq35ij
MD5:	C5650797DF46F6AE44111A8EC12296D3
SHA1:	5208D73844172EAFFC311512E5C9AEE1B0ED3699
SHA-256:	D594A17AF7E6DB8B48E8158DF2318247D6E849C535CF4F0029F019E46D626E47
SHA-512:	DAB4B102659CE134DDF6C7DFF1A288D2988FB3F3D8A5F2F8C9015B6458CDB6012DE9A41723F061FC0B2F3F027F47E2AA2E70681FF2596E0536F867E36AA96F45
Malicious:	false
Preview:	// Inspired by: http://documentcloud.github.com/underscore/#compact.."use strict";..var isValue = require("../../object/is-value");..var filter = Array.prototype.filter;..module.exports = function () {..return filter.call(this, function (val) { return isValue(val); });.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\concat\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.8831791873211685
Encrypted:	false
SSDEEP:	6:0iPbeA4oLFVosqJDXtwBE3Yc6nLTewFR5FX9DE7xuOfFR15Md:PTQqXgXz3o7FnrDIfBMd
MD5:	7FCD772EA034AAE5F63FC7292D7730FE
SHA1:	FD41D12AC56957D9C672B2A1B8ECEFABFEEC5CC5
SHA-256:	63ABB3FA1BF938801EBFE1827F328886DA23B0CCA3F036702F414B9C914A45A0
SHA-512:	0E7FFD44B63BEDFF8042E68C0550AE21064AFB294FBD2341429B2A7F76CA08335C3917D82C60CB502A43669E3155AF061B146CFC518B158FB9AD703A94631633
Malicious:	false
Preview:	"use strict";..if (!require("./is-implemented")()) {..Object.defineProperty(Array.prototype, "concat", {...value: require("./shim"),...configurable: true,...enumerable: false,...writable: true..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\concat\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	108
Entropy (8bit):	4.618275806168878
Encrypted:	false
SSDEEP:	3:jTqhBBbJAXPbJYRAKaOIE69sqLdBFljANcw:4BWPbeA05osqLXCcw
MD5:	975E0183EC91950A4F851AE96C3AC59C
SHA1:	8320858C5A5BC906EC6F2C6A0BE75A9DA31FDF4B
SHA-256:	4CD2607D3049DE932088589324FC6B1E589C12924EECC67BCF14C230FAB5EC36
SHA-512:	71F6AC884963E0C815783D6A8E77C8995F5700A487EA3B48E18F26D117FE17D26E092793E6C5E7736290D5DAF2884AAE2FD8A7FB955D589FE85039A5065E002B
Malicious:	false
Preview:	"use strict";..module.exports = require("./is-implemented")() ? Array.prototype.concat : require("./shim");.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\concat\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.77493328297151
Encrypted:	false
SSDEEP:	3:jTqaF2QiiHpA+LFWQHMHrQwQKzBbfaaXARQbx12QEVeLdBNtshiGvDREVTw:zsQGfzBURG3E5iGbRD
MD5:	09F7CC2FBFB760BBBE29F0338EAE3EB2
SHA1:	D7F053DE8F0582E58B9463E2C49EB12168E4D503
SHA-256:	6F5FDE3B4B9F4D069A6482FC789C096ECD39FB34253FEEE03BAA8A5BFE2CA960
SHA-512:	78D77491B313DD7102DBB9380A806A178BE8CED00B489BEDE204EDBC1812E5B4561A4E7B7EA7412746B6C61F18D2AE49A2D7488DCE634AB2D72A1937AC46A7B8
Malicious:	false
Preview:	"use strict";..var SubArray = require("../../_sub-array-dummy-safe");..module.exports = function () { return new SubArray().concat("foo") instanceof SubArray; };.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\concat\shim.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1279
Entropy (8bit):	4.938075683264556
Encrypted:	false
SSDEEP:	24:RScdKcGTPvaN7vdhqI8q52EQYBtEnesizMVhnaFYVmBXiW7wfeabhn9gKBHrVmxG:kkKHo7aq52A/qDVhnaF4md17aBbhnhBD
MD5:	BC5ABBFB627B6CDAF497934D5E7C6E74
SHA1:	AD0C611582DDE30E7CAA2C3A7601F3561C77A453
SHA-256:	3072A5A2E8AA3E7A34E103E95F11C2E8EE888797A78DDD27E181761921D38819
SHA-512:	434F8BEE43568A9F170A4C14204DF8D97315C56E737040BBC8216F8F6F49EE91F2B14E9E9B1297A6E77116D6B3E62BBF67263E1372736359875A6AA352D667D5
Malicious:	false
Preview:	"use strict";..var isPlainArray = require("../../is-plain-array"). , toPosInt = require("../../../number/to-pos-integer"). , isObject = require("../../../object/is-object"). , isConcatSpreadable = require("es6-symbol").isConcatSpreadable. , isArray = Array.isArray. , concat = Array.prototype.concat. , forEach = Array.prototype.forEach. , isSpreadable;..isSpreadable = function (value) {..if (!value) return false;..if (!isObject(value)) return false;..if (value[isConcatSpreadable] !== undefined) {...return Boolean(value[isConcatSpreadable]);..}..return isArray(value);.};..// eslint-disable-next-line no-unused-vars.module.exports = function (item /, .items/) {..var result;..if (!this \|\| !isArray(this) \|\| isPlainArray(this)) {...return concat.apply(this, arguments);..}..result = new this.constructor();..if (isSpreadable(this)) {...forEach.call(this, function (val, i) { result[i] = val; });..} else {...result[0] = this;.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\contains.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.919226037060362
Encrypted:	false
SSDEEP:	3:jTqaFM1ANAbNBAKu33zBbfNBpRFKxFgLquevnLB4iHNrXJFWBGLpRJFEj9l5UzeL:61Mx33zBpBpRmXGyNrZF9pRLyhUzy
MD5:	EF80F9F6ED8779735BF3BCF157AB5D04
SHA1:	5A4B66D37086F174F492300964B88813488BB17B
SHA-256:	29577A102D0894EBBC969A27084777C732C33CC5602D181C6521131122A2CA05
SHA-512:	C116FD62982FBED049C33FB6230232BB10E85B57E695CCE6C3EE9DFE1EBF0C177F053C8C9168D345CCFFC1F6D5B547C62C572766822050854D45C6155E03A54D
Malicious:	false
Preview:	"use strict";..var indexOf = require("./e-index-of");..module.exports = function (searchElement /, position/) {..return indexOf.call(this, searchElement, arguments[1]) > -1;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\copy-within\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	204
Entropy (8bit):	4.9124298880584965
Encrypted:	false
SSDEEP:	6:0iPbeA4oLFVosqJDVMRNMlbyE3Yc6nLTewFR5FX9DE7xuOfFR15Md:PTQqXgVYgX3o7FnrDIfBMd
MD5:	5CD852C9D89BADA492569ABEA93DB6D1
SHA1:	A5A497212A5AF90E5231460A6D4042A7D47C4CDE
SHA-256:	51EA04983E053BBF13F6D0A1425C5244EFE6BA96411C4D4FD0F14A54F7CBCCF9
SHA-512:	6D378D3BDA14555C3DF85263CD94546318919C2E9288DB2F0CB574084826E438C1CE339E782AEF3436341ED766F52CA6CEA6072592E342AAFC670A263B02624A
Malicious:	false
Preview:	"use strict";..if (!require("./is-implemented")()) {..Object.defineProperty(Array.prototype, "copyWithin", {...value: require("./shim"),...configurable: true,...enumerable: false,...writable: true..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\copy-within\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.639016273508268
Encrypted:	false
SSDEEP:	3:jTqhBBbJAXPbJYRAKaOIE69sqLdmRNMZyUANcw:4BWPbeA05osqLgRNMZy1cw
MD5:	72F987002EAFB38BB8039B068D5C18AD
SHA1:	01AE05272D7BA75CC5544AF9A9307751513B21A4
SHA-256:	B55F06ED0352320690531AD2451E413B544DBEBC393ED2EC51E19F10536490C1
SHA-512:	985C1B48BD9D6A027944371EAC4F713998617791E05178E4938CC4B415A20F3281D0D914A4B76E3B14A197EA1D7DC958A60BF6D2125A6594258228AAB6B30B98
Malicious:	false
Preview:	"use strict";..module.exports = require("./is-implemented")() ? Array.prototype.copyWithin : require("./shim");.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\copy-within\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.8968996915724565
Encrypted:	false
SSDEEP:	3:jTqhBBbfasH0yZwhEHyzfRNMCYSEJL5f+gxMLrHZ2fRNMKJtlDI+rn:4BYeyTRNMBkgQr5mRNMST0+rn
MD5:	E933E6B0AD7F36F2C53E726F5E0B8874
SHA1:	1AE965F83113691BB9812BA7E8509380CBF319EB
SHA-256:	C4BCF951EBBFB707385E10844E09E87C636BA1BC159A3ECB85A6A4C422117DAF
SHA-512:	A4BDF42DDB95554DC31D5D9A9D46A13EEEAB94F9A85AD3822A527771FC20ABAC6497ACE09E5C94BF2BC7307E6B8CCEAF4A82E5B5056E52F309FE318D80FE7431
Malicious:	false
Preview:	"use strict";..module.exports = function () {..var arr = [1, 2, 3, 4, 5];..if (typeof arr.copyWithin !== "function") return false;..return String(arr.copyWithin(1, 3)) === "1,4,5,4,5";.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\copy-within\shim.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	4.855022504034402
Encrypted:	false
SSDEEP:	24:OvBKmkiWfIvefBVeD1fjV/aEFYMLmEMsk6IXMNaNEkjcIn1XRXhrw:OvBKUvefq1fjVjyUhc6IXYa5jFn1Xfw
MD5:	7D0240FE945E1D88C94D340C469068A8
SHA1:	445E7B88A07174EF109067CE165299BBB039B8F7
SHA-256:	E3F7E3B2DB88CCF4D6DD5858F0A577A713D15409EE870585809CFAA53E5C27DB
SHA-512:	14559AA67C8855A3392B5180B44E67F3F9C17B6BB691B18F77B2ED65A5C46445FF033F1501F2687626E5672F2703EF697EDA331F79A061E2B60A07F99D1C8372
Malicious:	false
Preview:	// Taken from: https://github.com/paulmillr/es6-shim/.."use strict";..var toInteger = require("../../../number/to-integer"). , toPosInt = require("../../../number/to-pos-integer"). , validValue = require("../../../object/valid-value"). , objHasOwnProperty = Object.prototype.hasOwnProperty. , max = Math.max. , min = Math.min;..module.exports = function (target, start /, end/) {..var arr = validValue(this).. , end = arguments[2].. , length = toPosInt(arr.length).. , to.. , from.. , fin.. , count.. , direction;...target = toInteger(target);..start = toInteger(start);..end = end === undefined ? length : toInteger(end);...to = target < 0 ? max(length + target, 0) : min(target, length);..from = start < 0 ? max(length + start, 0) : min(start, length);..fin = end < 0 ? max(length + end, 0) : min(end, length);..count = min(fin - from, length - to);..direction = 1;...if (from < to && to < from + count) {...direction = -1;...from +

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\diff.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	295
Entropy (8bit):	4.708537544651646
Encrypted:	false
SSDEEP:	6:zuFodzAIIJtCJvAElxQexLsqLcRaYBb6oWyf+ThrZFDZzJGhzJFHD:6FohIJtCt9QexJcRxB5+NFdkhTj
MD5:	7CDE304CB36D93EF28BC6428C1B40AC8
SHA1:	5808FFB7C0FBB92A0981837B0A626AC6CC3E9AC6
SHA-256:	DEDEB274C1026152645900DAC7F8842D9EF7A898C03899B35D1A53A536638A55
SHA-512:	C8C42D8FEA77C575FD9E43D90ACD24FACC99A4BDA6010BEDF470685A20B154BFAAE0698BF603501CD518198C9B62AC5F7F789844D6C6737454105930DF0A3C19
Malicious:	false
Preview:	"use strict";..var value = require("../../object/valid-value"). , contains = require("./contains"). , filter = Array.prototype.filter;..module.exports = function (other) {..value(this);..value(other);..return filter.call(this, function (item) { return !contains.call(other, item); });.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\e-index-of.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.956542495503578
Encrypted:	false
SSDEEP:	24:lFIpXIvEklWBZRzR8JHg98TvuZ5K1nbFtZq:rIWvEklW8Jtp1nbF6
MD5:	8EFD82E1FCDECDA6625526A4762420D8
SHA1:	DBC9AB07CB933CA90A7D85885D566CE641114F35
SHA-256:	A2495BD72B9402D5D9648296BF3AFAD93B1C4B36E667AC222C0353CA2267F42D
SHA-512:	1E891F17870AAA5C649ECA678A53621C089E5F33CD5DC897AC3BA7757933EBD7919C63F2D1830148EA93A1D9B507B59EFF9220B27098A42D0D28BCBFB206B7B1
Malicious:	false
Preview:	"use strict";..var numberIsNaN = require("../../number/is-nan"). , toPosInt = require("../../number/to-pos-integer"). , value = require("../../object/valid-value"). , indexOf = Array.prototype.indexOf. , objHasOwnProperty = Object.prototype.hasOwnProperty. , abs = Math.abs. , floor = Math.floor;..module.exports = function (searchElement /, fromIndex/) {..var i, length, fromIndex, val;..if (!numberIsNaN(searchElement)) return indexOf.apply(this, arguments);...length = toPosInt(value(this).length);..fromIndex = arguments[1];..if (isNaN(fromIndex)) fromIndex = 0;..else if (fromIndex >= 0) fromIndex = floor(fromIndex);..else fromIndex = toPosInt(this.length) - floor(abs(fromIndex));...for (i = fromIndex; i < length; ++i) {...if (objHasOwnProperty.call(this, i)) {....val = this[i];....if (numberIsNaN(val)) return i; // Jslint: ignore...}..}..return -1;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\e-last-index-of.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	955
Entropy (8bit):	4.9754769157135526
Encrypted:	false
SSDEEP:	24:lFIpXIvu6k/klWBZRbRXT69KoTvuZ5K1VIbFtZq:rIWvuxklWzJap1VIbF6
MD5:	437A69FDD049B4D0ABF547F85DAF5831
SHA1:	64277A2E1003B6A3CDB80F7C36371DED9D68FF3B
SHA-256:	698BDB457B4AC14C2E293E3507FC95A5AAFEBB83FA84773631EEFEEE0F68CA57
SHA-512:	EB15E9B8AE0E44117019B6AA4888E4BC22612BCD42727D09E481CF71F4C08B78C9D98B54181B9DE176BC5D9B5E1826BE57DC2956416F3A3766660DB46B807D9E
Malicious:	false
Preview:	"use strict";..var numberIsNaN = require("../../number/is-nan"). , toPosInt = require("../../number/to-pos-integer"). , value = require("../../object/valid-value"). , lastIndexOf = Array.prototype.lastIndexOf. , objHasOwnProperty = Object.prototype.hasOwnProperty. , abs = Math.abs. , floor = Math.floor;..module.exports = function (searchElement /, fromIndex/) {..var i, fromIndex, val;..if (!numberIsNaN(searchElement)) {...// Jslint: ignore...return lastIndexOf.apply(this, arguments);..}...value(this);..fromIndex = arguments[1];..if (isNaN(fromIndex)) fromIndex = toPosInt(this.length) - 1;..else if (fromIndex >= 0) fromIndex = floor(fromIndex);..else fromIndex = toPosInt(this.length) - floor(abs(fromIndex));...for (i = fromIndex; i >= 0; --i) {...if (objHasOwnProperty.call(this, i)) {....val = this[i];....if (numberIsNaN(val)) return i; // Jslint: ignore...}..}..return -1;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\entries\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	201
Entropy (8bit):	4.847110673999269
Encrypted:	false
SSDEEP:	6:0iPbeA4oLFVosqJWSyE3Yc6nLTewFR5FX9DE7xuOfFR15Md:PTQqXRA3o7FnrDIfBMd
MD5:	EDFBECF44B90ECF985B6B8DC851B2C42
SHA1:	E2A5387235497150A0A805D852C70AE7BFEBD4DB
SHA-256:	FB6A202E6C0598F331BD1673407DA511E2095E020AC2271A1A5D6A36800BC977
SHA-512:	41556F4A0357BE5EE4A44B47BE046416B116346CB207002FE12AA22FF8399473F0140EDB83494387365660B015F4CE80BCE5431473E281FF4294FA60E4C8FC44
Malicious:	false
Preview:	"use strict";..if (!require("./is-implemented")()) {..Object.defineProperty(Array.prototype, "entries", {...value: require("./shim"),...configurable: true,...enumerable: false,...writable: true..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\entries\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	109
Entropy (8bit):	4.537236584983362
Encrypted:	false
SSDEEP:	3:jTqhBBbJAXPbJYRAKaOIE69sqLeXMLjANcw:4BWPbeA05osqLxLCcw
MD5:	B529153192D74E5FA15BF9AF2D8FC166
SHA1:	620D79B30AD8C8D7D766C72615A1F9264A869AA6
SHA-256:	600D055A1DDCE31637BFEF8C6EDC848D387C501F7B87D6F721AA98D02A320029
SHA-512:	29C917A92FF31912B0522D01CABC6F514B738C3EB3C679D01962A0CBDB6F8E59F1CB2F94069DF0404305AE61BBDBA75C1F0E4CFF6079704A55B2A0496F04A3C2
Malicious:	false
Preview:	"use strict";..module.exports = require("./is-implemented")() ? Array.prototype.entries : require("./shim");.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\entries\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	469
Entropy (8bit):	4.524052925786447
Encrypted:	false
SSDEEP:	6:4B6Q8X71qe0ngeX+XEQR17XSaAU3XWI8ZUOQETz1XbQ/4:4BRG7cWIoZ1TSdUnWI8aNwrV
MD5:	40B9B3BDA9D5C58A0686B5633ADD42D1
SHA1:	45A96C7F16EE48BA8F1731B26DFBF86BE24C84C0
SHA-256:	B254DA62FBD9EB773051A8473381021920FB4130BFA0447E3BB07D71BDB47240
SHA-512:	1D49DB767A6CB8626EBFFDD3B3A0855C828405B18700A7CBCFEFA765A856B79E4EAA58A7A538E6ABC0BA4E254D48FF0420991D42AFE2C75307C83A7091AE8D48
Malicious:	false
Preview:	"use strict";..module.exports = function () {..var arr = [1, "foo"], iterator, result;..if (typeof arr.entries !== "function") return false;..iterator = arr.entries();..if (!iterator) return false;..if (typeof iterator.next !== "function") return false;..result = iterator.next();..if (!result \|\| !result.value) return false;..if (result.value[0] !== 0) return false;..if (result.value[1] !== 1) return false;..if (result.done !== false) return false;..return true;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\entries\shim.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.616258666463814
Encrypted:	false
SSDEEP:	3:jTqaFkXX3gjiLsX9/Qb0BbfaaXARQbx1kkMX3tLHO58Evqwn:Y3grX9/Qb0BURG5W3BHIvqw
MD5:	B378D03FE235957D485685937A78A332
SHA1:	48BCAD8A98495B4440D6F422C411E7464858B120
SHA-256:	0625B9416D641178DFA7180D10559D89A1E5F06499079FF5D00C5AC6AD1171C0
SHA-512:	05F2D40083E9CBB7E53FC0B2E2B64AAD41EDBF672E1E85F18CC20F0D4EC119657F6E31B412C7801029815CF8A3E7E3AE0D6A8726F2669C0B84459EF8D73929E3
Malicious:	false
Preview:	"use strict";..var ArrayIterator = require("es6-iterator/array");.module.exports = function () { return new ArrayIterator(this, "key+value"); };.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\exclusion.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	782
Entropy (8bit):	4.878200372978189
Encrypted:	false
SSDEEP:	24:9Iv4ifBiJuBKlEvzVCt/6WhCrFdjsB6JgM5nFr:CvfB6u6uU/9hKdFuUnFr
MD5:	8174A2D2C9A178FF69566D0F85ED296C
SHA1:	94E984D68A31539F579A13E0BB6AC06174A08711
SHA-256:	1602C423B8856311BD6A07765CB683C99DF5DF332748E036E365402C3D4B1D93
SHA-512:	3450BD2AE3A4F891E05419A27A110BC70623A50565D0BB1EAA34C5A412F94D05BBC14F0BD0DB5BE45646482AED959F7706C7CF11B471368FD9B366A1467F1DB5
Malicious:	false
Preview:	"use strict";..var value = require("../../object/valid-value"). , aFrom = require("../from"). , toArray = require("../to-array"). , contains = require("./contains"). , byLength = require("./_compare-by-length"). , filter = Array.prototype.filter. , push = Array.prototype.push;..module.exports = function (/* .lists*/) {..var lists, seen, result;..if (!arguments.length) return aFrom(this);..push.apply((lists = [this]), arguments);..lists.forEach(value);..seen = [];..result = [];..lists.sort(byLength).forEach(function (list) {...result = result.....filter(function (item) { return !contains.call(list, item); }).....concat(filter.call(list, function (item) { return !contains.call(seen, item); }));...push.apply(seen, toArray(list));..});..return result;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\fill\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	198
Entropy (8bit):	4.8716822635664885
Encrypted:	false
SSDEEP:	6:0iPbeA4oLFVosqJCJq0yE3Yc6nLTewFR5FX9DE7xuOfFR15Md:PTQqX3E0X3o7FnrDIfBMd
MD5:	B571E31E8C27FDE4D9F34066EF362045
SHA1:	E9932C02361839A20E731BEB4C563C746F89A699
SHA-256:	243FB0C70F255C7A26BA7D73D100C535D93E63EDCA1728FCD02E411B7CB9E56C
SHA-512:	B83741B8D79CAE47BCD47E87E8C1F7A02A04D7B012C4BF8FE33431FCFCC17A53FA6D8D97AEEEA937445AA60AD6BEE5683FE9AF636A3EDF4F51C79EA229FD89C2
Malicious:	false
Preview:	"use strict";..if (!require("./is-implemented")()) {..Object.defineProperty(Array.prototype, "fill", {...value: require("./shim"),...configurable: true,...enumerable: false,...writable: true..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\fill\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.611038047102677
Encrypted:	false
SSDEEP:	3:jTqhBBbJAXPbJYRAKaOIE69sqLcJlFXAUANcw:4BWPbeA05osqLcJfQ1cw
MD5:	E566FE3EFF06DFDE952B432371146A97
SHA1:	ECD203B9364184C014A9C54BA9B9906C017A2B36
SHA-256:	51DA4CF9C952F428670DCDC557BA89534B46EAA8C3927EF8FF54F03BA3FB3195
SHA-512:	B4B12E902C92F1E14B7E23709784A9DD136969864B2042BE5ADFC264585FF441597468B3C76B2214A888A28246B6B9BE8A1AC43813080BE54A5370E013364DB8
Malicious:	false
Preview:	"use strict";..module.exports = require("./is-implemented")() ? Array.prototype.fill : require("./shim");.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\fill\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.865319642472349
Encrypted:	false
SSDEEP:	3:jTqhBBbfasHv0MDFwhEH3MJwYSEJL5f+gxMLrHYUd4iYo0QIeer:4B71qeYwYkgQr4UmiP0dBr
MD5:	B60947342ED6CCF21863DCFF11A1332B
SHA1:	39AB5C3A8067C149612CC1B5C4FCD596637F2EDA
SHA-256:	AC46C51C541B2DA3FE180032DF23F154F990A7C6AA9B9B026C75A354122AFE54
SHA-512:	0D08E71CFF7CDDC29B58AF2A31436BD9AFC9BA967801E1E68ED30226D1E275DE1A7206FC74AB83D2E09BD70CFA9275877EA30D6E93BAC9FEDBA6D72BF507B7D1
Malicious:	false
Preview:	"use strict";..module.exports = function () {..var arr = [1, 2, 3, 4, 5, 6];..if (typeof arr.fill !== "function") return false;..return String(arr.fill(-1, -3)) === "1,2,3,-1,-1,-1";.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\fill\shim.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	753
Entropy (8bit):	4.827815048984387
Encrypted:	false
SSDEEP:	12:jSQ2s4BKqRXDepLkDDpIxqtNkIJtCZGJ0YBWvDDKeDcqyX+SONnAVySrbXhcFmRi:OvBKok8W5Iv3BWnKeDcXXfjVPrzhcFXF
MD5:	1005BF8BAD71ACD5832CAD9A87979D74
SHA1:	70DAA53EA73823630E3D4E1FE4CD8BBB9E91D831
SHA-256:	F318EBDEAB7026F14F60DF0A4DBD84B1DFDABD11C36A3E22D79277C3D659D863
SHA-512:	898376AB0B9130B9584BADDE2506518E1638E19CD47A1B59C5951015FEF0E3B3A8E31873165ABD015AB019884B74ED42683D0851C037968E590DCB2DB4FA963D
Malicious:	false
Preview:	// Taken from: https://github.com/paulmillr/es6-shim/.."use strict";..var toInteger = require("../../../number/to-integer"). , toPosInt = require("../../../number/to-pos-integer"). , validValue = require("../../../object/valid-value"). , max = Math.max. , min = Math.min;..module.exports = function (value /, start, end/) {..var arr = validValue(this).. , start = arguments[1].. , end = arguments[2].. , length = toPosInt(arr.length).. , relativeStart.. , i;...start = start === undefined ? 0 : toInteger(start);..end = end === undefined ? length : toInteger(end);...relativeStart = start < 0 ? max(length + start, 0) : min(start, length);..for (i = relativeStart; i < length && i < end; ++i) arr[i] = value;..return arr;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\filter\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.8546734680482215
Encrypted:	false
SSDEEP:	6:0iPbeA4oLFVosqJCCkE3Yc6nLTewFR5FX9DE7xuOfFR15Md:PTQqX3A3o7FnrDIfBMd
MD5:	BA1AE7DB0D68D8675DB573B533163276
SHA1:	741832BBA9D7224C13DAE79A56DA4022179423C8
SHA-256:	099291000009A2544AA21F17A9E219770E464D16FC510D66F191BC1324C647E9
SHA-512:	06072DCA10B2D17D79ADD6ED249DA0864B84BDC89895CF8410702D8A0F32448359E01D1C3161F945A9AD28285541EBEA5755F60D8C9E08847E6654CBEEAE70FE
Malicious:	false
Preview:	"use strict";..if (!require("./is-implemented")()) {..Object.defineProperty(Array.prototype, "filter", {...value: require("./shim"),...configurable: true,...enumerable: false,...writable: true..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\filter\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	108
Entropy (8bit):	4.579499629176509
Encrypted:	false
SSDEEP:	3:jTqhBBbJAXPbJYRAKaOIE69sqLcRWtQUpANcw:4BWPbeA05osqLcRWa1cw
MD5:	519D1359D9AE01F2EC02D136F9A75793
SHA1:	4FB3018F8382C212348C149668E7AA30D3A928F7
SHA-256:	F516C64FA93A7552F6C6AC76BCB0D130247C99050B375F485C378E14DF5DD0F0
SHA-512:	4F2344598A6B5633ACC3470E8CFBC5E55E24CBA82DEDB9B4A03C7D228E79E99D40CA5D0199D4587DFF6E78B23FB1440F67BFD19BBCF1386A94598F4E7BB1F378
Malicious:	false
Preview:	"use strict";..module.exports = require("./is-implemented")() ? Array.prototype.filter : require("./shim");.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\filter\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	205
Entropy (8bit):	4.687550891458064
Encrypted:	false
SSDEEP:	3:jTqaF2QiiHpA+LFWQHMHrQrZizsaaXARQbrsDzBbfaaXARQbx12QEVeLcReZWlLu:zsQRYzBRVzBURG3EfReZKLXGbRD
MD5:	52B2CA6B0F1C8022F5CE417130B22CEC
SHA1:	8539C00890FC87777CE7690D053FDF93C1FA6740
SHA-256:	AC9C5177B8D16BFFC642997C4BDEEB4BC52C6CCD5A3E97A9CC8903F9F82AC687
SHA-512:	BB3093FDD7E5CB04DA9325DA59FA49245DE964D2DB825AAB2BA70713EE2821C98C3C75F0771C3058D7D956F376BE5B130E9AE24A354264B5F0A9F3F400838532
Malicious:	false
Preview:	"use strict";..var SubArray = require("../../_sub-array-dummy-safe"). , pass = function () { return true; };..module.exports = function () { return new SubArray().filter(pass) instanceof SubArray; };.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\filter\shim.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	698
Entropy (8bit):	4.8800399916983075
Encrypted:	false
SSDEEP:	12:RP6I8pokbCp8XeNNcRiEOllKXVIBTvU5ixi+6rS4qWNxN2bFdqYn2Ws6r:RY3bwnN9veCBTv0siz240FYi2Ws6r
MD5:	9A53475E5FC1B07A5EAD2103AFB7E1FF
SHA1:	7BD73733E73F7EF1ABB8F96CE9F4224EC447E99C
SHA-256:	AB9A500CAFF907CE5B8040C6C73164F4044B0FAF94777AD8388C1A4C0B33D67B
SHA-512:	6490C93B5D86B0EBFA01421D36F6D22DD174395B3C7FFEE83FC74FEE6D2ACAA526A602EA783804EC145F78465D63573DD4C06C456EE32077DAD08407B7CCDFC3
Malicious:	false
Preview:	"use strict";..var isPlainArray = require("../../is-plain-array"). , callable = require("../../../object/valid-callable"). , isArray = Array.isArray. , filter = Array.prototype.filter. , forEach = Array.prototype.forEach. , call = Function.prototype.call;..module.exports = function (callbackFn /, thisArg/) {..var result, thisArg, i;..if (!this \|\| !isArray(this) \|\| isPlainArray(this)) {...return filter.apply(this, arguments);..}..callable(callbackFn);..thisArg = arguments[1];..result = new this.constructor();..i = 0;..forEach.call(this, function (val, j, self) {...if (call.call(callbackFn, thisArg, val, j, self)) result[i++] = val;..});..return result;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\find-index\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	203
Entropy (8bit):	4.921624084783489
Encrypted:	false
SSDEEP:	6:0iPbeA4oLFVosqJAAwyE3Yc6nLTewFR5FX9DE7xuOfFR15Md:PTQqXnX3o7FnrDIfBMd
MD5:	599C39CE9C68C5D306FDD26CA0ACE3F6
SHA1:	CE802D94ACB8AEF1B7C608724B235DD472775D0F
SHA-256:	7700B54F7C658623D9546E4B35E9764AEB0A30A396A2A7F0ABFBE90563D8C236
SHA-512:	DD13000D2DA8B652149BDD4E655D79920459501B8C6356D61EAEA73929AA3FD884684FF347F93581D175CEE6D0D5A539D2A4F135A9A2D95A8B84A5A70A7D9B13
Malicious:	false
Preview:	"use strict";..if (!require("./is-implemented")()) {..Object.defineProperty(Array.prototype, "findIndex", {...value: require("./shim"),...configurable: true,...enumerable: false,...writable: true..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\find-index\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.66729672313729
Encrypted:	false
SSDEEP:	3:jTqhBBbJAXPbJYRAKaOIE69sqLeaLQXAUANcw:4BWPbeA05osqLeACA1cw
MD5:	4F66EC39C480193503709C899273ACFB
SHA1:	2BD4B1ED38FE15FA65A965A7F8E968DCBC3BBA0C
SHA-256:	6E26680F8FDDAD3DD3C39A8560D88D2B025BEA9BB2C651D2B56D9004831667C3
SHA-512:	735C58070C908C51404344EA886EFB1A0D14DE0B61E5C6BA6F93F901DECBC7BBBC476119DBC59F298759796C7F5F06113F0CBE14B54E96D3CF6881F6939B0516
Malicious:	false
Preview:	"use strict";..module.exports = require("./is-implemented")() ? Array.prototype.findIndex : require("./shim");.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\find-index\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	219
Entropy (8bit):	4.748021526847547
Encrypted:	false
SSDEEP:	3:jTqaFDxYFJamFXQbpgZWTa3zBbfasHv0MDFwhEH3MLBqcSEJL5f+SXbQLBqyM0RD:jxYFYyXtZPzB71qeaAckSreAM+w
MD5:	B4D937FB80A10BD0C3AE01CCA773E7E6
SHA1:	D61F45502971C69643B70CDAC723B9F610E548A9
SHA-256:	3FEDC6158DB2E57EBE3E99AF82BA65F0DF8527477F35E6A914E85A52C7B44360
SHA-512:	47E06893C4DA34D8AAB1C271B3C26DE881C15DBDEBF3C968635E55B00DC612D6DE6951CC9E53EEE2D4DB0900C0649CDD344119FD03BAB2F6A9B00C224F12F6DC
Malicious:	false
Preview:	"use strict";..var fn = function (value) { return value > 3; };..module.exports = function () {..var arr = [1, 2, 3, 4, 5, 6];..if (typeof arr.findIndex !== "function") return false;..return arr.findIndex(fn) === 3;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\find-index\shim.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	540
Entropy (8bit):	4.897662172179002
Encrypted:	false
SSDEEP:	12:8kbCuOtNkIJtC/FFKXVszBUB3fiz/OFhAesjfFgz5ryb:Tb9IvEsSzBY3azahAjN4Mb
MD5:	93B3EDAD8C48AB22C2F301A9B9C121BE
SHA1:	58E7B4FF9179D5326AD3E6584FCABB74D2F26E59
SHA-256:	0F3C469A78739A9F2414C6221D1FE1AD99A6EA4AA2FEB7A6571E8C440D27118B
SHA-512:	73736184FB5731DFC95EFDAD98DE494492FA9163ED79F7AAE1F70850519AD5EDCB0F2125B2F975E975CF489B3644C7A3FFB464CE8D6DF0936370D067D7F8577C
Malicious:	false
Preview:	"use strict";..var callable = require("../../../object/valid-callable"). , ensureValue = require("../../../object/valid-value"). , some = Array.prototype.some. , apply = Function.prototype.apply;..module.exports = function (predicate /, thisArg/) {..var k, self;..self = Object(ensureValue(this));..callable(predicate);...return some.call(...self,...function (value, index) {....if (apply.call(predicate, this, arguments)) {.....k = index;.....return true;....}....return false;...},...arguments[1]..)...? k...: -1;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\find\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	198
Entropy (8bit):	4.882418107097159
Encrypted:	false
SSDEEP:	6:0iPbeA4oLFVosqJA9gE3Yc6nLTewFR5FX9DE7xuOfFR15Md:PTQqXfB3o7FnrDIfBMd
MD5:	8A5BDBCF53D1A8DD9B579E49FD42779A
SHA1:	7E2FA47B4C3173BB1EBF6C55BBAB041257FA1F42
SHA-256:	56FD960133BF1574399A4D19417E99F2F1902CF8C408D67C4E3BAA16860A5127
SHA-512:	6948081B87684ED32CD0E572AA8680645755DE35CB9D718934775BCD582BAF1DA0FC628283DA12A35B5F8C26B0ECDD077115C4BF060AE1013C024AE0033728FA
Malicious:	false
Preview:	"use strict";..if (!require("./is-implemented")()) {..Object.defineProperty(Array.prototype, "find", {...value: require("./shim"),...configurable: true,...enumerable: false,...writable: true..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\find\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.62278439142189
Encrypted:	false
SSDEEP:	3:jTqhBBbJAXPbJYRAKaOIE69sqLezfpANcw:4BWPbeA05osqLezAcw
MD5:	D9404F8926C5A588CC87757A53B9414A
SHA1:	7819064D68D9ACF038FD52B32C8E94476190E260
SHA-256:	15D3846B0BF17996547D95CADA160AB0D43CAF1D3A59F2EBEE28617527E574DD
SHA-512:	465A20ECD72CCAB5888F78DEDF1A29BCC3EA39C0B72D31199D48E9F372D29B7003664C1D7E8D220FB648F970D9B55DD443E08B393AB2E87138524797A803CE96
Malicious:	false
Preview:	"use strict";..module.exports = require("./is-implemented")() ? Array.prototype.find : require("./shim");.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\find\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	209
Entropy (8bit):	4.701621275437964
Encrypted:	false
SSDEEP:	3:jTqaFDxYFJamFXQbpgZWTa3zBbfasHv0MDFwhEH3MLBnYFgSEJL5f+SXbQLB6YPk:jxYFYyXtZPzB71qeaFdkSreoYPav
MD5:	92A4241CF096E0651046CF02537ABF35
SHA1:	613A1F58F4C5B6B0FEE1D6D793D49573AA486AE9
SHA-256:	6038B921CBE624C7AEBFBC25E5046781D7B91C20AA90BC6308D38D53531DF074
SHA-512:	624CB1A18BA48E49ECC78A624207F296B1ACB37D7C3C1EB482DC744DAB0D982C4ED747522C9397259D4F7478EF966DB74F0AC674B32994842A0D38523BAE6579
Malicious:	false
Preview:	"use strict";..var fn = function (value) { return value > 3; };..module.exports = function () {..var arr = [1, 2, 3, 4, 5, 6];..if (typeof arr.find !== "function") return false;..return arr.find(fn) === 4;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\find\shim.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	258
Entropy (8bit):	4.84477321631416
Encrypted:	false
SSDEEP:	6:jJMnVlIUfNWQaBBUB3kf7jcRMqQaGcW0v:VolvfNWQYBUB3e7jcBXv
MD5:	CB79AA52C5F41A13277EFF05352C2188
SHA1:	714021B6D47CC862B6AB21B95B55D04701B44C7F
SHA-256:	D51F87DB9CBE32993E6E01EE97CFC94602ED8E437FF24FEA1CC3E9B4472C966E
SHA-512:	14AC1ECE9E2E68E35E01AD5C69C1BD5E34FA8DCAC56FC41902CC229886CD154F925152B33DFEF1D29FE0D5641FB1004DE36BF29B5ACF2966A9F52E9ED0854513
Malicious:	false
Preview:	"use strict";..var findIndex = require("../find-index/shim");..// eslint-disable-next-line no-unused-vars.module.exports = function (predicate /, thisArg/) {..var index = findIndex.apply(this, arguments);..return index === -1 ? undefined : this[index];.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\first-index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	407
Entropy (8bit):	4.889922636436173
Encrypted:	false
SSDEEP:	12:xKuKmDpI1FehIJtC3P+QfB7lH2n1wbFFYr:xKupXIvedBZH+1wbFmr
MD5:	984B418E62DC65E7CDBCA061EA3737E0
SHA1:	9C01E4111F5AB55E47ABAFB3C9AD34D66C5444EF
SHA-256:	2F18C8462AA03814A2E0282A517E31E0B0EB07668013BCCF9CF3751DB32E8566
SHA-512:	A184B00C10FF59E02648BABC6C92A99AFC7BC4D0A38D18B188FFDF85760F59D899668C86DDF10578E74EBD17F1942A0676D2D9839834AA82BB87DE921B42B3FF
Malicious:	false
Preview:	"use strict";..var toPosInt = require("../../number/to-pos-integer"). , value = require("../../object/valid-value"). , objHasOwnProperty = Object.prototype.hasOwnProperty;..module.exports = function () {..var i, length;..if (!(length = toPosInt(value(this).length))) return null;..i = 0;..while (!objHasOwnProperty.call(this, i)) {...if (++i === length) return null;..}..return i;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\first.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.687951074789616
Encrypted:	false
SSDEEP:	3:jTqaFDRKKwAYMGIaKPIKzBbfaSF7QGsKvXMEDLQXLreSj20QGLBmMLXvzvn:jRKKdGIpP3zB07Kv/dSj20QGYEvDn
MD5:	C833D00B3B2278C90EABAD65421C214E
SHA1:	D5DDD9E38892E0601304D9D6D18A1B80A2802F05
SHA-256:	B2415A0140BD88D4A46551E812581EA46B6CDF6084F30951B2A71E2B368B4544
SHA-512:	844F8D7EEF48FC7D42EEF90309E09C1CEAD981D96E0EBB1010AF6F7A1259951ECDB40EBC23E6054BAD9CFE3BCF3402649DBD46B122D61EAB56AF062A0C25DDDD
Malicious:	false
Preview:	"use strict";..var firstIndex = require("./first-index");..module.exports = function () {..var i;..if ((i = firstIndex.call(this)) !== null) return this[i];..return undefined;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\flatten.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.889966225067801
Encrypted:	false
SSDEEP:	24:2onIvwHdBqbZZB8XaxjYk20DMN5TEMrwCMNr:lIvwHdYbOXanFDMNdEMrwCMNr
MD5:	684DCDD37979EDA98ED82933558B39E3
SHA1:	94FD02D8C3F010D721A18B276A3E5FFF170EA67A
SHA-256:	952BCB6F0CB3F9C376BCCC0FB8D670100F19D696404DE4BE5083AF33677C6FAF
SHA-512:	8D1FBB58B62D44B7881A1C600C111B1C1437F6491BF2A86F921DEDC3CE2C67BDC215B251800AFC36C1B7B7762A66C3409257C5644CDDC7F9F09D8D14D76606DB
Malicious:	false
Preview:	// Stack grow safe implementation.."use strict";..var ensureValue = require("../../object/valid-value"). , isArray = Array.isArray. , objHasOwnProperty = Object.prototype.hasOwnProperty;..module.exports = function () {..var input = ensureValue(this), index = 0, remaining, remainingIndexes, length, i, result = [];..// Jslint: ignore..main: while (input) {...length = input.length;...for (i = index; i < length; ++i) {....if (!objHasOwnProperty.call(input, i)) continue;....if (isArray(input[i])) {.....if (i < length - 1) {......// eslint-disable-next-line max-depth......if (!remaining) {.......remaining = [];.......remainingIndexes = [];......}......remaining.push(input);......remainingIndexes.push(i + 1);.....}.....input = input[i];.....index = 0;.....continue main;....}....result.push(input[i]);...}...if (remaining) {....input = remaining.pop();....index = remainingIndexes.pop();...} else {....input = null;...}..}..return result;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\for-each-right.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	587
Entropy (8bit):	4.901845148149146
Encrypted:	false
SSDEEP:	12:xKuKmDppOhbCI1FehIJtC3P+QWKXVIBryPYBWNzX0D/IJJVacv:xKup7qbQIvexCB80D/IJJYe
MD5:	E82E5C9F95BE5144E6002777EBDF34D8
SHA1:	C44B1C28CCE4D4000DD3D0F9599B413DF21FD6FC
SHA-256:	E3782374EBFFB79E5A6F5D1EFA7A4C1BE944BCFFD5A2EC9338A9CE72C94F4AD2
SHA-512:	FFDF64E6032E707C506C93315BF2B6FCA8796EC1D8D5713B75950B0A6198FD9738A061D06F66CD30B4A257500ACADB03EC788EB99A0CC1A5083D9563385BA979
Malicious:	false
Preview:	"use strict";..var toPosInt = require("../../number/to-pos-integer"). , callable = require("../../object/valid-callable"). , value = require("../../object/valid-value"). , objHasOwnProperty = Object.prototype.hasOwnProperty. , call = Function.prototype.call;..module.exports = function (cb /, thisArg/) {..var i, self, thisArg;...self = Object(value(this));..callable(cb);..thisArg = arguments[1];...for (i = toPosInt(self.length) - 1; i >= 0; --i) {...if (objHasOwnProperty.call(self, i)) call.call(cb, thisArg, self[i], i, self);..}.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\group.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	614
Entropy (8bit):	5.046258735208203
Encrypted:	false
SSDEEP:	12:jdFCxEF2eLQW+hbCI1FohIJtC1EOVEWKXVszBw3uvEtNRRHu7O5TO5IAO5TD9ryw:BdCbyIvYvKfSzBwlNbe4jAl8r
MD5:	316F357F92028341F525331BF17031C3
SHA1:	B26C4081B71FEDB4BEA9CFA03CEC9C42BAE732E0
SHA-256:	2F0986E17994885AB6B238FAA577F172CB0041CF2672FC51D1046A2BF94567B4
SHA-512:	811F2A3BF4BF2C2C45046469E5E81B25517694FBA2D1A4067A5EE1BB3A92DE0F200CFA29856156B711D61C5ABDAF3AA7083C667D9C378EBD51FA96C52038454D
Malicious:	false
Preview:	// Inspired by Underscore's groupBy:.// http://documentcloud.github.com/underscore/#groupBy.."use strict";..var callable = require("../../object/valid-callable"). , value = require("../../object/valid-value"). , forEach = Array.prototype.forEach. , apply = Function.prototype.apply;..module.exports = function (cb /, thisArg/) {..var result;...value(this);..callable(cb);...result = Object.create(null);..forEach.call(...this,...function (item) {....var key = apply.call(cb, this, arguments);....if (!result[key]) result[key] = [];....result[key].push(item);...},...arguments[1]..);..return result;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1321
Entropy (8bit):	4.734234689329802
Encrypted:	false
SSDEEP:	24:4BVbPHCSYdIluDseqF8TIoUKgz52y0MWQkaZImNeB9S2CDn:4CRIlUs1FYB6529MSswRCD
MD5:	F1003E1083A772F926BF6DF53FBA1151
SHA1:	45475FA500937B1AA854A593A46BAE4F7CD6076C
SHA-256:	ECAE5065DAA6018AEF68ACC1EAB9B6847098B13E9D0E6DF2CF7B5C32AD05E671
SHA-512:	F7E493E6E790CD1F1BA568EC4A352DAB6BCDFEB268717A370E22A334DFEA7632DB4224AD17C8DA3FD7A71D09B96061CF5251093876DE46F3CFFE0A150A5629EC
Malicious:	false
Preview:	"use strict";..module.exports = {.."@@iterator": require("./@@iterator"),.."binarySearch": require("./binary-search"),.."clear": require("./clear"),.."compact": require("./compact"),.."concat": require("./concat"),.."contains": require("./contains"),.."copyWithin": require("./copy-within"),.."diff": require("./diff"),.."eIndexOf": require("./e-index-of"),.."eLastIndexOf": require("./e-last-index-of"),.."entries": require("./entries"),.."exclusion": require("./exclusion"),.."fill": require("./fill"),.."filter": require("./filter"),.."find": require("./find"),.."findIndex": require("./find-index"),.."first": require("./first"),.."firstIndex": require("./first-index"),.."flatten": require("./flatten"),.."forEachRight": require("./for-each-right"),.."keys": require("./keys"),.."group": require("./group"),.."indexesOf": require("./indexes-of"),.."intersection": require("./intersection"),.."isCopy": require("./is-copy"),.."isEmpty": require("./is-empty"),.."isUniq": require("./is-uniq"),.."l

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\indexes-of.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	276
Entropy (8bit):	4.9639216487731606
Encrypted:	false
SSDEEP:	6:61Mx33zBWvfexeivnUQOZyNrZFTq37Fx7WkmLdvEqr:61Mx33zBWvTIn2kNFo7WkmLd/r
MD5:	888846F6889E32180A9F6E06239B3CD0
SHA1:	8CF0B0795DB5BE3E91C5A0B709EF984132E4B5F9
SHA-256:	4901774986047C2B908EFDEF78F9819699441291FAFE52039FE96FF79C324FF5
SHA-512:	4290A02A38889192D093E33578B3EA2A0FBBDDF9F7D1B07F9DF11443F22A200520743480A6B3D69075A37049752B7A4713E8906BC783986969A0F7213B2E38E4
Malicious:	false
Preview:	"use strict";..var indexOf = require("./e-index-of");..module.exports = function (value /, fromIndex/) {..var result = [], i, fromIndex = arguments[1];..while ((i = indexOf.call(this, value, fromIndex)) !== -1) {...result.push(i);...fromIndex = i + 1;..}..return result;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\intersection.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	588
Entropy (8bit):	4.887068154321224
Encrypted:	false
SSDEEP:	12:6FohIJtCt98BTmrQexJcRklfrjEBKHyXuClM8eq+Mbrl:9Iv/BiJF0BKSvH7l
MD5:	EAD38378FE32A8AE2CF071A2D6550A84
SHA1:	12938810C98203E8CF9323E5075C46E3697CAE0E
SHA-256:	609D9AE6D1CC6DA8E75E895EDFFB06D19CFDB0D09BDE56BDADC17EF9CA4441CB
SHA-512:	44F512074E4A7F2B0A0743748CABF446C3ACB29F411BA36EB675029514903946D9F78455409A2208960CDA7AE560A5AD193AEC33D8FD1819946858EC37AD9300
Malicious:	false
Preview:	"use strict";..var value = require("../../object/valid-value"). , contains = require("./contains"). , byLength = require("./_compare-by-length"). , filter = Array.prototype.filter. , push = Array.prototype.push. , slice = Array.prototype.slice;..module.exports = function (/* .list*/) {..var lists;..if (!arguments.length) slice.call(this);..push.apply((lists = [this]), arguments);..lists.forEach(value);..lists.sort(byLength);..return lists.reduce(function (list1, list2) {...return filter.call(list1, function (item) { return contains.call(list2, item); });..});.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\is-copy.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	610
Entropy (8bit):	4.882139426874197
Encrypted:	false
SSDEEP:	12:xKuKmDpC/I1FehIJtC3P+QfB3XswiKufLb+VbFh6bBJ/:xKupqIvedBHTiZfX6bFEd5
MD5:	66F446EB57E34E245D9022590614E0D8
SHA1:	41EB4FF7CA795C237C8175A19F96EA822D0C3A77
SHA-256:	23D5E61BC7EC4965CAEEE922C601408B09B40F8192056B67B8A2693CCC23D139
SHA-512:	43E95575D09BD92BA60A8AABE8A57C1785FF946BB11E1D3D1C3D7FF67FCB1F9F4D74EA39B029237726C7E37E04A703633769E6C3106B2330A9A18442E7B09DD3
Malicious:	false
Preview:	"use strict";..var toPosInt = require("../../number/to-pos-integer"). , eq = require("../../object/eq"). , value = require("../../object/valid-value"). , objHasOwnProperty = Object.prototype.hasOwnProperty;..module.exports = function (other) {..var i, length;..value(this);..value(other);..length = toPosInt(this.length);..if (length !== toPosInt(other.length)) return false;..for (i = 0; i < length; ++i) {...if (objHasOwnProperty.call(this, i) !== objHasOwnProperty.call(other, i)) {....return false;...}...if (!eq(this[i], other[i])) return false;..}..return true;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\is-empty.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	201
Entropy (8bit):	4.692401040107267
Encrypted:	false
SSDEEP:	3:jTqaFA7BkhHpA+LakBpQGsKCFXAUpAYMGIaKPIKzBbfaaXARQb5cK5kkAeISFk8:4BwakBpQ7KCeGIpP3zBURfK5kR0Fk8
MD5:	163278450D51F06E6BA0EA0FF4522CF2
SHA1:	691C35D0CD055F3DB05A538ABC11A0C6EC21C919
SHA-256:	4BFA3320E83F5EDEE8B989F43889D7FCC3A5EB502D30EC4A87A79ABCD56DC289
SHA-512:	73989C7892983A6350585E54EF7AA0CA53193D4F8AB26F0778B9FEAB3BE0ABBAA6AF72DCB527006FCB58FAF89ACC9912D2330841E98EC2AC3566189A2DCC6904
Malicious:	false
Preview:	"use strict";..var ensureArray = require("../../object/ensure-array"). , firstIndex = require("./first-index");..module.exports = function () { return firstIndex.call(ensureArray(this)) === null; };.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\is-uniq.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	261
Entropy (8bit):	4.680129819135472
Encrypted:	false
SSDEEP:	6:61MgFLRgsqLnM3/DeZjSBGyNrZFTqE24zBURNtfZFrMw:61MkUM3/YjWNFg4zBahFYw
MD5:	BA2110794E0578A72EDBC84562EC6FFD
SHA1:	65D9EAD39AD22732C883A5D1CFA7ED8ED1B8E38C
SHA-256:	C61B8B72C29D93CD25BEEA538056E33AA9E43B4AEB091B4B44F5E56ADA54BB8C
SHA-512:	96D6B6BCB2D94E08D96BD3F17C039729C5642C9994A45B7A8E4B9BE38B63E300DD5BD72452B3A12C91D059B078E6892B823860DBDDA57DDD70F013DC82BC7701
Malicious:	false
Preview:	"use strict";..var indexOf = require("./e-index-of"). , every = Array.prototype.every. , isFirst;..isFirst = function (value, index) { return indexOf.call(this, value) === index; };..module.exports = function () { return every.call(this, isFirst, this); };.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\keys\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	198
Entropy (8bit):	4.891150222754515
Encrypted:	false
SSDEEP:	6:0iPbeA4oLFVosqJhVyE3Yc6nLTewFR5FX9DE7xuOfFR15Md:PTQqXy3o7FnrDIfBMd
MD5:	ED7918136C262B356A53989C1B868CCC
SHA1:	4803A1F100B3F13A4941587A003011D10534094E
SHA-256:	C2883C630DF8818740AEEDF758B0A942CC04FB277CB7511E987640A123222BB3
SHA-512:	FBA0327C4A5CFAB1C3022BB3D54DD2755AF5ED9E21761505B8ACB218331AD8DE1FA8718B40454FC82C1E1249AF14A3FF79E343281A39F7AAF1555597393E2FEE
Malicious:	false
Preview:	"use strict";..if (!require("./is-implemented")()) {..Object.defineProperty(Array.prototype, "keys", {...value: require("./shim"),...configurable: true,...enumerable: false,...writable: true..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\keys\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.597084134030782
Encrypted:	false
SSDEEP:	3:jTqhBBbJAXPbJYRAKaOIE69sqLvccJANcw:4BWPbeA05osqLicw
MD5:	40715F8AFDDE8F7BF04794CE3583703A
SHA1:	AA3742C9DC04EC863368FC1A43A323DC928BACAE
SHA-256:	3D784CB7AAAE415AFCE0CA06397EF9ED6B1C568CBD434ACE33C8AC21C331AE97
SHA-512:	6E96739B0D61CB45A379BC25312477AD02E63ED20C1DAD953A9690D1FF7700E962F734E3A58EB7433064506C6ED6C2F5E1E45A68460BF15E6C136F2B28DF0865
Malicious:	false
Preview:	"use strict";..module.exports = require("./is-implemented")() ? Array.prototype.keys : require("./shim");.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\keys\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	401
Entropy (8bit):	4.510604125948633
Encrypted:	false
SSDEEP:	6:4B6Q8X71qe6JYeXWTXEQR17XSaAU3XWIJTLbQ/4:4BRG7cXSImZ1TSdUnWIZV
MD5:	02FF6986E0ED3608A8900CD6D62CBDC1
SHA1:	1DF7708D8EC545C510288285A77C2F4899269514
SHA-256:	72DB7F43B9AFE0EA74F3769B395B0C48B1F715531278E7E98B7CADE9FE367D8C
SHA-512:	6AFFB88ED14C524313EC8FA966F8DD1E6C2687095F35BF6DD9305D80138E0BE14939842A91275408570EDC18F63C2368FCF47718745145B2E02367866B394CC4
Malicious:	false
Preview:	"use strict";..module.exports = function () {..var arr = [1, "foo"], iterator, result;..if (typeof arr.keys !== "function") return false;..iterator = arr.keys();..if (!iterator) return false;..if (typeof iterator.next !== "function") return false;..result = iterator.next();..if (!result) return false;..if (result.value !== 0) return false;..if (result.done !== false) return false;..return true;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\keys\shim.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	139
Entropy (8bit):	4.570641176717313
Encrypted:	false
SSDEEP:	3:jTqaFkXX3gjiLsX9/Qb0BbfaaXARQbx1kkMX3tLHO5scn:Y3grX9/Qb0BURG5W3BHY
MD5:	D55709BDCFF8067953BBE2B1CA54F65D
SHA1:	4F0248978B8C277CF19572A942D6F27F99EE3212
SHA-256:	D289D8D2713AA32726C6067D772D1FEF55DEED3B5893AA908426B6F0F49FF012
SHA-512:	F3AAF2AB2775F16DC66377F930DFA6C74245DA5FA2A6E66CA951501708020B2CCD0EA9FD3B9EA577961151D75EE2F1A4F58F5AF719B7A20E97C0F8C1B2BE1DB6
Malicious:	false
Preview:	"use strict";..var ArrayIterator = require("es6-iterator/array");.module.exports = function () { return new ArrayIterator(this, "key"); };.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\last-index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	412
Entropy (8bit):	4.881802756251089
Encrypted:	false
SSDEEP:	12:xKuKmDpI1FehIJtC3P+QfB7lH2nHeqwbFFgTr:xKupXIvedBZH+HlwbFMr
MD5:	6369F9510909C844D3A0DC030F955C48
SHA1:	959CD036074D7B949824BC8E15DD61AB0A46A594
SHA-256:	FCD0E3ED37D7EEA2FEE1D5A927E590B3611DCD937FAF05E6628B914C32182F4F
SHA-512:	EED3256C2A167C000123B698641CCE0D53115E38136036B45C0431D9A51DFBEB5441300D0EBE3EC8997C20908BFA66E3D858F3774A0E1B6C4ACAC1A6C394CE5E
Malicious:	false
Preview:	"use strict";..var toPosInt = require("../../number/to-pos-integer"). , value = require("../../object/valid-value"). , objHasOwnProperty = Object.prototype.hasOwnProperty;..module.exports = function () {..var i, length;..if (!(length = toPosInt(value(this).length))) return null;..i = length - 1;..while (!objHasOwnProperty.call(this, i)) {...if (--i === -1) return null;..}..return i;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\last.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.716735682399985
Encrypted:	false
SSDEEP:	3:jTqaFJEWUAwASfBKPIKzBbfaSF7D6AvXMEDLQXLreSj20QGLBmMLXvzvn:pEWUAdP3zBCAv/dSj20QGYEvDn
MD5:	32F39185A356F955C0E09E9E20A0FF65
SHA1:	6B83BB93C62097DAA02BDF1E6C36063CD2892D7C
SHA-256:	5E55C252FF7FFDD7DEE8F24B1577057F3981EBFDE29A1A1156D0CFBB65090DD3
SHA-512:	659BEA117714CC53A912ED8EDCFCDB5E7CAFC1C5A2C586B49EEE6C3CB65C3390642119CDEDC23EC111D299C5367D59AC56473A9EE6D93E76336777186BF4D7B5
Malicious:	false
Preview:	"use strict";..var lastIndex = require("./last-index");..module.exports = function () {..var i;..if ((i = lastIndex.call(this)) !== null) return this[i];..return undefined;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\map\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.878670191728955
Encrypted:	false
SSDEEP:	6:0iPbeA4oLFVosqJdHJuE3Yc6nLTewFR5FX9DE7xuOfFR15Md:PTQqXQ3o7FnrDIfBMd
MD5:	D0B6184BD072FE2D66B177C56110DE7B
SHA1:	70E2D0A44A41A4D677BE7020A295FA04283B413C
SHA-256:	5751E04E83C6DAD98D4E4228DC05B94481922FE1B504A486A99F2304DD7466CC
SHA-512:	74A9320AE9934D7AE49FA27102AF1C793B04731FA79809514530282F4E6AA46D2F3149730FC498FD2359277EC6E17EDA46C18E85062D387FE8D82FC15ED45B7D
Malicious:	false
Preview:	"use strict";..if (!require("./is-implemented")()) {..Object.defineProperty(Array.prototype, "map", {...value: require("./shim"),...configurable: true,...enumerable: false,...writable: true..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\map\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	105
Entropy (8bit):	4.5859873587174285
Encrypted:	false
SSDEEP:	3:jTqhBBbJAXPbJYRAKaOIE69sqLLFaUpANcw:4BWPbeA05osqLLI1cw
MD5:	E0EB81B287B7C9EE827F9ABEC9681F36
SHA1:	89D90AE2D205DFC79B8148EFB44072B1649B12D2
SHA-256:	0DE4046C8F4E57B3AD9EEC5ADE843A3117CDEE51F353AB3F69DB2AA638440E78
SHA-512:	17F71FEAF761A3611E47E5B131D6C0687F3B9FDD267174D9454D7E4F1014D9215831295CEBD6676C8B22A3166A6DBAC193775247817A5D64E6DF3F915EF87B95
Malicious:	false
Preview:	"use strict";..module.exports = require("./is-implemented")() ? Array.prototype.map : require("./shim");.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\map\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	215
Entropy (8bit):	4.758680705082547
Encrypted:	false
SSDEEP:	3:jTqaFMkiFBpA+LZG5svzOFiHpA+LFWQHMHrQwQKzBbfaaXARQbx12QEVeLLNAT6A:cFdUyvzTsQGfzBURG3Eo+hiGbRD
MD5:	156078800EAC022B14EAF2A645CCEAB5
SHA1:	9AA0F51047EA69A6FF4B73C16A28F61FFCB7A506
SHA-256:	919EC46B13590D76D00BA5393FFFF4BA8BB9F8F631BBC6C0C6A5DAC20F539748
SHA-512:	8EC940B950902F459E5EF7D72D528D47C837DF8EE10185A104060C152D199B6D4C0D9BC6C348FDA1E0A90E9F3B7111E3551DEBBEABCC0C6678ACC7151AEA4E6C
Malicious:	false
Preview:	"use strict";..var identity = require("../../../function/identity"). , SubArray = require("../../_sub-array-dummy-safe");..module.exports = function () { return new SubArray().map(identity) instanceof SubArray; };.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\map\shim.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	681
Entropy (8bit):	4.86311434856967
Encrypted:	false
SSDEEP:	12:RP6I8pokbCp8S/d9EOllKXVIBTB5ixi+6mgU4qWNxUbFdqDW7un1r:RY3bwNveCBTrsizW4gFYDW7Y1r
MD5:	8D2CB531DCF1D2EE10BC78D0AE96C904
SHA1:	2A54E8004E87B532F5106C68FBDC68463FC72C96
SHA-256:	A2869CCF5112E37E51DBAE8360E633A84B05BCDF4652CE2BA9B7ECAB30BE5C6A
SHA-512:	1934DB5C9B2858C59840BB835C65857422A6ED8AE6B219E11826AF950715AE1B6E887555ACAED045E0F8FC61E0F0EDE709D4ABEDFF779CCF4BC25C14B5FC4342
Malicious:	false
Preview:	"use strict";..var isPlainArray = require("../../is-plain-array"). , callable = require("../../../object/valid-callable"). , isArray = Array.isArray. , map = Array.prototype.map. , forEach = Array.prototype.forEach. , call = Function.prototype.call;..module.exports = function (callbackFn /, thisArg/) {..var result, thisArg;..if (!this \|\| !isArray(this) \|\| isPlainArray(this)) {...return map.apply(this, arguments);..}..callable(callbackFn);..thisArg = arguments[1];..result = new this.constructor(this.length);..forEach.call(this, function (val, i, self) {...result[i] = call.call(callbackFn, thisArg, val, i, self);..});..return result;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\remove.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	388
Entropy (8bit):	4.999796565918862
Encrypted:	false
SSDEEP:	12:61Mk1EOYKDnOhYlvfNWQYBGZEnRJTANFitwuFaGez:urv8gEQYBgEkFiquFaP
MD5:	F6BDF3363669514314BBEBAEAF54D4F6
SHA1:	F8B3776B0CD39D87D151A7892D9737A0D9CDDDBB
SHA-256:	B53510EE18C7498162F7A9E02AE11A3DFC3A5A5A86E207B19D1974D4BCBDE112
SHA-512:	05CFD1022A5F3F64F42D40CDC01C0BC5614A4BE41363B479B9E8591C9D5F97A95C3E3FEFF1F1E9726DC2AA7BD461B75E2879CF9B078960F5A55F96510AB1AB84
Malicious:	false
Preview:	"use strict";..var indexOf = require("./e-index-of"). , forEach = Array.prototype.forEach. , splice = Array.prototype.splice;..// eslint-disable-next-line no-unused-vars.module.exports = function (itemToRemove /, .item/) {..forEach.call(...arguments,...function (item) {....var index = indexOf.call(this, item);....if (index !== -1) splice.call(this, index, 1);...},...this..);.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\separate.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	205
Entropy (8bit):	4.729686969360861
Encrypted:	false
SSDEEP:	3:jTqaFDMIYqB9sqL1vMvfBBBbf2dYRNTxXJFDQyXa3FQJt9sjpFYfvsX8jS2pBPvD:jlYgsqLM7BieNTxZFDZq3qCpifv2whr
MD5:	34B5A384CCF6BC0388420DDB19F57DCE
SHA1:	D0FA9C1261AE9EEE0D0A51A92C1AC9ABBA36D15D
SHA-256:	310932786B2A31AA073C069DF7F2462EDF6C3B83253B4914FDA9680654A1C441
SHA-512:	D848A32D2E1FD35AE2A900882FC231B5A560DDDE692503ED4D4F396C4DDFCF1E79169B622935BE40D7E5A889B52A8DF0E376FC8EA6F7813D8E56E119B01AB725
Malicious:	false
Preview:	"use strict";..var forEach = Array.prototype.forEach;..module.exports = function (sep) {..var result = [];..forEach.call(this, function (val) { result.push(val, sep); });..result.pop();..return result;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\slice\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	199
Entropy (8bit):	4.867071640761832
Encrypted:	false
SSDEEP:	6:0iPbeA4oLFVosqJ5lyE3Yc6nLTewFR5FX9DE7xuOfFR15Md:PTQqXg93o7FnrDIfBMd
MD5:	59C2AAE706F3FEBB3BF2C92BD4198E5D
SHA1:	C2C8CF6C9CFB95B162A525C620838584946C3DCC
SHA-256:	CA23E6B102BB0CC6170F0CC9F63804B8AF46C6EE3FD571CCCD9E4B5ECCE6B4EC
SHA-512:	75CFE4E6A0AF608453C71C45336A1F2A9E25F51D40F03A1E49DA3DF28ABDE0589126B8F3B231C9A1608FC01CA8B7E14FF38BA84DA2D0A1504B519A90A87E4B3C
Malicious:	false
Preview:	"use strict";..if (!require("./is-implemented")()) {..Object.defineProperty(Array.prototype, "slice", {...value: require("./shim"),...configurable: true,...enumerable: false,...writable: true..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\slice\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	107
Entropy (8bit):	4.573145870265513
Encrypted:	false
SSDEEP:	3:jTqhBBbJAXPbJYRAKaOIE69sqLOMPQUANcw:4BWPbeA05osqLOMacw
MD5:	0DB7794F1E762A103FDB56965F8D011A
SHA1:	BD598D3AD9326E8A6B3C9A2643CBCA49E33EAE4A
SHA-256:	077C79CEF6126885DF9F00A3F04F540FF898676BFB3539B606877FAA7A3C65E8
SHA-512:	321AECACC0D3DA7E9B75F5761458458A6ABA1E5A7E87A346E0F1AB476097B773ACB86A9010CEA3B4C40C88121288029B9CCB7D597460B8A7BB48F6358BC9E917
Malicious:	false
Preview:	"use strict";..module.exports = require("./is-implemented")() ? Array.prototype.slice : require("./shim");.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\slice\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	156
Entropy (8bit):	4.778164666668702
Encrypted:	false
SSDEEP:	3:jTqaF2QiiHpA+LFWQHMHrQwQKzBbfaaXARQbx12QEVeLOM3ioGvDREVTw:zsQGfzBURG3EbMSoGbRD
MD5:	431C221CA855D6A482FC2D989F249AC4
SHA1:	89FB652290E7D1F748E434D54DA11AAC39867B41
SHA-256:	8E8BFAD05422DE9F621CBD079DE34D595564449FE034F9D7240A9D7B46D03C29
SHA-512:	4913A93E7BBC8C98014D84AA79B5BCCDB777C9325EEB7A6FAB2763E95EA2950C07F495C9F0C0EE82A8858566E6C80CFC3BB2F16CDD588454A6989CE7F94BD164
Malicious:	false
Preview:	"use strict";..var SubArray = require("../../_sub-array-dummy-safe");..module.exports = function () { return new SubArray().slice() instanceof SubArray; };.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\slice\shim.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.7918658377024546
Encrypted:	false
SSDEEP:	24:xKmkiVlGjpUBVN0sizK3SyskIjTtwysWObFGW68QUr:xKawjpUXNt3jIjxObFRWUr
MD5:	6EDC68783E6E52E676C0C3DC45959B77
SHA1:	9FD8085DD38D4E53F2776AC0652C06108EB27370
SHA-256:	2B8726B764CD2B98372687E06C71B7ACF0FCB123F39A4D2B9C163B453C28F731
SHA-512:	FEACC0F847AB2CA266C6CF0E04DE44FCBB9582691342965CBA14164D7C2AE3489F70BD0EFA51F9002795613A57D1423E3CC82751226917552FA127AAB4BB1863
Malicious:	false
Preview:	"use strict";..var toInteger = require("../../../number/to-integer"). , toPosInt = require("../../../number/to-pos-integer"). , isPlainArray = require("../../is-plain-array"). , isArray = Array.isArray. , slice = Array.prototype.slice. , objHasOwnProperty = Object.prototype.hasOwnProperty. , max = Math.max;..module.exports = function (start, end) {..var length, result, i;..if (!this \|\| !isArray(this) \|\| isPlainArray(this)) {...return slice.apply(this, arguments);..}..length = toPosInt(this.length);..start = toInteger(start);..if (start < 0) start = max(length + start, 0);..else if (start > length) start = length;..if (end === undefined) {...end = length;..} else {...end = toInteger(end);...if (end < 0) end = max(length + end, 0);...else if (end > length) end = length;..}..if (start > end) start = end;..result = new this.constructor(end - start);..i = 0;..while (start !== end) {...if (objHasOwnProperty.call(this, start)) re

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\some-right.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	625
Entropy (8bit):	4.914946263719602
Encrypted:	false
SSDEEP:	12:xKuKmDppOhbCI1FehIJtC3P+QWKXVIBrySNYYBWNzX0D/IJJVxl:xKup7qbQIvexCB5NG0D/IJJPl
MD5:	585D8C233E9AEA8030AB133CF233D6C3
SHA1:	28198BA41E2CDD3C2E282BD9CB49E0596A30BAE9
SHA-256:	52CF5ADECE6974F54E256C92D12E21EF53650D53FAA2E6792B860B47CD42618D
SHA-512:	A7CA59E48B6910EC914A8B38E3B0D3E832FC2B6F8E77B05F59DFB6032A8D13CD69D407572F3F33E4B1864C8A5347D166C110FA2E625FE0B2586FBBA1EDD4E720
Malicious:	false
Preview:	"use strict";..var toPosInt = require("../../number/to-pos-integer"). , callable = require("../../object/valid-callable"). , value = require("../../object/valid-value"). , objHasOwnProperty = Object.prototype.hasOwnProperty. , call = Function.prototype.call;..module.exports = function (cb /, thisArg/) {..var i, self, thisArg;..self = Object(value(this));..callable(cb);..thisArg = arguments[1];...for (i = toPosInt(self.length) - 1; i >= 0; --i) {...if (objHasOwnProperty.call(self, i) && call.call(cb, thisArg, self[i], i, self)) {....return true;...}..}..return false;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\splice\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.870102772519632
Encrypted:	false
SSDEEP:	6:0iPbeA4oLFVosqJFVyE3Yc6nLTewFR5FX9DE7xuOfFR15Md:PTQqXe3o7FnrDIfBMd
MD5:	B981087A1D7562C07B82458483B6ED66
SHA1:	6EB8B168B4C3DBAB1AD822FAC6CCEC1F8ED95641
SHA-256:	B8B904EB0A08CF2136B8148D05D5809051666DF8BA6306FE9750BC81E48EE067
SHA-512:	4E03970FC2EF67365E37BB93B72FD1C152159398881F8F13A8A12DBDD71C1EBA3741A5A364BAF938CCA5447794B6A6CDBB7EAF6643C688F9B3FC527560205C13
Malicious:	false
Preview:	"use strict";..if (!require("./is-implemented")()) {..Object.defineProperty(Array.prototype, "splice", {...value: require("./shim"),...configurable: true,...enumerable: false,...writable: true..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\splice\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	108
Entropy (8bit):	4.573220836413936
Encrypted:	false
SSDEEP:	3:jTqhBBbJAXPbJYRAKaOIE69sqLSJMGAFtQUANcw:4BWPbeA05osqLSCXKcw
MD5:	B08393B4AAAFBBAE3A84C2D05212A8C9
SHA1:	62FB6EAF95D9CAACC7A0FEE57F96CA71144007E4
SHA-256:	189BEAB78A6CF917E76E39DEF8F557DC8A45D6A14AF504C2140C816660176346
SHA-512:	045E2C44F11E22285CFD791DE321D4923643EEBFA4B856080682AED87A1A19E85E437F91162647C9ECFE95D9DEDF66043CEAD1007C0421DC1284D94F2EA2C793
Malicious:	false
Preview:	"use strict";..module.exports = require("./is-implemented")() ? Array.prototype.splice : require("./shim");.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\splice\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	158
Entropy (8bit):	4.815622152340437
Encrypted:	false
SSDEEP:	3:jTqaF2QiiHpA+LFWQHMHrQwQKzBbfaaXARQbx12QEVeLSJMGANfioGvDREVTw:zsQGfzBURG3EHCXQoGbRD
MD5:	14A96974E325169B0AA89F22D60FBB0C
SHA1:	FB0916D13D23F3E933A1006BB3CD74029417B236
SHA-256:	640A264B5C7C670D9EFCCDF897B6E28027C55EF15C6D8335BE330CCA1481943F
SHA-512:	E1E98E4A967EC89E2D57D9A3B1C370080C2B40E71FA6E46F2903C74BFE0B88326212CC729D0DAE12EE130A665FD7C1427C553E4D3247B005288109187000C649
Malicious:	false
Preview:	"use strict";..var SubArray = require("../../_sub-array-dummy-safe");..module.exports = function () { return new SubArray().splice(0) instanceof SubArray; };.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\splice\shim.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	530
Entropy (8bit):	4.803397701540639
Encrypted:	false
SSDEEP:	12:RP6I8p8UNnNrEOlFrlvfNWQYBRs5vFEXQVSMG5ixiUoI9ZQAXWB2Xr:RaXTvdEQYB+HEfMesieZVmB2Xr
MD5:	6DEBADB9683052902E5BBBCCF10E337E
SHA1:	554F7D024D8AF71DE5DA7223A8660236F4FE22C6
SHA-256:	69301E696472B3627B0363FB4B72AD5267CA253030ECF84327827D21B659433E
SHA-512:	D1C14F5F0057949DBF2ABC8A8E0E90D05392525F02B33D9C1E313D319516CE64B48C270A4FDC0D5EF8E30090F8E0370B82FB543D421B4C10C4438EEE581F2612
Malicious:	false
Preview:	"use strict";..var isPlainArray = require("../../is-plain-array"). , isArray = Array.isArray. , splice = Array.prototype.splice. , forEach = Array.prototype.forEach;..// eslint-disable-next-line no-unused-vars.module.exports = function (start, deleteCount /, .items/) {..var arr = splice.apply(this, arguments), result;..if (!this \|\| !isArray(this) \|\| isPlainArray(this)) return arr;..result = new this.constructor(arr.length);..forEach.call(arr, function (val, i) { result[i] = val; });..return result;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\uniq.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	263
Entropy (8bit):	4.658337568076463
Encrypted:	false
SSDEEP:	6:61MgFLQeieLsqLcR8P/DeZjSBGyNrZFTqE24zBURUhrZFrMw:61MkQeieJcR2/YjWNFg4zBnNFYw
MD5:	0A8809429642C2B49CAFF6AFB560D478
SHA1:	1F866F7C1046F81C5AE703CEF3A4DED3CD4A0B1F
SHA-256:	9FDE1589CB903B322C111D29F9401AE0C4C86F88C833CAA8DE11C03C6AA2EB06
SHA-512:	3791D6CAD674310B5BB588699E390F37A135B89ED745B12FF10AB1EB46AC34AA48FDACBEE13E3E2D20FA87A50CD5AD0EDEFA10B9FC0A2189B5431F3113AF0530
Malicious:	false
Preview:	"use strict";..var indexOf = require("./e-index-of"). , filter = Array.prototype.filter. , isFirst;..isFirst = function (value, index) { return indexOf.call(this, value) === index; };..module.exports = function () { return filter.call(this, isFirst, this); };.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\values\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.875193699346397
Encrypted:	false
SSDEEP:	6:0iPbeA4oLFVosqJfJbyE3Yc6nLTewFR5FX9DE7xuOfFR15Md:PTQqXGL3o7FnrDIfBMd
MD5:	61F91C1D9CA00A9C04E5A52B74B69F1A
SHA1:	285D8C9847C0B1BD6D4080A295A3A6B361C84F10
SHA-256:	B81BE2E5A427AC9D7660ED0B3CC1AE9F13E3BA738A0A91964A2A7B30F8966445
SHA-512:	EC7C19C1673FF996E1BC0762F3C6135406FED1B1454AFD55B94B3AEBDD8F9A8DBDD830A272DA261EFEC0A5A6A54BABD46B7FDB74F3AA4CC4F69DA6EF3C5316C8
Malicious:	false
Preview:	"use strict";..if (!require("./is-implemented")()) {..Object.defineProperty(Array.prototype, "values", {...value: require("./shim"),...configurable: true,...enumerable: false,...writable: true..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\values\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	108
Entropy (8bit):	4.611569997988717
Encrypted:	false
SSDEEP:	3:jTqhBBbJAXPbJYRAKaOIE69sqL7ftjANcw:4BWPbeA05osqL7ftCcw
MD5:	EE703C8F2D6BDECE5CB505DE437EACCA
SHA1:	9576E38898223C625489B439BEF966AB5174AF59
SHA-256:	59F7CDACA7C9C76149F5F3E060E7BA63EB8B0E13A8F27617E4B65FB2E4C96DFE
SHA-512:	8575A7CE011838408E3CD4C0E4CEAFD6FCA2EDA2D33494E9A4BCE0398D238F20508D0B03A989987842C15F12969423F4ACEBCC0FC520249BB51BE043CCBCEF20
Malicious:	false
Preview:	"use strict";..module.exports = require("./is-implemented")() ? Array.prototype.values : require("./shim");.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\values\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	409
Entropy (8bit):	4.479971378590568
Encrypted:	false
SSDEEP:	6:4BgL9X71qeqCageXOKCXEQR17XSaAU3XWIJuRkbQ/4:4BgL17cXC7IOKUZ1TSdUnWIwRUV
MD5:	BCC4B1A4EA6E632DFE15ECBA6CC86E6F
SHA1:	96378A8DE2D385B6EBAF36933A5AED370F609892
SHA-256:	C73575DF8CBE39492AE7F834C8EA89CE5092DF24DF0C1AC89CFC10DF586F67C4
SHA-512:	5CE7D5E044DA0A2F0051DB75BBE8DFB241EFE1CA08745E778A3091693FD62F7F0FB1539CA50B80BF58364E040C6A271D3028FBB4A26AEAE1C391DFDB570A5478
Malicious:	false
Preview:	"use strict";..module.exports = function () {..var arr = ["foo", 1], iterator, result;..if (typeof arr.values !== "function") return false;..iterator = arr.values();..if (!iterator) return false;..if (typeof iterator.next !== "function") return false;..result = iterator.next();..if (!result) return false;..if (result.value !== "foo") return false;..if (result.done !== false) return false;..return true;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\#\values\shim.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.562260341122936
Encrypted:	false
SSDEEP:	3:jTqaFkXX3gjiLsX9/Qb0BbfaaXARQbx1kkMX3tLHThwn:Y3grX9/Qb0BURG5W3BHThw
MD5:	B6884E7051E5E9ACCE3583116EC28C02
SHA1:	26718E22E9C7F560BDB33B56F44F01BAA37399D4
SHA-256:	9E9FDA0A1D0E8BB7B8FE94A4C4A4D045D1AA53D75481252AD1952F626CDC0778
SHA-512:	45622D6EF2B42C08DEBE77587F2EF4A58AC18A4113F9300D41FE3B8377B462F0127C762FC2F66DE9FB42D679598ED02E0B30A8F6FD09A4617391319245D5E8DC
Malicious:	false
Preview:	"use strict";..var ArrayIterator = require("es6-iterator/array");.module.exports = function () { return new ArrayIterator(this, "value"); };.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\from\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.863252425965675
Encrypted:	false
SSDEEP:	3:jTqJiXPbJYRAKTOHPAGRKeJqXTXUIeiuE3yUANc6sGQQTewFR5FX9DEJpHRuJAfG:0iPbeA4oLFVIeiuE3Yc6nLTewFR5FX9d
MD5:	A02DC9EC0CEED14E9C9D442B624D4433
SHA1:	D215C7AA633A1817098276641D28CE61E2721301
SHA-256:	9F744F4CC9DD8C983856BD752EE02335DBA60961C024673F855DC7771C9CA98F
SHA-512:	32EB5F23C674ADC7B0D43C43A2AB2C3D8CFC9F2D1456E64FE41CA1D5230636A32D526F0B05D6EF39F45D6213CCA2249058569E94ED82A8D48DDC52DD20A6336C
Malicious:	false
Preview:	"use strict";..if (!require("./is-implemented")()) {..Object.defineProperty(Array, "from", {...value: require("./shim"),...configurable: true,...enumerable: false,...writable: true..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\from\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	96
Entropy (8bit):	4.598936757154083
Encrypted:	false
SSDEEP:	3:jTqhBBbJAXPbJYRAKaOIE6VJANcw:4BWPbeA05EYcw
MD5:	C49ED4BD4076B51A000660C2063C7DDA
SHA1:	B616C74FE9BEC028DA0FC20610C3ACC6D5711B87
SHA-256:	6C93AAC20F93EB5A111814BBB00608C00217EF51BC18B22550BDBC903952F0E0
SHA-512:	604F5F4D94DB94E2B1575FFB7BC44A6582CD61FC73B9CC0D627F8EE82232CC427B0B9403FEF0C0F20AB8919D3AD863A9516CD249A24CC56B269830428A891F65
Malicious:	false
Preview:	"use strict";..module.exports = require("./is-implemented")() ? Array.from : require("./shim");.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\from\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	243
Entropy (8bit):	4.675391628419093
Encrypted:	false
SSDEEP:	3:jTqhBBbfawTF5HBbUFQJ4vsMqhDXK4aHASEJL5fdZ2Au4euQtYJEXMwsXpxRKJjD:4BRPUd1qVXJaHA4AuTO+MPQDyh/h+V4w
MD5:	548B42E99D066506EC0DD698291923B2
SHA1:	CB04E9850F31DD2130E06A55170E64A52FBD4BB5
SHA-256:	EDCD7EAC7B33268097EA071E1374487F4AD3BD3DABEA96EED6725D5110448B23
SHA-512:	FA8AF3B766A54A4A0B969F01F987C9C52EAF53DDBEF3FFCE42257F61CA9516B9AD261D43B9EFD0F50F4973AC611FC5328F79CB85271313F74581FE974305D996
Malicious:	false
Preview:	"use strict";..module.exports = function () {..var from = Array.from, arr, result;..if (typeof from !== "function") return false;..arr = ["raz", "dwa"];..result = from(arr);..return Boolean(result && result !== arr && result[1] === "dwa");.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\from\shim.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3199
Entropy (8bit):	4.976036863616504
Encrypted:	false
SSDEEP:	48:JOvhe7AXEi5JK5WG+08nMqvAFNgBqXBQxzf48+PNeqUBtxNBa2HaJnqdnHP:h7AXEi5HIWqXOxL+leqUXxzMnqdHP
MD5:	12D9C44F8B9778B9FC034888A0C36F15
SHA1:	5E7F944499747C7A2245845066DDDE5181C874FB
SHA-256:	F1E0C96756FA34A81702E9F3062E44325E30DAFD704E3EDC269B25D04B5D1A25
SHA-512:	E08CFCFBBF246A683A3EAB33D88BDE2BA05BE352DFF34DAE58CE2E6F04E20225D175BC225ACD0D9CB06E47AB2A1A228A785D8B8D5129466171D17FF91E8F3607
Malicious:	false
Preview:	"use strict";..var iteratorSymbol = require("es6-symbol").iterator. , isArguments = require("../../function/is-arguments"). , isFunction = require("../../function/is-function"). , toPosInt = require("../../number/to-pos-integer"). , callable = require("../../object/valid-callable"). , validValue = require("../../object/valid-value"). , isValue = require("../../object/is-value"). , isString = require("../../string/is-string"). , isArray = Array.isArray. , call = Function.prototype.call. , desc = { configurable: true, enumerable: true, writable: true, value: null }. , defineProperty = Object.defineProperty;..// eslint-disable-next-line complexity, max-lines-per-function.module.exports = function (arrayLike /, mapFn, thisArg/) {..var mapFn = arguments[1].. , thisArg = arguments[2].. , Context.. , i.. , j.. , arr.. , length.. , code.. , iterator.. , result.. , getIterator.. , value;...arrayLike = Object(

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\generate.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	504
Entropy (8bit):	4.913784957201235
Encrypted:	false
SSDEEP:	12:xKu+pI1Fh3IJtCbrjEBuBFt0JCwH2jgEmeDzTeupZF8FYc:xKubIvs0BKPaRHZEj/CuvgX
MD5:	51425B147F83CF965B5578EAE97F497D
SHA1:	A47B49C25278CBF4D46E789BD60DA4EB22FF7D21
SHA-256:	157C612704EC026881A431AE442A15D2EDAC2F65D0A8418C62260B7535AE4EBE
SHA-512:	A6B6C762E1EC2DD3B02EFD8FE8BBA57BDA12510414D44F16504372D6F0FF548719E0C4CFE5FF11558512E559E6431BA6B8F21A17941C9ED3808086C856E7258B
Malicious:	false
Preview:	"use strict";..var toPosInt = require("../number/to-pos-integer"). , value = require("../object/valid-value"). , slice = Array.prototype.slice;..module.exports = function (length /, .fill/) {..var arr, currentLength;..length = toPosInt(value(length));..if (length === 0) return [];...arr = arguments.length < 2 ? [undefined] : slice.call(arguments, 1, 1 + length);...while ((currentLength = arr.length) < length) {...arr = arr.concat(arr.slice(0, length - currentLength));..}..return arr;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	268
Entropy (8bit):	4.666756320636107
Encrypted:	false
SSDEEP:	6:4BSB0D7AKMUvVNiCP/kebSmR/NCX1rgy4GCBI9:4BD7AcPiCDv7CFrgy4T+9
MD5:	7B6BD7DBC62AFA17EDDAA3274E93ADE8
SHA1:	25B8B1143BCB0DA04307CB0B64FE96D364FF9954
SHA-256:	77C70DFB598AD6B29D1E6D566275EEBE05F2A69C7833E7CE59A3EAEA5B94D4E4
SHA-512:	ECEB009BD7FDBA00577954A88F3FBE08FB2953961991AED9343B368E1BEC5C5B8B376640F38E5DE1F777A7AF6260A4800EF3209D1F5B65D0385A3055EB94E4C9
Malicious:	false
Preview:	"use strict";..module.exports = {.."#": require("./#"),.."from": require("./from"),.."generate": require("./generate"),.."isPlainArray": require("./is-plain-array"),.."of": require("./of"),.."toArray": require("./to-array"),.."validArray": require("./valid-array").};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\is-plain-array.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	283
Entropy (8bit):	4.7119779716539885
Encrypted:	false
SSDEEP:	3:jTqaFMjk0YqBYDFNjlQHlnNjQYBbfBTXRnrPFZZv3KUEXpXL5f2MJvUyxXHVa+TU:UkdZJ8NEYBNTBrPFZZb+KMJNv8SMb5wO
MD5:	DA82BAAE43783EF7015889242064D02C
SHA1:	EAC120E8CFEC35EF2EE54EFA1F65AE434A1ED75A
SHA-256:	B6BB8458096AD707931A48AFC34C49870BCD509F92CA7478FEB4763A0371B9BE
SHA-512:	797D4866D01DED6F1DBE2EA49F5FB3B22B604379A5E5F28F3BBE1F8C365ADE961F5E0A90794EA3F47999CA9BDA62B6C1495FF8A9BBA6C74D13C081E84D009EDE
Malicious:	false
Preview:	"use strict";..var isArray = Array.isArray, getPrototypeOf = Object.getPrototypeOf;..module.exports = function (obj) {..var proto;..if (!obj \|\| !isArray(obj)) return false;..proto = getPrototypeOf(obj);..if (!isArray(proto)) return false;..return !isArray(getPrototypeOf(proto));.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\of\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.866786673827977
Encrypted:	false
SSDEEP:	3:jTqJiXPbJYRAKTOHPAGRKeJqXTXUI4HLgE3yUANc6sGQQTewFR5FX9DEJpHRuJAu:0iPbeA4oLFVIDE3Yc6nLTewFR5FX9DE4
MD5:	5C91CDC3408E089D5147BA2279A2206A
SHA1:	BC36CD4FF5433F251B6155FCB97A81100347A089
SHA-256:	AE8C623A667C7C568619CA83FC997639929E0A95664D75529FEF44F3EAD28F91
SHA-512:	0B3297A19D57AB9EBF75A0740F19E5720C8E6B7D30CA87D0C3DA6DA33137040765F6D6117E10DFEFE3051063052A2CE0257D20A4FC916918C97755D83EA51B59
Malicious:	false
Preview:	"use strict";..if (!require("./is-implemented")()) {..Object.defineProperty(Array, "of", {...value: require("./shim"),...configurable: true,...enumerable: false,...writable: true..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\of\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	94
Entropy (8bit):	4.612891980454004
Encrypted:	false
SSDEEP:	3:jTqhBBbJAXPbJYRAKaOIE6YIUpANcw:4BWPbeA05S1cw
MD5:	D94262B94330C9A5D2113B781FA949F6
SHA1:	53B5A5088FCBE39688EAA2E8C84B82705637EE5F
SHA-256:	E83D8241238EB9413B644806B722D39C0C1536BE3432BD155A078AC940607A59
SHA-512:	E1BEE3068992A61BA3EC415C4C45E2B4103AB0B4601603BC094207DA39D56CE77B34098B22B465D132C9A9041E4554DD69CBBAB9843A2537C4D4FC283C0BA326
Malicious:	false
Preview:	"use strict";..module.exports = require("./is-implemented")() ? Array.of : require("./shim");.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\array\of\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	198
Entropy (8bit):	4.662056874913824
Encrypted:	false
SSDEEP:	3:jTqhBBbfaeeXxY8XJ4vsMqhKZ7SEJL5fftYeJ9eHfuA2xRKJjDDymh+HEXHfr:4BT1qW7jJ9e2QDymh+0
MD5:	EA39E00B5036DC28C90CB2E52B0AD032
SHA1:	8CB5ACD3E416B44DE087DDC0DCE76028159DC914
SHA-256:	C2B4EA90444E6994B600E6A555B673CA2A8B76C58C2B38A226F4CC4BE5712EFA
SHA-512:	B456F44EA130F467FABDCC123D3B9F4CCD8E4F5704906F82AC36F388BC007FD8DEE49A2245886A72E5FD3417BB1C1545A7D7C4C6330466529944B4EE80FCD662
Malicious:	false
Preview:	"use strict";..module.exports = function () {..var of = Array.of, result;..if (typeof of !== "function") return false;..result = of("foo", "bar");..return Boolean(result && result[1] === "bar");.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\_iterate.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1113
Entropy (8bit):	4.821654504148786
Encrypted:	false
SSDEEP:	24:cLMWoBQFR47bJIvlofdB/f9F5Bn3c45MfXGKRJHR9oDGxJbFaJXD0Hzr:coPQRRvlwZfD5Bn3c4aXG8RR94Gz5CW
MD5:	14F8545A8C11F5EE70C9A892E7319E0A
SHA1:	75B8371FA978379ED76EED3A800C07D4C1C5869B
SHA-256:	B0D2E25B7A3B44F9C2575A4FE8172B7CBA07316E8580500AF9CB6E0331E72525
SHA-512:	605186ED13A6CA615BC8C62C08E24E2B23496F0DD3CD3280941CB67DEA8D0E989374340656AF1D5FA64D083C4A134CCB8809BFA69C1F7201EF272E0899800F16
Malicious:	false
Preview:	// Internal method, used by iteration functions..// Calls a function for each key-value pair found in object.// Optionally takes compareFn to iterate object in specific order.."use strict";..var callable = require("./valid-callable"). , value = require("./valid-value"). , bind = Function.prototype.bind. , call = Function.prototype.call. , keys = Object.keys. , objPropertyIsEnumerable = Object.prototype.propertyIsEnumerable;..module.exports = function (method, defVal) {..return function (obj, cb /, thisArg, compareFn/) {...var list, thisArg = arguments[2], compareFn = arguments[3];...obj = Object(value(obj));...callable(cb);....list = keys(obj);...if (compareFn) {....list.sort(typeof compareFn === "function" ? bind.call(compareFn, obj) : undefined);...}...if (typeof method !== "function") method = list[method];...return call.call(method, list, function (key, index) {....if (!objPropertyIsEnu

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\is-callable.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	101
Entropy (8bit):	4.550448771151578
Encrypted:	false
SSDEEP:	3:RFWVXHv6hBBbf/QbrEZKdGQPSazv:jkHvABLvwvDv
MD5:	A2C127587894D99C150F7A8C85F7BD06
SHA1:	7EE30B81F3D5B8B91C3B1CDE84CE523356EB754D
SHA-256:	1D700212D7C01FEEA3BFE1A68020C109F98DE04126C50EE2A449587ADD70A820
SHA-512:	2D83997568C16CF7E737FC023A8499BC387D1D3067542BF4560D0C85894B426D39235036B2A2FA71A8D3CC8C6A82D7684E344500B2E87563CDE33AE845608768
Malicious:	false
Preview:	// Deprecated.."use strict";..module.exports = function (obj) { return typeof obj === "function"; };.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\is-copy-deep.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1574
Entropy (8bit):	5.081044750635793
Encrypted:	false
SSDEEP:	24:NjlMIvU1y1Hgw4kRRYUvYn50iiWOSR7BWqkypCO:1lvUshgw4kRvvQOiLOS9dkypCO
MD5:	6159390406D1CC1CD719BFEAF260CE81
SHA1:	DECB0040A3254244AC1125877AF2A28FD3376DB2
SHA-256:	079048722EEE19886AE9ECC747A212D40CB281058C75C9A293089BAEFCBA9F6F
SHA-512:	2AB88AAAA977D6B58DD0F717658F764EEAB34AF208EC72C6E3793DAA371F4CDA2A6F4D6135AAE860A93EE54078C5219A6C6501923B092C97C7E830CBB4EC62FA
Malicious:	false
Preview:	"use strict";..var eq = require("./eq"). , isPlainObject = require("./is-plain-object"). , value = require("./valid-value");..var isArray = Array.isArray. , keys = Object.keys. , objPropertyIsEnumerable = Object.prototype.propertyIsEnumerable. , objHasOwnProperty = Object.prototype.hasOwnProperty. , eqArr. , eqVal. , eqObj;..eqArr = function (arr1, arr2, recMap) {..var i, length = arr1.length;..if (length !== arr2.length) return false;..for (i = 0; i < length; ++i) {...if (objHasOwnProperty.call(arr1, i) !== objHasOwnProperty.call(arr2, i)) return false;...if (!eqVal(arr1[i], arr2[i], recMap)) return false;..}..return true;.};..eqObj = function (obj1, obj2, recMap) {..var k1 = keys(obj1), k2 = keys(obj2);..if (k1.length !== k2.length) return false;..return k1.every(function (key) {...if (!objPropertyIsEnumerable.call(obj2, key)) return false;...return eqVal(obj1[key], obj2[key], recMap);..});.};..eqVal = function (val1, val2, recMap) {..var i, eqX, c1, c2;..i

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\is-copy.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	596
Entropy (8bit):	4.771893404169664
Encrypted:	false
SSDEEP:	12:F3I1Fi+IJtCdMQ40BW2dTN+DeXmqwRIWLcULhsY5ZRoF:F+IvABWckyXmqwbRRroF
MD5:	7D35110A3AF09EF55108978AECF2D3D6
SHA1:	8E872D8057C3A886CFFC7C0F34C0D074985F933D
SHA-256:	D3043755CEAF23793CDCBC42989592ECB45037EBC529E103F437F1BE728EB6AA
SHA-512:	3E7CAE0C921B2A6060AABFC49665A26A0C74EAA12227E9CA0C3B43538935931CE3773C36C96D36EFAC146D4199B89D2B537DF71EE762DBFD92786F02086CDB72
Malicious:	false
Preview:	"use strict";..var eq = require("./eq"). , value = require("./valid-value"). , keys = Object.keys. , objPropertyIsEnumerable = Object.prototype.propertyIsEnumerable;..module.exports = function (val1, val2) {..var k1, k2;...if (eq(value(val1), value(val2))) return true;...val1 = Object(val1);..val2 = Object(val2);...k1 = keys(val1);..k2 = keys(val2);..if (k1.length !== k2.length) return false;..return k1.every(function (key) {...if (!objPropertyIsEnumerable.call(val2, key)) return false;...return eq(val1[key], val2[key]);..});.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\is-empty.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	311
Entropy (8bit):	4.774886638294784
Encrypted:	false
SSDEEP:	6:zuFHCBIIJtCKe9bKHqL40BNTfoz/b8wq5vH:6Fi+IJtCvMQ40BNTc/b8x5/
MD5:	C1EDD6B4D63BD607CAE89D6C8EC3F7AA
SHA1:	F5C4A3B97632F98B4ABC296F946CD7AB7B75DC54
SHA-256:	8BF897122FB3B2F14B52AA412507BAD285E221FD74616CE72F4FDED4EDB61827
SHA-512:	80D402B984146E548ED745A846FB14BCEC26B1BFCC7E58C4FD382B9862B3E9C279FA5B09D9C7721B56841B071738AEE5387F9D8AA96927484B484CB87A4A747E
Malicious:	false
Preview:	"use strict";..var value = require("./valid-value"). , objPropertyIsEnumerable = Object.prototype.propertyIsEnumerable;..module.exports = function (obj) {..var i;..value(obj);..for (i in obj) {...// Jslint: ignore...if (objPropertyIsEnumerable.call(obj, i)) return false;..}..return true;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\is-finite-number.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	143
Entropy (8bit):	4.636122539223215
Encrypted:	false
SSDEEP:	3:jTqaFMsQ6hAXPkISyiHQKzBbfamFXQb2WrdHzmFtMWw4RoIJVMeFYw:YPkGi/zBWyXBWrdettoIJVqw
MD5:	0CFF53F44BDD1235901BFFCC89703F65
SHA1:	5ABFC7B86FA1D0EECD7DB170ED19A93276638A1C
SHA-256:	2C8A354C61028479E57153D7F83B2C7A5CAD609D8A9603109A889BE0FBC08E8D
SHA-512:	1F5E618D7DC373F458EB1B1E70B60F11C479AC94C3CFFCF85C24E59F162620C208D8226B61627F1518C8D3EC960CE2449BF85EED2658F964915AA56496496BA4
Malicious:	false
Preview:	"use strict";..var isNumber = require("./is-number-value");..module.exports = function (value) { return isNumber(value) && isFinite(value); };.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\is-integer.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	218
Entropy (8bit):	4.673464772415981
Encrypted:	false
SSDEEP:	3:jTqaFMraLmTA+JFFJFEdFYHpAXPIeAHHQKzBbfQ9evx3OSM/RQXL5fIFkYs5aWso:ca6FLqTPIv/zBoeJ3OnjOY2aW7LD
MD5:	B66F58342C91928A09BE8A7D8EE24740
SHA1:	1957EECF6EF9683A04E1A835B2308FB1022A36F5
SHA-256:	2DB98D40DA023879C689C7FD0F821D60405A169C8122F1A53D23D2876C83F8A4
SHA-512:	A7D318EBEDEDFC8424E2CADF08FF1262AAED453D025E344C9174E3B9657C54376EABB70EFB76E73AF656AE958C33FD822A37B106201075AC77BE5E89BEBA5E32
Malicious:	false
Preview:	"use strict";..var isInteger = require("../number/is-integer"). , isValue = require("./is-value");..module.exports = function (arg) {..if (!isValue(arg)) return false;..arg = Number(arg);..return isInteger(arg);.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\is-natural-number-value.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	215
Entropy (8bit):	4.626785559646874
Encrypted:	false
SSDEEP:	6:ZRPwRHh6/FLqFVPIv/zBoeJ3On/aWrVcYD:/lhqFVA/zBoeJ+liYD
MD5:	C4547178E592F9982F2CC96BC308EE3C
SHA1:	E864B318A5068A646CEBFEF5E6F8154757F7B7B7
SHA-256:	6930E837B56B28F5F63BB61BFB7FD3D1DAB20F225D0BB59988E428DBE0365A4A
SHA-512:	B29ACE127502A046AF738509B92B0C3928A1A49F16B0E5F89D7892044A7BD74B18DFEBBD227B2517E7DEDA8789E35A90DFD5819C772AABCC35942654424E5871
Malicious:	false
Preview:	"use strict";..var isNaturalNumber = require("./is-natural-number"). , isValue = require("./is-value");..module.exports = function (arg) {..if (!isValue(arg)) return false;..return isNaturalNumber(arg);.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\is-natural-number.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	133
Entropy (8bit):	4.6164575960887655
Encrypted:	false
SSDEEP:	3:jTqaFMsEw9yUA+VHCDKzBbfQ9eCQb2Wr4CWQ0FYw:Z9FHCWzBoeCBWrVX0iw
MD5:	5339A9A7AA9ADA1443CDF2EC551DA797
SHA1:	243E1063B995C824BB4BFEE6ED16488C40CAE9D4
SHA-256:	8CC91AD1469BA6FD2D97ADCF5E7147FE187F5D843C137FE2CB925429BA6FF0A9
SHA-512:	32890E1C905057466B1C9A89A6FCF5D995EFC3AB337EE7CECB4D6AA75035FE48BC7DA7C9D38DB50527FDD779A4F452F8AA4E25D243B518AD85CF14493F7DED49
Malicious:	false
Preview:	"use strict";..var isNatural = require("../number/is-natural");..module.exports = function (arg) { return isNatural(Number(arg)); };.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\is-number-value.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.650387253959909
Encrypted:	false
SSDEEP:	3:jTqaFM0EqtjAXPIeAHHQKzBbfamFQ3ZEeAMMFXARQXL5fKcWA2b+MlrB3eFYQabl:ztYPIv/zBWyQ3sgfcHvMxZQabXAE
MD5:	484A1C8F57EA7B6CB8A61EA873336FE7
SHA1:	DB116D145AC8EA349CCA0053493348B093ED2438
SHA-256:	7B9D029BC5B1A873CDCDB1A83AD4675F0337F0BF40891FEF943F1D9B8F0D667B
SHA-512:	EF4D01DEA133DC25A8FC75FA545A9AA5C53D3F0C15CA44321D39DFD106C2E7C9D36A68D4D97EAF9CD7D6B7F60A5CE1F7E8921205723AFDE692D17B977C82236A
Malicious:	false
Preview:	"use strict";..var isValue = require("./is-value");..module.exports = function (value) {..if (!isValue(value)) return false;..try { return !isNaN(value); }..catch (e) { return false; }.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\is-object.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	192
Entropy (8bit):	4.741085905642034
Encrypted:	false
SSDEEP:	3:jTqaFM0EqtjAXPIeAHHL6IyFMyMacHzBbfamFXQb3gEeAMFtIEIEZTEedwHgWAeN:ztYPIvr1FacHzBWyXAEt7VMgWAaD
MD5:	2B255FFBAC08F7E4243DC9B8778339BE
SHA1:	138989A9EEAAED3A4F9DFE17736E411D43784125
SHA-256:	B4BD2596EF4D31E46CBF22255372C4AE48917862E1A14C362BAFAF4CB903E198
SHA-512:	D64861BCED7AAF9CC839AC6DBC32499EEE2A5A7B9D92226EC1A30E1F1FB22754EDAB23A2E320287698243691138A63110AEEBBB8E1EA478353379F144E0A96EB
Malicious:	false
Preview:	"use strict";..var isValue = require("./is-value");..var map = { function: true, object: true };..module.exports = function (value) { return (isValue(value) && map[typeof value]) \|\| false; };.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\is-plain-function.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	350
Entropy (8bit):	4.845907258060834
Encrypted:	false
SSDEEP:	6:WAs6qLmvPVV/o1EbKXKHqLsz7B6FQ3+VLdOVLyMndOVLwqnoHAkSMBLM2Ds:kgr/uEbKXVsPB6eOVBOVOMdOVhaAHas
MD5:	1ACBBD04903F81F5EE75C2DC7579C168
SHA1:	D42CD392B6C5885B2CC58D5D20327367DB779B05
SHA-256:	70611440848766DD222C29FE67D22F964FCA8920E358E51B0089240C138B931D
SHA-512:	0756EBF12654C57CBD8E54D7F97A839CD79D5B55B99A154483E51321AF3565E20FA3480F8673771E4556A8C7806E59399C0E9C53B0A34096C5861F5925C192C8
Malicious:	false
Preview:	"use strict";..var isClassStr = RegExp.prototype.test.bind(/^\s*class[\s{/}]/). , fnToString = Function.prototype.toString;..module.exports = function (fn) {..if (typeof fn !== "function") return false;..if (typeof fn.call !== "function") return false;..if (typeof fn.apply !== "function") return false;..return !isClassStr(fnToString.call(fn));.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\is-plain-object.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	592
Entropy (8bit):	4.717217405089735
Encrypted:	false
SSDEEP:	12:3RdN+xMyis4SUBWJoFFD3snAU/kK3ouMFe7fTOLjSWu:TbyiBW26AgRDZfTOLjSJ
MD5:	5A2F727F6A57F36A88FB3C6CD06C1261
SHA1:	331C97E5648CA61A90E03EC120DF93A6596F80B4
SHA-256:	3B4BCB60371F8E24D9BF9CEE0D6E7D08DC4C91BF1647D30D8A43105AC1292AD5
SHA-512:	0C306D6C76911AE89B49094B881CA93BBA57D7EA9B7F6CA53644C7F986F6451284AA2D2E2418EB3FB45A485C65E506D374D5E8A6CF3582B5B44A946A5A821023
Malicious:	false
Preview:	"use strict";..var getPrototypeOf = Object.getPrototypeOf. , prototype = Object.prototype. , objToString = prototype.toString. , id = Object().toString();..module.exports = function (value) {..var proto, valueConstructor;..if (!value \|\| typeof value !== "object" \|\| objToString.call(value) !== id) {...return false;..}..proto = getPrototypeOf(value);..if (proto === null) {...valueConstructor = value.constructor;...if (typeof valueConstructor !== "function") return true;...return valueConstructor.prototype !== value;..}..return proto === prototype \|\| getPrototypeOf(proto) === null;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\is-promise.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	127
Entropy (8bit):	4.562493841672748
Encrypted:	false
SSDEEP:	3:jTqhiAdj5yXiAGqBSCRVDGLWXqvxcyBbJAXP3Onn:sJ5YNUDBWPenn
MD5:	98DC014BCD55E1893562F07536F846E3
SHA1:	5B42FDCEF6FB240F077F30D2280CF9D4C29A3D70
SHA-256:	4F3C0938B9897EBAFC560F6CDBED627371E14DF78681DBB5B53CD0302923DC69
SHA-512:	DD8B8656A11CC1F573FEFB6819CD8650667C7578803798426E85AE7DE6406B27218610F848C122DA36EF7373E6F7F7E18B9A3A629A7C7215A4EA2A2D2AEB8552
Malicious:	false
Preview:	"use strict";..// In next major this check will also confirm on promise constructor.module.exports = require("./is-thenable");.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\is-thenable.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.698594457104649
Encrypted:	false
SSDEEP:	3:jTqaFMh9OFoXjAXPouHu/LslKFBpAXPovfzBbfamFXQb2WqHlFFtMW6ONuLUJzv:WcTPoICJIPoHzBWyXBW6tBuLCzv
MD5:	D54CEFFE3EC41B1B9388F745D460998F
SHA1:	36A3972A1D9C48E0C8F421A9685CB8F07A930337
SHA-256:	9FDC954FA007071B243C775AEDB1A77A5C5199F02A6DC90206365251DCCE1AFA
SHA-512:	30B0B4D0D7AC84CC3BAA11A3E1B831A3E39A944361E6B42E12D6018FDA353E50BD652629822C976FE25FFF201BDD4963A561BDE54645D4514C2CA329698FCAF6
Malicious:	false
Preview:	"use strict";..var isCallable = require("./is-callable"). , isObject = require("./is-object");..module.exports = function (value) { return isObject(value) && isCallable(value.then); };.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\is-value.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	167
Entropy (8bit):	4.72025490623988
Encrypted:	false
SSDEEP:	3:jTqaF6QhLMYFXjA+Kj+OsN2QUjzCN8pQ0Bbfa3CQbpg+Yo7hLMDZVYoAu:DFXMfskQ4zTBW3CtRz
MD5:	66AEFB3EE95F663571B492B8D1452CAB
SHA1:	B7839060FA7D4DE01AB73140F38EB80AC0527402
SHA-256:	E31230F72F88064837FE27F0C065EA5BCBADD80E4EE1E113F58224B0266AF34D
SHA-512:	531D310DF8BE0FDED3D8A48028E2C1DBFD74A5C34D8AE315C6109413DD8E5359AFF530DE35CB1574D3043BAE7FA7BEB1A8B2EEAB422FE2CEC5668B4896FE32D7
Malicious:	false
Preview:	"use strict";..var _undefined = require("../function/noop")(); // Support ES3 engines..module.exports = function (val) { return val !== _undefined && val !== null; };.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\is.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.024426632678308
Encrypted:	false
SSDEEP:	6:j7eEYwlQX5E7RfK6X7cobZ+mRfzBW6ZMyRVjZKzwPQnw:j7AE7RfKEzfzBW2MygMV
MD5:	856743294F8533E287109BD6BA7E0F6D
SHA1:	E756F944FAE815A47DC3048D28F95EE8122542FB
SHA-256:	94DA5FBB1D104759466895B1C2216A5BC6BBCA40C14F1B9409CD84CFBCB7219A
SHA-512:	F9E5B82C915E79C539E5C8FB6D5D92B440BC917C3EBD95F331FB9B459354DA11251A99AAD95EB610878AC72057CFEBCC7F2ABB6437A5F32E5841A58989307CC8
Malicious:	false
Preview:	// Implementation credits go to:.// http://wiki.ecmascript.org/doku.php?id=harmony:egal.."use strict";..var numIsNaN = require("../number/is-nan");..module.exports = function (val1, val2) {..return val1 === val2 ? val1 !== 0 \|\| 1 / val1 === 1 / val2 : numIsNaN(val1) && numIsNaN(val2);.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\key-of.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	290
Entropy (8bit):	4.652401100698189
Encrypted:	false
SSDEEP:	3:jTqaFAc/wpAbTHLxbUANGwKzBbfjA57GvsXA2Aj3esajxhrZsGyfJsAEXGCeVsXj:bf3x1G/zBuGP2Aj3eZjxhFkJhE4Ami3
MD5:	47F21C1686A578A1F4FB14FD403477D8
SHA1:	90340E6E0ABFED6D416BC9D76FDEEFC52E1B567B
SHA-256:	9CEF5443F8464A0AD453FD2D6AF87EB44B05E559946F31B895BA1181C1D32EBB
SHA-512:	86A77606934E09A7A3BBCE4B829F71757DDDC8FA84BA5D6E6DD86961055CCD3813A3A0CB8AC1EC15E78F82A3FA13C49472FC8E77160036D39D5EE3FABC7496A3
Malicious:	false
Preview:	"use strict";..var eq = require("./eq"). , some = require("./some");..module.exports = function (obj, searchValue) {..var result;..return some(obj, function (value, name) {...if (eq(value, searchValue)) {....result = name;....return true;...}...return false;..})...? result...: null;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\keys\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.8765249228795415
Encrypted:	false
SSDEEP:	3:jTqJiXPbJYRAKTOHPAGRKeJqXdvnFwsyE3yUANc6sGQQTewFR5FX9DEJpHRuJAfG:0iPbeA4oLF+yE3Yc6nLTewFR5FX9DE7E
MD5:	AB6DFE8BB7D57040E44A2793AD51CF94
SHA1:	721AF2FC27C467C2EB1442FF6D4E16CE132DBBDC
SHA-256:	EE12D6A09B10EBD553C7EF95C3287AE28581D33E2B509F28E3FB234030B48221
SHA-512:	666531E1D12079E56C8EDAB5ED6609410F6054C28094D36FA190080DDBA52938101A5EC6C463D56DD6D71EFEE2835EB5EBB52513C205C0CDF577FC5574DBA193
Malicious:	false
Preview:	"use strict";..if (!require("./is-implemented")()) {..Object.defineProperty(Object, "keys", {...value: require("./shim"),...configurable: true,...enumerable: false,...writable: true..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\keys\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.6351248271222625
Encrypted:	false
SSDEEP:	3:jTqhBBbJAXPbJYRAKaOerlJANcw:4BWPbeA0QKcw
MD5:	2A0812327A4ACB61BF76FF80285BA3EF
SHA1:	1C142A8B5907D9D2CCF0A1FCB655E09A50958E02
SHA-256:	CC7145495F86C5688B8EE3869D9FB26B47CF35A9237CD22991988B90A4885FA5
SHA-512:	507110A3A3E4943AE332490E2B5289F6CAD9D4C64CE9505DAF4034996DBF37FAA4D33DAC8EBF416A4F40C6FE2630AC6F914ADF4DAF430A82A5D16929371A5AFA
Malicious:	false
Preview:	"use strict";..module.exports = require("./is-implemented")() ? Object.keys : require("./shim");.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\keys\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	133
Entropy (8bit):	4.6480497377360965
Encrypted:	false
SSDEEP:	3:jTqhBBbfakbRrV9MIMqMHfvs2A6/L9evNQROf5Yev:4B1bRfOHsnYL9Jlev
MD5:	0F13B876AD10BA49FE800484149BD666
SHA1:	C933807187D1C7B3FEE7D72CA46375045BB7F25A
SHA-256:	98C99BEE10565C421AF334A7CB98008EFD091A52B011F70524299706CDC58EE0
SHA-512:	64BD37E5047344098E803963517C497EAF65EDA02FA54D8DC665219BCD13E3E46C7B019550BF3583456DC4329DB9460E4FD77ADDF40B342F9F9864A3A0C65E2B
Malicious:	false
Preview:	"use strict";..module.exports = function () {..try {...Object.keys("primitive");...return true;..} catch (e) {...return false;..}.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\keys\shim.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	175
Entropy (8bit):	4.749807304973665
Encrypted:	false
SSDEEP:	3:jTqaFM0EqtjA+XLeAHHL6OAmqHPtrwQYBbf5G+eCQb0dKiaU5G+fyZievn:ztpvrR8dwQYBbDcqUiev
MD5:	98DA57EB6FCBC4FA65E99745CB6023D6
SHA1:	8DDC3E4BEDD58DB8F976148631F3DC550D9EA07E
SHA-256:	AFBC44CC882FB9B1D0AAC6797103E8BD6D136336DDFD8BA789E95A4C434BD08F
SHA-512:	4BB63725177348F2AE03E70C42BC7B625650F9DC4C097E79F1874478D2B6654E48F715099CFBC9792037DBACD4A80988B48C83B76EC5F7CCEE74A7873DBAC720
Malicious:	false
Preview:	"use strict";..var isValue = require("../is-value");..var keys = Object.keys;..module.exports = function (object) { return keys(isValue(object) ? Object(object) : object); };.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\map-keys.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	408
Entropy (8bit):	4.952516443859433
Encrypted:	false
SSDEEP:	12:2+bC1EOxW1KXVIBXD3NOqvsjfM94GecNZgjcenr:/bYvpCBX0qkjfMydcHgjcKr
MD5:	510AD93E093A8D68A8409CCD22642A01
SHA1:	335F94EF8A6C925398A1AD358E1ADC016F9043B6
SHA-256:	765C83D495226D6BA35B0C1C733E75CD079CDE753D47E22F714737BDCFD4EDB8
SHA-512:	4F935500F027092BA662229BF76FE3AF23C86E581C5589BAE6A27F3E37410C9D5BF075013DEDBA0658B91F4D0ABEDD6E831233B22FE71CCB2F163A1B795FAF6A
Malicious:	false
Preview:	"use strict";..var callable = require("./valid-callable"). , forEach = require("./for-each"). , call = Function.prototype.call;..module.exports = function (obj, cb /, thisArg/) {..var result = {}, thisArg = arguments[2];..callable(cb);..forEach(...obj,...function (value, key, targetObj, index) {....result[call.call(cb, thisArg, key, value, this, index)] = value;...},...obj..);..return result;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\map.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	395
Entropy (8bit):	4.958519230098922
Encrypted:	false
SSDEEP:	12:2+bC1EOxW1KXVIBXD3NOhZjfM96W7O5IUMA5r:/bYvpCBX0hZjfM0W7jUM4r
MD5:	7BB59390F051AEB2B0175FF11343FE6C
SHA1:	12EBFDFABE30F822F328DF1F238614EA6D14C06A
SHA-256:	20E1B49A3E9AA9B439CA37CE950F09E3EBA978D180DA08EB5FDB10FE9F2F3148
SHA-512:	45C954FC76322B1C05A027C6DF43A781A1F1A87968B92761AB12EA66EC29DA7CE99896192E0341FD1C9EE1527FC3B0099F43F8428FF4196069B3B902C97DDF0B
Malicious:	false
Preview:	"use strict";..var callable = require("./valid-callable"). , forEach = require("./for-each"). , call = Function.prototype.call;..module.exports = function (obj, cb /, thisArg/) {..var result = {}, thisArg = arguments[2];..callable(cb);..forEach(obj, function (value, key, targetObj, index) {...result[key] = call.call(cb, thisArg, value, key, targetObj, index);..});..return result;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\mixin-prototypes.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	607
Entropy (8bit):	4.777571638774585
Encrypted:	false
SSDEEP:	12:Jp+IJtCS9ggB9sTKmKFetZDE26LqgaiVr:+Iv/7B2lc2opGO
MD5:	8A25E6807408B947BED4A8993DBB52BF
SHA1:	B55219FD8617209C586909C2A3C3CFA48342FCC1
SHA-256:	A6AB709693D3C41FB38D1E21FC3205729D6629D07C1E44B494278610C03FA3D2
SHA-512:	42AD326C95DBDC1EC39F4F76830C699D0A1908505BBE2CBFD06DBF314BD0CC8319444900AB5DD8C8B3FD29AC07D9ABBB8AE9BEBF3F85CC12ABD558CA05DA0A5F
Malicious:	false
Preview:	"use strict";..var value = require("./valid-value"). , mixin = require("./mixin");..var getPrototypeOf = Object.getPrototypeOf;..module.exports = function (target, source) {..target = Object(value(target));..source = Object(value(source));..if (target === source) return target;...var sources = [];..while (source && !isPrototypeOf.call(source, target)) {...sources.unshift(source);...source = getPrototypeOf(source);..}...var error;..sources.forEach(function (sourceProto) {...try { mixin(target, sourceProto); } catch (mixinError) { error = mixinError; }..});..if (error) throw error;..return target;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\mixin.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.798237272098147
Encrypted:	false
SSDEEP:	12:6Fg+IJtCGQndDWB9mJm3eJ3bTWje+X4YBJ/Wqi48e+s2Vr:qIvGDWBh43bigYz/WqioS
MD5:	9172CC797804D1389DFA16B3166E0F78
SHA1:	32C5C4E515C12D63FCF9385BBD6B5524BE49B03B
SHA-256:	FFB503EA2FAAF0493F5F4085983F721207522C3BD701A79EC8413AA5B98CD9F2
SHA-512:	C7CC487143948BF32B262D5173475EA3CEFC4255F459F0DB1E2B452685833B5F57A2EFF7B2796C2849134917A8F1D0F5D3A90EEFA584576F37B0939FD4A2DFC5
Malicious:	false
Preview:	"use strict";..var value = require("./valid-value"). , defineProperty = Object.defineProperty. , getOwnPropertyDescriptor = Object.getOwnPropertyDescriptor. , getOwnPropertyNames = Object.getOwnPropertyNames. , getOwnPropertySymbols = Object.getOwnPropertySymbols;..module.exports = function (target, source) {..var error, sourceObject = Object(value(source));..target = Object(value(target));..getOwnPropertyNames(sourceObject).forEach(function (name) {...try {....defineProperty(target, name, getOwnPropertyDescriptor(source, name));...} catch (e) { error = e; }..});..if (typeof getOwnPropertySymbols === "function") {...getOwnPropertySymbols(sourceObject).forEach(function (symbol) {....try {.....defineProperty(target, symbol, getOwnPropertyDescriptor(source, symbol));....} catch (e) { error = e; }...});..}..if (error !== undefined) throw error;..return target;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\normalize-options.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	469
Entropy (8bit):	4.954224946196334
Encrypted:	false
SSDEEP:	12:ztYAroYK1X4K/r48T6jYVlvfNWQYBpWLLMyxZtdq08r:p86KE8T68HEQYBpzkZ58r
MD5:	947AE8DDCFEE7B7B6F69C820962CF47C
SHA1:	7C2175DC00878E3714C7891CFEFECE4062A7C983
SHA-256:	1870CBA64C4A16061E0E65C7814328DBE9B862F874050D59E563DAE18C2A5BB1
SHA-512:	3968546F05677E44C11898D8A4944BBF86BC1D2B6D723D73CC5DD1952F82765FA55496D6AA9563E4E449C781D5C95F4E8878278C47F74F2952DBFA9DCAEEC4A7
Malicious:	false
Preview:	"use strict";..var isValue = require("./is-value");..var forEach = Array.prototype.forEach, create = Object.create;..var process = function (src, obj) {..var key;..for (key in src) obj[key] = src[key];.};..// eslint-disable-next-line no-unused-vars.module.exports = function (opts1 /, .options/) {..var result = create(null);..forEach.call(arguments, function (options) {...if (!isValue(options)) return;...process(Object(options), result);..});..return result;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\primitive-set.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	276
Entropy (8bit):	4.874612802480039
Encrypted:	false
SSDEEP:	6:jlYgsqL1X4KhVlIUfNWQaBBcYXCu4XJaT3bDQy9xCv2pAr:ZYK1X4KnlvfNWQYBcpeLMyBOr
MD5:	6C94A713F879F77A9B796522BB16E106
SHA1:	37F1FFC581568221C82292780E0E35A4AE6779A6
SHA-256:	06542366EB2EB3068B54C1D6330FCD8584A140F23A7A63C8B064BE23FD2DEDDB
SHA-512:	4AF206C31B89DF8D82BF90C6136EB563A262BAEE223E6CA93D19D05120A4092DD929D13401DCADC3D53585E00F391B62540D530F88E27B318F7D29963AA60DD8
Malicious:	false
Preview:	"use strict";..var forEach = Array.prototype.forEach, create = Object.create;..// eslint-disable-next-line no-unused-vars.module.exports = function (arg /, .args/) {..var set = create(null);..forEach.call(arguments, function (name) { set[name] = true; });..return set;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\safe-traverse.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	379
Entropy (8bit):	4.964399354048064
Encrypted:	false
SSDEEP:	6:zuFCBIIJtCTtYPIv/zBhmFV00Qoz9RI+xvZ2F4aqp2M9mkAlwU+IYEvxRHBA6r:6g+IJtCTtYA/zBhm7Bz9H2Fkp2MUkAlZ
MD5:	5A420A0410F14A0A1A27098DCAB16AB2
SHA1:	53F4670517AC5501448E1B1B800E6628BDBE7867
SHA-256:	D8990F6D07C1EF866AAA9B9445E37307068CAE3EE9D1F5BC6F242D4B1BB2FF2B
SHA-512:	C359DA117A54F65DB4741DC92DE63C0FB24C5E148820F89702829D35620FDBA74139F5172131943C2F6E2692179F360199CA1AF7C2E061A8FE1374E69FCB383B
Malicious:	false
Preview:	"use strict";..var value = require("./valid-value"). , isValue = require("./is-value");..module.exports = function (obj /, .names/) {..var length, current = 1;..value(obj);..length = arguments.length - 1;..if (!length) return obj;..while (current < length) {...obj = obj[arguments[current++]];...if (!isValue(obj)) return undefined;..}..return obj[arguments[current]];.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\serialize.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	5.065481732111364
Encrypted:	false
SSDEEP:	24:xKePH/yEkIGySjKZB7DYxxOBuKXBNyNMebMlbzc501TLaz:xfHyEkIGzKZqxxOtXL7eSbzX1HY
MD5:	67F2D1F96023DFD0DDD6F9DED269DD25
SHA1:	3AD1498BFF0996EAF6DDEC10DEB475122B617F0B
SHA-256:	1269007A981E989BBD3697EEB8C2A538894BD6891D08E6C52295E0A69EB83974
SHA-512:	A4FB21B8414852ABF1DC764F04354E7A9B4F5A3BFC348CDC7F43E28DEEFC178F194CB5148A686AEBFCA490A9A3011A2C907E4AEAC28480C3DE0F68B2553B12A2
Malicious:	false
Preview:	"use strict";..var toArray = require("./to-array"). , isDate = require("../date/is-date"). , isValue = require("../object/is-value"). , isRegExp = require("../reg-exp/is-reg-exp");..var isArray = Array.isArray. , stringify = JSON.stringify. , objHasOwnProperty = Object.prototype.hasOwnProperty;.var keyValueToString = function (value, key) {..return stringify(key) + ":" + module.exports(value);.};..var sparseMap = function (arr) {..var i, length = arr.length, result = new Array(length);..for (i = 0; i < length; ++i) {...if (!objHasOwnProperty.call(arr, i)) continue;...result[i] = module.exports(arr[i]);..}..return result;.};..module.exports = function (obj) {..if (!isValue(obj)) return String(obj);..switch (typeof obj) {...case "string":....return stringify(obj);...case "number":...case "boolean":...case "function":....return String(obj);...case "object":....if (isArray(obj)) return "[" + sparseMap(obj) + "]";....if (isRegExp(obj)) return String(obj);....if (isDate(obj)) return

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\set-prototype-of\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	227
Entropy (8bit):	4.936339165468923
Encrypted:	false
SSDEEP:	6:q6BiPbeAm/cXeLFIjSmBE3698TewFR5FX9DE7xuOfFR15Md:jITOisCGmy36+7FnrDIfBMd
MD5:	92457ACA5CDC29ED2D73EE4922D8A179
SHA1:	43A94F1A157E124487E68584B48BBE35F958F1D5
SHA-256:	0B8F63A72396A2EB5362370C8D153B013DE8F3D24A80EECB07CD276792627841
SHA-512:	5B3D9B14EC5ACCD0F6E68D50CD1F27259F48B6959B5EBC9274FC629005C30B5CED226EADDB6F3D203A03B4A71F7EC6E108D5F26CC1B0CACC2E7B6F26C0A6F940
Malicious:	false
Preview:	"use strict";..var shim;..if (!require("./is-implemented")() && (shim = require("./shim"))) {..Object.defineProperty(Object, "setPrototypeOf", {...value: shim,...configurable: true,...enumerable: false,...writable: true..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\set-prototype-of\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	107
Entropy (8bit):	4.657751469893899
Encrypted:	false
SSDEEP:	3:jTqhBBbJAXPbJYRAKaOejNiHpANcw:4BWPbeA04NiYcw
MD5:	C38CE99756692488ABD8D0AC8C9D499A
SHA1:	3B3856FF1933A6A93236CEE61E2A2CBF6661BACE
SHA-256:	5123665E047AF678C3BF9472E3341ACDA15075EC31E79D57E0EC3631F56A0F56
SHA-512:	9604397D8EFA143A2F73411971BA79E83F772D9A79E50A9768BCDC550153F82804817244FCF6D2304CCED178F84F8E2B08CAEC4A5B9BCB550DBC85F482E1C66D
Malicious:	false
Preview:	"use strict";..module.exports = require("./is-implemented")() ? Object.setPrototypeOf : require("./shim");.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\set-prototype-of\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	383
Entropy (8bit):	4.756078603790983
Encrypted:	false
SSDEEP:	6:gqh2G8NsjRgDBGxV5wNsH6N+UAjFBX5CkUGAJAJKbAiYo9B:gqlRqBEVe+VFhczpbdYoD
MD5:	B98D3618D0985B81ABA3B6FDA138C7C7
SHA1:	312058483F347F1D13C67C7ABDBDD7388AC0F31E
SHA-256:	E1E071FF98C64095279C6E2657FD4172BF38CDDE5B9098D7AD0CDD0D2F64E862
SHA-512:	20509F71ADCD7F7EF16EB96761C4AE0B387AD23B32098AECA4E4EEAA20AC8B3869F5BC565982C6867B41669AA42A09C3DFC94612DE53E45040B1DDDFA227B897
Malicious:	false
Preview:	"use strict";..var create = Object.create, getPrototypeOf = Object.getPrototypeOf, plainObject = {};..module.exports = function (/* CustomCreate*/) {..var setPrototypeOf = Object.setPrototypeOf, customCreate = arguments[0] \|\| create;..if (typeof setPrototypeOf !== "function") return false;..return getPrototypeOf(setPrototypeOf(customCreate(null), plainObject)) === plainObject;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\set-prototype-of\shim.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2202
Entropy (8bit):	4.981961801415811
Encrypted:	false
SSDEEP:	48:DyMJvsGAXSMRBcjnP+hB2B/KeyQBeBFKvB2Bt3wQZ8LkA+YQoSo9/AMfdAIxXJ:DLAXvUnA0C+cy0lwOCFxQm/AMfN
MD5:	36EABD7684AB088315E8A1DE93D1D515
SHA1:	50793936EBC514AF9AAE3B35C4A4ED38951C68DC
SHA-256:	B4220E0CBB99AA6F6AA56C7839AF6AAFCA576959CB9BB07798E32A1BDC9CD82C
SHA-512:	F83E70023A540019A403D45D74CEB98412485DB7B939F1A065DEAB177F8EAC2A677EA01268D04D500680F792F48B1EF347ABE33C3DF329E229D72A8B1539E462
Malicious:	false
Preview:	/* eslint no-proto: "off" */..// Big thanks to @WebReflection for sorting this out.// https://gist.github.com/WebReflection/5593554.."use strict";..var isObject = require("../is-object"). , value = require("../valid-value"). , objIsPrototypeOf = Object.prototype.isPrototypeOf. , defineProperty = Object.defineProperty. , nullDesc = { configurable: true, enumerable: false, writable: true, value: undefined }. , validate;..validate = function (obj, prototype) {..value(obj);..if (prototype === null \|\| isObject(prototype)) return obj;..throw new TypeError("Prototype must be null or an object");.};..module.exports = (function (status) {..var fn, set;..if (!status) return null;..if (status.level === 2) {...if (status.set) {....set = status.set;....fn = function (obj, prototype) {.....set.call(validate(obj, prototype), prototype);.....return obj;....};...} else {....fn = function (obj, prototype) {.....validate(obj, prototype).__proto__ = prototype;.....return

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\some.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.416603424812509
Encrypted:	false
SSDEEP:	3:jTqhBBbJA4mmNlJa+ev:4BeZ
MD5:	ABA0D9EC63C2DA097EF1FB2E20C757EE
SHA1:	90DC7FDC91B2EB863D4C7F16B2C28FFE15EE1BC9
SHA-256:	6382B9F95F543F824AFF975CB643C1D54DD65C76ED91126CD860983369DF181C
SHA-512:	38A6C06CB4410E7D93C50F98840FE571E16D51E3D84EC1911FDC7B1010F6058E9C7C5AB6E8622B570E549E8A280B2A686CDC896EFC7BEAC4FDFC4FD8EABB8CC9
Malicious:	false
Preview:	"use strict";..module.exports = require("./_iterate")("some", false);.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\to-array.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	570
Entropy (8bit):	4.994089537261404
Encrypted:	false
SSDEEP:	12:Op+bCqTAC1EOjWDKXVFjdEPWzB3F5ZjNnOkctqvsjfM9ifg/ahW4rr:OQbwYvjnjLB3F5iDqkjfMwfgSA4rr
MD5:	F1101E7AD7E699B0F6F1B209A85BD78C
SHA1:	BF9C32E21169BA4E07FA3692B6338566E0B56B6B
SHA-256:	CAE8C1C37607A755F712A220414194A7C8418818AC74E2679043157F73261079
SHA-512:	E165AE4A712C2A015D7CE616594ECF7BFC271F60E19124D27E100BBE3A2C0F901B1B27F3FC94ADF690DD4F995A8A4629AB2E3A60F1E86F8895350D3F68F6F849
Malicious:	false
Preview:	"use strict";..var callable = require("./valid-callable"). , isValue = require("./is-value"). , forEach = require("./for-each"). , call = Function.prototype.call. , defaultCb = function (value, key) { return [key, value]; };..module.exports = function (obj /, cb, thisArg, compareFn/) {..var a = [], cb = arguments[1], thisArg = arguments[2];..cb = isValue(cb) ? callable(cb) : defaultCb;...forEach(...obj,...function (value, key, targetObj, index) {....a.push(call.call(cb, thisArg, value, key, this, index));...},...obj, arguments[3]..);..return a;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\unserialize.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.687059489248401
Encrypted:	false
SSDEEP:	3:jTqaFTgSjAIECBIIJtHQKzBbfNzYLRI6vcLg30m1jeGqYws80pMNMe7vn:ztkCBIIJt/zBylIUzjUDSMNTv
MD5:	E73186F26AED91C1119F481C1993A5B6
SHA1:	B23BFE8C2346DCC92C009E0F1BE5EE0483598847
SHA-256:	FF604C8FFB181D65A74DD069A2D3EE278C15FA9E52DFC28B554D8BC224E528A4
SHA-512:	00EA0D1168E4E66A232A6BED349BFC6C3C62D18F43C9A7FEBFA34103B186D03FC5F843F4478CDAB67EE496554C3F6BD8EA5C9F3D9E43805290BE010D8A76C014
Malicious:	false
Preview:	"use strict";..var value = require("./valid-value");..module.exports = function (code) {..// eslint-disable-next-line no-new-func..return new Function("return " + value(code))();.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\valid-callable.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	142
Entropy (8bit):	4.517321735374665
Encrypted:	false
SSDEEP:	3:jTqhBBbf+FQ3+hDLnYaSEDvoVsI9FXFL6LufP2VqAwn:4B6FQ3+VLd5rInXFLgC+IAwn
MD5:	8B5C404EC91B5EB12F456481ABDBCE27
SHA1:	D90B2ADBA3277E744B7108D804C9F3A54109A880
SHA-256:	713E0F5447821CDFBFD8897EBE113BC9CE1B87B728A91679B5E1F27A46ADCC77
SHA-512:	8F45ECBB2972491F0C943DBF6C597A754ECEAEF015E3A376AE00E12D1AD58E511245AA0D92F7E34E7DAE1A48D529F17AEABF8C8BD980945CE37D7AB4DFEAD432
Malicious:	false
Preview:	"use strict";..module.exports = function (fn) {..if (typeof fn !== "function") throw new TypeError(fn + " is not a function");..return fn;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\valid-object.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.818274848006988
Encrypted:	false
SSDEEP:	3:jTqaFMtvtgAUpAXPovfzBbfamFQ3cGFMFRFoV8+8FXFLoR/vn2Fg2vn:av6YPoHzBWyQ3cF7+8xFL6+2I
MD5:	216623FD953AD7C533628146A8B7B9F0
SHA1:	FF50B7DC2BDA2B0132DD87295FDE53F41C3421B5
SHA-256:	C524971B12A47279B1971FD3F80AEB23D3C4CF7973A5BC5B0C699C85F2B1A060
SHA-512:	DBBE34B11C0AEDC8BDC34F6968BAC46A90685D05BFEF295BCCA4BE561CF7B52AC3D0F9DBE2CCC70CFF588E13AC34A3AC671E814C06B7032C5B6BE53B8F4F5827
Malicious:	false
Preview:	"use strict";..var isObject = require("./is-object");..module.exports = function (value) {..if (!isObject(value)) throw new TypeError(value + " is not an Object");..return value;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\valid-value.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.712368976377026
Encrypted:	false
SSDEEP:	3:jTqaFM0EqtjAXPIeAHHQKzBbfamFQ3ZEeAMMFRFoVoz3upB7LOMw2A2Fg2vn:ztYPIv/zBWyQ3sjvzyBbP2I
MD5:	AC7FE539E1F338AA9070D7F92FF604A6
SHA1:	4BCB86302C7C00606B29D53472421B143ADBB3B2
SHA-256:	26544C4334F7F730F0DF527FAE9FA59D0EC49B43AD884BE20D04811BB3B71B9A
SHA-512:	D36DA098D693CA0FD93DEBE0FF62496EC3369EAAAC215079883FE0819901269EE5FF0E08D29E8155AA31868965B02AF259F4CD1352D14E0D7443CABB6F35B828
Malicious:	false
Preview:	"use strict";..var isValue = require("./is-value");..module.exports = function (value) {..if (!isValue(value)) throw new TypeError("Cannot use null or undefined");..return value;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\validate-array-like-object.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	4.842680356994427
Encrypted:	false
SSDEEP:	6:Uk3bvPBFpOTPoHzBNC3uAfE/yS4kF9MWFL7UJr:Uk3TdOTMzBNCk/dHF37S
MD5:	C982658BF78515983D3C0F0B7F142C07
SHA1:	6B9B010EADDEAE63A848E599AF3FF7D915FD05A4
SHA-256:	044A79436497B0293CAFEE70B4CD5F85450AD7D90927D1C9277A000F3D6D053A
SHA-512:	294FA3353C614E3A79F4716072180FFDA38589E557856B1B33FAA7F9FACB5AC547BE5CB047E0CDFA84A8DDABFFA805F450562A8D307B9F69306470778455BD93
Malicious:	false
Preview:	"use strict";..var isArrayLike = require("./is-array-like"). , isObject = require("./is-object");..module.exports = function (obj) {..if (isObject(obj) && isArrayLike(obj)) return obj;..throw new TypeError(obj + " is not array-like object");.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\validate-array-like.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.838848231509759
Encrypted:	false
SSDEEP:	3:jTqaFMjk3YyUAXPoKXDKzBbfBMD3VKVFXpXLw4aJFoVlM92WFL7EXueYev:Uk3bvP8zBNC3VyS4kF9MWFL7hHev
MD5:	327F9D986FBA2A0A5157BB652ACE4D33
SHA1:	8A7631A0C23099402201BB822D037AC978DFCCA0
SHA-256:	AB573D4A3B779F4CBA54AC685A3DCA5AB885A9757342CAB1086696929B256F0B
SHA-512:	8BCAD6C3E49F032BCB4AFBB85D3480A346059A7D1D1D9E45A122C6E3A26CB1E797ABD9AF9D67C253EAD5D34822FB2F469820C444F3B24B28539024CC69BD1286
Malicious:	false
Preview:	"use strict";..var isArrayLike = require("./is-array-like");..module.exports = function (obj) {..if (isArrayLike(obj)) return obj;..throw new TypeError(obj + " is not array-like value");.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\validate-stringifiable-value.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	199
Entropy (8bit):	4.575368771877498
Encrypted:	false
SSDEEP:	6:4VHFCBIIJtCxsCBEmIQfzBWyXbcCUuMiw:Mg+IJtCLy+fzBWu3dMN
MD5:	50B191ACFB5706235126CC0A7D4DEB88
SHA1:	04EC32647BBD9F1EEADAED7A20778AA292AEA0CB
SHA-256:	A37216E01AFE7B88FA681ED1F3509C9990D7EFF006B6F9779481C54A15D2B54F
SHA-512:	D878F78EB6C58A8EB83CF447D8E5725790565EC704BA0A02C1734E6FE96C022BA00842C294F0777B17D85C1C2BA892FD429958B8FF26170F74B4FD62917A896F
Malicious:	false
Preview:	"use strict";..var ensureValue = require("./valid-value"). , stringifiable = require("./validate-stringifiable");..module.exports = function (value) { return stringifiable(ensureValue(value)); };.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\object\validate-stringifiable.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	318
Entropy (8bit):	4.763932670954834
Encrypted:	false
SSDEEP:	6:WcTPoIHfzB3PRe/rPUxoXOc3wsndQ5cReKL9SFv8dgTcfmAev:pgIHfzB0eSZdhEYOv
MD5:	D9591666CA6467A558CBF98F067B5477
SHA1:	EC941CB4C3501572A0295E0B5AA401B1A57B3EB4
SHA-256:	CEA22251D4C2AB393C03D87D55CAD343951283C89F7CF98BF242D67D6A574391
SHA-512:	8E4F0F3ADF6A23327986A38D34B06DDCE715B0129340FA0F7AFECED147D65765001C5BB126C31E8352686A0C0DAC04C92B4E6D72FA6B2E593AC6D2B0BD0951E6
Malicious:	false
Preview:	"use strict";..var isCallable = require("./is-callable");..module.exports = function (stringifiable) {..try {...if (stringifiable && isCallable(stringifiable.toString)) return stringifiable.toString();...return String(stringifiable);..} catch (e) {...throw new TypeError("Passed argument cannot be stringifed");..}.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\optional-chaining.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	432
Entropy (8bit):	4.978941378216271
Encrypted:	false
SSDEEP:	12:ztdriZjsYlvfNWQYBWjveIcFHqOvrZrIRWqqXp0CcQvD:/2OgEQYBWjt05rFqspfD
MD5:	553F6E0D71542D0A324D763CBEF56071
SHA1:	F75D15B5A072966CD4C0CE4A2272E17101D85A9A
SHA-256:	4242E801D739F818CE22185773BD1A0DD6B5B36B6DDA0C4A5755007A33B5BDFD
SHA-512:	0D6B05849A28EDEC9D9B767B4DA296327444F956CF319ABC8663AFCFCD21521B071CDAA4A9557097D4594A557E6D00C25F0864DFFB1B2C67D840B7E3553CAFCD
Malicious:	false
Preview:	"use strict";..var isValue = require("./object/is-value");..var slice = Array.prototype.slice;..// eslint-disable-next-line no-unused-vars.module.exports = function (value, propertyName1 /, .propertyNamen/) {..var propertyNames = slice.call(arguments, 1), index = 0, length = propertyNames.length;..while (isValue(value) && index < length) value = value[propertyNames[index++]];..return index === length ? value : undefined;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\package.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	4.600304219563336
Encrypted:	false
SSDEEP:	24:bANt1CGhHKhN1QDxV9Yy+kz7YBRkvxapgyFwsZPxC9oxaUu:bARphqutV9YyTzUBExGgyis69oxah
MD5:	70FA12A6E9D2B338F4820C859D91397E
SHA1:	974F258624613CA75C20BCBF58F515DDCA2AE665
SHA-256:	1D9C64255895D060CC58E0CF923EF47869466CFC7E790B59CDE6D5470BDB24B9
SHA-512:	5C7FDDF1E1AF01CDB3E3F007B8A271883B712EE667CA57F62B78914DD2DF375121E9E67ED6C5BE77A177D48D0C1157D3104CB8E726B2A362F2BD663C92DE68C3
Malicious:	false
Preview:	{. "name": "es5-ext",. "version": "0.10.61",. "description": "ECMAScript extensions and shims",. "author": "Mariusz Nowak <medyk@medikoo.com> (http://www.medikoo.com/)",. "repository": "medikoo/es5-ext",. "dependencies": {. "es6-iterator": "^2.0.3",. "es6-symbol": "^3.1.3",. "next-tick": "^1.1.0". },. "devDependencies": {. "eslint": "^8.13.0",. "eslint-config-medikoo": "^4.1.2",. "git-list-updated": "^1.2.1",. "github-release-from-cc-changelog": "^2.3.0",. "husky": "^4.3.8",. "lint-staged": "^12.3.8",. "nyc": "^15.1.0",. "plain-promise": "^0.1.1",. "prettier-elastic": "^2.2.1",. "tad": "^3.1.0". },. "husky": {. "hooks": {. "pre-commit": "lint-staged". }. },. "lint-staged": {. ".js": [. "eslint". ],. ".{css,html,js,json,md,yaml,yml}": [. "prettier -c". ]. },. "prettier": {. "printWidth": 100,. "tabWidth": 4,. "overrides": [. {. "files": [. ".md",. ".yml".

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\promise\#\as-callback.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	532
Entropy (8bit):	4.842129870663537
Encrypted:	false
SSDEEP:	12:+73upB+LvtFA+zBcXpa1KLRB2AeQyM44xyA2D:acwF7BcXoQzeQBlx2D
MD5:	61C81369F8BD5E1A2DB5EFB054E1922A
SHA1:	B6C5BB76363AEA6D217FFE44EE4E400B8DEF0D11
SHA-256:	8C575FA576A0F67B50486F0B19070750ABF9ACC0C247AA0C70BC1061246BA6D4
SHA-512:	489CB291B8A060DCA2CD227E6697F849F1564E61F0B96D8C6709C7AE42CA3FACAB0EBB2122E10D6D97A0EB4CD886755C7956DA6D36C5BC9E74E5793872F71229
Malicious:	false
Preview:	"use strict";..var ensurePlainFunction = require("../../object/ensure-plain-function"). , ensureThenable = require("../../object/ensure-thenable"). , microtaskDelay = require("../../function/#/microtask-delay");..module.exports = function (callback) {..ensureThenable(this);..ensurePlainFunction(callback);..// Rely on microtaskDelay to escape eventual error swallowing..this.then(...microtaskDelay.call(function (value) { callback(null, value); }),...microtaskDelay.call(function (reason) { callback(reason); })..);.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\promise\#\finally\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	203
Entropy (8bit):	4.865590005360488
Encrypted:	false
SSDEEP:	6:0iPbeA4oLFJD1qJAzFgE3Yc6nLTewFR5FX9DE7xuOfFR15Md:PTQqdFB3o7FnrDIfBMd
MD5:	A3CBFE85C2C7F3DE48EA29253990C298
SHA1:	B8B15A1D4BB7DEBDE354B0B61430BF6E624BE62E
SHA-256:	42E8BC4D5098F16290052FB50C728D2DDA14D9864E8DC396F0B8502D0DC2B5A4
SHA-512:	E7E56E4290B2B4848EF150B28180846C7B22D6112FD74867A228EAFC1017B1350196774E601E61DF4477276FCD5D9E8DB50EB07D13B03ECD69F8D9F8B82DE306
Malicious:	false
Preview:	"use strict";..if (!require("./is-implemented")()) {..Object.defineProperty(Promise.prototype, "finally", {...value: require("./shim"),...configurable: true,...enumerable: false,...writable: true..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\promise\#\finally\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.611587547378585
Encrypted:	false
SSDEEP:	3:jTqhBBbJAXPbJYRAKaO1XFqLe/JANcw:4BWPbeA01XFqLe/Ycw
MD5:	8022A0A567EE68016097FA807D82B0E7
SHA1:	0EAE9A7D0C754B4B6AACF7E0210D5E1CAB6DBA3B
SHA-256:	F500DA4A5103186CA7A17FF60DC3194177FDD532BF65A85BC16B77A99E98A8C3
SHA-512:	D22D9C256522295AB1E89B6FAF2673CA294BEE7D01EB46B742AEFDB2DB2E5492BB99845AD98917337497561AC759FB1A8BE4C4883D395576FDA546E3AAB99B75
Malicious:	false
Preview:	"use strict";..module.exports = require("./is-implemented")() ? Promise.prototype.finally : require("./shim");.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\promise\#\finally\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.5384330229682375
Encrypted:	false
SSDEEP:	3:jTqhBBbfaQ3+h1aIXXaSEJL5fch1aIXFqLekYYFHASEJL5f+HYn:4Bb3+jDXaOjDFqLeRoHAk4
MD5:	5E73AB04EC9380A366E067CD2798F3B9
SHA1:	5FD67B6D1F8D0D5104FBDA09955B125A5448057E
SHA-256:	691B49EB3E78B6C0F3B58BDCAAFBFCD8F3AB447A8269108D4547178425F55B8D
SHA-512:	0BB3E8A294E3594AED58FAC9FAB4A3145D6FB6CB0CE62D8F6C3ABA5354EC0155B3A189C325562FE8C2130EB67336169C4B0BDB27C3BF3DAAF2382837D65EF394
Malicious:	false
Preview:	"use strict";..module.exports = function () {..if (typeof Promise !== "function") return false;..if (typeof Promise.prototype.finally !== "function") return false;..return true;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\promise\#\finally\shim.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	706
Entropy (8bit):	4.780311977699821
Encrypted:	false
SSDEEP:	12:+Y3buOoupB+jLzRo0tMCUBcXpaiRZhmG+lTJr:7ru2qe0SBcX7bhG5p
MD5:	24100ABC637479997EE1DFDCBEFF6111
SHA1:	26A36F1237782F275F04666D2636693839EC5FAB
SHA-256:	9A8AC77C07E26EFFDA9C6205E712FDF3C43335D2F5798AB7ADE4CE1A77B64669
SHA-512:	B49F418381F9B0AD93EE75051FE0D41B5E2A95D259E2189815B5A3161CEDD7048B7D480B5F8D16A287B3CDCE3F125B212B7F32CC320D975F196FCE887AC27B21
Malicious:	false
Preview:	"use strict";..var ensurePlainFunction = require("../../../object/ensure-plain-function"). , isThenable = require("../../../object/is-thenable"). , ensureThenable = require("../../../object/ensure-thenable");..var resolveCallback = function (callback, next) {..var callbackResult = callback();..if (!isThenable(callbackResult)) return next();..return callbackResult.then(next);.};..module.exports = function (callback) {..ensureThenable(this);..ensurePlainFunction(callback);..return this.then(...function (result) {....return resolveCallback(callback, function () { return result; });...},...function (error) {....return resolveCallback(callback, function () { throw error; });...}..);.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\promise\#\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	105
Entropy (8bit):	4.764871204033721
Encrypted:	false
SSDEEP:	3:jTqhBBbH1FXxQWAf+MHAM3MLEHKXjAYMYr9v:4BLBq+JwqXcA
MD5:	23393A67AF2518EEC660BFDF0349198F
SHA1:	60317BA960E63CC5B14C2213808661762F5819FA
SHA-256:	6A51FEE468C41BD031137C9A9FE4582F7C4E443EE8BCF624D436F5273902E57E
SHA-512:	C95B666CA13059F3A872A6DBBF23CD8F1B9FEB07170C1CEC3988B2F6761875D922DE57E7D9ADCDC3CF67314983B20FE393D0EAD13803E6D2C982E160D09FF2B3
Malicious:	false
Preview:	"use strict";..module.exports = { asCallback: require("./as-callback"), finally: require("./finally") };.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\promise\.eslintrc.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.000432302535625
Encrypted:	false
SSDEEP:	3:ai9Ak9AjwC:aaANd
MD5:	6262CAE00A6BF36D9A8F9D3B1AC100AF
SHA1:	92708F684AD9568F894263B26B6EACE555EF6F83
SHA-256:	15F5C2DC524401633C77D1B334E5130A8BF4DD403AF9C8C373115D6F925435DE
SHA-512:	02A4C3EEB53F8ABE06F3C3A8FC84251CDAB775EFF28A758663538AB5859C10E685BC5D2FD6242A4814DE1A7CD638807320283B56042E5FD9F52D02C201A40730
Malicious:	false
Preview:	{ "globals": { "Promise": true } }.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\promise\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	84
Entropy (8bit):	4.59577140586704
Encrypted:	false
SSDEEP:	3:jTqhBBbhfJA4DFXxpASDC:4BFftC
MD5:	A13A7C83C82D8174DC39B5CE6E48172B
SHA1:	E562403E3F99B78EA843F96BC0BB0A5CD92D0588
SHA-256:	45D119DD1C45E9B7BCD42BD70166A87568926D0AB888120D4D393167A8F47F6A
SHA-512:	8F98B441C27CE5F5B1E89FEFEFC85107498FA362310198F889299AFC3A50374D9EB7BA78D5F78FA64A2C79F8C72DAAD6DA1E7806E97C955B7B348D78F2C4653C
Malicious:	false
Preview:	"use strict";..module.exports = { "#": require("./#"), "lazy": require("./lazy") };.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\promise\lazy.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	847
Entropy (8bit):	4.867545269949213
Encrypted:	false
SSDEEP:	12:aHzBl09oR9Vnmko1D4duBCOY197W4bFW/2QoEJkEnv4vX4k+8xbL7FnxnQm:gBd9URQVbFWDo3Eoi8xxnJQm
MD5:	6DFD31420E794AE656B7541B7DAB260C
SHA1:	5BB82CEA73EF6FAD702285213F946DD9128582C1
SHA-256:	BCA2683935E69E56D9C20DDCB575331CA66D02280567E37D7CD990B6FAE638EB
SHA-512:	9292CBEA3EECB3B03547179998CBD0831C41F0C852205C552B86FC62400C182B26524665FCA6099982AC4525BCC8B5DD3627B114C7DFEA2D74A809F66548C1A2
Malicious:	false
Preview:	"use strict";..var isFunction = require("../function/is-function");..module.exports = function (executor) {..var Constructor;..if (isFunction(this)) {...Constructor = this;..} else if (typeof Promise === "function") {...Constructor = Promise;..} else {...throw new TypeError("Could not resolve Promise constuctor");..}...var lazyThen;..var promise = new Constructor(function (resolve, reject) {...lazyThen = function (onSuccess, onFailure) {....if (!hasOwnProperty.call(this, "then")) {.....// Sanity check.....throw new Error("Unexpected (inherited) lazy then invocation");....}.....try { executor(resolve, reject); }....catch (reason) { reject(reason); }....delete this.then;....return this.then(onSuccess, onFailure);...};..});...return Object.defineProperty(promise, "then", {...configurable: true,...writable: true,...value: lazyThen..});.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\reg-exp\#\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	226
Entropy (8bit):	4.721375546755258
Encrypted:	false
SSDEEP:	3:jTqhBBbmZMGzaUAXPYSVHGUAXPAyvfFXjATyRjvAtBpAMAjYsJ0kKtXjANhWmitm:4BSynPHovPVfGy+tBe0o0kKAhWmUSP
MD5:	95496D3B0FC8B475F08424F8876752F9
SHA1:	28C721BE80348148A805626F67C98FA83995E48B
SHA-256:	6EF03C0AA8C0B1A3957A67DDA10C606A6EF8FAF29D82D6E638BEDC59668819A9
SHA-512:	04782FE2324DCEA25245C60B510E6641BC1A61D57D9CFC0E1927A8E8442E52DA453B2AF733B0076A136CDBB9B1918E6E84152D7B2EEC77B443B4621B711BB73E
Malicious:	false
Preview:	"use strict";..module.exports = {..isSticky: require("./is-sticky"),..isUnicode: require("./is-unicode"),..match: require("./match"),..replace: require("./replace"),..search: require("./search"),..split: require("./split").};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\reg-exp\#\is-sticky.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.978944509911048
Encrypted:	false
SSDEEP:	3:jTqaFTgSACYAFXjA+1BIQLAd+dzFQX87zk7zH3IYBbfaaXARQbdRi/ECwCYRNpIX:z4SBIQfQM38XDBURRM53Nm5N
MD5:	BCD1DB113462D9164605F29BB2AD2FA4
SHA1:	8F71A4073A0B77C8924D22C40B718366CC23CA7F
SHA-256:	C02E73A7827064B922C06F73DF74D3DC216C6ACB092E88953B7E9CD4C0EA09AB
SHA-512:	7A6D42A9B7DEE55D396DE267670A0EF4590A1AECB3D226D242F8BADAC1F5BB23B1C799002F07F2582524B35DBC392BC80BF591E3C80DBF0DC4D490FB852F0694
Malicious:	false
Preview:	"use strict";..var validRegExp = require("../valid-reg-exp"). , re = /\/[a-xz]y[a-xz]$/;..module.exports = function () { return Boolean(String(validRegExp(this)).match(re)); };.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\reg-exp\#\is-unicode.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.958308877477767
Encrypted:	false
SSDEEP:	3:jTqaFTgSACYAFXjA+1BIQLAd+dzFQX87zoc43IYBbfaaXARQbdRi/ECwCYRNpIEe:z4SBIQfQM3MDBURRM53Nm5N
MD5:	D7BD138B537C5566D5F116C3AC34A503
SHA1:	835A937EF98DF555D0CDC25D25E53A7804C64733
SHA-256:	0F024B40AC278637746EC06C9FA3C966C31FFEF0097C420773EC57D15E60D163
SHA-512:	57AA65CA68870ADB8B9D64DD8CD0246074BA3E45244747EF78809747A994BE3EA89BD3D444FF3E1F858876FF11396FCA904704EC3D61C1F0407256B62D77D982
Malicious:	false
Preview:	"use strict";..var validRegExp = require("../valid-reg-exp"). , re = /\/[a-xz]u[a-xz]$/;..module.exports = function () { return Boolean(String(validRegExp(this)).match(re)); };.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\reg-exp\#\match\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.938526440549565
Encrypted:	false
SSDEEP:	6:0iPbeA4oLFLTs6qJZNE3Yc6nLTewFR5FX9DE7xuOfFR15Md:PTQqVr3o7FnrDIfBMd
MD5:	2595D5116F2F2FD5C453923F6C25CA12
SHA1:	4DC57FA29C02D6069A4B7B14E1124015A45B2F10
SHA-256:	ED0FC995DB5376E3A84E3E7CFE342D0BC565ACCE9BCC088CD4F8CB3E9952915D
SHA-512:	67C2535882EEC6C41FB8085EC8E6641144D1AB7FFC8504BD3E8755D937DDF0A8A3401AEC709CB686DD9F01AF49CA8D6EA8E2C22816ADBD54B8972DF9355648AD
Malicious:	false
Preview:	"use strict";..if (!require("./is-implemented")()) {..Object.defineProperty(RegExp.prototype, "match", {...value: require("./shim"),...configurable: true,...enumerable: false,...writable: true..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\reg-exp\#\match\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	108
Entropy (8bit):	4.665102522674996
Encrypted:	false
SSDEEP:	3:jTqhBBbJAXPbJYRAKaOw4s6qLPGNltjANcw:4BWPbeA0w4s6qLPG1Ccw
MD5:	91CEF45C66DBB027189FBF772134546E
SHA1:	0C1C7D6A44E8C50761D34E579DB6DC564FD9B0F5
SHA-256:	51205D32CAC7F72B4534D1E8E7CBFAAB01505788DEEEA01573654B6C2106AB82
SHA-512:	7299A4E627000BD5EE33746C7DBDA50B5C7E51434308EB1A56F8074A6820F5959C5D2AE85703438863E2830C724824B5B40C81692704A92DA2519D43E9B5246A
Malicious:	false
Preview:	"use strict";..module.exports = require("./is-implemented")() ? RegExp.prototype.match : require("./shim");.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\reg-exp\#\match\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	168
Entropy (8bit):	4.684955084682461
Encrypted:	false
SSDEEP:	3:jTqaFXqzIKzBbfaQ3+hXAVI+YoHASEJL5f+BH5VeWKkXkwu5RaVsKsevYw:3qkKzBb3+BkJ/AkpK1wY2swYw
MD5:	DE482BCDE78BB4BF1F686F5A19F874AE
SHA1:	1CA2E202B30184E64C1FE947A2A3BCC781A6799A
SHA-256:	01A32B0A2DC34D50C5F05B71334D7D2D46CFDC56F0DBB82B0ABF408541F52B92
SHA-512:	F2D3C5550BBEEF7D81F0A8F144231F4C92C358C8388D09C966558F971F13DB923C35C7D951E7DD359F6A43A01547D86B938495359A5A53772F3E55DAFF07731C
Malicious:	false
Preview:	"use strict";..var re = /foo/;..module.exports = function () {..if (typeof re.match !== "function") return false;..return re.match("barfoobar") && !re.match("elo");.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\reg-exp\#\match\shim.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.868223313236824
Encrypted:	false
SSDEEP:	3:jTqaFTgSACYAFXjA+LABIQLAd+WzBbfrCxCYRNGgxML5XsaDNMy:z4KABIQyzB3w3NGgQ5X
MD5:	4CF61D929D1075607E65E56C71334992
SHA1:	8C0EF8287C80A9AF14CB065D29265E0E8843C59A
SHA-256:	CBB77871BC4F011189F2E20B2B4E40F1204FF4D2E94919E15FA6A8359E25F907
SHA-512:	D124343D70F312634600A902BF2FEC896951AC4C0F926F6233AB0C6791381EEFF27294E11291C9622D798AC85B5AB037DE8626A98F7B2450BB50A83B84933636
Malicious:	false
Preview:	"use strict";..var validRegExp = require("../../valid-reg-exp");..module.exports = function (string) {..validRegExp(this);..return String(string).match(this);.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\reg-exp\#\replace\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.906154953927762
Encrypted:	false
SSDEEP:	6:0iPbeA4oLFLTs6qJOCpbyE3Yc6nLTewFR5FX9DE7xuOfFR15Md:PTQqV3CpL3o7FnrDIfBMd
MD5:	47B158C6A9324FFDC5AAF9A4D6F568E5
SHA1:	432FC5CC2DAB987C9DA1B5DF174A98599DDC1063
SHA-256:	C5C8AD49FE25375D4FC432B9C431D288C30E29258AD3B61993BEFED2C8AB7B1F
SHA-512:	43842192F869F5B1AEEDDC0E91D9D3125770E2CA18903BB6838B8E6ABA1F9D794127EC4FCFFFCECDC0F88CC9FED47A8B93324C2B1FF83B29F4A66F2951C1537A
Malicious:	false
Preview:	"use strict";..if (!require("./is-implemented")()) {..Object.defineProperty(RegExp.prototype, "replace", {...value: require("./shim"),...configurable: true,...enumerable: false,...writable: true..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\reg-exp\#\replace\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.624701674087888
Encrypted:	false
SSDEEP:	3:jTqhBBbJAXPbJYRAKaOw4s6qLAClyUANcw:4BWPbeA0w4s6qLAClYcw
MD5:	59AE62346DB6693C20CA4FB64DAF31F4
SHA1:	5C43D11E33E0CC9FD7901FEEF12461EDBE536A2B
SHA-256:	DC1E56D9D43B1BAB081721F96F2DC7A0A7E8B67D87BAA4A046FF9F8D4DF50B75
SHA-512:	EB19FBE3500582DD315E1E8A71F1BE63533F405415B93800FBA05A988A868E1B8F7ECDDAE7B6BCD59D41B0CF8ECA3045557E47B68FA76E987FBC08D280B7C37E
Malicious:	false
Preview:	"use strict";..module.exports = require("./is-implemented")() ? RegExp.prototype.replace : require("./shim");.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\reg-exp\#\replace\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	169
Entropy (8bit):	4.5803375737282765
Encrypted:	false
SSDEEP:	3:jTqaFXqzIKzBbfaQ3+hXA1+1aSEJL5f+BYA0VW1U4eDZ+r:3qkKzBb3+BCYak0Vt4eDs
MD5:	4661217484B9F6DDAA493EE0F7BEF375
SHA1:	D30C8B8E06B48F938556D34525857E7760FCA758
SHA-256:	220AC155B37C3DFE401B4E531A18FDEE98B135B3086F062C7EFCE1E06BE9B1F2
SHA-512:	9ADDAEE62B31181B351E09D583E6F1708592B00947176D02D1DC8D0A9CA04A1E5AD9EA0D8CFEC6885B9BC5AD069C64C41C6E772CADD5C6A97EAC0839A6E54359
Malicious:	false
Preview:	"use strict";..var re = /foo/;..module.exports = function () {..if (typeof re.replace !== "function") return false;..return re.replace("foobar", "mar") === "marbar";.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\reg-exp\#\replace\shim.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	192
Entropy (8bit):	4.84837774397259
Encrypted:	false
SSDEEP:	3:jTqaFTgSACYAFXjA+LABIQLAd+WzBbfrCLXhzEJCYRNGgxML5XjJYDJJFXA0zEQw:z4KABIQyzB3SM3NGgQ5lYDJJFXhZw
MD5:	04FAB2DE8F6BB7ED3925ABAA1D8E77B3
SHA1:	FC130707161746C4B02F2041B3FE04A61C542770
SHA-256:	10EE2986A53EB0677F69925A0905D0B1B3D6F2908D7E846CC47EE8DFD83201C6
SHA-512:	FD68FA2848404A84EBA62FB0117682B2C4C68699F904628E3153FFF563D46967CB4B93D635AC143695D9E90C5229A9D1C5AFE6E8B3DE8CE856CA963728C474E9
Malicious:	false
Preview:	"use strict";..var validRegExp = require("../../valid-reg-exp");..module.exports = function (string, replaceValue) {..validRegExp(this);..return String(string).replace(this, replaceValue);.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\reg-exp\#\search\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	201
Entropy (8bit):	4.926094454137547
Encrypted:	false
SSDEEP:	6:0iPbeA4oLFLTs6qJ5gE3Yc6nLTewFR5FX9DE7xuOfFR15Md:PTQqVa3o7FnrDIfBMd
MD5:	8AF8F21DAA3ECDBAB33B2F494635D789
SHA1:	0DEA3F3C60D7AD54F82CBF38DE97ADA1D66EC8B4
SHA-256:	8356EC7045EC0CE2D282C922099E17DAA9E7B8356DC37CED164EAEA162A22B00
SHA-512:	48EDB1670635F93D9838617A2CF6FB3324462034F43F66A619EEE86D8C9A7A5834475B79EEBBFBFB1CE1D55FA2C38DD9E1C25CAE794F52E9649AFABA49C8B9CC
Malicious:	false
Preview:	"use strict";..if (!require("./is-implemented")()) {..Object.defineProperty(RegExp.prototype, "search", {...value: require("./shim"),...configurable: true,...enumerable: false,...writable: true..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\reg-exp\#\search\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	109
Entropy (8bit):	4.646347221447485
Encrypted:	false
SSDEEP:	3:jTqhBBbJAXPbJYRAKaOw4s6qLHRtjANcw:4BWPbeA0w4s6qLLCcw
MD5:	3BF8488203E15AD75D2C480144C4E1AB
SHA1:	81B07D05FE18EA9324B7E73C4EF19A67B7924986
SHA-256:	B78DDC9084CAD91DD7DD016A22063A79E1DA3377AA9D37ECA69AE39E1F1153E0
SHA-512:	FEF2550D0113AC3ECF932AD92F41096083D6C45F700B7B7F1505564AB3A8C57986D403F2EAFE80D7CBA56428152C28D46FCAC41C73D776DAAA6E0A4A03709B9A
Malicious:	false
Preview:	"use strict";..module.exports = require("./is-implemented")() ? RegExp.prototype.search : require("./shim");.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\reg-exp\#\search\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	153
Entropy (8bit):	4.606557041943371
Encrypted:	false
SSDEEP:	3:jTqaFXqzIKzBbfaQ3+hXAarYoHASEJL5f+BZBQeWKHMcnYw:3qkKzBb3+BTr/Ak3Bn6w
MD5:	337E83987E7F4C800F92D231240224D4
SHA1:	F8C1234A61AA9E6F148FEE09EA92742845EA9FDA
SHA-256:	2FF08684A81AB5350AF674D35292C8365625DED044AE5C75001CB2DD076F59D1
SHA-512:	536E969DFA8EE066213F1DB5588A37E5C8605A51789566F25149313A71EE5BEFC29DC858987509B79873E16EBA31E609BDC26B2674FA0436ED19DC6654D579DE
Malicious:	false
Preview:	"use strict";..var re = /foo/;..module.exports = function () {..if (typeof re.search !== "function") return false;..return re.search("barfoo") === 3;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\reg-exp\#\search\shim.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	163
Entropy (8bit):	4.847391703481484
Encrypted:	false
SSDEEP:	3:jTqaFTgSACYAFXjA+LABIQLAd+WzBbfrCxCYRNGgxML5XSnNMy:z4KABIQyzB3w3NGgQ5i1
MD5:	86E761C0F39FC122A20FE5733A147E75
SHA1:	AD6B49177413A3F76F8D20AE5CB94DE08DFD805F
SHA-256:	EF1365C59AC9812168619E7262EE4ABC1C40D3B49A268342F178F8104C086075
SHA-512:	68239EF7A2CF3A48E12A381272C61724EC7B030CC5625FEE0EE3964585F52834B9606F6715B10195B48019CED2C5FA78B3653848823114ADC1345669864FBA0F
Malicious:	false
Preview:	"use strict";..var validRegExp = require("../../valid-reg-exp");..module.exports = function (string) {..validRegExp(this);..return String(string).search(this);.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\reg-exp\#\split\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.918418651230417
Encrypted:	false
SSDEEP:	6:0iPbeA4oLFLTs6qJ3JuE3Yc6nLTewFR5FX9DE7xuOfFR15Md:PTQqVC3o7FnrDIfBMd
MD5:	1B96911DB9E9F7DA566C5AB020B2F18E
SHA1:	4C102DD877D614E0E2F8E8F88FEA248D6056C28E
SHA-256:	3EB780B89CEA6CB5472488368D14DA1BF5D7A378843B8F38DE648CB2E62E77B4
SHA-512:	5F4F67B467AD40BE263111462D05661219D82E84705A287890093AA4BD73BC15BF11F1983B8474E628EF4167D66EED922CE202F53E68AB69C6DA8CC788D994C5
Malicious:	false
Preview:	"use strict";..if (!require("./is-implemented")()) {..Object.defineProperty(RegExp.prototype, "split", {...value: require("./shim"),...configurable: true,...enumerable: false,...writable: true..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\reg-exp\#\split\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	108
Entropy (8bit):	4.599480063993669
Encrypted:	false
SSDEEP:	3:jTqhBBbJAXPbJYRAKaOw4s6qLSJMRFfyUANcw:4BWPbeA0w4s6qLSCRFfy1cw
MD5:	1AB776890FF2279CF9A06FA47A4B5884
SHA1:	C311F66BAF2F7D206C98396740F4447E0E6C116D
SHA-256:	10F7285B701899C95143AD951CC09040EA9048929C79F39F4FBF9B688F5DBCB8
SHA-512:	FF021520E31C2BFD883E0F7611F6FD4560160A4E973A9D450302805F7E6F5E9493A294903E499422302BDD4B3D680CE22A5D9378E181DF0273459D3E47934549
Malicious:	false
Preview:	"use strict";..module.exports = require("./is-implemented")() ? RegExp.prototype.split : require("./shim");.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\reg-exp\#\split\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	158
Entropy (8bit):	4.713688027111519
Encrypted:	false
SSDEEP:	3:jTqaFXq50w7BbfaQ3+hXANFE19ASEJL5f+BZkNHkYKp7aDKDv:3q50UBb3+B+Fe9Ak3kNHTKUI
MD5:	40F8C2117CDC069DB6EA91182A15C1FC
SHA1:	150DF8342A4755071A45CED02CA9D476D97C40F4
SHA-256:	A3D395E31FF3D20D6AAC48AD83089DCEC446D0EFC2170D9E5498B111E0E4F6DB
SHA-512:	5EF6FD7D86C633F13BC0A8EBC6ED7EEFFA7767D6F744040CF8FB12289B1B0730E8B0834502F6497D14BDB17071F5F8D5265BC9DCCAC842C5B57F9E6732AC5280
Malicious:	false
Preview:	"use strict";..var re = /\\|/;..module.exports = function () {..if (typeof re.split !== "function") return false;..return re.split("bar\|foo")[1] === "foo";.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\reg-exp\#\split\shim.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.83480242916676
Encrypted:	false
SSDEEP:	3:jTqaFTgSACYAFXjA+LABIQLAd+WzBbfrCxCYRNGgxML5XHJQNRJj:z4KABIQyzB3w3NGgQ55QNR1
MD5:	FFA4F8B5C19549C8EABEC90C1718010B
SHA1:	94D4782FF0BD8A8CA1B0E4F7200A72219FABDF88
SHA-256:	E1F5F9AE4A22693E294A1CDEE10EDCB03C3F8EE6C119381638F492C9290FEEEA
SHA-512:	1ADC25EE810C1611B274156B4FA769CB0C44F88EC8D922E0E0B7231F3C1928A6387E187FDC5E1860AD23F56AACE15A982BC38B8031330D3551E6FEFF2938DAC6
Malicious:	false
Preview:	"use strict";..var validRegExp = require("../../valid-reg-exp");..module.exports = function (string) {..validRegExp(this);..return String(string).split(this);.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\reg-exp\#\sticky\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	213
Entropy (8bit):	4.9859389833639005
Encrypted:	false
SSDEEP:	6:GKZiPbeA4oLFLTs6qJRGtTewFR5FX9DE7Vp:pgTQqVkk7FnrDI7
MD5:	9131A946D29FACAB1AEEFE92F1A0A2FF
SHA1:	1F13BB073174A9A91215AFF47CA1A26B880209B5
SHA-256:	E930E7670B410ED90EEBE76A405FEAB6CCDA60A41AB2EBB51BA0983C8004B015
SHA-512:	95EDE1B97B606929E199E5AF387AC094A065446D6EB4917844DBA59A7FDB7B72F288B3F3C5A15B071FC529508E8230E3B0A29F6BE3B2D95AF8AFBCACE962BEF5
Malicious:	false
Preview:	"use strict";..var isSticky = require("../is-sticky");..if (!require("./is-implemented")()) {..Object.defineProperty(RegExp.prototype, "sticky", {...configurable: true,...enumerable: false,...get: isSticky..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\reg-exp\#\sticky\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.003435774630131
Encrypted:	false
SSDEEP:	6:4B9o9EGvz1H9GgEm6MHqFb4Bfe38f22uxG8f2239N8faL6GAR1qAIsvn:4B9yEiGkfe3O22HO22vOCARcsvn
MD5:	F59D444750E6051F9074696D658862AF
SHA1:	7A8F7C42CDC4348F53A2EF2624DF5D1118491BBA
SHA-256:	555C05EA4B62E5038A0E0CA71BEA044149D87A374846C4AB40635423E2A435C7
SHA-512:	3B44F1D14B6F2105E811A0E24FBB9CEE7F4F4CD91557124008792497B343349EC99BFBB090749ABE235A3E06E5E762D490B222C251B52B16BEEB3E64DB875A81
Malicious:	false
Preview:	"use strict";..module.exports = function () {..var dummyRegExp = /a/;..// We need to do check on instance and not on prototype due to how ES2015 spec evolved:..// https://github.com/tc39/ecma262/issues/262..// https://github.com/tc39/ecma262/pull/263..// https://bugs.chromium.org/p/v8/issues/detail?id=4617..return "sticky" in dummyRegExp;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\reg-exp\#\unicode\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	217
Entropy (8bit):	4.934906635062688
Encrypted:	false
SSDEEP:	6:ASBiPbeA4oLFLTs6qJQRLTewFR5FX9DE7Vqk:A5TQqVDF7FnrDIYk
MD5:	3D14F444FB0D2CE2F82C4FC99D03383B
SHA1:	8B4751473A38117EC55B12EA382D833859F4B8AC
SHA-256:	AE6C84BDC3B88E59EDCADF636A90DD86F0D23BA42661433DA00156CA6FF7558B
SHA-512:	1241A75C851308F1F707BA8B8D203B0FDF14E68B5849424789B637D03F7E11134F048A528ECBCE967349BA6E9F1C47D1A312F3658094C60FD60F56424EDEABE6
Malicious:	false
Preview:	"use strict";..var isUnicode = require("../is-unicode");..if (!require("./is-implemented")()) {..Object.defineProperty(RegExp.prototype, "unicode", {...configurable: true,...enumerable: false,...get: isUnicode..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\reg-exp\#\unicode\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	345
Entropy (8bit):	4.988660503134427
Encrypted:	false
SSDEEP:	6:4B9o9EGvz1H9GgEm6MHqFb4Bfe38f22uxG8f2239N8faL6GAR1q/Tsvn:4B9yEiGkfe3O22HO22vOCARcYvn
MD5:	EEC256568FA07E0F09336AA9A3293A51
SHA1:	45B31211F4479FFADB1C241853FA309976B46140
SHA-256:	D0019CED32689B99492D5AED9156135985C22E9B29762C007B8D19F5DCBC5FBF
SHA-512:	C8600F6C5C5DDA891D9497984C64E293C4F18CBAE143FC2479B31CD900C2F0A14D2463F76E30F604E900586784254031F8F0B7B19E240F9D83C9809808EDEFDE
Malicious:	false
Preview:	"use strict";..module.exports = function () {..var dummyRegExp = /a/;..// We need to do check on instance and not on prototype due to how ES2015 spec evolved:..// https://github.com/tc39/ecma262/issues/262..// https://github.com/tc39/ecma262/pull/263..// https://bugs.chromium.org/p/v8/issues/detail?id=4617..return "unicode" in dummyRegExp;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\reg-exp\escape.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	254
Entropy (8bit):	5.194242060114887
Encrypted:	false
SSDEEP:	6:jLtCLyDDZw4dc2i8g63QEqm7yBzR7Q5KLxF+D:jLDZxir63QjuyBB3LxFw
MD5:	5AF6379D678758F49A5D74D08903EFC2
SHA1:	7F5EB70471996B5477AEE5A242E10AF9F78C30C7
SHA-256:	A9E94816560B8EC61181AB0E1A5A152B6D79450022FC13BE9FCDFE8807838F19
SHA-512:	EAF266D73716D4CBEEFBC48CAD68075547AF5E9F91848EC655E4EBA05D315E9DA7A106C305C0534828C0A476056906A49F692E8C85321E3B42F128F72DC3F190
Malicious:	false
Preview:	// Thanks to Andrew Clover:.// http://stackoverflow.com/questions/3561493.// /is-there-a-regexp-escape-function-in-javascript.."use strict";..var re = /[-/\\^$*+?.()\|[\]{}]/g;..module.exports = function (str) { return String(str).replace(re, "\\$&"); };.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\reg-exp\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	172
Entropy (8bit):	4.703566279392924
Encrypted:	false
SSDEEP:	3:jTqhBBbmBljApAXtQUAbBRHUwEFQUAXPQk+sTgMBwCYtFQUAIECBIQLAd+7v:4BSB0EWBRHPEFQvPQYTgz7FQxCBIQvv
MD5:	CBF82ACD23BC2F6B3B0D135AA015009A
SHA1:	8B053D000D3684E136E2C6E309A47906B322CAAF
SHA-256:	601AA72591F9B60AE77DDCA73D91B5E3B72EF79ED83D08E425449AB3C2355D0B
SHA-512:	0CE0301AE2CB8DB7431A0F12902F1C5B1621F99F0BA219345BB0925499B1EFCF8877BF863A6491A21436342A778C206D0CEDEE523A2AEE46E18B41D7CAD176C7
Malicious:	false
Preview:	"use strict";..module.exports = {.."#": require("./#"),.."escape": require("./escape"),.."isRegExp": require("./is-reg-exp"),.."validRegExp": require("./valid-reg-exp").};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\reg-exp\is-reg-exp.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	217
Entropy (8bit):	4.909330357424912
Encrypted:	false
SSDEEP:	6:85XcQbKHqLs98l2XzDXeTBWy8tfFavmGbCOH5XziE2fWAO:85MpQs98l2DDXUBWPtfamGbCOH5DcfWH
MD5:	5D3631D001713A690814B60742E481A9
SHA1:	D4E6D60D6F6486A412E7FA858D1E25256A1EF953
SHA-256:	23E8A59DF5136B23D62FBC21F0B9BF4EEB4FFEA8FB171688CF5784DF32C207F4
SHA-512:	B21D83BD46FA3C5F46FF76C0D3449B3C3CBEBCCD234FE68D9DF8F26E28D3C567CA7E83E2F84DF977974EF0C300823FF965D5220AB48395063AA3F7F571B1325C
Malicious:	false
Preview:	"use strict";..var objToString = Object.prototype.toString, id = objToString.call(/a/);..module.exports = function (value) {..return (value && (value instanceof RegExp \|\| objToString.call(value) === id)) \|\| false;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\reg-exp\valid-reg-exp.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.86565174066279
Encrypted:	false
SSDEEP:	3:jTqaFMwAClFXjAXPQk+WzBbfamFQ3jRVpMFRFoV8+8FXFLW0YGVvn2Fg2vn:HQPQyzBWyQ3jRVQ7+8xFLj+2I
MD5:	8F9E9602854A8AF59F197921CF98D518
SHA1:	4DEC06A06844EC830B5B6C7345F71BFA841C948A
SHA-256:	52001CBD80000E7A1D5EB2735A2C184ABB6FEA11018D42AA923FF2B647304692
SHA-512:	13CE9F0E3B5614CC45FE08052056080236F00B4BA58E89E642ABF57B62DB25AAA807988BB92F535D0F84E1AD90A166B807D5FAADE00BE8BD49A6EB2C3265585A
Malicious:	false
Preview:	"use strict";..var isRegExp = require("./is-reg-exp");..module.exports = function (value) {..if (!isRegExp(value)) throw new TypeError(value + " is not a RegExp object");..return value;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\safe-to-string.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	266
Entropy (8bit):	4.807040806042094
Encrypted:	false
SSDEEP:	6:WcVMFIHfzBWyk/MfFBuLXX8MwsndQVfCL9J9LGEPQvzv:UFIHfzBWSfu7MMZdUiJpGEPQvzv
MD5:	38E9BD985D62D5976AFFE97D799FB457
SHA1:	4B4EC853DDB804D3FB6635500C2587E7506BC301
SHA-256:	E4744022C6BF108AFAB68564A4A93AC68E1DCBEE759972A01EA7207240A84A76
SHA-512:	8D323255D6FA44F8C7A48E334AF16EA30A0CB61152FA5C986291488762B1BF97C907AAAFD8C7A29EC9755D5307D30407CE7B8A343A87D90A6192CC3A06F3F7A1
Malicious:	false
Preview:	"use strict";..var isCallable = require("./object/is-callable");..module.exports = function (value) {..try {...if (value && isCallable(value.toString)) return value.toString();...return String(value);..} catch (e) {...return "<Non-coercible to string value>";..}.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\@@iterator\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	223
Entropy (8bit):	4.874291554190278
Encrypted:	false
SSDEEP:	6:0iPbeA4oLF3pqJ7sR4KXmTE3Yc6nLTewFR5FX9DE7xuOfFR15Md:PTQqVTyMmI3o7FnrDIfBMd
MD5:	D12F0E2CA11227CE0FA9FF5B3C3ADBF6
SHA1:	238A1379D03ED84748672A045DAD1CE4D476FCF8
SHA-256:	1D2870F99D7A0F356A6E62DA20B4F0EA2ECB4B159C8FA2B48FA765C01AB485EE
SHA-512:	7196A8692F1AEBA128D79562944493929501C086E4524D04F89B2B2098F3D87BFDACBE878527579D7C27FB5EA1D15FF5497F97D31E8D151D44250B65A01F58BF
Malicious:	false
Preview:	"use strict";..if (!require("./is-implemented")()) {..Object.defineProperty(String.prototype, require("es6-symbol").iterator, {...value: require("./shim"),...configurable: true,...enumerable: false,...writable: true..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\@@iterator\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	136
Entropy (8bit):	4.7095158132798645
Encrypted:	false
SSDEEP:	3:jTqhBBbJAXPbJYRAKkMxCpqdJN4scy4KXiRUQWANcw:4BWPbeAMxCpqdJusR4KXiRU4cw
MD5:	89106E9B3C6ECD2795A7E9CC6624064D
SHA1:	D8A8D746A2F8968FA9430C96A9357B7492BBDE19
SHA-256:	331F1D8D48BE899FE9BC38354BF91E25948D550102941E6A9B60737EEDB2F8D2
SHA-512:	A8947AA73EADF99604A1579D8D01F9F3B70608E8208D9117611788A613C9DA3830C1FD24EB0D425F974F70051B2A2877A3C4E67DA14E33D46F9BFBB0FD3EEBCB
Malicious:	false
Preview:	"use strict";..module.exports = require("./is-implemented")()..? String.prototype[require("es6-symbol").iterator]..: require("./shim");.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\@@iterator\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	479
Entropy (8bit):	4.646876130604065
Encrypted:	false
SSDEEP:	6:dXxY7sR4KXDYBke6wFMm3X71qLX2eX2XutsXEQR17XSaAU3XWIJtZbQ/4:V9yMDYBcwF17cj2Iwu0Z1TSdUnWIX9V
MD5:	03496F0DB7192AAB9CB47562E2AA777F
SHA1:	5DF6DEC14A89630F343EFFB19874B5C1369D0993
SHA-256:	666AB5FD7B1FCC8F546F2C67C167AE256EBBBB3CAD76D1C2EED8F818535B78A1
SHA-512:	FF77CDA33D3047808C4A39EAA6CDE68C0C9B2D7CAA0E581E0D10B22FEBE654DBC1A11DD0E7058AF232E632544C6F736C33130B7E0F1EB555AABCA22B7FB14ADA
Malicious:	false
Preview:	"use strict";..var iteratorSymbol = require("es6-symbol").iterator;..module.exports = function () {..var str = "..f", iterator, result;..if (typeof str[iteratorSymbol] !== "function") return false;..iterator = str[iteratorSymbol]();..if (!iterator) return false;..if (typeof iterator.next !== "function") return false;..result = iterator.next();..if (!result) return false;..if (result.value !== "..") return false;..if (result.done !== false) return false;..return true;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\@@iterator\shim.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	203
Entropy (8bit):	4.6490689210491905
Encrypted:	false
SSDEEP:	6:WXSRBMgrX+rIfNFwsAIIJt/zBURGwSRBMEYN:QrY0I1FwkIJt/zBFwrEYN
MD5:	12FA062A126AA87BE099219AFF09D2E8
SHA1:	6D2338A6EBD7B6BE7C1255721F694CBFDCEF603A
SHA-256:	4749A5D70708E80CE522DEB7AAD78F926C4A7ED677F6100A5606602A2E04FF32
SHA-512:	10D45D7FDCBF69B94F4A064C728030D9B72D9716E23143BE7C8938648A55305B7C53A63F503E29F1D39E8196983CFFC7F8071F096187FECCA4303182B7B68300
Malicious:	false
Preview:	"use strict";..var StringIterator = require("es6-iterator/string"). , value = require("../../../object/valid-value");..module.exports = function () { return new StringIterator(value(this)); };.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\at.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1072
Entropy (8bit):	5.047200263890222
Encrypted:	false
SSDEEP:	24:TYBDKvnSIvbBBWLv828E8CRhRnCkGDIseSl2aWOuWwR4RKnOxiO:WDKvbCLk2wCflCcseRE04wnGT
MD5:	7E233C79671935839AE89B53D6E8E960
SHA1:	7D34B78E05641AEFB757211A7952206C32D83DEA
SHA-256:	E7C6C272427E6CE85AAD832A1FA40F16DD13FEB5C51DD16F3771F0BDA2E88CE0
SHA-512:	3BE6A3E45AC8C5ECDBF2D4B654E66D73BCD0A950C0B43B8415EDA5A897DBE7C6C009E60990A1FE053E9940EAD4F7B3B46C5CA6ADFB42FE43BB14E77E11730ADB
Malicious:	false
Preview:	// Based on: https://github.com/mathiasbynens/String.prototype.at.// Thanks @mathiasbynens !.."use strict";..var toInteger = require("../../number/to-integer"). , validValue = require("../../object/valid-value");..module.exports = function (pos) {..var str = String(validValue(this)), size = str.length, cuFirst, cuSecond, nextPos, len;..pos = toInteger(pos);...// Account for out-of-bounds indices..// The odd lower bound is because the ToInteger operation is..// going to round `n` to `0` for `-1 < n <= 0`...if (pos <= -1 \|\| pos >= size) return "";...// Second half of `ToInteger`..// eslint-disable-next-line no-bitwise..pos \|= 0;..// Get the first code unit and code unit value..cuFirst = str.charCodeAt(pos);..nextPos = pos + 1;..len = 1;..if (...// Check if it.s the start of a surrogate pair...cuFirst >= 0xd800 &&...cuFirst <= 0xdbff && // High surrogate...size > nextPos // There is a next code unit..) {...cuSecond = str.charCodeAt(nextPos);...if (cuSecond >= 0xdc00 && cuSecond <= 0xd

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\camel-to-hyphen.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	217
Entropy (8bit):	4.8611917630838795
Encrypted:	false
SSDEEP:	6:3hcFpqLACLas8d4YBkQhZFXnxZRsRyJt2ACD:RSiACms8dTBtLFBDvJt9CD
MD5:	313F100C8AFC550BBF7C595EEE44A5A8
SHA1:	E0E381C5E7248D066DF6A69162246B253A44E76F
SHA-256:	96AA1230142F459420EE5F79DE7434946703521F38365DC6A4B1CD8CEC024E78
SHA-512:	874E0E69BFDFB7C54A0860CCACC0CE2035F5DD3DC02BAFD4B1A328905637071C02272564B2DE03B967321F84D0712CCB4FA64E4E8E42A6B4B076FEC41B940D7A
Malicious:	false
Preview:	"use strict";..var replace = String.prototype.replace, re = /([A-Z])/g;..module.exports = function () {..var str = replace.call(this, re, "-$1").toLowerCase();..if (str[0] === "-") str = str.slice(1);..return str;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\capitalize.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.846769331158759
Encrypted:	false
SSDEEP:	3:jTqaFTgSjA+LFJAIIJtHQKzBbfafo5oEfNIf05AdoN8g+RmAED:ztNzAIIJt/zBk+ZfNY05AdoT+RmtD
MD5:	FA5E4FEB5AC623E69895B37558A315C3
SHA1:	EC443108A1F37564A880B06FFFE8A2B5C3C91588
SHA-256:	A383B776829752D4757E8106058FBECDE18D628084496C4CFFEA2A23C82F04CA
SHA-512:	2891ED1D35007A6819ED1D75865C597EE25F0DEB8AAA3D179FE3F6702CC727005CCCCD52C44E3C2FF631FF0367E3FC0AB1A5EE725B4A74B27DE46D6252995688
Malicious:	false
Preview:	"use strict";..var value = require("../../object/valid-value");..module.exports = function () {..var str = String(value(this));..return str.charAt(0).toUpperCase() + str.slice(1);.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\case-insensitive-compare.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.640425300503539
Encrypted:	false
SSDEEP:	3:jTqaFRKkXTXMFpqLseWDBbfxcFfhXuMRXMMA9oENJyuMY2ryMM4w:xKeTcFpqLseQB+uYGZNJyu4ON4w
MD5:	28A4EBEB35760354D114FF1045E43926
SHA1:	69A126C66478FFB948DBA87870E3D14D209923A0
SHA-256:	75F2EA9423357B1123812FC8F3869412BD3BBF75B3C357BB497014AF01B49FAB
SHA-512:	5C46D24E88ABF72B0E01D77B041D91BBC3B6F163075CF2484B222C0375BEE9DCA86D988E9C1EBE73ACDF9A9C6C4EEB824AAC3F407300D0986A131192DC047E55
Malicious:	false
Preview:	"use strict";..var toLowerCase = String.prototype.toLowerCase;..module.exports = function (other) {..return toLowerCase.call(this).localeCompare(toLowerCase.call(String(other)));.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\code-point-at\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	206
Entropy (8bit):	4.906061391063501
Encrypted:	false
SSDEEP:	6:0iPbeA4oLF3pqJDVuE3Yc6nLTewFR5FX9DE7xuOfFR15Md:PTQqVQVL3o7FnrDIfBMd
MD5:	0D80931842395B5AA2666DA6752A7B27
SHA1:	D16604ACEBCD5138ECAFEF9D4196F01F70157286
SHA-256:	851DC4EB8E66A5E3A2499094D29F1110326B616AB0B965453C3FB682417A0F84
SHA-512:	2835F14D74D1065E04B966062FA362D891FB2E159B8EB5DEED6C9A295C1DF598123AE3E0093078A2B4CD650E9F3A0B89C4AB0E13CFE7CF27BFBEFF29D0FAE6F5
Malicious:	false
Preview:	"use strict";..if (!require("./is-implemented")()) {..Object.defineProperty(String.prototype, "codePointAt", {...value: require("./shim"),...configurable: true,...enumerable: false,...writable: true..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\code-point-at\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	114
Entropy (8bit):	4.629261698863138
Encrypted:	false
SSDEEP:	3:jTqhBBbJAXPbJYRAKaODpqLdptjANcw:4BWPbeA0DpqLXtCcw
MD5:	AC44DB6F5FC6313F48624E611707265D
SHA1:	48EA6393C5E54FE8A34F0A13ACF724D079ECE578
SHA-256:	46E0EBB7CEBE45D57A7E7CEAEFFFD79249ECFAFF945AB0DF9FF4589BA236317B
SHA-512:	51CF47CB9505599D0BA5B36E17631EC4386254C928D42F0859E1D6E22F6D81F64C45A431BB1C65FCD7A092979C6F4AAF8BB59A905E5328FCCF383395B3BF1A4A
Malicious:	false
Preview:	"use strict";..module.exports = require("./is-implemented")() ? String.prototype.codePointAt : require("./shim");.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\code-point-at\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.902137601695894
Encrypted:	false
SSDEEP:	3:jTqaFWRVokm5n03BBBbfaQ3+hWUaAlYoHASEJL5f+ANAfxAge7v:2V60DBb3+vawAkANP7v
MD5:	195168861BE0B82BA6C7E0BD67C9A1F2
SHA1:	4D7E5BB5ECB528E0F7D324E8D6E815628727D896
SHA-256:	B96013194224AC2BD6AD97AE0F8993B3ABC368E9D5E0B62BA07D163C879BB352
SHA-512:	DA88E416C7A7ABA8F4208FAA82BACF8575F9FB0E0AEE21087995307D54459D6DAFA907D301349E377A36A76003A63415A756C82F30BF9576B5B077BFC33438BF
Malicious:	false
Preview:	"use strict";..var str = "abc\uD834\uDF06def";..module.exports = function () {..if (typeof str.codePointAt !== "function") return false;..return str.codePointAt(3) === 0x1d306;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\code-point-at\shim.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	818
Entropy (8bit):	5.086657105778861
Encrypted:	false
SSDEEP:	12:j/VD02KFi/KqRXDepIxqtNkIJt/zBBRV38MLPEvKRrFoFs195iFwymnFNItqbasl:TY0Kon5IvbBB/8UGKRl1tOIbnl
MD5:	E2292EDC0BD013C417470AC70CCB1351
SHA1:	ED40C265A74F287328BE2AA3290879C8CA2BB5B0
SHA-256:	4123F029F489E6D4EC46AB58881ABE2FB1D182C8C5C400B06DB045689C865F63
SHA-512:	CFC76272E777EE4858C697194BADBD7CE4C6129D741F56E69B4C2B81BBCA334209E1AC110200E5E174EABD0399C27763A6D31A201114B9D73421FC0FC9EFB2B1
Malicious:	false
Preview:	// Based on: https://github.com/mathiasbynens/String.prototype.codePointAt.// Thanks @mathiasbynens !.."use strict";..var toInteger = require("../../../number/to-integer"). , validValue = require("../../../object/valid-value");..module.exports = function (pos) {..var str = String(validValue(this)), length = str.length, first, second;..pos = toInteger(pos);...// Account for out-of-bounds indices:..if (pos < 0 \|\| pos >= length) return undefined;...// Get the first code unit..first = str.charCodeAt(pos);..if (first >= 0xd800 && first <= 0xdbff && length > pos + 1) {...second = str.charCodeAt(pos + 1);...if (second >= 0xdc00 && second <= 0xdfff) {....// http://mathiasbynens.be/notes/javascript-encoding#surrogate-formulae....return (first - 0xd800) * 0x400 + second - 0xdc00 + 0x10000;...}..}..return first;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\contains\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	203
Entropy (8bit):	4.881903292495552
Encrypted:	false
SSDEEP:	6:0iPbeA4oLF3pqJDMbyE3Yc6nLTewFR5FX9DE7xuOfFR15Md:PTQqVQq3o7FnrDIfBMd
MD5:	13DEF22A42F1FFAB7D55490AE078BAF9
SHA1:	8BFD39974BBE73879A47A29F9BDCD2B869E9FF58
SHA-256:	88941C6896F88F4DF6FAFE50269C2DA5A8D0C0636D9CE2445E29A819A2F02A44
SHA-512:	227915BB051DB491A7C937E168DCB8DCD130CD95C23C0D5DA60DB06AB65A8A3F065651041614AF4B4601D04927B5A588CCF15D23C7B1327F876405EFF64FEF6C
Malicious:	false
Preview:	"use strict";..if (!require("./is-implemented")()) {..Object.defineProperty(String.prototype, "contains", {...value: require("./shim"),...configurable: true,...enumerable: false,...writable: true..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\contains\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.612355274247121
Encrypted:	false
SSDEEP:	3:jTqhBBbJAXPbJYRAKaODpqLd2FfFQUANcw:4BWPbeA0DpqLSYcw
MD5:	8863CD0BC8C53996CB0C7DB416E9068E
SHA1:	C1D9BAE75BCD6A7B614BC010C6A443E367075192
SHA-256:	0715BB4C802D7F724F822FD59ED55180ACFCAB87E9E7DB60B0428E98EEF1F041
SHA-512:	1AE699750F86169BB35C421755CD5401575D00A2D9F125BB46389A0C2776D4BE4B5DA52E837B4DEBDD0EADC14E954A6FEAFCCFA119852DFCD768F7ED94DD527F
Malicious:	false
Preview:	"use strict";..module.exports = require("./is-implemented")() ? String.prototype.contains : require("./shim");.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\contains\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.577017490651692
Encrypted:	false
SSDEEP:	3:jTqaFWRVo3eZcmBBbfaQ3+hWUQaFEYSEJL5f+AHaNHBSEHMcEJaNHDacaJ+7vn:2VcSdBb3+vQ8kAHQkEHkJQEg
MD5:	70280484027A30C0971355DC88AA1CE4
SHA1:	DE3CB3158CEA4DE0BB252BA96FD535B417A2C63A
SHA-256:	BD4EF5C6BCC166C3D56547FF5B7D793F1A413D0B97A7EA386B1BC6A587122A75
SHA-512:	ED81C4F54B3A46192153980F1A67EC1A915B6086E2EDB6426CA36EE4D03588BB55435543E7F227E19020E6F01CF69EF819ED98C59C58155E09C877274E4B73CF
Malicious:	false
Preview:	"use strict";..var str = "razdwatrzy";..module.exports = function () {..if (typeof str.contains !== "function") return false;..return str.contains("dwa") === true && str.contains("foo") === false;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\contains\shim.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.903844686378864
Encrypted:	false
SSDEEP:	3:jTqaFM1AccFpqL5BbfN26dDVKLquevnLB4iHNrXJFWBGY6eE5l5Uzegw:6wFpqL5Bp26dDGyNrZFa6bNUzy
MD5:	4436B506FFE421366C713CA1DB347435
SHA1:	5272DB82890C8DB2623793162DA894A9029EDCB5
SHA-256:	2059566AB804E9F9C21B831DD9438EC3DD064F4B562107E1AF54850B12058F5E
SHA-512:	3765C70FCB4AB18DED93432A928E1C8280E8C512881165444D23F788A5E3443967A9AC271983CD2CCF21579DFB2ED27A3F1292FBEBD49A1EDBF0F0F7587B55F0
Malicious:	false
Preview:	"use strict";..var indexOf = String.prototype.indexOf;..module.exports = function (searchString /, position/) {..return indexOf.call(this, searchString, arguments[1]) > -1;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\count.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	399
Entropy (8bit):	4.8979408925848
Encrypted:	false
SSDEEP:	12:ky7t0/zBpETw6Lz9pfCZq8aMKPTsRcj2T3OVrUvqOM:7ybBp8kZhETsRcjbVrz
MD5:	D7AB5F50658CD31A6543C59087EC5543
SHA1:	F2C093E3F88FE22BCA0A1032419CA504B3C790FE
SHA-256:	E43552B373CC59B325677B53F1A6B540616278E49CF8D7DC000E136E6677F1A2
SHA-512:	679B2E422F723283CA289E61D67B643DAED5BA1D822E464B617B660DBF6AC43DBD8A01B9AEE49ABB5793E438D654C89BA93C141DD69FEEF909762E3E6266A34C
Malicious:	false
Preview:	"use strict";..var ensureString = require("../../object/validate-stringifiable-value");..module.exports = function (search) {..var string = ensureString(this), count = 0, index = 0;...search = ensureString(search);..if (!search) throw new TypeError("Search string cannot be empty");..while ((index = string.indexOf(search, index)) !== -1) {...++count;...index += search.length;..}..return count;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\ends-with\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	203
Entropy (8bit):	4.902628810085628
Encrypted:	false
SSDEEP:	6:0iPbeA4oLF3pqJwBE3Yc6nLTewFR5FX9DE7xuOfFR15Md:PTQqVRy3o7FnrDIfBMd
MD5:	8D1290FCCA641C54E465BDC11D960EA9
SHA1:	703F77FD65BFFE46FBD846C2B528D2B6AF5EBDB2
SHA-256:	893E46ACC9B0F4E203640CD3EDB007206B6F05C19CF4632B03C58ED191A650B5
SHA-512:	FF8ADD01456FDE06AC4A0104E1BBC04367D401F8353AF267250090739C0116A6926E2D80C8706D6D7D09492F31946B561908330A61693741DCACB8564C27EA38
Malicious:	false
Preview:	"use strict";..if (!require("./is-implemented")()) {..Object.defineProperty(String.prototype, "endsWith", {...value: require("./shim"),...configurable: true,...enumerable: false,...writable: true..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\ends-with\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.604554042413484
Encrypted:	false
SSDEEP:	3:jTqhBBbJAXPbJYRAKaODpqLOW5xANcw:4BWPbeA0DpqL5mcw
MD5:	E7AAC9D3F55D1B0510D260FBA1E7A898
SHA1:	A9AA37F16368B3725495A353CD0CBBF8E74C77E9
SHA-256:	9C73232A5DC6ACE0661B8040C14A9C7DE354DBC6617C39AF0C172170EAB2FB10
SHA-512:	AD7B0A95514F74A0AECEF55A0D734F6F391D5C13365346D421ED0C559D13CCADAA51BBA18D679DB08E6B4393D3221120A5B77C92053F178E3C6C6DBCAB60932E
Malicious:	false
Preview:	"use strict";..module.exports = require("./is-implemented")() ? String.prototype.endsWith : require("./shim");.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\ends-with\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	201
Entropy (8bit):	4.649906513646893
Encrypted:	false
SSDEEP:	3:jTqaFWRVo3eZcmBBbfaQ3+hWSEcASEJL5f+AJZzFSEjZJ+7vn:2VcSdBb3+pxAkADR9g
MD5:	806206F8D89B039A405606CDBEFEB94E
SHA1:	5CE578E5DED351905685339B2666E3B896FC0115
SHA-256:	2F0591DAB0C812FACD2823E24A3E711B7C5A3DBE6654E45262574C21D62D2210
SHA-512:	3D7344055FD15DE9DF0B091D47F99F517A2A89B694CD075973CF3E25A5F9C4135C6977A1CA50F359F6FD8E9368FF5DE83BB70E068796ECC8F74F99818305A3DD
Malicious:	false
Preview:	"use strict";..var str = "razdwatrzy";..module.exports = function () {..if (typeof str.endsWith !== "function") return false;..return str.endsWith("trzy") === true && str.endsWith("raz") === false;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\ends-with\shim.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	596
Entropy (8bit):	4.885339995985965
Encrypted:	false
SSDEEP:	12:xKqRzDepI1F+kIJtCqoTCw5BpVZCNYcPfaVanL7aCWNqJsmV598LlH+VRhn:xKG7IvypBvZQPf2e7yNqimV+CRh
MD5:	6B19D1FC6008CACD182487886453EC7E
SHA1:	86889787F72199CD6590C6836FA7F7CDA848FAD5
SHA-256:	AE653AE2C7AF9EC5D0D02788D5908E66F43F0A958B2D75D8B055D301D14EF97D
SHA-512:	0FB54D0F990341A8E63140B17F39D04995A1968C2EE9750819F5AD14F0A0338F4A0A9121D573136CFD2B51A73531741F0108FA6EFB326AEA3E0574731ED5E2AD
Malicious:	false
Preview:	"use strict";..var toInteger = require("../../../number/to-integer"). , value = require("../../../object/valid-value"). , isValue = require("../../../object/is-value"). , min = Math.min. , max = Math.max;..module.exports = function (searchString /, endPosition/) {..var self, start, endPos;..self = String(value(this));..searchString = String(searchString);..endPos = arguments[1];..start =...(isValue(endPos) ? min(max(toInteger(endPos), 0), self.length) : self.length) -...searchString.length;..return start < 0 ? false : self.indexOf(searchString, start) === start;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\hyphen-to-camel.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	224
Entropy (8bit):	4.743482785381069
Encrypted:	false
SSDEEP:	6:3hcFpqLACLaw+Jic4MKgkiDjJtOUWzBURAhZFXngkND:RSiACmw+Jic4LxzBtLFQG
MD5:	D0DFFE48A5F74B34CBD06F98FDD63A85
SHA1:	26BBBA23754AC667EDE1D4135CA5F015E6D044C7
SHA-256:	306D8FB606A3E863443C6C6F87C6C4A925A9DDF73D22A5E31782D35EE50CB681
SHA-512:	BFA8344A2A099DAC789131FA16B87FB801B790D300D3AC98A98A283663F1B4975DE6A0E56CD52F1E5BA5D6F750DA80A555C23433CAD1E380F149B45E3EE4034A
Malicious:	false
Preview:	"use strict";..var replace = String.prototype.replace, re = /-([a-z0-9])/g;.var toUpperCase = function (ignored, a) { return a.toUpperCase(); };..module.exports = function () { return replace.call(this, re, toUpperCase); };.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\indent.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.017014512052774
Encrypted:	false
SSDEEP:	12:ztNkCQWNpQ0SiACcOYBy8B0Ghd3KWWxRFCLFy0v:McF7CBHyUQxqLF5v
MD5:	E24AE99DBAE30464E38A4924E4A8FEE6
SHA1:	69DF94DE6F24C44A6164BEB6897B4CF7AFE4B434
SHA-256:	A4A24A9CC9A12020482704E47FF32EAF212FEB5063832894F6DA5FA470372B53
SHA-512:	DD466262E8D6EAA58C7CCB37F8C0DAAAE9A86C70D3A90786F9ACFFB590FCC45139C1CCBF6ED26EF57F0F03FE07DD959A47FD485DDA2D503041977FABD9ACCC53
Malicious:	false
Preview:	"use strict";..var isValue = require("../../object/is-value"). , repeat = require("./repeat"). , replace = String.prototype.replace. , re = /(\r\n\|[\n\r\u2028\u2029])([\u0000-\u0009\u000b-\uffff]+)/g;..module.exports = function (indent /, count/) {..var count = arguments[1];..indent = repeat.call(String(indent), isValue(count) ? count : 1);..return indent + replace.call(this, re, "$1" + indent + "$2");.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.7415412767713585
Encrypted:	false
SSDEEP:	12:4BVbovmnnrGJLLAL5TuCL1iMa/TL3NNauF/n7jRjKoyRn110R8Xm2Ygn:4BVbP0LLAL5Tv6H3nTxpjKo6n1yRqm9g
MD5:	CC9D886FB3A9F702466E7E1260CF3394
SHA1:	7CC3C6B728619838EA49CDEE56D39EE1142F20C0
SHA-256:	C89214D10C69C7B8AD1A9415F308842500367D250F060194172FB613801B371E
SHA-512:	5181DDE54B695E34354FF347226F43C4E30DF46546CF5630CCE95720F2D2C377144F08A9FB3C8FEEE36C0DA4B35321D602832F0DDF0E6A5307AAFC36364FDF4F
Malicious:	false
Preview:	"use strict";..module.exports = {.."@@iterator": require("./@@iterator"),.."at": require("./at"),.."count": require("./count"),.."camelToHyphen": require("./camel-to-hyphen"),.."capitalize": require("./capitalize"),.."caseInsensitiveCompare": require("./case-insensitive-compare"),.."codePointAt": require("./code-point-at"),.."contains": require("./contains"),.."hyphenToCamel": require("./hyphen-to-camel"),.."endsWith": require("./ends-with"),.."indent": require("./indent"),.."last": require("./last"),.."normalize": require("./normalize"),.."pad": require("./pad"),.."plainReplace": require("./plain-replace"),.."plainReplaceAll": require("./plain-replace-all"),.."repeat": require("./repeat"),.."startsWith": require("./starts-with"),.."uncapitalize": require("./uncapitalize").};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\last.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	196
Entropy (8bit):	4.820499083730715
Encrypted:	false
SSDEEP:	3:jTqaFTgSjA+LFJAIIJtHQKzBbfaDPoEfNIIzuzFWAZO202fuxFpDLSNyFT+O:ztNzAIIJt/zB6ZfN4sAZL02Wxf6Y1h
MD5:	576828CADB41EA94ABF719C2036D4BB1
SHA1:	553498305381D1155A8671E96DD5368BE32D4348
SHA-256:	D221061CB57B849A5EDFAEC12B0861D1A3B13ECCF615351994D84D67FE56870A
SHA-512:	14DB5342302645983E5C7601C36D7A8DF171F00C46E48547A88F6EE5BF1E0B4E6B416D00DD3E452CE408C817448EFDF46F9C263B0ECF6A415900C5B5E6188E8E
Malicious:	false
Preview:	"use strict";..var value = require("../../object/valid-value");..module.exports = function () {..var self = String(value(this)), length = self.length;..return length ? self[length - 1] : null;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\normalize\_data.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	168573
Entropy (8bit):	4.039432655541204
Encrypted:	false
SSDEEP:	1536:zmikW51CqDkGxIN1NtbrLXvRiPEYHptc5+ALe14kZzicCO5T2J8QxGnHy:vkW5g3EH5T2J8QxGnS
MD5:	0ECDD78740BC1A9E6FFA62A59F57EE18
SHA1:	14CAA32C82AB3ECEF1C5F12D421FEED86A7EC962
SHA-256:	36E489F470D267792FBF231EB49E16C46EEFC6539913B00F592FB6CAC576F446
SHA-512:	57BF011591FE44A8A3FFC6072F5FDEAC09AACE1743A62C912F6F23514DFC44698F0F3388A6C63830DFC20452EE3A1D46CB32546CD72A9C8A72F62A75161982F5
Malicious:	false
Preview:	/* eslint max-lines: "off", no-sparse-arrays: "off", comma-style: "off" */.."use strict";..module.exports = {..0: {...60: [, , { 824: 8814 }],...61: [, , { 824: 8800 }],...62: [, , { 824: 8815 }],...65: [...., ,....{.....768: 192,.....769: 193,.....770: 194,.....771: 195,.....772: 256,.....774: 258,.....775: 550,.....776: 196,.....777: 7842,.....778: 197,.....780: 461,.....783: 512,.....785: 514,.....803: 7840,.....805: 7680,.....808: 260....}...],...66: [, , { 775: 7682, 803: 7684, 817: 7686 }],...67: [, , { 769: 262, 770: 264, 775: 266, 780: 268, 807: 199 }],...68: [, , { 775: 7690, 780: 270, 803: 7692, 807: 7696, 813: 7698, 817: 7694 }],...69: [...., ,....{.....768: 200,.....769: 201,.....770: 202,.....771: 7868,.....772: 274,.....774: 276,.....775: 278,.....776: 203,.....777: 7866,.....780: 282,.....783: 516,.....785: 518,.....803: 7864,.....807: 552,.....808: 280,.....813: 7704,.....816: 7706....}...],...70: [, , { 775: 7710 }],...71: [, , { 769: 500, 770: 284, 772: 7712, 774: 286

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\normalize\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	204
Entropy (8bit):	4.889237923051533
Encrypted:	false
SSDEEP:	6:0iPbeA4oLF3pqJe5jyE3Yc6nLTewFR5FX9DE7xuOfFR15Md:PTQqVHV3o7FnrDIfBMd
MD5:	7CF2322B551D6EB5DA3880939AD54F92
SHA1:	46233F144B657992677ECEAA212A004E8F74039F
SHA-256:	D79109A0200099C5C250C8D162581EFA0942D089F5965FED9CF743DFC01523D4
SHA-512:	6067E6181866BB7C6A402B6C8DECE68A2C92B36869E4576D5B80620F9EF0D339E3C71054CAA585635224009B8388C0B613A6D88B495D708A6117DC89D6D48BB5
Malicious:	false
Preview:	"use strict";..if (!require("./is-implemented")()) {..Object.defineProperty(String.prototype, "normalize", {...value: require("./shim"),...configurable: true,...enumerable: false,...writable: true..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\normalize\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.623652972563562
Encrypted:	false
SSDEEP:	3:jTqhBBbJAXPbJYRAKaODpqLo9FTANcw:4BWPbeA0DpqLoScw
MD5:	72948934E10E7AB90A69578F22F342B8
SHA1:	FAB9C3CFFE27A861282B63E2498B6774291D0023
SHA-256:	9E3130085AEF2ABD6C793317B684855D146AA60B09961B0CE626C158810F6827
SHA-512:	01F4E21E83871935E3EEFEF48FAC0BC650509E6A0D782640D2DC4D6BE041D851347B957B471D1D23C8B89F5A3D4F865868AF5DAA61B2F11AE3C879248522FFB0
Malicious:	false
Preview:	"use strict";..module.exports = require("./is-implemented")() ? String.prototype.normalize : require("./shim");.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\normalize\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.979850308901084
Encrypted:	false
SSDEEP:	3:jTqaFWRVoG232mZk+hBBbfaQ3+hWZK21aSEJL5f+A0drjuHMFSE2BiDytHwD:2Vpuk+TBb3+kYkA9kjW2ytHO
MD5:	E7F7C3C28CD9C7CC302D3FB722EE0550
SHA1:	6355CD1BFAE9B9948940AE1827F8C20DB469F6B0
SHA-256:	F842176C635122C3FFA5930EA99A5CCE224814AA176CA4378EA226D5EED7A686
SHA-512:	355C9485BC4700E9B05A69F1AC6DCBC8838E35A032B4FCCEF5FB5F1A3E729A80D3E1D64EABEFFB1B3AD0B9D353D8218C0CB4F0F1CD2CDEF5A308496754A5F018
Malicious:	false
Preview:	"use strict";..var str = "......";..module.exports = function () {..if (typeof str.normalize !== "function") return false;..return str.normalize("NFKD") === "..a.a.u.o.";.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\normalize\shim.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8264
Entropy (8bit):	5.219096586595928
Encrypted:	false
SSDEEP:	192:ycSOXdPGO2UGddkHwLiJoLkeEuv0w45LStSh6:ycSSdPGO2rdd1keEuv5tS8
MD5:	75DEDA4BAAF628E7BC70B65B80B8731D
SHA1:	985E17D022A0AA43F66C4CE28ED6E7EA4024E6A7
SHA-256:	074812FB19A68C49B90FCFD73761E2C5E952156B60E5D89016F7FB82DFDA5FEA
SHA-512:	D97FC59FDAB039EED37A36DB3C5059C05808C499A2E7D6ECF2038D23386A0EE71734458C30C1B507FEA4FC3E02042529435B29FEBEA5BA5DD365D3BA8AF73620
Malicious:	false
Preview:	/* eslint no-bitwise: "off", max-statements: "off", max-lines: "off" /..// Taken from: https://github.com/walling/unorm/blob/master/lib/unorm.js../. * UnicodeNormalizer 1.0.0. * Copyright (c) 2008 Matsuza. * Dual licensed under the MIT (MIT-LICENSE.txt) and. * GPL (GPL-LICENSE.txt) licenses.. * $Date: 2008-06-05 16:44:17 +0200 (Thu, 05 Jun 2008) $. * $Rev: 13309 $. /.."use strict";..var primitiveSet = require("../../../object/primitive-set"). , validValue = require("../../../object/valid-value"). , data = require("./_data");..var floor = Math.floor. , forms = primitiveSet("NFC", "NFD", "NFKC", "NFKD"). , DEFAULT_FEATURE = [null, 0, {}]. , CACHE_THRESHOLD = 10. , SBase = 0xac00. , LBase = 0x1100. , VBase = 0x1161. , TBase = 0x11a7. , LCount = 19. , VCount = 21. , TCount = 28. , NCount = VCount TCount. , SCount = LCount * NCount. , UChar. , cache = {}. , cacheCounter = []. , fromCache. , fromData. , fromCpOnly. , fromRuleBasedJamo. , fromCpFilter. ,

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\pad.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	583
Entropy (8bit):	4.803687885057294
Encrypted:	false
SSDEEP:	12:xKqRzmepI1F+hIJtCQ+NpZaV5BNLXN0rRbAZSGcidzej7Q2eEXOXOsFej:xK9kIv01gBNirGSeLgO+sQ
MD5:	5008872436106D3D1903D240FF41123B
SHA1:	7101ECE2408BD76947267533AA8544FD6A6D970A
SHA-256:	83D1BB7DF23FCF5058FF40F5AB79562D3E9EA669119AEFFB56C8746965683862
SHA-512:	3FADA96F2817412897EAF377DC7A5EB2A394605941839AB2746C0C699D34E6EB85DCB85FFC01B46C102CFAC7399C49AC452A4386A0642F3231D9BF7C0527C914
Malicious:	false
Preview:	"use strict";..var toInteger = require("../../number/to-integer"). , value = require("../../object/valid-value"). , repeat = require("./repeat"). , abs = Math.abs. , max = Math.max;..module.exports = function (fill /, length/) {..var self = String(value(this)), sLength = self.length, length = arguments[1];...length = isNaN(length) ? 1 : toInteger(length);..fill = repeat.call(String(fill), abs(length));..if (length >= 0) return fill.slice(0, max(0, length - sLength)) + self;..return self + (sLength + length >= 0 ? "" : fill.slice(length + sLength));.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\plain-replace-all.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	419
Entropy (8bit):	4.796080382225606
Encrypted:	false
SSDEEP:	12:JNhIJt/zBp1ouEN0bsdaMxtFDjcZchc8Kkos+0WCD:pIvbBjPbsdXthjYZSos+2D
MD5:	EC10F7655989A4F82FB4BF70F1ADC1B0
SHA1:	199FAE3EA98DD359B72A16E527E6E0841F0BD2DB
SHA-256:	B6869B5C8B7331E9D3EF3606F7E4D63E6496684F38829F0227EA30150BD69617
SHA-512:	96B1737C2F862E2E7047A7FEA412DAE79170CEDC756005F207FC7678166C76FCDEA02B935428E34F1189B5DA31A03A1C4DCE1FAC5088D51987A16C26A1F5D04F
Malicious:	false
Preview:	"use strict";..var value = require("../../object/valid-value");..module.exports = function (search, replace) {..var index, pos = 0, str = String(value(this)), sl, rl;..search = String(search);..replace = String(replace);..sl = search.length;..rl = replace.length;..while ((index = str.indexOf(search, pos)) !== -1) {...str = str.slice(0, index) + replace + str.slice(index + sl);...pos = index + rl;..}..return str;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\plain-replace.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	314
Entropy (8bit):	4.747239687343018
Encrypted:	false
SSDEEP:	6:6wFpqLRFpqLOMTYBpEC344NrZFYMfSFQ+WAMZFVGksZFabL5BaQv:6GirijEBp1oANFYz9dgFVZAFabLza6
MD5:	FD55F156726DA5CA9C034BA31766A33E
SHA1:	259D5B8F818D8F297B749063558976360C78CC6A
SHA-256:	06606D386AE849A5AB56B9EB0F192DC3BCF33D870CF5DB096FB1831EA9EB86E0
SHA-512:	4CAF6E31C7807CF4041487F8ABDC1DA581F1CE3DB2A8898B88920E40BC4F4823406E22314833D74BBB06626BD51BAFDDE6DDD28E56AB1C705A444D60AECC3F22
Malicious:	false
Preview:	"use strict";..var indexOf = String.prototype.indexOf, slice = String.prototype.slice;..module.exports = function (search, replace) {..var index = indexOf.call(this, search);..if (index === -1) return String(this);..return slice.call(this, 0, index) + replace + slice.call(this, index + String(search).length);.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\repeat\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	201
Entropy (8bit):	4.854455054197506
Encrypted:	false
SSDEEP:	6:0iPbeA4oLF3pqJOLwBE3Yc6nLTewFR5FX9DE7xuOfFR15Md:PTQqVLLB3o7FnrDIfBMd
MD5:	D75E5EC6C239C2353974D346DABAB777
SHA1:	BC6113EE0CF3762060006A8D69606A6D2457D27D
SHA-256:	ACDD3A0D0CE0CE98090ABAA9DCA1DB88FBDD76275B4D2FF9D77183D831DC27F1
SHA-512:	C8E9A270C663DEAA1246B1199E06B8446585762E1D785BFB395ED863416E692F18411C4D8462F5ABDE916A4910B9E228E5BEC5C034569F369DFCA3DAC0BA3B33
Malicious:	false
Preview:	"use strict";..if (!require("./is-implemented")()) {..Object.defineProperty(String.prototype, "repeat", {...value: require("./shim"),...configurable: true,...enumerable: false,...writable: true..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\repeat\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	109
Entropy (8bit):	4.561382772559044
Encrypted:	false
SSDEEP:	3:jTqhBBbJAXPbJYRAKaODpqLAfjANcw:4BWPbeA0DpqLAfCcw
MD5:	A06AFAFC9B0D4A59484B61FC5ADE47B2
SHA1:	12F8B672FDC0B7ADFDF96C5DC924251F14C65110
SHA-256:	48752E425A8D09B3ECBEA03D801FB7F03012F9C1E0E8A8F839BAAF33EAE12107
SHA-512:	138D37069A20B8EBEF274FF3219165C076E80C697DF072D9FB0C88A106A62C8464AEDB51C8A8428CA110720625E815778D50522625A97D21B68CCB0B4E8DADD5
Malicious:	false
Preview:	"use strict";..module.exports = require("./is-implemented")() ? String.prototype.repeat : require("./shim");.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\repeat\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	156
Entropy (8bit):	4.479816708244843
Encrypted:	false
SSDEEP:	3:jTqaFWRVojcIaBBbfaQ3+hWFA/VaASEJL5f+A6/QcFjKDv:2VIcIYBb3+HVaAkAMZ6
MD5:	13735593282FCE21C1548C3FC0B75F53
SHA1:	662BEB7A96A0D949E96E6C0BB2068FE4F78A2960
SHA-256:	C799085BF4B519196E7102898F6B42D8CDE666720ECB1DDDF08D92F51CB42550
SHA-512:	7553B3E61410D5272AAB8113A3CFCC1DFF7EA0FD7BB48FFEFF6F2DC1BAA55C0B25B7C9093CAE5B37EAE26233A630AFE07853492ABD79050185CFC9FB50364252
Malicious:	false
Preview:	"use strict";..var str = "foo";..module.exports = function () {..if (typeof str.repeat !== "function") return false;..return str.repeat(2) === "foofoo";.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\repeat\shim.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	711
Entropy (8bit):	5.081425788047318
Encrypted:	false
SSDEEP:	12:jLoRLsSD2KFiAnZ4vF+kIJtCrD73zBmM3ONF/3eOq8ao9O8jsclMCTaDlv2Kr:NgFeXIvc7DB7afejo9acWK5Kr
MD5:	B1AA8AB75B1202C21DFFBBD1E3BE8D92
SHA1:	4FD5A48AC7557F369EF5E0190D963CDB08DC229F
SHA-256:	F6942540343B86897CB52CE006017405BF15849028C147AD666BF662584F73F3
SHA-512:	A951D573187622538E8A49E030DB769A1204DBCAA52628351E109CAED005E704669839892AEB6664F9E4166F89A44AEAB03C5F199079337FA89928FABCAA4213
Malicious:	false
Preview:	// Thanks.// @rauchma http://www.2ality.com/2014/01/efficient-string-repeat.html.// @mathiasbynens https://github.com/mathiasbynens/String.prototype.repeat/blob/4a4b567def/repeat.js.."use strict";..var value = require("../../../object/valid-value"). , toInteger = require("../../../number/to-integer");..module.exports = function (count) {..var str = String(value(this)), result;..count = toInteger(count);..if (count < 0) throw new RangeError("Count must be >= 0");..if (!isFinite(count)) throw new RangeError("Count must be < .");...result = "";..while (count) {...if (count % 2) result += str;...if (count > 1) str += str;...// eslint-disable-next-line no-bitwise...count >>= 1;..}..return result;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\starts-with\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	205
Entropy (8bit):	4.889891103235668
Encrypted:	false
SSDEEP:	6:0iPbeA4oLF3pqJZgwBE3Yc6nLTewFR5FX9DE7xuOfFR15Md:PTQqVghy3o7FnrDIfBMd
MD5:	0270F7C90510A22D16EE84A38CB901D5
SHA1:	BCB92F974FC4D803BBC6E4D4CD81C1ECD1082B7F
SHA-256:	2D241D63CE73D5B618ABB4BF5A3B163D4B60DB0AE7055D3A6BBED739549E6005
SHA-512:	9E278958FFC09E68526FEDBC4A89A9A92D38D96751BD569DA8B64FD444E1D304B52EC4D1FA3B2B275032F03F6B57D44A2D5ED76C5314857DE6DD42D9162C82D4
Malicious:	false
Preview:	"use strict";..if (!require("./is-implemented")()) {..Object.defineProperty(String.prototype, "startsWith", {...value: require("./shim"),...configurable: true,...enumerable: false,...writable: true..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\starts-with\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.6034586025839905
Encrypted:	false
SSDEEP:	3:jTqhBBbJAXPbJYRAKaODpqLWEXwJhANcw:4BWPbeA0DpqLWEXwmcw
MD5:	42755B2D7EEA043C1529D0F5AFD0AF5C
SHA1:	1528EC96947DAEE459E6C0A02122CB37C90AF6E5
SHA-256:	508ED5014E69FA31E47D10C8D51FF200E452D8D1AD083D921FF8B8499AF0D3CA
SHA-512:	09908488B0BEA5124201E697A6CDE7A3DB35909928728FDE90C26C12EDEBE6FC64B4A10B771F2D8BF02AD5FAAD2DF1D86060D9AD2AE8FE990395B6ACB60D4EFA
Malicious:	false
Preview:	"use strict";..module.exports = require("./is-implemented")() ? String.prototype.startsWith : require("./shim");.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\starts-with\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	207
Entropy (8bit):	4.570756537759818
Encrypted:	false
SSDEEP:	3:jTqaFWRVo3eZcmBBbfaQ3+hWELJMASEJL5f+AOBRzFSaJlteMBhn:2VcSdBb3+/LmAkAOTv3teM3
MD5:	EA34103D81EB5BE27FA740276F01064D
SHA1:	36699EEA1A70B33F5CB5C22E624C32980D8C1BD2
SHA-256:	B5AC1CA2DE5FDEAB98D5522D2C96CA5FD1A18C8FBDE72612794CA309D014C77E
SHA-512:	6870A9D8A36A2ACEAECEA48F85343F82C85B484DDB2BB44C5AE914F2EA2E48AAACB2F018376A09393D23431ADDEA49C5A21F1D7768CC32FC8EF243609E24F93C
Malicious:	false
Preview:	"use strict";..var str = "razdwatrzy";..module.exports = function () {..if (typeof str.startsWith !== "function") return false;..return str.startsWith("trzy") === false && str.startsWith("raz") === true;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\starts-with\shim.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	390
Entropy (8bit):	4.805255416795007
Encrypted:	false
SSDEEP:	12:6F+kIJtCrDepZ0JuYBpVR4NYdxC+tVRhn:sIvcJBvRbFRh
MD5:	39D4FFC35E232AC1E6651ECF21EDD46A
SHA1:	87C75EAC58C58F8A47EF297E5D843D0F5C5B687E
SHA-256:	B73577FBCD8B74D050ADA74AF4B2FF1B1978F8876F7636324AAB72DF87A7077B
SHA-512:	B43471CFDF4DA0EC53DCD5A70994E149ABB172D7C5470F7BF0D0C763F9FA3094DB258A6AAD3CA7E37ADA38D7259EAA46788ADC6BC7207422DD0462647FA51055
Malicious:	false
Preview:	"use strict";..var value = require("../../../object/valid-value"). , toInteger = require("../../../number/to-integer"). , max = Math.max. , min = Math.min;..module.exports = function (searchString /, position/) {..var start, self = String(value(this));..start = min(max(toInteger(arguments[1]), 0), self.length);..return self.indexOf(searchString, start) === start;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\#\uncapitalize.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	220
Entropy (8bit):	4.82872705668557
Encrypted:	false
SSDEEP:	3:jTqaFA7TR4AFoXjA+LFJAEmIWXMfAITgQAHHQKzBbfafoujR4ANrXMPAdoN837iA:4TmzAEmIVI/zBktZXWAdoQiRmtD
MD5:	BCEA9150432709E0E4D90E350A7E7BAA
SHA1:	81A199D84EAA8EECAB04B917F9CCDAC34A8DE34B
SHA-256:	172DDDA817092A607442F14E15EB9114FCAA14C4A8EBEFE1A80448AC7BEA621E
SHA-512:	5FBD6FEDE55BD25CD38D99CC5AF3120FE7579FA8104DA0553E5B2303536DF5E2A57D63F931D52A053CF3BDC1DBDC1B7926A4008CBD4F54420F6182F68BE1E53A
Malicious:	false
Preview:	"use strict";..var ensureStringifiable = require("../../object/validate-stringifiable-value");..module.exports = function () {..var str = ensureStringifiable(this);..return str.charAt(0).toLowerCase() + str.slice(1);.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\format-method.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	713
Entropy (8bit):	4.927663370131717
Encrypted:	false
SSDEEP:	12:zUFICI1FJ3IJtCNKXVIB1IY8v9vRu9N0lNHYRBTW2H/I1Th4rqVIgIgHiypAnnz2:9XIvPCB1cv9Ju9ClNHkWouiqVIgIg6nC
MD5:	9D486B107A7187EAB317E6EE85C43DD3
SHA1:	C2BA13A55F29F6A527E73AB99ED04F8E6AFB8D92
SHA-256:	7F121F450BE27B9B2A279A142A0C549ABC6C098FA73275A34FC56AF7379F1644
SHA-512:	7F4B261250F1DBCD2CEEC46DD381128043998A739BBE3B0CA9F738B5148F82E6B7999043F96E4F987B10B767BDC04456AABB1C8DA6324467B65E8A28732E7EC9
Malicious:	false
Preview:	"use strict";..var isCallable = require("../object/is-callable"). , value = require("../object/valid-value"). , call = Function.prototype.call;..module.exports = function (fmap) {..fmap = Object(value(fmap));..return function (pattern) {...var context = this;...value(context);...pattern = String(pattern);...return pattern.replace(..../%([a-zA-Z]+)\|\\([\u0000-\uffff])/g,....function (match, token, escapeChar) {.....var t, result;.....if (escapeChar) return escapeChar;.....t = token;.....while (t && !(result = fmap[t])) t = t.slice(0, -1);.....if (!result) return match;.....if (isCallable(result)) result = call.call(result, context);.....return result + token.slice(t.length);....}...);..};.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\from-code-point\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	198
Entropy (8bit):	4.898151980192129
Encrypted:	false
SSDEEP:	6:0iPbeA4oLF3he5E3Yc6nLTewFR5FX9DE7xuOfFR15Md:PTQqZv3o7FnrDIfBMd
MD5:	57E8B41A8236F33DF23BB68A0E3735B6
SHA1:	878AF442FAB0BDEC8BEBF8414E70D63B751199E4
SHA-256:	00841C4E57CF9FD68595EA609456867C57C76E38FE4E69A98F13EC0171E5FEC8
SHA-512:	757753ACE15A5387BE8921CA1157E9A932DABE1E53FF80D92ED5D3BC1BC4C8A65DB7C31C6B8B9A5AACB246F169DDCF278D4D33E2755EE858BBBDCBCBB9A9EB2E
Malicious:	false
Preview:	"use strict";..if (!require("./is-implemented")()) {..Object.defineProperty(String, "fromCodePoint", {...value: require("./shim"),...configurable: true,...enumerable: false,...writable: true..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\from-code-point\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.639919122467019
Encrypted:	false
SSDEEP:	3:jTqhBBbJAXPbJYRAKaOLKMdAUANcw:4BWPbeA0Ly1cw
MD5:	5F4C17FE2432C2224EF6AD10B2C3FDC4
SHA1:	87BA3B0E4A856CF2E961F9FEB2F6D38B7AA2D64F
SHA-256:	77C55C24DE89B6C2F4A8204878AAB221656AD65A2DDB8BF5AC1E3CF405165BF1
SHA-512:	D3924555D351264B6D770310F76B24B50BFF7455E7732E039038A66D3FD44F48153F94D0FBE95BD1C37C582B30702C136AB6AC3047F5848AB6C359337B077B6F
Malicious:	false
Preview:	"use strict";..module.exports = require("./is-implemented")() ? String.fromCodePoint : require("./shim");.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\from-code-point\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	227
Entropy (8bit):	4.970803657270554
Encrypted:	false
SSDEEP:	3:jTqhBBbfawT9SKMw55KM+OhDXKuSKM5aASEJL5f+VhSKMn7VTJFUGhE2Z/fQ154I:4BZSm5OOVXxSJaAkLSX7yGhE2ta2a4un
MD5:	AD982B87AA2714DA86B387ED2C489869
SHA1:	241E74E645AEACD09331EE61C692B870815F96C9
SHA-256:	41351AAAF43DD014D2110556B41B0B2685A6844C65207C8DB2DBB52E1F12161E
SHA-512:	7D9D4570EB81154635457BF83B13B6C3A8098A1B1A1D8A6758B1658F6C990FDFDEA1E104C60A1CDF0A3419434E6157443D504CC1D7B8B190F733A3102BCB3303
Malicious:	false
Preview:	"use strict";..module.exports = function () {..var fromCodePoint = String.fromCodePoint;..if (typeof fromCodePoint !== "function") return false;..return fromCodePoint(0x1d306, 0x61, 0x1d307) === "\ud834\udf06a\ud834\udf07";.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\from-code-point\shim.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1051
Entropy (8bit):	5.149116145030216
Encrypted:	false
SSDEEP:	24:T5Dn65EBLoOEQYBGasfoioi8uedNUANNlALr:dDPBLjAAboiNCSAPmr
MD5:	0EE7CC281544EF29FD0257D1CB72AC48
SHA1:	B103DE883233C7238A5C8E012F4464D438E1E423
SHA-256:	80C77707C1A272F3E1AE9A7E961E61D70C2662DB989A2D7F20FD36A2C1B7B36E
SHA-512:	A33790A3D5FB082FBF91B4A39EBE1ABDB508DB5A20D723846B2042DA9148CD1E0E7740BB568BFB60E57510B46B3DD2CF3BE569CA40F303FC3EA90D14CEF1DEEC
Malicious:	false
Preview:	// Based on:.// http://norbertlindenberg.com/2012/05/ecmascript-supplementary-characters/.// and:.// https://github.com/mathiasbynens/String.fromCodePoint/blob/master.// /fromcodepoint.js.."use strict";..var floor = Math.floor, fromCharCode = String.fromCharCode;..// eslint-disable-next-line no-unused-vars.module.exports = function (codePoint1 /, .codePoints/) {..var chars = [], length = arguments.length, i, codePoint, result = "";..for (i = 0; i < length; ++i) {...codePoint = Number(arguments[i]);...if (....!isFinite(codePoint) \|\|....codePoint < 0 \|\|....codePoint > 0x10ffff \|\|....floor(codePoint) !== codePoint...) {....throw new RangeError("Invalid code point " + codePoint);...}....if (codePoint < 0x10000) {....chars.push(codePoint);...} else {....codePoint -= 0x10000;....// eslint-disable-next-line no-bitwise....chars.push((codePoint >> 10) + 0xd800, (codePoint % 0x400) + 0xdc00);...}...if (i + 1 !== length && chars.length <= 0x4000) continue;...result += fromCharCode.apply(null,

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	287
Entropy (8bit):	4.753822593049185
Encrypted:	false
SSDEEP:	6:4BSB0DM5OAQAPAI5DgX/L89PZJ63iRIA2iyYA1G+t:4BDM59PLDgX/L8u+8bSW
MD5:	82BC0E5D6C9C3CBDFC5A1422765D357D
SHA1:	AA630D6D4883C18436F4E62BFC4ED1D683B69135
SHA-256:	28CDB4B592401954A702621DCDB382F919F1D981F3CE907B5F115319164E3DDD
SHA-512:	2CE4D7E0AA587063CBC8286F659B7925A66B2953E78EF8899E61FE69F582234464BFF408FC2D1867FE6C13300551F38C5F57F0248E245DD11D3D128C0D73933B
Malicious:	false
Preview:	"use strict";..module.exports = {.."#": require("./#"),.."formatMethod": require("./format-method"),.."fromCodePoint": require("./from-code-point"),.."isString": require("./is-string"),.."random": require("./random"),.."randomUniq": require("./random-uniq"),.."raw": require("./raw").};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\is-string.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.8603886150995
Encrypted:	false
SSDEEP:	6:85XcQbKHqLs98l2XzjHfzBWyUVYlssKfvnVEMAtmGb3XziE24jMO:85MpQs98l2D7fzBWVIssKfvnrAtmGb3h
MD5:	EFF164045817D5FDD677A73D02A2922F
SHA1:	657F2902C14DBFE8E28F1F1B7A2955CB7B726CF5
SHA-256:	3EA64863111A205CF351C5812459467EFA314E9B833A7908D67B4F84EEC3595F
SHA-512:	B75C2E0FA98722C20D62EFEF816C486CAE81DCEBB720ADF862486B07D2AA56B7E9670529BAE470DF2FE8BA7FEA5E907F9B90F4B31A438F1BB66ECBE3C62F8339
Malicious:	false
Preview:	"use strict";..var objToString = Object.prototype.toString, id = objToString.call("");..module.exports = function (value) {..return (...typeof value === "string" \|\|...(value &&....typeof value === "object" &&....(value instanceof String \|\| objToString.call(value) === id)) \|\|...false..);.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\random-uniq.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	205
Entropy (8bit):	4.803447832069617
Encrypted:	false
SSDEEP:	3:jTqaFCAKiSlEguJIp4oyteHBBBbfaE4+xFfAwzt3iSHHAjpx4WACD:2iGuJIFHzBV73xHGJACD
MD5:	B1D8797ACA1B052CCE3FFD923E6F75E9
SHA1:	95E0209F81235179239618E889840C3BF61493E1
SHA-256:	14ADC2264912EC7C8823FF741BE3D930B7A351BD2C1C979A69373D063FCE4865
SHA-512:	DE397252C7EE302EBC532ABEB9111B33BC5F659FC64188E670CA9E144AC1E21C740D48F3BE589AFD0D861B03734166F004BBE17F824EA58F819A513A3B6B8196
Malicious:	false
Preview:	"use strict";..var generated = Object.create(null), random = Math.random;..module.exports = function () {..var str;..do {...str = random().toString(36).slice(2);..} while (generated[str]);..return str;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\random.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1064
Entropy (8bit):	4.947867009656258
Encrypted:	false
SSDEEP:	24:N1VRpG1PDzZkXABSIdX6DYpLyi0OTiVobAnoJD:N1Va17zZkQEIh6DYpLyiV+Vou2D
MD5:	53BAF42A5E0AF4F1716A904AE941FFBA
SHA1:	F81ABE131710BE8C77B5B7954C62DFFDEE0482CD
SHA-256:	32559DAE2A6BE1DEF108BFAB7BDA8E393C2F5A50F18313B9DC5585CA0B4013E3
SHA-512:	B9C2D37CA16C8E18CE545CFA93E8187AEEA783ABB72C6005B67D80981DBAC26C532750E42CE54A1832C4B0D0853E6639B501E57FBC594057064A84FF7C0AAF49
Malicious:	false
Preview:	"use strict";..var isValue = require("../object/is-value"). , toNaturalNumber = require("../number/to-pos-integer");..var generated = Object.create(null), random = Math.random, uniqTryLimit = 100;..var getChunk = function () { return random().toString(36).slice(2); };..var getString = function (/* length /) {..var str = getChunk(), length = arguments[0];..if (!isValue(length)) return str;..while (str.length < length) str += getChunk();..return str.slice(0, length);.};..module.exports = function (/ options */) {..var options = Object(arguments[0]), length = options.length, isUnique = options.isUnique;...if (isValue(length)) length = toNaturalNumber(length);...var str = getString(length);..if (isUnique) {...var count = 0;...while (generated[str]) {....if (++count === uniqTryLimit) {.....throw new Error(......"Cannot generate random string.\n" +......."String.random is not designed to effectively generate many short and " +......."unique random strings".....);....}....str = get

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\raw\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.864854160714635
Encrypted:	false
SSDEEP:	3:jTqJiXPbJYRAKTOHPAGRKeJqXBx1HLHkE3yUANc6sGQQTewFR5FX9DEJpHRuJAfG:0iPbeA4oLFqkE3Yc6nLTewFR5FX9DE7E
MD5:	E9117F4AF3A9BC8F767405967F05C7D0
SHA1:	009D66817D8E2074BC8B534007CB6D4097074EEB
SHA-256:	6E487E1B625F93E878DF467CEBC8A5D62F7AFE776BBD07D9C9CF4A21C7303B4B
SHA-512:	2DA1035673518B89D8757221F901E76E5C2BDE68CE3F7F0894FEF66DF53580A89CA9B86BF12A7FACE8F7D70ACCA1950B2E3D22DD430BCA497E5500781A2534D5
Malicious:	false
Preview:	"use strict";..if (!require("./is-implemented")()) {..Object.defineProperty(String, "raw", {...value: require("./shim"),...configurable: true,...enumerable: false,...writable: true..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\raw\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	96
Entropy (8bit):	4.610837830748541
Encrypted:	false
SSDEEP:	3:jTqhBBbJAXPbJYRAKaOOHpANcw:4BWPbeA0OYcw
MD5:	8A65E3B5897A07D854DAACCEA97F2B2C
SHA1:	A536AA853D0560FDFDC34BF809A6AF1F8D888191
SHA-256:	B547C5378737316CA25F8340510FE0F74E269EE10D22F28E703AB84A8B5FF46D
SHA-512:	BFAB8CFEB7714D4858F58537ED104A71C67512643067783F482312534FA5A4730B0D9A64645EC2C3E99274142DF5927509839F7C5F3EA5321547EB8713B34FC8
Malicious:	false
Preview:	"use strict";..module.exports = require("./is-implemented")() ? String.raw : require("./shim");.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\raw\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	259
Entropy (8bit):	4.875062028162882
Encrypted:	false
SSDEEP:	3:jTqhBBbfan/MKSmW41DOhXEjPgSEJL5fdburz+HLo4LJWzjftso45z4epQBJHLMm:4BQnSh6OBkg6/H/UNQ7rqX5zT5lzsvn
MD5:	A721BD5DD0BBDDEBFE01B89F6A62A2EB
SHA1:	48778F4294659922A8A2A5AF493AB5184A5301A9
SHA-256:	2FDC99EA48ED193FC3E2DC50EEB617E7927DF69F2AE9BC32782A53F1EBD31AD4
SHA-512:	B57756337F7EC921FE4F32991DC872A78441FA12E1C8D6EDAF56CD3733A242DD1D3EBE57FD3FCC1EB79FAE9B7BA7B32E3BDB7E01052B97C6B6C2E2DDAF82B29D
Malicious:	false
Preview:	"use strict";..module.exports = function () {..var raw = String.raw, test;..if (typeof raw !== "function") return false;..test = ["foo\nbar", "marko\n"];..test.raw = ["foo\\nbar", "marko\\n"];..return raw(test, "INSE\nRT") === "foo\\nbarINSE\nRTmarko\\n";.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\string\raw\shim.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	473
Entropy (8bit):	4.997494774690807
Encrypted:	false
SSDEEP:	12:xKukmDpIxqtNhIJtCQxAVUbB5HV5Z59xADAX4NACqt9iKLrSpdN:xKuzWSIvrAibB5959qcXkACqtgKLID
MD5:	2592164DA108D272485188043F48E1B2
SHA1:	054BB59300CE3540B585ABCE719B87DFBA26016B
SHA-256:	F9534CBDFBC0A30AA9E4EC2E18F48EE8596B8F459FF1E847B109B4E89EEFEF6F
SHA-512:	C320F490EC66C99EF92034161824650BF468AC07FA1FF0BB191E5BEBB11DA7357D0A5D72AD4DF7D02E72FDC7C0DCC867174C535D65EE19DCC0324C257E0A85EF
Malicious:	false
Preview:	"use strict";..var toPosInt = require("../../number/to-pos-integer"). , validValue = require("../../object/valid-value"). , reduce = Array.prototype.reduce;..module.exports = function (callSite /, .substitutions/) {..var args, rawValue = Object(validValue(Object(validValue(callSite)).raw));..if (!toPosInt(rawValue.length)) return "";..args = arguments;..return reduce.call(rawValue, function (str1, str2, i) {...return str1 + String(args[i]) + str2;..});.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es5-ext\to-short-string-representation.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	413
Entropy (8bit):	5.051901281006308
Encrypted:	false
SSDEEP:	12:SMn6Lhpsw7BWVwCGTGhCWj8gz8CMFPyN6bKWl+:SMn6L0w7BWVwBTGhCW8sLMFqN6bKWw
MD5:	29EBE954E3D87FDF396D773AE7833C17
SHA1:	33057713CBBB021F346E8378DAD84512FC33BC00
SHA-256:	3161203F15C19FA531173783293F29843EB03AF0E55FEFC77EE091A6B40413E3
SHA-512:	8F5E68A01F9B7E79AD822C8C6AB5CE751204158705F96FB870A6F338575741A1F97BB373FF691812EA3D265F33D744A6658AB8542557736B877201B699A4F421
Malicious:	false
Preview:	"use strict";..var safeToString = require("./safe-to-string");..var reNewLine = /[\n\r\u2028\u2029]/g;..module.exports = function (value) {..var string = safeToString(value);..// Trim if too long..if (string.length > 100) string = string.slice(0, 99) + ".";..// Replace eventual new lines..string = string.replace(reNewLine, function (char) {...return JSON.stringify(char).slice(1, -1);..});..return string;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es6-iterator\#\chain.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1118
Entropy (8bit):	4.818446156776376
Encrypted:	false
SSDEEP:	24:JDD69SyVVeMf8Iys2jN+biwdB2vbd0tV5NNOlJx6i52dNU5BBM5967CIgy:JDutV0amjgyh0tvilJbP5g5Rm
MD5:	4FC61EFB18455D91701A3119E77D926F
SHA1:	DC0CE4BF0DD8F8428963767C608F99ACB547FF74
SHA-256:	F3AA007DFFFE0E1B68A87EA14BBED7877B6F371094E135DC278286E8FFDA0788
SHA-512:	778D3E3CE2D07AA170BB606F07E0F97DF8BED17487FB7E2A85DED1C996DDDB9F7886CF9CF448AC7D820D4D1D912697E1EE4DD2A4CB28B5C90ED00891A0E49DCB
Malicious:	false
Preview:	"use strict";..var setPrototypeOf = require("es5-ext/object/set-prototype-of"). , d = require("d"). , Iterator = require("../"). , validIterable = require("../valid-iterable").. , push = Array.prototype.push. , defineProperties = Object.defineProperties. , IteratorChain;..IteratorChain = function (iterators) {..defineProperties(this, {...__iterators__: d("", iterators),...__current__: d("w", iterators.shift())..});.};.if (setPrototypeOf) setPrototypeOf(IteratorChain, Iterator);..IteratorChain.prototype = Object.create(Iterator.prototype, {..constructor: d(IteratorChain),..next: d(function () {...var result;...if (!this.__current__) return { done: true, value: undefined };...result = this.__current__.next();...while (result.done) {....this.__current__ = this.__iterators__.shift();....if (!this.__current__) return { done: true, value: undefined };....result = this.__current__.next();...}...return result;..}).});..module.exports = function () {..var iterators = [

C:\Program Files (x86)\????????\resources\app\node_modules\es6-iterator\.editorconfig

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	272
Entropy (8bit):	4.681043601909451
Encrypted:	false
SSDEEP:	6:SlBQh+AmQS2Qpo1vsFfM/GvasmhdedOZaY1xvU1u6L+:ek+6vcwcaThodOZf1xvUQK+
MD5:	E7FF4F929DBE997D477F257020424567
SHA1:	CB94DA8A33BD7CBCFCF6D35EBEF5BEDE274FEE89
SHA-256:	E0F783A897B9C9AEAF55EA595F69D6CF5725DD52D00E45223380FE3C786731B3
SHA-512:	8E662FAFD361718288EF23064FE135B68DD72764F6842A9571467D47F27FEDDBEA077FD7ED0CAA0481556FD77154099252112ED72DB47C28CDF457C4C4C16F8D
Malicious:	false
Preview:	# EditorConfig is awesome: http://EditorConfig.org..# top-most EditorConfig file.root = true..# Unix-style newlines with a newline ending every file.[].end_of_line = lf.insert_final_newline = true.indent_style = tab..[{.json,*.yml}].indent_style = space.indent_size = 2.

C:\Program Files (x86)\????????\resources\app\node_modules\es6-iterator\CHANGES

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1257
Entropy (8bit):	4.9766451275000385
Encrypted:	false
SSDEEP:	24:L1AXlH1QS0D5fhIpiPX6T+e3GUGZHFkWVVtAKLEGvdVAYstM2MdT:5AVVQ7oiPKT+e2UEHFHAGdJstTMdT
MD5:	E4418EFF6D05E6A6CC3FF37BF54ED57F
SHA1:	78320B30476603005AACEACA9039E31B1F26378F
SHA-256:	499B989616E8F2D94E464AFEFAF8CAAA81E02D9324BCFCE6480A2D27CC320075
SHA-512:	4A6D6751D41B1C1901FAF763B036491C53301C41B1CA75804151E9992CF1C7BB1F33733885CDE00293AABD6EACC7184A0B6CDF3D7A0A697B3623238AB7617089
Malicious:	false
Preview:	For recent changelog see CHANGELOG.md..-----..v2.0.1 -- 2017.03.15.* Update dependencies..v2.0.0 -- 2015.10.02.* Use es6-symbol at v3..v1.0.0 -- 2015.06.23.* Implement support for arguments object.* Drop support for v0.8 node ('^' in package.json dependencies)..v0.1.3 -- 2015.02.02.* Update dependencies.* Fix spelling of LICENSE..v0.1.2 -- 2014.11.19.* Optimise internal `_next` to not verify internal's list length at all times. (#2 thanks @RReverser).* Fix documentation examples.* Configure lint scripts..v0.1.1 -- 2014.04.29.* Fix es6-symbol dependency version..v0.1.0 -- 2014.04.29.* Assure strictly npm hosted dependencies.* Remove sparse arrays dedicated handling (as per spec).* Add: isIterable, validIterable and chain (method).* Remove toArray, it's addressed by Array.from (polyfil can be found in es5-ext/array/from).* Add break possiblity to 'forOf' via 'doBreak' function argument.* Provide dedicated iterator for array-likes (ArrayIterator) and for strings (StringIter

C:\Program Files (x86)\????????\resources\app\node_modules\es6-iterator\LICENSE

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1103
Entropy (8bit):	5.154576732506326
Encrypted:	false
SSDEEP:	24:bmYfrmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:bm0aJHlxE35QHOs5exm3ogF5n
MD5:	3A0E4B466225C131D23DF6171D246447
SHA1:	79394F8970296D1DF1FAAB7874D1DF6413E84E94
SHA-256:	29C6C58225BAF0C91719E5600F7E1302CAD616C0FD81C45B02B5E78882B9E2A9
SHA-512:	942841399292CC9EC7EDA9D0D8C4BDBD2D0EA8F0BDB6BC0F603C683E3B002AF1423928F7B8221323E80DEDA0D644951E515367048743DE6A8C699CAACA54C0E2
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (C) 2013-2017 Mariusz Nowak (www.medikoo.com)..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,

C:\Program Files (x86)\????????\resources\app\node_modules\es6-iterator\array.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1198
Entropy (8bit):	4.9291334954682435
Encrypted:	false
SSDEEP:	24:JD7A7ZR0vGMCzB2TGbylRenLFRBxpIOp5JkdaHlGMU2EOCyFmrF2O:JDsRUGPOGbsCFRnCkFGjyWZt
MD5:	62E84E5F15C392A3354EA9AF9501E36E
SHA1:	1D8D9C8CDE1623C60FF941A9095065BC863E5456
SHA-256:	861F6F98F1EA81B35B11AC67241577E0BF8787CDF9BD5E5323017CD179E41E70
SHA-512:	3C5144CA54E84C199C27BA6A8BE9A631217F2C93B13ABD0A72BBF15D2B051749AE0590685AAE93FFFF475BDF784067144861F46E7884C25AAE0CBF3DF7388432
Malicious:	false
Preview:	"use strict";..var setPrototypeOf = require("es5-ext/object/set-prototype-of"). , contains = require("es5-ext/string/#/contains"). , d = require("d"). , Symbol = require("es6-symbol"). , Iterator = require("./");..var defineProperty = Object.defineProperty, ArrayIterator;..ArrayIterator = module.exports = function (arr, kind) {..if (!(this instanceof ArrayIterator)) throw new TypeError("Constructor requires 'new'");..Iterator.call(this, arr);..if (!kind) kind = "value";..else if (contains.call(kind, "key+value")) kind = "key+value";..else if (contains.call(kind, "key")) kind = "key";..else kind = "value";..defineProperty(this, "__kind__", d("", kind));.};.if (setPrototypeOf) setPrototypeOf(ArrayIterator, Iterator);..// Internal %ArrayIteratorPrototype% doesn't expose its constructor.delete ArrayIterator.prototype.constructor;..ArrayIterator.prototype = Object.create(Iterator.prototype, {.._resolve: d(function (i) {...if (this.__kind__ === "value") r

C:\Program Files (x86)\????????\resources\app\node_modules\es6-iterator\for-of.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	4.958643957423426
Encrypted:	false
SSDEEP:	24:yObgnsQ7BoQjhFgJo6CqGXIF5x2mgcPrQuI3xDxYXdmZ:qnfCYhb6wXI/8sU3TYXdw
MD5:	DF6FE70E475A374EAF591778657D66A8
SHA1:	3359CBFD2869BC623E4E8E825CE7A64C75213A4A
SHA-256:	A788F6CDB66FD300B9ADE7BFF02438018019A7D91D9712353322D6C6EFC8E475
SHA-512:	A5CD61E1AE9ED674495F52E0EDE8B165F519CEE916DB1051699D9BA7AD2FEA7CEC864A249A00B0413B07C1D1E085E910E5E12981A47D5FE4E4322AE0417011CB
Malicious:	false
Preview:	"use strict";..var isArguments = require("es5-ext/function/is-arguments"). , callable = require("es5-ext/object/valid-callable"). , isString = require("es5-ext/string/is-string"). , get = require("./get");..var isArray = Array.isArray, call = Function.prototype.call, some = Array.prototype.some;..module.exports = function (iterable, cb /, thisArg/) {..var mode, thisArg = arguments[2], result, doBreak, broken, i, length, char, code;..if (isArray(iterable) \|\| isArguments(iterable)) mode = "array";..else if (isString(iterable)) mode = "string";..else iterable = get(iterable);...callable(cb);..doBreak = function () {...broken = true;..};..if (mode === "array") {...some.call(iterable, function (value) {....call.call(cb, thisArg, value, doBreak);....return broken;...});...return;..}..if (mode === "string") {...length = iterable.length;...for (i = 0; i < length; ++i) {....char = iterable[i];....if (i + 1 < length) {.....code = char.charCodeAt(0);.....if (code >= 0xd800 && c

C:\Program Files (x86)\????????\resources\app\node_modules\es6-iterator\get.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	581
Entropy (8bit):	4.728401461422274
Encrypted:	false
SSDEEP:	12:U0xFYXxD0DHUW6T4+A19yMDYBNCOhMdAQout3A56zAwrd56o:9i2j9IJuUMUBNgdAQoWy6pr36o
MD5:	7FB30640194BDF7A66EAB0BCD4455B52
SHA1:	2EC52E4904AC12A225A880AE3FACD98278694763
SHA-256:	20F2CDB54BF9BD650C5CB3D973032309749DAB0CEBE5947AEC650D702FD3DCEC
SHA-512:	B025E9B64583F8A4EC4180FB088AAB953176045C095CDAF7F4EBDE4B7424F9D0C6C9725FF075DB4209FE9C3D7D5B3DC4DB9807695A82BA45BC3DAC0E8F173F1C
Malicious:	false
Preview:	"use strict";..var isArguments = require("es5-ext/function/is-arguments"). , isString = require("es5-ext/string/is-string"). , ArrayIterator = require("./array"). , StringIterator = require("./string"). , iterable = require("./valid-iterable"). , iteratorSymbol = require("es6-symbol").iterator;..module.exports = function (obj) {..if (typeof iterable(obj)[iteratorSymbol] === "function") return obj[iteratorSymbol]();..if (isArguments(obj)) return new ArrayIterator(obj);..if (isString(obj)) return new StringIterator(obj);..return new ArrayIterator(obj);.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es6-iterator\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2964
Entropy (8bit):	4.940661109694333
Encrypted:	false
SSDEEP:	48:GGavIRuFGbPwaCTQaFHcVC5hWSpBWXlfz0WekWetUWe8WeCffgxsGUMWzt1kbUWE:rtRu/aCT/UC5hFWlfz0jkjSj8jCXgxsv
MD5:	2A84D2E10CEF0370E4507E699EF5C8D8
SHA1:	0F91B2EBEC53D5FD3C60BEB80C12D39CC0BD0D1A
SHA-256:	29F3A8F8339F1DE55E2205CD81DAB64B924D732B43EAD7131F6CD9D2AB10715A
SHA-512:	2BF6CEDE3BF9FC1FFAC8B487DD83A201BF077893FBF1DB49E8400FC7B32C0CCEE92E573EEA750089B83B905532D51DDC8DC86DEAF060AE35965A1DB69A60FBC0
Malicious:	false
Preview:	"use strict";..var clear = require("es5-ext/array/#/clear"). , assign = require("es5-ext/object/assign"). , callable = require("es5-ext/object/valid-callable"). , value = require("es5-ext/object/valid-value"). , d = require("d"). , autoBind = require("d/auto-bind"). , Symbol = require("es6-symbol");..var defineProperty = Object.defineProperty, defineProperties = Object.defineProperties, Iterator;..module.exports = Iterator = function (list, context) {..if (!(this instanceof Iterator)) throw new TypeError("Constructor requires 'new'");..defineProperties(this, {...__list__: d("w", value(list)),...__context__: d("w", context),...__nextIndex__: d("w", 0)..});..if (!context) return;..callable(context.on);..context.on("_add", this._onAdd);..context.on("_delete", this._onDelete);..context.on("_clear", this._onClear);.};..// Internal %IteratorPrototype% doesn't expose its constructor.delete Iterator.prototype.constructor;..defineProperties(..Iterator.prototype,..assign(.

C:\Program Files (x86)\????????\resources\app\node_modules\es6-iterator\is-iterable.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	507
Entropy (8bit):	4.717802862616608
Encrypted:	false
SSDEEP:	12:U0eXxqF5CoLM9yMN8JTBW/cJyei0tX3dAF:y2HLMUMNIBWk73dAF
MD5:	DA16001E1354C4527B004EF10BCFA33A
SHA1:	FD1B6F092F03825899704210C93ED14AB6A85D70
SHA-256:	E05D5CB2B4B38A4AE859E898D402F11533B87BD3DA2280D191B95C76E2616755
SHA-512:	3D9FC2E56B30994550F2B6DD3C5F820F390EEDD39442DEA9DFFE3D4D18B7042CC0D32819E88F6F01791FD7E19A757563F27275356B11E8F1CCB84A80D86304F9
Malicious:	false
Preview:	"use strict";..var isArguments = require("es5-ext/function/is-arguments"). , isValue = require("es5-ext/object/is-value"). , isString = require("es5-ext/string/is-string");..var iteratorSymbol = require("es6-symbol").iterator. , isArray = Array.isArray;..module.exports = function (value) {..if (!isValue(value)) return false;..if (isArray(value)) return true;..if (isString(value)) return true;..if (isArguments(value)) return true;..return typeof value[iteratorSymbol] === "function";.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es6-iterator\package.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	547
Entropy (8bit):	4.801308379629225
Encrypted:	false
SSDEEP:	12:wn1e1nKx0c+hNwbmF2/NoChQYARbwYCEn0Y2/4B1HTp+t:wn1eVThNjINetRbVCE0Y2/4B1HdO
MD5:	FD9EE93C380FD79C722C5B89928725B2
SHA1:	FB8A88C40DB3CA76C1F1F9C021F9BC3C776B7A77
SHA-256:	598050BB3FFEC5E8084BFC5DD044876EB064DF442931FD0F302BA4181D8B3113
SHA-512:	770AF6A981033222BB661ADF118171F1A6EC2F7B0FDF9AB3590923AF62F3DCC1D56227E32532BEE3B325284A5F8915FB21633F7229A36DA78303D9D38A313373
Malicious:	false
Preview:	{. "name": "es6-iterator",. "version": "2.0.3",. "description": "Iterator abstraction based on ES6 specification",. "author": "Mariusz Nowak <medyk@medikoo.com> (http://www.medikoo.com/)",. "repository": {. "type": "git",. "url": "git://github.com/medikoo/es6-iterator.git". },. "dependencies": {. "d": "1",. "es5-ext": "^0.10.35",. "es6-symbol": "^3.1.1". },. "devDependencies": {. "eslint": "^4.9",. "eslint-config-medikoo-es5": "^1.4.4",. "event-emitter": "^0.3.5",. "tad": "^0.2.7". },. "license": "MIT".}

C:\Program Files (x86)\????????\resources\app\node_modules\es6-iterator\string.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1379
Entropy (8bit):	5.004934558121281
Encrypted:	false
SSDEEP:	24:ls214D17ZRWz7CzBOGbwlRxjnLF/x2NJkdafh7U2nMGPVGF6LIFX8xOwFmr1qnO:W2ODnRvAGbaRF/xBk6A4QIdJn
MD5:	EE0EDA48B7BF517F2B939791B4F5202C
SHA1:	F931E858C909DC86AFD8BA6AE7E557F2D53F7C8F
SHA-256:	8075BC0140556949A71668C6457220A917067789811377B0F63903C1D5D96D2F
SHA-512:	16CFCEF312FA6BB0CCF7144EAA43570414851D300AA52DB613E534B756BCC97852A5C83F947674FFC526CF6FABDBBBC407D0C110AEB51E4D071B81CECDB7B92F
Malicious:	false
Preview:	// Thanks @mathiasbynens.// http://mathiasbynens.be/notes/javascript-unicode#iterating-over-symbols.."use strict";..var setPrototypeOf = require("es5-ext/object/set-prototype-of"). , d = require("d"). , Symbol = require("es6-symbol"). , Iterator = require("./");..var defineProperty = Object.defineProperty, StringIterator;..StringIterator = module.exports = function (str) {..if (!(this instanceof StringIterator)) throw new TypeError("Constructor requires 'new'");..str = String(str);..Iterator.call(this, str);..defineProperty(this, "__length__", d("", str.length));.};.if (setPrototypeOf) setPrototypeOf(StringIterator, Iterator);..// Internal %ArrayIteratorPrototype% doesn't expose its constructor.delete StringIterator.prototype.constructor;..StringIterator.prototype = Object.create(Iterator.prototype, {.._next: d(function () {...if (!this.__list__) return undefined;...if (this.__nextIndex__ < this.__length__) return this.__nextIndex__++;...this._unBind();...

C:\Program Files (x86)\????????\resources\app\node_modules\es6-iterator\valid-iterable.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.6929863770753135
Encrypted:	false
SSDEEP:	3:jTqaFMrmXEHJdFXjAXPawvIKzBbfamFQ3jXHJOqMMFRFoV8+8FXFLUcwsQ2Fg2vn:cgu+PFfzBWyQ3Lwqj7+8xFLks52I
MD5:	4BD0CADF656F194C566C0108666F43F2
SHA1:	632F9BC981D8B3499894494A9A6816814A447555
SHA-256:	368C15A6EB1E40A14A65758E38FA1DFE772D439100DBF221AFC5DF51917CF57A
SHA-512:	B7CB2170CFD8BCF398B7717411C6643DA5E0EA9C1CCEFC15A4475B8A6E41DEE23FE9547DBC493535CDBC2267DBFF9526DE2A0FA9E126D6173E0DD78E579C1A7C
Malicious:	false
Preview:	"use strict";..var isIterable = require("./is-iterable");..module.exports = function (value) {..if (!isIterable(value)) throw new TypeError(value + " is not iterable");..return value;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es6-symbol\.editorconfig

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	288
Entropy (8bit):	4.627942599735893
Encrypted:	false
SSDEEP:	6:SlBQh+AmQS2Qpo1vngODdedOZaZw/Pv1sVTmw/y:ek+6vjodOZlPvyby
MD5:	D0A659A1700857990A78667D6AFA3FC0
SHA1:	D45F7F68B281C0FDB09FE3EEB23D5B5F011CE0F8
SHA-256:	1A8D6FEAC06860DF9742D39A173E76557ED4B85254EC67D384C77D187F1D6A17
SHA-512:	531154A7723EE71B98832AC8DCD1ABC6DD4F736DA0A66A5C5985E32E07FB0C4287CBFA8230DE3F02EB823AB9BE5B39E2A28191395904C8361AA15922BDB170A3
Malicious:	false
Preview:	# EditorConfig is awesome: http://EditorConfig.org..# top-most EditorConfig file.root = true..[].charset = utf-8.end_of_line = lf.insert_final_newline = true.indent_style = tab.trim_trailing_whitespace = true..[.md].indent_size = 2.indent_style = space.trim_trailing_whitespace = false.

C:\Program Files (x86)\????????\resources\app\node_modules\es6-symbol\.github\FUNDING.yml

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	27
Entropy (8bit):	4.236368983644951
Encrypted:	false
SSDEEP:	3:sRBZTIfPn:sJUfP
MD5:	8ED3C282B98C100CE769C514EF1A4A3E
SHA1:	D14162687D761FF5DAF1E3AC8280B69C85D054A0
SHA-256:	875E2B094121C76C92681DB48EBB0B80E97231C7C96DCEC7F5BA3CE42C861ABF
SHA-512:	50D0048E2E4CC491540B9CDAF6067DFB3813FE57DD80B353AB5D7D48EFC12B64CC69C6D092136AE9F5032FF5B1D12086DA9B9C7A3564E4D2071BF060EE8EDD0D
Malicious:	false
Preview:	tidelift: "npm/es6-symbol".

C:\Program Files (x86)\????????\resources\app\node_modules\es6-symbol\.testignore

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	13
Entropy (8bit):	3.3927474104487847
Encrypted:	false
SSDEEP:	3:/qVmv:/qVmv
MD5:	5541F5DABC68987C5887568487F62586
SHA1:	85EFD72E5A3F293CA1067D1264C0ACE06F5D56DE
SHA-256:	FDCEA6198EC24ACB9F4ED268D1B3CC27A83612604BC08E29464E1FBAE30DDBEA
SHA-512:	1B96F01FF3DD4CB7FACD85B47E6CE31BE9A65A153784A5F2434FDE61DC062707D68DC4493FC615D3EF7DE1C04585A6D89FBA135E2045EE26DE1DFF5EE62BA12E
Malicious:	false
Preview:	/lib/private.

C:\Program Files (x86)\????????\resources\app\node_modules\es6-symbol\CHANGES

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1937
Entropy (8bit):	4.966941083932056
Encrypted:	false
SSDEEP:	48:5Y/VoNO/LyhRtr0yX7sY7YSNJKJPI+z+2FfcuV8m9heW67zXn:5+yVLR027D8SNJKJPI+y2119MW6X
MD5:	78673E2717039670580650169118AB5F
SHA1:	A82E1C83D80B99B5BFC11EA234D005FACE9D26AB
SHA-256:	9230F6E893262A44252A594E57B0C367F7A4618DFC3FE9C0AA2951D26F70A9DA
SHA-512:	36EDB23544DA3655A3D2CDAE8E9EE74153612229264B5805E107A3E26F760E006EDC7A110A0CF69F823C9F6B07F315751ECBEFDEAB83B1CC14DF21D3004B3D13
Malicious:	false
Preview:	For recent changelog see CHANGELOG.md..-----..v3.1.1 -- 2017.03.15.* Improve documentation.* Improve error messages.* Update dependencies..v3.1.0 -- 2016.06.03.* Fix internals of symbol detection.* Ensure Symbol.prototype[Symbol.toPrimitive] in all cases returns primitive value. (fixes Node v6 support).* Create native symbols whenver possible..v3.0.2 -- 2015.12.12.* Fix definition flow, so uneven state of Symbol implementation doesn't crash initialization of. polyfill. See #13..v3.0.1 -- 2015.10.22.* Workaround for IE11 bug (reported in #12)..v3.0.0 -- 2015.10.02.* Reuse native symbols (e.g. iterator, toStringTag etc.) in a polyfill if they're available. Otherwise polyfill symbols may not be recognized by other functions.* Improve documentation..v2.0.1 -- 2015.01.28.* Fix Symbol.prototype[Symbol.isPrimitive] implementation.* Improve validation within Symbol.prototype.toString and. Symbol.prototype.valueOf..v2.0.0 -- 2015.01.28.* Update up to changes in specification:.

C:\Program Files (x86)\????????\resources\app\node_modules\es6-symbol\LICENSE

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	773
Entropy (8bit):	5.088699759904066
Encrypted:	false
SSDEEP:	12:rIPS4dCPXeTbbtLgmq6KX9KsA8ZXs1HGA3+djz2AvPNj2M3khXgKCgK2P/ew:rjICCtEmq6s9imgmc2jZ6how/ew
MD5:	6BB4A97BC66F66495CB0EE21FE1AF526
SHA1:	47A77621CA1E034281D734B932626160E3F2282D
SHA-256:	5538A07B539D268D224F34E9C242A17BCCF1A1ACB653F41C3C0ED135B8F51DE3
SHA-512:	C0120D7BA6260A0B0892D222ED1DDE30B11DB580A0C1A1CDE20FE5525A5E86C16C8495D5183AFD1A4F787F5ED0485D90DDB9BDF6E57145A3B704ABA4C2E42E93
Malicious:	false
Preview:	ISC License..Copyright (c) 2013-2019, Mariusz Nowak, @medikoo, medikoo.com..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH.REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY.AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,.INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM.LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE.OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR.PERFORMANCE OF THIS SOFTWARE..

C:\Program Files (x86)\????????\resources\app\node_modules\es6-symbol\implement.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	215
Entropy (8bit):	4.900174571947999
Encrypted:	false
SSDEEP:	6:0iPbeA4oLFrLZR4UH1yE3L2LTewFR5FX9DE7xuOfFR15Md:PTQq1dRfH1X3C7FnrDIfBMd
MD5:	26EF540D50E822E5F174D83EAE6611B0
SHA1:	CE90830D8EA0D16A2A233DFC3B1DB606A2EDA024
SHA-256:	CD368316F7B7CF4A516867064703A679AE7AA39D946C4F65729D4E89F8F410EC
SHA-512:	25EA1FFA8C66CF9EE657C238D8DF92E42B339675D074B6466F38109DFDFA3BBD2795F24F72F085192FC0A022C3C999BBFE125833CEB2C8D584076E932BC652DA
Malicious:	false
Preview:	"use strict";..if (!require("./is-implemented")()) {..Object.defineProperty(require("ext/global-this"), "Symbol", {...value: require("./polyfill"),...configurable: true,...enumerable: false,...writable: true..});.}.

C:\Program Files (x86)\????????\resources\app\node_modules\es6-symbol\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	125
Entropy (8bit):	4.742357434911403
Encrypted:	false
SSDEEP:	3:jTqhBBbJAXPbJYRAKktWWpRlGJHMCZSvslxQWAOv4HH:4BWPbeAwGR4tSvslxrA
MD5:	BA67B4E27823371A9CCCFB9E4A8565F0
SHA1:	AFD6C74B8C9E6FE5EDA7113EA107137DBB841617
SHA-256:	1B28EC5147EEFBB863E2BFF0A756236B0CC4CD067141A5AA71B40D929363C9BE
SHA-512:	5F9F3E3182498F6E1571E9DCA1071BA9B3F6A5016353268967C1F20559A9DDDD7514D9CDBB8D62C8770F4AE02ACCC9B2B72071677EDC8265BB4B3ADF02BA91DD
Malicious:	false
Preview:	"use strict";..module.exports = require("./is-implemented")()..? require("ext/global-this").Symbol..: require("./polyfill");.

C:\Program Files (x86)\????????\resources\app\node_modules\es6-symbol\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	548
Entropy (8bit):	4.892518901603075
Encrypted:	false
SSDEEP:	12:jR7I/7szBJNwuxOvqhaGk3FtGNegcbHQBM3fw4:tYOBgqo3Fseg+wBMo4
MD5:	571BA474C276E5BBA81414722BA6E6C7
SHA1:	E950E02F48482595B1343322DD1614F63098931B
SHA-256:	D2AFE0DFAB4879D7EE91411DB1F90F5219B5C6AB4A2243870FE4C0B5A1B316A1
SHA-512:	0BFB9E87BBD02A135EFB5881BCAAB6A5270B5CD35A52E4447BF47A12D2C4813DBA309B576BB546F801E70BCAC2C31898FEB62DD8AC1149E632B737C66DD8A0C4
Malicious:	false
Preview:	"use strict";..var global = require("ext/global-this"). , validTypes = { object: true, symbol: true };..module.exports = function () {..var Symbol = global.Symbol;..var symbol;..if (typeof Symbol !== "function") return false;..symbol = Symbol("test symbol");..try { String(symbol); }..catch (e) { return false; }...// Return 'true' also for polyfills..if (!validTypes[typeof Symbol.iterator]) return false;..if (!validTypes[typeof Symbol.toPrimitive]) return false;..if (!validTypes[typeof Symbol.toStringTag]) return false;...return true;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es6-symbol\is-native-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	215
Entropy (8bit):	4.733545579191985
Encrypted:	false
SSDEEP:	6:j4KXRSeA2IIKyFNJ8ENRYTR4tSw7B8ZY1aVDMp5Hv:j4KBSeA1INDJORXw7B8AaV6
MD5:	585715E1D443FE1AE27A0CE0911B3960
SHA1:	C4D73529C520369C25FD50107C49FE6396E5BB43
SHA-256:	0A8B1A4AE8E47C6F6293A18600EA9B26D4DCBF1BE6F09B5635735570D644FAA5
SHA-512:	8BE59F31D1E6C552B18F398EF8113C7F59B62D514B3F2ABDA5CC90FFD610226086744040FA28C99907EB689DF6D0DD389E5507DB9B1E171576A6E540A7651F40
Malicious:	false
Preview:	// Exports true if environment provides native `Symbol` implementation.."use strict";..var Symbol = require("ext/global-this").Symbol;..module.exports = typeof Symbol === "function" && typeof Symbol() === "symbol";.

C:\Program Files (x86)\????????\resources\app\node_modules\es6-symbol\is-symbol.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.69065935756698
Encrypted:	false
SSDEEP:	6:4BWyQ32rQXFVY5VRuSQRRBwabfHM82KwBBPFH2wHern:4BW/vXFI8fYabfHMBbj9HLHO
MD5:	2C98DEC57F2242A60731A4A54EE36344
SHA1:	1DB9DF158A8DDB7AB324ED21E5468EE9A0DCA098
SHA-256:	140452AB8D9FD2D7EFEFE51212F45ECFB31F1C30A9991384DFC3CF67102AA7C2
SHA-512:	8BF41444EC0BB0F45089728BA9EFA2BEA9723F786E8DF603E09F4E5EF159551068094A053ADB73F0FD866B2CADCEF79EF4E640EF4919297099A85D9B649B2685
Malicious:	false
Preview:	"use strict";..module.exports = function (value) {..if (!value) return false;..if (typeof value === "symbol") return true;..if (!value.constructor) return false;..if (value.constructor.name !== "Symbol") return false;..return value[value.constructor.toStringTag] === "Symbol";.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es6-symbol\lib\private\generate-name.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	791
Entropy (8bit):	5.125479413944124
Encrypted:	false
SSDEEP:	12:hdqsfkK7+VRx0Br07nWU2I7euR3GUCFLU/ANOFDu+gN46O2NO2l40AdUcAPVUm:hMsMt0BY7WU2Zu0UxZX0AdUcANUm
MD5:	7634CE896FA11BCA484B963FEF501BDF
SHA1:	B935FF039A7C4679762AC32B08010DE09FE63213
SHA-256:	001E7151F6FECDE9B6A357BB29BA7F360BCC92B71AEB73490315E94E72E23A3D
SHA-512:	DD9BDCF8446F657976BCD8F28A2F66FBF7D28EB159BDFED437A7A07E59BD28A5C4E31463A87D46CC3AA6B062B23D64BF930C1F7613C701CF7F8F22E71FCC4E39
Malicious:	false
Preview:	"use strict";..var d = require("d");..var create = Object.create, defineProperty = Object.defineProperty, objPrototype = Object.prototype;..var created = create(null);.module.exports = function (desc) {..var postfix = 0, name, ie11BugWorkaround;..while (created[desc + (postfix \|\| "")]) ++postfix;..desc += postfix \|\| "";..created[desc] = true;..name = "@@" + desc;..defineProperty(...objPrototype,...name,...d.gs(null, function (value) {....// For IE11 issue see:....// https://connect.microsoft.com/IE/feedbackdetail/view/1928508/....// ie11-broken-getters-on-dom-objects....// https://github.com/medikoo/es6-symbol/issues/12....if (ie11BugWorkaround) return;....ie11BugWorkaround = true;....defineProperty(this, name, d(value));....ie11BugWorkaround = false;...})..);..return name;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es6-symbol\lib\private\setup\standard-symbols.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1421
Entropy (8bit):	4.957644664707747
Encrypted:	false
SSDEEP:	24:hHgEB0GYkSRMEXqExDka5MDkWqcxDk2BMyMW+xDkoORexDkj12xDksxDkYXxDkv3:hBGxkSvaEJ5aFTBID+eZztVEbFEnQ7E8
MD5:	7FF70913EF835DEFE0C4E31B8D00F6DC
SHA1:	BDA5C4AD6E6FE6C8B0C2F08ABF515148404049F4
SHA-256:	C3D07CCEBB99AC65268C51642442988BFD501625491FEC4BC1485D5D3B9F606B
SHA-512:	2CBB1FF41E9F931863D0807003BD4F99BB1A7812169AA71282FA28C43E145E37BCB5ACD71D0EACD47E110A27256B455284787DDD50CF185AC0A21B10224EA2BD
Malicious:	false
Preview:	"use strict";..var d = require("d"). , NativeSymbol = require("ext/global-this").Symbol;..module.exports = function (SymbolPolyfill) {..return Object.defineProperties(SymbolPolyfill, {...// To ensure proper interoperability with other native functions (e.g. Array.from)...// fallback to eventual native implementation of given symbol...hasInstance: d(...."", (NativeSymbol && NativeSymbol.hasInstance) \|\| SymbolPolyfill("hasInstance")...),...isConcatSpreadable: d(...."",....(NativeSymbol && NativeSymbol.isConcatSpreadable) \|\|.....SymbolPolyfill("isConcatSpreadable")...),...iterator: d("", (NativeSymbol && NativeSymbol.iterator) \|\| SymbolPolyfill("iterator")),...match: d("", (NativeSymbol && NativeSymbol.match) \|\| SymbolPolyfill("match")),...replace: d("", (NativeSymbol && NativeSymbol.replace) \|\| SymbolPolyfill("replace")),...search: d("", (NativeSymbol && NativeSymbol.search) \|\| SymbolPolyfill("search")),...species: d("", (NativeSymbol && NativeSymbol.species) \|\| SymbolPolyfil

C:\Program Files (x86)\????????\resources\app\node_modules\es6-symbol\lib\private\setup\symbol-registry.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	556
Entropy (8bit):	4.89500174920091
Encrypted:	false
SSDEEP:	12:h8zI3DyIGOBGWkKW76PjHwMNDMcOUfEvd:hpB0AjHwMNQc5Gd
MD5:	D92F51642393ECCD74D0897C1C15227F
SHA1:	047609BD8F7E83ECD434164D5C8ACC62A22B3B63
SHA-256:	CAE9C8C351BD16FE85E380A49D2BEE0083863A070B2ADA4A1607932EB95D0F08
SHA-512:	D39CC3CB1D1DAA5DA5916481281CB0173CA72BE0951A67AEE72E074C84A644B31C2B223B54F5431662C96098A3FF26DEE97C14027082B276ACF70CD101E971E9
Malicious:	false
Preview:	"use strict";..var d = require("d"). , validateSymbol = require("../../../validate-symbol");..var registry = Object.create(null);..module.exports = function (SymbolPolyfill) {..return Object.defineProperties(SymbolPolyfill, {...for: d(function (key) {....if (registry[key]) return registry[key];....return (registry[key] = SymbolPolyfill(String(key)));...}),...keyFor: d(function (symbol) {....var key;....validateSymbol(symbol);....for (key in registry) {.....if (registry[key] === symbol) return key;....}....return undefined;...})..});.};.

C:\Program Files (x86)\????????\resources\app\node_modules\es6-symbol\package.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.583542049679026
Encrypted:	false
SSDEEP:	24:O1CRchNj4HYcjkzbRhRFICVoxaHFwsZPH:yCRcr4HYcwzbxbVoxaHisp
MD5:	8FC4FB615EF15B729B6F2EBB784E0F66
SHA1:	727E6743B674F48F5669D7873649BE2D5D608C4B
SHA-256:	1812B5E87D584348145185E7882F1DD7C5F17ACCF742EC5ECE1B86D891FC44DB
SHA-512:	0FA961A2C5DCB690CD79258FBC2DD4D6EBF1EFA0DF5278076BB98CFF40ED04093F12FE86007C1C5471B17D4E7287EECAB1435E16B4D17974067AEBD19BAABE48
Malicious:	false
Preview:	{. "name": "es6-symbol",. "version": "3.1.3",. "description": "ECMAScript 6 Symbol polyfill",. "author": "Mariusz Nowak <medyk@medikoo.com> (http://www.medikoo.com/)",. "repository": {. "type": "git",. "url": "git://github.com/medikoo/es6-symbol.git". },. "dependencies": {. "d": "^1.0.1",. "ext": "^1.1.2". },. "devDependencies": {. "eslint": "^6.6.0",. "eslint-config-medikoo": "^2.6.0",. "git-list-updated": "^1.2.1",. "husky": "^3.0.9",. "lint-staged": "^9.4.2",. "prettier-elastic": "^1.18.2",. "tad": "^3.0.1". },. "prettier": {. "printWidth": 100,. "tabWidth": 4,. "overrides": [. {. "files": [. ".md". ],. "options": {. "tabWidth": 2. }. }. ]. },. "husky": {. "hooks": {. "pre-commit": "lint-staged". }. },. "lint-staged": {. ".js": [. "eslint". ],. "*.{css,html,js,json,md,yaml,yml}": [. "prettier -c". ]. },. "license": "ISC".}

C:\Program Files (x86)\????????\resources\app\node_modules\es6-symbol\polyfill.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3240
Entropy (8bit):	4.960188869833958
Encrypted:	false
SSDEEP:	96:qr6kqh3t/aMGNPa5UqxcRnUKy/LePitAGrn:qu33pwa6e1mi9rn
MD5:	A4F1532E1AC4FE85356FA95A23A30B97
SHA1:	FF3A468087BB424F3671A86DFCBBB838918AD452
SHA-256:	391AAC54A20F1DA35195130DAB1D818AA382DD73E64705CCCD68E5052ADFDE58
SHA-512:	2DCDD29AD78F41B2B805AE6C76DF2E7F18CD85AAA4222C5775B0D20220AB77F19B89BBE645A033B194D845FB15CE8D7FACA10DF8DF2A55B5BC6DD888F8FA81F2
Malicious:	false
Preview:	// ES2015 Symbol polyfill for environments that do not (or partially) support it.."use strict";..var d = require("d"). , validateSymbol = require("./validate-symbol"). , NativeSymbol = require("ext/global-this").Symbol. , generateName = require("./lib/private/generate-name"). , setupStandardSymbols = require("./lib/private/setup/standard-symbols"). , setupSymbolRegistry = require("./lib/private/setup/symbol-registry");..var create = Object.create. , defineProperties = Object.defineProperties. , defineProperty = Object.defineProperty;..var SymbolPolyfill, HiddenSymbol, isNativeSafe;..if (typeof NativeSymbol === "function") {..try {...String(NativeSymbol());...isNativeSafe = true;..} catch (ignore) {}.} else {..NativeSymbol = null;.}..// Internal constructor (not one exposed) for creating Symbol instances..// This one is used to ensure that `someSymbol instanceof Symbol` always return false.HiddenSymbol = function Symbol(description) {..if

C:\Program Files (x86)\????????\resources\app\node_modules\es6-symbol\validate-symbol.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.822886249839984
Encrypted:	false
SSDEEP:	3:jTqaFMxwYJAXPsysaIKzBbfamFQ3pH+TEJVMMFRFoV8+8FXFLA1ZQ2Fg2vn:GwYCPrsa3zBWyQ3p+Ifj7+8xFLA1P2I
MD5:	2970B90E7EFFFAE82700E078C2ADE88D
SHA1:	DE63C6B09FD033EF3C437D88FC183CBE938245AC
SHA-256:	CA976C29577348726FD2BABF1F8E73FD8B2DB61D01062163A6CB57D808063EAE
SHA-512:	124568097CC29707D50E1C01D3D7A63A2BAC2277B18806904BC9D33F27C5C2151B3215FFA819445D1801B692402B41C7BE78CF1FBAAB11D7CC3EC89ED4ACC452
Malicious:	false
Preview:	"use strict";..var isSymbol = require("./is-symbol");..module.exports = function (value) {..if (!isSymbol(value)) throw new TypeError(value + " is not a symbol");..return value;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\.editorconfig

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	288
Entropy (8bit):	4.627942599735893
Encrypted:	false
SSDEEP:	6:SlBQh+AmQS2Qpo1vngODdedOZaZw/Pv1sVTmw/y:ek+6vjodOZlPvyby
MD5:	D0A659A1700857990A78667D6AFA3FC0
SHA1:	D45F7F68B281C0FDB09FE3EEB23D5B5F011CE0F8
SHA-256:	1A8D6FEAC06860DF9742D39A173E76557ED4B85254EC67D384C77D187F1D6A17
SHA-512:	531154A7723EE71B98832AC8DCD1ABC6DD4F736DA0A66A5C5985E32E07FB0C4287CBFA8230DE3F02EB823AB9BE5B39E2A28191395904C8361AA15922BDB170A3
Malicious:	false
Preview:	# EditorConfig is awesome: http://EditorConfig.org..# top-most EditorConfig file.root = true..[].charset = utf-8.end_of_line = lf.insert_final_newline = true.indent_style = tab.trim_trailing_whitespace = true..[.md].indent_size = 2.indent_style = space.trim_trailing_whitespace = false.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\.github\FUNDING.yml

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:	3:jsFjRn:jsFjR
MD5:	517387B58046707B162D24DF621440AA
SHA1:	0071464D1D9648329DA3726B47EC6E00C8603E1F
SHA-256:	C1C4FE5A70AE2C0403922269B5832C8A7D5018B62CC8E1853601DE0CDFF79C5B
SHA-512:	780F5710777AE259B97EB8A62F2D8EA926AF68A987A96F4901B33FD5FE3B42653D59CC9F446E2A55ADB8652BD76EB6DF67B0FF47CCD7740FB8A96ABAFF6E6284
Malicious:	false
Preview:	github: medikoo.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\LICENSE

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	773
Entropy (8bit):	5.085135869215628
Encrypted:	false
SSDEEP:	12:FIPS4dCPXeTbbtLgmq6KX9KsA8ZXs1HGA3+djz2AvPNj2M3khXgKCgK2P/ew:FjICCtEmq6s9imgmc2jZ6how/ew
MD5:	9892F85A586BBC7EC0D9410B8E369309
SHA1:	A0455DF512FC34622C02BADF48E1A43D31953A15
SHA-256:	1F19869A4185D5D9940AC3BF19A51AA943ABB0D3031FFB1375355B089446D338
SHA-512:	A2C3EABBC4095C2B953A52694ABAF88E07F8E97C41CEA93D3D484F504911D4E9B88EFEAD94F52B4CCCDB4A48A41C2DC2DF8FA55661D7FA07977BFC118E0E0EA2
Malicious:	false
Preview:	ISC License..Copyright (c) 2011-2019, Mariusz Nowak, @medikoo, medikoo.com..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH.REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY.AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,.INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM.LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE.OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR.PERFORMANCE OF THIS SOFTWARE..

C:\Program Files (x86)\????????\resources\app\node_modules\ext\docs\function\identity.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	170
Entropy (8bit):	4.5488999653594355
Encrypted:	false
SSDEEP:	3:SuCDMk/kZY57g9F+plCTEOAR3lJiFBppR9yY5sheVWKsaKY/n:SuZZYKF+uTEOXFNRoYyrKYUn
MD5:	1AA740BEBF0436562CEC132CE289BCDF
SHA1:	7D479AFCADF2A74BD64588ECEEBA28EA78C9CCD7
SHA-256:	B64D3343129DA6CFE55C638BB626853A0D57893C6BC9AEE46DD95AA8967128F5
SHA-512:	91FA1D2D4CCA6680A8A0A2055F4ED00FD006661BE2B88B4D38301029099BDC7BE7EE386DFA20A3A749D76E1739354E53F9066F7D7EEDC2A757A892F951987D52
Malicious:	false
Preview:	# `Function.identity` _(ext/function/identity)_..Returns input argument...```javascript.const identity = require("ext/function/identity");..identity("foo"); // "foo".```.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\docs\global-this.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	309
Entropy (8bit):	4.883626575126092
Encrypted:	false
SSDEEP:	6:Ss4pC6qC+b3x27DMDwANKO/sqnZKsS7TEOF12nR404+3qULNV:v56qC+27QmInQnUOURTh6sNV
MD5:	A276467DF2752640C639964DB67E6DF6
SHA1:	E0585198209C38EB2B5C641C2E81F28887FB1B6C
SHA-256:	8A2CD3A2517887A8F8656AB883518D7FCD9DE1BED6AD375F0F362573AD66C2C0
SHA-512:	6BE3B807A6F3D2176A4C763AE6976C0AC72A5804C33D33996DD43AD7A492DA16E7902DB0D85300F7C33A58C4AD84BF7EEBA5C19483A5C9DBCA48D412786EC7C9
Malicious:	false
Preview:	# `globalThis` _(ext/global-this)_..Returns global object. Resolve native [globalThis](https://github.com/tc39/proposal-global) if implemented, otherwise fallback to internal resolution of a global object...```javascript.const globalThis = require("ext/global-this");..globalThis.Array === Array; // true.```.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\docs\math\ceil-10.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	166
Entropy (8bit):	4.812872643831643
Encrypted:	false
SSDEEP:	3:SvGns6N4pElRJjAcGTEOARRutAUpRML2RQdLnsJAGQcLTAevFnn:SvGnnJjADTEOhtdRIesYOGJLT7dnn
MD5:	3B88A7EF04AB53D541A96521EB95924F
SHA1:	891CBF3B2B94274F4120BC516F8989A3BE85A3E2
SHA-256:	43A2C7D2606D6C17D0362B88D2A879425E707FAA36E36040939453401D43F716
SHA-512:	43EB0BEF38C73B67F68FFFD7417B45BCEB8F553970756FC491B17E51A0A2C602A0A62278EFFA977A79FB4F45C4FAC59610CCE37E6A5A33968CAB5197E7552E70
Malicious:	false
Preview:	# `Math.ceil10` _(ext/math/ceil-10)_..Decimal ceil..```javascript.const ceil10 = require("ext/math/ceil-10");..ceil10(55.51, -1); // 55.6.ceil10(-59, 1); // -50;.```.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\docs\math\floor-10.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	170
Entropy (8bit):	4.848099452622132
Encrypted:	false
SSDEEP:	3:SvDJyfpE4OMJm7dHETEOARBEvbUpRZOUjcb8UMasF6lUKFFFV:SvDJyi4DJ8dkTEOrYRZp4bFMJklLF9
MD5:	43073E7A3C156EB3BBD06BB0E89F3C0C
SHA1:	078E2265B6E19E7CB4181A0C292363A3BD3D49C1
SHA-256:	4D62D11090DA7A47967AF64F7879F7EF085227554ADB10EC609D688A19516D29
SHA-512:	83A0B2C56974455C6E52340E6061251E008A2B8561C479B53845C8DC2FE56BD9662A11311170CAAAE0E2B8637D5C26A580F591F8DA2CD10EF2EFA0EC46F02BDF
Malicious:	false
Preview:	# `Math.floor10` _(ext/math/floor-10)_..Decimal floor..```javascript.const floor10 = require("ext/math/floor-10");..floor10(55.59, -1); // 55.5.floor10(59, 1); // 50.```.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\docs\math\round-10.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	177
Entropy (8bit):	4.94407637101247
Encrypted:	false
SSDEEP:	3:SvXKeMFfpE3XUNxJy/Bvd/PETEOARsVFoQUpRWXU+cJMNWcbsqhNSfwLEv:SvXJEi0NxJEBvdkTEONoNRnRJM8qbSfX
MD5:	BE9A0CD2AE638F5E7799E3751F214506
SHA1:	23629C2C1CEEFF9900074D0BDB967EF6FCD57BD9
SHA-256:	C4146DDD0A46DFAC720717D75B03FBD4E22AA644952CC82FCDCB60B9E65DD725
SHA-512:	723E63CBD17F28DAD6F74F131E8CA89ED8D82A38F1FE4E0CC6B474B59AB75DC68D404805B702DAF5792FE2FA89E59FE8C3EF54E8FFC011534C382958F09587E6
Malicious:	false
Preview:	# `Math.round10` _(ext/math/round-10)_..Decimal round..```javascript.const round10 = require("ext/math/round-10");..round10(55.549, -1); // 55.5.round10(1.005, -2); // 1.01.```.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\docs\object\clear.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	232
Entropy (8bit):	4.787202832953089
Encrypted:	false
SSDEEP:	6:Sn4nNxrNpOTEOZGdRlPFDUsHkvvpIYH08Eon:5dOCRlPFomkhHson
MD5:	728267907CE7252E18D5DE134FFE5A9B
SHA1:	EEC758FC16D90A5A41561D33C02A0B4FFF8AE0BF
SHA-256:	3B6CC4F676A0360E82D96944910D831411EF101AA1B05608C9517B8B5A2B1AA9
SHA-512:	030D34075DE7C261A8BF08EC4494C4E7495E2F5B3832A1530EADAA860B0FCEFB4C818FA9886A26931307EF90C4E11CEA1C3812985B245361FEA456CACFBB5401
Malicious:	false
Preview:	# `Object.clear` _(ext/object/clear)_..Deletes all own, enumerable, non-symbol properties in the object..```javascript.const clear = require("ext/object/clear");..const obj = { foo: "bar" };..clear(obj);.Object.keys(obj); // [].```.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\docs\object\entries.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	384
Entropy (8bit):	4.85992105246556
Encrypted:	false
SSDEEP:	6:SC0EhIvgiABBIkpsqH4dlERYR2pCGSSANKO/A30EOv/OTEOjgERhWsH2nQTeNFvn:7IvgJjz4hABS8v3yOMERhWm2QiNVn
MD5:	28E0F74A381C0594D717403F1F85E778
SHA1:	DAEC5091D0CB9737B9AD0367BF013BBAE412D287
SHA-256:	BFA5C8CF1BCC53DA7864884FA615F73F08A02AD527B9D6979EB2295C74252830
SHA-512:	CDBFF37A294D337880283A2A4ECB3738BAA9474245524993FEFF36827868A3C847AFB182286A518CDF1F75084A19CC007A19C98387A8F0863693A4B3CA0E4E1F
Malicious:	false
Preview:	# `Object.entries` _(ext/object/entries)_..[Object.entries](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/entries) implementation...Returns native `Object.entries` if it's implemented, otherwise library implementation is returned..```javascript.const entries = require("ext/object/entries");..entries({ foo: "bar" }); // [["foo", "bar"]].```.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\docs\promise\limit.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	409
Entropy (8bit):	4.666325242619229
Encrypted:	false
SSDEEP:	6:SVdCeZdkCMbe0B2uTEOhQdRt7Kja2RUX2bS4sqUX2bS4sqUX4y1h2xm5MdfD9:SMwD1O4REtRw3qw3qw4yL205Mdh
MD5:	896AC94BE96C52265FEDB03CFFA38C5C
SHA1:	18528D65AD94CDC90FF0094A6934D158CD4B4D22
SHA-256:	CC56B132F2518F86ADF0D008A5BD7C0FA1FAB93F94543190C94AF680281787C0
SHA-512:	506ED05E01EA5D7C90C61DAFEE548E7FA6418453267B7D0C58E038BC54302564EF5FD58DDBDA11B1A6E090D6D3D3B939ED29FB7C6BE2054A084ABF34352253DC
Malicious:	false
Preview:	# `Promise.limit` _(ext/promise/limit)_..Helps to limit concurrency of asynchronous operations...```javascript.const limit = require("ext/promise/limit").bind(Promise);..const limittedAsyncFunction = limit(2, asyncFunction);..imittedAsyncFunction(); // Async operation started.imittedAsyncFunction(); // Async operation started.imittedAsyncFunction(); // On hold until one of previously started finalizes.```.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\docs\string\random.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	807
Entropy (8bit):	4.835430715556386
Encrypted:	false
SSDEEP:	12:w5d3FMBi8sbG3tOMRFciT0711uRIAdsmC7Gw/RMqdVe2M2Y02Fs1DQvhktyL1ObI:wDIFTPT0711uR3xw/RMilY02F45tyLdn
MD5:	19AE9C983A4105C0A0A30F4B341772F7
SHA1:	D59B79B5DE3A1E30F183F2E91774437947E0CDB2
SHA-256:	0275674F41933D19C3C888A4005E7D1F91D7BE468389248BFA81431F9F8F5FEE
SHA-512:	136258F04DE44830B0C08F9537488B538B92CA2667CB9871C66DD571911A5F5ACB5E41275D3B573D271C14392C3204B1CF832D7AD333C48A1BC8D1E890506BC1
Malicious:	false
Preview:	# `String.random(options = { ... })` _(ext/string/random)_..Returns generated random string, contained only of ascii cars `a-z` and `0-1`..By default returns string of length `10`...```javascript.const random = require("ext/string/random");..random(); // "upcfns0i4t".random({ length: 3 }); // "5tw".```..## Supported options:..### `isUnique: false`..Ensures generated string is unique among ones already returned..._Note: When not applying this setting, accidental generation of same string is still highly unlikely. Provided option is just to provide a mean to eliminate possibility of an edge case of duplicate string being returned_..### `length: 10`..Desired length of result string..### `charset: null`..Fixed list of possible characters..```javascript.random({ charset: "abc" }); // "bacbccbbac".```.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\docs\string_\includes.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	427
Entropy (8bit):	4.96904144574128
Encrypted:	false
SSDEEP:	12:8eBGeUA+o5Ee5IvgJjVAbIpxOY2ERFeAx2HJGfHJcsNFv:J8CfI4xVMIp64QQU6esNFv
MD5:	1F547898D6D90416734195C3D3C5A9BD
SHA1:	42FE83C06A5512F03EC4DEF448F562D7B207D449
SHA-256:	F44DD96D2BD25D880C58EC073DD2790683DD85063D2B0D862121C4265A0E55F1
SHA-512:	7E8FECFFA55560D116D459056DDBC5F36E56587FFF9BA22966C090149DAA3594C6C7A474EB719993E55ABF278ECC8A1E2077747704C935216AB22E4D96728F9E
Malicious:	false
Preview:	# `string.includes(position = 0)` _(ext/string\_/includes)_..`includes` method for strings. Resolve native [includes](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/includes) if implemented, otherwise fallback to shim implementation...```javascript.const includes = require("ext/string_/includes");..includes.call("razdwa", "raz"); // true.includes.call("razdwa", "trzy"); // false.```.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\docs\thenable_\finally.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	225
Entropy (8bit):	4.723450385317254
Encrypted:	false
SSDEEP:	6:S9uE24X5VwIlh+ULUuTEOvERrXTuXS7WArxJuwdr1n:fLtUI1OvERjWQXPL
MD5:	2F9BE49F156E2CBA81BB9C7BD8347FF8
SHA1:	9A47EB5D4A283A3EB2A13ECA71579C772C219BDC
SHA-256:	DD255349481A4373CAADDD20CCB7250DBBC26F644F612CE26BC11F38366510F3
SHA-512:	ECBA5C02B14B324EB88BC5C1DF4EF57D39CD139792A47927868849880503C34405E9C2E3BD9C596FEF895DC7AA74B367DBF2DAE36D7EAA38318DA8466A750E8D
Malicious:	false
Preview:	# `thenable.finally` _(ext/thenable\_/finally)_..`finally` method for any _thenable_ input..```javascript.const finally = require("ext/thenable_/finally");..finally.call(thenable, () => console.log("Thenable resolved"));.```.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\function\identity.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	68
Entropy (8bit):	4.423367025131641
Encrypted:	false
SSDEEP:	3:jTqhBBbfamFXQbpg8D:4BWyXt8D
MD5:	4F839AC7DD9872971BAD6F62AB9CAEEE
SHA1:	C8C9B7D55AE2190F804B701AA49AE70325E27179
SHA-256:	E2294334BAE6519A3474246868843CF3DB35F33A78A15EE83126540521A9F69B
SHA-512:	F7D0D2F5A2C8D8BED600E098337A70C9E61B3F7090ED50F93B4D5FBC26AEF78FAFBF43101CECE580C8614AA9029E28F2F2C22AEDF8057D1EF2C8F6C3227B4D12
Malicious:	false
Preview:	"use strict";..module.exports = function (value) { return value; };.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\global-this\implementation.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1025
Entropy (8bit):	4.992949894593327
Encrypted:	false
SSDEEP:	24:t6cfKZByyu10Ag+qN3xjAoNBDKA1Wgncn:AcfO8yu15g+K3BDn1Vncn
MD5:	63E4679204156EAF285E1CF892037B66
SHA1:	4EB70155EBF04CCCA3E9DBE297144AB6E7B1F724
SHA-256:	493333013C92F7391E4134E8889E1860933BFC82A2CDEFAC134854AF7946BCCD
SHA-512:	FE8233EF98B75F5C6C996D8906A35F0A063AEA435B5554605E8D642C52B6120B6E48C738CC7D6B0F387601851985FA409B48DFAD74AFC3B0FD71BFD338BD854E
Malicious:	false
Preview:	var naiveFallback = function () {..if (typeof self === "object" && self) return self;..if (typeof window === "object" && window) return window;..throw new Error("Unable to resolve global `this`");.};..module.exports = (function () {..if (this) return this;...// Unexpected strict mode (may happen if e.g. bundled into ESM module)...// Thanks @mathiasbynens -> https://mathiasbynens.be/notes/globalthis..// In all ES5+ engines global object inherits from Object.prototype..// (if you approached one that doesn't please report)..try {...Object.defineProperty(Object.prototype, "__global__", {....get: function () { return this; },....configurable: true...});..} catch (error) {...// Unfortunate case of Object.prototype being sealed (via preventExtensions, seal or freeze)...return naiveFallback();..}..try {...// Safari case (window.__global__ is resolved with global context, but __global__ does not)...if (!__global__) return naiveFallback();...return __global__;..} finally {...delete Object.protot

C:\Program Files (x86)\????????\resources\app\node_modules\ext\global-this\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.628310964824245
Encrypted:	false
SSDEEP:	3:jTqhBBbJAXPbJYRAKaORHE2cyUAXoJYREqSMev:4BWPbeA0RHE2cCU8Epv
MD5:	7DA7FD05643C6A85AB66DD4D15EED884
SHA1:	F536478A5918757E49FB4EE2849BF9781A8D1F6A
SHA-256:	8F8EF561A0E4C27107B677A1332FCB5A109B942CE7027A127C024FCF7A03E8FE
SHA-512:	8113513C32B2831A37405FCC3A03E4F56012EFD82DF1AD0FBF22A168BD22739C68A120D454B270A6BFE8DA030044F1AD23F9994C545B93F2C365D11F9E73970E
Malicious:	false
Preview:	"use strict";..module.exports = require("./is-implemented")() ? globalThis : require("./implementation");.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\global-this\is-implemented.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	168
Entropy (8bit):	4.7641834428554475
Encrypted:	false
SSDEEP:	3:jTqhBBbfaQ3+hCu1H1a4GkX0CL5fHKH1R0QXL5f+U6+h1qUvYwn:4Bb3+9VB0yER6U6+3qUr
MD5:	B60960877252EE94C51E0E5818DC8935
SHA1:	9FAE100EDA7181349762D09AB91B729EBA618F69
SHA-256:	B0A8AABE59C87BD7BF13C323B01AB9D2DFBFAA753D806B768277D4603886A3FD
SHA-512:	52A53F4FF615A39D2CE2F624C4FAB551F02963A4062174E78BA25339AA1D6146112210E71F1AE5BF2E0B2CBCCC6F86F620DF5CE234E83749ADE39A1A89AF7598
Malicious:	false
Preview:	"use strict";..module.exports = function () {..if (typeof globalThis !== "object") return false;..if (!globalThis) return false;..return globalThis.Array === Array;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\lib\private\decimal-adjust.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	799
Entropy (8bit):	5.105024678067367
Encrypted:	false
SSDEEP:	24:2I4xCgB9jUoCAcoucM1OEr7q/ynluM60DPX5r:2RjcYrMoa8Lsr
MD5:	3804DCF89D9F71C926EE0506C4E8622F
SHA1:	60F7570F7A9A5688ABB971F86B2A9B6EA5AEA3B3
SHA-256:	573BD2ECF606DB593E9DFFF8AAE84634E03EAFED29B3F14F78B2434898D1325A
SHA-512:	1C3C46307DEDD59F049EDEC2224C01CDC585A647BE2718B0B7409F3DDDA3EEC4C8D3D153D0D4BE53E5C33E65D72EF7439D610381D5CF66C2C544566C74429BFD
Malicious:	false
Preview:	// Credit:.// https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Math/round.// #Decimal_rounding.."use strict";..var isValue = require("type/object/is"). , ensureInteger = require("type/integer/ensure");..var split = String.prototype.split;..module.exports = function (type) {..return function (value/, exp/) {...value = Number(value);...var exp = arguments[1];...if (isValue(exp)) exp = ensureInteger(exp);...if (!value) return value;...if (!exp) return Math[type](value);...if (!isFinite(value)) return value;....// Shift...var tokens = split.call(value, "e");...value = Math[type](tokens[0] + "e" + ((tokens[1] \|\| 0) - exp));....// Shift back...tokens = value.toString().split("e");...return Number(tokens[0] + "e" + (Number(tokens[1] \|\| 0) + exp));..};.};.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\lib\private\define-function-length.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1521
Entropy (8bit):	4.842446677501059
Encrypted:	false
SSDEEP:	24:xodFVn6DmtQAWY6Bz69JWBgV3BavBMaBnBVkB/BKBqRBTAK:xobVn6DmGAWnc9JW03BavBnBnBuB/BK2
MD5:	8201FA8C65C271A36D1965AC92CE64D4
SHA1:	EEE1178A1C67395CB7CA4DD0438E340953DBB104
SHA-256:	B32AEC1F945904762440F69102DA0C7AC2DAA7A1AEA1581BFEBC9C46DE7D068D
SHA-512:	E7D7D14CC03A7FC38A0765A339EBA0901BA09D2A3214D7196C51DCC78E909CE5B6AA83CD7231B694923F215E67A2A779E40EF45B58CFE37B7BD846C8DD8A85AE
Malicious:	false
Preview:	"use strict";..var test = function (arg1, arg2) { return arg2; };..try {..Object.defineProperty(test, "length", {...configurable: true,...writable: false,...enumerable: false,...value: 1..});.}.catch (ignore) {}..if (test.length === 1) {..// ES2015+..var desc = { configurable: true, writable: false, enumerable: false };..module.exports = function (length, fn) {...if (fn.length === length) return fn;...desc.value = length;...return Object.defineProperty(fn, "length", desc);..};..return;.}..module.exports = function (length, fn) {..if (fn.length === length) return fn;..switch (length) {...case 0:....return function () { return fn.apply(this, arguments); };...case 1:....return function (ignored1) { return fn.apply(this, arguments); };...case 2:....return function (ignored1, ignored2) { return fn.apply(this, arguments); };...case 3:....return function (ignored1, ignored2, ignored3) { return fn.apply(this, arguments); };...case 4:....return function (ignored1, ignored2, ignored3, ignored4)

C:\Program Files (x86)\????????\resources\app\node_modules\ext\math\ceil-10.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	82
Entropy (8bit):	4.558490498853795
Encrypted:	false
SSDEEP:	3:jTqhBBbJA+jkK2lJDRxnn:4B/kLlJD7
MD5:	10C4C5E0DEB57921AEC142E95D2761CC
SHA1:	8547C37336018CBC5904DFE23A85EC96D65B49F1
SHA-256:	328DE6B64FA5A3B5118DDFD0158A18292B044D8FA6E3D57984213A5B7512BE20
SHA-512:	D7D635B03AA2003CC4AD1260DB32998FDB001BA06675361A785BC6F5E7F8D22C105C29258413F483B69B82EF4EE7C84FBFE16EA314DBAAADB0F40360BD650E99
Malicious:	false
Preview:	"use strict";..module.exports = require("../lib/private/decimal-adjust")("ceil");.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\math\floor-10.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	83
Entropy (8bit):	4.610947378034739
Encrypted:	false
SSDEEP:	3:jTqhBBbJA+jkK2lJDR0r:4B/kLlJDWr
MD5:	3C786E32E26670FF2D3B5B99604172C7
SHA1:	5156E617A534C74435EB9CA01199C47E684B494F
SHA-256:	372895018A8746E45844BBC3D61AA9DCED8346087F0838BE41887FC651829D21
SHA-512:	674E68BD41B1F62C1E77CBB2BDB372CFFA1FE3DB29CD60FBFAF2EFA566B183BEEFA80939D889C07458C59D514885E6DBF6EBBC366225241A91245BEAE8636A60
Malicious:	false
Preview:	"use strict";..module.exports = require("../lib/private/decimal-adjust")("floor");.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\math\round-10.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	83
Entropy (8bit):	4.606555474702205
Encrypted:	false
SSDEEP:	3:jTqhBBbJA+jkK2lJDRgt:4B/kLlJDCt
MD5:	8E1B4A37FE82711EF6BBEDBAC58B934A
SHA1:	35030AA70B5619BF830DA5F3C20B9FE9A3C1B909
SHA-256:	2C486C8482D9CC7CBBC056B2BABF95278211E6BFDD8D1E0C987558B7BE752EAD
SHA-512:	451BE03F1E987A94706C88791B415A2B2EA4D2EAA1F29E038E38E8D1346051CEEBDA052577C0B1FF7A7D50A49A63AF08572E8521A461C17847602E4DBF9D3B61
Malicious:	false
Preview:	"use strict";..module.exports = require("../lib/private/decimal-adjust")("round");.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\node_modules\type\array-length\coerce.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	224
Entropy (8bit):	4.618053754905369
Encrypted:	false
SSDEEP:	3:jTqaFGKLKXmTA+oIKAFMe3IKzBbfamFYbKy2KXameJmpFQ2XLpgrpt7mFXA2XLxc:ILA2eHzBWyYvD9rQHL7y+2I
MD5:	6102C8A11A82BD4B0DEADB0F1AF601E5
SHA1:	06B0223B4C7B756E48786596415053B70B880321
SHA-256:	1BB5BA046A073A875A841B4AF514282ECCB389BD88A7CA646DF11676F904474A
SHA-512:	1BA2338FC6D79088032FEC2685539F1D887302FEB3887F5744D63E6666F30CA8CE0C6B7FDD2605EBED096FC5C31DB4C052E0EF9EDE5913F1ECF2485CFD0C0298
Malicious:	false
Preview:	"use strict";..var coerceToSafeInteger = require("../safe-integer/coerce");..module.exports = function (value) {..value = coerceToSafeInteger(value);..if (!value) return value;..if (value < 0) return null;..return value;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\node_modules\type\array-length\ensure.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	457
Entropy (8bit):	4.733523909075826
Encrypted:	false
SSDEEP:	6:3sFr6OTyCYRbMeHzBWK4yUkJLkNdUQTo8mvo0YI3KGMVIAAX2+uFjuJWS7cD:mrlTKHzBW5poLOdmoQ3KUojGhcD
MD5:	95428FE0C9B3B3B63C5EBA3C0DC28338
SHA1:	60DD2918DF27E381F1BDC3909125960F2F456AEC
SHA-256:	FD93CA2F5B8B56EB568EA26DF49F523AE380DC1B42B51AB4BDAF6340829C0FC2
SHA-512:	54C50C091E407A56595EFF1B378EC2670EAFDDF3CF2D8FE85206697D952334071AC2AE809EBCD52C807E9B38E4FA71DB75122AC7B8FC37DEE31E3121D1F03F7C
Malicious:	false
Preview:	"use strict";..var resolveException = require("../lib/resolve-exception"). , coerce = require("./coerce");..module.exports = function (value/, options/) {..var coerced = coerce(value);..if (coerced !== null) return coerced;..var options = arguments[1];..var errorMessage =...options && options.name....? "Expected an array length for %n, received %v"....: "%v is not an array length";..return resolveException(value, errorMessage, options);.};.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\node_modules\type\array-like\ensure.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	424
Entropy (8bit):	4.765153646278875
Encrypted:	false
SSDEEP:	6:3sFr6OTyCV//r8zBWKa3UJGUuQH+dUQTo8mvo0YI3KgVIAAXX2puFjuJWS7cD:mrlTV//r8zBWnEJGK+dmoQ39UHrjGhcD
MD5:	4C115CF304AA92DF1531E249065331AA
SHA1:	04062F8440AA5B8533DBDCCB8CD8666A4E108758
SHA-256:	32CA225BB5D3B9E38D31C48260FB7A4F33AAE0FEB7BE3AB99A52A4CEE015C025
SHA-512:	45C192BF523D8C22498D32C99BD6635BD0BFB601881EC5B401F605243F4118340F08149A4B23C8B65F1BC69F3211DF44178340B973438684C5D7BAFCDCBC3BD8
Malicious:	false
Preview:	"use strict";..var resolveException = require("../lib/resolve-exception"). , is = require("./is");..module.exports = function (value/, options/) {..if (is(value, arguments[1])) return value;..var options = arguments[1];..var errorMessage =...options && options.name....? "Expected an array like for %n, received %v"....: "%v is not an array like";..return resolveException(value, errorMessage, options);.};.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\node_modules\type\array-like\is.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	543
Entropy (8bit):	4.852836360477264
Encrypted:	false
SSDEEP:	6:eSuKkrOB+zBWKa3coaFdUQx+AtR7xMiEtVYc3kqFVmYdcsda73yRAsgxy5J4:eBKqOB+zBWnsPFdZ5MiEtlFYYOOgxy5W
MD5:	1C3655138CA6017249987DA587640E95
SHA1:	2E6592B1FF888C7878C60A6616C485FAA224B1A7
SHA-256:	0948A79E8F14C1392031D788089359985482259D3563D7E0EBCB38EF18686061
SHA-512:	5B8A472885EB1ECAB91A5325619DF2E6726450909CC88E81C61DFB7374BBE0A2A6061CE87EF7243FA6051D6056A10019A6FE8778B54669AE90A0D79C6755EEBF
Malicious:	false
Preview:	"use strict";..var coerceToArrayLength = require("../array-length/coerce"). , isObject = require("../object/is");..module.exports = function (value/, options/) {..if (!isObject(value)) {...var options = arguments[1];...if (isObject(options) && options.allowString && typeof value === "string") return true;...return false;..}...if (typeof value === "function") return false;...var length;..try { length = value.length; }..catch (error) { return false; }...if (coerceToArrayLength(length) === null) return false;..return true;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\node_modules\type\array\ensure.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1499
Entropy (8bit):	4.975638574724007
Encrypted:	false
SSDEEP:	24:mSrpQGRs7TBWXJz+DWKeNqIDDMQEjgNzT9UlqsW20MWAzqFGI:mCp9RsX8zEWKeN9DhegNzT9UAsW20M/i
MD5:	BCE718A8BDB45A76234C1D51A8469C0C
SHA1:	391FB09DDEA37A3212FBA19FA4ADB009938D21F6
SHA-256:	FF89A33756752455E1DAAF09842EB1A1015F628E0AAD056B2312040F2208258D
SHA-512:	1E83322A4C8F210CEF23115E6167BCCBB0ABCCF809CA51C8806033CA1F4F73351674D721E48C6F364FAFB6CE80C234F10CC25ED7D702DCF59133C79C03F87F10
Malicious:	false
Preview:	"use strict";..var resolveException = require("../lib/resolve-exception"). , resolveErrorMessage = require("../lib/resolve-error-message"). , toShortString = require("../lib/to-short-string"). , ensurePlainFunction = require("../plain-function/ensure"). , is = require("./is");..var objHasOwnProperty = Object.prototype.hasOwnProperty, invalidItemsLimit = 3;..module.exports = function (value /, options/) {..var options = arguments[1];..var mainErrorMessage =...options && options.name ? "Expected an array for %n, received %v" : "%v is not an array";..if (!is(value)) return resolveException(value, mainErrorMessage, options);..if (!options) return value;...var ensureItem = ensurePlainFunction(options.ensureItem, { isOptional: true });..if (ensureItem) {...var coercedValue = [], invalidItems;...for (var index = 0, length = value.length; index < length; ++index) {....if (!objHasOwnProperty.call(value, index)) continue;....var coercedItem;....try {.....coercedIt

C:\Program Files (x86)\????????\resources\app\node_modules\ext\node_modules\type\array\is.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	792
Entropy (8bit):	4.900796075254309
Encrypted:	false
SSDEEP:	12:ZjkvtHkzENpQsDz/KFZy7c+ASiBW/GdfStTW4g23coFrXF07BFqRxbj:ZYB5Ntz/4yY+LiBWq2gMcYa7CRxbj
MD5:	7C7723F4A1AC0E79E1AFEF5CF314B35A
SHA1:	1A08107856D3B4EFE36035028128A2BAB170AFFA
SHA-256:	401DE3FF8036C4D3D319A8C3C9D9A1344D210B99699E0921747A4586AE6954F7
SHA-512:	AB62EF63C32F4627F72BD67C7452963086AF8D0F18B9FB77DEF2BB12621FFC08FD25920E9D36B2BB463C844A2EA015BE4352192DC99753BB22FDABBF42868BA5
Malicious:	false
Preview:	"use strict";..var isPrototype = require("../prototype/is");..var isArray;.if (typeof Array.isArray === "function") {..isArray = Array.isArray;.} else {..var objectToString = Object.prototype.toString, objectTaggedString = objectToString.call([]);..isArray = function (value) { return objectToString.call(value) === objectTaggedString; };.}..module.exports = function (value) {..if (!isArray(value)) return false;...// Sanity check (reject objects which do not expose common Array interface)..if (!hasOwnProperty.call(value, "length")) return false;..try {...if (typeof value.length !== "number") return false;...if (typeof value.push !== "function") return false;...if (typeof value.splice !== "function") return false;..} catch (error) {...return false;..}...return !isPrototype(value);.};.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\node_modules\type\constructor\ensure.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	429
Entropy (8bit):	4.695186925731618
Encrypted:	false
SSDEEP:	12:mrlTV//r8zBWvfdEc+dmoQnE+bo+kjGhcD:maBWX3+RQncKo
MD5:	9AE64D540F9714DDD1240F38172DE121
SHA1:	A0FFE9D2DC36827F3C6041B0DCCE4927AD8ADFCF
SHA-256:	C1E973EAC48A98CCE35EEEE535EED8045B0D10F917F99E08285066E1C3B5A36B
SHA-512:	D8462E059E93871AFEF747E6B7BCC8BA632FD3CC05C458A9D525C34F27874A4B704367901922A11EFE1609EA4CDC451B15B42E64C51F886B6B23A56600A2EFD6
Malicious:	false
Preview:	"use strict";..var resolveException = require("../lib/resolve-exception"). , is = require("./is");..module.exports = function (value /, options/) {..if (is(value)) return value;..var options = arguments[1];..var errorMessage =...options && options.name....? "Expected a constructor function for %n, received %v"....: "%v is not a constructor function";..return resolveException(value, errorMessage, options);.};.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\node_modules\type\constructor\is.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	332
Entropy (8bit):	4.830581834919661
Encrypted:	false
SSDEEP:	6:wsXrX6NQVVtlUcEbKXKHqLsz7BWyQ3bDgSpnzie84:brX6yrtlUcEbKXVsPBW/bpnz9
MD5:	C9C5F8AF6D48CD71D40AC6087F8FFB35
SHA1:	AAA9388B9BCC4F74F1D94546FF184C2DA0A634F8
SHA-256:	BE82F349891892D9A35C1BD7584FD7BAAAD3931D33F3521E88F68B87634148F0
SHA-512:	46CDAC477C7A15BA82348873165F6235C11DEDD4659AA4A66358729B3822DCC4255D031D5729B6DEA7D18B82121A7394F9194B9259959B43FFE8989EE58D89D2
Malicious:	false
Preview:	"use strict";..var isFunction = require("../function/is");..var constructorRe = /^\s*(?:class[\s{/}]\|function[\s(])/. , functionToString = Function.prototype.toString;..module.exports = function (value) {..if (!isFunction(value)) return false;..if (!constructorRe.test(functionToString.call(value))) return false;..return true;.};.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\node_modules\type\date\ensure.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	390
Entropy (8bit):	4.698676971764435
Encrypted:	false
SSDEEP:	6:3sFr6OTyCV//r8zBWKa3UgH+dUQTo8mvo0YAuCdXMVsEupuFjuJWS7cD:mrlTV//r8zBWnEc+dmosyluOjGhcD
MD5:	DC7D0F77C2498B22D199B8B93EF4DF2A
SHA1:	BA99D1879B9574DFA7A711439D2B551300C8A97B
SHA-256:	E8185DD7B6FFEE50BB3BFC23F810D0C8409AF10A47359FD54C8971D39864729D
SHA-512:	A211DAF7DC4914C89421758FB2D413F42A3B73EFB0C2302BCD8D3CCEC6CFCEC882434857BE20104622350A7BE0C255E7B2B27C8D562D724AC1E596B99BC45ADA
Malicious:	false
Preview:	"use strict";..var resolveException = require("../lib/resolve-exception"). , is = require("./is");..module.exports = function (value/, options/) {..if (is(value)) return value;..var options = arguments[1];..var errorMessage =...options && options.name ? "Expected a date for %n, received %v" : "%v is not a date";..return resolveException(value, errorMessage, options);.};.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\node_modules\type\date\is.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	666
Entropy (8bit):	4.853244254016614
Encrypted:	false
SSDEEP:	12:ZqNJBaOBW/v4dfSwrFqBFoyaBF+rRuTQQU+Mmi5Xbbj:Zq7BNBWoUe2rRbP+ri5rbj
MD5:	6D2301348921E16930C10E86EF3AE82A
SHA1:	E6B0890DF6570CA04C379F19643DFCCA9FA48D6C
SHA-256:	0D01760623C2831950E0051F91FBE9C747EA4779BCD7E8E7894A9A27FDB14FAC
SHA-512:	4DD1E1E4D6B1CC740EA088069D1BD67BB8763239913E2B3438A3655684C8986E88B9A4948FC0D242D3BCF7719C99505F575A0D270CE82B2E6BDECD245C9957DF
Malicious:	false
Preview:	"use strict";..var isPrototype = require("../prototype/is");..var dateValueOf = Date.prototype.valueOf;..module.exports = function (value) {..if (!value) return false;...try {...// Sanity check (reject objects which do not expose common Date interface)...if (typeof value.getFullYear !== "function") return false;...if (typeof value.getTimezoneOffset !== "function") return false;...if (typeof value.setFullYear !== "function") return false;....// Ensure its native Date object (has [[DateValue]] slot)...dateValueOf.call(value);..} catch (error) {...return false;..}...// Ensure it hosts valid date..if (isNaN(value)) return false;...return !isPrototype(value);.};.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\node_modules\type\docs\array-length.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	838
Entropy (8bit):	5.00452107724412
Encrypted:	false
SSDEEP:	12:hqFrCwllKUGp+kY7z7dOfYO4eKoPPrltPnkkl6rMr4p0pFPOGtD/f0Y:hqFrCwlvE+kygP4eK4PrXnzkk4OXf/
MD5:	6B5BD687370D7690D5D3836FA9D4C431
SHA1:	F3D2BB2CC73F5B8767EBF203116C811D6877ADA8
SHA-256:	3B3A553EFE3C088EAFDDC419027FC64C030C9200772F1045F5C33762839CFBE1
SHA-512:	20A92BFADDBABE1754DC58A7389CD1B57DB37AD03418078A84A9C9FC54062977E006E9CDBC5DCF9987217891B8A5268399F694B3A18A0CED0386CF524C7369DA
Malicious:	false
Preview:	# Array length.._number_ primitive that conforms as valid _array length_..## `array-length/coerce`..Follows [`safe-integer/coerce`](safe-integer.md#safe-integercoerce) but returns `null` in place of values which are below `0`..```javascript.const coerceToArrayLength = require("type/safe-integer/coerce");..coerceToArrayLength("12.95"); // 12.coerceToArrayLength(9007199254740992); // null.coerceToArrayLength(null); // null.```..## `array-length/ensure`..If given argument is an _array length_ coercible value (via [`array-length/coerce`](#array-lengthcoerce)) returns result number..Otherwise `TypeError` is thrown...```javascript.const ensureArrayLength = require("type/array-length/ensure");..ensureArrayLength(12.93); // "12".ensureArrayLength(9007199254740992); // Thrown TypeError: 9007199254740992 is not a valid array length.```.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\node_modules\type\docs\array-like.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	971
Entropy (8bit):	4.907321989957763
Encrypted:	false
SSDEEP:	24:BTF1WBRZ/92wG736nit4N+mvr2nuuQ92NN+W9fan:XBwq3K0uuyefan
MD5:	06BE7A2781AAFC6C152ECE658FCAA967
SHA1:	B9214675734485C00506AE87D6D719B940B3CC4D
SHA-256:	99B1723538B3B09E49525C5712DB15E8AE411EBBE41A796D82FE4A3AD0E7BAB6
SHA-512:	4C9824A1712317AD801850B9D8586173F29F0132F83F357DD551CAE3313816BD6CC0E581848563FECD283C3E4978D6501D761D255EC063B62635A12DAE46D77D
Malicious:	false
Preview:	# Array Like.._Array-like_ value (any value with `length` property)..## `array-like/is`..Restricted _array-like_ confirmation. Returns true for every value that meets following contraints..- is an _object_ (or with `allowString` option, a _string_).- is not a _function_.- Exposes `length` that meets [`array-length`](array-length.md#array-lengthcoerce) constraints..```javascript.const isArrayLike = require("type/array-like/is");..isArrayLike([]); // true.isArrayLike({}); // false.isArrayLike({ length: 0 }); // true.isArrayLike("foo"); // false.isArrayLike("foo", { allowString: true }); // true.```..## `array-like/ensure`..If given argument is an _array-like_, it is returned back. Otherwise `TypeError` is thrown...```javascript.const ensureArrayLike = require("type/array-like/ensure");..ensureArrayLike({ length: 0 }); // { length: 0 }.ensureArrayLike("foo", { allowString: true }); // "foo".ensureArrayLike({}); // Thrown TypeError: null is not an iterable.```.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\node_modules\type\docs\array.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1099
Entropy (8bit):	4.890783297118613
Encrypted:	false
SSDEEP:	24:iSLGKJElYFJGnkuQjrf0cWpUGPa6jBgYSTjLH9:iSLGNNkuyrf6pUGi6NSr9
MD5:	0056518449A842864D03B1C732E06EF6
SHA1:	34D4E8F676B470089F29A557660EB07965619182
SHA-256:	65114E0685F03B38F91818998D1DCF6693C7D9B7026085EF7FF3F3CE5A563AFE
SHA-512:	8C735214C3C85E0223ABD93814B6540AF86D4B1BD9BF4118A06E52A1B89BDB54EEB83656354D27D9371769494CFEC5080A29FFB7A5F9E3F7A5D719B9D8A69B28
Malicious:	false
Preview:	# Array.._Array_ instance..## `array/is`..Confirms if given object is a native array..```javascript.const isArray = require("type/array/is");..isArray([]); // true.isArray({}); // false.isArray("foo"); // false.```..## `array/ensure`..If given argument is an array, it is returned back. Otherwise `TypeError` is thrown...```javascript.const ensureArray = require("type/array/ensure");..ensureArray(["foo"]); // ["foo"].ensureArray("foo"); // Thrown TypeError: foo is not an array.```..### Confirming on items..Items can be validated by passing `ensureItem` option. Note that in this case:..- A newly created instance of an array with coerced item values is returned.- Error message lists up to three items which are invalid..```javascript.const ensureString = require("type/string/ensure");..ensureArray([12], { ensureItem: ensureString }); // ["12"]../*. Below invocation with crash with:. TypeError: 23, [object Object], [object Object] is not a valid array.. Following items are invalid

C:\Program Files (x86)\????????\resources\app\node_modules\ext\node_modules\type\docs\constructor.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	737
Entropy (8bit):	4.648746212629005
Encrypted:	false
SSDEEP:	12:GUiLGxDMlvJCO+EOFOo2VcGkgNG0IFG7gNG1UFJRfnl9XJuHj0pFPOpNOo2shNGX:GUiLGx+vJGXqNEFNqUFJlnlfuQMhBwfH
MD5:	82A83948147E61ADA7BF2D51BE976F19
SHA1:	F7D1C3920CCD075285B7A0570FB3D43196CC5403
SHA-256:	72B061AD811972D06345CF1F6B005468EE93A4BF102BB795F4C6170DFD3EEEDD
SHA-512:	17B87DFAFC5E03028FCB866A02C61694AD4CFFBA994DA2DE7D69742BF81DA35BFBA0B66B0E595D3D863C50751AFD24772E88D65FAFD2BBF104840088947BD58D
Malicious:	false
Preview:	# Constructor..A _Function_ instance that's a _constructor_ (either regular function or _class_)..## `constructor/is`..Confirms if given object is a constructor function\_..```javascript.const isConstructor = require("type/constructor/is");..isConstructor(function () {}); // true.isConstructor(() => {}); // false.isConstructor(class {}); // true.isConstructor("foo"); // false.```..## `constructor/ensure`..If given argument is a _constructor function_, it is returned back. Otherwise `TypeError` is thrown...```javascript.const ensureConstructor = require("type/constructor/ensure");..const fn = function () {};.ensureConstructor(fn); // fn.ensureConstructor(() => {}); // Thrown TypeError: () => {} is not a constructor function.```.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\node_modules\type\docs\date.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	592
Entropy (8bit):	4.763234982168809
Encrypted:	false
SSDEEP:	12:hTXLGtJCirfOPQmO2o4jZFJznouHj0pFPOamQmiGMhacz/fpsV:hTXLGtJCTWMFJznouQTmTiGMhxjfpsV
MD5:	E29632AADF33001811F8AA782D6302FA
SHA1:	9F4E487D4E1818F9BD68EE9B9BD1991B20D6A49C
SHA-256:	74675C13F8A953FF964F7D7C94E1B5E7767FBFD089246D003638D475FE83235F
SHA-512:	D098E0CB748923A04536C8854FE3D66FACA0AEA2E4A4CD7B6569E27529A29E99A1A38881BA336A8A765145F9FDEC213DD148E133C68176596C5B50D990EDA4EC
Malicious:	false
Preview:	# Date.._Date_ instance..## `date/is`..Confirms if given object is a native date, and is not an _Invalid Date_..```javascript.const isDate = require("type/date/is");..isDate(new Date()); // true.isDate(new Date("Invalid date")); // false.isDate(Date.now()); // false.isDate("foo"); // false.```..## `date/ensure`..If given argument is a date object, it is returned back. Otherwise `TypeError` is thrown...```javascript.const ensureDate = require("type/date/ensure");..const date = new Date();.ensureDate(date); // date.ensureDate(123123); // Thrown TypeError: 123123 is not a date object.```.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\node_modules\type\docs\ensure.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1481
Entropy (8bit):	4.786668641584665
Encrypted:	false
SSDEEP:	24:41IKCUOGeI1Au1GwPdoQVBpTwy6gb2dJwKriJQSdCOSQ6wVZN:yCU91AqV9z6HwK+JQ33Q6wp
MD5:	40D2B4AC223CBC4F4B3E009D4AA03DEB
SHA1:	A866D64F086888D7A03A3BC8E0AC4A2EFCF14861
SHA-256:	D209A34BCE5007C7B0B612176FE63AE65EEBBE25720A1F8E2D6F1BCD41F2AE8D
SHA-512:	14CD3A936CCAB6430522A1C244AF547D488E77D660940D28C58ECC2574573F7E87A4EF9B8C7F54D51D0CC195EE3FD4BC2B514AC1C16891FD57BC0F4A66AEECF8
Malicious:	false
Preview:	# `ensure(validationDatum1[, ...validationDatumN[, options]])`..Provides a complete cumulated input validation for an API endpoint. Validates multiple input arguments and consolidates eventual errors into one...## Arguments..### `validationDatum1[, ...validationDatumN]`..For each argument to be validated a `validationDatum` of following stucture should be defined:..```javascript.[argumentName, inputValue, ensureFunction, (options = {})];.```..- `argumentName` - Name of validated argument (used for meaningful error messaging).- `inputValue` - An argument value as passed to function.- `ensureFunction` - An `ensureX` function with which argument should be validated (e.g. if we're after string, then we need [string/ensure](string.md#stringensure)).- `options` - Optional, extra options to be passed to `ensureX` function..### `[options]`..Eventual options be passed to underlying `ensureX` functions. If custom error constructor is passed with an `Error` option, then cumulated error is created

C:\Program Files (x86)\????????\resources\app\node_modules\ext\node_modules\type\docs\error.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	591
Entropy (8bit):	4.587709209812719
Encrypted:	false
SSDEEP:	12:UBELG3JCiArOM7pkopFJLnsuHj0pFPOy6JvW/fMpV:UyLG3JKt3FJLnsuQZ6MfMpV
MD5:	4473A1EA18438D8FDC6AC2920EFE48EC
SHA1:	B0BFEF9ADC48F200CA4000B4E24A7C829A11BA28
SHA-256:	D26AC536E5D6D1572175962C4E67237A4656A4B3BD1F1724E7BCDF4DC2997EBE
SHA-512:	A69E430E10DE5A1DF11E151A9E7C07B737011DD8A7B8726E17817CD77B020944C5EC6BB66E0D5699D88CC69B104D7CA920B013CED4D039279BAC92B08E7F0410
Malicious:	false
Preview:	# Error.._Error_ instance..## `error/is`..Confirms if given object is a native error object..```javascript.const isError = require("type/error/is");..isError(new Error()); // true.isError({ message: "Fake error" }); // false.```..## `error/ensure`..If given argument is an error object, it is returned back. Otherwise `TypeError` is thrown...```javascript.const ensureError = require("type/error/ensure");..const someError = new Error("Some error");.ensureError(someError); // someError.ensureError({ message: "Fake error" }); // Thrown TypeError: [object Object] is not an error object.```.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\node_modules\type\docs\finite.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	726
Entropy (8bit):	4.734249705847977
Encrypted:	false
SSDEEP:	12:VxFgFrOHBBzmuDaJfTbA+TaQO3bKGq2BtLvkGD6nHSKCHf4p0pFPOSRgbKfRojdA:VxFgFrCPzZR+io2fkGmnjC/4ONggojTm
MD5:	977AEEEF690C48C5E3955A892E627732
SHA1:	94497471DE265CF9346C3F681D3FE9B3FDB67695
SHA-256:	E67C6896E47AE04757BC880910E3E1276850A87FED6B4A087CF45B21C34F8ACE
SHA-512:	370864BF2330F1DF13501F78F622CEC84924E23DE237475D236516730726EE8053C31FB2B45D969B686977FE2918533DEC96D783EA69FD75EAF0C3ED46375939
Malicious:	false
Preview:	# Finite Number..Finite _number_ primitive..## `finite/coerce`..Follows [`number/coerce`](number.md#numbercoerce) additionally rejecting `Infinity` and `-Infinity` values (`null` is returned if given values coerces to them)..```javascript.const coerceToFinite = require("type/finite/coerce");..coerceToFinite("12"); // 12.coerceToFinite(Infinity); // null.coerceToFinite(null); // null.```..## `finite/ensure`..If given argument is a finite number coercible value (via [`finite/coerce`](#finitecoerce)) returns result number..Otherwise `TypeError` is thrown...```javascript.const ensureFinite = require("type/finite/ensure");..ensureFinite(12); // "12".ensureFinite(null); // Thrown TypeError: null is not a finite number.```.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\node_modules\type\docs\function.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	603
Entropy (8bit):	4.666463644521599
Encrypted:	false
SSDEEP:	12:1hUiLG8UjJCiMMOWvWwILX2FJDU0nkuHj0pFPOHg//fvn:DUiLGdJ5HFJDnkuQnfP
MD5:	BCF09E60A80C443CB8A063D9B833EBB0
SHA1:	326DF79D39C4D76F407A5091673AB1A4930D0A9D
SHA-256:	BAD17DF2621E07903CB91B4A764F905B44F2E25C82D232B7A9545424CF47E7A8
SHA-512:	0F2ECEAC7522BDA6AD550B37D5964DCC37AFCBFD96474B2B07C17494F065050EA919B2C9A420E088A256C43071FB491EDBB282F92D71DDEFCCC841A26CC1632C
Malicious:	false
Preview:	# Function.._Function_ instance..## `function/is`..Confirms if given object is a native function..```javascript.const isFunction = require("type/function/is");..isFunction(function () {}); // true.isFunction(() => {}); // true.isFunction(class {}); // true.isFunction("foo"); // false.```..## `function/ensure`..If given argument is a function object, it is returned back. Otherwise `TypeError` is thrown...```javascript.const ensureFunction = require("type/function/ensure");..const fn = function () {};.ensureFunction(fn); // fn.ensureFunction(/foo/); // Thrown TypeError: /foo/ is not a function.```.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\node_modules\type\docs\integer.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	679
Entropy (8bit):	4.740784547100967
Encrypted:	false
SSDEEP:	12:y1zx4QFzmqONpzJLQKv+nSsfy4p0pFPOMQt/f3KF:eljzuzWnn/y4Ok5f3k
MD5:	48FD17F9C925311B3CD0099C10E1E7BC
SHA1:	FCC31223D6BA225C11744743448A71C256C48796
SHA-256:	79537C5D0B9938D8F2CFA237BBDDDB620A635F6A40444C7626F278E6FE8289AA
SHA-512:	5C5F6AEA1F4713DB3148395F38FEBE80DE6C3AA21E5F1133E44058C083713EDA424E728FE7145BCC4E71FE0ED8EDCBE5F4C96CDD4426ABEB27FE64421D5A954D
Malicious:	false
Preview:	# Integer Number..Integer _number_ primitive..## `integer/coerce`..Follows [`finite/coerce`](finite.md#finitecoerce) additionally stripping decimal part from the number..```javascript.const coerceToInteger = require("type/integer/coerce");..coerceToInteger("12.95"); // 12.coerceToInteger(Infinity); // null.coerceToInteger(null); // null.```..## `integer/ensure`..If given argument is an integer coercible value (via [`integer/coerce`](#integercoerce)) returns result number..Otherwise `TypeError` is thrown...```javascript.const ensureInteger = require("type/integer/ensure");..ensureInteger(12.93); // "12".ensureInteger(null); // Thrown TypeError: null is not an integer.```.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\node_modules\type\docs\iterable.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1759
Entropy (8bit):	4.865184537507344
Encrypted:	false
SSDEEP:	48:aJkZnZJqXGX+KDXhL+6uOLEufAS3cf9SrpUGvEBCByQg9:aJAzL+VuiU2aK
MD5:	76155B37C3161A53C23230FD012682D9
SHA1:	F8EE53A06FC403FEC7C18B1350822644329D272C
SHA-256:	E70E46460D8A0419AD3656A9E29B91F153BB723768EAEA28118AFA0CD2E332FF
SHA-512:	AAF07D6FD2CD2EDBB24D245886BD04DB251417CC02E1948B189DF5E95DFC5AE3E0A747F8E39C768F352AFCC2D13180F1558F1ED14CA62C51BE6C3EB9B752D36B
Malicious:	false
Preview:	# Iterable..Value which implements _iterable_ protocol..## `iterable/is`..Confirms if given object is an _iterable_ and is not a _string_ (unless `allowString` option is passed)..```javascript.const isIterable = require("type/iterable/is");..isIterable([]); // true.isIterable({}); // false.isIterable("foo"); // false.isIterable("foo", { allowString: true }); // true.```..Supports also `denyEmpty` option..```javascript.isIterable([], { denyEmpty: true }); // false.isIterable(["foo"], { denyEmpty: true }); // true.```..## `iterable/ensure`..If given argument is an _iterable_, it is returned back. Otherwise `TypeError` is thrown..By default _string_ primitives are rejected unless `allowString` option is passed...```javascript.const ensureIterable = require("type/iterable/ensure");..ensureIterable([]); // [].ensureIterable("foo", { allowString: true }); // "foo".ensureIterable({}); // Thrown TypeError: null is not expected iterable.```..### Denying empty iterables..Pass `denyEmpty` option

C:\Program Files (x86)\????????\resources\app\node_modules\ext\node_modules\type\docs\map.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	490
Entropy (8bit):	4.836280811267171
Encrypted:	false
SSDEEP:	12:gULGYgJCintO4ZxquHDFJ/TnKsuHj0pFPOd4VHU/fb:zLGPJtTjFJ/TnduQBV8fb
MD5:	62639EA822E8F0CC4A5EDD81544736FF
SHA1:	CF6391B7417BE7856A635445CCF57DEA050E5F2B
SHA-256:	1A9B94BE9434E385CA630483CB9810BEE8427356EE60266EC4B1B675AF5E9A1B
SHA-512:	7B74AE929BC33EF5D8B5703DA5E19B3381907ECFC863DDE767A3D25D007B59E5BEEB2161F3320FB5DE16A895BFFB5AB0D46B5ECB27BDCE0C6869D5D272A353F1
Malicious:	false
Preview:	# Map.._Map_ instance..## `map/is`..Confirms if given object is a native _map_..```javascript.const isMap = require("type/map/is");..isMap(new Map()); // true.isMap(new Set()); // false.isMap({}); // false.```..## `map/ensure`..If given argument is a _map_, it is returned back. Otherwise `TypeError` is thrown...```javascript.const ensureMap = require("type/map/ensure");..const map = new Map();.ensureMap(map); // map.eensureMap({}); // Thrown TypeError: [object Object] is not a map.```.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\node_modules\type\docs\natural-number.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	762
Entropy (8bit):	4.78312598421088
Encrypted:	false
SSDEEP:	12:/l8UOLRGdXGUT50kka6HGdOf8LHzqLdXWn/Vapn3SS4p0pFPOhcD6/fHW:KTR/W50kktGFHmYn/Kl4OjafHW
MD5:	4CB1B016399FC426E836756C4EBBE5D3
SHA1:	D4DF3FFEE65F53720A401E015AC01712F21EBF97
SHA-256:	EF2847C3C593D3FB6A263A2B0B0F3047F4B4543E0236DD452CF3664BCB5E1143
SHA-512:	7E8F80511FBC125423B3B90131F388F113C01947A27CB6B020E7F738A4DD3F959272BDDDDA1B8D2EB3142BE688CC8A488C5FA0550D48624F5BAF8B8AA704B826
Malicious:	false
Preview:	# Natural Number..Natural _number_ primitive..## `natural-number/coerce`..Follows [`integer/coerce`](integer.md#integercoerce) but returns `null` for values below `0`..```javascript.const coerceToNaturalNumber = require("type/natural-number/coerce");..coerceToNaturalNumber("12.95"); // 12.coerceToNaturalNumber(-120); // null.coerceToNaturalNumber(null); // null.```..## `natural-number/ensure`..If given argument is a natural number coercible value (via [`natural-number/coerce`](#natural-numbercoerce)) returns result number..Otherwise `TypeError` is thrown...```javascript.const ensureNaturalNumber = require("type/natural-number/ensure");..ensureNaturalNumber(12.93); // "12".ensureNaturalNumber(-230); // Thrown TypeError: null is not a natural number.```.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\node_modules\type\docs\number.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	792
Entropy (8bit):	4.722660607332186
Encrypted:	false
SSDEEP:	12:WrGKKKllqJVZ+s8Fcwtqb+RzUm6OSAZNA/AKwiAvLAnsaJj6AB4p0pFPOGw/fd:WrVTlGZ+sWtSYFL8Ixvkndj6S4Ovgfd
MD5:	FDFF4A6B7CD38A1B5456488A778DC302
SHA1:	C9194E062D98C27F123C88419C1BCB2E144FD2D5
SHA-256:	3F5E9DB1FDF996898C9648D13B334F8831F42535A25424F5F569076F7AFE5471
SHA-512:	A46827CD286C5D31C83D07FCCF12967253214953E100BECBDF13631B69CF59D88B5B8ACF4F49261438957AE11E25BBA343E8CE197C484F27293F6724E814E1A3
Malicious:	false
Preview:	# Number.._number_ primitive..## `number/coerce`..Restricted number coercion. Returns number presentation for every value that follows below constraints..- is implicitly coercible to number.- is neither `null` nor `undefined`.- is not `NaN` and doesn't coerce to `NaN`..For all other values `null` is returned..```javascript.const coerceToNumber = require("type/number/coerce");..coerceToNumber("12"); // 12.coerceToNumber({}); // null.coerceToNumber(null); // null.```..## `number/ensure`..If given argument is a number coercible value (via [`number/coerce`](#numbercoerce)) returns result number..Otherwise `TypeError` is thrown...```javascript.const ensureNumber = require("type/number/ensure");..ensureNumber(12); // "12".ensureNumber(null); // Thrown TypeError: null is not a number.```.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\node_modules\type\docs\object.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	520
Entropy (8bit):	4.817760416540868
Encrypted:	false
SSDEEP:	12:ToJ71Jc3O+EuR4s7FJSnlAuHj0pFPOlCEQPF4HwfWf/fDV:ToJ71J2FJSniuQaUF4HbfDV
MD5:	98EA9A3A6E9307111540D516B54CDA9D
SHA1:	0906727CDEB167934BE57477821C7E42731FA2D0
SHA-256:	17D7CBD4E7B18DC1B08EB9E6AF5FA19411D07FA3AFAD82670CCCDB40E9314AFC
SHA-512:	FD60210AA21976C9768CA6E316A2597DD4D2654FA0F36B09D7464E9DC44793207B02D033EBD2E15FD1526385E43A0FABD8EAC5F1473FDBEB0EA61F554627A597
Malicious:	false
Preview:	# Object.._Object_, any non-primitive value..## `object/is`..Confirms if passed value is an object..```javascript.const isObject = require("type/object/is");..isObject({}); // true.isObject(true); // false.isObject(null); // false.```..## `object/ensure`..If given argument is an object, it is returned back. Otherwise `TypeError` is thrown...```javascript.const ensureObject = require("type/object/ensure");..const obj = {};..ensureObject(obj); // obj.ensureString(null); // Thrown TypeError: null is not an object.```.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\node_modules\type\docs\plain-function.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	710
Entropy (8bit):	4.749317716906
Encrypted:	false
SSDEEP:	12:gUq9UiLGTJ/5JC1tOyQ7vMCILdFJKnipuHj0pFPOPE/ffn:gr9UiLGF/5J+T2kFJKn6uQzff
MD5:	BD09ABC6918B511F53241F67E7F6C287
SHA1:	44C7390541A468A771DDC7FD713C00CCDE6DA877
SHA-256:	A695FB765239D144114E9CFAFC5C1A681CF335125C843B26587F31C05506D4DB
SHA-512:	901D523800630004628D3E912E281F0BABCD662A3833E38817780D70A38FBF0B16F5F851F057D04E1DEF6AB55B839FFB9B3D57C1204E2759B914F27BFFEEB16B
Malicious:	false
Preview:	# Plain Function..A _Function_ instance that is not a _Class_..## `plain-function/is`..Confirms if given object is a _plain function_..```javascript.const isPlainFunction = require("type/plain-function/is");..isPlainFunction(function () {}); // true.isPlainFunction(() => {}); // true.isPlainFunction(class {}); // false.isPlainFunction("foo"); // false.```..## `plain-function/ensure`..If given argument is a _plain function_ object, it is returned back. Otherwise `TypeError` is thrown...```javascript.const ensurePlainFunction = require("type/function/ensure");..const fn = function () {};.ensurePlainFunction(fn); // fn.ensurePlainFunction(class {}); // Thrown TypeError: class is not a plain function.```.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\node_modules\type\docs\plain-object.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1916
Entropy (8bit):	4.943008396193509
Encrypted:	false
SSDEEP:	24:hOR1J5JFJfnauQvWf+tQWOStfq7MNpQM8qvqlWwUGPMo5kLcm1GMkcmH9:cZauUWf+JOHaDwUGUoMUx9
MD5:	08A3EBBD6DFBC280AF8A440B4EE0F250
SHA1:	3C8ADB67C6FDA4FAB98103BD0621B4175A8C2EB1
SHA-256:	F75DA475FBE2D72B0D03C7D108A2DC8DFCD6B51DCBCFBAA09F12A77586C39247
SHA-512:	EFF43C038EC1A02E9C1533B4B6080D6125A2A1E23B386B18ED9809B45956F132A9EAA600D38C56B298CE0E07127768833540D86291ABB36EBC75AE4B094D014D
Malicious:	false
Preview:	# Plain Object..A _plain object_..- Inherits directly from `Object.prototype` or `null`.- Is not a constructor's `prototype` property..## `plain-object/is`..Confirms if given object is a _plain object_..```javascript.const isPlainObject = require("type/plain-object/is");..isPlainObject({}); // true.isPlainObject(Object.create(null)); // true.isPlainObject([]); // false.```..## `plain-object/ensure`..If given argument is a plain object it is returned back. Otherwise `TypeError` is thrown...```javascript.const ensurePlainObject = require("type/plain-object/ensure");..ensurePlainObject({}); // {}.ensurePlainObject("foo"); // Thrown TypeError: foo is not a plain object.```..### Confirming on keys..Keys can be validated by passing `allowedKeys` option. Note that in this case:..- Error message lists up to three invalid keys..```javascript.const allowedKeys = ["foo"];..ensurePlainObject({}, { allowedKeys }); // {}.ensurePlainObject({ foo: "bar" }, { allowedKeys }); // { foo: 'bar' }../*. Belo

C:\Program Files (x86)\????????\resources\app\node_modules\ext\node_modules\type\docs\promise.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	589
Entropy (8bit):	4.725184523509741
Encrypted:	false
SSDEEP:	12:QX5mLGszzJCiXkVOgTvoUald98DFJ9zknFSJuHj0pFPO8K+SYKCPKYU/fo:HLGqJ0LQAFJanFwuQt8fo
MD5:	5005C91F981D0022ABD0A2E4F9C32C14
SHA1:	A5DFAE5C91851F52989F6E5D98E6F1E973E37523
SHA-256:	6970400A4968B523C5D17E227D8D932388A9D63959EB9FC96D8788DC62DE1B9C
SHA-512:	CFC9FDD22A12914460959B9C088B350B94E3BD78872407A7A3F31779C84B45F4C990B580D77EC7AED37896A26A66EC4EE99C3729C881FA487C10FA4BB2E84AAB
Malicious:	false
Preview:	# Promise.._Promise_ instance..## `promise/is`..Confirms if given object is a native _promise_..```javascript.const isPromise = require("type/promise/is");..isPromise(Promise.resolve()); // true.isPromise({ then: () => {} }); // false.isPromise({}); // false.```..## `promise/ensure`..If given argument is a promise, it is returned back. Otherwise `TypeError` is thrown...```javascript.const ensurePromise = require("type/promise/ensure");..const promise = Promise.resolve();.ensurePromise(promise); // promise.eensurePromise({}); // Thrown TypeError: [object Object] is not a promise.```.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\node_modules\type\docs\prototype.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	304
Entropy (8bit):	4.493354642116462
Encrypted:	false
SSDEEP:	6:Sr/GdocqFAVXsqU3JCwH/Ncq/kTEOmFYhcq8jNeHbrNqbKHqjtNkXUosqjNV:5oGqJCuPOFyYHYeaxsNV
MD5:	903CAA875105DE0B5CA847776912FB41
SHA1:	3365794DE082A2BC2A8D7CC48836346A25809815
SHA-256:	1680EF01F0A3E4664542C390F192C7D132FB3A5E2227BBC8FF7384F17D8BDE18
SHA-512:	E65A57B6E9DBE358A539BF37DDCA4E0F1280A771890AD3F583182943A6C309A2E7464D7618E58C6DC10D676E765840856C4D099E5F136E053C86C0C7C49EB8BD
Malicious:	false
Preview:	# Prototype..Some constructor's `prototype` property..## `prototype/is`..Confirms if given object serves as a _prototype_ property..```javascript.const isPrototype = require("type/prototype/is");..isPrototype({}); // false.isPrototype(Object.prototype); // true.isPrototype(Array.prototype); // true.```.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\node_modules\type\docs\reg-exp.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	551
Entropy (8bit):	4.837422114074776
Encrypted:	false
SSDEEP:	12:RxqiLGo9HgJCiQYpIOaxsVp4oUFJX9LzPnYpTuHj0pFPO09zIq2Dp/fwpGV:XqiLGouJQTqp8FJX9TnWuQx9EjBf3V
MD5:	AD8577FCB7BDFA0473522F54BB52DD89
SHA1:	866398240BE6493E230F965347510826C6F9D42E
SHA-256:	F75FBCFA9B0AA9285243F547EDC5D165293616A481FF6B4B4191B17C00797B29
SHA-512:	269910058346CCAA57E7318567F3932BFF6432C9765E099B8ECF0A39A1A00CB91445FFB556D65BE66E7CCC4DE12C948AA3EF787EB997D78958E3F5459EDF3839
Malicious:	false
Preview:	# RegExp.._RegExp_ instance..## `reg-exp/is`..Confirms if given object is a native regular expression object..```javascript.const isRegExp = require("type/reg-exp/is");..isRegExp(/foo/);.isRegExp({}); // false.isRegExp("foo"); // false.```..## `reg-exp/ensure`..If given argument is a regular expression object, it is returned back. Otherwise `TypeError` is thrown...```javascript.const ensureRegExp = require("type/reg-exp/ensure");..ensureRegExp(/foo/); // /foo/.ensureRegExp("foo"); // Thrown TypeError: null is not a regular expression object.```.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\node_modules\type\docs\safe-integer.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	832
Entropy (8bit):	5.028364590710152
Encrypted:	false
SSDEEP:	12:8iagVUT50kY7zhDnChtMPVOQpgQDc+nBssUi4p0pFPO5E8YEvZEZ/f5F:OgVW50kyhObStDZnoi4OTyv6tfb
MD5:	2159653D3942F498AC55316841A592C1
SHA1:	41873C641DBF7A4999916EBF4F6BB96290CD3DF4
SHA-256:	B19FA4C05B27323301EC9C3609469D53B0C3CD61567899E39B31A14E6CC61BC9
SHA-512:	F197B994873391F05C9EE40BA7B9D7A1C5AA46CD6C2BDC685EA02523004CD9228B3CBE0D2EE7BF0C2100A4ADD44A0DA7715C3C78F330BA5BCC73E959C8D61B86
Malicious:	false
Preview:	# Safe Integer Number..Safe integer _number_ primitive..## `safe-integer/coerce`..Follows [`integer/coerce`](integer.md#integercoerce) but returns `null` in place of values which are beyond `Number.MIN_SAFE_INTEGER` and `Number.MAX_SAFE_INTEGER` range...```javascript.const coerceToSafeInteger = require("type/safe-integer/coerce");..coerceToInteger("12.95"); // 12.coerceToInteger(9007199254740992); // null.coerceToInteger(null); // null.```..## `safe-integer/ensure`..If given argument is a safe integer coercible value (via [`safe-integer/coerce`](#safe-integercoerce)) returns result number..Otherwise `TypeError` is thrown...```javascript.const ensureSafeInteger = require("type/safe-integer/ensure");..ensureSafeInteger(12.93); // "12".ensureSafeInteger(9007199254740992); // Thrown TypeError: null is not a safe integer.```.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\node_modules\type\docs\set.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	490
Entropy (8bit):	4.70244139537736
Encrypted:	false
SSDEEP:	12:WDELGuu1JCiiOiP9YwaUBDFJnhi+ndv9uHj0pFPO5AkGYAWAXAQBU/fBv:WDELGRJcXFJhndv9uQrMfBv
MD5:	D29F5382E8313BD7F58ACBA85E680479
SHA1:	A68D77C9D4382EF0A27C0C860655088C248FDD76
SHA-256:	33FB89A0336F660AA9DEB049F622981AD55BF291F9F9AC77CDC261DE2BC655B2
SHA-512:	A4FB8735FE7FCB2AA5AB87C07F4C7187965F966FD61A7C07D20CF61513DD89C55BA51DB559DC12808909EB16AD5FC44B728874070B3FC03679480D62E5D90063
Malicious:	false
Preview:	# Set.._Set_ instance..## `set/is`..Confirms if given object is a native set\_..```javascript.const isSet = require("type/set/is");..isSet(new Set()); // true.isSet(new Set()); // false.isSet({}); // false.```..## `Set/ensure`..If given argument is a _set_, it is returned back. Otherwise `TypeError` is thrown...```javascript.const ensureSet = require("type/set/ensure");..const set = new Set();.ensureSet(set); // set.eensureSet({}); // Thrown TypeError: [object Object] is not a set.```.

C:\Program Files (x86)\????????\resources\app\node_modules\ext\node_modules\type\docs\string.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	784
Entropy (8bit):	4.694883857574967
Encrypted:	false
SSDEEP:	12:ds9lNM1qlqJVZ+s8FcwtEj0zqdQskm6OmaNGKc8ncE+qp4FRR0pFPO5yeWpWf/ft:dUlNhGZ+sWtm0EeNKc8nV+qp4rmFSft
MD5:	BB8C70A94740C180769CB811CFEF1DAE
SHA1:	248AB41FEA33177D41E2EB94BBE458CF734C8484
SHA-256:	89C2D36B0BA616D04153CED00337897F9526DFE822FA6CE01F3C912DC1D6EA14
SHA-512:	FD948C05C8925FAF3B3F1A4FB89E519DF66F5A8C80E3FEFCA06DB0E6D2BA4E64EBF0940ADF53EF638D979900DD0B2CC39425C26D65E53037DE3375AE8838365D
Malicious:	false
Preview:	# String.._string_ primitive..## `string/coerce`..Restricted string coercion. Returns string presentation for every value that follows below constraints..- is implicitly coercible to string.- is neither`null` nor `undefined`.- its `toString` method is not `Object.prototype.toString`..For all other values `null` is returned..```javascript.const coerceToString = require("type/string/coerce");..coerceToString(12); // "12".coerceToString(undefined); // null.```..## `string/ensure`..If given argument is a string coercible value (via [`string/coerce`](#stringcoerce)) returns result string..Otherwise `TypeError` is thrown...```javascript.const ensureString = require("type/string/ensure");..ensureString(12); // "12".ensureString(null); // Thrown TypeError: null is not a string.```.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\LICENSE

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1213
Entropy (8bit):	5.197754041521806
Encrypted:	false
SSDEEP:	24:xGrNdrBrmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:x6/BaJ8YHvEH5QHOs5exm3oEFJ
MD5:	BDCE592098BCDCBF89E9A179D5580F81
SHA1:	3470C8F5F1A00A0EE4B9EC241E269D75BA7F335A
SHA-256:	AC3D00F58256132BA72425AF07E6A7F952E464AD6E5043378504549C040C7A01
SHA-512:	83CCB49DCB5971491EDAFB682F9EC152EFCD1052712B0A01B0159AAEC936EBF91FF158AA661F51106FF30773E68E9E0D74285CA76346B05F94DF8FDF83803990
Malicious:	false
Preview:	Copyright (c) 2009-2011 Richard "Rick" W. Branson.Copyright (c) 2012-2014 Nathan Rajlich, Richard "Rick" W. Branson.Copyright (c) 2015 Nathan Rajlich, Richard "Rick" W. Branson, Gabor Mezo..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOL

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\LICENSE

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1132
Entropy (8bit):	5.126128868977439
Encrypted:	false
SSDEEP:	24:CXiJHTHuyPP3GtIHw1Gg9WPH+sUW8Ok4odZo3U/qldFD:AiJTfPvGt7ICWPH+sfINi3OMFD
MD5:	492385FE22195952F5B9B197868BA268
SHA1:	6EAD3A7AA9B1DAAB14E473E5B0A18383EEB9FAEE
SHA-256:	DEAF3A42EFFB551A5B140FA9AFEFED183A27F1341C6D1BF430D106A5E6931FC0
SHA-512:	65704BD0016289FDE98E57BD58F8B2754BE834111CB8F9E98C0A02D304C550BA98195812D00BA58698CA8E289C1EB2CEF47C65FE444808E3B662DFE73E748BD7
Malicious:	false
Preview:	libffi - Copyright (c) 1996-2019 Anthony Green, Red Hat, Inc and others..See source files for details...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.``Software''), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\LICENSE-BUILDTOOLS

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	18698
Entropy (8bit):	4.665003165009676
Encrypted:	false
SSDEEP:	384:SywzNhUwi5rpL676yV12rPd34ZomzM2FR+dWF7jUI:SnNmFWixMFzMdm7jUI
MD5:	631BC8750A749106CF625001C1D6EFB0
SHA1:	EDBA73156489A814C9EC38F23FA6AEA64EFEBCBF
SHA-256:	E67978CD18816C0CB7D29AAAACDE7B7447402C2FB321A051698890A8EAEDDA94
SHA-512:	3508BB032E50FBED116AA6F9EB2BE5D1EE7BF57955B20E94C4B6D8479B71FCD84418CBBF19761BABE9A97027D0246A900EA3A093E2B3CEA896B405BF49BD4309
Malicious:	false
Preview:	The libffi source distribution contains certain code that is not part.of libffi, and is only used as tooling to assist with the building and.testing of libffi. This includes the msvcc.sh script used to wrap the.Microsoft compiler with GNU compatible command-line options,.make_sunver.pl, and the libffi test code distributed in the.testsuite/libffi.bhaible directory. This code is distributed with.libffi for the purpose of convenience only, and libffi is in no way.derived from this code...msvcc.sh an testsuite/libffi.bhaible are both distributed under the.terms of the GNU GPL version 2, as below..... GNU GENERAL PUBLIC LICENSE. Version 2, June 1991.. Copyright (C) 1989, 1991 Free Software Foundation, Inc.,. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. Everyone is permitted to copy and distribute verbatim copies. of this license document, but changing it is not allowed... Preamble.. The licenses for most

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\Makefile.am

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5976
Entropy (8bit):	5.404526416414877
Encrypted:	false
SSDEEP:	96:CYHG6Mp/Ly5lMx1fMEWkjBDP2kskrErn4xRyWQThDaIUuAWcBSer/vj+:NmboWx5MEWkjB6kskIr4xRyWQd1cBSeG
MD5:	6DD421846A7AF9CDBC9FC3FB11480C21
SHA1:	3D3472430CB550D89B55816EB0C29F7C0E4C1F66
SHA-256:	B53B6E365F37EE33E869456DF12FE45A57D8E6EF799121F837F9FEC03AFAABF4
SHA-512:	E7CF0BE688E4610A08738CB883A0D0960CC7B582567F6A9FA6FEB221677459DEA57FA3B1F2DCED25535AF008AD4CD006004B3841FF68F4DE0EC296EB5168D32A
Malicious:	false
Preview:	## Process this with automake to create Makefile.in..AUTOMAKE_OPTIONS = foreign subdir-objects..ACLOCAL_AMFLAGS = -I m4..SUBDIRS = include testsuite man.if BUILD_DOCS.## This hack is needed because it doesn't seem possible to make a.## conditional info_TEXINFOS in Automake. At least Automake 1.14.## either gives errors -- if this attempted in the most.## straightforward way -- or simply unconditionally tries to build the.## info file..SUBDIRS += doc.endif..EXTRA_DIST = LICENSE ChangeLog.old.....\..m4/libtool.m4 m4/lt~obsolete.m4.....\.. m4/ltoptions.m4 m4/ltsugar.m4 m4/ltversion.m4...\.. m4/ltversion.m4 src/debug.c msvcc.sh....\..generate-darwin-source-and-headers.py....\..libffi.xcodeproj/project.pbxproj....\..libtool-ldflags libtool-version configure.host README.md \..libffi.map.in LICENSE-BUILDTOOLS msvc_build make_sunver.pl...# local.exp is generated by configure.DISTCLEANFILES = local.exp..# Subdir rules rely on $(FLAGS_TO_PASS).FLAGS_TO_PASS = $(AM_MAKEFLAGS)..MAKEOVERRID

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\Makefile.in

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	80306
Entropy (8bit):	5.587072192732303
Encrypted:	false
SSDEEP:	1536:cApD5SKW8sDrB8GWs1ylvCri8GigGNWA0fnfJ0qy0QTESvaX5oFsbSUNc6w9v/tQ:cApD0DpGigkW7fn+LWdp9aLHwZMaEj8F
MD5:	5A059583ADA0F50B94FD565BEE5D24FC
SHA1:	B04C8914EDDAADD6A7E1679512E5EC65F39EAECA
SHA-256:	F1788AFDB3494D9ECA77269E265AA3304B4D2DB7581FA499121E72B970E9B3DE
SHA-512:	806AC6850274FD9BC3932CEE4F955C19FAF7392D8B10D57E4D0A3CFEBF8BCC711B7FE113FB84B49A501B94E2AD296D84A7AA74FF587076ED93994934B8D1B210
Malicious:	false
Preview:	# Makefile.in generated by automake 1.16.3 from Makefile.am..# @configure_input@..# Copyright (C) 1994-2020 Free Software Foundation, Inc...# This Makefile.in is free software; the Free Software Foundation.# gives unlimited permission to copy and/or distribute it,.# with or without modifications, as long as this notice is preserved...# This program is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY, to the extent permitted by law; without.# even the implied warranty of MERCHANTABILITY or FITNESS FOR A.# PARTICULAR PURPOSE...@SET_MAKE@....VPATH = @srcdir@.am__is_gnu_make = { \. if test -z '$(MAKELEVEL)'; then \. false; \. elif test -n '$(MAKE_HOST)'; then \. true; \. elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \. true; \. else \. false; \. fi; \.}.am__make_running_with_option = \. case $${target_option-} in \. ?) ;; \. *) echo "am__make_running_with_option: internal error: invalid" \. "target option '$${

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\README

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	11275
Entropy (8bit):	4.960443144911343
Encrypted:	false
SSDEEP:	192:EpdyE4pQQrk3usiWa0jffoWxTqmJu0jHFiaApgLFIxxGXWrCg9ulpZkh:0dyXQzS0jffoWFqUxEOLFSVrCJZkh
MD5:	8F1718E1076DD2DFC8784F81C9A73A22
SHA1:	53204BA171BB3845158FDA769CF0F891DAF86273
SHA-256:	E087AE510CFEA86BE230D0352952491AC1A0FFEBFD5A531C1F1D41F99474BF1F
SHA-512:	468670DA61C6943E75B22D12E5A81ED69158F5F2BE4E1E29B119B89D6F972230018799D8195E6A8CD9E5AAB7E20B3B36AA4BB5DAB6B158E611CDDA59C0F4D167
Malicious:	false
Preview:	Status.======..libffi-3.0.11 was released on April 11, 2012. Check the libffi web.page for updates: <URL:http://sourceware.org/libffi/>....What is libffi?.===============..Compilers for high level languages generate code that follow certain.conventions. These conventions are necessary, in part, for separate.compilation to work. One such convention is the "calling.convention". The "calling convention" is essentially a set of.assumptions made by the compiler about where function arguments will.be found on entry to a function. A "calling convention" also specifies.where the return value for a function is found...Some programs may not know at the time of compilation what arguments.are to be passed to a function. For instance, an interpreter may be.told at run-time about the number and types of arguments used to call.a given function. Libffi can be used in such programs to provide a.bridge from the interpreter program to compiled code...The libffi library provides a portable, high level pr

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\README.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	19228
Entropy (8bit):	4.461604546133029
Encrypted:	false
SSDEEP:	192:RXpdyE4pQQSo3+XCq66+NmfRWupzZ3aKX0DcTg8qgqDBJGXGUnNmpZkh:TdyXQ06+NcWupt3aJC1qgqVXUn+Zkh
MD5:	0505E070E547830ABB0B4CF9778B1365
SHA1:	14012F1FDAF364633E4AEEDD47945DBB72B0C1E5
SHA-256:	F7AFC36B7F3C300D323D386BE84C3BEF2DA681EC5EC4DEB53F5C036F7B7A5DAE
SHA-512:	596262D05BE1AC6235F2D4A43DAFEED223BCACB197B0C0EB402486421A2E4EE8E0E5160AF97B0218E817CB4B95DE1C08EBC6719DFED6036F9020EDDBE04EA791
Malicious:	false
Preview:	Status.======..[![Build Status](https://travis-ci.org/libffi/libffi.svg?branch=master)](https://travis-ci.org/libffi/libffi).[![Build status](https://ci.appveyor.com/api/projects/status/8lko9vagbx4w2kxq?svg=true)](https://ci.appveyor.com/project/atgreen/libffi)..libffi-3.3 was released on November 23, 2019. Check the libffi web.page for updates: <URL:http://sourceware.org/libffi/>....What is libffi?.===============..Compilers for high level languages generate code that follow certain.conventions. These conventions are necessary, in part, for separate.compilation to work. One such convention is the "calling.convention". The "calling convention" is essentially a set of.assumptions made by the compiler about where function arguments will.be found on entry to a function. A "calling convention" also specifies.where the return value for a function is found...Some programs may not know at the time of compilation what arguments.are to be passed to a function. For instance, an interpreter may

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\config.guess

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	48932
Entropy (8bit):	5.68339613146025
Encrypted:	false
SSDEEP:	768:IvLDgfGmWXlz+DihvVwZKySAwsJtLL3pVzVWZvvovXRKJSdrWN2BgYrdZXg6azSw:kDAGCwsJtLL3pdVWZvvovaSdrFbXRazH
MD5:	544841A034D421DCC80423257A1BB3B5
SHA1:	67609B43B8CAB4D0F2AC77D36EC5ABB632350503
SHA-256:	42F9E80C88168DE121F6826B68D6B0E653967190E072D53278A5660B4E5DCB50
SHA-512:	B16B937D85F78FDF237B74CFFCC6F4BD4F1CF2A0245C3835136FFCA1AF91FFB936913CA4155BE96DD0327D0618187C4E9B26B44FDA08E01177CE958BE3C73547
Malicious:	false
Preview:	#! /bin/sh.# Attempt to guess a canonical system name..# Copyright 1992-2020 Free Software Foundation, Inc...timestamp='2020-07-12'..# This file is free software; you can redistribute it and/or modify it.# under the terms of the GNU General Public License as published by.# the Free Software Foundation; either version 3 of the License, or.# (at your option) any later version..#.# This program is distributed in the hope that it will be useful, but.# WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.# General Public License for more details..#.# You should have received a copy of the GNU General Public License.# along with this program; if not, see <https://www.gnu.org/licenses/>..#.# As a special exception to the GNU General Public License, if you.# distribute this file as part of a program that contains a.# configuration script generated by Autoconf, you may include it under.# the same distribution terms that

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\config.sub

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	34130
Entropy (8bit):	5.124330502808674
Encrypted:	false
SSDEEP:	384:QveD5DDSxTnTnFHaNKwNSNWx4HxT0rOP0sntn8IQowMhShPiK+UxbLuRLr/tuwL+:Qv2DDS7HaW7tn8IQowMhwP+XrQwLJoW8
MD5:	A71A7588A49488D9D3DE0C74612AA8E2
SHA1:	9E988A120F085958E31B52396ACD2A5D65D4839E
SHA-256:	C398A157B3A14EA6239FECE69131B39836C08B21E04D066BBDE42CE8969496D7
SHA-512:	423CF74479861CBAD960EF5FBAD320894253784055B46530AE229159914FDEFBE5059A4C79A867A2CE21841640BD480520CFAA5C9B85674BC6787B3871F69CCA
Malicious:	false
Preview:	#! /bin/sh.# Configuration validation subroutine script..# Copyright 1992-2020 Free Software Foundation, Inc...timestamp='2020-07-10'..# This file is free software; you can redistribute it and/or modify it.# under the terms of the GNU General Public License as published by.# the Free Software Foundation; either version 3 of the License, or.# (at your option) any later version..#.# This program is distributed in the hope that it will be useful, but.# WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.# General Public License for more details..#.# You should have received a copy of the GNU General Public License.# along with this program; if not, see <https://www.gnu.org/licenses/>..#.# As a special exception to the GNU General Public License, if you.# distribute this file as part of a program that contains a.# configuration script generated by Autoconf, you may include it under.# the same distribution terms th

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\config\win\ia32\fficonfig.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6274
Entropy (8bit):	5.209296781774129
Encrypted:	false
SSDEEP:	192:dGMZzDESYUKbHnKrYKpHdylZDrJZvHlZCYxqi01G0t/zZ+:zurK0KpS0YUF7Y
MD5:	7AF9747F6FA531DAE2C0CC0F894C50B3
SHA1:	AB58EFEF82C7988C25F09DB1E50D6CC9F332DB11
SHA-256:	642F4FD7C672E160A98585B56E29C6F4570EEEE682D38C99340A12C5E8754E19
SHA-512:	DCB44CCD8EFF88C523EF968ED07F94A22E783C7EC7B3B90E5A74658F0A580C4217C1972E7E66A0D21B1378ADF857605CBDF13D39A80F2033CBE9753506D00E9A
Malicious:	false
Preview:	/* fficonfig.h. Generated from fficonfig.h.in by configure. /./ fficonfig.h.in. Generated from configure.ac by autoheader. /../ Define if building universal (internal helper macro) /./ #undef AC_APPLE_UNIVERSAL_BUILD /../ Define to one of `_getb67', `GETB67', `getb67' for Cray-2 and Cray-YMP. systems. This function is required for `alloca.c' support on those systems.. /./ #undef CRAY_STACKSEG_END /../ Define to 1 if using `alloca.c'. /./ #undef C_ALLOCA /../ Define to the flags needed for the .section .eh_frame directive. /.#define EH_FRAME_FLAGS "aw"../ Define this if you want extra debugging. /./ #undef FFI_DEBUG /../ Cannot use PROT_EXEC on this target, so, we revert to alternative means /./ #undef FFI_EXEC_TRAMPOLINE_TABLE /../ Define this if you want to enable pax emulated trampolines /./ #undef FFI_MMAP_EXEC_EMUTRAMP_PAX /../ Cannot use malloc on this target, so, we revert to alternative means /./ #undef FFI_MMAP_EXEC_WRIT /../ Define thi

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\config\win\ia32\ffitarget.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4490
Entropy (8bit):	5.283437686948631
Encrypted:	false
SSDEEP:	96:uknPhUuHZgosp3WEg8PH6eHx6N0q3sPhui64o:uLuHZgFp3WEg2Thui4
MD5:	321709E9143C14291760A6B233B96A9C
SHA1:	55103C48FEF6750564F57885C6EE756ED065C68E
SHA-256:	FBF9DB5505715032364A20AECD0DD11377391458E50E99B8315B3AE4E54431B2
SHA-512:	9979A27FD70F0F53C29FDDFD7D602CA4B845A8E35A9ED0E89964E844AEB3B11176884BB813BD914D3919565ABED5E8DADE76C1B00DC670B2585AB08060FCD6AE
Malicious:	false
Preview:	/* ------------------------------------------------------------------C--.. ffitarget.h - Copyright (c) 2012, 2014, 2018 Anthony Green.. Copyright (c) 1996-2003, 2010 Red Hat, Inc... Copyright (C) 2008 Free Software Foundation, Inc..... Target configuration macros for x86 and x86-64..... Permission is hereby granted, free of charge, to any person obtaining.. a copy of this software and associated documentation files (the.. ``Software''), to deal in the Software without restriction, including.. without limitation the rights to use, copy, modify, merge, publish,.. distribute, sublicense, and/or sell copies of the Software, and to.. permit persons to whom the Software is furnished to do so, subject to.. the following conditions:.... The above copyright notice and this permission notice shall be included.. in all copies or substantial portions of the Software..... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,..

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\config\win\x64\ffi.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	13940
Entropy (8bit):	5.268096805603499
Encrypted:	false
SSDEEP:	192:uuuHt/QidqyuyEWSIvZ+RECm+arz6hqrREiAdOGL8K8GJhNn6BsxlRm:uuqHAyuChRzAqrREiAdr8K8ab5xu
MD5:	355A4BA8F22877124A7D528108ADAB1E
SHA1:	8CAF04D2EC7563F08E299C8F4B9D951090CE3427
SHA-256:	5E70BB65B8D444EA85B01631769C9FFF481D74A151D4752D0A2C081E2BFC82B9
SHA-512:	F3C9F0BBE3E494B50F4C12CC385DFF9957389537AA98283C40F6C3D8289A3EB16EC2D9A801C6934CE1D34ACD9E81D0840D93257115555D707066B43E98AAA4E6
Malicious:	false
Preview:	/* ------------------------------------------------------------------C--. libffi 3.3 - Copyright (c) 2011, 2014, 2019 Anthony Green. - Copyright (c) 1996-2003, 2007, 2008 Red Hat, Inc... Permission is hereby granted, free of charge, to any person. obtaining a copy of this software and associated documentation. files (the ``Software''), to deal in the Software without. restriction, including without limitation the rights to use, copy,. modify, merge, publish, distribute, sublicense, and/or sell copies. of the Software, and to permit persons to whom the Software is. furnished to do so, subject to the following conditions:.. The above copyright notice and this permission notice shall be. included in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. N

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\config\win\x64\fficonfig.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6274
Entropy (8bit):	5.209296781774129
Encrypted:	false
SSDEEP:	192:dGMZzDESYUKbHnKrYKpHdylZDrJZvHlZCYxqi01G0t/zZ+:zurK0KpS0YUF7Y
MD5:	7AF9747F6FA531DAE2C0CC0F894C50B3
SHA1:	AB58EFEF82C7988C25F09DB1E50D6CC9F332DB11
SHA-256:	642F4FD7C672E160A98585B56E29C6F4570EEEE682D38C99340A12C5E8754E19
SHA-512:	DCB44CCD8EFF88C523EF968ED07F94A22E783C7EC7B3B90E5A74658F0A580C4217C1972E7E66A0D21B1378ADF857605CBDF13D39A80F2033CBE9753506D00E9A
Malicious:	false
Preview:	/* fficonfig.h. Generated from fficonfig.h.in by configure. /./ fficonfig.h.in. Generated from configure.ac by autoheader. /../ Define if building universal (internal helper macro) /./ #undef AC_APPLE_UNIVERSAL_BUILD /../ Define to one of `_getb67', `GETB67', `getb67' for Cray-2 and Cray-YMP. systems. This function is required for `alloca.c' support on those systems.. /./ #undef CRAY_STACKSEG_END /../ Define to 1 if using `alloca.c'. /./ #undef C_ALLOCA /../ Define to the flags needed for the .section .eh_frame directive. /.#define EH_FRAME_FLAGS "aw"../ Define this if you want extra debugging. /./ #undef FFI_DEBUG /../ Cannot use PROT_EXEC on this target, so, we revert to alternative means /./ #undef FFI_EXEC_TRAMPOLINE_TABLE /../ Define this if you want to enable pax emulated trampolines /./ #undef FFI_MMAP_EXEC_EMUTRAMP_PAX /../ Cannot use malloc on this target, so, we revert to alternative means /./ #undef FFI_MMAP_EXEC_WRIT /../ Define thi

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\config\win\x64\ffitarget.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4490
Entropy (8bit):	5.283437686948631
Encrypted:	false
SSDEEP:	96:uknPhUuHZgosp3WEg8PH6eHx6N0q3sPhui64o:uLuHZgFp3WEg2Thui4
MD5:	321709E9143C14291760A6B233B96A9C
SHA1:	55103C48FEF6750564F57885C6EE756ED065C68E
SHA-256:	FBF9DB5505715032364A20AECD0DD11377391458E50E99B8315B3AE4E54431B2
SHA-512:	9979A27FD70F0F53C29FDDFD7D602CA4B845A8E35A9ED0E89964E844AEB3B11176884BB813BD914D3919565ABED5E8DADE76C1B00DC670B2585AB08060FCD6AE
Malicious:	false
Preview:	/* ------------------------------------------------------------------C--.. ffitarget.h - Copyright (c) 2012, 2014, 2018 Anthony Green.. Copyright (c) 1996-2003, 2010 Red Hat, Inc... Copyright (C) 2008 Free Software Foundation, Inc..... Target configuration macros for x86 and x86-64..... Permission is hereby granted, free of charge, to any person obtaining.. a copy of this software and associated documentation files (the.. ``Software''), to deal in the Software without restriction, including.. without limitation the rights to use, copy, modify, merge, publish,.. distribute, sublicense, and/or sell copies of the Software, and to.. permit persons to whom the Software is furnished to do so, subject to.. the following conditions:.... The above copyright notice and this permission notice shall be included.. in all copies or substantial portions of the Software..... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,..

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\configure

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	686878
Entropy (8bit):	5.282147381002671
Encrypted:	false
SSDEEP:	6144:Qx9sXthkMmK4C4gRpjQ8QPTxoToVgZJ8Hdp8ewT9ZtEfrh+B8Q+pDKfTvKC6ZAvV:ZAlGXbffIEhSUrGId3osiPxH3iv
MD5:	DBD942B3BA2F1352338EFE77987D8DCE
SHA1:	76C836FA63488AA331D282C8FC2F2FBF187A2C71
SHA-256:	3FA84183E306B3E532E2DC0EF042A03035D6FCAD7AE5EC041EAC47496D0D73D0
SHA-512:	62C6C14807E4EF1420BB077783A03759EAD201D3F6AC61E3EF16A3142CB1FDE45D75E77EACCE2CF200E9DED5FA541EFC162D5A30EC7CEE23D2BB8B7DD2856186
Malicious:	false
Preview:	#! /bin/sh.# Guess values for system-dependent variables and create Makefiles..# Generated by GNU Autoconf 2.69 for libffi 3.3..#.# Report bugs to <http://github.com/libffi/libffi/issues>..#.#.# Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc..#.#.# This configure script is free software; the Free Software Foundation.# gives unlimited permission to copy, distribute and modify it..## -------------------- ##.## M4sh Initialization. ##.## -------------------- ##..# Be more Bourne compatible.DUALCASE=1; export DUALCASE # for MKS sh.if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then :. emulate sh. NULLCMD=:. # Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which. # is contrary to our usage. Disable this feature.. alias -g '${1+"$@"}'='"$@"'. setopt NO_GLOB_SUBST.else. case `(set -o) 2>/dev/null` in #(. posix) :. set -o posix ;; #(. *) :. ;;.esac.fi...as_nl='.'.export as_nl.# Printing a long string crashes Solaris 7 /usr/bin/pri

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\configure.ac

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	12103
Entropy (8bit):	5.435653447507252
Encrypted:	false
SSDEEP:	192:43ttd5I54bMpAsnpfvcFR0ilOl55cK5Rf4u9kCxJNkp57yei8Yg1SHTQ6VWEQqXo:43ttXA4bMpAop3cFR0i4lcSRzCVyeixY
MD5:	0BB1D2E3C584255C3304CA6BE3682F63
SHA1:	7C8C01003B96966E7A09880BFE81D94367C48A6A
SHA-256:	2C6E4B047FDA162238F30676A51E8ECACF9C4F507A0821DECC66BAB8C1FC69DC
SHA-512:	BA0824CFDE4A4DA31913A591241F3B584437249A3CE7FA320F95E3934A9273704C32FFAA4EDC96BF1CF8577267AA1B8DAB12EFBBE92308C8A04FB1340A826C14
Malicious:	false
Preview:	dnl Process this with autoconf to create configure..AC_PREREQ(2.68)..AC_INIT([libffi], [3.3], [http://github.com/libffi/libffi/issues]).AC_CONFIG_HEADERS([fficonfig.h])..AC_CANONICAL_SYSTEM.target_alias=${target_alias-$host_alias}..case "${host}" in. frv-elf). LDFLAGS=`echo $LDFLAGS \| sed "s/\-B[^ ]libgloss\/frv\///"`\ -B`pwd`/../libgloss/frv/. ;;.esac..AX_ENABLE_BUILDDIR..AM_INIT_AUTOMAKE..# The same as in boehm-gc and libstdc++. Have to borrow it from there..# We must force CC to /not/ be precious variables; otherwise.# the wrong, non-multilib-adjusted value will be used in multilibs..# As a side effect, we have to subst CFLAGS ourselves..# Also save and restore CFLAGS, since AC_PROG_CC will come up with.# defaults of its own if none are provided...m4_rename([_AC_ARG_VAR_PRECIOUS],[real_PRECIOUS]).m4_define([_AC_ARG_VAR_PRECIOUS],[]).save_CFLAGS=$CFLAGS.AC_PROG_CC.AC_PROG_CXX.CFLAGS=$save_CFLAGS.m4_undefine([_AC_ARG_VAR_PRECIOUS]).m4_rename_force([real_PRECIOUS],[_AC_ARG_VAR

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\configure.host

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6090
Entropy (8bit):	5.575823283030712
Encrypted:	false
SSDEEP:	96:StSGhdckpOdhhc2DVJj3LMSUvNm15LQbqXEtOuuShmgKHko:KSGhdt8hvVVL4N+5L6qmuShmgKEo
MD5:	C1CF88DCAEC95155EC7E44F009AA9ECE
SHA1:	6A0C0826B31CA7978AA01B860252239B1A1D4B44
SHA-256:	022C954373D31797CD820ABD0814C93207136EECD23D625F7481CCDF86415B12
SHA-512:	FCBA46C3B7314E7046C49D2FE2479702E0803E168EBFE7DE7E6FDEB246E224B7C279840FFD39AF34A7C34704E6DAAD8B7858459C795686A1F5ADD03AEAA6841C
Malicious:	false
Preview:	# configure.host.#.# This shell script handles all host based configuration for libffi..#..# THIS TABLE IS SORTED. KEEP IT THAT WAY..# Most of the time we can define all the variables all at once....case "${host}" in. aarch64--cygwin* \| aarch64--mingw* \| aarch64--win* )..TARGET=ARM_WIN64; TARGETDIR=aarch64..MSVC=1..;;.. aarch64--)..TARGET=AARCH64; TARGETDIR=aarch64..SOURCES="ffi.c sysv.S"..;;.. alpha--)..TARGET=ALPHA; TARGETDIR=alpha;..# Support 128-bit long double, changeable via command-line switch...HAVE_LONG_DOUBLE='defined(__LONG_DOUBLE_128__)'..SOURCES="ffi.c osf.S"..;;.. arc--)..TARGET=ARC; TARGETDIR=arc..SOURCES="ffi.c arcompact.S"..;;.. arm--cygwin \| arm--mingw* \| arm--win* )..TARGET=ARM_WIN32; TARGETDIR=arm..MSVC=1..;;.. arm--)..TARGET=ARM; TARGETDIR=arm..SOURCES="ffi.c sysv.S"..;;.. avr32--)..TARGET=AVR32; TARGETDIR=avr32..SOURCES="ffi.c sysv.S"..;;.. bfin)..TARGET=BFIN; TARGETDIR=bfin..SOURCES="ffi.c sysv.S"..;;.. cris--*)..TARGET=LIB

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\depcomp

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	23568
Entropy (8bit):	4.865028648946144
Encrypted:	false
SSDEEP:	384:3LBbt5u3pqYRBRXWPuolkux1EBMPTJYE8KMiUqsMnZ3PGT2nBEEJ7lnYu2oF:3LBbt5u3pqYRXGPFKujEBMPdYE8KMi1r
MD5:	91B287CE6C245893A75BD18DC53FB07A
SHA1:	D429169AEAA44FD5B17F40DEFACDB9D6767E389A
SHA-256:	B31B449B11F40156B18D2E2A989D78CA3F89BE0B96CA0A160455B3299B82D2E6
SHA-512:	A5E173DECD0A0951CCBBA38BB9E4542BFB5D95FBB07397FFCAE05FA61A9DD7EF588B8BACD83860440488AAE0CC40D452D4035CF040CEB9957A9C7396D67BE95C
Malicious:	false
Preview:	#! /bin/sh.# depcomp - compile a program generating dependencies as side-effects..scriptversion=2018-03-07.03; # UTC..# Copyright (C) 1999-2020 Free Software Foundation, Inc...# This program is free software; you can redistribute it and/or modify.# it under the terms of the GNU General Public License as published by.# the Free Software Foundation; either version 2, or (at your option).# any later version...# This program is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.# GNU General Public License for more details...# You should have received a copy of the GNU General Public License.# along with this program. If not, see <https://www.gnu.org/licenses/>...# As a special exception to the GNU General Public License, if you.# distribute this file as part of a program that contains a.# configuration script generated by Autoconf, you may include it under.# the s

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\doc\Makefile.am

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.6460184044150195
Encrypted:	false
SSDEEP:	3:RFdCRFR7BAFPRRpAIMRm9srVQb:jd8FF2F/gNVQb
MD5:	BAD91FF01547CE79FE537211F4763AC0
SHA1:	6D927C240B66D4C773D34F501CE9EC745A07F3B9
SHA-256:	9A56679034CEBF73189C4D4D689CDEEAED2F6AF68945CC9D52A3846DECE0567B
SHA-512:	AA888BC53FFE724E6581C61C0505F0C1B2101202BFCFBF3ADA5737FBA6D61CB62CA28F0D6A4B1E6856709DAC4C886267E863FC7212C615EAC8ED637BAD58CD8C
Malicious:	false
Preview:	## Process this with automake to create Makefile.in..info_TEXINFOS = libffi.texi.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\doc\Makefile.in

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	26146
Entropy (8bit):	5.5555216054303065
Encrypted:	false
SSDEEP:	768:cqpDBTSKW8HfDuWAbwfJgayH3W0m/5BhMaEKj5w5HeTWWDY8SGoQonZ2yWUIW+P7:cqpD5SKW8HqWA0fnymb/5BhMaEK1WWD7
MD5:	56FEDDE0CB1058F01691B4081A253E7E
SHA1:	D718DCA1BECB84321C9C4911625D04B5DAF90750
SHA-256:	BE5AFC7D3124E81AAABA330D382A2259D96543209648AC41BFA04E3E9A507A15
SHA-512:	D8D7B48CF2FCAA0B224F6F1CD42ED4C62CC0F6A6C46C572FF183C6932F4FCDAE3566785D64C7439C9519176F6A68A5D3877FBBD61F92A4ACF6E2BE8AF26893A3
Malicious:	false
Preview:	# Makefile.in generated by automake 1.16.3 from Makefile.am..# @configure_input@..# Copyright (C) 1994-2020 Free Software Foundation, Inc...# This Makefile.in is free software; the Free Software Foundation.# gives unlimited permission to copy and/or distribute it,.# with or without modifications, as long as this notice is preserved...# This program is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY, to the extent permitted by law; without.# even the implied warranty of MERCHANTABILITY or FITNESS FOR A.# PARTICULAR PURPOSE...@SET_MAKE@.VPATH = @srcdir@.am__is_gnu_make = { \. if test -z '$(MAKELEVEL)'; then \. false; \. elif test -n '$(MAKE_HOST)'; then \. true; \. elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \. true; \. else \. false; \. fi; \.}.am__make_running_with_option = \. case $${target_option-} in \. ?) ;; \. *) echo "am__make_running_with_option: internal error: invalid" \. "target option '$${tar

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\doc\libffi.info

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	36817
Entropy (8bit):	4.737774266653315
Encrypted:	false
SSDEEP:	768:4HgTcH0pJnJid9gH6xtRKQ3JAM5MkGM6WKOlyh5KmOkLpIcjxc829rKwbs0Y:4HgTcH0DnJs7JKQ3JAM5MkGM6WKOghp7
MD5:	65E9037D1FA1D68D1B81605BBE43FA73
SHA1:	2DB7616290E1BE419BC348984238619166E633FB
SHA-256:	6FE18701B28F270E367F13BC0D9670FE6CA6AEF0AEBDDE5B56B5038B48A03488
SHA-512:	7DEEED257A718C41DD26FE9925EF3B06B2D557BFF511B4DB0E511CCC9CA47580DE53F686ECCE4DA7EDCBB8704E97487C7DA1DB4AE2F347532CEACA9879247A2D
Malicious:	false
Preview:	This is ../../doc/libffi.info, produced by makeinfo version 4.8 from.../../doc/libffi.texi... This manual is for libffi, a portable foreign function interface.library... Copyright (C) 2008-2019 Anthony Green and Red Hat, Inc... Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:.. The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEME

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\doc\libffi.texi

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	31079
Entropy (8bit):	4.853526839720686
Encrypted:	false
SSDEEP:	768:qgtWS4xAScz51rsTJs3sk1f1vO5FeY5ssw+ImYslq9zi3ckdToE9j38YX7m4oyqk:JuTo51gTrkbvO5FeY5ssw+ImYsE9Wckl
MD5:	08CD564FC1DA75BBB060027153FF86EC
SHA1:	F2FAFE7565A39C59F946BDD4C24412354E4195C7
SHA-256:	906E2B7A17FFD6240D7BD848CD6F22976AD4A12F5F836FB2FB27DD86D6471551
SHA-512:	8288F09452B1878B8AC3FD57CB48F289F62E3F6191098CF1A19E6483048451BB752FE0E8B7DAC9886565A5EEA039D3F9CFB3DF8782BDE69FE1546E0AE9EDE316
Malicious:	false
Preview:	\input texinfo @c --texinfo--.@c %start of header.@setfilename libffi.info.@include version.texi.@settitle libffi: the portable foreign function interface library.@setchapternewpage off.@c %end of header..@c Merge the standard indexes into a single one..@syncodeindex fn cp.@syncodeindex vr cp.@syncodeindex ky cp.@syncodeindex pg cp.@syncodeindex tp cp..@copying..This manual is for libffi, a portable foreign function interface.library...Copyright @copyright{} 2008--2019 Anthony Green and Red Hat, Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.``Software''), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission no

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\doc\mdate-sh

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6106
Entropy (8bit):	5.108096104531243
Encrypted:	false
SSDEEP:	96:Wm7ACw5P6btYA+12ukpA227bBaB2JdCfXow4ar8/uNPM3Ee9KCXzBMIx1Tn:Wm7ACwt62AO2Rphwy/owh3PM0exjBjF
MD5:	176B1671068C0099ACA4EC2BDE2733D3
SHA1:	C6CF330F08B873E5E2CA82680AF0E3002CC3A4C1
SHA-256:	4E8FA843D3195A6E14FF129E1B92CBD23B2476C4C6403D15A83E8783A0EF3C8F
SHA-512:	1552F91518F007ED440C036093125A3C97E00723D700B9EC4AFA9495B02C8B1308451255DCB7EB599E46EE767EDF8B272517E0B2FC2842A799F047375FEE2AA9
Malicious:	false
Preview:	#!/bin/sh.# Get modification time of a file or directory and pretty-print it...scriptversion=2018-03-07.03; # UTC..# Copyright (C) 1995-2020 Free Software Foundation, Inc..# written by Ulrich Drepper <drepper@gnu.ai.mit.edu>, June 1995.#.# This program is free software; you can redistribute it and/or modify.# it under the terms of the GNU General Public License as published by.# the Free Software Foundation; either version 2, or (at your option).# any later version..#.# This program is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.# GNU General Public License for more details..#.# You should have received a copy of the GNU General Public License.# along with this program. If not, see <https://www.gnu.org/licenses/>...# As a special exception to the GNU General Public License, if you.# distribute this file as part of a program that contains a.# configuratio

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\doc\stamp-vti

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	96
Entropy (8bit):	4.778318482072569
Encrypted:	false
SSDEEP:	3:rxg0WXQ5mvMmxg0MHA5mvMsq4MDkF/n:ljWXnlnMH36LYF/
MD5:	7D03CF9FD43D16FA0EF535699995EFA1
SHA1:	1A4F0054F99B5A7E13159A3B0ECED41A64C86A1C
SHA-256:	7E8FF3271C6FA08268DB34B5F2630C72C99362A89C65A278C3AC1FEBCA426F0D
SHA-512:	D899BED2928B7652D95F498F0E677D57EF08837F04340E2669D01ED5439C93AEDAB671CE8ED13AE8FA9B943F5DC36CD1EE8C44A5FF0ACCCD502FA4A01A3D9CF8
Malicious:	false
Preview:	@set UPDATED 5 February 2021.@set UPDATED-MONTH February 2021.@set EDITION 3.3.@set VERSION 3.3.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\doc\texinfo.tex

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	380572
Entropy (8bit):	4.92113886885091
Encrypted:	false
SSDEEP:	6144:Y7Fsg3BUuthAQ539GMmYv95vj6UmjdvxVcHPq2R:0th9/6xJYH
MD5:	72089D424C2E8DEFA57C6090261EAAEA
SHA1:	6A38E9ECA5B0DDE276CE7C9D401B67220264C571
SHA-256:	2269410DE4E4A6054F501DDC541E10C9DEAE7B19055CBA8E80291B13584C41CE
SHA-512:	C1165E5F6F8E8D72B9821CE9E25A12FB7C8EAEABCC7A4EF907F2ECD45E6B3F8945B2C17084EFACD8558A1A9A30A02198656D896E5BD77113B1AF2ACFCAB8F77B
Malicious:	false
Preview:	% texinfo.tex -- TeX macros to handle Texinfo files..%.% Load plain if necessary, i.e., if running under initex..\expandafter\ifx\csname fmtname\endcsname\relax\input plain\fi.%.\def\texinfoversion{2020-10-24.12}.%.% Copyright 1985, 1986, 1988, 1990-2020 Free Software Foundation, Inc..%.% This texinfo.tex file is free software: you can redistribute it and/or.% modify it under the terms of the GNU General Public License as.% published by the Free Software Foundation, either version 3 of the.% License, or (at your option) any later version..%.% This texinfo.tex file is distributed in the hope that it will be.% useful, but WITHOUT ANY WARRANTY; without even the implied warranty.% of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.% General Public License for more details..%.% You should have received a copy of the GNU General Public License.% along with this program. If not, see <https://www.gnu.org/licenses/>..%.% As a special exception, when this file is read by TeX w

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\doc\version.texi

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	96
Entropy (8bit):	4.778318482072569
Encrypted:	false
SSDEEP:	3:rxg0WXQ5mvMmxg0MHA5mvMsq4MDkF/n:ljWXnlnMH36LYF/
MD5:	7D03CF9FD43D16FA0EF535699995EFA1
SHA1:	1A4F0054F99B5A7E13159A3B0ECED41A64C86A1C
SHA-256:	7E8FF3271C6FA08268DB34B5F2630C72C99362A89C65A278C3AC1FEBCA426F0D
SHA-512:	D899BED2928B7652D95F498F0E677D57EF08837F04340E2669D01ED5439C93AEDAB671CE8ED13AE8FA9B943F5DC36CD1EE8C44A5FF0ACCCD502FA4A01A3D9CF8
Malicious:	false
Preview:	@set UPDATED 5 February 2021.@set UPDATED-MONTH February 2021.@set EDITION 3.3.@set VERSION 3.3.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\fficonfig.h.in

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5851
Entropy (8bit):	5.2264210834839515
Encrypted:	false
SSDEEP:	96:A4U2KrWCer5Q6N8yK8KlTn0YGjqV/n3X7TAIrt/v+dQjc21BPqi0u+Qq4T/xr+:AOtRNQbyK8KlTn0YGjqV/n3X3X9v+gfi
MD5:	53B818300D4CB47B77AB3F89C9986AB1
SHA1:	04A7DC2A7D5DC35DA6786AE102A83C93956421A5
SHA-256:	4131BAD48E149718F4F8C04E701E658A856BE06AB6255495D62BE526274BB433
SHA-512:	E016ACFE3B41D6D8B77F2E3C1E94542F9CDC05E42A104F46216156FEB8CCDE0690B339B752BAC130AF0BC2CDB1CAC508B9F4B4F89EDEE319A3B8F8DA599C8A95
Malicious:	false
Preview:	/* fficonfig.h.in. Generated from configure.ac by autoheader. /../ Define if building universal (internal helper macro) /.#undef AC_APPLE_UNIVERSAL_BUILD../ Define to one of `_getb67', `GETB67', `getb67' for Cray-2 and Cray-YMP. systems. This function is required for `alloca.c' support on those systems.. /.#undef CRAY_STACKSEG_END../ Define to 1 if using `alloca.c'. /.#undef C_ALLOCA../ Define to the flags needed for the .section .eh_frame directive. /.#undef EH_FRAME_FLAGS../ Define this if you want extra debugging. /.#undef FFI_DEBUG../ Cannot use PROT_EXEC on this target, so, we revert to alternative means /.#undef FFI_EXEC_TRAMPOLINE_TABLE../ Define this if you want to enable pax emulated trampolines /.#undef FFI_MMAP_EXEC_EMUTRAMP_PAX../ Cannot use malloc on this target, so, we revert to alternative means /.#undef FFI_MMAP_EXEC_WRIT../ Define this if you do not want support for the raw API. /.#undef FFI_NO_RAW_API../ Define this if you do not want support

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\generate-darwin-source-and-headers.py

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6626
Entropy (8bit):	4.792573576948016
Encrypted:	false
SSDEEP:	96:0UrnCMfHzbVh2NpiRnNMSVM22sJTV+xXiK0PJPA8w/35pkvaGUV+VyVYgjV4DOF4:T4GxUYxaoX
MD5:	A83B618BF5D11F6FC33E6E512C7F3355
SHA1:	DCD008D22D43D0C90CABA04157FF020EDD48B542
SHA-256:	0808584C94AB304AB534B7D4DA3BF7ADECA7F04E0A17A722ADB15031E8415343
SHA-512:	4BEB5C4D9D66CB3908B1043CEDD7135704D44F72819F8500806667A50336BED94B18CDF1DD89FECCAF5480A1F29FC37002C888190E85DDA028F52E9438EBDDF5
Malicious:	false
Preview:	#!/usr/bin/env python.import subprocess.import os.import errno.import collections.import glob.import argparse..class Platform(object):. pass..class simulator_platform(Platform):. directory = 'darwin_ios'. sdk = 'iphonesimulator'. arch = 'i386'. triple = 'i386-apple-darwin11'. version_min = '-miphoneos-version-min=7.0'.. prefix = "#ifdef __i386__\n\n". suffix = "\n\n#endif". src_dir = 'x86'. src_files = ['sysv.S', 'ffi.c', 'internal.h']...class simulator64_platform(Platform):. directory = 'darwin_ios'. sdk = 'iphonesimulator'. arch = 'x86_64'. triple = 'x86_64-apple-darwin13'. version_min = '-miphoneos-version-min=7.0'.. prefix = "#ifdef __x86_64__\n\n". suffix = "\n\n#endif". src_dir = 'x86'. src_files = ['unix64.S', 'ffi64.c', 'ffiw64.c', 'win64.S', 'internal64.h', 'asmnames.h']...class device_platform(Platform):. directory = 'darwin_ios'. sdk = 'iphoneos'. arch = 'armv7'. triple = 'arm-apple-darwin11'. version_mi

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\generate-ios-source-and-headers.py

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5303
Entropy (8bit):	4.452704303580894
Encrypted:	false
SSDEEP:	96:jFJy+5zQVtY55PHgMJTO/VyX9jyP15G8Y+N6uS/6FhyKN8t8rxFmc0M:jm+5zQfY55xxOg9295R0M
MD5:	A99550F29BA59F299E084E06DCBB10AE
SHA1:	10D940DBB2C98F6B3CF04011F390F4D1B7878AEF
SHA-256:	CC3D514FB94BC7F44771D85095460D58B28E0ED20E0309A090D1E48985354DA0
SHA-512:	F5B2DCA3CE52D7A80EE1F196C7373F22209384BFED8E938176203D5E31941DD90073E4BAC3FD7163DA75BCA446814194BBD85F4A86DAB1B85C89E7CE73A3F1F7
Malicious:	false
Preview:	#!/usr/bin/env python..import subprocess.import re.import os.import errno.import collections.import sys..class Platform(object):. pass..sdk_re = re.compile(r'.-sdk ([a-zA-Z0-9.])')..def sdkinfo(sdkname):. ret = {}. for line in subprocess.Popen(['xcodebuild', '-sdk', sdkname, '-version'], stdout=subprocess.PIPE).stdout:. kv = line.strip().split(': ', 1). if len(kv) == 2:. k,v = kv. ret[k] = v. return ret..sim_sdk_info = sdkinfo('iphonesimulator').device_sdk_info = sdkinfo('iphoneos')..def latest_sdks():. latest_sim = None. latest_device = None. for line in subprocess.Popen(['xcodebuild', '-showsdks'], stdout=subprocess.PIPE).stdout:. match = sdk_re.match(line). if match:. if 'Simulator' in line:. latest_sim = match.group(1). elif 'iOS' in line:. latest_device = match.group(1).. return latest_sim, latest_device..sim_sdk, device_sdk = latest_sdks()..class simulat

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\generate-osx-source-and-headers.py

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5200
Entropy (8bit):	4.501946582628025
Encrypted:	false
SSDEEP:	96:1FJy+5JsytsEe1ng5ReMJTO/VyX9jyPeEizRX8pZN6u9N6Fh8VN8B8MxFBc0M:1m+5JsmsEee5RrxOg92GEizRs0M
MD5:	2EA34FFE8AEEB435B46669DA45FFF8A9
SHA1:	9E5B8021C39F0196186D887E4B0CACA41D84C0E1
SHA-256:	A1DF3ACA2849D7866A35D6D0876EBAF2833FD2C38CB9146F9786F8552056C796
SHA-512:	75037ACCFE5745F867971A04D442BA55F0B59FE20EBA9BE8635308836C5356889F2472DE78EBFE64B7312C4560D170397CA1395B056E053E7B7E4E8ED65046C9
Malicious:	false
Preview:	#!/usr/bin/env python.import subprocess.import re.import os.import errno.import collections.import sys..class Platform(object):. pass..sdk_re = re.compile(r'.-sdk ([a-zA-Z0-9.])')..def sdkinfo(sdkname):. ret = {}. for line in subprocess.Popen(['xcodebuild', '-sdk', sdkname, '-version'], stdout=subprocess.PIPE).stdout:. kv = line.strip().split(': ', 1). if len(kv) == 2:. k,v = kv. ret[k] = v. return ret..desktop_sdk_info = sdkinfo('macosx')..def latest_sdks():. latest_desktop = None. for line in subprocess.Popen(['xcodebuild', '-showsdks'], stdout=subprocess.PIPE).stdout:. match = sdk_re.match(line). if match:. if 'OS X' in line:. latest_desktop = match.group(1).. return latest_desktop..desktop_sdk = latest_sdks()..class desktop_platform_32(Platform):. sdk='macosx'. arch = 'i386'. name = 'mac32'. triple = 'i386-apple-darwin10'. sdkroot = desktop_sdk_info['Path']. . pre

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\include\Makefile.am

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.009535764515011
Encrypted:	false
SSDEEP:	6:jd8FF2F/IhRoWeTK5Q+hvLyCfAGh5YOQ7ev:jeWFoUTK/vmCfAEYJav
MD5:	EFCD1924A7B3A7DD64F0F4A3D0F539E3
SHA1:	1E5E10E79F1A2941EC4633FBF8B0EE40E38ACBBA
SHA-256:	43763A7DEB601012459BA66E354160656C6B8659E2282B84D4239555A11E92BD
SHA-512:	34780B24724C020A8BDF7F4E0582D608E70F8775A7B5AEB63A17D1A75DA7136351B5AFF5C5F94023F90C25BA9D875B566767310D785AC2EA8B75CEFB4BA198A2
Malicious:	false
Preview:	## Process this with automake to create Makefile.in..AUTOMAKE_OPTIONS=foreign..DISTCLEANFILES=ffitarget.h.noinst_HEADERS=ffi_common.h ffi_cfi.h.EXTRA_DIST=ffi.h.in..nodist_include_HEADERS = ffi.h ffitarget.h.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\include\Makefile.in

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	18167
Entropy (8bit):	5.529217805002341
Encrypted:	false
SSDEEP:	384:wpspDu6TSKW8QvkRai0DuWAbwdlJgaQM21Ov3ESWwQxLgDs7MaEdjg2wg2qKpv2F:cspDBTSKW8Fai0DuWAbwfJgahv3ESWw9
MD5:	FC3D53D37857BA1B730A9A14D4AFF10F
SHA1:	7036228EA1B3BD47014CDBBA975359AD7E837BAC
SHA-256:	96D4BC647AC57D3AACBA02C8F863ABFC02955F985509387325AA9F5FEC136861
SHA-512:	53659CBCDD2B6D06701797475981C18A1DFBB50869DE6B203CE97337AD9B07F4558FC501EFDD2FB0FB734479E77C7ECEEA0825F83572EB4F4C593A131542FAAD
Malicious:	false
Preview:	# Makefile.in generated by automake 1.16.3 from Makefile.am..# @configure_input@..# Copyright (C) 1994-2020 Free Software Foundation, Inc...# This Makefile.in is free software; the Free Software Foundation.# gives unlimited permission to copy and/or distribute it,.# with or without modifications, as long as this notice is preserved...# This program is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY, to the extent permitted by law; without.# even the implied warranty of MERCHANTABILITY or FITNESS FOR A.# PARTICULAR PURPOSE...@SET_MAKE@..VPATH = @srcdir@.am__is_gnu_make = { \. if test -z '$(MAKELEVEL)'; then \. false; \. elif test -n '$(MAKE_HOST)'; then \. true; \. elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \. true; \. else \. false; \. fi; \.}.am__make_running_with_option = \. case $${target_option-} in \. ?) ;; \. *) echo "am__make_running_with_option: internal error: invalid" \. "target option '$${ta

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\include\ffi.h.in

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	14073
Entropy (8bit):	5.286105027817536
Encrypted:	false
SSDEEP:	192:ucuHt/QidPijyuyEWSIvZ+R2Cm+arz6hqrREiAmGL8K8Glf6BsxLRm:ucqHlijyuCh/zAqrREiAD8K8ux0
MD5:	28E05FE024A9B85A4D1AB2A790F5A70D
SHA1:	99A30EBB10477EA28B1263DE03A1EBA27A142B34
SHA-256:	C86413E56EF61322A67A6A61D773B62371137D1F9C1ABC91E6AA6D4012B24E91
SHA-512:	3BB5BA65093888011487FE2449E9F8516203E14376788B7B1CB26413109287F06A74D573AA6EEA74266B646E53CEF532B8CA320D9AEA949A208602961E33A812
Malicious:	false
Preview:	/* ------------------------------------------------------------------C--. libffi @VERSION@ - Copyright (c) 2011, 2014, 2019 Anthony Green. - Copyright (c) 1996-2003, 2007, 2008 Red Hat, Inc... Permission is hereby granted, free of charge, to any person. obtaining a copy of this software and associated documentation. files (the ``Software''), to deal in the Software without. restriction, including without limitation the rights to use, copy,. modify, merge, publish, distribute, sublicense, and/or sell copies. of the Software, and to permit persons to whom the Software is. furnished to do so, subject to the following conditions:.. The above copyright notice and this permission notice shall be. included in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AN

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\include\ffi_cfi.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1942
Entropy (8bit):	4.67102386777118
Encrypted:	false
SSDEEP:	48:12xW/Nke8lPqPaJRGf1Tkin4J/bfDSmDlajAv88zBthRoWvmGf8zPHMeGfsks4cm:1R/Nke8lPIaJRGf1Tkq4FbmYwo5tthG0
MD5:	26308E024D2E5060AA77696E07E9D7E6
SHA1:	E8AC61C5D449DF306F64706ACAC9FEAAA9829506
SHA-256:	0EAF4C217034E3E96AE50125FED4255F2D0BDC07CDF84CCF8B8B19140AEEBC35
SHA-512:	F2874300FC8108112C63B0CA10EFC52BC28BE8C3568D4D84E22675369E55A066A2E465713DD243E7ABFADA69E03CAAB2814CBCBDC833F34889A86D2333BB4031
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffi_cfi.h - Copyright (c) 2014 Red Hat, Inc... Conditionally assemble cfi directives. Only necessary for building libffi.. ----------------------------------------------------------------------- */..#ifndef FFI_CFI_H.#define FFI_CFI_H..#ifdef HAVE_AS_CFI_PSEUDO_OP..# define cfi_startproc....cfi_startproc.# define cfi_endproc....cfi_endproc.# define cfi_def_cfa(reg, off)...cfi_def_cfa reg, off.# define cfi_def_cfa_register(reg)..cfi_def_cfa_register reg.# define cfi_def_cfa_offset(off)..cfi_def_cfa_offset off.# define cfi_adjust_cfa_offset(off)..cfi_adjust_cfa_offset off.# define cfi_offset(reg, off)...cfi_offset reg, off.# define cfi_rel_offset(reg, off)..cfi_rel_offset reg, off.# define cfi_register(r1, r2)...cfi_register r1, r2.# define cfi_return_column(reg)...cfi_return_column reg.# define cfi_restore(reg)...cfi_restore reg.# define cfi_same_value(reg)...cfi_same_value reg.# define cfi_undefined(reg)

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\include\ffi_common.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4160
Entropy (8bit):	5.16718813933947
Encrypted:	false
SSDEEP:	96:13/fD7IE+F0O06tDsEWbaGLydmXiMoIzzdNlS:ZHPqtDsFf3XiMoCU
MD5:	2649852EE85BE3A9429283F307C5F5C9
SHA1:	229CBFFA8559F329DD257E3E56EFCEEB0DC81785
SHA-256:	48348D32CD2C9E8A201E8095289D435F8638540E644C1ECA92AD9DB9854A2F20
SHA-512:	D5B32EC652C0B6D64831FBFF333875C125A556104AC5FAA413E19B03A2CE66F4EA7C8A690ABF0DEAE68B692BF55456027DB8CED44AF102208E9C0177AE8BCC55
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffi_common.h - Copyright (C) 2011, 2012, 2013 Anthony Green. Copyright (C) 2007 Free Software Foundation, Inc. Copyright (c) 1996 Red Hat, Inc.. . Common internal definitions and macros. Only necessary for building. libffi.. ----------------------------------------------------------------------- /..#ifndef FFI_COMMON_H.#define FFI_COMMON_H..#ifdef __cplusplus.extern "C" {.#endif..#include <fficonfig.h>../ Do not move this. Some versions of AIX are very picky about where. this is positioned. /.#ifdef __GNUC__.# if HAVE_ALLOCA_H.# include <alloca.h>.# else. / mingw64 defines this already in malloc.h. */.# ifndef alloca.# define alloca __builtin_alloca.# endif.# endif.# define MAYBE_UNUSED __attribute__((__unused__)).#else.# define MAYBE_UNUSED.# if HAVE_ALLOCA_H.# include <alloca.h>.# else.# ifdef _AIX.# pragma alloca.# else.# ifnde

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\install-sh

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	15358
Entropy (8bit):	4.91920781057568
Encrypted:	false
SSDEEP:	384:9dj/jriL5B5hZgfViYUnMRLMRfur6vTUk9J3kX/sddHswFhTmrVxPD:9l7e1B5hZgfViYeE+ur6bUk9J3kvsddg
MD5:	B090C5891571C820E91D345A9551AF44
SHA1:	894E0A9DE7976233743575C6B84DEDC1B37025B6
SHA-256:	3D7488BEBD0CFC9B5C440C55D5B44F1C6E2E3D3E19894821BAE4A27F9307F1D2
SHA-512:	E9ED1EC4B9903CCCA1D2D7C224200AAA194F22E6CCBCC2A3A595F38F5E3BF04177BCFAC4AE12310BB91262AD8AA3F63420D795A42FB08D95296E0836F4C6A5E9
Malicious:	false
Preview:	#!/bin/sh.# install - install a program, script, or datafile..scriptversion=2020-11-14.01; # UTC..# This originates from X11R5 (mit/util/scripts/install.sh), which was.# later released in X11R6 (xc/config/util/install.sh) with the.# following copyright and license..#.# Copyright (C) 1994 X Consortium.#.# Permission is hereby granted, free of charge, to any person obtaining a copy.# of this software and associated documentation files (the "Software"), to.# deal in the Software without restriction, including without limitation the.# rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.# sell copies of the Software, and to permit persons to whom the Software is.# furnished to do so, subject to the following conditions:.#.# The above copyright notice and this permission notice shall be included in.# all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.# IMPLIED, INCLUDING BUT NOT LIMITED TO

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\libffi.gyp

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5962
Entropy (8bit):	4.288977757856422
Encrypted:	false
SSDEEP:	96:xDNfbZSnOK3zPoKHzPdWDP4L4SdOoHzV3lNYAihFmf4fqfPfsfLYcnUNJm13GsGW:30j1pjOQzVHjkENJ63GsGW
MD5:	DBFD006E81D3F5958081BABFC04AD72C
SHA1:	7843F25668D996580A53F85024B7373DFBB03FD8
SHA-256:	B4DF411EABFE75F90256AE704EBF693DC320A7824C6B3F7E33D7C1F586A5AEE4
SHA-512:	5FBA8489D2BEDDE90ED0CCF3BB0893CAA44EC70E9253B75C92C190B08C56F517ED908FFB07A203A0A2DF1CC92AE0866A69C118DB8B7725988AFA5109BE37DDBF
Malicious:	false
Preview:	# This file is used with the GYP meta build system..# http://code.google.com/p/gyp.# To build try this:.# svn co http://gyp.googlecode.com/svn/trunk gyp.# ./gyp/gyp -f make --depth=`pwd` libffi.gyp.# make.# ./out/Debug/test..{. 'variables': {. 'target_arch%': 'ia32', # built for a 32-bit CPU by default. },. 'target_defaults': {. 'default_configuration': 'Debug',. 'configurations': {. # TODO: hoist these out and put them somewhere common, because. # RuntimeLibrary MUST MATCH across the entire project. 'Debug': {. 'defines': [ 'DEBUG', '_DEBUG' ],. 'msvs_settings': {. 'VCCLCompilerTool': {. 'RuntimeLibrary': 1, # static debug. },. },. },. 'Release': {. 'defines': [ 'NDEBUG' ],. 'msvs_settings': {. 'VCCLCompilerTool': {. 'RuntimeLibrary': 0, # static release. },. },. }. },. 'msvs_settings': {. 'VCCLCompilerTool': {. },.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\libffi.map.in

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.174336852687287
Encrypted:	false
SSDEEP:	24:DQzYSGwn2ld8s/+5vtr8sWYwrey3nKU8d8szJXQ7MeMEMopv5Xj9:DNSV2ld8s/gtr8sWYwrey3Md8szJXQIk
MD5:	DC96B7E95C692E5CF63583915544CD48
SHA1:	A44288202A772BDB82D40CDAEBF0E1702D0D4624
SHA-256:	416D4D3D6B27EDB72B509EE2036853FEA82B286806F289330DE4AB30CCCDC984
SHA-512:	19AA079BF032CEA6A03BD021A3E6878724F2A7B52FBF4A4C39FBAC902679801CD16BF205E9F2134D0EE600705EE8D7DF919132BFAA13782D5B7E619AC3D6976F
Malicious:	false
Preview:	#define LIBFFI_ASM.#define LIBFFI_H.#include <fficonfig.h>.#include <ffitarget.h>../* These version numbers correspond to the libtool-version abi numbers,. not to the libffi release numbers. /..LIBFFI_BASE_7.0 {. global:../ Exported data variables. /..ffi_type_void;..ffi_type_uint8;..ffi_type_sint8;..ffi_type_uint16;..ffi_type_sint16;..ffi_type_uint32;..ffi_type_sint32;..ffi_type_uint64;..ffi_type_sint64;..ffi_type_float;..ffi_type_double;..ffi_type_longdouble;..ffi_type_pointer;.../ Exported functions. /..ffi_call;..ffi_prep_cif;..ffi_prep_cif_var;...ffi_raw_call;..ffi_ptrarray_to_raw;..ffi_raw_to_ptrarray;..ffi_raw_size;...ffi_java_raw_call;..ffi_java_ptrarray_to_raw;..ffi_java_raw_to_ptrarray;..ffi_java_raw_size;.. local:..;.};..LIBFFI_BASE_7.1 {. global:..ffi_get_struct_offsets;.} LIBFFI_BASE_7.0;..#ifdef FFI_TARGET_HAS_COMPLEX_TYPE.LIBFFI_COMPLEX_7.0 {. global:../* Exported data variables. */..ffi_type_complex_float;..ffi_type_complex_double;..ffi_type_complex_long

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\libffi.pc.in

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.942552583309069
Encrypted:	false
SSDEEP:	6:iDLzSNnXIciOWEWiUa6XYMe6XZY+ORFq7yD7UbKck30gISWikpLa6XCn:i/Gp1iFDilJ/yYpK7y6Kck30g4iILah
MD5:	AD82C93BB7F9710EE5D0F0E9AF25E51D
SHA1:	6E5B332139C051C65ABF8ED03801605BE25A1015
SHA-256:	0828AA34E7D8BF5C8007E897CE12459912E7EE491E1C17377432C8BF204704BE
SHA-512:	0D98B342882FBF21E6F511C120E1C899A04D607C5F7153861D89463B7752278A41FE15D27DBD237D8013ECBBF7FB6F1B324FE5C320E90624E6D00277E89C3359
Malicious:	false
Preview:	prefix=@prefix@.exec_prefix=@exec_prefix@.libdir=@libdir@.toolexeclibdir=@toolexeclibdir@.includedir=@includedir@..Name: @PACKAGE_NAME@.Description: Library supporting Foreign Function Interfaces.Version: @PACKAGE_VERSION@.Libs: -L${toolexeclibdir} -lffi.Cflags: -I${includedir}.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\libffi.xcodeproj\project.pbxproj

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	51468
Entropy (8bit):	5.66151891994109
Encrypted:	false
SSDEEP:	768:qWpWugaG7gMVczLKd91214QXyGfCknqT6IgsY3pef9Xuo:s7gdidf214zUtCSw1eo
MD5:	FF7284D1DD4DC104D66F0EA0EB8F0DCF
SHA1:	01732BBEAD2A0106EDEE08D19D85240857DF77B7
SHA-256:	488BFCD6A2EB169DC302E6EFAE90C6C84CFC72496EAB1CBD4520E9CC6542CD0D
SHA-512:	A2A34608DACD16E8B54AEF22D81453C91DD16BBFEFD4F579CE94913FA90FBE03149BD7B0041D3D0DCC43B02CB72B2D27B2D6EA14C3E2D3CFDD4E0999C54A9845
Malicious:	false
Preview:	// !$UTF8$!.{..archiveVersion = 1;..classes = {..};..objectVersion = 46;..objects = {../* Begin PBXBuildFile section /...43B5D3F81D35473200D1E1FD / ffiw64_x86_64.c in Sources / = {isa = PBXBuildFile; fileRef = 43B5D3F71D35473200D1E1FD / ffiw64_x86_64.c /; };...43B5D3FA1D3547CE00D1E1FD / win64_x86_64.S in Sources / = {isa = PBXBuildFile; fileRef = 43B5D3F91D3547CE00D1E1FD / win64_x86_64.S /; };...43E9A5C71D352C1500926A8F / sysv_i386.S in Sources / = {isa = PBXBuildFile; fileRef = 43E9A5C51D352C1500926A8F / sysv_i386.S /; };...43E9A5C81D352C1500926A8F / unix64_x86_64.S in Sources / = {isa = PBXBuildFile; fileRef = 43E9A5C61D352C1500926A8F / unix64_x86_64.S /; };...DBFA714A187F1D8600A76262 / ffi.h in Headers / = {isa = PBXBuildFile; fileRef = DBFA713E187F1D8600A76262 / ffi.h /; };...DBFA714B187F1D8600A76262 / ffi_common.h in Headers / = {isa = PBXBuildFile; fileRef = DBFA713F187F1D8600A76262 / ffi_common.h /; };...DBFA714C187F1D8600A76262 / fficonfig.h in Heade

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\libtool-ldflags

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3370
Entropy (8bit):	4.843134677379592
Encrypted:	false
SSDEEP:	48:3iuyzHyUjH6m7tNflAjE+V/UM2v73yKTqbKK0jdp0wnXD7BGzowaKsU+4gDKXv87:SNzb5pxlAah732Y2GnBQaKsUjWCHMzNH
MD5:	18097D974D6F6A830C12C42592F0006D
SHA1:	3E14BF9D6CBF7ED0F31652A64404E9D0608DBF91
SHA-256:	953D3A071DD9C49B5B066BD9AA6CABF8B003219F0419E211574964272672E1F5
SHA-512:	F3E9552DDABFA79E40E281D3124DD2AC1175734ACCF4628B45E1F1DCE1F2C1BA203FFD98C9CF320133363FA8E6C3C4460CFD348D242C2D96CB854AB1B9F1E004
Malicious:	false
Preview:	#! /bin/sh..# Script to translate LDFLAGS into a form suitable for use with libtool...# Copyright (C) 2005 Free Software Foundation, Inc..#.# This file is free software; you can redistribute it and/or modify.# it under the terms of the GNU General Public License as published by.# the Free Software Foundation; either version 2 of the License, or.# (at your option) any later version..# .# This program is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.# GNU General Public License for more details..# .# You should have received a copy of the GNU General Public License.# along with this program; if not, write to the Free Software.# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, .# MA 02110-1301, USA. ..# Contributed by CodeSourcery, LLC...# This script is designed to be used from a Makefile that uses libtool.# to build libraries as follows: .#.# LTL

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\libtool-version

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	4.530486383320552
Encrypted:	false
SSDEEP:	24:qKFPTqUpqfeSHUKOPVoZUb8+CSR5bS6x2MLHHkyrDeTHyAwap:xFPTPkmoLFVSy6AMLk7Rv
MD5:	FCC1AA39145D19118FE4C3AA370DB144
SHA1:	FB9BCD3167CBC62D6A531E02105A647B3CCD3A55
SHA-256:	F8F45635942E9C2D57B7325696B54F550CD9DF7777441068F62A41D9F89CB668
SHA-512:	437B78A280BB0C52876EF398106A6A5FA954DD68D56A2F713F0817E70EA9BFC0F900DB2FE7A7149F2D0A48C9105935E0AC527C5E07A500E9BA43D8C602E723EE
Malicious:	false
Preview:	# This file is used to maintain libtool version info for libffi. See.# the libtool manual to understand the meaning of the fields. This is.# a separate file so that version updates don't involve re-running.# automake..#.# Here are a set of rules to help you update your library version.# information:.# .# 1. Start with version information of `0:0:0' for each libtool library..#.# 2. Update the version information only immediately before a public.# release of your software. More frequent updates are unnecessary,.# and only guarantee that the current interface number gets larger.# faster..#.# 3. If the library source code has changed at all since the last.# update, then increment revision (`c:r:a' becomes `c:r+1:a')..#.# 4. If any interfaces have been added, removed, or changed since the.# last update, increment current, and set revision to 0..#.# 5. If any interfaces have been added since the last public release,.# then increment age..#.# 6. If any interfaces have been

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\ltmain.sh

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	324089
Entropy (8bit):	5.010182501900258
Encrypted:	false
SSDEEP:	6144:EMiSRg49MWrCom5FzLQmoMuMBhmQptqyUjFjasypWpCZl+JRKT2MBFpfJYTt/Wfm:uB3j+hC+
MD5:	DF0F18E33BA4242FF9DFF54FECE82D8C
SHA1:	6871957156B07AE46E5F75DA9510A56C79B45C76
SHA-256:	34FFAA53E9BECCCCE1CEE4F149A3B1CBBA3C4CDA06AB7DFAF1AE905EA4B2C0E3
SHA-512:	3F225C24AACFF5B7708B7DE3B6B31ABB4623674F01732F795CDED9E21A205DC29392F4F5CB023D9C09D2E8FF81615150D4B9D5E1CCD09DBAB18857CF26335933
Malicious:	false
Preview:	#! /bin/sh.## DO NOT EDIT - This file generated from ./build-aux/ltmain.in.## by inline-source v2014-01-03.01..# libtool (GNU libtool) 2.4.6.# Provide generalized library-building support services..# Written by Gordon Matzigkeit <gord@gnu.ai.mit.edu>, 1996..# Copyright (C) 1996-2015 Free Software Foundation, Inc..# This is free software; see the source for copying conditions. There is NO.# warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE...# GNU Libtool is free software; you can redistribute it and/or modify.# it under the terms of the GNU General Public License as published by.# the Free Software Foundation; either version 2 of the License, or.# (at your option) any later version..#.# As a special exception to the GNU General Public License,.# if you distribute this file as part of a program or library that.# is built using GNU Libtool, you may include this file under the.# same distribution terms that you use for the rest of that program..#.#

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\m4\asmcfi.m4

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	467
Entropy (8bit):	5.161016688745154
Encrypted:	false
SSDEEP:	12:L1hboZT5b67M4tE5cqWJbm1JJF/9twm3n:L1hbu5b6KcqW81J4On
MD5:	E7DB107F0174B047DBF238BE1CDD0C8C
SHA1:	E2BFB86B72AAE7577880CB06F19BEB5ADCB1BDDC
SHA-256:	370D6BD9896C51201BEC2DA86CBA7034B1F61E224D9E2AB255AA4B61B04AF8FB
SHA-512:	8C51675CF5C2F2EDCFBA7C52A3A4A9DFB6549A040404F61EF99C9D6B672ED4BCBAE0A5E8B466D2A54640643F9E90B7EE1967E916483C2BAEC194099FE9FBBA78
Malicious:	false
Preview:	AC_DEFUN([GCC_AS_CFI_PSEUDO_OP],.[AC_CACHE_CHECK([assembler .cfi pseudo-op support],. gcc_cv_as_cfi_pseudo_op, [. gcc_cv_as_cfi_pseudo_op=unknown. AC_TRY_COMPILE([asm (".cfi_sections\n\t.cfi_startproc\n\t.cfi_endproc");],,... [gcc_cv_as_cfi_pseudo_op=yes],... [gcc_cv_as_cfi_pseudo_op=no]). ]). if test "x$gcc_cv_as_cfi_pseudo_op" = xyes; then. AC_DEFINE(HAVE_AS_CFI_PSEUDO_OP, 1,.. [Define if your assembler supports .cfi_* directives.]). fi.]).

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\m4\ax_append_flag.m4

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1552
Entropy (8bit):	5.29941378457092
Encrypted:	false
SSDEEP:	24:Mj4mOdNqlL8uH3eM8vEJbeGXTMrhRu8KOnmbCFIS1/n6u:Mj4mYy8uX9dQ1RWOnFX5nb
MD5:	703F71A3D5303F3F72FC19A64A41EB72
SHA1:	27B97E29746CA5684DEFB1918097B565CEC9EB0D
SHA-256:	392CB0E965351B1D6A9847CF165DC4092FB1853FD63DBE010AC8B21C286F5E16
SHA-512:	81DF10715391998BA7D19A9B04D7110C3EEB3C97E493C72FBC18E29F47BE3134BFB4A67784A217D44B2EC184B400725717C33D2E321933E9351CCF30868827BC
Malicious:	false
Preview:	# ===========================================================================.# https://www.gnu.org/software/autoconf-archive/ax_append_flag.html.# ===========================================================================.#.# SYNOPSIS.#.# AX_APPEND_FLAG(FLAG, [FLAGS-VARIABLE]).#.# DESCRIPTION.#.# FLAG is appended to the FLAGS-VARIABLE shell variable, with a space.# added in between..#.# If FLAGS-VARIABLE is not specified, the current language's flags (e.g..# CFLAGS) is used. FLAGS-VARIABLE is not changed if it already contains.# FLAG. If FLAGS-VARIABLE is unset in the shell, it is set to exactly.# FLAG..#.# NOTE: Implementation based on AX_CFLAGS_GCC_OPTION..#.# LICENSE.#.# Copyright (c) 2008 Guido U. Draheim <guidod@gmx.de>.# Copyright (c) 2011 Maarten Bosmans <mkbosmans@gmail.com>.#.# Copying and distribution of this file, with or without modification, are.# permitted in any medium without royalty provided the copyright notice.# and this notice are

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\m4\ax_cc_maxopt.m4

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8127
Entropy (8bit):	5.170132338630893
Encrypted:	false
SSDEEP:	192:RyMEEav/Y4S0zhtVoHgapt7I0UAdR2j/IpQ9:RTsv/Y4S0zhtVtapt7I0vdRo9
MD5:	72AE15777B62631C81A4076EC5C1F59B
SHA1:	97867E86C6535D232F3936DF4FC1BEDBD8246677
SHA-256:	A63670B118B80379D34DFE33537048AEE23865E4A7FF80EECC528FDE2509078F
SHA-512:	61D1AD03AD3DAA554B62FD6715DD0A999DA0E7F56C0F6DDED5094B71E53E7402B0E7796AB382488AFC536D04C6208DB9C103CCC17009937410F704B94A4248B8
Malicious:	false
Preview:	# ===========================================================================.# https://www.gnu.org/software/autoconf-archive/ax_cc_maxopt.html.# ===========================================================================.#.# SYNOPSIS.#.# AX_CC_MAXOPT.#.# DESCRIPTION.#.# Try to turn on "good" C optimization flags for various compilers and.# architectures, for some definition of "good". (In our case, good for.# FFTW and hopefully for other scientific codes. Modify as needed.).#.# The user can override the flags by setting the CFLAGS environment.# variable. The user can also specify --enable-portable-binary in order to.# disable any optimization flags that might result in a binary that only.# runs on the host architecture..#.# Note also that the flags assume that ANSI C aliasing rules are followed.# by the code (e.g. for gcc's -fstrict-aliasing), and that floating-point.# computations can be re-ordered as needed..#.# Requires macros: AX_CHECK_COMPILE_FLAG, A

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\m4\ax_cflags_warn_all.m4

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5059
Entropy (8bit):	5.340092467522867
Encrypted:	false
SSDEEP:	96:MME8K9pehRQZRvsm4ctItBIZaCEaW3W2B6Zc:0HEeoaW31ec
MD5:	31C99701FABFB18CBCBCBA84B48772F3
SHA1:	2719019A6C08DAE7FFB840F96A60D6D6A7B5B4EB
SHA-256:	F698BD1B561A4E0EE1987B92CB77BB32E4F260319E44D677470DD3F8C82CCF58
SHA-512:	7246DC0ED820F9B7B97A3F50180E6287B740AFDEC16E20C9110D5489622CEBB6CD9023F37FCFBBE819A2F7CA0AA1FFF576C3C443AE33062A007ED9B0944E6A1E
Malicious:	false
Preview:	# ===========================================================================.# https://www.gnu.org/software/autoconf-archive/ax_cflags_warn_all.html.# ===========================================================================.#.# SYNOPSIS.#.# AX_CFLAGS_WARN_ALL [(shellvar [,default, [A/NA]])].# AX_CXXFLAGS_WARN_ALL [(shellvar [,default, [A/NA]])].# AX_FCFLAGS_WARN_ALL [(shellvar [,default, [A/NA]])].#.# DESCRIPTION.#.# Try to find a compiler option that enables most reasonable warnings..#.# For the GNU compiler it will be -Wall (and -ansi -pedantic) The result.# is added to the shellvar being CFLAGS, CXXFLAGS, or FCFLAGS by default..#.# Currently this macro knows about the GCC, Solaris, Digital Unix, AIX,.# HP-UX, IRIX, NEC SX-5 (Super-UX 10), Cray J90 (Unicos 10.0.0.8), and.# Intel compilers. For a given compiler, the Fortran flags are much more.# experimental than their C equivalents..#.# - $1 shell-variable-to-add-to : CFLAGS, CXXFLAGS, or FCFLAGS.#

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\m4\ax_check_compile_flag.m4

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	5.442282315958199
Encrypted:	false
SSDEEP:	48:Mz4fIG1XfejY0pi6k0jwh999SQ1Ry1fkCNh1I:MU1KY9f0jkXwcmK
MD5:	DFCF4BBEA8EFEABAAAF41D09136FB0DB
SHA1:	C3896088C00457E02059986BEC054BB35DBB23AE
SHA-256:	629DC6835EB1E2BD586FD842A4DB66541BC442BCC2B13D6F24907631C5A688B0
SHA-512:	31D695B3EA3022229C5C8E6091155936C629F3ED267260612B15EF846903F3CF6B20080960B9BC333479F4542551F88EC1DEC293001C9C89FC9015351A5C114E
Malicious:	false
Preview:	# ===========================================================================.# https://www.gnu.org/software/autoconf-archive/ax_check_compile_flag.html.# ===========================================================================.#.# SYNOPSIS.#.# AX_CHECK_COMPILE_FLAG(FLAG, [ACTION-SUCCESS], [ACTION-FAILURE], [EXTRA-FLAGS], [INPUT]).#.# DESCRIPTION.#.# Check whether the given FLAG works with the current language's compiler.# or gives an error. (Warnings, however, are ignored).#.# ACTION-SUCCESS/ACTION-FAILURE are shell commands to execute on.# success/failure..#.# If EXTRA-FLAGS is defined, it is added to the current language's default.# flags (e.g. CFLAGS) when the check is done. The check is thus made with.# the flags: "CFLAGS EXTRA-FLAGS FLAG". This can for example be used to.# force the compiler to issue an error when a bad flag is given..#.# INPUT gives an alternative input source to AC_COMPILE_IFELSE..#.# NOTE: Implementation based on AX_CFLAGS_GCC_OPTI

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\m4\ax_compiler_vendor.m4

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3641
Entropy (8bit):	4.9787517029693245
Encrypted:	false
SSDEEP:	96:MMWEwusm4cQyTwC6Yt/hB/b4YpbJLaewtxz:nECwClBMle8z
MD5:	B44F17F4D2E67A12C0EBFFD07B6AC68C
SHA1:	D69760BC527137915F44BC2758638322D6D4B0CF
SHA-256:	2F440C236D5EC743713C5608D84F9D337FB596F45F873CD5420C495094FD6E60
SHA-512:	D78C19CBA649AD170A2B022A99270E0A35656F49BBA763B061E92F07135D550927C70BF37B02FE52EE7B8CA9A2FE6AFB7DFA4AFCEB5635AEF4BDB588BD5EFE32
Malicious:	false
Preview:	# ===========================================================================.# https://www.gnu.org/software/autoconf-archive/ax_compiler_vendor.html.# ===========================================================================.#.# SYNOPSIS.#.# AX_COMPILER_VENDOR.#.# DESCRIPTION.#.# Determine the vendor of the C/C++ compiler, e.g., gnu, intel, ibm, sun,.# hp, borland, comeau, dec, cray, kai, lcc, metrowerks, sgi, microsoft,.# watcom, etc. The vendor is returned in the cache variable.# $ax_cv_c_compiler_vendor for C and $ax_cv_cxx_compiler_vendor for C++..#.# LICENSE.#.# Copyright (c) 2008 Steven G. Johnson <stevenj@alum.mit.edu>.# Copyright (c) 2008 Matteo Frigo.#.# This program is free software: you can redistribute it and/or modify it.# under the terms of the GNU General Public License as published by the.# Free Software Foundation, either version 3 of the License, or (at your.# option) any later version..#.# This program is distributed in the hope that it

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\m4\ax_configure_args.m4

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1657
Entropy (8bit):	5.072054015648052
Encrypted:	false
SSDEEP:	24:M749OUPADrV8wpxtqXlhlCYF/FrU3sq0+C802g1+OzVXGXTMrhRLrLBbz/G0uWtu:M7499AXubXlhlC0ForyfzYQ1RLXQktun
MD5:	C991E33536A4CEA5AD9C576BE6D2D4D0
SHA1:	A5DF52F794791A199BE659107D84D0A4CE801887
SHA-256:	6B03141F467EA653EED74BB4551DB6E376527426684A243A8E723D1AD11E30E9
SHA-512:	D017DD68404DDBCFE704F3C0B2CF893A3DD4CF28F00ECDA008D38D9B0F451740118400F825C33A7BFD1FAF8AC99DC10EB2800E7BDAA5102FCD2CFC19264268E9
Malicious:	false
Preview:	# ===========================================================================.# https://www.gnu.org/software/autoconf-archive/ax_configure_args.html.# ===========================================================================.#.# SYNOPSIS.#.# AX_CONFIGURE_ARGS.#.# DESCRIPTION.#.# Helper macro for AX_ENABLE_BUILDDIR..#.# The traditional way of starting a subdir-configure is running the script.# with ${1+"$@"} but since autoconf 2.60 this is broken. Instead we have.# to rely on eval'ing $ac_configure_args however some old autoconf.# versions do not provide that. To ensure maximum portability of autoconf.# extension macros this helper can be AC_REQUIRE'd so that.# $ac_configure_args will always be present..#.# Sadly, the traditional "exec $SHELL" of the enable_builddir macros is.# spoiled now and must be replaced by "eval + exit $?"..#.# Example:.#.# AC_DEFUN([AX_ENABLE_SUBDIR],[dnl.# AC_REQUIRE([AX_CONFIGURE_ARGS])dnl.# eval $SHELL $ac_configure_

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\m4\ax_enable_builddir.m4

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	13216
Entropy (8bit):	5.4107705918882845
Encrypted:	false
SSDEEP:	384:MYcUc1GQ4WOS7fewoicLa7V36jn+upTIuPdA3nEki6F+:V/Ih4WOSbeKcLa7V36jn+upTbPdAXEka
MD5:	8793BFB0D51A719CA436FCF3F0B20A02
SHA1:	D8E33891591FD7ACDCBE19177940DCE08DD4A20E
SHA-256:	E63154501A33A7DBA2621E14744F490482E1BC59AE7C7DE2E53915BA8642F30D
SHA-512:	298CFD37C3477A54AB5A08AD2A9616A982347C8A9D05D7EA9CDA9E9BE133529AA7B1FEA21086DD25AABD0521D6682E9AF7FC391FF6F18EC6311733F8BC49C652
Malicious:	false
Preview:	# ===========================================================================.# https://www.gnu.org/software/autoconf-archive/ax_enable_builddir.html.# ===========================================================================.#.# SYNOPSIS.#.# AX_ENABLE_BUILDDIR [(dirstring-or-command [,Makefile.mk [,-all]])].#.# DESCRIPTION.#.# If the current configure was run within the srcdir then we move all.# configure-files into a subdir and let the configure steps continue.# there. We provide an option --disable-builddir to suppress the move into.# a separate builddir..#.# Defaults:.#.# $1 = $host (overridden with $HOST).# $2 = Makefile.mk.# $3 = -all.#.# This macro must be called before AM_INIT_AUTOMAKE. It creates a default.# toplevel srcdir Makefile from the information found in the created.# toplevel builddir Makefile. It just copies the variables and.# rule-targets, each extended with a default rule-execution that recurses.# into the build directory of

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\m4\ax_gcc_archflag.m4

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	13171
Entropy (8bit):	5.386993727923716
Encrypted:	false
SSDEEP:	192:+8LEo0oe1GidSeHFEeKapv77NqahtDV6cMCB86GlSFlH5Bp2pxrGSzyGhmGLhgV+:+8Lh0T1TdSk4apv3NqwVZMCBKXyfEhSg
MD5:	69D0061DBF73A2050E2C1EED62B7B154
SHA1:	0877D96EC37F13494AF1C0E804782204E426AE0E
SHA-256:	14FAE97A5F044E8B5125638A54ED43BE2E090C52771AA4955262727437E78FDB
SHA-512:	F19FEB5266987BFC4292AF7FA795EAD07EE47D0907C1B26D47E29ABD5C9EA3576FA5CA7C7F53485170976DDF74535350B874D0273AA827E0E6C6219BD72664AD
Malicious:	false
Preview:	# ===========================================================================.# https://www.gnu.org/software/autoconf-archive/ax_gcc_archflag.html.# ===========================================================================.#.# SYNOPSIS.#.# AX_GCC_ARCHFLAG([PORTABLE?], [ACTION-SUCCESS], [ACTION-FAILURE]).#.# DESCRIPTION.#.# This macro tries to guess the "native" arch corresponding to the target.# architecture for use with gcc's -march=arch or -mtune=arch flags. If.# found, the cache variable $ax_cv_gcc_archflag is set to this flag and.# ACTION-SUCCESS is executed; otherwise $ax_cv_gcc_archflag is set to.# "unknown" and ACTION-FAILURE is executed. The default ACTION-SUCCESS is.# to add $ax_cv_gcc_archflag to the end of $CFLAGS..#.# PORTABLE? should be either [yes] (default) or [no]. In the former case,.# the flag is set to -mtune (or equivalent) so that the architecture is.# only used for tuning, but the instruction set used is still portable. In.# the latter

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\m4\ax_gcc_x86_cpuid.m4

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3703
Entropy (8bit):	5.165205951102255
Encrypted:	false
SSDEEP:	96:M+Hh96t4msK8+7qdYO3Ol0sm4c6/tApIkjV8ae0Bfu:Nh96JsK8QOB3VEDepIa8au
MD5:	AD8EDCCAEA3295E08080BF141FD92399
SHA1:	C1F9DF619E1755651742925860377AEC58E802F6
SHA-256:	EBA1884E575CB1E6E4174777FD708893982C355FF9D07F6CB0AA59D0FD66DE0B
SHA-512:	4EDC3ACF44A205BA4C413038AB2B7AE242C6DAE3B4D87EF618E68B3C8BBD38F0B272130E31B00E621BE2E2E55B33E6CC22B0656344944D008DE30C0A04FAB9E7
Malicious:	false
Preview:	# ===========================================================================.# https://www.gnu.org/software/autoconf-archive/ax_gcc_x86_cpuid.html.# ===========================================================================.#.# SYNOPSIS.#.# AX_GCC_X86_CPUID(OP).# AX_GCC_X86_CPUID_COUNT(OP, COUNT).#.# DESCRIPTION.#.# On Pentium and later x86 processors, with gcc or a compiler that has a.# compatible syntax for inline assembly instructions, run a small program.# that executes the cpuid instruction with input OP. This can be used to.# detect the CPU type. AX_GCC_X86_CPUID_COUNT takes an additional COUNT.# parameter that gets passed into register ECX before calling cpuid..#.# On output, the values of the eax, ebx, ecx, and edx registers are stored.# as hexadecimal strings as "eax:ebx:ecx:edx" in the cache variable.# ax_cv_gcc_x86_cpuid_OP..#.# If the cpuid instruction fails (because you are running a.# cross-compiler, or because you are not using gcc, or becau

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\m4\ax_require_defined.m4

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1218
Entropy (8bit):	5.101199116792353
Encrypted:	false
SSDEEP:	24:M74IO/LPm6f2aVWfE/WX6Df3lRLGX/MrhRh8E3FvbuSv:M74IyOWHWZ6Dq01R7R
MD5:	EF9E850B28E8776BD224D3743B87884F
SHA1:	33B3DFA713406F881A0D8C1B0134E659642AF8B8
SHA-256:	D870B21E817747C6A61A9DD72E06EA45F87E012C7A1A9AA5FF90CD3AF89B3774
SHA-512:	586003252230E05C915F71AB5449B63E8E8FF68DE8D37236DFD7E4C3E76B5F454A8C0965C606EDC4E534BE241EA39F02A9CD9E6F3B3EFC833C89C513F4EAC1C2
Malicious:	false
Preview:	# ===========================================================================.# https://www.gnu.org/software/autoconf-archive/ax_require_defined.html.# ===========================================================================.#.# SYNOPSIS.#.# AX_REQUIRE_DEFINED(MACRO).#.# DESCRIPTION.#.# AX_REQUIRE_DEFINED is a simple helper for making sure other macros have.# been defined and thus are available for use. This avoids random issues.# where a macro isn't expanded. Instead the configure script emits a.# non-fatal:.#.# ./configure: line 1673: AX_CFLAGS_WARN_ALL: command not found.#.# It's like AC_REQUIRE except it doesn't expand the required macro..#.# Here's an example:.#.# AX_REQUIRE_DEFINED([AX_CHECK_LINK_FLAG]).#.# LICENSE.#.# Copyright (c) 2014 Mike Frysinger <vapier@gentoo.org>.#.# Copying and distribution of this file, with or without modification, are.# permitted in any medium without royalty provided the copyright notice.# and this notice are pr

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\m4\libtool.m4

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	305414
Entropy (8bit):	5.400739444727929
Encrypted:	false
SSDEEP:	6144:3wSQSlrBHFjOvwYAU/Fkgi/2WDg5+YaNk5xcHrYw+Zg+XrZsGEREYRGAFU25ttR/:etM7E0L4q
MD5:	507376106BEEEB6B07E10F41C8CFD678
SHA1:	C7B543D7622CEF397AC05830C65BB0A17AAB4ED4
SHA-256:	69C28D3EC923E91024567A9385FB32D890FFE8192D1ECB1F6AB729F8A4AC11FE
SHA-512:	F270105584FBF0CC9DFF5DFA9196924247F1CAC7DF0D95F19FA83B98D49F65E70F925A4267C0E17868669F33C773279A3EEA5C54A5533D9E0D7EEED023492896
Malicious:	false
Preview:	# libtool.m4 - Configure libtool for the host system. --Autoconf--.#.# Copyright (C) 1996-2001, 2003-2015 Free Software Foundation, Inc..# Written by Gordon Matzigkeit, 1996.#.# This file is free software; the Free Software Foundation gives.# unlimited permission to copy and/or distribute it, with or without.# modifications, as long as this notice is preserved...m4_define([_LT_COPYING], [dnl.# Copyright (C) 2014 Free Software Foundation, Inc..# This is free software; see the source for copying conditions. There is NO.# warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE...# GNU Libtool is free software; you can redistribute it and/or modify.# it under the terms of the GNU General Public License as published by.# the Free Software Foundation; either version 2 of of the License, or.# (at your option) any later version..#.# As a special exception to the GNU General Public License, if you.# distribute this file as part of a program or library that is built.# u

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\m4\ltoptions.m4

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	14514
Entropy (8bit):	5.481459276318382
Encrypted:	false
SSDEEP:	384:LAQWCokY+/3Er/VKuLyuximwMiADWSIyySrgruaAw8/ww:LAQWCokYYUr3hikuPbHAxT
MD5:	064AF1799FEBAA676203302BBF359180
SHA1:	9CD35D79DA7776AF14F21B259C64F130FA1A3536
SHA-256:	E77EBBA8361B36F14B4D0927173A034B98C5D05049697A9DED84D85EB99A7990
SHA-512:	C5B6F78D203BBDCA41C94DFD3798A31C62CA23521BFE7E106EC3FAC8EAE44612DE3361DF2DAF61F5651B3C1A46039B8F3F67BD3D086E771A32E134AFCF35593A
Malicious:	false
Preview:	# Helper functions for option handling. -- Autoconf --.#.# Copyright (C) 2004-2005, 2007-2009, 2011-2015 Free Software.# Foundation, Inc..# Written by Gary V. Vaughan, 2004.#.# This file is free software; the Free Software Foundation gives.# unlimited permission to copy and/or distribute it, with or without.# modifications, as long as this notice is preserved...# serial 8 ltoptions.m4..# This is to help aclocal find these macros, as it can't see m4_define..AC_DEFUN([LTOPTIONS_VERSION], [m4_if([1])])...# _LT_MANGLE_OPTION(MACRO-NAME, OPTION-NAME).# ------------------------------------------.m4_define([_LT_MANGLE_OPTION],.[[_LT_OPTION_]m4_bpatsubst($1__$2, [[^a-zA-Z0-9_]], [_])])...# _LT_SET_OPTION(MACRO-NAME, OPTION-NAME).# ---------------------------------------.# Set option OPTION-NAME for macro MACRO-NAME, and if there is a.# matching handler defined, dispatch to it. Other OPTION-NAMEs are.# saved as a flag..m4_define([_LT_SET_OPTION],.[m4_define(_LT_MANGL

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\m4\ltsugar.m4

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4384
Entropy (8bit):	5.269339484442745
Encrypted:	false
SSDEEP:	96:Tyl8A0PS/gZw+KZFCazK35MKf5VfzKI8x8htod3co5E79:ul8AQ2gZRkCam35MGVfur+
MD5:	FA2891F9060865871CBBAA1C6E2D96F4
SHA1:	2028BFFADFD9B989BCC63DA90596101FE4EC20B9
SHA-256:	5A6735CDA60E0BA0D1B706C0EF648F5D096298DA46DAEFD9CDECDB6A0F4584D3
SHA-512:	53AAD0A3767CDF88AC6C40FD8B9A1C26678B828F68C5CA9973289F762F11B1A66464464242A479B479AED9E49629DF439979504198EA55E9398FC48D120051DD
Malicious:	false
Preview:	# ltsugar.m4 -- libtool m4 base layer. --Autoconf--.#.# Copyright (C) 2004-2005, 2007-2008, 2011-2015 Free Software.# Foundation, Inc..# Written by Gary V. Vaughan, 2004.#.# This file is free software; the Free Software Foundation gives.# unlimited permission to copy and/or distribute it, with or without.# modifications, as long as this notice is preserved...# serial 6 ltsugar.m4..# This is to help aclocal find these macros, as it can't see m4_define..AC_DEFUN([LTSUGAR_VERSION], [m4_if([0.1])])...# lt_join(SEP, ARG1, [ARG2...]).# -----------------------------.# Produce ARG1SEPARG2...SEPARGn, omitting [] arguments and their.# associated separator..# Needed until we can rely on m4_join from Autoconf 2.62, since all earlier.# versions in m4sugar had bugs..m4_define([lt_join],.[m4_if([$#], [1], [],. [$#], [2], [[$2]],. [m4_if([$2], [], [], [[$2]_])$0([$1], m4_shift(m4_shift($@)))])]).m4_define([_lt_join],.[m4_if([$#$2], [2], [],. [m4_if([$2], [],

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\m4\ltversion.m4

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	699
Entropy (8bit):	5.344225468240668
Encrypted:	false
SSDEEP:	12:teKlwOLiF/OxGUYYZSowPUpMK3ecfFPwQGvt30tDADQGvxxl7PmGZA6wAdCQpff+:tYF/j28omEpYQKt30tyQKrl7PmGZBwa0
MD5:	D936FD6B2025C9B5322F826117D7F30C
SHA1:	3AAE847C163FA6CC7C8241A3A49F98705538D55F
SHA-256:	A27B754709DE61575197BF5A980696C98AE49DA3F92F0DE8EE7F42DD543B7465
SHA-512:	26D40427460F23D6F3DA0845E9BD9C8158D042146F7D60B2E27873FD87FA41E09DCF291A97BA638FD3DD8D1CEA4FC695499BC1F3BDA98A10CDEE94308193991A
Malicious:	false
Preview:	# ltversion.m4 -- version numbers...-- Autoconf --.#.# Copyright (C) 2004, 2011-2015 Free Software Foundation, Inc..# Written by Scott James Remnant, 2004.#.# This file is free software; the Free Software Foundation gives.# unlimited permission to copy and/or distribute it, with or without.# modifications, as long as this notice is preserved...# @configure_input@..# serial 4179 ltversion.m4.# This file is part of GNU Libtool..m4_define([LT_PACKAGE_VERSION], [2.4.6]).m4_define([LT_PACKAGE_REVISION], [2.4.6])..AC_DEFUN([LTVERSION_VERSION],.[macro_version='2.4.6'.macro_revision='2.4.6'._LT_DECL(, macro_version, 0, [Which release of libtool.m4 was used?])._LT_DECL(, macro_revision, 0).]).

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\m4\lt~obsolete.m4

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6140
Entropy (8bit):	5.408031362723526
Encrypted:	false
SSDEEP:	96:3S3AlYz+3dZB4D9RMu/ze+RCynmG1PdKTKH+6Mr9gMg4fAkXkNbsBf/6q6qn2Xny:i3AFvTu/mXUDh+
MD5:	22AA295BF5320AEC7FBA6756FF11058A
SHA1:	E21F085615F98D3751690C1615923E89160D5783
SHA-256:	26FA3285C35DD6AB00ED1E466BA92A17E4655E01897731EC18A587A4CF5E4F8D
SHA-512:	9A1CA5AC43A62E0B9100906B167280EB8A327329DDCA49A16E128CE91517617E8F64FE398B933AAE66312BFE5A3CA813BDB26936F99763B99A647F79A3CA213E
Malicious:	false
Preview:	# lt~obsolete.m4 -- aclocal satisfying obsolete definitions. --Autoconf--.#.# Copyright (C) 2004-2005, 2007, 2009, 2011-2015 Free Software.# Foundation, Inc..# Written by Scott James Remnant, 2004..#.# This file is free software; the Free Software Foundation gives.# unlimited permission to copy and/or distribute it, with or without.# modifications, as long as this notice is preserved...# serial 5 lt~obsolete.m4..# These exist entirely to fool aclocal when bootstrapping libtool..#.# In the past libtool.m4 has provided macros via AC_DEFUN (or AU_DEFUN),.# which have later been changed to m4_define as they aren't part of the.# exported API, or moved to Autoconf or Automake where they belong..#.# The trouble is, aclocal is a bit thick. It'll see the old AC_DEFUN.# in /usr/share/aclocal/libtool.m4 and remember it, then when it sees us.# using a macro with the same name in our local m4/libtool.m4 it'll.# pull the old libtool.m4 in (it doesn't see our shiny new m4_define.# and doe

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\make_sunver.pl

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9021
Entropy (8bit):	5.176964299423426
Encrypted:	false
SSDEEP:	192:dMMvh9MwUkgzwc0waa7su5N7DxCy/Ntswq:dMO9MwUHiuj3gwq
MD5:	652B57F03F525E02CEAC3DEE8F672204
SHA1:	9AA6529B2FFF4BE3C5DEBBCE95B08E08639439F5
SHA-256:	CA40D3458893E03A90807BE87D720A59E921EE6BF678C6696779D635004A261F
SHA-512:	301CE4D71B966CB4AB3259AF36ED399215F0A1F62569F092D3B3192EC108BDF8BCFAF2A231A7FC3EACEB5A26F3C3DC7C0D759757EB01F01FA8FB7220BD9E20E2
Malicious:	false
Preview:	#!/usr/bin/perl -w..# make_sunver.pl.#.# This script takes at least two arguments, a GNU style version script and.# a list of object and archive files, and generates a corresponding Sun.# style version script as follows:.#.# Each glob pattern, C++ mangled pattern or literal in the input script is.# matched against all global symbols in the input objects, emitting those.# that matched (or nothing if no match was found)..# A comment with the original pattern and its type is left in the output.# file to make it easy to understand the matches..#.# It uses elfdump when present (native), GNU readelf otherwise..# It depends on the GNU version of c++filt, since it must understand the.# GNU mangling style...use FileHandle;.use IPC::Open2;..# Enforce C locale..$ENV{'LC_ALL'} = "C";.$ENV{'LANG'} = "C";..# Input version script, GNU style..my $symvers = shift;..##########.# Get all the symbols from the library, match them, and add them to a hash...my %sym_hash = ();..# List of objects and archives

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\man\Makefile.am

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	207
Entropy (8bit):	4.7510960398545565
Encrypted:	false
SSDEEP:	3:RFdCRFR7BAFPRRpAIks/qZL3g/hhLAeK7+fbGF5fbmqLovIjiFcMLAeK7+fbGF5I:jd8FF2F/IhGhE+q/hMvGm9O+q/hMvn
MD5:	ADE48C43A4229988450151E8D3FD4EA2
SHA1:	6470506B1F62CFDA35613C53269879B1667C6837
SHA-256:	D9CBD9CF52FEC3D4E9F1B4694CE1915D05DEE93D8D9817447DD63648B4577DF9
SHA-512:	E879D3923E84E019EE8D20B047114D5CBD239FB514B0B63F5ABACA4450CE6BBBF746913988CE4D8B24EDBD8396D02140E430793BBF1809730EEC0BC2360D721C
Malicious:	false
Preview:	## Process this with automake to create Makefile.in..AUTOMAKE_OPTIONS=foreign..EXTRA_DIST = ffi.3 ffi_call.3 ffi_prep_cif.3 ffi_prep_cif_var.3..man_MANS = ffi.3 ffi_call.3 ffi_prep_cif.3 ffi_prep_cif_var.3..

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\man\Makefile.in

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	16617
Entropy (8bit):	5.553057997913385
Encrypted:	false
SSDEEP:	384:wpqpDu6TSKW8QA+GDuWAbwdlJgaQM21d33DqSNt2QPa4tMaEjjg2wg2HK70ZgdbC:cqpDBTSKW84GDuWAbwfJgai33FNt2QPR
MD5:	732F0888352C42CF22C5F4DC9D122ABC
SHA1:	D900156EA1C31E255692C96163B9A3B96E4BBF76
SHA-256:	9376CE792D7766FDC31D31A7ECDBEA4B14C0B3363C4655AD9AA164B3533EC1E7
SHA-512:	396CEA7EE2394834BAD451684B72A22ECF1A8A5BB77097AA3A0FF20D8C48CDBE3829088666D02B168F1B04D5CCDB3004DDD2A3CFC5F91FCD905B55887D3BC9EB
Malicious:	false
Preview:	# Makefile.in generated by automake 1.16.3 from Makefile.am..# @configure_input@..# Copyright (C) 1994-2020 Free Software Foundation, Inc...# This Makefile.in is free software; the Free Software Foundation.# gives unlimited permission to copy and/or distribute it,.# with or without modifications, as long as this notice is preserved...# This program is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY, to the extent permitted by law; without.# even the implied warranty of MERCHANTABILITY or FITNESS FOR A.# PARTICULAR PURPOSE...@SET_MAKE@.VPATH = @srcdir@.am__is_gnu_make = { \. if test -z '$(MAKELEVEL)'; then \. false; \. elif test -n '$(MAKE_HOST)'; then \. true; \. elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \. true; \. else \. false; \. fi; \.}.am__make_running_with_option = \. case $${target_option-} in \. ?) ;; \. *) echo "am__make_running_with_option: internal error: invalid" \. "target option '$${tar

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\man\ffi.3

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	850
Entropy (8bit):	4.905203873668924
Encrypted:	false
SSDEEP:	24:Y4h0kJBK5Ch0kJFRBK5mhkF06M2oofp0Lmv0SHV:rGkDKAGkLDKsWF06M2XRmef
MD5:	375A858985EC2096671F484B1FE9B14B
SHA1:	B3795ECE35B3C5D1733D71B360EFC8CE7F8AEDFC
SHA-256:	AA4730E114C305943A2226A524ED8447DC6B66A184523999868E5433C2C9DE74
SHA-512:	DF55633B6264290C7F6F2BAF5BA8D62DE16E78186FC6A09CEFFFD29DD5F0F63C9E6DA326B6CEA0B4D125FD48BEEC15FB8FB7F4F9F240406A37F63FE678FD18D6
Malicious:	false
Preview:	.Dd February 15, 2008..Dt FFI 3..Sh NAME..Nm FFI..Nd Foreign Function Interface..Sh LIBRARY.libffi, -lffi..Sh SYNOPSIS..In ffi.h..Ft ffi_status..Fo ffi_prep_cif..Fa "ffi_cif cif"..Fa "ffi_abi abi"..Fa "unsigned int nargs"..Fa "ffi_type rtype"..Fa "ffi_type *atypes"..Fc..Ft void..Fo ffi_prep_cif_var..Fa "ffi_cif cif"..Fa "ffi_abi abi"..Fa "unsigned int nfixedargs"..Fa "unsigned int ntotalargs"..Fa "ffi_type rtype"..Fa "ffi_type atypes"..Fc..Ft void..Fo ffi_call..Fa "ffi_cif cif"..Fa "void (fn)(void)"..Fa "void rvalue"..Fa "void **avalue"..Fc..Sh DESCRIPTION.The foreign function interface provides a mechanism by which a function can.generate a call to another function at runtime without requiring knowledge of.the called function's interface at compile time...Sh SEE ALSO..Xr ffi_prep_cif 3 ,..Xr ffi_prep_cif_var 3 ,..Xr ffi_call 3.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\man\ffi_call.3

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2333
Entropy (8bit):	4.893088204314435
Encrypted:	false
SSDEEP:	48:aQWF06MQvXIwsb4XVAb19tY6VDn+T3mrb7uMR6LIhcHRfMKZvJ77MWHDZl8ra6c7:aQYXIw+Yu9PY2b7uMIXxZx77MWjXAa6G
MD5:	DD7B61F56E75A1D052DD10DC02AC4940
SHA1:	DE5093B413972F6F54F22959560C50E1724C2C8F
SHA-256:	2817CE7B78CB737D7B85B18B45899470F5F565F990D056D3D8CFABF6D779477F
SHA-512:	76FCABB595D286F2AE7526AF59648192A69EE896C901697A90CF346BD7B5DC6E33CA6535E4C13E62D8D6EF5B230614407860B36A77ABDFF3FF12059B93D0145E
Malicious:	false
Preview:	.Dd February 15, 2008..Dt ffi_call 3..Sh NAME..Nm ffi_call..Nd Invoke a foreign function...Sh SYNOPSIS..In ffi.h..Ft void..Fo ffi_call..Fa "ffi_cif cif"..Fa "void (fn)(void)"..Fa "void rvalue"..Fa "void *avalue"..Fc..Sh DESCRIPTION.The..Nm ffi_call.function provides a simple mechanism for invoking a function without.requiring knowledge of the function's interface at compile time...Fa fn.is called with the values retrieved from the pointers in the..Fa avalue.array. The return value from..Fa fn.is placed in storage pointed to by..Fa rvalue ...Fa cif.contains information describing the data types, sizes and alignments of the.arguments to and return value from..Fa fn ,.and must be initialized with..Nm ffi_prep_cif.before it is used with..Nm ffi_call ...Pp..Fa rvalue.must point to storage that is sizeof(ffi_arg) or larger for non-floating point.types. For smaller-sized return value types, the..Nm ffi_arg.or..Nm ffi_sarg.integral type must be used to hold.the return value...Sh EXAMPLES..

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\man\ffi_prep_cif.3

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1158
Entropy (8bit):	4.8836133722198865
Encrypted:	false
SSDEEP:	24:r3h0kJBK5VgxIXsRMdILZzIUFE0tVcY8ay0sa4A0LR5+:r3GkDKjgxO8Md2pIUFE0tOtRXA0LG
MD5:	634EA3FF80C805D513F31C111C5E6D36
SHA1:	954A8DF53DFAF206FFE7D329BD10F3CEF0401E2B
SHA-256:	F60C5BB9D04B55988DA13511A2C3EDFA0F39FB6F51ABFB8AC24D0B161C4169C0
SHA-512:	D7346885D12400A27F34A5FC4B1814FF5384D31C4A28801482BF804B3EE0FA6EF0B2468BACCA59CBCDD9D28EB9F1AB5CE10414FF1CB7A25ACB333B7F95BC70B7
Malicious:	false
Preview:	.Dd February 15, 2008..Dt ffi_prep_cif 3..Sh NAME..Nm ffi_prep_cif..Nd Prepare a..Nm ffi_cif.structure for use with..Nm ffi_call ....Sh SYNOPSIS..In ffi.h..Ft ffi_status..Fo ffi_prep_cif..Fa "ffi_cif cif"..Fa "ffi_abi abi"..Fa "unsigned int nargs"..Fa "ffi_type rtype"..Fa "ffi_type **atypes"..Fc..Sh DESCRIPTION.The..Nm ffi_prep_cif.function prepares a..Nm ffi_cif.structure for use with ..Nm ffi_call....Fa abi.specifies a set of calling conventions to use...Fa atypes.is an array of..Fa nargs.pointers to..Nm ffi_type.structs that describe the data type, size and alignment of each argument...Fa rtype.points to an..Nm ffi_type.that describes the data type, size and alignment of the.return value. Note that to call a variadic function..Nm ffi_prep_cif_var.must be used instead...Sh RETURN VALUES.Upon successful completion,..Nm ffi_prep_cif.returns..Nm FFI_OK ..It will return..Nm FFI_BAD_TYPEDEF.if..Fa cif.is..Nm NULL.or..Fa atypes.or..Fa rtype.is malformed. If..Fa abi.does not refer to a va

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\man\ffi_prep_cif_var.3

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1321
Entropy (8bit):	4.9010718988130115
Encrypted:	false
SSDEEP:	24:Q9fBIh0kJFRBK5VWxI6bsRMoLZzIUFEOKUNEQVci8ay0sa4A0Lz5U:E2GkLDKjWxJ8MWpIUFEOKUNxOHRXA0L+
MD5:	3FAC156E21EF8E1746B25464DE61E40B
SHA1:	2E7FA32317DBB66B2235BB5772C1D73E2DAD4CC4
SHA-256:	9365685252F33F13627C9303BC01883B764227132069260C19E94100FF442A51
SHA-512:	10DCC8672B1EE30A48E4399F49193F2EA4A7722E27E097F361B8E7EC7601ECA80C9784C5019D5C99CB949C5CC9CD63A8149965BA203F1C1EDFC871651A9599EB
Malicious:	false
Preview:	.Dd January 25, 2011..Dt ffi_prep_cif_var 3..Sh NAME..Nm ffi_prep_cif_var..Nd Prepare a..Nm ffi_cif.structure for use with..Nm ffi_call.for variadic functions...Sh SYNOPSIS..In ffi.h..Ft ffi_status..Fo ffi_prep_cif_var..Fa "ffi_cif cif"..Fa "ffi_abi abi"..Fa "unsigned int nfixedargs"..Fa "unsigned int ntotalargs"..Fa "ffi_type rtype"..Fa "ffi_type **atypes"..Fc..Sh DESCRIPTION.The..Nm ffi_prep_cif_var.function prepares a..Nm ffi_cif.structure for use with..Nm ffi_call.for variadic functions...Fa abi.specifies a set of calling conventions to use...Fa atypes.is an array of..Fa ntotalargs.pointers to..Nm ffi_type.structs that describe the data type, size and alignment of each argument...Fa rtype.points to an..Nm ffi_type.that describes the data type, size and alignment of the.return value...Fa nfixedargs.must contain the number of fixed (non-variadic) arguments..Note that to call a non-variadic function..Nm ffi_prep_cif.must be used...Sh RETURN VALUES.Upon successful completion,..Nm ffi

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\mdate-sh

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5483
Entropy (8bit):	5.068674892896261
Encrypted:	false
SSDEEP:	96:WmYACwqP7l274gdCfYGwDr8/HPM3e9KCXzBMIx1TG:WmYACwG7t7Jwf2PM3eRjBjU
MD5:	BA25B8A8910B7416A09AD23611286ACB
SHA1:	A0830EF490F46F6D08203123C853C86E462C6942
SHA-256:	E176470B65C5993E4D680656AEF676C8A45790E3B761463E6E74E08ACE2BE619
SHA-512:	65DDA1D3D4C87EE7D78E115BA6ABFB4246E64ACB63A5FEDD816AA4DF7207772FF7B87A118CC579F70F0799C83BC7C61CBF8BAE89D5258C855943386A0E455C88
Malicious:	false
Preview:	#!/bin/sh.# Get modification time of a file or directory and pretty-print it...scriptversion=2005-06-29.22..# Copyright (C) 1995, 1996, 1997, 2003, 2004, 2005 Free Software.# Foundation, Inc..# written by Ulrich Drepper <drepper@gnu.ai.mit.edu>, June 1995.#.# This program is free software; you can redistribute it and/or modify.# it under the terms of the GNU General Public License as published by.# the Free Software Foundation; either version 2, or (at your option).# any later version..#.# This program is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.# GNU General Public License for more details..#.# You should have received a copy of the GNU General Public License.# along with this program; if not, write to the Free Software Foundation,.# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA...# As a special exception to the GNU General Public

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\missing

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6878
Entropy (8bit):	4.89722097622545
Encrypted:	false
SSDEEP:	192:w2+L2bJ6AQhNVTZnBdUmBKqwrjQF76ngD:2L2bJ6H/tnBdUVrrngD
MD5:	53E627F03D2B741A129DA926C51CA8AA
SHA1:	BE6FA4AB13C2BB59E39217CC918F6B854D7F0508
SHA-256:	7B3B653A3B256DEC2D25FFAA12CE557DCADE2B8FE57C969B3E53F025A5A806A4
SHA-512:	D780478A5ADC56DE28CE0319DC22E19122FED0522AC7776247848AAA1731E512B47FD65F9F2A031E5D3158C797D55672EB4707F2CEF4CD92EBC35D38701C4722
Malicious:	false
Preview:	#! /bin/sh.# Common wrapper for a few potentially missing GNU programs...scriptversion=2018-03-07.03; # UTC..# Copyright (C) 1996-2020 Free Software Foundation, Inc..# Originally written by Fran,cois Pinard <pinard@iro.umontreal.ca>, 1996...# This program is free software; you can redistribute it and/or modify.# it under the terms of the GNU General Public License as published by.# the Free Software Foundation; either version 2, or (at your option).# any later version...# This program is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.# GNU General Public License for more details...# You should have received a copy of the GNU General Public License.# along with this program. If not, see <https://www.gnu.org/licenses/>...# As a special exception to the GNU General Public License, if you.# distribute this file as part of a program that contains a.# configurati

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\msvc_build\aarch64\Ffi_staticLib.vcxproj

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6677
Entropy (8bit):	5.3402648241646125
Encrypted:	false
SSDEEP:	96:yYp3bzkBlfNjUi7BB4T2UmyaLdmyaLDmq3/AD/e+PcGhRXLAu/eNPcGh/fNeU3/r:y43boh818/zPcGhX/wPcGh9eXQAhAz
MD5:	158CEA38721D0607397168D1BFF3B5AA
SHA1:	2DC9B8B7223042E6E277C4C4993FF92336541F1D
SHA-256:	8171504C3712E969101FD723E24B287A60261593E214BCEDBB886C37E3F6543A
SHA-512:	55791059BFC7A724BFAC2DA85424587F95AE2D021A3CC29133FA4E42E56D6592E8DFB8A43D987D87B4167E582C826A9E250300FE470292FB164638CFBDA33FAE
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">.. <ItemGroup Label="ProjectConfigurations">.. <ProjectConfiguration Include="Debug\|ARM64">.. <Configuration>Debug</Configuration>.. <Platform>ARM64</Platform>.. </ProjectConfiguration>.. <ProjectConfiguration Include="Release\|ARM64">.. <Configuration>Release</Configuration>.. <Platform>ARM64</Platform>.. </ProjectConfiguration>.. </ItemGroup>.. <PropertyGroup Label="Globals">.. <VCProjectVersion>15.0</VCProjectVersion>.. <ProjectGuid>{115502C0-BE05-4767-BF19-5C87D805FAD6}</ProjectGuid>.. <Keyword>Win32Proj</Keyword>.. <RootNamespace>FfistaticLib</RootNamespace>.. <WindowsTargetPlatformVersion>10.0.17763.0</WindowsTargetPlatformVersion>.. <ProjectName>Ffi_staticLib_arm64</ProjectName>.. </PropertyGroup>.. <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />.. <Property

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\msvc_build\aarch64\Ffi_staticLib.vcxproj.filters

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2080
Entropy (8bit):	5.088006011924445
Encrypted:	false
SSDEEP:	24:JdS4+lOFKMU4DFA5glpFXZ/ZQ7IG9j3505Z9w3505Z9/3505Z9Z3505Z99k35058:3QlZ4aZIG7AA+AfA6iVOLv
MD5:	8B631BB101497994370CB71CD3D82748
SHA1:	0CA1055721DBE6EF53FEAA956DDD70E2140E023F
SHA-256:	46B406C298FBBDBA6212E8D8AABAE0BDA2D5A2FFE337C77B85ECF8DD3055EE0D
SHA-512:	2FFD5B4DA16BDDE9E2AFB2BFE13BB9FA0A93C455EF277BCA70FC2F41ECF867E64BF7132E1EBFA32E2D767BDA286BC1CD2D89137975718D7797BA02D87C9A8FB9
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">.. <ItemGroup>.. <Filter Include="Source Files">.. <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>.. <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>.. </Filter>.. <Filter Include="Header Files">.. <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>.. <Extensions>h;hh;hpp;hxx;hm;inl;inc;ipp;xsd</Extensions>.. </Filter>.. <Filter Include="Resource Files">.. <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>.. <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>.. </Filter>.. </ItemGroup>.. <ItemGroup>.. <ClInclude Include="..\include\ffi.h">.. <Filter>Header Files</Filter>.. </ClInclude>.. <ClInclude Include="..\include\ffi_cfi.h">.. <Fil

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\msvc_build\aarch64\Ffi_staticLib.vcxproj.user

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	165
Entropy (8bit):	5.133402913617452
Encrypted:	false
SSDEEP:	3:JLWMNHU8LdgCQ4JWzyWQHUcFKFvDmNGzE+tR2T2K2VWiXxSuZYKPAG9:JiMVBdDJJWSfFK9mUA+D2T2rVhEUj9
MD5:	F03D1341D7B2BAD5C19B6F03EDCCB013
SHA1:	37A32FC6A073EB33D970A77BEC4C6CFDBE7E6463
SHA-256:	E953B026D0F383188C753487DF0A4D879FA5DA5BA82AC979AA877DB84E89A060
SHA-512:	F07DB393B3FB6B156D1439347863474579E1D608C88591DAE0DCE9258E11385B1A341FAC26079ACDE74B81EBE3BF6F8EE5C8CABB89F16F7EAD682A00D881CE59
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">.. <PropertyGroup />..</Project>

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\msvc_build\aarch64\aarch64_include\ffi.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	13722
Entropy (8bit):	5.266396249973437
Encrypted:	false
SSDEEP:	192:uh4uHt/Qid6yuyEWSIvZ+RfCm+arz6hqrREiAWOGL8K8GJhNnTBsxy52:u+qHIyuChSzAqrREiAWr8K8ab2xv
MD5:	FF685656E5C3DE4C48BD79706BF691AB
SHA1:	0A3F611A9EDAD1ACCD00C3465B3A31D23449F1A8
SHA-256:	B04AB245E6935172D1F4E27151D048B9D212D45934414CC262823F8AB2535FD7
SHA-512:	3DDF1A7BB1B80342CB33E0C044384DD890E280A74792C33F86D34CAAB01735E20D1112C2C92A54FAFD370901E00D69DB115CD36390F86F056BE34E1598CD923C
Malicious:	false
Preview:	/* ------------------------------------------------------------------C--. libffi 3.3-rc0 - Copyright (c) 2011, 2014 Anthony Green. - Copyright (c) 1996-2003, 2007, 2008 Red Hat, Inc... Permission is hereby granted, free of charge, to any person. obtaining a copy of this software and associated documentation. files (the ``Software''), to deal in the Software without. restriction, including without limitation the rights to use, copy,. modify, merge, publish, distribute, sublicense, and/or sell copies. of the Software, and to permit persons to whom the Software is. furnished to do so, subject to the following conditions:.. The above copyright notice and this permission notice shall be. included in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NON

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\msvc_build\aarch64\aarch64_include\fficonfig.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6393
Entropy (8bit):	5.217875170655509
Encrypted:	false
SSDEEP:	192:dGjjZdD4AYUKbHn6YINzulPDrnZvHiqnYsqi01G0d/zZ+:Wz4rJIkYjF7Y
MD5:	BF3EEDCF78653D0579751B8EFB1533B9
SHA1:	F8AED8B8A49F5AF488C2228D90751616A8DFDCAF
SHA-256:	58D7BD9C9ECEB66C97F56DAF69CC6D0E1397AE4655533814B73A7F678A6F55F7
SHA-512:	7C9EC02F2AB63E58279AAA2551516B7CF036855C2B85DDA7430A8F5E3AE4C7DF90368A677ACC96AB3F5B2B956963D2B88D325F91573DF88B4054A4EEDB76828C
Malicious:	false
Preview:	/* fficonfig.h. Generated from fficonfig.h.in by configure. /./ fficonfig.h.in. Generated from configure.ac by autoheader. /../ Define if building universal (internal helper macro) /./ #undef AC_APPLE_UNIVERSAL_BUILD /../ Define to one of `_getb67', `GETB67', `getb67' for Cray-2 and Cray-YMP. systems. This function is required for `alloca.c' support on those systems.. /./ #undef CRAY_STACKSEG_END /../ Define to 1 if using `alloca.c'. /./ #undef C_ALLOCA /../ Define to the flags needed for the .section .eh_frame directive. /.#define EH_FRAME_FLAGS "a"../ Define this if you want extra debugging. /./ #undef FFI_DEBUG /../ Cannot use PROT_EXEC on this target, so, we revert to alternative means /./ #undef FFI_EXEC_TRAMPOLINE_TABLE /../ Define this if you want to enable pax emulated trampolines /./ #undef FFI_MMAP_EXEC_EMUTRAMP_PAX /../ Cannot use malloc on this target, so, we revert to alternative means /./ #undef FFI_MMAP_EXEC_WRIT /../ Define this

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\msvcc.sh

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8458
Entropy (8bit):	4.742268358023328
Encrypted:	false
SSDEEP:	192:BHmtbrkyIIOk9fiJZw1l24X4tjsnAjtHZzjwdXmkE:skyIIOGfaZEotj3jthjCXmv
MD5:	36177724EB4624149C01CD8BEDE37971
SHA1:	27E33DE70CAA688D6222B064DCA180ED21D7EB57
SHA-256:	F87C01149F7767ADA8A20D9F75C6420E5F0F7A534DCEE9A57D469BC5BDD12A14
SHA-512:	DBCB076598265A5F1A61E86E17EFF633926275A8C7F76B493CE9BCB3F377C08F926A59E40899A95247DEE1BB2FE4B17ECEC4AA2379EB85958E8B6113F2DDAFF7
Malicious:	false
Preview:	#!/bin/sh..# *** BEGIN LICENSE BLOCK ***.# Version: MPL 1.1/GPL 2.0/LGPL 2.1.#.# The contents of this file are subject to the Mozilla Public License Version.# 1.1 (the "License"); you may not use this file except in compliance with.# the License. You may obtain a copy of the License at.# http://www.mozilla.org/MPL/.#.# Software distributed under the License is distributed on an "AS IS" basis,.# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License.# for the specific language governing rights and limitations under the.# License..#.# The Original Code is the MSVC wrappificator..#.# The Initial Developer of the Original Code is.# Timothy Wall <twalljava@dev.java.net>..# Portions created by the Initial Developer are Copyright (C) 2009.# the Initial Developer. All Rights Reserved..#.# Contributor(s):.# Daniel Witte <dwitte@mozilla.com>.#.# Alternatively, the contents of this file may be used under the terms of.# either the GNU General Public License Version 2 or lat

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\preprocess_asm.cmd

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.640976442480104
Encrypted:	false
SSDEEP:	3:mKDD2JFK+ECeKw3WmQmwpsdriFfsQOCbFW:hCWLrWm+sQOYFW
MD5:	0C05D3DFFF1810BEF6EFF8D5B8A62C7A
SHA1:	BFE82B62451E42053F96F1E5AE202A141F099BB4
SHA-256:	299B4F06BDE7B1779F33E5AF6C89474D09DA06196FA8E9AFA00DF5DF992EF704
SHA-512:	228E4D5BC718583B595A2EF5B805BC0DCDA4EF5E4AFA9137E031E3C7EEC3ACE9F9AE757DC0A997573B0CD810DBA6429F4E4104BBE3F7EE718AB8EECE1393BE58
Malicious:	false
Preview:	@echo off..cl /nologo /EP /I%1 /I%2 /DPIC /DFFI_BUILDING /DHAVECONFIG_H %3 > %4.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\aarch64\ffi.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	26502
Entropy (8bit):	5.10835300902789
Encrypted:	false
SSDEEP:	768:6VC1EF5W1nuxFnWrcFkxCFstmFxYw58TEak3+Xs1XvNYDEJza:6VC1EF5W1nuxFnWrcFkg1FxYs8TEESa
MD5:	828BC812418161397E922B2BF6603D41
SHA1:	9553469E74059F9C3C09F0CD3FE4FD2A06787C51
SHA-256:	60CD3EC3EE48B3279AEB4594FD85C38B318F5024C5BF28D8B87115AE40A8C185
SHA-512:	2ED2988A5F1078153C2E43FEE058C55B398895F7A7860EFFF89765857D22113AD83AC07918992AC28633A8A9F1816C6D6A600F724277578DF285ED33DBE2EA9A
Malicious:	false
Preview:	/* Copyright (c) 2009, 2010, 2011, 2012 ARM Ltd...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.``Software''), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,.TORT OR OTHERWISE, ARISING FROM, OUT OF OR I

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\aarch64\ffitarget.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2676
Entropy (8bit):	5.34889615602986
Encrypted:	false
SSDEEP:	48:zxiJTfPvGt7ICWPH+sfINi3OMFQcl5MRq+J2+hBjWOYfKycWbYf/N7/crBb:zCPut0CuHXOJcl5Oqs2+OPfbt0ft/crN
MD5:	6D7BE2B919719556AD555CFEC199E8B5
SHA1:	7C65ACF1F8136706014B0B08C427E11E9A506D85
SHA-256:	EE109C2BC130655CAEDD91D71543428FB133146C3A0A33C51BFFCFBFDACFA2F7
SHA-512:	0ECC60BF79136C05AFCF6A9996148D6313641613A5FAF38995E50AA3B8563A40994680D0037FEFB8B97E50E07FD791F2CABB9C830921F2723ED14BF7CFBA2600
Malicious:	false
Preview:	/* Copyright (c) 2009, 2010, 2011, 2012 ARM Ltd...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.``Software''), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,.TORT OR OTHERWISE, ARISING FROM, OUT OF OR I

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\aarch64\internal.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2284
Entropy (8bit):	5.420559093297391
Encrypted:	false
SSDEEP:	48:niJTfPvGt7ICWPH+sfINi3OMFDeUoO2iCRsi3uU9WOz3E+8a53Jvy8bRUzZyKJIc:gPut0CuHXOYjUWWpM
MD5:	F6F12FEC5373834AD78C26BA498BFA17
SHA1:	A03CF273D647978404C7CBF2A3DF191A46269270
SHA-256:	166B25071B928528A000A1EF43187A8156BA9215E70AEB8278630BA138016916
SHA-512:	892A39D5F0F85FF295F321B07662ABCECF50791086DFC6C2195FC3441EE3EBF5F7006379ACCDF0B259501CFCA7BE23148382B38450C28494F258215C04527E53
Malicious:	false
Preview:	/* .Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.``Software''), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,.TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE.SOFTWARE OR THE USE OR O

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\aarch64\sysv.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	11215
Entropy (8bit):	5.544570524956464
Encrypted:	false
SSDEEP:	192:zJbuHXQQRDbhfve+wJNVBKnybYVlAD4f+mhLYGrwOEMGNfk8aoekdsjpVfBUhQGL:ztsQQtbcLPVBKyEVSU8OiNfk8aoekmbc
MD5:	F4250870FE2EBD95E9CD93E3939D0098
SHA1:	FD6E2627C18652D7444688497960FCBF17651E6B
SHA-256:	14D6FD01739B1A0736E0DD46AECF892DFE9C2EDF51070F52286AA7EF9D94BF38
SHA-512:	DD475512E68D73E178CFC1A6B83428EFE8EE3EC5401A646D0CCFB623CACB758A90344DCBE3B2AE86B6C49F69D5FF6953F3B409DAE9B7E30CE377C87D8113FD06
Malicious:	false
Preview:	/* Copyright (c) 2009, 2010, 2011, 2012 ARM Ltd...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.``Software''), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,.TORT OR OTHERWISE, ARISING FROM, OUT OF OR I

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\aarch64\win64_armasm.preasm

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	11833
Entropy (8bit):	5.486795968003079
Encrypted:	false
SSDEEP:	192:zD9uHXKY+eHGvNVBKUJ3MzzzzzZ5NAylxw6taUylLjLPGmi5GNfk8a1+Qq1p7Gmh:zRsKQHiVBKUJ3MzzzzzZ5NAQxw6gUlmJ
MD5:	8F71747B20626F838A660890435ACB41
SHA1:	328ABD120F78674863D4DA0D4444BB4F4D09A1F1
SHA-256:	59AD5646AC37BFD72277243A9994B9730E33347D0DD98CCAE6EC7198705DED68
SHA-512:	66433E8F1D6A43B7D96A97914BD7EF9E77700FA1CF84650358E2A262B061D6F96F866F87A9534ED39AC265DE9449A3BE860591BAB3EF7815DC67B73850462ED0
Malicious:	false
Preview:	/* Copyright (c) 2009, 2010, 2011, 2012 ARM Ltd..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.``Software''), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:.The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software..THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,.TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN C

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\alpha\ffi.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	13100
Entropy (8bit):	5.350266675709089
Encrypted:	false
SSDEEP:	384:vqRWIpZaZ6fN//S/rBZY/wcTwBgbjFitnchpgbzAc2vrIn:SlZaZ6qBe/wc8chpgbzAc2TA
MD5:	40E4BFC4CE20447E75683F85D1801954
SHA1:	811CE5FBCBA61EB53D1BD383196A2CE355D52E79
SHA-256:	26D079A724E4AA495BA8F5A9D5DAB012228060BC97477EA322EC04D01E5199A3
SHA-512:	40ABAE0B36B43973F758C2A5092A5F32C818048AC081626EBE94DDE7D6B7DD7E25F49ADA3EFA9252B9DF80A3F8671D3E5223DBFD7BB8A206DFB81DC145417EE1
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffi.c - Copyright (c) 2012 Anthony Green.. Copyright (c) 1998, 2001, 2007, 2008 Red Hat, Inc... Alpha Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\alpha\ffitarget.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2051
Entropy (8bit):	5.12466189023767
Encrypted:	false
SSDEEP:	48:u69UT8J2EPPvGUuRtWPH+sZITLWXo+FVlcl5MRq+GJmcyW/:u7GPOUwuHtoSlcl5OqXJmq/
MD5:	D602D6B1B71200F27C9C202731A55218
SHA1:	A3A1F3DF08BDF930E59E500C74CF477998F8A2E3
SHA-256:	D3056EDB82319F6CB2B45F3A52FAE5FA9EF39E2D679FAC4DA3F3A4729BCB78E3
SHA-512:	C469DAE1B23315BDA62F177508FE786813BE588A5091AEE749C635AD5B445B84DDEC74680C7BB3DC05FC285EB81694DBBCB1D05AEBF092C2930C9A657E302FDB
Malicious:	false
Preview:	/* ------------------------------------------------------------------C--. ffitarget.h - Copyright (c) 2012 Anthony Green. Copyright (c) 1996-2003 Red Hat, Inc.. Target configuration macros for Alpha... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\alpha\internal.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	571
Entropy (8bit):	4.799151879596724
Encrypted:	false
SSDEEP:	12:HecliYLeYmH+k7rh5YchYijTIqVBIqc53LDBY/YbvYI2cvWdiYIZY:kFD3jcJNfywjl1KiVY
MD5:	A9A4EF52F3883876D62820519BA4F3AB
SHA1:	EC42F9BCE5EE16412ABEF8F418295490F1F03672
SHA-256:	163E8A0F0A8810BCCE8A0777E2ADBB6147033E49E14C60711738384D5FFBB658
SHA-512:	543F48BE6685371CE2EEA44530DA66859B31FD7C054B6619B6B8BD88F34D2AB4F6CF8F116E2CA7F27312DE6B1A6899953099D1AFC2FE3A635A55A82E54B2B573
Malicious:	false
Preview:	#define ALPHA_ST_VOID.0.#define ALPHA_ST_INT.1.#define ALPHA_ST_FLOAT.2.#define ALPHA_ST_DOUBLE.3.#define ALPHA_ST_CPLXF.4.#define ALPHA_ST_CPLXD.5..#define ALPHA_LD_VOID.0.#define ALPHA_LD_INT64.1.#define ALPHA_LD_INT32.2.#define ALPHA_LD_UINT16.3.#define ALPHA_LD_SINT16.4.#define ALPHA_LD_UINT8.5.#define ALPHA_LD_SINT8.6.#define ALPHA_LD_FLOAT.7.#define ALPHA_LD_DOUBLE.8.#define ALPHA_LD_CPLXF.9.#define ALPHA_LD_CPLXD.10..#define ALPHA_ST_SHIFT..0.#define ALPHA_LD_SHIFT..8.#define ALPHA_RET_IN_MEM.0x10000.#define ALPHA_FLAGS(S, L).(((L) << ALPHA_LD_SHIFT) \| (S)).

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\alpha\osf.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5932
Entropy (8bit):	5.506614056022711
Encrypted:	false
SSDEEP:	96:3vGPOUwuHtoEyAq9zlNBi9q9sTbA1dtfAO85CCb5DMim+D2rgV:3puHt35MlwTbA1dttC1D5qrgV
MD5:	6908F921057714D5356A458F7A2DEBA2
SHA1:	C4828AFDDEA97F6C8095113C1C95474C584FC93A
SHA-256:	C3E2C75A16396B5F49F41D2E2BBA6760DDF5B96DC97401A06E2262220077AD78
SHA-512:	B4C29BF5641C0260A337AC97F5BC801FEFE3976A0D3AC5F765096D7963F09EEB71BB04CD854D23AE73064A3BB8A6B8B6DF4EA6D38E6BE6BA2FEE5CC1A9C62BD1
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. osf.S - Copyright (c) 1998, 2001, 2007, 2008, 2011, 2014 Red Hat.. Alpha/OSF Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NONINFRINGEMENT. IN NO E

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\arc\arcompact.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4477
Entropy (8bit):	4.502678470962499
Encrypted:	false
SSDEEP:	96:ZGPOUwuHSBqM4FmxxquWDppNYXDSQxLlQ1X33l:fuHSBJ4UjIFpNYXDSQ3Q13l
MD5:	57AA2FDADE3129C340916BC4BB26CFBB
SHA1:	C3F2C7059261B187B6B8F43D90D67825788EC3EB
SHA-256:	D82AD0F32DA7626F5ECA676C45D80F4C4E6DA54DD6322F84034B6D143353AFE7
SHA-512:	2B4FB7ACD159EC23D7864BF9BCAA88F3F353E63B12750B6FF57B1EA5444EA5842C23391F017C263ED669628BA116BDB22C0A2F58E16B8970997217D7D485F62D
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. arcompact.S - Copyright (c) 2013 Synposys, Inc. (www.synopsys.com). . ARCompact Foreign Function Interface .. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND, EXPRESS. OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.. IN

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\arc\ffi.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6524
Entropy (8bit):	5.157737480098524
Encrypted:	false
SSDEEP:	96:1eXGPOUwuHSBqMaz+/hyKwGKDNIbWRmr4xVlkVSZUNS98qKZGV2IAOwDymBL:auHSBJjyKwGKDO+m9VlS98qKZGVXGWmd
MD5:	059C03EB967EA6BCD70D11136688A98D
SHA1:	CFC6D7535E7FD02D049A81B00802EB44F20C47D2
SHA-256:	09D47A68802D803355026B2185E3294613485E88EFAAA1A9DA682B8D80091E0E
SHA-512:	825F5A1C20174D085C375748D929CD41F6FC978B3297C69FAEC9BB2497961F235A95D6E9B396C80B03861178C7163D130C9769726E2A99F685D0BD9AFA6D9A48
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffi.c - Copyright (c) 2013 Synopsys, Inc. (www.synopsys.com). . ARC Foreign Function Interface .. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND, EXPRESS. OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.. IN NO EVENT S

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\arc\ffitarget.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1927
Entropy (8bit):	5.127711470998356
Encrypted:	false
SSDEEP:	48:19+T8J2EPPvGUuRtWPHasZILV3q2Dlcl5MR8+DypYA:1sGPOUwuHSBqalcl5O8cdA
MD5:	2B86E1CDED84ECA7D5E99C892BD83B4A
SHA1:	2304FB75FF8755F9C006ABBEB2D8C1485902C049
SHA-256:	6CBF168E4DEEF40EB76044B377312277901EE89590154E2B48702BA4C2399CE3
SHA-512:	DE324D60E6DDF9FB6CE151E713CE826B90C963280EBDC94BF269A2C162B4ED059F2D40CE0639B7A6B6BA04CC066C8D0D9A8D2E5634BBA4C0AE9058659DA371F7
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffitarget.h - Copyright (c) 2012 Anthony Green. Copyright (c) 2013 Synopsys, Inc. (www.synopsys.com). Target configuration macros for ARC... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND, EXPRESS. OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\arm\ffi.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	21458
Entropy (8bit):	5.068719354481388
Encrypted:	false
SSDEEP:	384:Y4qPB8v62hE+0wDJBBvlFOql6FTtZORtyxV/Pd0vXBA4DmQsgjfZhKSJIqe81EF1:+KE+0wDJBVOqlmGt8P65AumQbzZmqN1G
MD5:	8911FC671ED23AA7898B640DAE225477
SHA1:	A786BD0B5744AE1DEB32F8D4A63B3640A8D40E92
SHA-256:	5C80A4E80188475C4A5725D98C3869408745149A437D051145AED53E8CCEAB4B
SHA-512:	7BD8648E6CC0E5D651AD24E4D418EB33C557A45DD339E6D65D4A98BA15386EA2B84959B30BD152A5EF3DA02D9F421A6BD1EF50B694CB13F64ED2C038BF83D660
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffi.c - Copyright (c) 2011 Timothy Wall. Copyright (c) 2011 Plausible Labs Cooperative, Inc.. Copyright (c) 2011 Anthony Green.. Copyright (c) 2011 Free Software Foundation. Copyright (c) 1998, 2008, 2011 Red Hat, Inc... ARM Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITH

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\arm\ffitarget.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2731
Entropy (8bit):	5.254445046425764
Encrypted:	false
SSDEEP:	48:u6muT8J2EPPvGUuRtWPH+sZITLWXo+FVlcl5MRq+GJmTmUMPxhE3JW6Yfry6IWOH:uuGPOUwuHtoSlcl5OqXJmTmxSsDfmQP2
MD5:	239B6FC62868FBE03E133C7E1904340E
SHA1:	375C52F6F59B678F4D1270DDAC13F4E60785A197
SHA-256:	54EE4410927BD70BD19349DAE9A566B181C0DD3212BED10C53F3D1E3A3A38B85
SHA-512:	5EA64654DB156564819E8CF2F2A3C6E594DB861562AFC95A4A54C23C964C4052B0BD9E889E08CE7D55502E82CD1E903A2BC088D05130BB0BD51808672570F268
Malicious:	false
Preview:	/* ------------------------------------------------------------------C--. ffitarget.h - Copyright (c) 2012 Anthony Green. Copyright (c) 2010 CodeSourcery. Copyright (c) 1996-2003 Red Hat, Inc... Target configuration macros for ARM... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\arm\internal.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.636100239640913
Encrypted:	false
SSDEEP:	3:HDKAeY6yNdr0eY6yNK1DM0eY6yNA2vHQ0eY6yq+0eY6yqwvjbeY6y77eB4eY6yF/:HeAeYbdr0eYbGM0eYb+0eYk+0eYka/eO
MD5:	B3304A9A5173D6D9180A3AE59BD6D9CD
SHA1:	8A08D98B611D3865872C793A0235333B0CB5E478
SHA-256:	AB6A5B6308151E27EC290C56D3F443125E2C9D17E102CC95E11FFB01A1586099
SHA-512:	D7446C4BAE332180A6F116513FDCE7C56C1D9E5ACE1BEAA3A94CC1C45CB3750098DDF5A132EEC0A4CBC93529DA530585345379829F6D5624EF6AA898F8C601EE
Malicious:	false
Preview:	#define ARM_TYPE_VFP_S.0.#define ARM_TYPE_VFP_D.1.#define ARM_TYPE_VFP_N.2.#define ARM_TYPE_INT64.3.#define ARM_TYPE_INT.4.#define ARM_TYPE_VOID.5.#define ARM_TYPE_STRUCT.6.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\arm\sysv.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9743
Entropy (8bit):	5.525317389620467
Encrypted:	false
SSDEEP:	192:eHuHt3qkHMzLzFBCxAGqCDpqDb8KhqWnpkHmxmRy621iquQBaGTvyQ21iiO6Tf1L:eHqakHMzLzFBCxAGqCDpqDlhOOC1iiTX
MD5:	912655B5E9DD3D364AF3733F995AFF40
SHA1:	B0C3A885E8020749A9F33A76DB2E85EFDDCCED97
SHA-256:	A7DD4DC4C8B725A1EBA46F8C792F0F99FE0453602AC2B4E3603057E836420BFA
SHA-512:	44147C138CC420507950A514EBD8CE67B0081104483C9E31E6D922FBBE285F39494F715BEDC2186C3C445014C74002AFB433AEEF209E27A9E5436EE05B831641
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. sysv.S - Copyright (c) 1998, 2008, 2011 Red Hat, Inc... Copyright (c) 2011 Plausible Labs Cooperative, Inc... ARM Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\arm\sysv_msvc_arm32.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9473
Entropy (8bit):	4.848592769699982
Encrypted:	false
SSDEEP:	192:h8uHt312e4utVy1rmtD7lpdXK1lnCBPbTYtqR+dXs1fY1EXQfzPCt:h8qIeermR1XGlnbLXYfBSPs
MD5:	0351A92C508A57029BFF881867529D57
SHA1:	DE13C0DEB71306E6AFAA388CF20D0CF033262981
SHA-256:	3A16C408994C829F8DDF2A8AF147C425927E2A45433B15A46BFD92C25D10B333
SHA-512:	314D07CCA33AE170897756575DD95FD191D24E81F803522764843714BE5F427CE024B8AF7CEE07DB18B48CD125536919AED06995D046E89F91DD28BAB40CBA8B
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. sysv.S - Copyright (c) 1998, 2008, 2011 Red Hat, Inc.. Copyright (c) 2011 Plausible Labs Cooperative, Inc.. Copyright (c) 2019 Microsoft Corporation... ARM Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRAN

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\avr32\ffi.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	12393
Entropy (8bit):	4.811100012022464
Encrypted:	false
SSDEEP:	192:kcuHt3pICsXOlTHQ1t0RgwfEgRenacCtIJtw689gZ4/AK0DZ/YF/+/I/Y/Q/PV/p:kcqbzFErJ+68SltKORFDQ
MD5:	1E7F2BE6A7BB2C081A285A402215A364
SHA1:	823FDF272A08A007A8D2FBF310BA33B4DDD8BAE2
SHA-256:	9697A0C6B2664BB98751781B638212D4828A130AF87EEEF821660A0940EA59DE
SHA-512:	AAB65A0E9ACF15FB55A60229542C5B28642A0AC2B4F9BB771ACE1EEA739BBD3564FC770422549D2332860908FA8F7624F32E93BDBD613C9F625859FC70C3E526
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffi.c - Copyright (c) 2011 Anthony Green. Copyright (c) 2009 Bradley Smith <brad@brad-smith.co.uk>.. AVR32 Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULA

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\avr32\ffitarget.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1967
Entropy (8bit):	5.1576766828983445
Encrypted:	false
SSDEEP:	48:u6ZIT8J2EPPvGUuRtWPH+sZITLWXo+FVlcl5MRq+GJmL+We:uEQGPOUwuHtoSlcl5OqXJmHe
MD5:	CECC1618A6DCEA06D53DDFDD6D11DD39
SHA1:	627BBD22586560FFEF0A53C1DE182775174A8571
SHA-256:	CD17C077B7B038B9027D373CBF82D42EB12CD1E3F0B39C3B54F43600DC0A7BEF
SHA-512:	AED77238211AE025A9FC8A1181B3C8D3445929C5F9C1CAC51E2F56861612A73424975E6ADD8D1942DD4F2C3620688BA652E0AA5228AD3F9CB52E5E6AA121F7A3
Malicious:	false
Preview:	/* ------------------------------------------------------------------C--. ffitarget.h - Copyright (c) 2012 Anthony Green. Copyright (c) 2009 Bradley Smith <brad@brad-smith.co.uk>. Target configuration macros for AVR32... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNES

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\avr32\sysv.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4840
Entropy (8bit):	4.905871812262408
Encrypted:	false
SSDEEP:	48:z/2T8J2EPPvGUuRtWPH+sZILvC3IOFFdEX5D9A/dhYAmDzucTz1dDPcnAcGClRwy:z/CGPOUwuHe6IeWD6FWAyPG86sfGd
MD5:	808BD4AA64C30850292F3FFE35D19EA5
SHA1:	755B6339D542C836E3E274A15DA2048E0E1BCF3E
SHA-256:	577635CD665853C100D8CC033CF3129D7C57B95230FE1238A7426450C6467840
SHA-512:	F5AB9B6D371D8564382CD0CF0BE1AAF656CE81795567AEEB4F18AE758092FB6846EC1E6B6B1B50A7344BC69A52E1CB3EBCF1166A3727F5F515D1B956B91F7BC5
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. sysv.S - Copyright (c) 2009 Bradley Smith <brad@brad-smith.co.uk>.. AVR32 Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.. IN NO EVEN

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\bfin\ffi.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6399
Entropy (8bit):	4.836936734900426
Encrypted:	false
SSDEEP:	96:1epjN2mGPOUwuHtoEFfG9O9/pbYyC6qz8ByV/xyxI1Flw9B6rTqG:KuHt3FfG9O9/jRyZxyxIXlwB6r+G
MD5:	1565EFE598960193506628CAFE73FBBB
SHA1:	0D125E45F3D7ED71BF2B4FB5145CDA8228B37229
SHA-256:	A84DDE009955ED8EF2893DFCB767E7610ABE33E47CE89E222350F053C53BC8FB
SHA-512:	1D504D754A7F08B7914FB25BFAFE3871FA1447FE6EBAB549D376EFA5DDCFC8581BDCB3002E320D99F3405A3E850144A4E43917C959C5820947BF2B7A8D4E807E
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffi.c - Copyright (c) 2012 Alexandre K. I. de Mendonca <alexandre.keunecke@gmail.com>,........ Paulo Pizarro <paulo.pizarro@gmail.com>.. Blackfin Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTAB

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\bfin\ffitarget.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1648
Entropy (8bit):	5.1070933361549375
Encrypted:	false
SSDEEP:	48:19UjLgKVT8J2EPPvGUuRtWPH+sZITLWXo+FFlcl+GZKmL6:12jN3GPOUwuHtoElclXZKmW
MD5:	7513CC181BF36663D44182B9F1C95C51
SHA1:	B9946FD709731617AB9B57D3546DAA2D3DFE1CA6
SHA-256:	8B337EDB35AA4CE7ECDDD02CCD87C4843A1A3FDD5B0407F092E558D8F7B0CD21
SHA-512:	A0A19BE1734D10CC07661745D22B395C730CBB0025060442295BBA67B6E12A456E96F8BAE64CCCC1B02244CA931B2A5683FEC0700883D43B0B6FF1A83748A51B
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffitarget.h - Copyright (c) 2012 Alexandre K. I. de Mendonca <alexandre.keunecke@gmail.com>.. Blackfin Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\bfin\sysv.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4425
Entropy (8bit):	5.3469389042441176
Encrypted:	false
SSDEEP:	96:MjNTmGPOUwuHtoEC+YOowOWbZZmFwgJzqQe43MqhTUSi:JuHt3jvow6zfeZ
MD5:	186967F96F819500E39F59A5251364E9
SHA1:	73377E6035F1DE5797D9BD7544B2827EAE5FF042
SHA-256:	4CDD351BA871ADCE4561AEE319379AD51FBC77C066441D32364623C1C964EB8F
SHA-512:	3EC65376C923D2387FFA26824F72C0A46EC47B23EB319B976C4101C7BC33A5E9F50BA56C79B824B9EC5BF26752D82CF597A52B64F7ED23024CE2408D44AC42C7
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. sysv.S - Copyright (c) 2012 Alexandre K. I. de Mendonca <alexandre.keunecke@gmail.com>,. Paulo Pizarro <paulo.pizarro@gmail.com>.. Blackfin Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARR

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\closures.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	27256
Entropy (8bit):	5.150120172816917
Encrypted:	false
SSDEEP:	384:n4qKx748Oeikgu4SIbxCAf2CYvR/h5g/Do4UwNQUTFy0vazw/lruBGB0uB1obPbx:LrfHRhy0vazeePL1kmCG
MD5:	7538561E445FC4048DDC3F903A9BFDE2
SHA1:	FFAEB55F98C709324F0F5431D35883604D34E2F7
SHA-256:	48ACF6947E1C101D5BBF588618D6DC5D9F7560AB59531E8EB9858EC20A1A6A86
SHA-512:	6C32F0FECCAA1B92800E1C8EDB4E63AE674030169F23DE9369845C7F87BBDD186852E47A68474BE477B879EBA69BF7A7BE9EA6716121A6714A76BBF52FC4A4F5
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. closures.c - Copyright (c) 2019 Anthony Green. Copyright (c) 2007, 2009, 2010 Red Hat, Inc.. Copyright (C) 2007, 2009, 2010 Free Software Foundation, Inc. Copyright (c) 2011 Plausible Labs Cooperative, Inc... Code to allocate and deallocate memory for closures... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PR

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\cris\ffi.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9839
Entropy (8bit):	5.198219927313132
Encrypted:	false
SSDEEP:	192:aaGuHSoJ37TklqaAbg/ow06m8zck0LrECeChPLNO5utXlIICJnK/kaWqTuyQuXu:ajNo17Tklqazxz/ArKCzLQnK/lQpb
MD5:	89604A232AF8071DE35DF602E5A6C8DB
SHA1:	A5F3E57C8B7E1603B28198E8467610B6F8B01315
SHA-256:	958EEB4F9B1D07D3AA2D7B9D26EE61B04AD749FFEA393A8F0446BA45377AD650
SHA-512:	236A1A2EAE54B972BDE242F269148B6DDA046C206C7381228469A7081CB1CCAC122013B93FF5CC207F4982C649880D2299CEB55BB3C37F971CAB7C403BFC8FA7
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffi.c - Copyright (c) 1998 Cygnus Solutions. Copyright (c) 2004 Simon Posnjak.. Copyright (c) 2005 Axis Communications AB.. Copyright (C) 2007 Free Software Foundation, Inc... CRIS Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND, EXPRESS. OR IMPLIED, INCLUDING BUT

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\cris\ffitarget.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2107
Entropy (8bit):	5.157973880740122
Encrypted:	false
SSDEEP:	48:u69yET8J2EPPvGUuRtWPH+sZITLWXo+FVlcl5MRq+GJmLGoGWfMv:uFUGPOUwuHtoSlcl5OqXJmyojfMv
MD5:	D56060242BAA5DC429BA60ACE6EBD724
SHA1:	8FE48DA27B075EC13B755374E565E432F6CC4BEE
SHA-256:	75D665F103A9D20DF7167B0E3171B31EDA6FA237E9C08CF5843471F2CAA4D445
SHA-512:	7CB9326AA6D76C0A0693AD7F0F81F15AFADEE41D98E29F37E5DD60308FF491CB9F9A66FDF7607234965F5E53C3581E1F13C1F942C577BBDC2AD05EE77B347BC0
Malicious:	false
Preview:	/* ------------------------------------------------------------------C--. ffitarget.h - Copyright (c) 2012 Anthony Green. Copyright (c) 1996-2003 Red Hat, Inc.. Target configuration macros for CRIS... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR P

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\cris\sysv.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5479
Entropy (8bit):	5.431329832416212
Encrypted:	false
SSDEEP:	96:UGPOUwuHSoqMWTkUlyQt6oNcuxNgsh3MZcNYvXqcK4UDuPxlTc5e+r:quHSoJrotN1xMmqvyJ8lId
MD5:	B17E59BF6BA716C77CD9CA7A4E39E672
SHA1:	5488659378DDAB49C75A51BCA9CEFA4190D88214
SHA-256:	8A3F9BEA4A554A58102D09B2A6EA0C340A8C9A35E2D67A9ECA47E12B75BF1348
SHA-512:	84C100CB8302FCF78D376E14F6F114835CEC28E940CFAC0EC9D2BBA9FD6E9A95A31BC859979AF488613C73FA55D76685288E774E8958F7F683C5CD5CD6B768DB
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. sysv.S - Copyright (c) 2004 Simon Posnjak.. Copyright (c) 2005 Axis Communications AB.. CRIS Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND, EXPRESS. OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRIN

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\debug.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2413
Entropy (8bit):	5.311922890326169
Encrypted:	false
SSDEEP:	48:RT8J2EPPvGUuRtWPH+sZITLWXo+FFL/mPeB3bkYDMYNwpusRRdT:7GPOUwuHtoEre8rmpusRRdT
MD5:	960420667F1D82B9FDEDCF2CB739390D
SHA1:	EAFA687F34EAFEC57228A5A14E213353AFB9EC7A
SHA-256:	5160A3877B65490AA30FA92A44A66C3BDF093D5AB75B9502ADB729038EFB3E5F
SHA-512:	A1893140517BBAF8E4354789D446BC5733609B36E674785D0AAF4D40AB98715E5E51413354619EBA84BBED01E92A79F64EEA0399B62B5503B2E4466155C0562C
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. debug.c - Copyright (c) 1996 Red Hat, Inc... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT. HOLDERS BE LIABLE FOR AN

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\dlmalloc.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	183561
Entropy (8bit):	4.995253695890672
Encrypted:	false
SSDEEP:	3072:TcFTq31vKGeCa0Dj+PB/S+dnUt/P/F7wexDnWk5DG22mw2S:TcFmoGeCa0Dj+PB/S+k/PV3DnWk5S1
MD5:	8C45772C208074DA1A905A869F59884F
SHA1:	52F11C9CA329FDFCD00FC57510BFE3CD5618EAA8
SHA-256:	D2028560B37849CA6B7B12504422AA832D6CF2F85F720CDD87799379744F54AD
SHA-512:	F24E70CE7E8E496F6CA7D522139FF6782FF2E318C35DB57B859871560B2947CC24838EBA2ADAD066F338B74AC2EC8BA91243B65ED66D41939D94E5CA2A5EA645
Malicious:	false
Preview:	/. This is a version (aka dlmalloc) of malloc/free/realloc written by. Doug Lea and released to the public domain, as explained at. http://creativecommons.org/licenses/publicdomain. Send questions,. comments, complaints, performance data, etc to dl@cs.oswego.edu.. Version 2.8.3 Thu Sep 22 11:16:15 2005 Doug Lea (dl at gee).. Note: There may be an updated version of this malloc obtainable at. ftp://gee.cs.oswego.edu/pub/misc/malloc.c. Check before installing!..* Quickstart.. This library is all in one file to simplify the most common usage:. ftp it, compile it (-O3), and link it into another program. All of. the compile-time options default to reasonable values for use on. most platforms. You might later want to step through various. compile-time and dynamic tuning options... For convenience, an include file for code using this malloc is at:. ftp://gee.cs.oswego.edu/pub/misc/malloc-2.8.3.h. You don't really need this .h file unless you call funct

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\frv\eabi.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3414
Entropy (8bit):	5.328688060256909
Encrypted:	false
SSDEEP:	96:2GPOUwuHS4qMfLxnIYU9pbTfLg0yuzYIP8UM:guHS4JflnIYU9hTTfzkIP7M
MD5:	B9ECCE87980CF9448D35F168D0B12575
SHA1:	FA69CDC84898D6B7EB8220A679ACC0D7E402A0ED
SHA-256:	4F5F724C88C240C2E4F748D35DC9E90BEE9B3E15B01255D464C423E72BAE7C08
SHA-512:	0CD7ADE5FFA0176D48A5DCC5E1E403CF3E96A899504671E9CD602953F5E22B8A908CEE1820998B9F92995DD3FBE6E41BEBA675E0FE94CC1DDBB2F617BC7FCC1C
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. eabi.S - Copyright (c) 2004 Anthony Green. . FR-V Assembly glue... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND, EXPRESS. OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR A

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\frv\ffi.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8456
Entropy (8bit):	5.150948546669439
Encrypted:	false
SSDEEP:	192:ouHt3N2ALw6GZ/0t8yuDgxRR0ZLg5Lo2Y/0Ub/445nKHIC1FhVo0VDjuR3:oqE/0UYo5Ig/xXW+3
MD5:	6D5F5603C261316978170EDCAE57685A
SHA1:	3987ECD69E40271056ABE1879D697FC5DF85E03F
SHA-256:	B8546DFF59DB5F3D329227B766860C648C93FB2657C93258F4600DC85E7DB77D
SHA-512:	844022727ECD62E9972C5880CF3884A2004CC91B641F89847F27A7004E64E77E1950A5F664F8D941AA82B1055A370B57DB62C747790AF164D4B753FABB992A46
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffi.c - Copyright (C) 2004 Anthony Green. Copyright (C) 2007 Free Software Foundation, Inc... Copyright (C) 2008 Red Hat, Inc.. . FR-V Foreign Function Interface .. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILIT

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\frv\ffitarget.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2190
Entropy (8bit):	5.104590594685158
Encrypted:	false
SSDEEP:	48:u60sAT8J2EPPvGUuRtWPH+sZITLWXo+FVlcl5MR9+GJmj9w+J/Wl+F+/WV:uyYGPOUwuHtoSlcl5O9XJmjv0AFxV
MD5:	46D793348229F3FA5C098E65A913A2DA
SHA1:	13846CAEF4945B5522780832321EA8B5C8333D4C
SHA-256:	3EDB1E12945A284C7F7305C42DF2BBC49CCEFBE91DDBDCB98ECE4FF6508E266F
SHA-512:	E94FB6B8AC0F903F31F5B30CAC59661A53471C2A21EAF34C75AF48FD013D43033573B4FA2B9DE87E5BE130B1FF6FCBACD8AC0E86B82384D4586B48AB2EB2E0F8
Malicious:	false
Preview:	/* ------------------------------------------------------------------C--. ffitarget.h - Copyright (c) 2012 Anthony Green. Copyright (c) 1996-2004 Red Hat, Inc.. Target configuration macros for FR-V.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PU

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\ia64\ffi.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	15898
Entropy (8bit):	5.234825285074882
Encrypted:	false
SSDEEP:	192:SuHt3TJSdCVGuznPTBGwnWa4Av5/SQYaihmCnZ45EjzkSjWT+bocd4zTLRrGDndD:SqFS6HrLnYS5/SV7njeEB2lsdb/1Brr
MD5:	42C9128059BD7E19C9952CCBCD2F2275
SHA1:	C5B5AB9624A9AC2074C16F46B41187C539ED11C8
SHA-256:	BB91F285C018ACD50666A85A236375BDBFA3081BD3F8D79EFC3DD60A361F2905
SHA-512:	1C57C9ED880413713E23AEB79FE5E4A8A597EAABFBDACA96AF8B8FB8F42856BC51457F851F8CDE3CC1806C9953739769A697A03EE75DE1421CC05B11D9EFE8CE
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffi.c - Copyright (c) 1998, 2007, 2008, 2012 Red Hat, Inc... Copyright (c) 2000 Hewlett Packard Company.. Copyright (c) 2011 Anthony Green. . IA64 Foreign Function Interface .. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCH

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\ia64\ffitarget.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2183
Entropy (8bit):	5.153619935723803
Encrypted:	false
SSDEEP:	48:u69VT8J2EPPvGUuRtWPH+sZITLWXo+FVlcl5MRq+iPmHSdWKo7:ugGPOUwuHtoSlcl5Oq1PmH5X
MD5:	7A21116D53A02F2CE8B47909DC050259
SHA1:	14F7B9DAF54766F3717B7F3206E11302B2BAF1F9
SHA-256:	E8AE27C307732EFFE4075C548984638B1869225BF8C28664F2BF17BD6B7A838E
SHA-512:	58D08A9ED8104CF7FFBB2EFF6B5C4C675B9EB22D304EFB1CA309F75974359ABD7BCFD6318BE1091EF98AF984E60E453CA372D7756632B36B5E39565F76A506B3
Malicious:	false
Preview:	/* ------------------------------------------------------------------C--. ffitarget.h - Copyright (c) 2012 Anthony Green. Copyright (c) 1996-2003 Red Hat, Inc.. Target configuration macros for IA-64... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\ia64\ia64_flags.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1949
Entropy (8bit):	5.186855763139179
Encrypted:	false
SSDEEP:	48:JT8J2EPPvGUuRtWPH+sZITLWXo+FFPWsP7pZV8VTEuV8qbUJ0Au:jGPOUwuHtoEP37pZ+1+EDN
MD5:	6598837388B91973B3E6193968357FDB
SHA1:	329FE8C097E0DD33876BF25717DB894E861A7435
SHA-256:	4715A00493BFB913B2D1F1779F1FF812633B3BB2A20F9A4B88DF6CA97A86B768
SHA-512:	77B2EC768B0A4C6E122B7A33EAEDDFA06A2B935EAFFF4771B46E12150B46042B17712FA75BD967F1F4DA01365083E29E8B64270CC5761CA6E6C08EA8ED65A017
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ia64_flags.h - Copyright (c) 2000 Hewlett Packard Company. . IA64/unix Foreign Function Interface .. Original author: Hans Boehm, HP Labs.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PU

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\ia64\unix.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	11952
Entropy (8bit):	5.455437751863841
Encrypted:	false
SSDEEP:	192:MuHt3fWQlXGPzzB9mTPFoGjhVPb9RjJ0+ae0S5TuYcKxzbmigHNe:MqeQlW7zB9uNtFVzXjJ0+ae0S5TuYcKL
MD5:	239C4F9CE72D72023F8FBD6B2A1516AD
SHA1:	8BACC9DCCFE835594999C87A9654025DB7BC5C10
SHA-256:	CE96B09C8497AA07EA0DEC7ED245A295A715FF0F175FC7CD3B022BAFE2F6A72F
SHA-512:	7DAF06A127834AD8365D104D6194BD469915D5E7EA5789D347D3BACA034015284BCAE404E53D7A545D7B529F1D75AFE7BD8C708D5951B32ED41CF38B38025C77
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. unix.S - Copyright (c) 1998, 2008 Red Hat, Inc.. Copyright (c) 2000 Hewlett Packard Company. . IA64/unix Foreign Function Interface .. Primary author: Hans Boehm, HP Labs.. Loosely modeled on Cygnus code for other platforms... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMP

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\java_raw_api.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8814
Entropy (8bit):	5.410286242093818
Encrypted:	false
SSDEEP:	192:juHt36v+MfaNlL5+IOArSl7FHvhsDAQy3JOR1:jqA+MaF8Ijc7FHvhFQy3E
MD5:	5087A408B19FCA412CF1B81262D0DA0B
SHA1:	D97C88295586F9AC9D7804ED88FB0AC30C115765
SHA-256:	5C3886D8C20BA1238135835AA132AD9C017AF5F9E5C55E2167D3AD047DEF1BD6
SHA-512:	D34AD02B7CBA3E252AD5AAA24400443267EF756E3BE423A723E2AB3DAD5006C654B8FDBC655BA24B89ECCF82B0B174081B32CF7E5FD4694C93CC552E3F9F6F10
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. java_raw_api.c - Copyright (c) 1999, 2007, 2008 Red Hat, Inc... Cloned from raw_api.c.. Raw_api.c author: Kresten Krab Thorup <krab@gnu.org>. Java_raw_api.c author: Hans-J. Boehm <hboehm@hpl.hp.com>.. $Id $.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMI

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\m32r\ffi.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5585
Entropy (8bit):	5.120037588429536
Encrypted:	false
SSDEEP:	96:1e8GPOUwuHSBqM9BlDwUHB2ENMkOaN5wx7O5pqf2dwR9vxu:fuHSBJXlDwUHBDN6aNOxSFmJu
MD5:	A06A5272996A57CF9C1338B05F6B19C8
SHA1:	F73252186C25B50DE24AB997FC83CF72ED859B0E
SHA-256:	998E91FD9182798EB2D19421EDEF8B284D7D3BDB911E57AAD71B12331353489D
SHA-512:	5B7E4134B13332C16BA7E7518BA248822628AC2BE293CA205CFED22436363BB347AB78FDE2775DFA58B3023D651E4488E5B93EC372E0CE45CE52B537A5D7D2F8
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffi.c - Copyright (c) 2004 Renesas Technology. Copyright (c) 2008 Red Hat, Inc.. . M32R Foreign Function Interface .. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND, EXPRESS. OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NO

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\m32r\ffitarget.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1936
Entropy (8bit):	5.0831017858647325
Encrypted:	false
SSDEEP:	48:u611QT8J2EPPvGUuRtWPHasZILV3q2Dlcl5MR8+GJmhBPK:u+oGPOUwuHSBqalcl5O8XJmG
MD5:	F231859DAA12286973D5134B9AFC8AFE
SHA1:	361659E3EF03827524B2DEE86476CE53366C4F53
SHA-256:	C6F77C82604629D48A4BA26731C883EB3D7A0D2938A72E2BBCD2DA7FB314F811
SHA-512:	C76B6B793CEC0CFCCE1C825974B11D042AEF825813CF2A96AF4E9CF674D05F7508D3ABF937A559249900DC6F61680CC020553A8F099C08EDEB987D711655B359
Malicious:	false
Preview:	/* ------------------------------------------------------------------C--. ffitarget.h - Copyright (c) 2012 Anthony Green. Copyright (c) 2004 Renesas Technology.. Target configuration macros for M32R... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND, EXPRESS. OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\m32r\sysv.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3050
Entropy (8bit):	5.3483553251468265
Encrypted:	false
SSDEEP:	48:cT8J2EPPvGUuRtWPHasZILV3q2zzEQNOJOozeoVsR/sYXEsSF1CqZCmkts9ETTDv:8GPOUwuHSBqM4QNUOQVGRkYXEsSF1CqK
MD5:	FDE1F5CB81AB7CE114AF861C94C368C0
SHA1:	A9F3712112BFB7E50F3873C4682EB6189C5A9B39
SHA-256:	C5FFC450F8A17B7D0D3B7A9D30C4857A7FF05A4D5C5C7095AE9CE1DED60F727F
SHA-512:	628077B318BEBEDA91670B57C2F0D7CC3B731F895078D28644BA7BA61E0E4671554BFE2E6A48821F6B3EF05009D110625DF9E13A246C9F1DB3E9F36665ECD33C
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. sysv.S - Copyright (c) 2004 Renesas Technology. . M32R Foreign Function Interface .. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND, EXPRESS. OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.. IN NO EVENT SHALL RENESAS T

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\m68k\ffi.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7363
Entropy (8bit):	5.1776624571630565
Encrypted:	false
SSDEEP:	192:iSdwb3NluAaPk5ymZwZJqkblrdVoC7/L2r/rvJ:8aAaPyk8brvJ
MD5:	E4A8B1DB2017CCF89ED2D5CB543F9E04
SHA1:	AD2FBAFC902DF2F8ABEC8DB6817335EFCB99A5E2
SHA-256:	8C3254A9BCD3B1B19A899CC42208A44934E356F872F9E8F3686B0DC70A979A73
SHA-512:	CA15F74358DE0952CF9DB28DB8B34AC966023E7C99AC22A04A6A7C7B2B5B31EF58F61757B7FF6DE9DCAA6270267D645EC56840F9B9DA5BA28C9EEC9AB23BA424
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffi.c.. m68k Foreign Function Interface. ----------------------------------------------------------------------- /..#include <ffi.h>.#include <ffi_common.h>..#include <stdlib.h>.#include <unistd.h>.#ifdef __rtems__.void rtems_cache_flush_multiple_data_lines( const void , size_t );.#else.#include <sys/syscall.h>.#ifdef __MINT__.#include <mint/mintbind.h>.#include <mint/ssystem.h>.#else.#include <asm/cachectl.h>.#endif.#endif..void ffi_call_SYSV (extended_cif ,... unsigned, unsigned,... void , void (fn) ());.void ffi_prep_args (void stack, extended_cif ecif);.void ffi_closure_SYSV (ffi_closure );.void ffi_closure_struct_SYSV (ffi_closure );.unsigned int ffi_closure_SYSV_inner (ffi_closure closure,..... void resp, void args);../ ffi_prep_args is called by the assembly routine once stack space has. been allocated for the function's arguments. /..void .ffi_prep_args (void *stack, e

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\m68k\ffitarget.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1947
Entropy (8bit):	5.097283694492799
Encrypted:	false
SSDEEP:	48:u69sT8J2EPPvGUuRtWPH+sZITLWXo+FVlcl5MRq+GJmLMWq:uxGPOUwuHtoSlcl5OqXJm5q
MD5:	13C434B27325F5FBE0A8EB0D25D0CE69
SHA1:	8F0B8D351BC4A2B0F087F491ECFE377B41A69422
SHA-256:	F29C86E1277D33C63B3E477C8660644FC00C491AD4DC59E7E7E3A86E47BDA327
SHA-512:	970098AF994FC38F3DDB9EF4CED00747B98D042D24A77D088557842EE9477FB351873F7D09D123181412081A4E007C8E82C29C8453DAD8DF18C3F9A974D5DE37
Malicious:	false
Preview:	/* ------------------------------------------------------------------C--. ffitarget.h - Copyright (c) 2012 Anthony Green. Copyright (c) 1996-2003 Red Hat, Inc.. Target configuration macros for Motorola 68K... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PART

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\m68k\sysv.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8217
Entropy (8bit):	5.576024250033611
Encrypted:	false
SSDEEP:	192:RuHt3f5XFL9DH0sBi/IuxsQABQhQQ2JmhI+i/IuZPsE1O6FLwDHaWQbuYmQy8QQW:RqhXFpDH1i/IuqQcQGQ2R+i/IuZPsGOJ
MD5:	A9479041537E0D5908B642894DF8879A
SHA1:	275D67243CB434898D2C0CF017B6551D8FFE755B
SHA-256:	BE73B16B527FF02DA8CA5A99C7505F8CFAA7CD61AE4BDA77DD7BF97FA47D6A35
SHA-512:	0D2F1C299CF713D6761A5E1CD3F180EA04A442DC1979DED3265FB6C7878FCE03296999D724A97DD66F4DE32CC4A16B5E3D3C1204ABC0FE519CE1BA9BC1F1E5CB
Malicious:	false
Preview:	/* -----------------------------------------------------------------------... sysv.S - Copyright (c) 2012 Alan Hourihane.. Copyright (c) 1998, 2012 Andreas Schwab.. Copyright (c) 2008 Red Hat, Inc... Copyright (c) 2012, 2016 Thorsten Glaser.. m68k Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\m88k\ffi.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10107
Entropy (8bit):	5.12543801291864
Encrypted:	false
SSDEEP:	192:xuHCuL5jPIMSdwLsoxt2zOuC7aCm3EzlGj2mtvnwbXoxt2zOuC7aCm3K41hPG9ce:xJuL5/ff2FhyOC4f2Fh7Mr
MD5:	444738B5406B426B09279081BB5779BC
SHA1:	F9ECCB798A451C3DFA4CC722BF304D4C2A10D7B2
SHA-256:	B68709D814F848AC7C5E78E09E6FC5C7F7F05DD8D42DB46FA6924838D4C8FF0E
SHA-512:	CF8264A97D6C5C5C20D40293E3AAE4D31793BA4E19D5BAA3F5075D24B601A0C74710C1FCA928A3AD1B3CD7D1946FC47EA1616090DF08611BD4E5DA9F961F8A13
Malicious:	false
Preview:	/. Copyright (c) 2013 Miodrag Vallat. <miod@openbsd.org>. . Permission is hereby granted, free of charge, to any person obtaining. * a copy of this software and associated documentation files (the. * ``Software''), to deal in the Software without restriction, including. * without limitation the rights to use, copy, modify, merge, publish,. * distribute, sublicense, and/or sell copies of the Software, and to. * permit persons to whom the Software is furnished to do so, subject to. * the following conditions:. * . * The above copyright notice and this permission notice shall be included. * in all copies or substantial portions of the Software.. * . * THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.. * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY. * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN AC

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\m88k\ffitarget.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1637
Entropy (8bit):	5.2846078728610415
Encrypted:	false
SSDEEP:	48:TasqJzpPv0XzWPHYsXILRI3s/sFZcl+Dyk/nbW6:elPMjuHCus/aclcO6
MD5:	AF8F5CCF69592A72BD80E0D0F3955838
SHA1:	C2BA97CBECFC4DDED3BAC78974414EB8627722F3
SHA-256:	1BC2C3A5C2FDC46B0AE12CC74451FBF03213EEBDC358EB545DCCFC8C07D5DC63
SHA-512:	2B916628A426FC418A6FA4D07191D8629214FBA12FCC9FB6FADE324596E074AD852BA11D2EE3386667777331410D9673068D3900BE078B376B86CC6DF704EF6C
Malicious:	false
Preview:	/. Copyright (c) 2013 Miodrag Vallat. <miod@openbsd.org>. . Permission is hereby granted, free of charge, to any person obtaining. * a copy of this software and associated documentation files (the. * ``Software''), to deal in the Software without restriction, including. * without limitation the rights to use, copy, modify, merge, publish,. * distribute, sublicense, and/or sell copies of the Software, and to. * permit persons to whom the Software is furnished to do so, subject to. * the following conditions:. * . * The above copyright notice and this permission notice shall be included. * in all copies or substantial portions of the Software.. * . * THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.. * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY. * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN AC

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\m88k\obsd.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4911
Entropy (8bit):	5.3418391969741
Encrypted:	false
SSDEEP:	96:elPMjuHCus/QnPjt0vbUqdoCy7BFFsNfWHoZX93P9hsvHoDxNk:xuHCuVJ0D/w7DisoPFePoDDk
MD5:	709B72792CA32486A78DE7CA0853BC70
SHA1:	F2F408550BB4AB40656A125833C3ACD6EB5AD2AF
SHA-256:	E0D08715E7B04238C6512C1DFC5531672D1E363ACA5FDB405CB3B584026BFED7
SHA-512:	6022AC56E04574FB3108F8C6B0CF5CE603DE14C0EB3BD83EA992AF312248151D25D073E3EBA1305DEC9D945BDA9AB6B0DA88B4A113AE80C5293F815FCD58C243
Malicious:	false
Preview:	/. Copyright (c) 2013 Miodrag Vallat. <miod@openbsd.org>. . Permission is hereby granted, free of charge, to any person obtaining. * a copy of this software and associated documentation files (the. * ``Software''), to deal in the Software without restriction, including. * without limitation the rights to use, copy, modify, merge, publish,. * distribute, sublicense, and/or sell copies of the Software, and to. * permit persons to whom the Software is furnished to do so, subject to. * the following conditions:. * . * The above copyright notice and this permission notice shall be included. * in all copies or substantial portions of the Software.. * . * THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.. * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY. * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN AC

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\metag\ffi.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8705
Entropy (8bit):	5.34389892184139
Encrypted:	false
SSDEEP:	192:7GHsI7x3SoxpLvvDvoLk0jIEkZ173YS3gTM+8zH1Xx3SMHZM5gi:7TIlvvELksiI6Z457
MD5:	BD5C369D7CBE5B0672949E7B2140B722
SHA1:	837F188A30164CFA748A96B6ADA9684B910FBBB0
SHA-256:	0BB7D95ED390BBCDF952B7CF8C601718781D07F6EEFAD73B71E70EE060169BD9
SHA-512:	A5627CF12EA076129FE1CFDD7E463482097A1AD2D07AB91E27851F7A6B0D49B6874437709AB6903154D273CA30AAAB9786FB584B447A3743B53E97C92DEA97C0
Malicious:	false
Preview:	/* ----------------------------------------------------------------------. ffi.c - Copyright (c) 2013 Imagination Technologies.. Meta Foreign Function Interface. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. `Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED `AS IS'', WITHOUT WARRANTY OF ANY KIND, EXPRESS. OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.. IN NO EVENT SHALL SIMON POSNJAK BE LIABLE FOR

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\metag\ffitarget.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1920
Entropy (8bit):	5.099355893326815
Encrypted:	false
SSDEEP:	48:u6M3T8J2EPPvGUuRtWPH+sZITLWXo+FVlcl5MRq+GJm2k1W1:u5GPOUwuHtoSlcl5OqXJmg1
MD5:	67AD078B504329E9204F39C0E68C7EC3
SHA1:	238CDC1FB1FB3A74C823B79AB43F424901EDFC91
SHA-256:	3526869DEBE2C001B92571DDC2D1BC425ACDA9642C6B553F3F1FA59C55022EF5
SHA-512:	0E004D9963D4890DEE83C63293A5DFE3E51C574DE35E8E8F84A7E95D41560E047264D92E3E333750ABC9A44831079DA0F275F0B02534EFDA00AFD0C2C8BAF872
Malicious:	false
Preview:	/* ------------------------------------------------------------------C--. ffitarget.h - Copyright (c) 2013 Imagination Technologies Ltd.. Target configuration macros for Meta.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NONINFRINGEMENT. IN NO EVEN

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\metag\sysv.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7517
Entropy (8bit):	5.448195483726825
Encrypted:	false
SSDEEP:	192:4uHt34Dr/zDXjoVkg/RFtVSroe7Xu41EU/:4qojnkVkuTze7+M
MD5:	527FBC9BA0B47D83D075D9419482DB3D
SHA1:	F7E4D6809FD3F9DAE790091940A6B4AE827BBC9E
SHA-256:	BD79B3250234634C66103208F742F54CDD459C4EEE6C18F0869344CA069DEADC
SHA-512:	CD167BD010450B346402C544DAF92C0860F58547A0AF43A7ED50BAE9F45419345D6BBC8A367A9D759EFA4CD7333083B363F158A47B99BE42E946933FA4C8533A
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. sysv.S - Copyright (c) 2013 Imagination Technologies Ltd... Meta Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software.... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NONINFRINGEMENT. IN NO EVENT SHALL

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\microblaze\ffi.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9037
Entropy (8bit):	5.428098211486477
Encrypted:	false
SSDEEP:	192:YuHt3v+UceAMg7rtQ8p5J8/usSYh84OZfcef3NGe:Yq/C59oh8AU
MD5:	E304356D36EB4ED4971634212E726904
SHA1:	D1796565F736118DE3F313DCD296930C9478A9F7
SHA-256:	F23F150FC464C3E6B87661CBBEA1429054E0223E6523F0903A20A950C5F9A770
SHA-512:	A1A0AEF82BDB11F074840DBB9385F2F04B6B2B0F8C2B8AC5B154373A64A3D6818B826D01ECDBFFF438972E9EAFB9202BE617DFA3A9977DFAC4332DFD2ED1FB0B
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffi.c - Copyright (c) 2012, 2013 Xilinx, Inc.. MicroBlaze Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NONINFRINGEMENT. IN NO EVENT SHALL THE AUTH

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\microblaze\ffitarget.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1828
Entropy (8bit):	5.209158219325153
Encrypted:	false
SSDEEP:	48:19UT8J2EPPvGUuRtWPH+sZITLWXo+FFlcl5MRq+J/0Wd:1SGPOUwuHtoElcl5Oq+Nd
MD5:	DEA48C87BAB2E6E9D92C69688CC49534
SHA1:	7C8B915F260FB47A0801F7EEF0FC44A75A594862
SHA-256:	9A975DA19167890D9FA2ED10BC9D9F570C48D284C736E6C8A2F89D2A147C4E44
SHA-512:	EA4B6FFE088445DA4BA7E042AD89F94F5E2A555EDE9B977D5B9BD9399D63C8023686A4C18C137DF060A93BAE3A540A7E2F766A883FA525D842795F107708DC62
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffitarget.h - Copyright (c) 2012, 2013 Xilinx, Inc.. Target configuration macros for MicroBlaze... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NONINFRINGEMENT. IN NO EVENT SH

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\microblaze\sysv.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8772
Entropy (8bit):	5.173296830503535
Encrypted:	false
SSDEEP:	192:EuHt3C2C4s1ncr/Av1gqA5/1ihsq3632Q7x2EoRAd1gUAsRf3BhUiXL7O:Eqqbd05tihP363283gzCf3BhUiXe
MD5:	A3471FED3C5C66DEDE7037C2D82F1CD3
SHA1:	FA1251FC10036663391B912EB4D2B41B5A9E877C
SHA-256:	9611AFE6A3B16F43BA7B5F9BEC1516BBC9F84607D2FCD461E551BC11B8D992EA
SHA-512:	7F8BBBBAC102B8FD8E168FF245D0C6AB3080CE56E5FE21BDA37C7FA684E6B2BD4831CF7BB79481AFA10430D4BDA894C4787EE230556C682A69CAA69004AA5F5B
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. sysv.S - Copyright (c) 2012, 2013 Xilinx, Inc.. MicroBlaze Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NONINFRINGEMENT. IN NO EVENT SHALL THE AUT

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\mips\ffi.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	28942
Entropy (8bit):	5.151419057544754
Encrypted:	false
SSDEEP:	384:DqFUGf+4tpJuRAvnNBure2Icc5kzz3RHGczFhydi71zj:+Fp+4tpJuCBupak8G8i7l
MD5:	5424B005643EC8C79E13C6B10732D0A1
SHA1:	613CFA5A2865856B738113C30DEDEA766F9FEA6D
SHA-256:	DA539668187FB50989DFD1B746BC7393E70D015B5134E47A1F6B61D70346F497
SHA-512:	5380F089FDDFF9CF667C456C9607CCA1A51A0517DEC2C8794F7A80C5816C0E674F4EE6A2F62E571FAAC26A28CADD7434119F9718D0AA3F45E57D905398BEC935
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffi.c - Copyright (c) 2011 Anthony Green. Copyright (c) 2008 David Daney. Copyright (c) 1996, 2007, 2008, 2011 Red Hat, Inc.. . MIPS Foreign Function Interface .. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\mips\ffitarget.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6553
Entropy (8bit):	5.304138912556433
Encrypted:	false
SSDEEP:	192:uPGuHt/lcl5xnxTz5hJqizCDlPgiO7cy7:ueqtcjxX5hJPGe
MD5:	7FEF5AA28262B178987F7D8E96580092
SHA1:	C65D5183366163288588B89157ACA9845C4F58F0
SHA-256:	688135DE0CF55460A81138FACDAC14D796F8456B3D1668A95DBB0EA129C31A7D
SHA-512:	3EDEA08F8F026AF02CF9BDAE6179D2EE0BB67BAD11465EDDD8A5AD19D42C2E58AE44027CBA8A16A42596DB3137F5957CA0748DC1AFE851E4DD76966FE9117006
Malicious:	false
Preview:	/* ------------------------------------------------------------------C--. ffitarget.h - Copyright (c) 2012 Anthony Green. Copyright (c) 1996-2003 Red Hat, Inc.. Target configuration macros for MIPS... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR P

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\mips\n32.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	16499
Entropy (8bit):	5.510894263694242
Encrypted:	false
SSDEEP:	384:kqDC0sAz2YL9hMMi14qyBHDd+ifp5W/xZACP6sF:/DrFL9Gv14BBHTU
MD5:	47F2B0A0AC025294FA78E8D09C51D7DE
SHA1:	1B9880AA0530E93F693ABA1D0A125417DFD8B7D1
SHA-256:	05041C535740B94DE3D657CE2BD13FFE4DDD0FB0C743F927AA9703ACF031A28C
SHA-512:	12B71F46F0C932D73B24EC5D4CC1308A4C58B59DDBEC29A5074F1CDBCEB789A3D7C21EA10707A828F921FF92F6A7A0BA86B7720AD943013AF231D211D4221ED3
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. n32.S - Copyright (c) 1996, 1998, 2005, 2007, 2009, 2010 Red Hat, Inc.. . MIPS Foreign Function Interface .. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NONINFRINGEMENT. I

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\mips\o32.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	13389
Entropy (8bit):	5.486816563505598
Encrypted:	false
SSDEEP:	192:wuHt3fLC/IrGu50m6JbSYGpTqRPoe/o1QYA0BQfToazsG9QY6cvO:wqDC/FQCJbSrU1oeUQgQLoaU
MD5:	75830193B218D280E520CE9FFA525979
SHA1:	C203C7CFF80744225311DD9A0461BE1C8C546345
SHA-256:	E2019859A3239583E6C4895B4293FB7D817F6C2E560F83C6813F91F6C12B7FF3
SHA-512:	34AE4D764F26C22C6599BB2C354CE2223F14B140612CE0C7DBEFA474B1BB39E077CECFC1FA62057397783B7285A41CB4FFEC96D9E321695B228E34EB75FEFE97
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. o32.S - Copyright (c) 1996, 1998, 2005 Red Hat, Inc.. . MIPS Foreign Function Interface .. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NONINFRINGEMENT. IN NO EVENT SHALL T

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\moxie\eabi.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2674
Entropy (8bit):	5.361372341144718
Encrypted:	false
SSDEEP:	48:8T8J2EPPvGUuRtWPHasZILE3q2zf9ok2e6T7x/sTRo7gsbDEnwn5FavLrM9ATVDv:cGPOUwuHS4qMf9oLTlklmp7ivLeATVew
MD5:	BD63095B928C820CFFDC50DCACB5377C
SHA1:	84CAA2D4BF60F767E6F24FEFD97BA9F58DB7D891
SHA-256:	2CD0AB9CCE028CEAED5FA9914CE01F9D3B8B2760B7F8EB11E1C4A685DDB079BA
SHA-512:	6B0B1C0C8C01AB8CDB52A0CC0FAD7D103FA84BAB9AC76002E151E982064C657456C320698000652BDFD11D4388680BBB292D54424E87D8B55C6101B4986E6601
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. eabi.S - Copyright (c) 2012, 2013 Anthony Green. . Moxie Assembly glue... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND, EXPRESS. OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.. IN NO EVENT SHALL THE AUTHOR BE LIABL

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\moxie\ffi.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7655
Entropy (8bit):	5.149013771517258
Encrypted:	false
SSDEEP:	192:1uHt3N2ALw6JZ/4yuDgncR5ZLg69aToNhMYK/L90Vkdk7LGRsHaCzS8h:1qB/eIi539VM4m8h
MD5:	1BC2D64E6A2BADD9A3062686DBC14534
SHA1:	EE8762B19A7A79472001F8F6793A3BDB61603944
SHA-256:	119C236CC6CE14EF62EF04BF6F87509750DB9235840BAA5A55E3B1F9184E56F2
SHA-512:	8954DFA27BA9E64F4A76CC33114244CF88B2A408204457B416BAF72CC321CC1F523E96C1A55E03E37EF7295F0903DAD50DD513CE494217A6370FD151C78B835C
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffi.c - Copyright (C) 2012, 2013, 2018 Anthony Green. . Moxie Foreign Function Interface .. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NONINFRINGEMENT. IN NO EVENT SHALL

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\moxie\ffitarget.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1942
Entropy (8bit):	5.067554043925707
Encrypted:	false
SSDEEP:	48:u6KT8J2EPPvGUuRtWPH+sZITLWXo+FVlcM+GJmjkynb+FWU:uZGPOUwuHtoSlcMXJmjryIU
MD5:	1CE9696E486104A23914C589A1221309
SHA1:	F773BC2C03B63256B4E77B308DE6435DBF63200E
SHA-256:	615C90A132D06A74C931971ACE552B875A688C6D553A6B4EBFD88D1D7D39F96A
SHA-512:	603C1F047AA64CF150038992112BFE31D9F6AEFDF3A400F079C5C39D13DAC36387AC4B6DF40A2E43599299DFFAE1066EE6339CB34C1D48FDAB046299BA5749B6
Malicious:	false
Preview:	/* ------------------------------------------------------------------C--. ffitarget.h - Copyright (c) 2012, 2013 Anthony Green. Target configuration macros for Moxie.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NONINFRINGEMENT. IN NO EVENT SHALL

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\nios2\ffi.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9589
Entropy (8bit):	5.061122203545006
Encrypted:	false
SSDEEP:	192:muHe6UX4B0nJWL1Y33YhpidYnyvCgsiRWzgAusVUU1scinLI0mZv8+:mN6UomQL1U32pEeELnYDusVUY3
MD5:	972354564207577D25B2DE719D8A298B
SHA1:	BF218F2F99AFFA68DE0725DB0E32E557DE8B7F34
SHA-256:	B6DB6E41DEBB710A08248CAB6BC36EC92A8E1C3FD223D6EB154A8F96DAC560DA
SHA-512:	0811CC076108C9F00E871FA51C117B599C99FC7A51E6DC5F1DD1692157D92296F5D4F546E5DA2D1658E5DE8A14D828A5F3B877D21865EC4BA141BB7B1A6E84A3
Malicious:	false
Preview:	/* libffi support for Altera Nios II... Copyright (c) 2013 Mentor Graphics... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:. . The above copyright notice and this permission notice shall be. included in all copies or substantial portions of the Software.. . THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY. CLAIM, DAMAGES OR OTHER LIABILITY, W

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\nios2\ffitarget.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1812
Entropy (8bit):	5.146503754644258
Encrypted:	false
SSDEEP:	48:TT8J2EPPvGURixWPH+sZILvC3IOFUVcl5MRq+GJmLiKZ5txtW8YD:pGPOUiuHe6Ijcl5OqXJmH9Ax
MD5:	AF1EF1C834944ABB57B8572C2DF0A282
SHA1:	A13D8DD6E95E8DF503D135F422AB98047C9A7EAC
SHA-256:	5D2C95EFF324C1AC90C39FC1B289D1A1E09BA77D38E35407B13F40EAF458953A
SHA-512:	D76C2125D607E18EC422B985CFC18DE61784DAC099694B43584541DCA44AAC81FE49C998E1532D16C26E112E391883F02F9AABA5E4DA2CE251106964C21B198A
Malicious:	false
Preview:	/* libffi target includes for Altera Nios II... Copyright (c) 2013 Mentor Graphics... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:. . The above copyright notice and this permission notice shall be. included in all copies or substantial portions of the Software.. . THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY. CLAIM, DAMAGES OR OTHER LIAB

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\nios2\sysv.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3841
Entropy (8bit):	5.164469616355754
Encrypted:	false
SSDEEP:	96:TGPOUiuHe6IFck3c/GbFhxN6zID/KGGnZSdvadwyfNO8B1AGCGaJGvGKGZUal:fuHe6gu/IN6zzGGnZSdvaWuoe1AnXJyS
MD5:	CBA9F8730593AA0A016A6C2B0C791591
SHA1:	98777477B006278A04B584AB6493950D448BE190
SHA-256:	89E6EC064F16250C2E297632F83EC22ADD6DF9ECB87EEABA9FC5BD4B62AA484E
SHA-512:	5E3A93DB45638FED523E7BAF4B99C3EBCD6D43AEF6D195C773EE7F1FEF8125E264E070E7B74175CD34E8962C6E7919B23D099C1B30D23D42947B3A0D41245850
Malicious:	false
Preview:	/* Low-level libffi support for Altera Nios II... Copyright (c) 2013 Mentor Graphics... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:. . The above copyright notice and this permission notice shall be. included in all copies or substantial portions of the Software.. . THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY. CLAIM, DAMAGES OR OTHER LI

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\or1k\ffi.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8485
Entropy (8bit):	4.961504560465385
Encrypted:	false
SSDEEP:	192:4fuHt3DRHmU0jiKbcY8whLoZ+LitmX/BybU5tIDAkBJO7wCGpPN:4fqNCiLwS5mXng/O7wCGD
MD5:	7C71EBD0062610B1037575137335FB1C
SHA1:	302459F397007D09D919B89DF2D5CC2F2851AB43
SHA-256:	CD23DC722E1AA7B2D46594FE9E4C5E8788C64896592CAE8470EB1A2AFE247764
SHA-512:	FEB32856C31D7EFFCB37CBF5ED54EFFEA075B29C79557078049C1F2B3BF92648C034A5383B37B8A80EE205AE4D4B4B1EB01AFF421FC14BDC00043A2934BF5BA4
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffi.c - Copyright (c) 2014 Sebastian Macke <sebastian@macke.de>.. OpenRISC Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NONINFRINGEMENT. IN NO EVE

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\or1k\ffitarget.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2074
Entropy (8bit):	5.1037439348888
Encrypted:	false
SSDEEP:	48:19DoCT8J2EPPvGUuRtWPH+sZITLWXo+FFlcl5MP9+GJmLftWP9O:1po2GPOUwuHtoElcl5C9XJmDAPg
MD5:	CF11F05B0ECE088D52D21699F3E7F6A4
SHA1:	EC256A61274B71D547DBF99E5D2539556C16CC55
SHA-256:	5FB35AA442AA3CABCA8AE8B2F29F849AB3E16376533184DBD87BF996253363CB
SHA-512:	F0A2BAFA46616CA03D52FA8FA26C8D6B247EB6EC3776F09120D096EC7164F943000D68E30875117E3612363E7813BC2C4EB838C9FADCB406CEC5AF6EF8891890
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffitarget.h - Copyright (c) 2014 Sebastian Macke <sebastian@macke.de>.. OpenRISC Target configuration macros.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NONINFRINGEMENT. IN

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\or1k\sysv.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2961
Entropy (8bit):	5.325730946062794
Encrypted:	false
SSDEEP:	48:LoDT8J2EPPvGUuRtWPH+sZITLWXo+FFzhSLThEzeTJ2+IzNcK8WzpfdZJbBo:LoZGPOUwuHtoEcLThEzeTJ2+yNVTzNn8
MD5:	1D34D3ABBC7D50E72537A84C14E06338
SHA1:	95C00EB2E13D665A3E3B49AB741EFB58E6A96DC5
SHA-256:	C2613E5DB24220B0DB69ECA54C411AAF6A9DFD9366AFFDE065C355E81A0A80ED
SHA-512:	AA04C3D63DB18A3F960A4544FA336EA7232A320BAC4D24C9C2E1C7912E54AC91E2A0A89FB55702571553A9E128C22A0FE0457A987391F57D3B2F51E19599657A
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. sysv.S - Copyright (c) 2014 Sebastian Macke <sebastian@macke.de>.. OpenRISC Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NONINFRINGEMENT. IN NO EV

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\pa\ffi.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	20043
Entropy (8bit):	5.265072709756667
Encrypted:	false
SSDEEP:	384:kqaUqch0rB6wl6wKjE+A8WaU+JlM3RXLIh648KAU4Lzs1OP:/aUqN6+6weEb8WaJ3M3RXLIE4cs1s
MD5:	9DA1655CCE76B9D6CD0A939C915DAA55
SHA1:	CC0E668048E4C2E211088075B303ACCFB707A585
SHA-256:	AACF77EB00950832B325A41CE6E8C06CB376A53A3421220B22C42844FC381C4C
SHA-512:	B6C234B7620C3AA21447A5320989955C05B19F5E704D3775241C7B43EC1E88CED85E93588A67B765ABA63276BBDFCE0FCC31751394EAEEA03C84444F0A8BE7C6
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffi.c - (c) 2011 Anthony Green. (c) 2008 Red Hat, Inc... (c) 2006 Free Software Foundation, Inc.. (c) 2003-2004 Randolph Chung <tausq@debian.org>. . HPPA Foreign Function Interface. HP-UX PA ABI support .. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\pa\ffitarget.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2600
Entropy (8bit):	5.201746277071161
Encrypted:	false
SSDEEP:	48:u69zT8J2EPPvGUuRtWPH+sZITLWXo+FVlcl5MR9+GJmG2C1rEWtoWn:uYGPOUwuHtoSlcl5O9XJmcZTn
MD5:	7251C6A684E8DC8D45763614445351BE
SHA1:	062AD1FB410460C349AA373B10B999FF652A6E7B
SHA-256:	3646C04DE513F10F0DA1C2D522A3ADC34C2322A4DE6CA71345BE91DDF899FD35
SHA-512:	1B942F62B5D1779D06C3E31EC3F568F736EE3C2BBA5ADE2C912439FFCE323E703257EF4450ACFB8B0EC4BD9A3E614F09075067C9643802451449799E685A9EB1
Malicious:	false
Preview:	/* ------------------------------------------------------------------C--. ffitarget.h - Copyright (c) 2012 Anthony Green. Copyright (c) 1996-2003 Red Hat, Inc.. Target configuration macros for hppa... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR P

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\pa\hpux32.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9226
Entropy (8bit):	5.466308639321558
Encrypted:	false
SSDEEP:	192:GuHS4JrZTJZWSHou2N76qXGHoTfco+dgKbCL6Oh4:GN459JUSIuA6qXGHoTobUP+
MD5:	F3279DC3EE2648B08C274F2457D17660
SHA1:	38D20EFCBDB4255A93BCD7B0CB7C201302E076FC
SHA-256:	E17214BEB91E445F1D4DFFF2E746DA9309004236E17870C7781DA25E1FBF83FD
SHA-512:	AC037A5FCB85AE2C9AA3CD168F579A2C3DF0233DF83C145FF76B6D4004DB49D7770E2DBC7D72ACEACD13E57C21D34BEC5E43EBEF1C23BB4053AEC4F62EB7DA74
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. hpux32.S - Copyright (c) 2006 Free Software Foundation, Inc... (c) 2008 Red Hat, Inc.. based on src/pa/linux.S.. HP-UX PA Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND, EXPRESS. OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FIT

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\pa\linux.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9678
Entropy (8bit):	5.394552765556352
Encrypted:	false
SSDEEP:	192:ruHSBJXZTJcwHobKN7Fe9h+vfcWlMdczW9bk6X1iRmm:rNBB9JlIbUFuh+v/W946MRf
MD5:	98B9496E03C76F24F66417CEF4ECA116
SHA1:	D5A7804FFF651099E9E4B6E2F065C8C393C6787A
SHA-256:	C1647D0B9A97779608F11FAC8E707D317F4A097B9E5D4D44283E53486CEAE751
SHA-512:	69A7B880BFE8E5E90609FB3E931B6EA84EE6B02CD9AFFF3CC4AA3B72EE5D80BECF7CE5A4EBDF1716425343A7C463AD14E6EB12D6FFAD1A999B08020869329EFF
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. linux.S - (c) 2003-2004 Randolph Chung <tausq@debian.org>.. (c) 2008 Red Hat, Inc... HPPA Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND, EXPRESS. OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGE

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\powerpc\aix.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	13175
Entropy (8bit):	5.487587967293247
Encrypted:	false
SSDEEP:	384:nN4eN/a1wLSPkOjNkDi7ST7xt7kONNyVi3odNciwPkOGNk93kX7kOqNsCH++fpA7:N4f1wL+ljNWiOT7xt7lNNyw3odNciQl2
MD5:	184C7714B9CF25FBBBE0BCC89A26DCFA
SHA1:	0546F01DC4AF0BD15F6A18F65DA11CEBB7BFDC53
SHA-256:	4626E4CB0FEFE1B81BFA110C65C2BE79F4D5C4D7066FBB9D857BEE01EC319C97
SHA-512:	68DA91B39FA692944610A268A1017A578785CF81F9E2C9764757B01FFDFE8CF9F83B1D0AD7A9375EEF30A432CE9599CE8971553E8EACF1908846DDE60A83AA0F
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. aix.S - Copyright (c) 2002, 2009 Free Software Foundation, Inc.. based on darwin.S by John Hornkvist.. PowerPC Assembly glue... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND, EXPRESS. OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONI

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\powerpc\aix_closure.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	15753
Entropy (8bit):	5.422429240031611
Encrypted:	false
SSDEEP:	384:uN4eNJXko3zTy6RyoJPzTfV+orF6z8oBR83CsC7DhFCBd:+4QjfN19Ql43R+DhFk
MD5:	551EDE9BD56160E1C6CD39409BFEC751
SHA1:	4FF65F58B616421E1036A9A1C55169F2773A06CD
SHA-256:	2E4F0E8E11137C9BBA06C2C6493790B502BDF0C5D57E9A2367745EF09F5BB75E
SHA-512:	46E61079C116BBA086CC2EA2156AD8D25D51B8C7954E3A48109D732298FEE79A809E521330E6AE9501D8F5511984236706C0BA05A70CE79BF38440AB314CCE36
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. aix_closure.S - Copyright (c) 2002, 2003, 2009 Free Software Foundation, Inc.. based on darwin_closure.S.. PowerPC Assembly glue... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND, EXPRESS. OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\powerpc\asm.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4316
Entropy (8bit):	5.26606555088016
Encrypted:	false
SSDEEP:	96:0oGPOUwuHS4qMhW6/a1AaDzo9afMDLkMD6MXtFa1XKrMDRDfDmDtA:BuHS4JbiAaDqP1fXtqWA
MD5:	ACDD4F1A6A4093DF0FEB0E71744898B4
SHA1:	61B4D4D9ADCE644A7ABD040045C06509AEFB371B
SHA-256:	88AE9590E5880128D80B5B44E78A08A3A19027ADC4D54D061E2CE0EB24DB977B
SHA-512:	CF158B7F9FD58ABDD3DA3E845DD5D81A7D8CA8C133F90B193E21E1B40B3B3AFDBC0A2E6E680FFAFA91B9FA6954EB1CD180555E14F8E0E08F58F14A9B41188490
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. asm.h - Copyright (c) 1998 Geoffrey Keating.. PowerPC Assembly glue... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND, EXPRESS. OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\powerpc\darwin.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	11167
Entropy (8bit):	5.5916003305843756
Encrypted:	false
SSDEEP:	192:XuHS4JjYCifYMpqHs0pyo1daXlYuAGPElH7fPGpEG3Hc4sMgsJA7TVNULbk9CGpn:XN49fi5qHs0pyoDa1YuAGPCH7Wb384IV
MD5:	FCF4949764155E3174447F2EE55B0DB7
SHA1:	6A2E2A0212219DC67AC8ABF9961E2EC896C8F694
SHA-256:	DB3504BD96DA9E5E49032EBE72D718E1336F7476B6046C804F5E0E5D2A976252
SHA-512:	D40FE246ACEF4436340012E6E31F85F0F3549CB48D97AF4E0D67602217EE667E0B320EC24BBD90F0D47E17B7E346C433E211060D9EC720D0FEC12A8D4B49DA40
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. darwin.S - Copyright (c) 2000 John Hornkvist.. Copyright (c) 2004, 2010 Free Software Foundation, Inc... PowerPC Assembly glue... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND, EXPRESS. OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\powerpc\darwin_closure.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	16117
Entropy (8bit):	5.562744816571378
Encrypted:	false
SSDEEP:	384:lHN4g7iNgW/Ra35pBm899Kaj/wrBpIMjGndASYf1PNNc1fiRFvEGi52VKSJ7E5SH:L4PNrI35pBm8n3LwrblSdASYf1PN+2VF
MD5:	8C2FBC617E204F07672C5CAE0E592102
SHA1:	5EEE7873B137EA69DF1007A0EBA9B02E06DBE667
SHA-256:	895E17B7737462DCE957BE858EC4FA9421ABFA258E7F1D674B347E2DECC2F9BA
SHA-512:	F4C1AEA03D8EB2A0FE54151A133CDF1262644841ECDB5E1693816D5A45A6B2D8FDB7844853514B6CCDE1146B64524A7041219F95C79C1A22665453AA27FF2CF5
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. darwin_closure.S - Copyright (c) 2002, 2003, 2004, 2010, . Free Software Foundation, Inc. . based on ppc_closure.S.. PowerPC Assembly glue... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND, EXPRESS. OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\powerpc\ffi.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5391
Entropy (8bit):	5.211497992545748
Encrypted:	false
SSDEEP:	96:1ebSGPOUwuHS4qM3WyxSkBE15illY/IYxMmjMhfSOSAzTWt:5uHS4J3W4BE1CIDqjXo
MD5:	B18C5D79DB8EC26F2A2A5F5720396E27
SHA1:	4515209D6789537CCF4D9624CAFFD3C456189839
SHA-256:	E71DDF26C51E4FA6905DA7540BD60B3E84B8B1C45A2593BEBDB87EF3024293D0
SHA-512:	9281CB4D95F98671037A8FB18B7B12504E2EBB30F53F91181E9750E42A270C0296B0785FD81145E8221A6BAC4F7B1C997655B5CAAF1DBC74FE23893664ADA54B
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffi.c - Copyright (C) 2013 IBM. Copyright (C) 2011 Anthony Green. Copyright (C) 2011 Kyle Moffett. Copyright (C) 2008 Red Hat, Inc. Copyright (C) 2007, 2008 Free Software Foundation, Inc.. Copyright (c) 1998 Geoffrey Keating.. PowerPC Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVI

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\powerpc\ffi_darwin.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	39413
Entropy (8bit):	5.244601812887184
Encrypted:	false
SSDEEP:	768:64u036Ngstwrb9NVwYmV3GbfVRe2DwpJxEeXSD37EeX6W5yNCKD2HKEI35CBu8nG:64h32wv9NVUVWbfVY2DaEeXSDrEeXl6J
MD5:	6FC4431F0726DC44E0AADBD98F1B862D
SHA1:	103463083356223C08D045137D0187453959BED2
SHA-256:	B1D4B9CF36B40409B68EC9C45CB343905ECB2B304207469973CFCCB71993E844
SHA-512:	E4936BED2DD053BA5AF01507C228C8BC48C67348682E5DDCD0DADDF0DFD10B9782FB22172BFC9D70C5AA1819E1442B3A16E0B0974386AE583680A6D23A00E5D5
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffi_darwin.c.. Copyright (C) 1998 Geoffrey Keating. Copyright (C) 2001 John Hornkvist. Copyright (C) 2002, 2006, 2007, 2009, 2010 Free Software Foundation, Inc... FFI support for Darwin and AIX.. . Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND, EXPRESS. OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\powerpc\ffi_linux64.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	30862
Entropy (8bit):	5.194522619711193
Encrypted:	false
SSDEEP:	768:n48bmzq5CPlrpgrTrHnSBK+9J+9c9aehKX0CSlSHrw0eigeaZD9fB/UPEAi:n48bmzsyokaehKX3HQz
MD5:	AD0DA4AACE3B256F7473AB4C0F3488C2
SHA1:	88ABE9E90A034D049F8A0DE62821588BFABB2D31
SHA-256:	664BDF52D3B50A7CEEF48C55B34C581D427D159BB61837F3308A8F8935CE260A
SHA-512:	A42FCE54CCD177FBB5EFA98A30683EAD76C2ED6FB27727BF328A63276B49B002C131A62DDBE4FD60ED1F77584F21F877E2AF1732AC701AA4E12CBFA500BD53CA
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffi_linux64.c - Copyright (C) 2013 IBM. Copyright (C) 2011 Anthony Green. Copyright (C) 2011 Kyle Moffett. Copyright (C) 2008 Red Hat, Inc. Copyright (C) 2007, 2008 Free Software Foundation, Inc. Copyright (c) 1998 Geoffrey Keating.. PowerPC Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substant

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\powerpc\ffi_powerpc.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4092
Entropy (8bit):	5.30341291427969
Encrypted:	false
SSDEEP:	96:1hSGPOUwuHS4qMG28CX2XHNP1Ry1vVt8szAn:QuHS4JsCXgHJavVtXAn
MD5:	15694D444C0B786EBF5D385E49454D57
SHA1:	3BD858609D20CC349097ADB2512A1E89FDA294BF
SHA-256:	B60064D0164DEFB765B8179C996A6DDA5805CC034414064C8F3C57561B22DCDE
SHA-512:	4B0DEAC89BBC135FF053990B50D838AD35CF072FA1EF6CA300B2DF376248067C6C0BD966BC3AF03B11C6884531F931802266021151F9A20419B603F1C3A39D7F
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffi_powerpc.h - Copyright (C) 2013 IBM. Copyright (C) 2011 Anthony Green. Copyright (C) 2011 Kyle Moffett. Copyright (C) 2008 Red Hat, Inc. Copyright (C) 2007, 2008 Free Software Foundation, Inc. Copyright (c) 1998 Geoffrey Keating.. PowerPC Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substant

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\powerpc\ffi_sysv.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	24617
Entropy (8bit):	5.248291278331258
Encrypted:	false
SSDEEP:	768:K4kGk+rVy73cB1gV+L3e/SlWakCLJoWpHS:K4r73G
MD5:	B3DFDE8013F5032762B6B7B21B089599
SHA1:	7C1CDBB9B2329926C4B00DC167C3657B3456FE5D
SHA-256:	3FEDA390184634474602E5E231FCAD9072C5A93D931F13B979CC460A911F83FC
SHA-512:	B3EC39BBF56A7131705E7EA9E55FCC9901D27DB48A900F421ACE17D3A3D1E664D6EC10E1CBE47F73F514624FB6C9A5C49CEB3058E4C00E5EE710F60800B73420
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffi_sysv.c - Copyright (C) 2013 IBM. Copyright (C) 2011 Anthony Green. Copyright (C) 2011 Kyle Moffett. Copyright (C) 2008 Red Hat, Inc. Copyright (C) 2007, 2008 Free Software Foundation, Inc. Copyright (c) 1998 Geoffrey Keating.. PowerPC Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of th

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\powerpc\ffitarget.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6294
Entropy (8bit):	5.379945674946769
Encrypted:	false
SSDEEP:	192:uCuHt/lcl5ieZdlJKMq9i2ZDkgj/ZcRBX:uCqtcoeZdlJKMq9i2ZDkgjxIX
MD5:	A355FD8F3B93F9F1CDABBCD382F689F1
SHA1:	11A28050EE9BF3038C1B822A862B63EF2151ACF6
SHA-256:	302E085CF78C8A08ECD75A763710A63457A405C6B9D7DD9DC1C004A942A536E9
SHA-512:	FF275F1E60F8B85081EC681A0AEAC66C910821A1A04E1A2C81FDEC2183F13F4748D42C825559D617791DA999DF93D05A8D4709094CAF07C31BD91EFFB2BE8584
Malicious:	false
Preview:	/* ------------------------------------------------------------------C--. ffitarget.h - Copyright (c) 2012 Anthony Green. Copyright (C) 2007, 2008, 2010 Free Software Foundation, Inc. Copyright (c) 1996-2003 Red Hat, Inc... Target configuration macros for PowerPC... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING B

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\powerpc\linux64.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6581
Entropy (8bit):	5.469539383404272
Encrypted:	false
SSDEEP:	192:yrZuHt3lccoGe3fw9mEAquTIZLgG/DGHbGJkdo3JAAp99JlS34S+mO5jPr2y9ZeQ:yrZq8r3fXEFSIZLVK6JUoKmfd
MD5:	2D5A0B8F27E65D0CBD338D0F99CDCE96
SHA1:	E31862FE386A8B2E6360BDAF913B30826035104E
SHA-256:	FAE97C566A72A89D89E35CE7D7E0205BC4635BA375FE859E281032F7FB39B472
SHA-512:	BEBB32126DF867FCAF888543B9AEE88B70113A43B797B135D8A75174F435A9E1EBEB7712F6FCC56F1450358EB0CB3F28454244D9446F6DD3C7F09182C573E503
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. sysv.h - Copyright (c) 2003 Jakub Jelinek <jakub@redhat.com>.. Copyright (c) 2008 Red Hat, Inc... PowerPC64 Assembly glue... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NON

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\powerpc\linux64_closure.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	13222
Entropy (8bit):	5.515662496280312
Encrypted:	false
SSDEEP:	384:yrZqUsxjkx8Qa+H2Q2wD2s6jRnfLhPcCQuP8jLUojx:yrkUsJkx8QaVSL9x
MD5:	E6109C395E69DF41B049828A7967EA70
SHA1:	BF60FC6011512A1992CFA4BE6D3D5EAF265EDCC5
SHA-256:	B78ADC67604115BAD14A2CB05081E08C083AE55D4DC6B776E8FBC6790575B797
SHA-512:	6254FEB26D15D8B74AED07285811E21225AD50889ABB37DF0D37E58AAA48ACD802A92DC2E4459C40B15D53BBF5C1B87A91BF8EFB89182FBF7D15250383940E31
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. sysv.h - Copyright (c) 2003 Jakub Jelinek <jakub@redhat.com>.. Copyright (c) 2008 Red Hat, Inc... PowerPC64 Assembly glue... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NON

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\powerpc\ppc_closure.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7872
Entropy (8bit):	5.435874425219041
Encrypted:	false
SSDEEP:	96:yNGPOUwuHtoEevDGw2SHEG7ovcoiRz0Zeo5XmO7crDWRezpSP95r/V+:yzuHt3YDtzHBokoiydAc9xV+
MD5:	DEBA483BAB067974966EC684FE6AF5E2
SHA1:	0ED106DA5EF4538F3D55734574E26CB82B0CCC14
SHA-256:	6DF911DE61A58E2E003DB4BC5C6076C9E2DA18244805C92EDBC57586E8D74AEC
SHA-512:	D010DCF63644CCDB0DA56D366019D2573E75BA0D0FB4AC52F7E0C0246FBAAD704D76BC08571A95CD8FA5F2A633E7596B9F2B120B3C81A7B5DDF8F1CDA998543C
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. sysv.h - Copyright (c) 2003 Jakub Jelinek <jakub@redhat.com>.. Copyright (c) 2008 Red Hat, Inc... PowerPC Assembly glue... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NONIN

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\powerpc\sysv.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4600
Entropy (8bit):	5.490370090944647
Encrypted:	false
SSDEEP:	96:tgpGPOUwuHtoEUZCYd1zbyn12lqsPSWaAmGa1GttDmEMo4TZjUiUyXiNjyPFDeEb:GPuHt3UZCYda2lqCSWaAmGa1GDDmEMoa
MD5:	ABBC89ABEA23FD5A16934350896A7D30
SHA1:	261AA8D46D18B7AD5762B62EE045E2AAE5E4EDDF
SHA-256:	B0DC61CC95ECE495EABB2121C31C704CD94D5884600FDB3154CE40ACED1556BE
SHA-512:	CAD0435FBD3FBEF67967966ACC8373B819B50950BA0E628A450945BD6248069486119A2E7EAA959882BCE0960BD7ACB2F4910F8109DD10570A281B265BECD466
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. sysv.S - Copyright (c) 1998 Geoffrey Keating. Copyright (C) 2007 Free Software Foundation, Inc.. PowerPC Assembly glue... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NONINFR

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\prep_cif.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7837
Entropy (8bit):	5.227903521522474
Encrypted:	false
SSDEEP:	192:auHt3i1rJEej/AnDQqg8yqH3vjzAbg2jEX2GKtUq7TG0jt33Cfpb6SbT4:aqy9JdjYnDQqxH3vjz04X2YiT9jt33C+
MD5:	5D9F395ECD3691762F09430197F7243F
SHA1:	B0CEFD0989A75CEE66032B0B448BF03E5784C86A
SHA-256:	AF9EA280D1EAA07C51148269D6793FEF9D078693BE3AB2A9AA37110C15CB1B91
SHA-512:	415151205ACD121139B124B8585AF10606A62CCA4E66333E007E81A9FE8DA7FDD692FEC36633A35207E4CF2B6CFBA1EA4A0811C6B311C93B97ED19761F45E89E
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. prep_cif.c - Copyright (c) 2011, 2012 Anthony Green. Copyright (c) 1996, 1998, 2007 Red Hat, Inc... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NONINFRINGEMENT.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\raw_api.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6292
Entropy (8bit):	5.357562028013441
Encrypted:	false
SSDEEP:	96:hUAGPOUwuHtoE6ZMLVi77ZijXUQO7et+IJa8H7Qy3vzn7ObJ66qSTKc31JJT63bB:KGuHt3mSydijEQOqt+IJamQy3bEBJWB
MD5:	0F87FD960DD5AB7D9AD685435F358014
SHA1:	ED49D504F9EB9FEFF3C96F072CDDC5388991EDD8
SHA-256:	D7EA1C81FC13E9FCEB0DC431BC865E224D7BE1E84483039EB4AD79144EF29C34
SHA-512:	C64AE63BF69FD67E0ED212891BAD17EF8584966AC2197EFDF0FA18B64D471EF0834629C4AD5EC85A72AB134979CAE8BCF73205691CC52F7A3F29D2C5F9D81B47
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. raw_api.c - Copyright (c) 1999, 2008 Red Hat, Inc... Author: Kresten Krab Thorup <krab@gnu.org>.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NONINFRINGEMENT. IN NO EVENT SH

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\riscv\ffi.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	16403
Entropy (8bit):	5.102459387857596
Encrypted:	false
SSDEEP:	384:IqCt31MtfTgsKX80s0v2b6EovIvApvsu3RiXB/ei:7E1MtfTgsKscvvtvZpvbm2i
MD5:	8F14CA5A5D9994B06FA1E35AD62C9C98
SHA1:	90B00505C3456E090DF95B30F87005479A8089E4
SHA-256:	121DFE2D01DC27AEAF3C20941923F43EDF4CBC8DA1196FA8C3882F73231ACAD8
SHA-512:	6E764EDEBF92E3F0FE55006536D35E9FD9E87B76B083DB22C57E9741B6507CDECC3D1A940FED3177785F6BE3FC85781027F2E25B3851BB7221C518934E2210F8
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffi.c - Copyright (c) 2015 Michael Knyszek <mknyszek@berkeley.edu>. 2015 Andrew Waterman <waterman@cs.berkeley.edu>. 2018 Stef O'Rear <sorear2@gmail.com>. Based on MIPS N32/64 port.. RISC-V Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF AN

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\riscv\ffitarget.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2357
Entropy (8bit):	5.181341417185249
Encrypted:	false
SSDEEP:	48:u6RT8J2EPPvGUuRtWPH+sZITLWXo+FVlcl5MRShzkk+UATtgRSJWs3M:u4GPOUwuHtoSlcl5OAfnYtgVsc
MD5:	A455990E50EBE413228C8095B32780A6
SHA1:	362BE932894034F3D648F35533129C329E507AF2
SHA-256:	E99D39A6622A5C1B3B0F164A89C45E53E60DA2719EF15781B25E8FEFCBEF1A43
SHA-512:	7F2CD4D450FF713689B6690BA039060F4065EC533DDBE507155860FD83827EBEA1ACD7DBFC55D2E5215F973889B9F4224B0AA08DC5264EDE721350869B9EA17E
Malicious:	false
Preview:	/* ------------------------------------------------------------------C--. ffitarget.h - 2014 Michael Knyszek.. Target configuration macros for RISC-V... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR C

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\riscv\sysv.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8082
Entropy (8bit):	5.04805118042826
Encrypted:	false
SSDEEP:	192:EuHt3jrW4o5sPA6KikQBxSk2YC0M5Vs++321GP+RbYKnOC5M5Vs++32eEzRbYKno:EqzSZQBxcu2UPmbKu2eebG
MD5:	C2701659C3363F2F239B73C60FE7C498
SHA1:	51D7A6A34F94DFDE056067A15ABF6E8CFD9E4C63
SHA-256:	20E6CD75B24B3E3061B4FDCE2F6FEF88B32FA33A89F01B623977EBF4C56F5195
SHA-512:	DBEBCC36FD4FD649306C735C6FBDEDA8161E57BAF02A779DDFDB5893D17400C61E8FB53CAF946099D74B42BDAFE76B8751AAF2E7BD67E1C399143C30F076395F
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffi.c - Copyright (c) 2015 Michael Knyszek <mknyszek@berkeley.edu>. 2015 Andrew Waterman <waterman@cs.berkeley.edu>. 2018 Stef O'Rear <sorear2@gmail.com>.. RISC-V Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\s390\ffi.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	21358
Entropy (8bit):	4.96414328764977
Encrypted:	false
SSDEEP:	384:9N4EmFDchiIFNB4SQj8ZUcMFFCW0TS2hy5rmg/GjfXIeaw:34nCiI94PjscFFOy5r06w
MD5:	AB8266659FDF9D027F4FCDAEFE6F2882
SHA1:	DCC0E0E76C2843B978D1B44EA12EEFF42CAFEEFD
SHA-256:	75C81D7329E261DC1177B5C7B7817FE894F06AE66130FF295C2B41C93C2BF134
SHA-512:	83C5605E5061C4E455D1604CC406753E52F6B7F44BEA045EED67BEFC0B0715FE5757D8AC6B19B844E162B6E438C3C7EB83D51950920A08221D478591DAD637C3
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffi.c - Copyright (c) 2000, 2007 Software AG. Copyright (c) 2008 Red Hat, Inc.. S390 Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND, EXPRESS. OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRING

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\s390\ffitarget.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2256
Entropy (8bit):	5.148950022362516
Encrypted:	false
SSDEEP:	48:u69bT8J2EPPvGUuRtWPH+sZITLWXo+FVlcl5MR9Mu+GJmLrWtoWx:usGPOUwuHtoSlcl5O9bXJmeTx
MD5:	B3368476E8654A67A996FC3570993A59
SHA1:	E953B61C491E9F56660807BA8E50C69120D9746C
SHA-256:	DC96F638D83A5678232A6A7E6A65334CFBF3F1ACDEC2E3572ECDF3AD1DDF2B5C
SHA-512:	AB17E42B751093DB11E9DFC09C3009087692C2EE677C633EDF84026E28A796A315C6FB52A351B537F0D1A322369D932CB3D112BDF009BABF30A9513950CF6102
Malicious:	false
Preview:	/* ------------------------------------------------------------------C--. ffitarget.h - Copyright (c) 2012 Anthony Green. Copyright (c) 1996-2003 Red Hat, Inc.. Target configuration macros for S390... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR P

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\s390\internal.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	312
Entropy (8bit):	5.100211717634367
Encrypted:	false
SSDEEP:	6:UH32HZDBNf1di01QkM01gF701FGF01yJutZjb1loC3f1KDmby0zlo+v:UH3yNNdigfk7gFtyJSZn3NKDmbyolv
MD5:	0CD10B848C2FEFB644A3EA94D8B40895
SHA1:	65831B09E2F10D5A7ED924D689956E6BFC6788AF
SHA-256:	357B4F5BC87AC38B5ED5A07767E2E72FB67096301F32721A385D6F573826F2B1
SHA-512:	81669B26A5B33C08E568D43B3B41917BD09C8FFE05EB27507F7964DF4427CE55792262C505BC6976952102ECC10D8F344140BE586530CC1A8863E1E417A9B8D7
Malicious:	false
Preview:	/* If these values change, sysv.S must be adapted! */.#define FFI390_RET_DOUBLE.0.#define FFI390_RET_FLOAT.1.#define FFI390_RET_INT64.2.#define FFI390_RET_INT32.3.#define FFI390_RET_VOID..4..#define FFI360_RET_MASK..7.#define FFI390_RET_IN_MEM.8..#define FFI390_RET_STRUCT.(FFI390_RET_VOID \| FFI390_RET_IN_MEM).

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\s390\sysv.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7502
Entropy (8bit):	5.419202647928275
Encrypted:	false
SSDEEP:	192:euHt3Khjodv0W0VKcoydPpjn4o6oNeoU2QfV+CFo07nQoGomF:eq3dgVK0HNbULVEIZmF
MD5:	2F187548E6D19ACD4B026E3124FBA409
SHA1:	0FAE7C792A0D8ED30BF5A05376E1DE37762D6DBE
SHA-256:	A49F55011BBF142097414A32395BD5050F361FCA5F8D4264C96E9CDE3A40E18C
SHA-512:	4479BC8C1E847661082A9E3B956BAD7BF893B9A3E15F4A11AA994B486FFDFEB2F3197BC3F7848E2904C968B8D4A0979EEDE9743C16D0E2B6A2A754D0B2D69E41
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. sysv.S - Copyright (c) 2000 Software AG. Copyright (c) 2008 Red Hat, Inc... S390 Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NONINFRING

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\sh64\ffi.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	11304
Entropy (8bit):	5.238616466949082
Encrypted:	false
SSDEEP:	192:+uHt3P6TBVy8tlqf8rYb2ZgALNgQb13KBDsX5/YCLZCf+/5XMmDRcKH+32nbmXB+:+qfMYwgErlHJuDu5/YKZu+RcwcKH+gOK
MD5:	40145FC2A1019D93AD69D0410503916C
SHA1:	0346F528C01C7D30E022B77EC99A92C74360E493
SHA-256:	7AA411C675749189389E88D4047DC95495C4BB159330E9CCC13C6BAC0A4E182A
SHA-512:	98735BB9C441A72F36992575F5343D69482C4C108ED502DCD091DD6487DD58CA7150A5DE5C01E3A823FD1C0534FC89344B789AEC58CCD1D7E6D91291060D392B
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffi.c - Copyright (c) 2003, 2004, 2006, 2007, 2012 Kaz Kojima. Copyright (c) 2008 Anthony Green. . SuperH SHmedia Foreign Function Interface .. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A P

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\sh64\ffitarget.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2077
Entropy (8bit):	5.063055513747967
Encrypted:	false
SSDEEP:	48:u69/T8J2EPPvGUuRtWPH+sZITLWXo+FVlcl5MR8+GJmLCWty:usGPOUwuHtoSlcl5O8XJmDM
MD5:	BAFCFB82EB59A68953D6EC8C4C56812B
SHA1:	FC8E10DCA96C9170FE41C08F9178FF473F0FF35A
SHA-256:	200CDEFF23918F5684A1A6EA20452FDEB74F891F81A2984A7907B97237718745
SHA-512:	7D782927216B44A86C1D148B2DDCEB58E8EDAC5F85D3E91218EDA3A3FB3D0DCC266D13977D0093B73A3CF4B329BCD2F6E339DB999FDC36666344269CEF8DC542
Malicious:	false
Preview:	/* ------------------------------------------------------------------C--. ffitarget.h - Copyright (c) 2012 Anthony Green. Copyright (c) 1996-2003 Red Hat, Inc.. Target configuration macros for SuperH - SHmedia... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\sh64\sysv.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	11693
Entropy (8bit):	5.435998053575651
Encrypted:	false
SSDEEP:	192:buHt3flEpoX7/eYS82TI60bmFAXixcjXLRyaV0Xj4taNp/NOmzRU6J4KLakCIzsY:bq/r/eYS82TI60bmFAXixcjXLRyluaNl
MD5:	981772E8EEDF7BA19049819909040D94
SHA1:	1F1EA42CD64BFF02D2C750118C33BFDD6CAB5407
SHA-256:	332A0D1B527DC7E02F4ABB2AFED63A21D0EE89DE6FD0E1C62940D5EBAEBD4402
SHA-512:	2580146C5F8674D4F6B2977AA75E08AAEF03E21450ECB944E1212942AFD60A94C0418309519D7681EEB2790D51824ABFCE9E1878018B82D4315D156E87E627BB
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. sysv.S - Copyright (c) 2003, 2004, 2006, 2008 Kaz Kojima. . SuperH SHmedia Foreign Function Interface .. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... . THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NONINFRINGEMENT. IN N

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\sh\ffi.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	15240
Entropy (8bit):	5.151638608931193
Encrypted:	false
SSDEEP:	384:6qJL2jSMFeMlpGGNBhT56mSW/k/vVSH0mAIu6BcFwI88LPb:tkSM0MlMGtyNSBiv
MD5:	7AEF7F35E26674EC5BFD80CE6CFAB20C
SHA1:	9C9548B8D335D9BFD29E1710D1F2B5D835E5B047
SHA-256:	B91B3B17D9F1A6587AF6FE0C4D59A45C3F467F93CCA552D464A0C1B4D8B2C50E
SHA-512:	D570344733C8009A0F171A9F52E92D6B9C39D36AE91AB4C7A98F6FB8F70ADEF421A145C70B9AC7AC89DF2E4A7DF71D8CC9A7A896103E9D11F86FD27408FA798D
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffi.c - Copyright (c) 2002-2008, 2012 Kaz Kojima. Copyright (c) 2008 Red Hat, Inc.. . SuperH Foreign Function Interface .. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\sh\ffitarget.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1940
Entropy (8bit):	5.091058024149855
Encrypted:	false
SSDEEP:	48:u61FT8J2EPPvGUuRtWPH+sZITLWXo+FVlcl5MR8+GJmLcWq:u4GPOUwuHtoSlcl5O8XJmRq
MD5:	2BC28603ADE2A1E9718180B01C9346AC
SHA1:	D8B4ACD1A043C1BE89A5C0A0F2A783CCF98861C1
SHA-256:	FB4105B6087D88B03A6D6D991E3F6F3C47C1006F0D9311262B3DD5FF76339542
SHA-512:	76F7E8E36C23BBC9996EB7998F6F04DEEBE9BC78FC3D7EECF979F835898897DB1CADA0AAFDFB7CE8CCB2EAC8560E3695CF7CE7DE4722A5B8217D7FF129BA6FFF
Malicious:	false
Preview:	/* ------------------------------------------------------------------C--. ffitarget.h - Copyright (c) 2012 Anthony Green. Copyright (c) 1996-2003 Red Hat, Inc.. Target configuration macros for SuperH... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\sh\sysv.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	14687
Entropy (8bit):	5.544685677149626
Encrypted:	false
SSDEEP:	384:SqUDgit6nofEJw5w38T1d2velHM3jzKvw:F0mcGelHMnT
MD5:	7E0990B03E6CFF0ED4B1C69CA758A1FE
SHA1:	29CA121450D6DCC62B9D62081B6AF619489B1418
SHA-256:	AEC8DA0BA9C1792923EC9E937B41AF529DA8959448D45826BF907D0703B1B0C6
SHA-512:	63882B06FD4D02E996A9348D3DFAD394C076CB20940C7210A36468D48F9CA6E3A03366D8CC7DC5CA3A83C25FC7BE9CC95E7E33C1CC60DFEE01826B0257DBFAD0
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. sysv.S - Copyright (c) 2002, 2003, 2004, 2006, 2008 Kaz Kojima. . SuperH Foreign Function Interface .. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NONINFRINGEMENT. IN NO EV

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\sparc\ffi.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	11244
Entropy (8bit):	5.319290475577902
Encrypted:	false
SSDEEP:	192:OPuHt3vY9o/IvdCTx/dr7uS9B8eoTIpYZ9Ega7fpzRbn8LtnOy943IC6/ub6rZEW:gqfHu9TIpYZWgORZn8ZOSZZr2NnXE
MD5:	0E963B7CAE88AA092FE7E2293FD3285C
SHA1:	CD495ADBD6AE723769A5CAFBD02FE78538A257B7
SHA-256:	97E79944E54749353D0477365BBF41C2E98AC159CEE661943938CB0270460587
SHA-512:	16717ADCA92F1FD4630773AC618A818DA21E775EEDC0ECFAFBF8323CD92768F1CDB8A7424E813B97BDB51CF36D84B6EF9159D16EE4E16497103944A79C60B91E
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffi.c - Copyright (c) 2011, 2013 Anthony Green. Copyright (c) 1996, 2003-2004, 2007-2008 Red Hat, Inc.. . SPARC Foreign Function Interface .. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PAR

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\sparc\ffi64.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	14949
Entropy (8bit):	5.277139851550606
Encrypted:	false
SSDEEP:	384:8qiNiYaHFN0gZByBMmUZopwNkRLY6u6FUsZaN7d9:XiNiYaHFL2MmUZiRLY2I7L
MD5:	D91F1EC3FBD46CAF1508582B9D90530B
SHA1:	3D4F5AB1511C0F3CF428F68969D4C580714D8815
SHA-256:	919F7159C80692ABC7833B243F40E754FB6CB0195ACB6865E20CAEF42D3E6B63
SHA-512:	680BFFFA4B06EE2E4F1C70AEF5C110B698C6B51A32C93E1966E069F25B73E40AFC59B0C00F7FDD9F186D68CA1BA1D60909C37558699DBC988F8CF5DABC04C29E
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffi.c - Copyright (c) 2011, 2013 Anthony Green. Copyright (c) 1996, 2003-2004, 2007-2008 Red Hat, Inc... SPARC Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICU

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\sparc\ffitarget.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2470
Entropy (8bit):	5.182697537151812
Encrypted:	false
SSDEEP:	48:u69Q0T8J2EPPvGUuRtWPH+sZITLWXo+FVlcl5MR3t6V+GJm0hYovXrpWZWo:uJEGPOUwuHtoSlcl5O3tYXJm0ZbM8o
MD5:	AC0F8F25F159C2358B99625E7CE6904E
SHA1:	73FED48A7C6D10BE389753EDD09223921A659F16
SHA-256:	255BCDF721E066D91F5DD20AD4868DCB3A5F523B0D8A74328F25D5D44D7DBEF4
SHA-512:	5130C63068C7EBC6AEFE7C0B326657FD9302D6F0C6468842013EBE229BDFB5AFAD1631FCA123E1CF77B74A75E0A1C27A887695BF668114FF03F5CB98B96C299A
Malicious:	false
Preview:	/* ------------------------------------------------------------------C--. ffitarget.h - Copyright (c) 2012 Anthony Green. Copyright (c) 1996-2003 Red Hat, Inc.. Target configuration macros for SPARC... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\sparc\internal.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	733
Entropy (8bit):	5.053233401119177
Encrypted:	false
SSDEEP:	12:Hez41qJrn4ED04JYn4p4M4w8F4KFF+FmEc22E4T4tc0OaL+DNuE4l6dFn4l6WL4c:kDRnHD096zt8F7FrEqEgr0OaSDNuEjnC
MD5:	3EC745FB9ADABB2CAD31B87DC3A175C7
SHA1:	06B66AF2D93E54BBD3F8F477ADE134859794CE08
SHA-256:	E526B44E6C13FBA4931B4C2F7E398A17459EE5179A12184D06B9A5D53184670A
SHA-512:	4AC93CF8C7D68818D6C61E12E74EC940ED1E12FDAF054C2B401183D4ACB85641D6A46A4688EC2EB81CD0B0AFB6D44C9E677411392368A15DEEC02764641C1F3E
Malicious:	false
Preview:	#define SPARC_RET_VOID..0.#define SPARC_RET_STRUCT.1.#define SPARC_RET_UINT8..2.#define SPARC_RET_SINT8..3.#define SPARC_RET_UINT16.4.#define SPARC_RET_SINT16.5.#define SPARC_RET_UINT32.6.#define SP_V9_RET_SINT32.7./* v9 only /.#define SP_V8_RET_CPLX16.7./ v8 only /.#define SPARC_RET_INT64..8.#define SPARC_RET_INT128.9../ Note that F_7 is missing, and is handled by SPARC_RET_STRUCT. /.#define SPARC_RET_F_8..10.#define SPARC_RET_F_6..11.#define SPARC_RET_F_4..12.#define SPARC_RET_F_2..13.#define SP_V9_RET_F_3..14./ v9 only /.#define SP_V8_RET_CPLX8..14./ v8 only */.#define SPARC_RET_F_1..15..#define SPARC_FLAG_RET_MASK.15.#define SPARC_FLAG_RET_IN_MEM.32.#define SPARC_FLAG_FP_ARGS.64..#define SPARC_SIZEMASK_SHIFT.8.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\sparc\v8.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9640
Entropy (8bit):	5.60715763617371
Encrypted:	false
SSDEEP:	192:PDuHt3WEXB9YEsQoTBFTclTLFGvDuJU9TQIqcghzFTVRZ9ZTPfLTZ4qPfvlGOSrW:rqFXBu9lclJYuJU9ThQlVRZ9ZTPfnZ4I
MD5:	991FD1C4E25A52E37E32D4A900E0152A
SHA1:	FC20749DFAF357FB7FBFEF86645107866778C137
SHA-256:	76D81E84943A95CD71011757A362BE5C80E9EFDA2FC202AB03FA34696CEA6785
SHA-512:	3509A0EC766475B2FB45B0C980C9D2438DCB067BA37E8665BECD62FB84D2B553BBEB0FA7B01E3735FFA16AC27FA0A96FA5F2AABFE3668B981D49FCF35D2DA090
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. v8.S - Copyright (c) 2013 The Written Word, Inc... Copyright (c) 1996, 1997, 2003, 2004, 2008 Red Hat, Inc... SPARC Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULA

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\sparc\v9.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9884
Entropy (8bit):	5.6672578001547125
Encrypted:	false
SSDEEP:	192:1RuHt3fgE3XB9+SpLhJtO6U8/15tvSRp7vEOFKlX9r1rsrZ:zqHXBvbI
MD5:	E8A7DC5891A2D4077A6736C3F99CFADA
SHA1:	BDF9A39AC128065D5B1488F9A423B45A684A370B
SHA-256:	D776DCDF2BA9063C040B9D96A761624A12E4CBDBBE79C27199D2F112016536FE
SHA-512:	A7D5DBF91E91D0F7BA083F0D613F6E1F452C6DA9146A08C74B6602C2DB8760B551B5C88ADF5EC3394F2DB498492EB6330FBEEFD4FEB0D856C334AEA0FE1BB8FA
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. v9.S - Copyright (c) 2000, 2003, 2004, 2008 Red Hat, Inc.. . SPARC 64-bit Foreign Function Interface .. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NONINFRINGEMENT. IN NO E

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\tile\ffi.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10309
Entropy (8bit):	5.010999730640812
Encrypted:	false
SSDEEP:	192:VuHt3S17jrmHHqcXUe84QgCXYWcCx3m4eLPJCn0+C5cCWj/4PNWHdPo5Sex9kiS8:VqgnmHHXEJtaxgj/E4C8S9knEwaX
MD5:	74934128AC3FACD5EB561545BDBC5532
SHA1:	F0099571B355E9912E153220BCE9A62F401D1442
SHA-256:	B4720CDA72947C595A9C882CC9EA525A3DD648AC57043CD65F01819AEAB9A558
SHA-512:	C6C3221409444B44DFD51B0D724B06508285F559D00AE19E0053281D306A1064B6363FEEA6A71E0CCF51220333565283215C51411684B39841FB6A5C25F2E8E4
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffi.c - Copyright (c) 2012 Tilera Corp... TILE Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPY

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\tile\ffitarget.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2174
Entropy (8bit):	5.195216020991383
Encrypted:	false
SSDEEP:	48:u6iN0T8J2EPPvGUuRtWPH+sZITLWXo+FFlcl5MRq+0+0dNW5WZWeQ:u2GPOUwuHtoElcl5Oqd+pc8X
MD5:	CB2B6C2FE568C674B50F708613772DA7
SHA1:	2C2086FF4B9927DEE70B41D9B0093DD6A4F90C36
SHA-256:	8A6663CD30DFEFEEBFE022CE6C79E06DA47A25B338BBF39CA58D506647F5CD19
SHA-512:	47F1F4A2FF59E8B015240262A72F0D50D69D73475716855B915B3C8A3C3F6B29C78437BA6B2C10302C933C72FFEC163EBC884D69706F3735FAF61070E8B1E700
Malicious:	false
Preview:	/* ------------------------------------------------------------------C--. ffitarget.h - Copyright (c) 2012 Tilera Corp.. Target configuration macros for TILE... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NONINFRINGEMENT. IN NO EVENT SHALL THE AUTH

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\tile\tile.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	11938
Entropy (8bit):	4.765347569956201
Encrypted:	false
SSDEEP:	192:4uHt3F0jEwuM/A1ztgOVYSB7PeZ+3yM7WKwYAFwe9WCJXylT5Jw6LehM87Mjn+Hq:4qVOEA4LnIaGWmylgBHL+Xf
MD5:	F56D8803C1D6045D76283E7FAC454681
SHA1:	222744602F0593150C540CAC8AF22403D4C77860
SHA-256:	D9B2437E3E3D05622383CAAFFC7116D59D01ADAD8DD0CF30FCFB02785A7B1C44
SHA-512:	892E3F8906094850C63D3C98E42C037E34561B3D3E7C069A44EA575713A838C91402F0DC1591D7E6A61675E1F1E017F327272593EBD9ED36B26F5AE3A6D8BC47
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. tile.S - Copyright (c) 2011 Tilera Corp... Tilera TILEPro and TILE-Gx Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NONINFRINGEMENT. IN NO EVENT SH

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\types.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3890
Entropy (8bit):	5.479104194246791
Encrypted:	false
SSDEEP:	48:MHAT8J2EPPvGUuRtWPH+sZITLWXo+FFr2b81WJQbyfKsxgQePZZj7sqsJ:M4GPOUwuHtoEr2b8AKbysPZ9YD
MD5:	264D52E2F2CA4DB989785CC57DFDEF10
SHA1:	0751E5991E1E304E40BBC93A06B393F88206F717
SHA-256:	466735AB14F3F53B3F147C6F3AB245105E8C262E89DAED8426E6E9FA569F792A
SHA-512:	9860C769B17022E55DC98793CAD2A8E2FE09916253FA96A4F8437198BDAB76752CDFBEC18F0AE94059D2AE2AB46491ED9E2F988AC02F88910655673F34400A1B
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. types.c - Copyright (c) 1996, 1998 Red Hat, Inc.. . Predefined ffi_types needed by libffi... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NONINFRINGEMENT. IN NO EVENT SHALL

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\vax\elfbsd.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4225
Entropy (8bit):	5.4342570669488905
Encrypted:	false
SSDEEP:	96:elPMjuHCus/TGlx9VYKzoxW7CQ30e0J10kN4Pn/aSZaZ:xuHCuMe5RzoxW7CQke0vonHZaZ
MD5:	52E15866F080E8D9541F6B44A152EA51
SHA1:	3B0250841E44DE5D757808ECE4CB9A7DE4FEE31C
SHA-256:	5B9FF613FE7061AA53DC0D058A00EF75A05C18E758741F4E37D0EA2C7BA795F8
SHA-512:	D0D887988B79A79F04A9173E8488F73680B67C77E9FD31F20CB025A297F060DCB4A1E2914E2D548376F9BC6A94E2C7D043553B1D03838EDCAF31CF6563D4EF59
Malicious:	false
Preview:	/. Copyright (c) 2013 Miodrag Vallat. <miod@openbsd.org>. . Permission is hereby granted, free of charge, to any person obtaining. * a copy of this software and associated documentation files (the. * ``Software''), to deal in the Software without restriction, including. * without limitation the rights to use, copy, modify, merge, publish,. * distribute, sublicense, and/or sell copies of the Software, and to. * permit persons to whom the Software is furnished to do so, subject to. * the following conditions:. * . * The above copyright notice and this permission notice shall be included. * in all copies or substantial portions of the Software.. * . * THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.. * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY. * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN AC

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\vax\ffi.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6326
Entropy (8bit):	5.179681187856321
Encrypted:	false
SSDEEP:	192:xuHCuiYdwYiuASCXNPN5ejwIG8f+Esh2guxc:xJuiW9ASCFzeVHnWXsc
MD5:	83F1D9086DD20BA7DA978B3421197AF4
SHA1:	BA4CE7A8764A05442D113BB8126D3418B6B8DAC5
SHA-256:	CE63755C5A8BC7439C6B10E0C20D3F2CA6C435423583C29DF43918269A9AC746
SHA-512:	0C9981F1237FFF19B12B492FD7BDC26F36A931CAF165D75AD4288CD0EFAB0AEED593704C86F5628523C353C88E3646CA57E614B557D349CF63842D07E2DDD972
Malicious:	false
Preview:	/. Copyright (c) 2013 Miodrag Vallat. <miod@openbsd.org>. . Permission is hereby granted, free of charge, to any person obtaining. * a copy of this software and associated documentation files (the. * ``Software''), to deal in the Software without restriction, including. * without limitation the rights to use, copy, modify, merge, publish,. * distribute, sublicense, and/or sell copies of the Software, and to. * permit persons to whom the Software is furnished to do so, subject to. * the following conditions:. * . * The above copyright notice and this permission notice shall be included. * in all copies or substantial portions of the Software.. * . * THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.. * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY. * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN AC

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\vax\ffitarget.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1638
Entropy (8bit):	5.273897696889775
Encrypted:	false
SSDEEP:	48:TasqJzpPv0XzWPHYsXILRI3s/sFwcl+DDnbWX:elPMjuHCus/RclcWX
MD5:	30AA04305B3EB941B4F1DE70B251ACA8
SHA1:	82C33FA0964627148ADA88A3B0EBCFAD964DBCEF
SHA-256:	5861DDE94D1A722B911E7CCEDFCA87C3A55BD90DF6641075563364A5AD521101
SHA-512:	A8540ED02780EC401CFDC8368F0493023291DB494CD8D59E4F804E2EC8F82ADEBB7A331E853DB61CFA2DC02DBDA40AE3030196206BEFA4AE96BD0BA7418F00BA
Malicious:	false
Preview:	/. Copyright (c) 2013 Miodrag Vallat. <miod@openbsd.org>. . Permission is hereby granted, free of charge, to any person obtaining. * a copy of this software and associated documentation files (the. * ``Software''), to deal in the Software without restriction, including. * without limitation the rights to use, copy, modify, merge, publish,. * distribute, sublicense, and/or sell copies of the Software, and to. * permit persons to whom the Software is furnished to do so, subject to. * the following conditions:. * . * The above copyright notice and this permission notice shall be included. * in all copies or substantial portions of the Software.. * . * THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.. * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY. * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN AC

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\x86\asmnames.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	508
Entropy (8bit):	4.712145793575211
Encrypted:	false
SSDEEP:	12:kvYgv3UXRjDATPgkgc0ZJc01eD4HGsD+Bb+hK49H7178HFx+/OHfCvK:+YqkXRjDATPrD0ZS0rC0gCHWx+/EYK
MD5:	0BE1EFBBD2F96F4797D30EB5ECA8A423
SHA1:	FE300CF3645092B9DAC7FBD7ADDD7EE5463AB71A
SHA-256:	B1A0C704A97AA9BB3A998F7D55CAE8BF8181E355249DA19A53269A10D03EDB8E
SHA-512:	1D6A0D115A7CF2F97C8FE1399F45C96A7E40B829E035547EC6BC50E91CF83099F044DFCB40B8F30B04EDF0EA4AAF7EB0038F72C001FB278244B0C421E13DDFC6
Malicious:	false
Preview:	#ifndef ASMNAMES_H.#define ASMNAMES_H..#define C2(X, Y) X ## Y.#define C1(X, Y) C2(X, Y).#ifdef __USER_LABEL_PREFIX__.# define C(X) C1(__USER_LABEL_PREFIX__, X).#else.# define C(X) X.#endif..#ifdef __APPLE__.# define L(X) C1(L, X).#else.# define L(X) C1(.L, X).#endif..#if defined(__ELF__) && defined(__PIC__).# define PLT(X). X@PLT.#else.# define PLT(X). X.#endif..#ifdef __ELF__.# define ENDF(X) .type.X,@function; .size X, . - X.#else.# define ENDF(X).#endif..#endif /* ASMNAMES_H */.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\x86\ffi.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	18527
Entropy (8bit):	5.236819613814016
Encrypted:	false
SSDEEP:	384:eqP5E8UFvIpfNuBp1czMn8ZAVNk2/Zka9ax1Hncs75fYD1pfrqKSWfB7lyfbMdVI:ptnqBp1cUNkgZZ9ax1Hc4fYD1fS2//N+
MD5:	C2458D42B1082B75051E54DE737721BD
SHA1:	5C9BDBDA61A481DD8A5EBF47F7D19A7172EB4CD9
SHA-256:	DDB0C29603A598E25A95564CA46C0CD530D7144D9065BCFCC7F9B4E216BFC2B9
SHA-512:	FBBC0E060E64D711E225DE17415A8FA560FE3117E36E4EC92BF454410087722EC618A0A6C79303F6C2EE4AF6D8DBD22DE643A906C0D630B273F3656B6194C5A5
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffi.c - Copyright (c) 2017 Anthony Green. Copyright (c) 1996, 1998, 1999, 2001, 2007, 2008 Red Hat, Inc.. Copyright (c) 2002 Ranjit Mathew. Copyright (c) 2002 Bo Thorsen. Copyright (c) 2002 Roger Sayle. Copyright (C) 2008, 2010 Free Software Foundation, Inc... x86 Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portion

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\x86\ffi64.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	23457
Entropy (8bit):	5.342524819368335
Encrypted:	false
SSDEEP:	384:eqtVMGMSOoOI/5Cdb6FuvdhjOMCcFXkii/CvbVoaOTFd3wA4st9UWOg8oHuWUvbE:pYGMSO1b6Fuvd5OMvFXkii/CTVoaOTFD
MD5:	CEFAAE306A2ADB11DA0A53FA0368AC76
SHA1:	B464C60C0CDE9030E20618B167F591D2AF358FA8
SHA-256:	127A50FA60868BEC1E58DCD3F5A1BE83F1851A39B89B6D1A04E7F8648FCBB828
SHA-512:	02888C6D6572BDD9A5AE4D82A888F0D7209A24DB7F884D9CCC4AA95A335346DF65F6F9B23F11AE25D8B1AC7515895E7089D5F2D3ADB4FF78A32244721DBC5C21
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffi64.c - Copyright (c) 2011, 2018 Anthony Green. Copyright (c) 2013 The Written Word, Inc.. Copyright (c) 2008, 2010 Red Hat, Inc.. Copyright (c) 2002, 2007 Bo Thorsen <bo@suse.de>.. x86-64 Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\x86\ffitarget.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4343
Entropy (8bit):	5.247281501800726
Encrypted:	false
SSDEEP:	96:uxGPOUwuHtoSlcl5OVcaljadXHtYXvJsVBOxqSpBS:unuHt/lcl5ramTOxqSm
MD5:	4EF9928EC21C398681ED3357AA400C48
SHA1:	5BAFCDF7C4FF860CE7F94C5260159E7BF063243B
SHA-256:	CE9A87677A9B9AF9DCC6F8F632B62948214824174B65FE4361D3B662CC72AEC0
SHA-512:	C0F5F26B249CF3CA72B2D334008A7AB8B7332F286E57EDF7C700B5C4A80960DBCE14E3DB940829134A3BC593A087F56B41AFB757DAF3F03E32611AB1172C1F6D
Malicious:	false
Preview:	/* ------------------------------------------------------------------C--. ffitarget.h - Copyright (c) 2012, 2014, 2018 Anthony Green. Copyright (c) 1996-2003, 2010 Red Hat, Inc.. Copyright (C) 2008 Free Software Foundation, Inc... Target configuration macros for x86 and x86-64... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLI

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\x86\ffiw64.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7567
Entropy (8bit):	5.276347124618578
Encrypted:	false
SSDEEP:	192:jDuHt3/0JxFr5jz3qmNUHvq2daRPomBHHSBc4ZgUzXyrd:XqP0ndlz31lwmogCCB
MD5:	BC6551C63133027D29EBEDEAA1B67D80
SHA1:	4008174B4FC482CB2AF585FCB064658205B9D62C
SHA-256:	35A7C3FC69C5C641436DC1E976F09CEE76E3ECD37C883C9175000638DEA5C34F
SHA-512:	C4B7068E79CB8441ADC154FE482B49AD1E8304A2EE832268180A449A6A1D6FFAE82D8C8485CE3E96FC9A1EB63BD073617557D1BAD0289D2B552C87FF67893DCD
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffiw64.c - Copyright (c) 2018 Anthony Green. Copyright (c) 2014 Red Hat, Inc... x86 win64 Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\x86\internal.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	618
Entropy (8bit):	4.8320869990183235
Encrypted:	false
SSDEEP:	12:Heu7H1ethRGpmmrJ9xDrQD5DuJQDomG9LHWrDuD4Ns7E:77H1ethspmmr/xDrQD5D9DojHSuDqd
MD5:	B4B878C72F2F781FE41ADDD69AB2D619
SHA1:	27C540D3FE6A64249BDD9B7217EA589A0C45E8FB
SHA-256:	018CB0FECE6CB2DA70BC358D4138576FAD87101C19B491EBE2FD8C3C37D6E30B
SHA-512:	BC5F6F552752D2CD335AA4C6A5C148836550BDCDB7AD0B69E0316033B62FAB592CF598BA07ACB2921E2982A52BAA0CCEEB2696BADD18267EE2F93A7A934B2F67
Malicious:	false
Preview:	#define X86_RET_FLOAT..0.#define X86_RET_DOUBLE..1.#define X86_RET_LDOUBLE..2.#define X86_RET_SINT8..3.#define X86_RET_SINT16..4.#define X86_RET_UINT8..5.#define X86_RET_UINT16..6.#define X86_RET_INT64..7.#define X86_RET_INT32..8.#define X86_RET_VOID..9.#define X86_RET_STRUCTPOP.10.#define X86_RET_STRUCTARG 11.#define X86_RET_STRUCT_1B.12.#define X86_RET_STRUCT_2B.13.#define X86_RET_UNUSED14.14.#define X86_RET_UNUSED15.15..#define X86_RET_TYPE_MASK.15.#define X86_RET_POP_SHIFT.4..#define R_EAX.0.#define R_EDX.1.#define R_ECX.2..#ifdef __PCC__.# define HAVE_FASTCALL 0.#else.# define HAVE_FASTCALL 1.#endif.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\x86\internal64.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	604
Entropy (8bit):	4.808786840175282
Encrypted:	false
SSDEEP:	12:HewJJrUS/7U3n9v8uBuZjBQmpUnxgXdYUxNrjxg5xTukfD1t:JR3m87HqgXd5PgbDt
MD5:	2BEC01E0D8A4177A30BFF85DF97C5D32
SHA1:	67262078F4E902D3B2CC9477DA30615C034B2F1B
SHA-256:	31B46F18CBCA82D79CC326C504DF9F9D93FC744426FC128BA6BEF5580066E796
SHA-512:	51BA2B12073C1898F6339E4A53AD7D089FE7B8090B09BF03F805EF25EE2BDEE5B3CEA50E5A4630EFE148EF405AB21FD32E15AC7393B9215862C402B62A4287E7
Malicious:	false
Preview:	#define UNIX64_RET_VOID..0.#define UNIX64_RET_UINT8.1.#define UNIX64_RET_UINT16.2.#define UNIX64_RET_UINT32.3.#define UNIX64_RET_SINT8.4.#define UNIX64_RET_SINT16.5.#define UNIX64_RET_SINT32.6.#define UNIX64_RET_INT64.7.#define UNIX64_RET_XMM32.8.#define UNIX64_RET_XMM64.9.#define UNIX64_RET_X87..10.#define UNIX64_RET_X87_2.11.#define UNIX64_RET_ST_XMM0_RAX.12.#define UNIX64_RET_ST_RAX_XMM0.13.#define UNIX64_RET_ST_XMM0_XMM1.14.#define UNIX64_RET_ST_RAX_RDX.15..#define UNIX64_RET_LAST..15..#define UNIX64_FLAG_RET_IN_MEM.(1 << 10).#define UNIX64_FLAG_XMM_ARGS.(1 << 11).#define UNIX64_SIZE_SHIFT.12.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\x86\sysv.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	29260
Entropy (8bit):	5.592901143155744
Encrypted:	false
SSDEEP:	768:JCunfESoEES29AsXDiQ5zo3tDhgzrgylrPd:J7gzrgylrPd
MD5:	64C4C93A11250A6E38199935D54F8C7D
SHA1:	1E4A674FFE82EE79B12747B82F0B7B8AEC9F2C38
SHA-256:	D2F187BEA59AD70981820B952BA4A5DDBD4EBF487D867DFDC8C0FE1BACF40C58
SHA-512:	62136338659456B10232AE81C5D279FCB805F29003A075CFCF10A5F16969C660BDA4ED0C1F8CE0CD6EC96C181144B23E5230342FFABEE24C5314C75DA63DABB2
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. sysv.S - Copyright (c) 2017 Anthony Green. - Copyright (c) 2013 The Written Word, Inc.. - Copyright (c) 1996,1998,2001-2003,2005,2008,2010 Red Hat, Inc.. . X86 Foreign Function Interface .. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\x86\sysv_intel.preasm

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	25305
Entropy (8bit):	5.6154253103849285
Encrypted:	false
SSDEEP:	384:+qxUVBMOmoTB4vR+WhdxttibfWnniDpZRig3nnknp4CLSnpyb6Doe9bz+Vyvf0pe:Jm3NJoSDNxZuRB/HHXo3tDR
MD5:	1B5E5E04568642438A80263E3E74D880
SHA1:	FA10A2F98F29767D8FB6F696BCB5107CD0C8EEB8
SHA-256:	4754DA0AA4ACE314E1D595132136F2C97DFA1572CFE4A8D284B9B8E9C476B1F4
SHA-512:	752BB4D08BD99043E69EFE03D8E81ED06780637C48F6A12F89E6428ED8F8DE7B0A6556CC0154D83E6D55FD2C89C6034A0075911BE9FE3E288F3FEB5CC4B598E1
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. sysv.S - Copyright (c) 2017 Anthony Green. - Copyright (c) 2013 The Written Word, Inc.. - Copyright (c) 1996,1998,2001-2003,2005,2008,2010 Red Hat, Inc.. . X86 Foreign Function Interface .. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\x86\unix64.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	15758
Entropy (8bit):	5.583143392849636
Encrypted:	false
SSDEEP:	384:DqvUVBEYN64B9qFQ71MdbGQ+7+vDAKHEj8cDYI33ZgaSoHIBI:+hYN64B9qFQ71MdbGQQ+8xj8cMCSoHIK
MD5:	1D9E320274B70BC67688DA5C75F77E97
SHA1:	3C2DCFF16646D6736AB2BCE083CF5782D266A36E
SHA-256:	08516CBC32F419C1FFB17CFBA1A3AF7F4350114A0EF24326C2EA9E79B57388BF
SHA-512:	15E69918CD65CEEB5E4FD088973753E6C4AD3AB4BA65B0CDA432DE66282AAC5D0472CA25747D11D6AA34DEE04749AB5D52D1FEDBCF47A740E4EE98BB856610EC
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. unix64.S - Copyright (c) 2013 The Written Word, Inc... - Copyright (c) 2008 Red Hat, Inc.. - Copyright (c) 2002 Bo Thorsen <bo@suse.de>.. x86-64 Foreign Function Interface .. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERC

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\x86\win64.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5259
Entropy (8bit):	5.49549071436138
Encrypted:	false
SSDEEP:	96:U5anUVBL5lNBi9emBfGBBEqWbEV6TU5xqoV2R8/GNiV9Fwzp1wPnV7Q+SNfqGG9U:U5anUVBL5lNmBfGBBEqWbEV6A58w/kY+
MD5:	6BC2DE1A2EE72641E8521128E000F6C6
SHA1:	69278B3E09E6D85B48E7CD169E6096609D65261E
SHA-256:	2759C24043AF1C94561CD4AA081E773D3F766BCBB655B759B21355A17D13622C
SHA-512:	915B5EE9589AC0C1933F1765D88455C13E790978236FDFB445C527843F181E1AEFFC09750598225446AFCA0C1CAD5D6B7AA4B85640264D2E98846B8A94D5DA80
Malicious:	false
Preview:	#ifdef __x86_64__.#define LIBFFI_ASM.#include <fficonfig.h>.#include <ffi.h>.#include <ffi_cfi.h>.#include "asmnames.h"..#if defined(HAVE_AS_CFI_PSEUDO_OP). .cfi_sections .debug_frame.#endif..#ifdef X86_WIN64.#define SEH(...) __VA_ARGS__.#define arg0.%rcx.#define arg1.%rdx.#define arg2.%r8.#define arg3.%r9.#else.#define SEH(...).#define arg0.%rdi.#define arg1.%rsi.#define arg2.%rdx.#define arg3.%rcx.#endif../* This macro allows the safe creation of jump tables without an. actual table. The entry points into the table are all 8 bytes.. The use of ORG asserts that we're at the correct location. /./ ??? The clang assembler doesn't handle .org with symbolic expressions. /.#if defined(__clang__) \|\| defined(__APPLE__) \|\| (defined (__sun__) && defined(__svr4__)).# define E(BASE, X)..balign 8.#else.# define E(BASE, X)..balign 8; .org BASE + X 8.#endif....text../* ffi_call_win64 (void stack, struct win64_call_frame frame, void *r10).. Bit o trickiness here -- FRAME is t

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\x86\win64_intel.preasm

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6972
Entropy (8bit):	5.535593512519418
Encrypted:	false
SSDEEP:	192:w+UVBuxO5lQYsYDnGY/YpMuHK+KBAj/kyZcEAGfW2wG+ZfK:JUVBuxO5SYYY/YpMuHK+KMNZcEAGf9FD
MD5:	ADFBEC73C500A3F14C14678973790F75
SHA1:	64117B84C2642EEC933B4A3CF66E063345946FAA
SHA-256:	A6B6E169C03D9B6336BF2A84D697E2BC3304131ECCCA24405B48C3441FCC8529
SHA-512:	99990F3621ED3D42DCFB6028460A8737723A9AF4E27F28507AB11C8393C877844BF60B2E13010984CE5634B043BB19DA855DB9F6D960D7994D9E0ECD6BC4F28E
Malicious:	false
Preview:	#define LIBFFI_ASM.#include <fficonfig.h>.#include <ffi.h>.#include <ffi_cfi.h>.#include "asmnames.h"..#if defined(HAVE_AS_CFI_PSEUDO_OP). .cfi_sections .debug_frame.#endif..#ifdef X86_WIN64.#define SEH(...) __VA_ARGS__.#define arg0.rcx.#define arg1.rdx.#define arg2.r8.#define arg3.r9.#else.#define SEH(...).#define arg0.rdi.#define arg1.rsi.#define arg2.rdx.#define arg3.rcx.#endif../* This macro allows the safe creation of jump tables without an. actual table. The entry points into the table are all 8 bytes.. The use of ORG asserts that we're at the correct location. /./ ??? The clang assembler doesn't handle .org with symbolic expressions. /.#if defined(__clang__) \|\| defined(__APPLE__) \|\| (defined (__sun__) && defined(__svr4__)).# define E(BASE, X).ALIGN 8.#else.# define E(BASE, X).ALIGN 8; ORG BASE + X 8.#endif....CODE..extern PLT(C(abort)):near..extern C(ffi_closure_win64_inner):near../* ffi_call_win64 (void stack, struct win64_call_frame frame, void *r10)..

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\xtensa\ffi.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8801
Entropy (8bit):	4.949476528859479
Encrypted:	false
SSDEEP:	192:QuHt3gicwjGWLoQxuSlAcOXXy8XHywGW+rLgNZl9gfLGNJpau:QqYClhuSlAciXy8XywX+nfiNJpZ
MD5:	549BFBA791A5BB2268F5E2B35332C48A
SHA1:	441A6935A4B276F09C39EEB63C7BB0B535C4C916
SHA-256:	41845299E801C198258EC9C31BF1CCE8B9D97859CD9D7055855D7B67C5CB6C40
SHA-512:	375AAB5C387D17BE6F58725F0EC0A97934EE4CFFE624B92AB23728FFD9F8EE8702FBA6C46FF59CB6DADE5A80966CAB59F8078BC1980AFDAC0686DA8AFC6BC26F
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. ffi.c - Copyright (c) 2013 Tensilica, Inc... XTENSA Foreign Function Interface.. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\xtensa\ffitarget.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1894
Entropy (8bit):	5.136508034594604
Encrypted:	false
SSDEEP:	48:u6oRzT8J2EPPvGUuRtWPH+sZITLWXo+FFlcl5MRq+VLUYtWM:uJGPOUwuHtoElcl5OqiQYAM
MD5:	892C400315F5A127DA4CD7A1EB7B65BE
SHA1:	5E5CDB02BDF8A7E78DC15CE1FCCD5B4C78D703CB
SHA-256:	7F883ED4EBDCBB364CE61AAEF49856C538E5F4F2695FBDD3D994F0B9D26AF93C
SHA-512:	4CCB2843217C627DA92719264AE425DA8D546CEE0D4B4F7690302457D272B8D9458064DFF655A85F42B48843E081FCF6713B1436E333C4411E66DF9F79ADB05D
Malicious:	false
Preview:	/* ------------------------------------------------------------------C--. ffitarget.h - Copyright (c) 2013 Tensilica, Inc.. Target configuration macros for XTENSA... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NONINFRINGEMENT. IN NO EVENT SHALL THE

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\src\xtensa\sysv.S

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5670
Entropy (8bit):	5.189131448474279
Encrypted:	false
SSDEEP:	96:mGPOUwuHtoE1ctYpAvSqojrAZUChzoLYpHHJ5KAOA+3vG7nQRVIXraW2F:wuHt3mvSqoQZUCZgAHJKcQ++/
MD5:	30E1959BEEB8D6392FF804E925EFCC11
SHA1:	310AD2EF4E295C47D099241C3DD08B2B701D2566
SHA-256:	419107EFCE381AEF3EBD2F4FA2015F63510B1C0FADA188F5CC0F9A63947CBB1E
SHA-512:	EEDB337A5D2249E5729384C394155F2B59D88734838AE3D789BD7CA469CF01658827B62AAD55C424606591BAF4459A1525A59937B2E58F30EB4A4BC63D65D344
Malicious:	false
Preview:	/* -----------------------------------------------------------------------. sysv.S - Copyright (c) 2013 Tensilica, Inc.. . XTENSA Foreign Function Interface .. Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. ``Software''), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be included. in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED ``AS IS'', WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHO

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\stamp-h.in

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:sWEyn:Sy
MD5:	1DED054093DE910D9786C62BC4FE8CC6
SHA1:	8E5113F6F47CE34E0437C2105441DBB70F01491A
SHA-256:	2CD8EC3DE6A07E1FD39676100DB57BA62372E820C19812FEE55899F65746E192
SHA-512:	20663B3F7A6C082BFA040BF33BEB3E22307395933199A3AF0DB024CB82D25052EB13AE62E9B5549F11E563ADA44D99A56ADACB8531319BCF9032F73C7A2D1740
Malicious:	false
Preview:	timestamp.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\test.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	681
Entropy (8bit):	4.742622452787254
Encrypted:	false
SSDEEP:	12:RAqVAj8K9hUXV8VKrvVMeUbb+oiMbRMl2EeUC6ZA8s2lUysFEq2Eb4:Rr6J9+8u9LU+TmMl2/6nUdGq2f
MD5:	2563110BD07B37997EAF6E509CBE6700
SHA1:	6878B26596B3C1AC01B0245F74CCAA6F37A02863
SHA-256:	E4AD6383000A56FE79BA960CC346E663C71BF892F8870EF163B6C99460AF180E
SHA-512:	460B3776E719FDB0601F84DA746163EA33A8357726D95C5B00AF5006A203F75C13284E94A1B4052906A1DC14BBA82A70F423F87D14BDFB134468FA82066E6DE0
Malicious:	false
Preview:	#include <stdio.h>.#include <ffi/ffi.h>..int main().{. ffi_cif cif;. ffi_type args[1];. void values[1];. char s;. int rc;.. / Initialize the argument info vectors /. args[0] = &ffi_type_pointer;. values[0] = &s;.. / Initialize the cif /. if (ffi_prep_cif(&cif, FFI_DEFAULT_ABI, 1,. &ffi_type_uint, args) == FFI_OK). {. s = "Hello World!";. ffi_call(&cif, puts, &rc, values);. / rc now holds the result of the call to puts /.. / values holds a pointer to the function's arg, so to. call puts() again all we need to do is change the. value of s */. s = "This is cool!";. ffi_call(&cif, puts, &rc, values);. }.. return 0;.}.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\Makefile.am

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6711
Entropy (8bit):	4.580934188610723
Encrypted:	false
SSDEEP:	192:kmzkcjk/Fpt+067wSk6GB/z5pHnYT6Dy8+MeY7SfkRxeBQASMRAJUECrLnsnSM7h:kmzkcjk/Fpt+067wSk6GB/z5pHnYT6Dj
MD5:	D5ED712B072CCA599A1F5D61C5304D65
SHA1:	696097BC714519FDEB30E9D90A6068782865A789
SHA-256:	A7125436BB65F1E69D71E7DB47430693687BF613CA7320CA04CD750A1C532E84
SHA-512:	2DE3BB4228D694F00089F99EA55452F462D9747926703654095180F8E63670E9385D09EA3618E4CBE6E300768F9F5E5157EB3983AF3C6278A8D7E7E985074A75
Malicious:	false
Preview:	## Process this file with automake to produce Makefile.in...AUTOMAKE_OPTIONS = foreign dejagnu..EXTRA_DEJAGNU_SITE_CONFIG=../local.exp..CLEANFILES = .exe core .log .sum..EXTRA_DIST = lib/target-libpath.exp lib/libffi.exp lib/wrapper.exp \.libffi.call/strlen4.c libffi.call/struct10.c libffi.call/many_mixed.c \.libffi.call/float.c libffi.call/struct5.c libffi.call/return_fl3.c \.libffi.call/return_fl1.c libffi.call/call.exp libffi.call/pyobjc-tc.c \.libffi.call/float_va.c libffi.call/struct8.c libffi.call/pr1172638.c \.libffi.call/return_sc.c libffi.call/va_struct1.c \.libffi.call/align_stdcall.c libffi.call/struct9.c libffi.call/va_1.c \.libffi.call/va_struct2.c libffi.call/return_fl2.c \.libffi.call/align_mixed.c libffi.call/ffitest.h libffi.call/struct4.c \.libffi.call/return_ldl.c libffi.call/float3.c libffi.call/return_sl.c \.libffi.call/return_dbl1.c libffi.call/err_bad_typedef.c \.libffi.call/return_ll1.c libffi.call/return_dbl2.c \.libffi.call/negint.c libffi.closures/nested_

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\Makefile.in

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	22102
Entropy (8bit):	5.471786869986742
Encrypted:	false
SSDEEP:	384:wpqpDu6TSKW8Q0GDuWAbwdlJgaQM215mzkcjk/Fpt+067wSk6GB/z5pHnYT6Dy8p:cqpDBTSKW80DuWAbwfJgaQ75k332cyJV
MD5:	04F4A35CD920A4D38F9C8ADB2A6AB57B
SHA1:	792E9FAD9BE0D573AA0D92284DDBD4B6B64A0AAD
SHA-256:	2C857791B28CD2C0D986254E93A1BFA0B26CB5B4203FF7897CDC8C0CF2FC4B8D
SHA-512:	96C19E0BBF73A08CB4E14BFD1056DE90571A49F2657D032357B7288AD830E0B31AA05F830EDFBDD5717269F4CA8692C07F1FE4AC5C34A1DC104A8DE771D0BBF7
Malicious:	false
Preview:	# Makefile.in generated by automake 1.16.3 from Makefile.am..# @configure_input@..# Copyright (C) 1994-2020 Free Software Foundation, Inc...# This Makefile.in is free software; the Free Software Foundation.# gives unlimited permission to copy and/or distribute it,.# with or without modifications, as long as this notice is preserved...# This program is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY, to the extent permitted by law; without.# even the implied warranty of MERCHANTABILITY or FITNESS FOR A.# PARTICULAR PURPOSE...@SET_MAKE@.VPATH = @srcdir@.am__is_gnu_make = { \. if test -z '$(MAKELEVEL)'; then \. false; \. elif test -n '$(MAKE_HOST)'; then \. true; \. elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \. true; \. else \. false; \. fi; \.}.am__make_running_with_option = \. case $${target_option-} in \. ?) ;; \. *) echo "am__make_running_with_option: internal error: invalid" \. "target option '$${tar

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\config\default.exp

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	24
Entropy (8bit):	4.022055208874201
Encrypted:	false
SSDEEP:	3:z6s2iDtvn:zdv
MD5:	DCE80BA7E038CA18591AABC6D3D2582C
SHA1:	EDA436AC4E6C9924CE3DA72B999BC6442E52BBE8
SHA-256:	BA6D7ACD9E5EB26EC2D22A59E0E8A08C91C6DBC1A249CCF11EF00602F568834E
SHA-512:	2EB4FE696696CBF02C45B13C1FDF4A1923B5D3A1222DFD322D90811C996A293CFDED058040C1D0ED78C5FC57943DBDB401DFFF54A0381FEA2672603288A05817
Malicious:	false
Preview:	load_lib "standard.exp".

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\lib\libffi.exp

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	19521
Entropy (8bit):	4.823855190930606
Encrypted:	false
SSDEEP:	384:pxfqSlK75mtoNknCVxSfY8yB8Qt1PaxgGHaArrvBL7LRayx4jI4:DfqSW8toNkSxSAZpMgGHaGx4U4
MD5:	BF092F8AC41BD30835E8C029CA96D63F
SHA1:	EDAA58A7221653E93597D9746BCE3086383E2E50
SHA-256:	9E588886994917CEE4365C86B1C78A375E202E03E7D42582C938D2DB4B14A817
SHA-512:	BE54CFE33AE681C72E97E2C9FD24BD4F7612A8E0344472BDD1F117F7A91ACB9111157F4CAD13E85924B020EA4C76EDD3F14011B20F380A9FCC20DE66931B45E9
Malicious:	false
Preview:	# Copyright (C) 2003, 2005, 2008, 2009, 2010, 2011, 2014, 2019 Free Software Foundation, Inc...# This program is free software; you can redistribute it and/or modify.# it under the terms of the GNU General Public License as published by.# the Free Software Foundation; either version 3 of the License, or.# (at your option) any later version..#.# This program is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.# GNU General Public License for more details..#.# You should have received a copy of the GNU General Public License.# along with this program; see the file COPYING3. If not see.# <http://www.gnu.org/licenses/>...proc load_gcc_lib { filename } {. global srcdir. load_file $srcdir/lib/$filename.}..load_lib dg.exp.load_lib libgloss.exp.load_gcc_lib target-libpath.exp.load_gcc_lib wrapper.exp..# Return 1 if the target matches the effective target 'arg

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\lib\target-libpath.exp

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9726
Entropy (8bit):	5.09692746256019
Encrypted:	false
SSDEEP:	96:/KzfSuThIsJwjjzDIjSIvmnNRjMPGBg9ymlJMK1CpTl6/gVl8NCF2R+R8R4hnh/V:/kfSChIXjjzDzrTjeGBgXynX8qaQr
MD5:	88F888C66CEE8D916E1AC91000ECC87A
SHA1:	793F432CE87DF8170DFBB5EA69B686274C9EF584
SHA-256:	370D3AA607AF39EF98FE7F5CE7655344BEC8995FD6FDE3EDFFD8A5584B374241
SHA-512:	42B2A2A75A39EF1F1AAB32BB7EFEDEC949E0291B3E3FD529A6CB04E0440D2C1B3445A0292BCFD24022DFB9E91AF6BB28FB74421E03230CAF21DA2798C4B95129
Malicious:	false
Preview:	# Copyright (C) 2004, 2005, 2007 Free Software Foundation, Inc...# This program is free software; you can redistribute it and/or modify.# it under the terms of the GNU General Public License as published by.# the Free Software Foundation; either version 3 of the License, or.# (at your option) any later version..#.# This program is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.# GNU General Public License for more details..#.# You should have received a copy of the GNU General Public License.# along with GCC; see the file COPYING3. If not see.# <http://www.gnu.org/licenses/>...# This file was contributed by John David Anglin (dave.anglin@nrc-cnrc.gc.ca)..set orig_environment_saved 0.set orig_ld_library_path_saved 0.set orig_ld_run_path_saved 0.set orig_shlib_path_saved 0.set orig_ld_libraryn32_path_saved 0.set orig_ld_library64_path_saved 0.set orig_ld_libr

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\lib\wrapper.exp

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1877
Entropy (8bit):	5.004869670895837
Encrypted:	false
SSDEEP:	48:SUPzHyUjHv7TIZimf8KE85MoCAL/aJlRDmwFwHlqs6:SKzbsdf8QxDI3EF6
MD5:	68DB067550882B3B091A82DF87310FFF
SHA1:	624C70FC4133E8DDD81EB2BA6FFD83D71225ED2E
SHA-256:	405ED3691640FACE11E6DEF6A99C768D3C187570869E3D7FF70C214A36F64347
SHA-512:	8C913E78160C12FF56BA575C540E37E27F8866698D3E1B8CD8C25F3E50906AA74FF4BBC80BD3E674447F1DB4A52DE15AB7BF047DF3E1E840E824FF290750971A
Malicious:	false
Preview:	# Copyright (C) 2004, 2007 Free Software Foundation, Inc...# This program is free software; you can redistribute it and/or modify.# it under the terms of the GNU General Public License as published by.# the Free Software Foundation; either version 3 of the License, or.# (at your option) any later version..# .# This program is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.# GNU General Public License for more details..# .# You should have received a copy of the GNU General Public License.# along with GCC; see the file COPYING3. If not see.# <http://www.gnu.org/licenses/>...# This file contains GCC-specifics for status wrappers for test programs...# ${tool}_maybe_build_wrapper -- Build wrapper object if the target.# needs it. FILENAME is the path to the wrapper file. If there are.# additional arguments, they are command-line options to provide to.# the c

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.bhaible\README

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	4.981913650808839
Encrypted:	false
SSDEEP:	48:s3yhp3muchZn9+YzjLz1+a5fxAkvqJp6QoAZAMhalN9Q309yY/Oz:t3mueZn9+YzjLz8WAN36QoAZAbN9QEjW
MD5:	B3F6762A9CDA7DF26859E715049F5053
SHA1:	C1DE81BBC7E616CA40A91C6EE3BDAB51CFDB1DE5
SHA-256:	22E6507A2126CE03AFB8254533F10992B76D91AE90EDFAE26D097C3453FB611E
SHA-512:	73ECD385E0BFAA65953450BBCBA37117ED92BFB76533CD5414D304770F1B6E0C353F7A77B24275FC54C977753EBD626426583F35338CC1C27365619D4B10B763
Malicious:	false
Preview:	This package contains a test suite for libffi...This test suite can be compiled with a C compiler. No need for 'expect'.or some other package that is often not installed...The test suite consists of 81 C functions, each with a different signature..* test-call verifies that calling each function directly produces the same. results as calling the function indirectly through 'ffi_call'..* test-callback verifies that calling each function directly produces the same. results as calling a function that is a callback (object build by. 'ffi_prep_closure_loc') and simulates the original function...Each direct or indirect invocation should produce one line of output to.stdout. A correct output consists of paired lines, such as..void f(void):.void f(void):.int f(void):->99.int f(void):->99.int f(int):(1)->2.int f(int):(1)->2.int f(2int):(1,2)->3.int f(2int):(1,2)->3......The Makefile then creates two files:.* failed-call, which consists of the non-paired lines of output of. 'test-call',.* f

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.bhaible\alignof.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2142
Entropy (8bit):	4.990501596248295
Encrypted:	false
SSDEEP:	48:afrTl4ynHunmtIfaU3qnVbRaPx1XjndTThbRRyQ4tEz:aPlTumtaxA941TdJ9RyS
MD5:	3B7EBD553F520825956E5610E90DBFCD
SHA1:	84C6EA95D4E8D7BB502C6556EF8EE024185ECB41
SHA-256:	45027B8E0A5ED7797786D7E4A7C8585FBB08E57E1079BFDF89AF2E5E98E06090
SHA-512:	CC5251D8538F9CACB8F4CB7161998D6C2CC43CE46B4F31BC1741EB880AC1037F4B05DEE5EAA055F75B52C25390BC553386C99B135E09D72C1456BBE2D78CB331
Malicious:	false
Preview:	/* Determine alignment of types.. Copyright (C) 2003-2004, 2006, 2009-2017 Free Software Foundation, Inc... This program is free software; you can redistribute it and/or modify. it under the terms of the GNU General Public License as published by. the Free Software Foundation; either version 2, or (at your option). any later version... This program is distributed in the hope that it will be useful,. but WITHOUT ANY WARRANTY; without even the implied warranty of. MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the. GNU General Public License for more details... You should have received a copy of the GNU General Public License. along with this program; if not, see <https://www.gnu.org/licenses/>. /..#ifndef _ALIGNOF_H.#define _ALIGNOF_H..#include <stddef.h>../ alignof_slot (TYPE). Determine the alignment of a structure slot (field) of a given type,. at compile time. Note that the result depends on the ABI.. This is the same as alignof (TYPE) and

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.bhaible\bhaible.exp

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2280
Entropy (8bit):	5.062062420621947
Encrypted:	false
SSDEEP:	48:IsPzjyUjH031gBVuJlVL7tpOpZuVulKqu8Uk5JMb8+t:IyzfVaVLBIpZuYfUJ
MD5:	D641D5187C4666DD31A3462C6AE71709
SHA1:	A1EA74C69C5BFBD249D67B6041E7388FD50A08CE
SHA-256:	8FAE824122822DE954E2E5C837260149AA9463D18B27544313DC097288EC5708
SHA-512:	AD37CB36B1EBD6D298B83444221DA4B0548E7FEB076FCB9A6C92411591C8A66C1DEA8031F3F0506A4DD8EFCA7AD5EA20D18CC8EB94F1CBB10B3768B5FAE542CD
Malicious:	false
Preview:	# Copyright (C) 2003, 2006, 2009, 2010, 2014, 2018 Free Software Foundation, Inc...# This program is free software; you can redistribute it and/or modify.# it under the terms of the GNU General Public License as published by.# the Free Software Foundation; either version 3 of the License, or.# (at your option) any later version..#.# This program is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.# GNU General Public License for more details..#.# You should have received a copy of the GNU General Public License.# along with this program; see the file COPYING3. If not see.# <http://www.gnu.org/licenses/>...dg-init.libffi-init..global srcdir subdir.global compiler_vendor..# The conversion of this testsuite into a dejagnu compatible testsuite.# was done in a pretty lazy fashion, and requires the use of compiler.# flags to disable warnings for now..if { [string m

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.bhaible\test-call.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	53687
Entropy (8bit):	5.212065075157808
Encrypted:	false
SSDEEP:	1536:YFt012gbEVBpB38E7vppanHrblmpmh5QAfydDL0YwX3rdjOrGzrGLGXpWl8r6hwa:YFt01Wn
MD5:	F6FCC70C1CE29A54EA5366A7194CFED7
SHA1:	DD3CEF94E6ACFD09B641DDCB30F987983A3FA29E
SHA-256:	163F4421F4D0424A8C20A594E25C09B9AD18D46B73727072F32729BD836F51BE
SHA-512:	DAFFEEF3A5EAE1F5B23E6F0855406B354CDF1AE0DD098F374AC8B8F9DD0D0321E568140C51B195A319521F24D65267ADA8BDACAAF2574EADF77BCB8FAF31CA72
Malicious:	false
Preview:	/. Copyright 1993 Bill Triggs <Bill.Triggs@inrialpes.fr>. Copyright 1995-2017 Bruno Haible <bruno@clisp.org>.. This program is free software: you can redistribute it and/or modify. it under the terms of the GNU General Public License as published by. the Free Software Foundation; either version 2 of the License, or. (at your option) any later version... This program is distributed in the hope that it will be useful,. but WITHOUT ANY WARRANTY; without even the implied warranty of. MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the. GNU General Public License for more details... You should have received a copy of the GNU General Public License. along with this program. If not, see <http://www.gnu.org/licenses/>../../* { dg-do run } /..#include <stdio.h>.#include <stdlib.h>.#include <string.h>.#include <ffi.h>.#include "alignof.h".#include <stdarg.h>../ libffi testsuite local changes -------------------------------- /.#ifdef DGTEST./ Redefine exit(1) as a t

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.bhaible\test-callback.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	104538
Entropy (8bit):	5.265578048045451
Encrypted:	false
SSDEEP:	3072:yFtHkSfGjUYW6KNe+s0VXi00qzXdToupeXE+wCDUKqb0WRjN4ZVbzaFUqVOWVPpF:KkZw/
MD5:	3EFE73051711D36A55E5AAA8D80BC23A
SHA1:	EB4BDB342095354BFE383CF8C3AFF044F54BEB9A
SHA-256:	32B537D4D0672ACF5441BA47A2D76E6209AB0022EF3F2DC3C05BAEEFD1A37E69
SHA-512:	9DFC9CD1881FE983A8CBD40B37E3EEFB4DA8A7ED525D4008B84DB3590557157EF418D85BBFCDC86A7D8552F4F72E19E9EF5C1DBEE62C3965458AEEA6F2973D61
Malicious:	false
Preview:	/. Copyright 1993 Bill Triggs <Bill.Triggs@inrialpes.fr>. * Copyright 1995-2017 Bruno Haible <bruno@clisp.org>. . This program is free software: you can redistribute it and/or modify. * it under the terms of the GNU General Public License as published by. * the Free Software Foundation; either version 2 of the License, or. * (at your option) any later version.. . This program is distributed in the hope that it will be useful,. * but WITHOUT ANY WARRANTY; without even the implied warranty of. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the. * GNU General Public License for more details.. . You should have received a copy of the GNU General Public License. * along with this program. If not, see <http://www.gnu.org/licenses/>.. /../ { dg-do run } /..#include <stdio.h>.#include <stdlib.h>.#include <string.h>.#include <ffi.h>.#include "alignof.h".#include <stdarg.h>../ libffi testsuite local changes -------------------------------- /.#ifdef DGTEST./ Redefi

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.bhaible\testcases.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	23988
Entropy (8bit):	5.174605897365964
Encrypted:	false
SSDEEP:	384:+TJluFNZHhq/qOdD59N84d3AxMXYstPeMk+eWcfn3Sp7Sf1MXsjCLIfi50I:+TJluFNZHhq/LNy4d3YMXYstPeMk+eWT
MD5:	105319DDDEEBE805D8ABE42033C0373C
SHA1:	EB9D76EC1BAD202FB6D1455E5B666FBF29282DA6
SHA-256:	33CDD2B9378B49BB0CA3AA1A3A4E9007E0A9EE5DA28A2CF01D36D745FE5E5748
SHA-512:	0281CAA64A8D0A29BEACDF5578BB1E800E945BA352189BE39B4C447D04DED6B0E26642B8601680027E4C832EB3FA07FCF239157FA3B265B9715652715AE60315
Malicious:	false
Preview:	/. Copyright 1993 Bill Triggs <Bill.Triggs@inrialpes.fr>. * Copyright 1995-2017 Bruno Haible <bruno@clisp.org>. . This program is free software: you can redistribute it and/or modify. * it under the terms of the GNU General Public License as published by. * the Free Software Foundation; either version 3 of the License, or. * (at your option) any later version.. . This program is distributed in the hope that it will be useful,. * but WITHOUT ANY WARRANTY; without even the implied warranty of. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the. * GNU General Public License for more details.. . You should have received a copy of the GNU General Public License. * along with this program. If not, see <http://www.gnu.org/licenses/>.. /../ This file defines test functions of selected signatures, that exercise. dark corners of the various ABIs. /..#include <stdio.h>..FILE out;..#define uchar unsigned char.#define ushort unsigned short.#define uint unsigned int.#

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\align_mixed.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	992
Entropy (8bit):	4.836408716003666
Encrypted:	false
SSDEEP:	12:UJw0q7N252z9OPZA3gVWmf9AUUXVAcIjd5FjdOVouTFb6MbtsxsutjUZVnL5Km8V:V0L20PZRVWaEg9Ox4Msxs4CZV1/Dw
MD5:	2C96425847ACF8E7FF588C88273B45D4
SHA1:	1AF548A10EEC8F91EAEF0A77A85101C322B6E455
SHA-256:	34A62C0A4043F0A30F899157D8EA9441A65F59F8A21FE06A04F038B9FC3C63AC
SHA-512:	459AD19617C9DD1D38511C9612A4D1F20C05EB8A31C33BE3A419865BB8EEDAC3345B52180AE2CAC7E2036DD06AF2C928E1F87C4DE3FBB93F24B810AB4EDE1AEA
Malicious:	false
Preview:	/* Area:.ffi_call. Purpose:.Check for proper argument alignment.. Limitations:.none.. PR:..none.. Originator:.<twalljava@java.net> (from many_win32.c) /../ { dg-do run } /..#include "ffitest.h"..static float ABI_ATTR align_arguments(int i1,. double f2,. int i3,. double f4).{. return i1+f2+i3+f4;.}..int main(void).{. ffi_cif cif;. ffi_type args[4] = {. &ffi_type_sint,. &ffi_type_double,. &ffi_type_sint,. &ffi_type_double. };. double fa[2] = {1,2};. int ia[2] = {1,2};. void values[4] = {&ia[0], &fa[0], &ia[1], &fa[1]};. float f, ff;.. / Initialize the cif */. CHECK(ffi_prep_cif(&cif, ABI_NUM, 4,... &ffi_type_float, args) == FFI_OK);.. ff = align_arguments(ia[0], fa[0], ia[1], fa[1]);.. ffi_call(&cif, FFI_FN(align_arguments), &f, values);.. if (f == ff). printf("align arguments tests ok!\n");. else. CHECK(0);. exit(0);.}.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\align_stdcall.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	993
Entropy (8bit):	4.8377822879904935
Encrypted:	false
SSDEEP:	12:UJw0q7N252z9OPZA3gVWmf9AUUXVAcIjd5FjdOVouTFb6MbtsxsutjUZVg35Km8V:V0L20PZRVWaEg9Ox4Msxs4CSp1/Dw
MD5:	BA5013EAFD064227C2A9C9F498E6BDB6
SHA1:	5A59E1FF7575A695238B3616F52B0C6BCDD5FD6E
SHA-256:	A93D34762F4C4220E43B0DFD8380D5991CAB9F621CB1CD3F73A34D972B9D724C
SHA-512:	A25091220C2D4F1C2AA481DAA01C9200E6DD0BA8551F023A322ADCF1EC35AF657F3482F1D1E3140A6E9D96159C9EACE8A55AF7B6855BA5CC6ADABFBAB184925A
Malicious:	false
Preview:	/* Area:.ffi_call. Purpose:.Check for proper argument alignment.. Limitations:.none.. PR:..none.. Originator:.<twalljava@java.net> (from many_win32.c) /../ { dg-do run } /..#include "ffitest.h"..static float ABI_ATTR align_arguments(int i1,. double f2,. int i3,. double f4).{. return i1+f2+i3+f4;.}..int main(void).{. ffi_cif cif;. ffi_type args[4] = {. &ffi_type_sint,. &ffi_type_double,. &ffi_type_sint,. &ffi_type_double. };. double fa[2] = {1,2};. int ia[2] = {1,2};. void values[4] = {&ia[0], &fa[0], &ia[1], &fa[1]};. float f, ff;.. / Initialize the cif */. CHECK(ffi_prep_cif(&cif, ABI_NUM, 4,... &ffi_type_float, args) == FFI_OK);.. ff = align_arguments(ia[0], fa[0], ia[1], fa[1]);;.. ffi_call(&cif, FFI_FN(align_arguments), &f, values);.. if (f == ff). printf("align arguments tests ok!\n");. else. CHECK(0);. exit(0);.}.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\call.exp

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	5.0547432441176126
Encrypted:	false
SSDEEP:	48:IhPzjyUjH0319XVCnbHfwbKZneEY8Il+t:I9zf2XVCbHfwR0
MD5:	4A73223F3B7419F5474E26AE23B604B0
SHA1:	F8325172508FA01702ABB82EBA042A86DDC655C1
SHA-256:	78533A0F27C8E466BEEF7487A9AA19694A009B5002B542C585F47B28D3ABD8CF
SHA-512:	EAFB636C68DAC7797F7D4F1374FC3ABE7633A1CEC30753512321BF2575038CAE2AAA4F66EED9608319B3BADE9509B575DC9106134D9234F963701FD5EAD6D601
Malicious:	false
Preview:	# Copyright (C) 2003, 2006, 2009, 2010, 2014 Free Software Foundation, Inc...# This program is free software; you can redistribute it and/or modify.# it under the terms of the GNU General Public License as published by.# the Free Software Foundation; either version 3 of the License, or.# (at your option) any later version..#.# This program is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.# GNU General Public License for more details..#.# You should have received a copy of the GNU General Public License.# along with this program; see the file COPYING3. If not see.# <http://www.gnu.org/licenses/>...dg-init.libffi-init..global srcdir subdir..if { [string match $compiler_vendor "microsoft"] } {. # -wd4005 macro redefinition. # -wd4244 implicit conversion to type of smaller size. # -wd4305 truncation to smaller type. # -wd4477 printf %lu of uint

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\closure_fn0.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2985
Entropy (8bit):	5.085235769320255
Encrypted:	false
SSDEEP:	48:sPor8oK0zgPwru5h+M+S+l+K+7+k+a+Bk+j+b+j1V+V+Vd+a4+K+5h+PB+M+L+dJ:eoKOgxiFJIyFa8BCquOK
MD5:	95A3D81256C777F68D1D74641CCE6F15
SHA1:	EE3F1A8F405AD0D946C21DFA85088754675876E1
SHA-256:	856E1ACC1F0A4068BD1A44F6C6179E42019C55D3E422EF28E4F2D406C00D5E99
SHA-512:	5F67BD3E54DCBE0D89821C591D9532B63FE3FADCA3A7B201067BA5F167D4F58B585D42B76D8C4CF9A0F6E81B64551D0358FEE214BCFF2A75E90BE9E30413DA36
Malicious:	false
Preview:	/* Area:.closure_call. Purpose:.Check multiple values passing from different type....Also, exceed the limit of gpr and fpr registers on PowerPC...Darwin.. Limitations:.none.. PR:..none.. Originator:.<andreast@gcc.gnu.org> 20030828. /...../ { dg-do run } /.#include "ffitest.h"..static void.closure_test_fn0(ffi_cif cif __UNUSED__, void* resp, void** args,... void* userdata).{. (ffi_arg)resp =. (int)(unsigned long long )args[0] + (int)((int )args[1]) +. (int)((unsigned long long )args[2]) + (int)(int )args[3] +. (int)((signed short )args[4]) +. (int)((unsigned long long )args[5]) +. (int)(int )args[6] + (int)((int )args[7]) +. (int)((double )args[8]) + (int)(int )args[9] +. (int)((int )args[10]) + (int)((float )args[11]) +. (int)(int )args[12] + (int)((int )args[13]) +. (int)((int )args[14]) + (int )args[15] + (intptr_t)userdata;.. printf("%d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d: %d\n",.. (int)*(unsigne

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\closure_fn1.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2873
Entropy (8bit):	5.096716402848742
Encrypted:	false
SSDEEP:	48:sF5or8oK0z2PRruMy1V+B1V+h1V+a1V+K+Y1V+b1V+a+BXj+b+j1V+V+Vd+a4+0L:4oKO28rlJtsTiBCKUt
MD5:	AF1C73F8927FD6FF7F3D0169D6A16BFA
SHA1:	387F5F8AC092BB039830BE1F6594CEAC9A6DD372
SHA-256:	0685203E159B44388CE63DD4EA86887FEBB31C7A46DD7B3E00A55DC972CD115C
SHA-512:	9F61597CD5B3248B54A07EA5B00A457D1D1C7752FCF9CC5992BD01B183308B99F63E2099869C83C6DE287A996DFCCC394FC23AFC4C9F2B80333AA47768C34448
Malicious:	false
Preview:	/* Area:.closure_call.. Purpose:.Check multiple values passing from different type....Also, exceed the limit of gpr and fpr registers on PowerPC...Darwin.. Limitations:.none.. PR:..none.. Originator:.<andreast@gcc.gnu.org> 20030828. /../ { dg-do run } /.#include "ffitest.h"...static void closure_test_fn1(ffi_cif cif __UNUSED__, void* resp, void** args,.... void* userdata).{. (ffi_arg)resp =. (int)(float )args[0] +(int)((float )args[1]) +. (int)((float )args[2]) + (int)(float )args[3] +. (int)((signed short )args[4]) + (int)((float )args[5]) +. (int)(float )args[6] + (int)((int )args[7]) +. (int)((double)args[8]) + (int)(int )args[9] +. (int)((int )args[10]) + (int)((float )args[11]) +. (int)(int )args[12] + (int)((int )args[13]) +. (int)((int )args[14]) + (int )args[15] + (intptr_t)userdata;.. printf("%d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d: %d\n",.. (int)(float )args[0], (int)((float )args[1]),.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\closure_fn2.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2892
Entropy (8bit):	5.131345458793862
Encrypted:	false
SSDEEP:	48:sPor8oK0z2PIruMmk+jk+Dk++k+K+4k+Bk+a+Bk+j+b+j1V+V+Vy1V+a4+0+2k+B:eoKO2J3TzOGRPFkif6Npj/KCGBCi2qt
MD5:	786C19F83B67C7B045C7603CC940DC6A
SHA1:	EFC67D8BD258D1936C5E4781C7D661FE2E5044C0
SHA-256:	5A51A966E23D18ACA911DC321560093025571D2C2BE3BB5CA0238D4FA8049D71
SHA-512:	2E731E1DD739505E815768494E27AE4AE41FF40A7B00EE101103CC42ACA7CE6D1F77324E5C097932FDC3E63A168BD95538CDE61226ABBECDDFDAFFBC900AF758
Malicious:	false
Preview:	/* Area:.closure_call. Purpose:.Check multiple values passing from different type....Also, exceed the limit of gpr and fpr registers on PowerPC...Darwin.. Limitations:.none.. PR:..none.. Originator:.<andreast@gcc.gnu.org> 20030828. /../ { dg-do run } /.#include "ffitest.h"..static void closure_test_fn2(ffi_cif cif __UNUSED__, void* resp, void** args,.... void* userdata).{. (ffi_arg)resp =. (int)(double )args[0] +(int)((double )args[1]) +. (int)((double )args[2]) + (int)(double )args[3] +. (int)((signed short )args[4]) + (int)((double )args[5]) +. (int)(double )args[6] + (int)((int )args[7]) +. (int)((double )args[8]) + (int)(int )args[9] +. (int)((int )args[10]) + (int)((float )args[11]) +. (int)(int )args[12] + (int)((float )args[13]) +. (int)((int )args[14]) + (int )args[15] + (intptr_t)userdata;.. printf("%d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d: %d\n",.. (int)(double )args[0], (int)((double )a

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\closure_fn3.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2911
Entropy (8bit):	5.0812761177635535
Encrypted:	false
SSDEEP:	48:sPor8oK0z2PXruMg1V+B1V+D1V+a1V+C1V+Y1V+p1V+F1V+jk+j+01V+j1V+B+V7:eoKO26S0kuRU/BClg78
MD5:	80762A3D4A50C6D41904442445DE79D0
SHA1:	DFEE6DC331465074EE4F7C1D94AC325440AE82D6
SHA-256:	870861C2DF4F07ABA46816CD8023DEBD5AE937D7CA66DC5C30F83B616A0A7070
SHA-512:	6709429A6A7E0E46F5F23F9B8B2ED401755A4C1106FE2E72A6B6DB49B4DC20EAFA7934198337E112C5B38F5855308F5076C3A553DF8B953BAC78EE7543C4D4EA
Malicious:	false
Preview:	/* Area:.closure_call. Purpose:.Check multiple values passing from different type....Also, exceed the limit of gpr and fpr registers on PowerPC...Darwin.. Limitations:.none.. PR:..none.. Originator:.<andreast@gcc.gnu.org> 20030828. /../ { dg-do run } /.#include "ffitest.h"..static void closure_test_fn3(ffi_cif cif __UNUSED__, void* resp, void** args,.... void* userdata). {. (ffi_arg)resp =. (int)(float )args[0] +(int)((float )args[1]) +. (int)((float )args[2]) + (int)(float )args[3] +. (int)((float )args[4]) + (int)((float )args[5]) +. (int)(float )args[6] + (int)((float )args[7]) +. (int)((double )args[8]) + (int)(int )args[9] +. (int)((float )args[10]) + (int)((float )args[11]) +. (int)(int )args[12] + (int)((float )args[13]) +. (int)((float )args[14]) + (int )args[15] + (intptr_t)userdata;.. printf("%d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d: %d\n",.. (int)(float )args[0], (int)(*(float

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\closure_fn4.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3016
Entropy (8bit):	4.935860867622361
Encrypted:	false
SSDEEP:	48:sKoK0BRPoru5h+Gh+fh+sh+Jh+ih+7h+Ih+Fh+Oh+Xh+Hh+sh+VLh+mh+/+5h+iC:HoKwRZI7lhhhhhhFkBCEb
MD5:	155711693AC5DF848DC78899D92159DB
SHA1:	F31F01AD404ED22F87A0B747D0AFBCBB50078F81
SHA-256:	E62902D14643204403D9195A57F2DA8AD348BF4C0A114BE55A8978CC0A66DE2A
SHA-512:	8007709B02B8A9AB9F2CECB6A312526E3ABB6028153C827BA64CAB0F7649EE3598A489C61551AF8F5902B9E8123C5EAE1EAA38ED967BE13613B047933371F86D
Malicious:	false
Preview:	/* Area:.closure_call. Purpose:.Check multiple long long values passing....Also, exceed the limit of gpr and fpr registers on PowerPC...Darwin.. Limitations:.none.. PR:..none.. Originator:.<andreast@gcc.gnu.org> 20031026. /../ { dg-do run } /..#include "ffitest.h"..static void.closure_test_fn0(ffi_cif cif __UNUSED__, void* resp, void** args,... void* userdata).{. (ffi_arg)resp =. (int)(unsigned long long )args[0] + (int)(unsigned long long )args[1] +. (int)(unsigned long long )args[2] + (int)(unsigned long long )args[3] +. (int)(unsigned long long )args[4] + (int)(unsigned long long )args[5] +. (int)(unsigned long long )args[6] + (int)(unsigned long long )args[7] +. (int)(unsigned long long )args[8] + (int)(unsigned long long )args[9] +. (int)(unsigned long long )args[10] +. (int)(unsigned long long )args[11] +. (int)(unsigned long long )args[12] +. (int)(unsigned long long )args[13] +. (int)(unsigned long long

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\closure_fn5.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3065
Entropy (8bit):	4.96252575367077
Encrypted:	false
SSDEEP:	48:sioK0BRPrru5h+Gh+fh+sh+Jh+ih+7h+Ih+Fh+Oh+7+Hh+sh+VLh+mh+/+5h+ihe:XoKwR+k7xhhhhvhFTBC5b
MD5:	2D9A7CA775EFBE9B842562715AF63078
SHA1:	3C99B7CD6AC013881C42219393685ABBA4B701D0
SHA-256:	141E4C2434392A639ADA3DAEF28947B5B15DB282CBC1F469D796BA9006B6F593
SHA-512:	AD4B77283C76D20B882E206CF80D92A05AAD502560998B445E07C5455E54907A91977C1DB6518478FDB01717FC1831C772D37A7B01A2F851913FE6713E0843E0
Malicious:	false
Preview:	/* Area:.closure_call. Purpose:.Check multiple long long values passing....Exceed the limit of gpr registers on PowerPC...Darwin.. Limitations:.none.. PR:..none.. Originator:.<andreast@gcc.gnu.org> 20031026. /../ { dg-do run } /.#include "ffitest.h"..static void.closure_test_fn5(ffi_cif cif __UNUSED__, void* resp, void** args,... void* userdata).{. (ffi_arg)resp =. (int)(unsigned long long )args[0] + (int)(unsigned long long )args[1] +. (int)(unsigned long long )args[2] + (int)(unsigned long long )args[3] +. (int)(unsigned long long )args[4] + (int)(unsigned long long )args[5] +. (int)(unsigned long long )args[6] + (int)(unsigned long long )args[7] +. (int)(unsigned long long )args[8] + (int)(unsigned long long )args[9] +. (int)(int )args[10] +. (int)(unsigned long long )args[11] +. (int)(unsigned long long )args[12] +. (int)(unsigned long long )args[13] +. (int)(unsigned long long )args[14] +. (int )args[1

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\closure_fn6.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3091
Entropy (8bit):	5.119483271585194
Encrypted:	false
SSDEEP:	48:sPor8ot0l6Pwru5h+K+S+Ph+p+4k+Bk+F1V+Bk+sk+b+j1V+V+Vd+aFk+xk+PD+V:eota6xjRk86JFhG/DnKWk2229OBCa50
MD5:	2447E0637FF7F794FC4113878F8927BB
SHA1:	D7AD76B289E8C4E2CEDAB2540BDBE11CB119ABE6
SHA-256:	707B03CCF6CC836BD565E4E565D06B0950D05D52A74BD59804B878F170452D85
SHA-512:	E791E1740E6E2CA68659F87DCEDFBAC685B43569E3F943E6A69AC8A5B94B2415B47263F22A987E397E0842FCA9C19D7E20005022D34DF76F76AF6AF45D9D020C
Malicious:	false
Preview:	/* Area:.closure_call. Purpose:.Check multiple values passing from different type....Also, exceed the limit of gpr and fpr registers on PowerPC.. Limitations:.none.. PR:..PR23404. Originator:.<andreast@gcc.gnu.org> 20050830. /../ { dg-do run } /.#include "ffitest.h"..static void.closure_test_fn0(ffi_cif cif __UNUSED__, void* resp, void** args,... void* userdata).{. (ffi_arg)resp =. (int)(unsigned long long )args[0] +. (int)((unsigned long long )args[1]) +. (int)((unsigned long long )args[2]) +. (int)(unsigned long long )args[3] +. (int)((int )args[4]) + (int)((double )args[5]) +. (int)(double )args[6] + (int)((float )args[7]) +. (int)((double )args[8]) + (int)(double )args[9] +. (int)((int )args[10]) + (int)((float )args[11]) +. (int)(int )args[12] + (int)((int )args[13]) +. (int)((double )args[14]) + (int)(double )args[15] +. (intptr_t)userdata;.. printf("%d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\closure_loc_fn0.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3096
Entropy (8bit):	5.142806735566593
Encrypted:	false
SSDEEP:	48:sPor8oK0zgPvru5h+M+S+l+K+7+k+a+Bk+j+b+j1V+V+Vd+a4+K+5h+PB+M+L+dX:eoKOgiiFJIywFB3EDuOK
MD5:	73CC1FEB078FD71F497D6C1D5BC9E578
SHA1:	A2CED77B4A6F59A4AFF461E8F5130F00AEFBB0CD
SHA-256:	737BEE646BA7CBE201D3F103C59F079AAB7D4309FC33196684D9FFDCBEA91031
SHA-512:	1534F2DE7D7406B38317D48A3D6D55D20013453C9E358649A127C5A1D696E79560E3567956DD28687A85C96D72DB6CA5C8365D85F41521307E8B5CCD439AA58A
Malicious:	false
Preview:	/* Area:.closure_call. Purpose:.Check multiple values passing from different type....Also, exceed the limit of gpr and fpr registers on PowerPC...Darwin.. Limitations:.none.. PR:..none.. Originator:.<andreast@gcc.gnu.org> 20030828. /...../ { dg-do run } /.#include "ffitest.h"..static void.closure_loc_test_fn0(ffi_cif cif __UNUSED__, void* resp, void** args,... void* userdata).{. (ffi_arg)resp =. (int)(unsigned long long )args[0] + (int)((int )args[1]) +. (int)((unsigned long long )args[2]) + (int)(int )args[3] +. (int)((signed short )args[4]) +. (int)((unsigned long long )args[5]) +. (int)(int )args[6] + (int)((int )args[7]) +. (int)((double )args[8]) + (int)(int )args[9] +. (int)((int )args[10]) + (int)((float )args[11]) +. (int)(int )args[12] + (int)((int )args[13]) +. (int)((int )args[14]) + (int )args[15] + (intptr_t)userdata;.. printf("%d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d: %d\n",.. (int)*(uns

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\closure_stdcall.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1952
Entropy (8bit):	5.141415093820557
Encrypted:	false
SSDEEP:	48:sraDLxruN+M+i+P+O+PB+A+K+k/4PoBvpBGbJPc/NXF/N/tqN:5Lk7N7BoQDlS
MD5:	802C38ED43E357475917666692725E6B
SHA1:	AC1340FC8915C874285C291AA6191EB2CD061BEB
SHA-256:	95267A9BE05584C2247D4A4F1C1CD1CB0A568ABD7B27A2774DFD827CF4293191
SHA-512:	D6C51C8A77386CA3BA9774BC6A909438B06B4B4481D49FE3FDA89520088DCCFA92D731AF8712779F71CB4D3C93AA5D7D42B014177ECBD44B3CB9AF41C4D950FC
Malicious:	false
Preview:	/* Area:.closure_call (stdcall convention). Purpose:.Check handling when caller expects stdcall callee. Limitations:.none.. PR:..none.. Originator:.<twalljava@dev.java.net> /../ { dg-do run { target i?86--cygwin i?86--mingw } } /.#include "ffitest.h"..static void.closure_test_stdcall(ffi_cif cif __UNUSED__, void* resp, void** args,... void* userdata).{. (ffi_arg)resp =. (int)(int )args[0] + (int)((int )args[1]). + (int)((int )args[2]) + (int)((int )args[3]). + (int)(intptr_t)userdata;.. printf("%d %d %d %d: %d\n",.. (int)(int )args[0], (int)((int )args[1]),.. (int)((int )args[2]), (int)((int )args[3]),. (int)(ffi_arg )resp);..}..typedef int (__stdcall closure_test_type0)(int, int, int, int);..int main (void).{. ffi_cif cif;. void code;. ffi_closure pcl = ffi_closure_alloc(sizeof(ffi_closure), &code);. ffi_type cl_arg_types[17];. int res;. void* sp_pre;. void* sp_post;. char buf[1024];.. cl_arg_types[0] = &ffi_type_ui

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\closure_thiscall.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1958
Entropy (8bit):	5.131497919235525
Encrypted:	false
SSDEEP:	48:s82cfIru/+M+i+P+O+PB+A+K+j/4PoBvpBHbcPc/NXF/N/tqN:VxNY7B7fDlS
MD5:	5D52F5CFD9125F82FB8E8E7DED890090
SHA1:	97D17AAAC1AC1FC89E84D94C2A7500C0A520061C
SHA-256:	DA5E0BD80881FE93CCB37480BECF26D2942353C95156C743FD003E6426BA11BD
SHA-512:	1767AF7EBB02A2737F663A91F642F62BF557239D6B80FE5A85BE305BEC3771C9DD7047B2157909C2524709E37B962C0696429732B3776EBB8BE394D19D287CA0
Malicious:	false
Preview:	/* Area:.closure_call (thiscall convention). Purpose:.Check handling when caller expects thiscall callee. Limitations:.none.. PR:..none.. Originator:.<ktietz@redhat.com> /../ { dg-do run { target i?86--cygwin i?86--mingw } } /.#include "ffitest.h"..static void.closure_test_thiscall(ffi_cif cif __UNUSED__, void* resp, void** args,... void* userdata).{. (ffi_arg)resp =. (int)(int )args[0] + (int)((int )args[1]). + (int)((int )args[2]) + (int)((int )args[3]). + (int)(intptr_t)userdata;.. printf("%d %d %d %d: %d\n",.. (int)(int )args[0], (int)((int )args[1]),.. (int)((int )args[2]), (int)((int )args[3]),. (int)(ffi_arg )resp);..}..typedef int (__thiscall closure_test_type0)(int, int, int, int);..int main (void).{. ffi_cif cif;. void code;. ffi_closure pcl = ffi_closure_alloc(sizeof(ffi_closure), &code);. ffi_type cl_arg_types[17];. int res;. void* sp_pre;. void* sp_post;. char buf[1024];.. cl_arg_types[0] = &ffi_typ

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\cls_12byte.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2530
Entropy (8bit):	5.103119168506066
Encrypted:	false
SSDEEP:	48:Gk0z2P1OKQqFnlDvaw8rmRCRlqLCgADxoHlDyx/r8rz31LtonU4G4M1f2jQzumu0:GkO201EnZvawimRAaCgADqHZytr8rj1f
MD5:	C97F1F851010776179EECCF84093F453
SHA1:	5517410265B51C07C04C46D5D39FFCC30DC95E70
SHA-256:	D079BF4FD04A501EAEED273E172C698C502CD5D8A5D43B826864225E391A0E61
SHA-512:	8F60BAC3A85E75BED686EEAFF4C94040C8D22D04C9576447E7FB0256B9533544F21CA58A1BE439FF063E73465AFA262EAE2859F11BEA290C1BD3A726A9EC5D22
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check structure passing with different structure size.. Limitations:.none.. PR:..none.. Originator:.<andreast@gcc.gnu.org> 20030828. /../ { dg-do run } /.#include "ffitest.h"..typedef struct cls_struct_12byte {. int a;. int b;. int c;.} cls_struct_12byte;..cls_struct_12byte cls_struct_12byte_fn(struct cls_struct_12byte b1,.... struct cls_struct_12byte b2).{. struct cls_struct_12byte result;.. result.a = b1.a + b2.a;. result.b = b1.b + b2.b;. result.c = b1.c + b2.c;.. printf("%d %d %d %d %d %d: %d %d %d\n", b1.a, b1.b, b1.c, b2.a, b2.b, b2.c,.. result.a, result.b, result.c);.. return result;.}..static void cls_struct_12byte_gn(ffi_cif cif __UNUSED__, void* resp,..... void** args , void* userdata __UNUSED__).{. struct cls_struct_12byte b1, b2;.. b1 = (struct cls_struct_12byte)(args[0]);. b2 = (struct cls_struct_12byte)(args[1]);.. (cls_struct_12byte)resp = cls_struct_12byte_fn(b1, b2);.}..int main (void).{. ffi_

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\cls_16byte.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2587
Entropy (8bit):	5.140532477357027
Encrypted:	false
SSDEEP:	48:Gfr0z2P1O+lkNcFjFGswrm6CRALCystZtzotNcx/r8rn3V5BajU4G4M1f2jQzu2w:GfrO20QkQjFGsum6AeCysvOTctr8r3VC
MD5:	9A889ECDE9CAC8D6CDCAB4D46358566D
SHA1:	731F88297FD264C1A5CF1475AA225EAAC01F0A00
SHA-256:	6453A6F302D814249C2E0A6A29234B8B03BDC4E273CABE54280F20193C0BC0BD
SHA-512:	1FD3B3DEEC460C63405D638CC2063DED1D40A20DEB2E404C0623035FC1D7BC50A5225C0AAAC76CC6CCC80538F5ED4E81B02FFCEC50E8499A09A7C6146FA688A8
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check structure passing with different structure size....Depending on the ABI. Check overlapping.. Limitations:.none.. PR:..none.. Originator:.<andreast@gcc.gnu.org> 20030828. /../ { dg-do run } /.#include "ffitest.h"..typedef struct cls_struct_16byte {. int a;. double b;. int c;.} cls_struct_16byte;..cls_struct_16byte cls_struct_16byte_fn(struct cls_struct_16byte b1,.... struct cls_struct_16byte b2).{. struct cls_struct_16byte result;.. result.a = b1.a + b2.a;. result.b = b1.b + b2.b;. result.c = b1.c + b2.c;.. printf("%d %g %d %d %g %d: %d %g %d\n", b1.a, b1.b, b1.c, b2.a, b2.b, b2.c,.. result.a, result.b, result.c);.. return result;.}..static void cls_struct_16byte_gn(ffi_cif cif __UNUSED__, void* resp,..... void** args, void* userdata __UNUSED__).{. struct cls_struct_16byte b1, b2;.. b1 = (struct cls_struct_16byte)(args[0]);. b2 = (struct cls_struct_16byte)(args[1]);.. (cls_struct_16byte)resp = cls_struct_1

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\cls_18byte.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2772
Entropy (8bit):	5.151826923001479
Encrypted:	false
SSDEEP:	48:Gf/JfrI0DP1OnuTmMFd/CIN+ZBB0f2ruU/sfohe/dtx65kF3XRU4G4M1f2jQHafU:GfSK0uTmGd/BNmfU/U/sghedtx6c3XRm
MD5:	74A4D0CD76EF4A68B57524E52EB6E026
SHA1:	C2AB5D73514CCB77EE6EE2205886E5929EDF900D
SHA-256:	219264582D099590A0F9CAFF47B4D6911F4CDCD118A96B02B34F0846789D81BC
SHA-512:	9B4A7CACC0F9C81510AF7A205F7F47E7974074D4AEC438E72D31FC81F32B045AF1CA51C4F5E251CA4798414879CA7F739A60113FCFE4B47EA5466DA41DCAD148
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check structure passing with different structure size....Depending on the ABI. Double alignment check on darwin.. Limitations:.none.. PR:..none.. Originator:.<andreast@gcc.gnu.org> 20030915. /../ { dg-do run } /.#include "ffitest.h"..typedef struct cls_struct_18byte {. double a;. unsigned char b;. unsigned char c;. double d;.} cls_struct_18byte;..cls_struct_18byte cls_struct_18byte_fn(struct cls_struct_18byte a1,.... struct cls_struct_18byte a2).{. struct cls_struct_18byte result;.. result.a = a1.a + a2.a;. result.b = a1.b + a2.b;. result.c = a1.c + a2.c;. result.d = a1.d + a2.d;... printf("%g %d %d %g %g %d %d %g: %g %d %d %g\n", a1.a, a1.b, a1.c, a1.d,.. a2.a, a2.b, a2.c, a2.d,.. result.a, result.b, result.c, result.d);. return result;.}..static void.cls_struct_18byte_gn(ffi_cif cif __UNUSED__, void* resp, void** args,... void* userdata __UNUSED__).{. struct cls_struct_18byte a1, a2;.. a1 = *(struct cls_struct_

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\cls_19byte.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2966
Entropy (8bit):	5.149438916027865
Encrypted:	false
SSDEEP:	48:Gf/JfrI0DP1OTToQvFyENIMbZbdfrruUy3GoOT/dp0xT5kSmYyU4G4M1f2jQHafM:GfSK0TToQNyEmMFbpWUy3ZOjdyxTJmYJ
MD5:	8745D4A18EA0C61BFC288BDCFE144733
SHA1:	1A60B0602045CDFD1002B000CF08D1DE44EDAB57
SHA-256:	DDF35A3B3CF53A2D5C40F6458A1D297F6CC5286E14F709A6D0F2712500CB5960
SHA-512:	B05E91EA5F2B4E9208447A7E6D2A5FE459584D81358BE11C9C0E1F77DFFEAE93B75C897D2D4A940420C469F33A07E44F23F4ED256C3B77DE063827092567AFA6
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check structure passing with different structure size....Depending on the ABI. Double alignment check on darwin.. Limitations:.none.. PR:..none.. Originator:.<andreast@gcc.gnu.org> 20030915. /../ { dg-do run } /.#include "ffitest.h"..typedef struct cls_struct_19byte {. double a;. unsigned char b;. unsigned char c;. double d;. unsigned char e;.} cls_struct_19byte;..cls_struct_19byte cls_struct_19byte_fn(struct cls_struct_19byte a1,.... struct cls_struct_19byte a2).{. struct cls_struct_19byte result;.. result.a = a1.a + a2.a;. result.b = a1.b + a2.b;. result.c = a1.c + a2.c;. result.d = a1.d + a2.d;. result.e = a1.e + a2.e;... printf("%g %d %d %g %d %g %d %d %g %d: %g %d %d %g %d\n",.. a1.a, a1.b, a1.c, a1.d, a1.e,.. a2.a, a2.b, a2.c, a2.d, a2.e,.. result.a, result.b, result.c, result.d, result.e);. return result;.}..static void.cls_struct_19byte_gn(ffi_cif cif __UNUSED__, void* resp, void** args,... void* userdata

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\cls_1_1byte.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2303
Entropy (8bit):	5.107284856569292
Encrypted:	false
SSDEEP:	48:GepHw0fP1OGQFxjeIxKa9fqruEjQ7ol6/rRor+OrP71U4G4M1f2jQNR1bSbWcdfP:GCHwW0GqxjFx3JzEjQslirmr+OrD1lfF
MD5:	E1ADB7CCE72CA554059E8AFE052E0D01
SHA1:	9FAEC57C75C7A207988AD184A4393F7ECED82DF3
SHA-256:	A4A04BF283E8805A8554D6D5FAE373BDB727B1BDBB503CC6E97EFC43FC347ECA
SHA-512:	5439B01EC11B4439E7DA31125B22FD8C7038F91D1EFC5E1F982450507E81AE21642472F78E79A79918F9B8F59DE365D83B05D169F4CD3A4C96C27FD0ABC3BCD1
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check structure passing with different structure size....Especially with small structures which may fit in one...register. Depending on the ABI.. Limitations:.none.. PR:..none.. Originator:.<andreast@gcc.gnu.org> 20030902. /..../ { dg-do run } /.#include "ffitest.h"..typedef struct cls_struct_1_1byte {. unsigned char a;.} cls_struct_1_1byte;..cls_struct_1_1byte cls_struct_1_1byte_fn(struct cls_struct_1_1byte a1,.... struct cls_struct_1_1byte a2).{. struct cls_struct_1_1byte result;.. result.a = a1.a + a2.a;.. printf("%d %d: %d\n", a1.a, a2.a, result.a);.. return result;.}..static void.cls_struct_1_1byte_gn(ffi_cif cif __UNUSED__, void* resp, void** args,... void* userdata __UNUSED__).{.. struct cls_struct_1_1byte a1, a2;.. a1 = (struct cls_struct_1_1byte)(args[0]);. a2 = (struct cls_struct_1_1byte)(args[1]);.. (cls_struct_1_1byte)resp = cls_struct_1_1byte_fn(a1, a2);.}..int main (void).{. ffi_cif cif;. void

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\cls_20byte.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2539
Entropy (8bit):	5.124493827737527
Encrypted:	false
SSDEEP:	48:Gfr0z2P1OrkbFuwxIo/ZCs6gIsmYfHruU+Daoq3/r8rfttCLuU4G4M1f2jQH2Vuh:GfrO20rkJuwyohCKmIyU+DNqvr8rfDCt
MD5:	01D99D1D899E6ECF137B0BB5ADD003B2
SHA1:	C20B994487AEFCB8DB5CD8168A0BB839D1B23AE1
SHA-256:	E59487A4B312F0EF5F4D550FDA23D67CC55232347557B6EE9C1AE67F9AAFBD02
SHA-512:	4FC5277C783860B3CDF08A60150A0D1F6FB7510773DFB32D18C983BFECB7225617325B7EC6E5DA4349E7328E8BB09E85421AF899C4876DA8CE1CD19AA03489DC
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check structure passing with different structure size....Depending on the ABI. Check overlapping.. Limitations:.none.. PR:..none.. Originator:.<andreast@gcc.gnu.org> 20030828. /../ { dg-do run } /.#include "ffitest.h"..typedef struct cls_struct_20byte {. double a;. double b;. int c;.} cls_struct_20byte;..cls_struct_20byte cls_struct_20byte_fn(struct cls_struct_20byte a1,.... struct cls_struct_20byte a2).{. struct cls_struct_20byte result;.. result.a = a1.a + a2.a;. result.b = a1.b + a2.b;. result.c = a1.c + a2.c;.. printf("%g %g %d %g %g %d: %g %g %d\n", a1.a, a1.b, a1.c, a2.a, a2.b, a2.c,.. result.a, result.b, result.c);. return result;.}..static void.cls_struct_20byte_gn(ffi_cif cif __UNUSED__, void* resp, void** args,... void* userdata __UNUSED__).{. struct cls_struct_20byte a1, a2;.. a1 = (struct cls_struct_20byte)(args[0]);. a2 = (struct cls_struct_20byte)(args[1]);.. (cls_struct_20byte)resp = cls_stru

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\cls_20byte1.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2541
Entropy (8bit):	5.12455725446666
Encrypted:	false
SSDEEP:	48:Gfr0ziP1OFlSbFuwxIo/ZC+FmYfHruU+Daoq3/d8xfHChFuU4G4M1f2jQzu2d8q1:GfrOi0vSJuwyohCGmIyU+DNqvd8xfHCJ
MD5:	74A478A4D23C568052C25D0828EB9C37
SHA1:	13ECF1291F9E8933F488BE6B085E3318CD8327FC
SHA-256:	41182ADEFB78B988DF587DEE49DF7F213A4BD0BD64B3294552A75E7FDD00C36E
SHA-512:	60FFFE5F0250B119EEAB476F606131B0F307FD02D56566C6701BA384E347ACBE676462AC95AE02FF5C758CEDEC0C86D67FC06E8E0B1BB9DAD55EF7F7812FB086
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check structure passing with different structure size....Depending on the ABI. Check overlapping.. Limitations:.none.. PR:..none.. Originator:.<andreast@gcc.gnu.org> 20030828. /..../ { dg-do run } /.#include "ffitest.h"..typedef struct cls_struct_20byte {. int a;. double b;. double c;.} cls_struct_20byte;..cls_struct_20byte cls_struct_20byte_fn(struct cls_struct_20byte a1,.... struct cls_struct_20byte a2).{. struct cls_struct_20byte result;.. result.a = a1.a + a2.a;. result.b = a1.b + a2.b;. result.c = a1.c + a2.c;.. printf("%d %g %g %d %g %g: %d %g %g\n", a1.a, a1.b, a1.c, a2.a, a2.b, a2.c,.. result.a, result.b, result.c);. return result;.}..static void.cls_struct_20byte_gn(ffi_cif cif __UNUSED__, void* resp, void** args,... void* userdata __UNUSED__).{. struct cls_struct_20byte a1, a2;.. a1 = (struct cls_struct_20byte)(args[0]);. a2 = (struct cls_struct_20byte)(args[1]);.. (cls_struct_20byte)resp = cls_st

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\cls_24byte.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	5.110897188355816
Encrypted:	false
SSDEEP:	96:GfrO20LDNLRLGLYLiLLLALYLoWhL6ULjL9LHLVL/LSLsrtrL9DhLKKLHEL4ELWlQ:gu9FQCcfqCoCnXxrJjsw9Br+riTLtkTL
MD5:	9AD6559D93C4E5946E60D6D08551748C
SHA1:	8A027A2126C098E6F0D2D2ED2409406172F1A912
SHA-256:	E92B34CA2EB89608902EFF0960104D277691469BE758046D8C210D3A4579A3F0
SHA-512:	49DA8E8D707A7C242F559191CB9A6C97FE7ED3B30205B1386A8D9ADDA0D6398DC7F6C6A4A4F1A4F554A4FA594C7F4D49D90E83B07EBEE838FDE424200D367B5E
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check structure passing with different structure size....Depending on the ABI. Check overlapping.. Limitations:.none.. PR:..none.. Originator:.<andreast@gcc.gnu.org> 20030828. /../ { dg-do run } */.#include "ffitest.h"..typedef struct cls_struct_24byte {. double a;. double b;. int c;. float d;.} cls_struct_24byte;..cls_struct_24byte cls_struct_24byte_fn(struct cls_struct_24byte b0,.... struct cls_struct_24byte b1,.... struct cls_struct_24byte b2,.... struct cls_struct_24byte b3).{. struct cls_struct_24byte result;.. result.a = b0.a + b1.a + b2.a + b3.a;. result.b = b0.b + b1.b + b2.b + b3.b;. result.c = b0.c + b1.c + b2.c + b3.c;. result.d = b0.d + b1.d + b2.d + b3.d;.. printf("%g %g %d %g %g %g %d %g %g %g %d %g %g %g %d %g: %g %g %d %g\n",.. b0.a, b0.b, b0.c, b0.d,.. b1.a, b1.b, b1.c, b1.d,.. b2.a, b2.b, b2.c, b2.d,.. b3.a, b3.b, b3.c, b2.d,.. result.a, result.b, result.c, result.d);.. return result;.}..static vo

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\cls_2byte.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2432
Entropy (8bit):	5.121350597979985
Encrypted:	false
SSDEEP:	48:GepHw0z2P1OF3LxFwgvrI6lZMLf1ruMsN8owgu/r8rpGkwcU4G4M1f2jQNaU1bSO:GCHwO20FbvwgvU6zMjoMsNfwgOr8rpG/
MD5:	CA547730D5493630C5B4F813450F6DDE
SHA1:	6C31F844059D0B7D0B96AEF68BAEF36E64E6D59D
SHA-256:	268E49D3BDBA53B10EA1B31E7DB68D0D6010067AC15D3BD8B985388185888BF0
SHA-512:	878F3145FB446D3D718A9F9651E26A4FCFF1607925D73983C51C1423E4FEE5C5DD68E8C30B83B613454AFF2EEE3EBB35C8FC0E2202C87A3BF859478107CEC893
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check structure passing with different structure size....Especially with small structures which may fit in one...register. Depending on the ABI.. Limitations:.none.. PR:..none.. Originator:.<andreast@gcc.gnu.org> 20030828. /../ { dg-do run } /.#include "ffitest.h"..typedef struct cls_struct_2byte {. unsigned char a;. unsigned char b;.} cls_struct_2byte;..cls_struct_2byte cls_struct_2byte_fn(struct cls_struct_2byte a1,.... struct cls_struct_2byte a2).{. struct cls_struct_2byte result;.. result.a = a1.a + a2.a;. result.b = a1.b + a2.b;.. printf("%d %d %d %d: %d %d\n", a1.a, a1.b, a2.a, a2.b, result.a, result.b);.. return result;.}..static void.cls_struct_2byte_gn(ffi_cif cif __UNUSED__, void* resp, void** args,... void* userdata __UNUSED__).{.. struct cls_struct_2byte a1, a2;.. a1 = (struct cls_struct_2byte)(args[0]);. a2 = (struct cls_struct_2byte)(args[1]);.. (cls_struct_2byte)resp = cls_struct_2byte_fn(a1, a

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\cls_3_1byte.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	5.146202895741255
Encrypted:	false
SSDEEP:	48:GepHw0fP1OqTCSFfBcI3kZCYxifsruENWpoPk/r8r09Z55vU4G4M1f2jQNaf8q1m:GCHw60qTCsfBz3gCYxuVENWiPor8r098
MD5:	B3233FB76BA0A1266F8D9CB15EDC5740
SHA1:	EDFD60FEA1944595E059722E703714AA92B39736
SHA-256:	66BE57D80B9B424B755A7A47982A87DF22A2F0AFD8D1FCAF68625ACD1D722C66
SHA-512:	F0F976020B57391620E5C10404EA4B8BBBA0B2F036AA286DF271EC1EB5EF615DCDC343E7249AF98187CE856AD88D77F73FF49F00954802C27029EADEC338956A
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check structure passing with different structure size....Especially with small structures which may fit in one...register. Depending on the ABI.. Limitations:.none.. PR:..none.. Originator:.<andreast@gcc.gnu.org> 20030902. /../ { dg-do run } /.#include "ffitest.h"..typedef struct cls_struct_3_1byte {. unsigned char a;. unsigned char b;. unsigned char c;.} cls_struct_3_1byte;..cls_struct_3_1byte cls_struct_3_1byte_fn(struct cls_struct_3_1byte a1,.... struct cls_struct_3_1byte a2).{. struct cls_struct_3_1byte result;.. result.a = a1.a + a2.a;. result.b = a1.b + a2.b;. result.c = a1.c + a2.c;.. printf("%d %d %d %d %d %d: %d %d %d\n", a1.a, a1.b, a1.c,.. a2.a, a2.b, a2.c,.. result.a, result.b, result.c);.. return result;.}..static void.cls_struct_3_1byte_gn(ffi_cif cif __UNUSED__, void* resp, void** args,... void* userdata __UNUSED__).{.. struct cls_struct_3_1byte a1, a2;.. a1 = (struct cls_struct_3_1byte)(args[0])

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\cls_3byte1.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2453
Entropy (8bit):	5.133588392009571
Encrypted:	false
SSDEEP:	48:GepHr0z2P1OzIJ3LzyFz/zhz8IzXzEZMLfzMruMztz2zJozvzE/r8rzU/zZmzPUA:GCHrO20zIbzMz/zhzTzXzAMjz1Mztz2e
MD5:	981FA45D1742BE35D08EBECA3A160FBB
SHA1:	25B5CA61E27A21BB0C6B9E6B5581A1527B2536D8
SHA-256:	0CF03630371A76B40ACC53EBF4C23318A4BBAF96CC2E32E690C7035E1281D030
SHA-512:	B7A9A15FB930719D1004C9799B202EB9CC86C5596626B7B0ECD7769C2D55ED26A5127287BD0F2B78CC67820732B975019551FEEAE3BB2C5F20F5D162A1E73237
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check structure passing with different structure size....Especially with small structures which may fit in one...register. Depending on the ABI. Check overlapping.. Limitations:.none.. PR:..none.. Originator:.<andreast@gcc.gnu.org> 20030828. /../ { dg-do run } /.#include "ffitest.h"..typedef struct cls_struct_3byte {. unsigned short a;. unsigned char b;.} cls_struct_3byte;..cls_struct_3byte cls_struct_3byte_fn(struct cls_struct_3byte a1,.... struct cls_struct_3byte a2).{. struct cls_struct_3byte result;.. result.a = a1.a + a2.a;. result.b = a1.b + a2.b;.. printf("%d %d %d %d: %d %d\n", a1.a, a1.b, a2.a, a2.b, result.a, result.b);.. return result;.}..static void.cls_struct_3byte_gn(ffi_cif cif __UNUSED__, void* resp, void** args,... void* userdata __UNUSED__).{.. struct cls_struct_3byte a1, a2;.. a1 = (struct cls_struct_3byte)(args[0]);. a2 = (struct cls_struct_3byte)(args[1]);.. (cls_struct_3byte)resp = cls_s

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\cls_3byte2.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2491
Entropy (8bit):	5.146639200776178
Encrypted:	false
SSDEEP:	48:GepHr0z2P1Ozq5LzSFzfzizcIz3zkZMLfz/ruqzNzWzpozPzV/r8rz03z5/azvUk:GCHrO20zqlzszfzizzz3zgMjzaqzNzWh
MD5:	D7EC90166BCEB0193B2C691DB6EA7181
SHA1:	311B8BFEAEA387D36AFD641F717BD477283C7CF3
SHA-256:	2DC56EBE102DB45C139270980D4133A8DAA57D2808C7F1B3A683617C186CC9A9
SHA-512:	4F83FFE5ED3803031359F4842E36C5C9111691DA0EEACB213C9E45C3FC81244C0E1CA1FAE3CD083E2BE7384C1383182FAEC1BFB6B0AC210B8768B1EE4E69AD74
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check structure passing with different structure size....Especially with small structures which may fit in one...register. Depending on the ABI. Check overlapping.. Limitations:.none.. PR:..none.. Originator:.<andreast@gcc.gnu.org> 20030828. /../ { dg-do run } /.#include "ffitest.h"..typedef struct cls_struct_3byte_1 {. unsigned char a;. unsigned short b;.} cls_struct_3byte_1;..cls_struct_3byte_1 cls_struct_3byte_fn1(struct cls_struct_3byte_1 a1,.... struct cls_struct_3byte_1 a2).{. struct cls_struct_3byte_1 result;.. result.a = a1.a + a2.a;. result.b = a1.b + a2.b;.. printf("%d %d %d %d: %d %d\n", a1.a, a1.b, a2.a, a2.b, result.a, result.b);.. return result;.}..static void.cls_struct_3byte_gn1(ffi_cif cif __UNUSED__, void* resp, void** args,... void* userdata __UNUSED__).{.. struct cls_struct_3byte_1 a1, a2;.. a1 = (struct cls_struct_3byte_1)(args[0]);. a2 = (struct cls_struct_3byte_1)(args[1]);.. *(cls_struc

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\cls_4_1byte.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2860
Entropy (8bit):	5.146152288919063
Encrypted:	false
SSDEEP:	48:GepHw0fP1OjTEJXFqMlIUDZN+fDruEKf+oWr/rtr7tOzaU4G4M1f2jQNaf81QH1j:GCHw60jTEJ1qMOUdNK+EKfRWrrtr7tOE
MD5:	C1A9FB2D6C003C4192CC65DCC5729B52
SHA1:	B537F101740E081582AA97C4A19B32E091554425
SHA-256:	22B02C05FE39664FF9B74C7CEC5685B66D83E4C651734DDFFF2E7DBD46D473BE
SHA-512:	6ADEBE87C10B3A1C15427AB1998E9358FEACBB56F910CAE1F089F7B1BD73092FC5411A5192574DB87A61E330168196AC85311DA9297782D9F3F3B9B200B7E2F1
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check structure passing with different structure size....Especially with small structures which may fit in one...register. Depending on the ABI.. Limitations:.none.. PR:..none.. Originator:.<andreast@gcc.gnu.org> 20030902. /../ { dg-do run } /.#include "ffitest.h"..typedef struct cls_struct_4_1byte {. unsigned char a;. unsigned char b;. unsigned char c;. unsigned char d;.} cls_struct_4_1byte;..cls_struct_4_1byte cls_struct_4_1byte_fn(struct cls_struct_4_1byte a1,.... struct cls_struct_4_1byte a2).{. struct cls_struct_4_1byte result;.. result.a = a1.a + a2.a;. result.b = a1.b + a2.b;. result.c = a1.c + a2.c;. result.d = a1.d + a2.d;.. printf("%d %d %d %d %d %d %d %d: %d %d %d %d\n", a1.a, a1.b, a1.c, a1.d,.. a2.a, a2.b, a2.c, a2.d,.. result.a, result.b, result.c, result.d);.. return result;.}..static void.cls_struct_4_1byte_gn(ffi_cif cif __UNUSED__, void* resp, void** args,... void* userdata __UNUSED__).{.. stru

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\cls_4byte.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2403
Entropy (8bit):	5.153150676934144
Encrypted:	false
SSDEEP:	48:Gfr0z2PdOVJ5L3FKsFI0jZMLfjruMq/eo2L/r8rbBu1uj6U4G4M1f2jQ9QU1bSb0:GfrO2cTlVKsu09MjeMq/x2Lr8rbBuujD
MD5:	FC9C27F090D515B83D42B3B99E620022
SHA1:	605C32D41DC8BAD0547279FC784D8A5A989846D5
SHA-256:	08174A7A85F1E7338D7307A0BE62EE626EB70BEBC8772037334124FAE0648E9A
SHA-512:	BB518A9C39443766B4202E2C4C1BEDC29572156996F59BDC99C778A6906D61991A6D087CF74600EDAC0081A2BC28C58648DC0FDEFFAEB2C71315E00CC59EEA58
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check structure passing with different structure size....Depending on the ABI. Check overlapping.. Limitations:.none.. PR:..none.. Originator:.<andreast@gcc.gnu.org> 20030828. /../ { dg-do run } /..#include "ffitest.h"..typedef struct cls_struct_4byte {. unsigned short a;. unsigned short b;.} cls_struct_4byte;..cls_struct_4byte cls_struct_4byte_fn(struct cls_struct_4byte a1,.... struct cls_struct_4byte a2).{. struct cls_struct_4byte result;.. result.a = a1.a + a2.a;. result.b = a1.b + a2.b;.. printf("%d %d %d %d: %d %d\n", a1.a, a1.b, a2.a, a2.b, result.a, result.b);.. return result;.}..static void.cls_struct_4byte_gn(ffi_cif cif __UNUSED__, void* resp, void** args,... void* userdata __UNUSED__).{.. struct cls_struct_4byte a1, a2;.. a1 = (struct cls_struct_4byte)(args[0]);. a2 = (struct cls_struct_4byte)(args[1]);.. (cls_struct_4byte)resp = cls_struct_4byte_fn(a1, a2);.}..int main (void).{. ffi_cif cif;. vo

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\cls_5_1_byte.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3022
Entropy (8bit):	5.120915608841059
Encrypted:	false
SSDEEP:	48:Gfr01P1O8TEZQUF1naIVGZF3furuM3U3oJW/rp0riBuJZ/LZTwU4G4M1f2jQNaf5:Gfrg08TEZQO1nJVeFPnM3U4JmryriBuQ
MD5:	3E24A186F6C1DD180E40E4AFAFD2FF9B
SHA1:	22CB061045F6C1F9756BD89EEF06C824C906A060
SHA-256:	F2E09113AA4885AEFF3DB96262FEFBF443E02C2559957DBFA3C8663F25C4076F
SHA-512:	F2B93B32753BE8B91BAA5B6E98BD69C29A62CF60F5868C6BACFFA104B44B0B4E519EFDCD048BEFC83A767363A67D7CFE3C216473C0060ABF239E7E49BDE4E38E
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check structure passing with different structure size....Depending on the ABI. Check overlapping.. Limitations:.none.. PR:..none.. Originator:.<andreast@gcc.gnu.org> 20050708. /../ { dg-do run } /.#include "ffitest.h"..typedef struct cls_struct_5byte {. unsigned char a;. unsigned char b;. unsigned char c;. unsigned char d;. unsigned char e;.} cls_struct_5byte;..cls_struct_5byte cls_struct_5byte_fn(struct cls_struct_5byte a1,.... struct cls_struct_5byte a2).{. struct cls_struct_5byte result;.. result.a = a1.a + a2.a;. result.b = a1.b + a2.b;. result.c = a1.c + a2.c;. result.d = a1.d + a2.d;. result.e = a1.e + a2.e;.. printf("%d %d %d %d %d %d %d %d %d %d: %d %d %d %d %d\n",.. a1.a, a1.b, a1.c, a1.d, a1.e,.. a2.a, a2.b, a2.c, a2.d, a2.e,.. result.a, result.b, result.c, result.d, result.e);.. return result;.}..static void.cls_struct_5byte_gn(ffi_cif cif __UNUSED__, void* resp, void** args,... void* userdata __UNUSED

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\cls_5byte.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2644
Entropy (8bit):	5.139713336417558
Encrypted:	false
SSDEEP:	48:Gfr0z2P1OWJVCUF1naIVGZCYxifuruM3U3oJW/r8riBuX8/GTwU4G4M1f2jQ9Qfb:GfrO20yVCO1nJVeCYxunM3U4Jmr8riBF
MD5:	3969C9BB2081637EE1D0B32E2AD25160
SHA1:	C07FE06CF737FCE354D232F55CF4A84DD4A56202
SHA-256:	426699C3D908A5D01DAA7F49691E05820A3D82052BFFC0EFA5DE31FAE1B1F873
SHA-512:	7C4B5E0A26808A34BF870AC2EF34F4DF4CF61163CE9E9FD957244DC1440A2AB1BF39BBEA5167F31702E5390B5058C026E61E6E30F0D0842F7C072C1FECAD114F
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check structure passing with different structure size....Depending on the ABI. Check overlapping.. Limitations:.none.. PR:..none.. Originator:.<andreast@gcc.gnu.org> 20030828. /../ { dg-do run } /.#include "ffitest.h"..typedef struct cls_struct_5byte {. unsigned short a;. unsigned short b;. unsigned char c;.} cls_struct_5byte;..cls_struct_5byte cls_struct_5byte_fn(struct cls_struct_5byte a1,.... struct cls_struct_5byte a2).{. struct cls_struct_5byte result;.. result.a = a1.a + a2.a;. result.b = a1.b + a2.b;. result.c = a1.c + a2.c;.. printf("%d %d %d %d %d %d: %d %d %d\n", a1.a, a1.b, a1.c,.. a2.a, a2.b, a2.c,.. result.a, result.b, result.c);.. return result;.}..static void.cls_struct_5byte_gn(ffi_cif cif __UNUSED__, void* resp, void** args,... void* userdata __UNUSED__).{.. struct cls_struct_5byte a1, a2;.. a1 = (struct cls_struct_5byte)(args[0]);. a2 = (struct cls_struct_5byte)(args[1]);.. *(cls_struct_5byt

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\cls_64byte.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3920
Entropy (8bit):	5.109452193218014
Encrypted:	false
SSDEEP:	96:Gf9paO20jS1xm4Crg4IWJjM2aUDdn1fyMrZrdD3qKnVYf2lf+2jQH2d8PDCJA61w:0QTWMAZIatkT6oPHhDAA
MD5:	22A1A0B8CDBD5807D180CBBC9FAB0918
SHA1:	A9ED5C63A2C93907E019D46282167C5EA1AC56E3
SHA-256:	B3F1F0B98F82BEDD4AD3279E8CE322C57AE0C76BCB9A3CE4F537E7FE8899CD9E
SHA-512:	4D1D129B7406976DE62693684B377484861996AC2243603B4862EE5DD875EF728CFBB18A7184338201AD134D4B1B004CAACC05A6A50CFB9E7A2EF818B0A4A22A
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check structure passing with different structure size....Depending on the ABI. Check bigger struct which overlaps...the gp and fp register count on Darwin/AIX/ppc64.. Limitations:.none.. PR:..none.. Originator:.<andreast@gcc.gnu.org> 20030828. /../ { dg-do run } */.#include "ffitest.h"..typedef struct cls_struct_64byte {. double a;. double b;. double c;. double d;. double e;. double f;. double g;. double h;.} cls_struct_64byte;..cls_struct_64byte cls_struct_64byte_fn(struct cls_struct_64byte b0,.... struct cls_struct_64byte b1,.... struct cls_struct_64byte b2,.... struct cls_struct_64byte b3).{. struct cls_struct_64byte result;.. result.a = b0.a + b1.a + b2.a + b3.a;. result.b = b0.b + b1.b + b2.b + b3.b;. result.c = b0.c + b1.c + b2.c + b3.c;. result.d = b0.d + b1.d + b2.d + b3.d;. result.e = b0.e + b1.e + b2.e + b3.e;. result.f = b0.f + b1.f + b2.f + b3.f;. result.g = b0.g + b1.g + b2.g + b3.g;. result.h =

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\cls_6_1_byte.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3214
Entropy (8bit):	5.109656003822294
Encrypted:	false
SSDEEP:	96:Gfrg0ZTEZSXTEOYu3FF/8MgR7E1rUUrNBR4gkulf+2jQNaf81heg1bSbWcZpiSNv:XETEZS1FFhPMVtkWPsDgk
MD5:	039B1DE2FA6F45815F082DE8D371CACB
SHA1:	C4CB2AE15C99D63A3E9684688A33DEE8DA2C0275
SHA-256:	6DE6A35961B11D4D0B9E6AE0933C33C68AAF6D3C5094F4B12AFDAAF6AD151045
SHA-512:	E30D0B808F6EE162A81BDCACC5580C32FB2017C7A4A4B64F31AC8D2F6B8AD7CAD3FDF94A873BE7C0FBBD9F97EB8796A4BE979BD3D46E673BDEEB396E2DA4CD60
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check structure passing with different structure size....Depending on the ABI. Check overlapping.. Limitations:.none.. PR:..none.. Originator:.<andreast@gcc.gnu.org> 20050708. /../ { dg-do run } */.#include "ffitest.h"..typedef struct cls_struct_6byte {. unsigned char a;. unsigned char b;. unsigned char c;. unsigned char d;. unsigned char e;. unsigned char f;.} cls_struct_6byte;..cls_struct_6byte cls_struct_6byte_fn(struct cls_struct_6byte a1,.... struct cls_struct_6byte a2).{. struct cls_struct_6byte result;.. result.a = a1.a + a2.a;. result.b = a1.b + a2.b;. result.c = a1.c + a2.c;. result.d = a1.d + a2.d;. result.e = a1.e + a2.e;. result.f = a1.f + a2.f;.. printf("%d %d %d %d %d %d %d %d %d %d %d %d: %d %d %d %d %d %d\n",.. a1.a, a1.b, a1.c, a1.d, a1.e, a1.f,.. a2.a, a2.b, a2.c, a2.d, a2.e, a2.f,.. result.a, result.b, result.c, result.d, result.e, result.f);.. return result;.}..static void.cls_struct_6byte_gn(ffi

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\cls_6byte.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2768
Entropy (8bit):	5.156330586331845
Encrypted:	false
SSDEEP:	48:Gfr0z8P1OnJVEJ0cFEOXIuRZN+fZruMgoYozooNJ/rtrNBuLt4eAU4G4M1f2jQ9q:GfrO80JVEJTEOYu3NK8MgR7E1rtrNB6m
MD5:	797A2DBB2F02D5C380FA202C3183F1CF
SHA1:	454F53813E0FE1F31F737729F79498DA440BEE28
SHA-256:	3838656CC6793783A91E5EEF412A40D9510FFA3DB6B304232C3682BFA64914CD
SHA-512:	3A53BE8F26AEFC346EE043D10A725E322432C339B3D0E07C266433064FECFFC26E43659B995868A0036B79785E231ABFBC5958550695F65A5BA8DA7086F1F9EE
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check structure passing with different structure size....Depending on the ABI. Check overlapping.. Limitations:.none.. PR:..none.. Originator:.<andreast@gcc.gnu.org> 20030828. /.../ { dg-do run } /.#include "ffitest.h"..typedef struct cls_struct_6byte {. unsigned short a;. unsigned short b;. unsigned char c;. unsigned char d;.} cls_struct_6byte;..cls_struct_6byte cls_struct_6byte_fn(struct cls_struct_6byte a1,.... struct cls_struct_6byte a2).{. struct cls_struct_6byte result;.. result.a = a1.a + a2.a;. result.b = a1.b + a2.b;. result.c = a1.c + a2.c;. result.d = a1.d + a2.d;.. printf("%d %d %d %d %d %d %d %d: %d %d %d %d\n", a1.a, a1.b, a1.c, a1.d,.. a2.a, a2.b, a2.c, a2.d,.. result.a, result.b, result.c, result.d);.. return result;.}..static void.cls_struct_6byte_gn(ffi_cif cif __UNUSED__, void* resp, void** args,... void* userdata __UNUSED__).{.. struct cls_struct_6byte a1, a2;.. a1 = (struct cls_struct_6byte

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\cls_7_1_byte.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3406
Entropy (8bit):	5.100571828992291
Encrypted:	false
SSDEEP:	96:Gfrg0CTEZSv+En5rPoF+JeNMVuqHAr4rMBRxOZwlf+2jQNaf81heDf1bSbWcZWOk:XLTEZSvKF+8DMKtkWqzTQP
MD5:	914F440E3C2C9CBD1896E936D435F68C
SHA1:	15411DBB5FB5E4D7680378E6836B7E6412E204CF
SHA-256:	52C5A74ED315D14F7195740F913F72F1B2810DC1E415D090F21388315BB3B03A
SHA-512:	B6D8852155BB18A320479EA18AE559BCF836878383E45BA7F40C0D9F9E8E39B1F620C40712F952DEE152A838F61C5FBA12B9BAA1FD45CA79E41C6BD8DC2CE69C
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check structure passing with different structure size....Depending on the ABI. Check overlapping.. Limitations:.none.. PR:..none.. Originator:.<andreast@gcc.gnu.org> 20050708. /../ { dg-do run } */.#include "ffitest.h"..typedef struct cls_struct_7byte {. unsigned char a;. unsigned char b;. unsigned char c;. unsigned char d;. unsigned char e;. unsigned char f;. unsigned char g;.} cls_struct_7byte;..cls_struct_7byte cls_struct_7byte_fn(struct cls_struct_7byte a1,.... struct cls_struct_7byte a2).{. struct cls_struct_7byte result;.. result.a = a1.a + a2.a;. result.b = a1.b + a2.b;. result.c = a1.c + a2.c;. result.d = a1.d + a2.d;. result.e = a1.e + a2.e;. result.f = a1.f + a2.f;. result.g = a1.g + a2.g;.. printf("%d %d %d %d %d %d %d %d %d %d %d %d %d %d: %d %d %d %d %d %d %d\n",.. a1.a, a1.b, a1.c, a1.d, a1.e, a1.f, a1.g,.. a2.a, a2.b, a2.c, a2.d, a2.e, a2.f, a2.g,.. result.a, result.b, result.c, result.d, result.e, re

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\cls_7byte.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2768
Entropy (8bit):	5.156422577760641
Encrypted:	false
SSDEEP:	48:Gfr0z2P1OgJVEvqFn5kIP8ZN+f0ruMVuxoHs/rtrMBuxZxOnU4G4M1f2jQ9Qf8lh:GfrO20AVEvEn5rPoNKNMVuqHArtrMBMF
MD5:	3CE38C90499F82BF4A34AAECF1EB9886
SHA1:	98F228B5B10C45334CE01C6AD859E6322E7C479A
SHA-256:	5416BDB5AB4BEA12164379A9E69BFEC623DD9C30A992CCF2ED7C2F23DD14E576
SHA-512:	7D3FFE9E2F3C1EAD77D4353804E005206E3355FE56CC50A6C663C85D088572AEF70A88DFF3165AFE40A51F0DCE622245B1EFA0774ADAF89DC68BAF3B457D1BFC
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check structure passing with different structure size....Depending on the ABI. Check overlapping.. Limitations:.none.. PR:..none.. Originator:.<andreast@gcc.gnu.org> 20030828. /../ { dg-do run } /.#include "ffitest.h"..typedef struct cls_struct_7byte {. unsigned short a;. unsigned short b;. unsigned char c;. unsigned short d;.} cls_struct_7byte;..cls_struct_7byte cls_struct_7byte_fn(struct cls_struct_7byte a1,.... struct cls_struct_7byte a2).{. struct cls_struct_7byte result;.. result.a = a1.a + a2.a;. result.b = a1.b + a2.b;. result.c = a1.c + a2.c;. result.d = a1.d + a2.d;.. printf("%d %d %d %d %d %d %d %d: %d %d %d %d\n", a1.a, a1.b, a1.c, a1.d,.. a2.a, a2.b, a2.c, a2.d,.. result.a, result.b, result.c, result.d);.. return result;.}..static void.cls_struct_7byte_gn(ffi_cif cif __UNUSED__, void* resp, void** args,... void* userdata __UNUSED__).{.. struct cls_struct_7byte a1, a2;.. a1 = (struct cls_struct_7byte

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\cls_8byte.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2345
Entropy (8bit):	5.122240656395703
Encrypted:	false
SSDEEP:	48:Gfr0z2P1O+EYL7FOQRIIfZfLfnruMej6oKX/r8r/wi8OU4G4M1f2jQzuNU1bSbWn:GfrO20SpOQSIBfjSMejtKPr8r/wi8Ols
MD5:	9598ABF0C23B0DB23B36C4E9F85A7906
SHA1:	0D1C661631D8220562D44D2A9034B235246AFC37
SHA-256:	87E7104E14E6D8EE0507B09A5FE82450EC80589CD68ABCB9F6080D27E1433E68
SHA-512:	557CC1B31E31A96E6EA6C716385CC965DFEC380DC27B39EE75309FFBACE1D372CB2610BAA7486C82EFC57225E5AAEA2DF5C55903739E0F8FC35E9C562EAFAD46
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check structure passing with different structure size....Depending on the ABI. Check overlapping.. Limitations:.none.. PR:..none.. Originator:.<andreast@gcc.gnu.org> 20030828. /../ { dg-do run } /.#include "ffitest.h"..typedef struct cls_struct_8byte {. int a;. float b;.} cls_struct_8byte;..cls_struct_8byte cls_struct_8byte_fn(struct cls_struct_8byte a1,.... struct cls_struct_8byte a2).{. struct cls_struct_8byte result;.. result.a = a1.a + a2.a;. result.b = a1.b + a2.b;.. printf("%d %g %d %g: %d %g\n", a1.a, a1.b, a2.a, a2.b, result.a, result.b);.. return result;.}..static void.cls_struct_8byte_gn(ffi_cif cif __UNUSED__, void* resp, void** args,... void* userdata __UNUSED__).{.. struct cls_struct_8byte a1, a2;.. a1 = (struct cls_struct_8byte)(args[0]);. a2 = (struct cls_struct_8byte)(args[1]);.. (cls_struct_8byte)resp = cls_struct_8byte_fn(a1, a2);.}..int main (void).{. ffi_cif cif;. void *code;. ffi_closu

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\cls_9byte1.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2447
Entropy (8bit):	5.142002183371645
Encrypted:	false
SSDEEP:	48:GfqJ9C0KP1OIltLIF57Yuir0RyLMyKJjodux/d8oxB3MHfNU4G4M1f2jQzu2U1bI:Gf6oD0+Bi57YukS8MyKJUdutd8oxRMHY
MD5:	DA2CA7E70A5B79C673C5CB2BDA9484DC
SHA1:	7326CCF9D17D4758D9C101F04D7D604EB48288DF
SHA-256:	820AF96CD4D523B50AD43C210B0C8C68334123911D20DC5B2DF0082A3913EFC2
SHA-512:	54D267217C68ED9C6303B351510150A215F8677B002A9B5B4CCD82C11EC260B5ADC876F2F66D8AB2951D2B6B3A895A76A3312C209700B1E5CC4BBB6D093C1610
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check structure passing with different structure size....Depending on the ABI. Darwin/AIX do double-word...alignment of the struct if the first element is a double....Check that it does not here.. Limitations:.none.. PR:..none.. Originator:.<andreast@gcc.gnu.org> 20030914. /../ { dg-do run } /.#include "ffitest.h"..typedef struct cls_struct_9byte {. int a;. double b;.} cls_struct_9byte;..cls_struct_9byte cls_struct_9byte_fn(struct cls_struct_9byte b1,.... struct cls_struct_9byte b2).{. struct cls_struct_9byte result;.. result.a = b1.a + b2.a;. result.b = b1.b + b2.b;.. printf("%d %g %d %g: %d %g\n", b1.a, b1.b, b2.a, b2.b,.. result.a, result.b);.. return result;.}..static void cls_struct_9byte_gn(ffi_cif cif __UNUSED__, void* resp,.....void** args, void* userdata __UNUSED__).{. struct cls_struct_9byte b1, b2;.. b1 = (struct cls_struct_9byte)(args[0]);. b2 = (struct cls_struct_9byte)(args[1]);.. (cls_struct_9byte

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\cls_9byte2.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2444
Entropy (8bit):	5.142667693817905
Encrypted:	false
SSDEEP:	48:GfqJX0KP1OyLIF57Yuir2RyLMyKJjodux/d8oxB3gH3NU4G4M1f2jQHmuU1bSbWu:Gf6XD0ai57YukE8MyKJUdutd8oxRgH3K
MD5:	FCA022A137F79C07B163374CFA8E9A75
SHA1:	B1A45D66A7D045C9617A52FEA7E6206D52EE68D4
SHA-256:	27418B1782A44052688E32178471FCB34EAA7ADA3F7E4CDA0C7070FCC5A58AA1
SHA-512:	3B729D24C6548F04FDD5C6A7A16D5EA50F24828BB028DE4822D667D5AA0436B82064427EFADFC8F0D5B9CACC31EA48523B47ADDF927D4C056C3F434DDAA22F68
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check structure passing with different structure size....Depending on the ABI. Darwin/AIX do double-word...alignment of the struct if the first element is a double....Check that it does here.. Limitations:.none.. PR:..none.. Originator:.<andreast@gcc.gnu.org> 20030914. /../ { dg-do run } /.#include "ffitest.h"..typedef struct cls_struct_9byte {. double a;. int b;.} cls_struct_9byte;..cls_struct_9byte cls_struct_9byte_fn(struct cls_struct_9byte b1,.... struct cls_struct_9byte b2).{. struct cls_struct_9byte result;.. result.a = b1.a + b2.a;. result.b = b1.b + b2.b;.. printf("%g %d %g %d: %g %d\n", b1.a, b1.b, b2.a, b2.b,.. result.a, result.b);.. return result;.}..static void cls_struct_9byte_gn(ffi_cif cif __UNUSED__, void* resp,.....void** args, void* userdata __UNUSED__).{. struct cls_struct_9byte b1, b2;.. b1 = (struct cls_struct_9byte)(args[0]);. b2 = (struct cls_struct_9byte)(args[1]);.. (cls_struct_9byte)res

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\cls_align_double.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2518
Entropy (8bit):	5.1337935949566855
Encrypted:	false
SSDEEP:	48:Gu60/P1OyhCkFlXqIF2ZCHEferuMHkHo5m/r8rStv6JU4G4M1f2jQN2f8q1bSbWK:GN60yhCelX5FOCHE3MHkI5Wr8rStv6JK
MD5:	5E97EC66E6EE3B580620C4F6AD53609F
SHA1:	93EE82E5B371901A1620438C69D06FE704839832
SHA-256:	268E4BA811F97A11054BAF3D1D000F366F57AACA9B6D18FC2C16046C25EE0AF3
SHA-512:	E514DBC81AF6F87DD7C8BACEF5F0A74656638542031FFADA10EDE551033B624FE0B5032E11984C7E0A2BB53AEA2E5698EA7EDCFE6303AF29C213D3958B958247
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check structure alignment of double.. Limitations:.none.. PR:..none.. Originator:.<hos@tamanegi.org> 20031203. /..../ { dg-do run } /.#include "ffitest.h"..typedef struct cls_struct_align {. unsigned char a;. double b;. unsigned char c;.} cls_struct_align;..cls_struct_align cls_struct_align_fn(struct cls_struct_align a1,.... struct cls_struct_align a2).{. struct cls_struct_align result;.. result.a = a1.a + a2.a;. result.b = a1.b + a2.b;. result.c = a1.c + a2.c;.. printf("%d %g %d %d %g %d: %d %g %d\n", a1.a, a1.b, a1.c, a2.a, a2.b, a2.c, result.a, result.b, result.c);.. return result;.}..static void.cls_struct_align_gn(ffi_cif cif __UNUSED__, void* resp, void** args,... void* userdata __UNUSED__).{.. struct cls_struct_align a1, a2;.. a1 = (struct cls_struct_align)(args[0]);. a2 = (struct cls_struct_align)(args[1]);.. (cls_struct_align)resp = cls_struct_align_fn(a1, a2);.}..int main (void).{. ffi_cif cif;.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\cls_align_float.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2553
Entropy (8bit):	5.138871229666529
Encrypted:	false
SSDEEP:	48:Gux0/P1OFCkFlXqIF2ZCDFKmmferuMHkHo5m/r8rStv6JU4G4M1f2jQNNf8q1bSf:GUu0FCelX5FOCBm3MHkI5Wr8rStv6JlB
MD5:	7AA4F52F0A53673EAB4C64B4A26A9BF7
SHA1:	D8C398B90F39B707F1E9BADA84989E56913A4226
SHA-256:	F64C5E349D5AF66F45267B8111A05796F072D9086321F8A87ECB4F031D14869B
SHA-512:	22388658D62EBF0A68200D1E9982E8B1EDAEE26D5463FDE98AF16157BF14F334C8EA76585ADD742B869F03C79F6E6DCC6D95336BABAFC2DC24A3E623FAA5E7D4
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check structure alignment of float.. Limitations:.none.. PR:..none.. Originator:.<hos@tamanegi.org> 20031203. /../ { dg-do run } /.#include "ffitest.h"..typedef struct cls_struct_align {. unsigned char a;. float b;. unsigned char c;.} cls_struct_align;..cls_struct_align cls_struct_align_fn(struct cls_struct_align a1,.... struct cls_struct_align a2).{. struct cls_struct_align result;.. result.a = a1.a + a2.a;. result.b = a1.b + a2.b;. result.c = a1.c + a2.c;.. printf("%d %g %d %d %g %d: %d %g %d\n", a1.a, (double)a1.b, a1.c, a2.a, (double)a2.b, a2.c, result.a, (double)result.b, result.c);.. return result;.}..static void.cls_struct_align_gn(ffi_cif cif __UNUSED__, void* resp, void** args,... void* userdata __UNUSED__).{.. struct cls_struct_align a1, a2;.. a1 = (struct cls_struct_align)(args[0]);. a2 = (struct cls_struct_align)(args[1]);.. (cls_struct_align)resp = cls_struct_align_fn(a1, a2);.}..int main (void

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\cls_align_longdouble.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2571
Entropy (8bit):	5.139437820427393
Encrypted:	false
SSDEEP:	48:Guc0/PdO0hCkFlXqIF2ZCDFKmmferuMHkHo5m/r8rStv6JU4G4M1f2jQNkf8q1bE:G5uc0hCelX5FOCBm3MHkI5Wr8rStv6Js
MD5:	1B30687B91C78C5C1506391194B1722E
SHA1:	2A4A3BDE67E7709628FE11DC0CA3C06692868AEB
SHA-256:	30D0133250F8CDC9C689B55D16815BD08C5D5A2E61E247A47CA012C743203179
SHA-512:	B03C05DFA6EF78340D0CE650389E9D4F779387440638CF9E94DC6995DEB3F59671E072FBF80A3EE293DED76A3B062FCDD2541514696C67FA90FDA58049330219
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check structure alignment of long double.. Limitations:.none.. PR:..none.. Originator:.<hos@tamanegi.org> 20031203. /../ { dg-do run } /..#include "ffitest.h"..typedef struct cls_struct_align {. unsigned char a;. long double b;. unsigned char c;.} cls_struct_align;..cls_struct_align cls_struct_align_fn(struct cls_struct_align a1,.... struct cls_struct_align a2).{. struct cls_struct_align result;.. result.a = a1.a + a2.a;. result.b = a1.b + a2.b;. result.c = a1.c + a2.c;.. printf("%d %g %d %d %g %d: %d %g %d\n", a1.a, (double)a1.b, a1.c, a2.a, (double)a2.b, a2.c, result.a, (double)result.b, result.c);.. return result;.}..static void.cls_struct_align_gn(ffi_cif cif __UNUSED__, void* resp, void** args,... void* userdata __UNUSED__).{.. struct cls_struct_align a1, a2;.. a1 = (struct cls_struct_align)(args[0]);. a2 = (struct cls_struct_align)(args[1]);.. (cls_struct_align)resp = cls_struct_align_fn(a1, a2);.}..i

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.call\cls_align_longdouble_split.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3754
Entropy (8bit):	5.244728905147393
Encrypted:	false
SSDEEP:	96:G56QvCP6KelvLJMqatZZZZZZZZZZZvZZZZiacl3tAAb1tZZZZvZZZZiq3jW935o5:vQvC3q1lJb1cXl2wU4n2
MD5:	AFBD432C3ABA67983397583F91E4C22C
SHA1:	B8D03FF22476D7F2C1B6B6F23E4FC75BBEE09B4D
SHA-256:	467EEB7F522FC81E2F453F9103DA08F746F43452FD1906E81DEB64EEFD3733B1
SHA-512:	C8294546305252499F79D4065AB7BDCA878DD5DEA637E780F004C1F2565D1C96C0FF86BF09EB35562B29E8A782F6B8D83FD8E63B7D491FC5AB42CA87D525720F
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check structure alignment of long double.. Limitations:.none.. PR:..none.. Originator:.<hos@tamanegi.org> 20031203. /../ { dg-excess-errors "no long double format" { xfail x86_64--mingw x86_64--cygwin } } /./ { dg-do run { xfail strongarm--* xscale--* } } /./ { dg-options -mlong-double-128 { target powerpc64--linux* } } /./ { dg-output "" { xfail x86_64--mingw x86_64--cygwin } } */..#include "ffitest.h"..typedef struct cls_struct_align {. long double a;. long double b;. long double c;. long double d;. long double e;. long double f;. long double g;.} cls_struct_align;..cls_struct_align cls_struct_align_fn(..cls_struct_align.a1,..cls_struct_align.a2).{..struct cls_struct_align r;...r.a = a1.a + a2.a;..r.b = a1.b + a2.b;..r.c = a1.c + a2.c;..r.d = a1.d + a2.d;..r.e = a1.e + a2.e;..r.f = a1.f + a2.f;..r.g = a1.g + a2.g;...printf("%Lg %Lg %Lg %Lg %Lg %Lg %Lg %Lg %Lg %Lg %Lg %Lg %Lg %Lg: "..."%Lg %Lg %Lg %Lg %Lg %

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.closures\stret_large.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4706
Entropy (8bit):	5.244430765799754
Encrypted:	false
SSDEEP:	96:oM97aDjb0Oj1N97wcvzJsDQgM6QWwU2jjelo8mypsz2dZijWKPS1mWku0UzLovvF:T0vLbWxUlkkjjH+a
MD5:	1D71DE28E244CA7911E151D4D81099BA
SHA1:	31C1646B0104B388E1195169B7CA624693EAAF88
SHA-256:	D711E83FDF28845C031AD3C349610D6D0E87D0711CD0D05F1A53422003D18AEB
SHA-512:	AAABE2E31B3FE8D5ADCB0B69C587DD4D3B26AEEBB05FC8227CF1800EAC7D4BD421B82D313345B3A3C51727970458A4063D73A1BBDAAA69B61A5869C3ECA12363
Malicious:	false
Preview:	/* Area:..ffi_call, closure_call. Purpose:..Check structure returning with different structure size......Depending on the ABI. Check bigger struct which overlaps.....the gp and fp register count on Darwin/AIX/ppc64.. Limitations:.none.. PR:...none.. Originator:.Blake Chaffin.6/21/2007./../ { dg-do run { xfail strongarm--* xscale--* } } /.#include "ffitest.h"../ 13 FPRs: 104 bytes /./ 14 FPRs: 112 bytes */..typedef struct struct_108byte {..double a;..double b;..double c;..double d;..double e;..double f;..double g;..double h;..double i;..double j;..double k;..double l;..double m;..int n;.} struct_108byte;..struct_108byte cls_struct_108byte_fn(..struct_108byte b0,..struct_108byte b1,..struct_108byte b2,..struct_108byte b3).{..struct_108byte.result;...result.a = b0.a + b1.a + b2.a + b3.a;..result.b = b0.b + b1.b + b2.b + b3.b;..result.c = b0.c + b1.c + b2.c + b3.c;..result.d = b0.d + b1.d + b2.d + b3.d;..result.e = b0.e + b1.e + b2.e + b3.e;..result.f = b0.f + b1.f + b2.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.closures\stret_large2.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4872
Entropy (8bit):	5.231030382760173
Encrypted:	false
SSDEEP:	96:oM97aD8oOj1N9SbfGzErDqdYlQWwU2jjelo8mypsz2dZijc3DPS1mWkuHUf5pfcv:T0GbeXAlkFjjDc9+qDH
MD5:	B6B4E24F5AFBAF7409816B6AFA5FC677
SHA1:	0F88D764929E3187E2288C07B28FC5C31913AAF5
SHA-256:	730C5FC454E296748557D7F90FFBD090CADE6B6F9E02FC2DF7760F9130A63805
SHA-512:	0A3667EEABA86BCDE7D3DC17AD581B4F8F49A9615D17F9026EDEEE4D42DE3274D000A76FEAFE8765FEDEBF348222DAD17249E1BECEF40D87EF1EADB6E024AE27
Malicious:	false
Preview:	/* Area:..ffi_call, closure_call. Purpose:..Check structure returning with different structure size......Depending on the ABI. Check bigger struct which overlaps.....the gp and fp register count on Darwin/AIX/ppc64.. Limitations:.none.. PR:...none.. Originator:.Blake Chaffin.6/21/2007./../ { dg-do run { xfail strongarm--* xscale--* } } /.#include "ffitest.h"../ 13 FPRs: 104 bytes /./ 14 FPRs: 112 bytes */..typedef struct struct_116byte {..double a;..double b;..double c;..double d;..double e;..double f;..double g;..double h;..double i;..double j;..double k;..double l;..double m;..double n;..int o;.} struct_116byte;..struct_116byte cls_struct_116byte_fn(..struct_116byte b0,..struct_116byte b1,..struct_116byte b2,..struct_116byte b3).{..struct_116byte.result;...result.a = b0.a + b1.a + b2.a + b3.a;..result.b = b0.b + b1.b + b2.b + b3.b;..result.c = b0.c + b1.c + b2.c + b3.c;..result.d = b0.d + b1.d + b2.d + b3.d;..result.e = b0.e + b1.e + b2.e + b3.e;..result.f = b0.f +

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.closures\stret_medium.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3805
Entropy (8bit):	5.253217784327093
Encrypted:	false
SSDEEP:	96:oM97aD/tfIjiXY6fzzmEDRu9rQWwU2jjelo8mypsz2yPS1mWkuf4UxmDvJ+8xmq:T0Sj4ZlkQjnh+8
MD5:	890C6B3EF3B120573377B37DC90FE592
SHA1:	28CE9C6A4F7256EB64ECC4515991E55576053784
SHA-256:	1883FD43D17FF1286B050BD721AC8CB82110977A58EC98DA4C6B4F50AD64AE56
SHA-512:	061A91C4A115235747FAD983F7CAF6F8909EEE3EA930175E7AD24AB1670A367958C9AE53F5E06C48DB68DDFE3E2953B7F90D0655F147EBD448F7CF475A37EB53
Malicious:	false
Preview:	/* Area:..ffi_call, closure_call. Purpose:..Check structure returning with different structure size......Depending on the ABI. Check bigger struct which overlaps.....the gp and fp register count on Darwin/AIX/ppc64.. Limitations:.none.. PR:...none.. Originator:.Blake Chaffin.6/21/2007./../ { dg-do run { xfail strongarm--* xscale--* } } */.#include "ffitest.h"..typedef struct struct_72byte {..double a;..double b;..double c;..double d;..double e;..double f;..double g;..double h;..double i;.} struct_72byte;..struct_72byte cls_struct_72byte_fn(..struct_72byte b0,..struct_72byte b1,..struct_72byte b2,..struct_72byte b3).{..struct_72byte.result;...result.a = b0.a + b1.a + b2.a + b3.a;..result.b = b0.b + b1.b + b2.b + b3.b;..result.c = b0.c + b1.c + b2.c + b3.c;..result.d = b0.d + b1.d + b2.d + b3.d;..result.e = b0.e + b1.e + b2.e + b3.e;..result.f = b0.f + b1.f + b2.f + b3.f;..result.g = b0.g + b1.g + b2.g + b3.g;..result.h = b0.h + b1.h + b2.h + b3.h;..result.i = b0.i + b1.i

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.closures\stret_medium2.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3889
Entropy (8bit):	5.280450695269787
Encrypted:	false
SSDEEP:	96:oM97aDFYfIjUXY6fzzmEDX4TNQWwU2jjelo8mypszfyPS1mWkuf4U5mDvJ+85mq:T0DR4hlkVjZh+q
MD5:	CB7F47822BEC926E1FAAA1722587049E
SHA1:	00458E032EE064270FC5C9F56A6E574C42D4D180
SHA-256:	A2FDEF84FD9FA07A11BBF6A5A092199B0AAEB0E357697F0F9C7A6734D3CBA89E
SHA-512:	0059EB80AC643B76D45108A24E5908FCE198090F6D0B1DA17AC8AE1A6DACC07A13963B9127965E9E6D27CA532C7FE36F35D62D71BCD7F999C896067582EE569A
Malicious:	false
Preview:	/* Area:..ffi_call, closure_call. Purpose:..Check structure returning with different structure size......Depending on the ABI. Check bigger struct which overlaps.....the gp and fp register count on Darwin/AIX/ppc64.. Limitations:.none.. PR:...none.. Originator:.Blake Chaffin.6/21/2007./../ { dg-do run { xfail strongarm--* xscale--* } } /./ { dg-options "-Wno-format" { target alpha-dec-osf } } */.#include "ffitest.h"..typedef struct struct_72byte {..double a;..double b;..double c;..double d;..double e;..double f;..double g;..double h;..long long i;.} struct_72byte;..struct_72byte cls_struct_72byte_fn(..struct_72byte b0,..struct_72byte b1,..struct_72byte b2,..struct_72byte b3).{..struct_72byte.result;...result.a = b0.a + b1.a + b2.a + b3.a;..result.b = b0.b + b1.b + b2.b + b3.b;..result.c = b0.c + b1.c + b2.c + b3.c;..result.d = b0.d + b1.d + b2.d + b3.d;..result.e = b0.e + b1.e + b2.e + b3.e;..result.f = b0.f + b1.f + b2.f + b3.f;..result.g = b0.g + b1.g + b2.g + b3.g

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.closures\testclosure.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1661
Entropy (8bit):	5.143753862006731
Encrypted:	false
SSDEEP:	48:sFU0rOP1OtD/W3r6X0GDD+syu0uy/9JFys64k4+1fojMiBkDsH11Txbv5l3:TMO0pW3qXyudK9JFysrVYojMiBkDq11B
MD5:	21E881D3E7941AC27718B1C92F315203
SHA1:	9EF3BD65E284146D3C7FFE02AF9822CD24915143
SHA-256:	28F962FE035EC5EBB52F9BCCBD526F4FDA777DC9C3874FC17E34064FD006DEB2
SHA-512:	19CE07C932073821261C7D56C7BF3D123ED0E038C10D6592EE9BA964B2C35990B746E6A5B67E9414D8033122EADFC304E1713A5CBF298733A5F3FB51E7434B7F
Malicious:	false
Preview:	/* Area:.closure_call. Purpose:.Check return value float.. Limitations:.none.. PR:..41908.. Originator:.<rfm@gnu.org> 20091102. /../ { dg-do run } /.#include "ffitest.h"..typedef struct cls_struct_combined {. float a;. float b;. float c;. float d;.} cls_struct_combined;..void cls_struct_combined_fn(struct cls_struct_combined arg).{. printf("%g %g %g %g\n",.. arg.a, arg.b,.. arg.c, arg.d);. fflush(stdout);.}..static void.cls_struct_combined_gn(ffi_cif cif __UNUSED__, void* resp __UNUSED__,. void** args, void* userdata __UNUSED__).{. struct cls_struct_combined a0;.. a0 = (struct cls_struct_combined)(args[0]);.. cls_struct_combined_fn(a0);.}...int main (void).{. ffi_cif cif;. void code;. ffi_closure pcl = ffi_closure_alloc(sizeof(ffi_closure), &code);. ffi_type* cls_struct_fields0[5];. ffi_type cls_struct_type0;. ffi_type* dbl_arg_types[5];.. struct cls_struct_combined g_dbl = {4.0, 5.0, 1.0, 8.0};.. cls_struct_type0.size = 0;. cls_struct_type0.ali

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\cls_align_complex.inc

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2581
Entropy (8bit):	5.181943297827648
Encrypted:	false
SSDEEP:	48:hOBCkFla6F2ZCUTNferuMHkHo5m/88ACKWU4G4M1f2jQNNf8HcScWc8Enb+dBGvi:oBCela6FOC653MHkI5W88ACKWlf+2jQm
MD5:	56663DCBFCF718FA8ED640FE9FE6BD79
SHA1:	B74C315AC77222B0D46A6357FD242203ABDB7DF8
SHA-256:	8F16FA6B099B91B9EE9B17CE48764C9316A21E0AC6F0D4C558F38B786046EC2C
SHA-512:	2604E18F7D84D6548ED543C904606CEE291DDFBD93A23F7B28C4327B7E4A52F7B4C7AE03949D8D21F95FAE5F896A90557E3074DAAB82BED16F29DDF3869E86EE
Malicious:	false
Preview:	/* --c-- /.#include "ffitest.h".#include <complex.h>..typedef struct cls_struct_align {. unsigned char a;. _Complex T_C_TYPE b;. unsigned char c;.} cls_struct_align;..cls_struct_align cls_struct_align_fn(..struct cls_struct_align a1, struct cls_struct_align a2).{. struct cls_struct_align result;.. result.a = a1.a + a2.a;. result.b = a1.b + a2.b;. result.c = a1.c + a2.c;.. printf("%d %f,%fi %d %d %f,%fi %d: %d %f,%fi %d\n",.. a1.a, T_CONV creal (a1.b), T_CONV cimag (a1.b), a1.c,.. a2.a, T_CONV creal (a2.b), T_CONV cimag (a2.b), a2.c,.. result.a, T_CONV creal (result.b), T_CONV cimag (result.b), result.c);.. return result;.}..static void.cls_struct_align_gn(ffi_cif cif __UNUSED__, void* resp, void** args,... void* userdata __UNUSED__).{.. struct cls_struct_align a1, a2;.. a1 = (struct cls_struct_align)(args[0]);. a2 = (struct cls_struct_align)(args[1]);.. (cls_struct_align)resp = cls_struct_align_fn(a1, a2);.}..int main (void).{. ffi_cif cif;. void *code;. f

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\cls_align_complex_double.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	254
Entropy (8bit):	4.863749611698213
Encrypted:	false
SSDEEP:	6:UmfJbN8QZiQPhAJA0KLfXDnSKhDKv7PZAkTo2Qg+IAkJDz:UINSuWO0q7SKhaPZAv2UIAAH
MD5:	B63238FC419BED697485033AC08FAA86
SHA1:	212BA7EB008FA8CA11F7725124B56AE94BCABAFE
SHA-256:	1D7B390C946DD82D5B589878CD7DBCD51D4745AA7DD6B911200E86023D25447F
SHA-512:	8AA4B1ED85B780F57DF9662C018A9D03BC78801294740221131AE1E93385F0A4DA6F197BB21F4F6E30790EE3041BB57F1E11EB0B4724FCDD739A6108662D7FB4
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check structure alignment of complex.. Limitations:.none.. PR:..none.. Originator:.<vogt@linux.vnet.ibm.com>. /../ { dg-do run } */..#include "complex_defs_double.inc".#include "cls_align_complex.inc".

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\cls_align_complex_float.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	253
Entropy (8bit):	4.8589031023897435
Encrypted:	false
SSDEEP:	6:UmfJbN8QZiQPhAJA0KLfXDnSKhDKv7PZAkToWIAkJDz:UINSuWO0q7SKhaPZAvWIAAH
MD5:	CFCC4CAE5FF02AA7B0CA6687C3CA3B22
SHA1:	42CBB41061A9C98744426D49348EA83B0689AC35
SHA-256:	E731E5E97859D92DDB3B35B40F19B29C728A7A6785F62276D4C77F17CBC3931F
SHA-512:	246D5B6BE7ADFEE5F87931A78EA34484049CBD8153EDF339A28B313225C72CA15746CF91551716F26EBD8AB2670FCFBFED119F3CD3006DD36C54E4878F2C2998
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check structure alignment of complex.. Limitations:.none.. PR:..none.. Originator:.<vogt@linux.vnet.ibm.com>. /../ { dg-do run } */..#include "complex_defs_float.inc".#include "cls_align_complex.inc".

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\cls_align_complex_longdouble.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	258
Entropy (8bit):	4.856895693442156
Encrypted:	false
SSDEEP:	6:UmfJbN8QZiQPhAJA0KLfXDnSKhDKv7PZAkToe9F+IAkJDz:UINSuWO0q7SKhaPZAveSIAAH
MD5:	1E0E5E742D7D6CCA42295FEF3FF2E4BD
SHA1:	1A3A2F273DC92CE2CB5A7828B31A0F2F5770027B
SHA-256:	529249C43E55C62FE05419AEDE98FDA5D37760E1E8A758B46CC4F419F44D29D9
SHA-512:	8A4239631C44DE67EF1C20D2773DDE3C95415F3D2B49844B4AB471D5F902F430D9CD8BD0880041B1746B57EED5CB3805E0DEBFD0F2AFBE78F035018338F044B8
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check structure alignment of complex.. Limitations:.none.. PR:..none.. Originator:.<vogt@linux.vnet.ibm.com>. /../ { dg-do run } */..#include "complex_defs_longdouble.inc".#include "cls_align_complex.inc".

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\cls_complex.inc

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1127
Entropy (8bit):	5.283060227971259
Encrypted:	false
SSDEEP:	24:YzfOruMCY+4EZk5sD/JXeMsxMFbJjYA4HZ4nb:HruMCY+s0/EB0bJjg2
MD5:	87789347AF217EA9BF210827C1347DBD
SHA1:	C4B26B39ABD6BCCA1D89C9C87D7C9363C213C040
SHA-256:	7D39F073DA37E5DC888AF4EAB0903225A8406AC2CA2DFED426C10B2B76CA9D82
SHA-512:	C995D8B5992DD61917CB53C60166F7414BD1EA6DD7E70C20002F91496C2A9BD83ED7785FD38CC80D3F77B2378C99D2E4878437193E75F577796F992C18D85AD7
Malicious:	false
Preview:	/* --c-- /.#include "ffitest.h".#include <complex.h>..static void cls_ret_complex_fn(ffi_cif cif __UNUSED__, void* resp, void** args,.... void* userdata __UNUSED__). {. _Complex T_C_TYPE pa;. _Complex T_C_TYPE pr;. pa = (_Complex T_C_TYPE )args[0];. pr = (_Complex T_C_TYPE )resp;. pr = pa;.. printf("%.6f,%.6fi: %.6f,%.6fi\n",.. T_CONV creal (pa), T_CONV cimag (pa),.. T_CONV creal (pr), T_CONV cimag (pr));. }.typedef _Complex T_C_TYPE (cls_ret_complex)(_Complex T_C_TYPE);..int main (void).{. ffi_cif cif;. void code;. ffi_closure pcl = ffi_closure_alloc(sizeof(ffi_closure), &code);. ffi_type cl_arg_types[2];. _Complex T_C_TYPE res;.. cl_arg_types[0] = &T_FFI_TYPE;. cl_arg_types[1] = NULL;.. /* Initialize the cif /. CHECK(ffi_prep_cif(&cif, FFI_DEFAULT_ABI, 1,... &T_FFI_TYPE, cl_arg_types) == FFI_OK);.. CHECK(ffi_prep_closure_loc(pcl, &cif, cls_ret_complex_fn, NULL, code) == FFI_OK);.. res = (((cls_ret_complex)code))(0.125 + 128.0 *

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\cls_complex_double.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.849321307010764
Encrypted:	false
SSDEEP:	6:UmfEHzQZtAHVoOJA0KLfXDnSKhDKv7PZAkTo2Qg+IAkJ9z:UrFVZO0q7SKhaPZAv2UIAAx
MD5:	4486F664A3B4F186624689AAB3B31C72
SHA1:	07AE4089C97931BFAA1868BD6634CB96F3FA116F
SHA-256:	9363097EA0942D1E187191045E370D1A7CE38F9EF7507AD97685256D239DAC0E
SHA-512:	2E06C723A6D460082D4282D6435A14A8E313B6DFE1339922AA8A5058F0C3BEAA8FACBB69809AC034BA66FD4522798C5863A31D4CE42DAD73F02BF9F6203A197B
Malicious:	false
Preview:	/* Area:.closure_call. Purpose:.Check return value complex.. Limitations:.none.. PR:..none.. Originator:.<vogt@linux.vnet.ibm.com>. /../ { dg-do run } */..#include "complex_defs_double.inc".#include "cls_complex.inc".

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\cls_complex_float.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	227
Entropy (8bit):	4.855317612390781
Encrypted:	false
SSDEEP:	6:UmfEHzQZtAHVoOJA0KLfXDnSKhDKv7PZAkToWIAkJ9z:UrFVZO0q7SKhaPZAvWIAAx
MD5:	E5BCF8561F45E80023309EC081F44A01
SHA1:	849267A84A729B5F6A1EBEBB14664A4F8202FB11
SHA-256:	C5840699A27C6A00AF3A8166843401FD7E331EAA3E95EA8C894D49C7CDE6A956
SHA-512:	BA28AF3F3E4E920B6C90DA459E654B52D75EBC2E1EF7E6F6C9A0201FC44C0B9263410C4EB08112F59D79309D7FAB6911730A0956B75F223A51D13573698E5A8F
Malicious:	false
Preview:	/* Area:.closure_call. Purpose:.Check return value complex.. Limitations:.none.. PR:..none.. Originator:.<vogt@linux.vnet.ibm.com>. /../ { dg-do run } */..#include "complex_defs_float.inc".#include "cls_complex.inc".

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\cls_complex_longdouble.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	232
Entropy (8bit):	4.844693983686116
Encrypted:	false
SSDEEP:	6:UmfEHzQZtAHVoOJA0KLfXDnSKhDKv7PZAkToe9F+IAkJ9z:UrFVZO0q7SKhaPZAveSIAAx
MD5:	72C963B921B58ECE24AF8922D71E2656
SHA1:	359DACB9F43531FA0431C00CB678D806381B55FE
SHA-256:	7CB2CF513C87F7EC84AC1004D71F5FB1EADE769550C8966992AD0AD7881E1133
SHA-512:	96986D39393CADC0D1A17FBE882932401B3AF649FEE68B53DDA9158E32CB59C6F1C3B3A4C610B0DDF4557916F443B7308FED8A21F92F369DF3959EC96119155A
Malicious:	false
Preview:	/* Area:.closure_call. Purpose:.Check return value complex.. Limitations:.none.. PR:..none.. Originator:.<vogt@linux.vnet.ibm.com>. /../ { dg-do run } */..#include "complex_defs_longdouble.inc".#include "cls_complex.inc".

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\cls_complex_struct.inc

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1551
Entropy (8bit):	5.284113279620573
Encrypted:	false
SSDEEP:	24:YzfyxxqacbvFxv65VawmAcFpdXV1uvrhID6MsxMJbhzg3Nc0FmEtA0FmEN:hkFk3awmAcFzXV1uvrhID6BGbhc35
MD5:	DB50DE8B56E9866C112223AA13DA5FE0
SHA1:	A378643CAB100A7055139049C33935F2E4CABF01
SHA-256:	80EF750DFC3444B703E1A36DAEACB3FB00E8FA99B32273790D71A9A26B733260
SHA-512:	C15CF762190E28DE069373FC13AA8F52F595CA0F35E6B8AF25C506C30726628D0CB6BA621F74E10B5A9A63953BF46AF7B06B54175BE95E4AE4F92CF95523AF9C
Malicious:	false
Preview:	/* --c-- /.#include "ffitest.h".#include <complex.h>..typedef struct Cs {. _Complex T_C_TYPE x;. _Complex T_C_TYPE y;.} Cs;..Cs gc;..void.closure_test_fn(Cs p).{. printf("%.1f,%.1fi %.1f,%.1fi\n",.. T_CONV creal (p.x), T_CONV cimag (p.x),.. T_CONV creal (p.y), T_CONV cimag (p.y));. gc = p;.}..void.closure_test_gn(ffi_cif cif __UNUSED__, void* resp __UNUSED__,...void** args, void* userdata __UNUSED__).{. closure_test_fn((Cs)args[0]);.}..int main(int argc __UNUSED__, char** argv __UNUSED__).{. ffi_cif cif;.. void code;. ffi_closure pcl = ffi_closure_alloc(sizeof(ffi_closure), &code);. ffi_type cl_arg_types[1];.. ffi_type ts1_type;. ffi_type ts1_type_elements[4];.. Cs arg = { 1.0 + 11.0 * I, 2.0 + 22.0 * I};.. ts1_type.size = 0;. ts1_type.alignment = 0;. ts1_type.type = FFI_TYPE_STRUCT;. ts1_type.elements = ts1_type_elements;.. ts1_type_elements[0] = &T_FFI_TYPE;. ts1_type_elements[1] = &T_FFI_TYPE;. ts1_type_elements[2] = NULL;.. cl_arg_types[0] = &ts1_type;

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\cls_complex_struct_double.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	253
Entropy (8bit):	4.869119587729195
Encrypted:	false
SSDEEP:	6:UmfJbN8QZwAeW0KLfXDnSKhDKv7PZAkTo2Qg+IAkJ99:UINgAJ0q7SKhaPZAv2UIAA3
MD5:	021CB7B9297C4F1A378B4C2EA16F42A5
SHA1:	7275E6BC9B8161FB57714E55FB0D3675CFD0E449
SHA-256:	BB6B3F66A0ADDDE784A52F1AA83DCA918CD1083CEA5769BF9D24E86A4CCBE537
SHA-512:	3D387561916AA34233FE54BF9F40FFB866A1942D0F1B7CE7D798C9FBC7D7E8A688640ACBC7DA36BCFC054CFA834A783027A3E423AF5E4B80E4DBE1507BA90991
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check complex arguments in structs.. Limitations:.none.. PR:..none.. Originator:.<vogt@linux.vnet.ibm.com>. /../ { dg-do run } */..#include "complex_defs_double.inc".#include "cls_complex_struct.inc".

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\cls_complex_struct_float.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	252
Entropy (8bit):	4.865609578201823
Encrypted:	false
SSDEEP:	6:UmfJbN8QZwAeW0KLfXDnSKhDKv7PZAkToWIAkJ99:UINgAJ0q7SKhaPZAvWIAA3
MD5:	F1317C8BB16F2B5695EF0EC7ECAB5E0F
SHA1:	4404F8C2E40C69EC259DC8676EF1587974686E19
SHA-256:	A98BD896A8B5CFEF33FBBA595E1FE9BE5FB6AD72918809D13F43181762E1CC74
SHA-512:	EC111B695EE48B45F6EEE9254284364A5B0003569320D825D4F1BD1419F13CB4579A37F2D9E83720EB5FCE44651966D7B63D9DD979A9AEC756FC3CCF121DA776
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check complex arguments in structs.. Limitations:.none.. PR:..none.. Originator:.<vogt@linux.vnet.ibm.com>. /../ { dg-do run } */..#include "complex_defs_float.inc".#include "cls_complex_struct.inc".

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\cls_complex_struct_longdouble.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.864726084647469
Encrypted:	false
SSDEEP:	6:UmfJbN8QZwAeW0KLfXDnSKhDKv7PZAkToe9F+IAkJ99:UINgAJ0q7SKhaPZAveSIAA3
MD5:	36F8C42C9D2D81BED98FC4F32A5BD029
SHA1:	8D08E7E0AB35149935D3627D3124D325F453469E
SHA-256:	371418E03F4FE162D484866662DF75E4BDCEEBCC1189925C85C21F7D39386CED
SHA-512:	3D6F60561EE1CE5ED8D6BD3B30EEC095D6DAD3940F640D7371BE8759CC930C26466F92A25F12E089BB52771C76ACD0F269D3FDA36D75D0D1EAAFE35483E8EEAD
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Check complex arguments in structs.. Limitations:.none.. PR:..none.. Originator:.<vogt@linux.vnet.ibm.com>. /../ { dg-do run } */..#include "complex_defs_longdouble.inc".#include "cls_complex_struct.inc".

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\cls_complex_va.inc

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2053
Entropy (8bit):	5.335407167817569
Encrypted:	false
SSDEEP:	48:a2rVP1tVst6cEELh/DWbz2M/ELMA9rJELX:aq1jsMa9DWbnaMqYX
MD5:	5D6BABAC4C99EB0ED4704C3B418FAD17
SHA1:	4CF65FC346BA17261D882C38A93B85682121E6C1
SHA-256:	4275E6E4AB6A7567B5918F459CB2ABB38F5C0859F288C0A2973AEC405590127A
SHA-512:	D363E17975A65BC164E47C3CA2846BA51A319905947B46080AE15B39EF48CA718594889D6EC151B16B32FFF2A42B6E9377F9AACD9588446D6752FC92E967AF05
Malicious:	false
Preview:	/* --c-- /.#include "ffitest.h".#include <stdio.h>.#include <stdlib.h>.#include <stdarg.h>.#include <complex.h>..static _Complex T_C_TYPE gComplexValue1 = 1 + 2 I;.static _Complex T_C_TYPE gComplexValue2 = 3 + 4 * I;..static int cls_variadic(const char format, ...).{. va_list ap;. _Complex T_C_TYPE p1, p2;.. va_start (ap, format);. p1 = va_arg (ap, _Complex T_C_TYPE);. p2 = va_arg (ap, _Complex T_C_TYPE);. va_end (ap);.. return printf(format, T_CONV creal (p1), T_CONV cimag (p1),...T_CONV creal (p2), T_CONV cimag (p2));.}..static void.cls_complex_va_fn(ffi_cif cif __UNUSED__, void* resp,... void** args, void* userdata __UNUSED__).{. char.format = (char*)args[0];. gComplexValue1 = (_Complex T_C_TYPE)args[1];. gComplexValue2 = (_Complex T_C_TYPE)args[2];.. (ffi_arg*)resp =. printf(format,.. T_CONV creal (gComplexValue1), T_CONV cimag (gComplexValue1),.. T_CONV creal (gComplexValue2), T_CONV cimag (gComplexValue2));.}..int main (void).{. ffi_cif cif;. v

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\cls_complex_va_double.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	262
Entropy (8bit):	4.855780241853905
Encrypted:	false
SSDEEP:	6:UmfJbN8as88HxuI0KLfXDnSKhDKv7PZAkTo2Qg+IAkJ91P:UINds88Hxv0q7SKhaPZAv2UIAAn
MD5:	A9518AD7E57AE1CC802A45D96AC7698D
SHA1:	C12523789AEF79DA23D8E64D4D6230C65E82C53A
SHA-256:	023B67DFBCF760A4CB063DA0B027A5995166665CA5487548499275907DBC2298
SHA-512:	0D54792B98E29DE74978733676162AC0073734D0DD116FA9FCEDF8A13CBB64F82E4D623A806B6D0C3497627A32AAFDB52CEFA6F7E5A1A58909D0C5B2941FE181
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Test complex' passed in variable argument lists.. Limitations:.none.. PR:..none.. Originator:.<vogt@linux.vnet.ibm.com>. /../ { dg-do run } */..#include "complex_defs_double.inc".#include "cls_complex_va.inc".

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\cls_complex_va_float.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	538
Entropy (8bit):	4.788624941192275
Encrypted:	false
SSDEEP:	12:UINds88Hxv0q7SKhaP8AcK4ZFIkDuzXZAvWIAAn:rd18H90NP8P7ZnGpczn
MD5:	F8835658C8195C00738B8B534C61D3A0
SHA1:	C40DA74964012F651CF2FBCB538909C1065561EA
SHA-256:	6C1875B8EF67B48471E6ABFA9F37D2D63A4AAA5225DFD2D515CABFD96C3011E6
SHA-512:	AB45D8545A14423B1349EAB3B00D625A87492EFA38CBD450BBAD0A388B71DEA3E93E1F63CBFF8CB8030FC28B2B08F737ABAA1EDF165CCD97D9F05661167F1AAD
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Test complex' passed in variable argument lists.. Limitations:.none.. PR:..none.. Originator:.<vogt@linux.vnet.ibm.com>. /../ { dg-do run } /../ Alpha splits _Complex into two arguments. It's illegal to pass. float through varargs, so _Complex float goes badly. In sort of. gets passed as _Complex double, but the compiler doesn't agree. with itself on this issue. /./ { dg-do run { xfail alpha--* } } */..#include "complex_defs_float.inc".#include "cls_complex_va.inc".

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\cls_complex_va_longdouble.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	266
Entropy (8bit):	4.851738908372457
Encrypted:	false
SSDEEP:	6:UmfJbN8as88HxuI0KLfXDnSKhDKv7PZAkToe9F+IAkJ91P:UINds88Hxv0q7SKhaPZAveSIAAn
MD5:	6D1FE6B62FFFFCD611CBC3E3838826F4
SHA1:	9CECE6EF551F86DA1F9DF3AC57273F8C0DFAED01
SHA-256:	1BD7DE83D4C0A80AA3DC2631A57909CF0290D8A5DC3677A174938736EDE1C614
SHA-512:	26168FB848577A49DE85D8893EE4700E49A6B8DB17484417723ACDB9BABD3A7119446D5FCBD68DBF8C38846B6972169139BCE78A7B785D1787F312A41553C864
Malicious:	false
Preview:	/* Area:.ffi_call, closure_call. Purpose:.Test complex' passed in variable argument lists.. Limitations:.none.. PR:..none.. Originator:.<vogt@linux.vnet.ibm.com>. /../ { dg-do run } */..#include "complex_defs_longdouble.inc".#include "cls_complex_va.inc".

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\complex.exp

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	5.147919133231337
Encrypted:	false
SSDEEP:	24:QNLI2SSCUgiyUVOkHxHqTbV331seqKpW84AXvl+/F:IhPzjyUjH031HW84Ad+t
MD5:	28A1CA33EBD22F62C3093F146F7BD555
SHA1:	0563CACDCC6357FE8D2AAE1EC3C9161F6C77BE41
SHA-256:	CCA150FF76198152D2B2CAB3B8369B5AF46EF69B312421CA1559398FDDA328D8
SHA-512:	5E795E2A8EC4B131C30BAA646170E2443270CBB1A8D5E0F79EFF07F8DA95E967419412BF39E839B8F86E8D7A263B155D757B38B6B9FCB7B85EE398A80398C615
Malicious:	false
Preview:	# Copyright (C) 2003, 2006, 2009, 2010, 2014 Free Software Foundation, Inc...# This program is free software; you can redistribute it and/or modify.# it under the terms of the GNU General Public License as published by.# the Free Software Foundation; either version 3 of the License, or.# (at your option) any later version..#.# This program is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.# GNU General Public License for more details..#.# You should have received a copy of the GNU General Public License.# along with this program; see the file COPYING3. If not see.# <http://www.gnu.org/licenses/>...dg-init.libffi-init..global srcdir subdir..set tlist [lsort [glob -nocomplain -- $srcdir/$subdir/*.{c,cc}]]..if { [libffi_feature_test "#ifdef FFI_TARGET_HAS_COMPLEX_TYPE"] } {. run-many-tests $tlist "".} else {. foreach test $tlist {..unsupported "$test".

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\complex.inc

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1130
Entropy (8bit):	5.2668259567243965
Encrypted:	false
SSDEEP:	24:Yjf/tXYjhultnYuarzfMsxVwpa6TEzEahcI4b:2Y4nYuKB/QZQEeq
MD5:	36064E5F2F950C041CC2C0E2E29D60C9
SHA1:	A00791FE66A229C020FAAE34C40DD835E73F0C2D
SHA-256:	CC99177798ECB57EC45B791809806454460D2A3800D516B355101B4F23E2680D
SHA-512:	1173519F56E7ACF9E55FA234438F308AA6E95C66A0151DEB0926DDED1FEE8F352559253A44CA45C8359D238EE4BE64FAA8F1FA6525BFE150156C5F40F3ADE1D4
Malicious:	false
Preview:	/* --c--/.#include "ffitest.h".#include <complex.h>..static _Complex T_C_TYPE f_complex(_Complex T_C_TYPE c, int x, int py).{. c = -(2 * creal (c)) + (cimag (c) + 1)* I;. py += x;.. return c;.}..int main (void).{. ffi_cif cif;. ffi_type args[MAX_ARGS];. void values[MAX_ARGS];.. _Complex T_C_TYPE tc_arg;. _Complex T_C_TYPE tc_result;. int tc_int_arg_x;. int tc_y;. int tc_ptr_arg_y = &tc_y;.. args[0] = &T_FFI_TYPE;. args[1] = &ffi_type_sint;. args[2] = &ffi_type_pointer;. values[0] = &tc_arg;. values[1] = &tc_int_arg_x;. values[2] = &tc_ptr_arg_y;.. /* Initialize the cif /. CHECK(ffi_prep_cif(&cif, FFI_DEFAULT_ABI, 3,... &T_FFI_TYPE, args) == FFI_OK);.. tc_arg = 1 + 7 I;. tc_int_arg_x = 1234;. tc_y = 9876;. ffi_call(&cif, FFI_FN(f_complex), &tc_result, values);.. printf ("%f,%fi %f,%fi, x %d 1234, y %d 11110\n",.. T_CONV creal (tc_result), T_CONV cimag (tc_result),.. T_CONV creal (2.0), T_CONV creal (8.0), tc_int_arg_x, tc_y);.. CHECK (creal (tc_

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\complex_defs_double.inc

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	237
Entropy (8bit):	4.754018766065547
Encrypted:	false
SSDEEP:	6:UVhuF5G2fipaToMI5G2f0cWFvqy0ij6Yxd2fkv:UVhuHuIoMGH0kyxlKS
MD5:	D3E7A72702279B04321943A6A6771FBA
SHA1:	247667C52CDD4CC6CED8A64320C4588E700550AF
SHA-256:	15546188E5A06871098B5771C98151AF22AEFD01994D015F3F484369E1320FAC
SHA-512:	84A423A6E2EC3FA705DD9735DC6CEDB0BE72A30C69B1B24B5BCF3D7DFF27E29D2AA5D5F477F6CE7F3FFDB007AE8593D0BFE570140FE319EB5A8D3505697C0408
Malicious:	false
Preview:	/* --c-- /./ Complex base type. /.#define T_FFI_TYPE ffi_type_complex_double./ C type corresponding to the base type. /.#define T_C_TYPE double./ C cast for a value of type T_C_TYPE that is passed to printf. */.#define T_CONV.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\complex_defs_float.inc

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	244
Entropy (8bit):	4.771985266781539
Encrypted:	false
SSDEEP:	6:UVhuF5G2fipawoMI5G2f0SE7WFvqy0ij6Yxd2fkRv:UVhuHupoMGHyikyxlKkv
MD5:	DD8DE8461B5028819597C0E8AC67FC86
SHA1:	31A92BBB666ADE4421ABD57E2B154722A48F1DDB
SHA-256:	B74338A2B1EE2DEA91D5BC3A551F5380A9DAD0A79DDAEB9C7190DFC15F6DC027
SHA-512:	2545FD98BCE7753149FB4B3E3012B62E58EBA9D8718ABA9A389D4B998B5488DD7689C6ABBCB4C3F1F18B3BBBE54979446E381DAB2EEC56A3D9377C2C9027895B
Malicious:	false
Preview:	/* --c-- /./ Complex base type. /.#define T_FFI_TYPE ffi_type_complex_float./ C type corresponding to the base type. /.#define T_C_TYPE float./ C cast for a value of type T_C_TYPE that is passed to printf. */.#define T_CONV (double).

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\complex_defs_longdouble.inc

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	246
Entropy (8bit):	4.769142950683612
Encrypted:	false
SSDEEP:	6:UVhuF5G2fipa3CBKvoMI5G2f0K6yWFvqy0ij6Yxd2fkv:UVhuHuCoMGHJ8kyxlKS
MD5:	28CC17ED71D65109F905AD720D20F420
SHA1:	B1B230F2B38033BF6A8FAE5D37B6AEADE1C5F463
SHA-256:	D50B1665657CE8386A33883450765A659A9E048D3BC66CAA51438FD2FE4C91E7
SHA-512:	AE7A7F843204ADA5FF709C55C2EECB32B6BE471A2E0840E0F45DEBDF71CECF53D59E1B0730ABD60BB999C6FAE7F2472322FDF462D03AF46B0768C546036FAFF1
Malicious:	false
Preview:	/* --c-- /./ Complex base type. /.#define T_FFI_TYPE ffi_type_complex_longdouble./ C type corresponding to the base type. /.#define T_C_TYPE long double./ C cast for a value of type T_C_TYPE that is passed to printf. */.#define T_CONV.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\complex_double.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	213
Entropy (8bit):	4.900782126543209
Encrypted:	false
SSDEEP:	6:UmfJ4QZwAfWLg0KLfXDnSKhDKv7PZAkTo2Qg+IAkTm:UXA+M0q7SKhaPZAv2UIAx
MD5:	7080E9C0F06568616CE6D1C8337B3142
SHA1:	6345C40F5026557BAEBC5848E017B77A6141F7B4
SHA-256:	5F9728631636700EC358D15D7B728639854C6B11C68942D934A1D43746B6F5A5
SHA-512:	DEC54A13FDB8FCB39A05F0B34EB4EB463080EBBA3995DE65B7E90910090E3BC59CFA064AC14F6846D816763B0A0E2BE36006BEF299200E13383D3D6BD159F759
Malicious:	false
Preview:	/* Area:.ffi_call. Purpose:.Check complex types.. Limitations:.none.. PR:..none.. Originator:.<vogt@linux.vnet.ibm.com>. /../ { dg-do run } */..#include "complex_defs_double.inc".#include "complex.inc".

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\complex_float.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	212
Entropy (8bit):	4.899498299166986
Encrypted:	false
SSDEEP:	6:UmfJ4QZwAfWLg0KLfXDnSKhDKv7PZAkToWIAkTm:UXA+M0q7SKhaPZAvWIAx
MD5:	CEB3FB0A63894DBA3DB02101851241B4
SHA1:	85C772623E89E291437C5AC1F136EC2E92D383EB
SHA-256:	8B338E72735A326E44C5E4BDD298BE09FE83F6BBD50BC1CD6ADAE910F2AA7EB8
SHA-512:	981CAFEFBFE86743715CF1A073E1EADE46C43456CBFF08149BB64BCFAA0E18A4034C168100EEC6DC0D30637746400B9E3A56246E50110CFA3D143CA1665BE5C2
Malicious:	false
Preview:	/* Area:.ffi_call. Purpose:.Check complex types.. Limitations:.none.. PR:..none.. Originator:.<vogt@linux.vnet.ibm.com>. /../ { dg-do run } */..#include "complex_defs_float.inc".#include "complex.inc".

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\complex_int.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2293
Entropy (8bit):	5.196769104400603
Encrypted:	false
SSDEEP:	24:yH0NPZfHZSg+EAPQTo/l8WtdbBEA3/xnWTYjhKjnYyIarzfMsx7wpa6TENseIfG/:+0NPTnnKQE8eE5YSnYyIKBVQZbeIfG/
MD5:	5E32C604A0CDC8B13E8B49292CEA0FA2
SHA1:	F6FE04599B8CB8439AFFCBE1187CE7C39B037B41
SHA-256:	5A2DB2BADE15D626020EF4AB79DBD5DA38B89D2F9D4BD3A54CA183E2CAAC8F3D
SHA-512:	5483FA5AEB304A031E31A0C709FA58EB263318BFB29E50545BF43F5DBB9ACAE8492CA37012CBB31B1E30CCC5C7274803FA6F65331B8E572596128C2FA6C250D2
Malicious:	false
Preview:	/* Area:.ffi_call. Purpose:.Check non-standard complex types.. Limitations:.none.. PR:..none.. Originator:.<vogt@linux.vnet.ibm.com>. /../ { dg-do run } /..#include "ffitest.h".#include "ffi.h".#include <complex.h>.._Complex int f_complex(_Complex int c, int x, int py).{. __real__ c = -2 * __real__ c;. __imag__ c = __imag__ c + 1;. py += x;. return c;.}../. * This macro can be used to define new complex type descriptors. * in a platform independent way.. . name: Name of the new descriptor is ffi_type_complex_<name>.. * type: The C base type of the complex type.. /.#define FFI_COMPLEX_TYPEDEF(name, type, ffitype). \. static ffi_type ffi_elements_complex_##name [2] = {. \. (ffi_type *)(&ffitype), NULL... \. };....... \. struct struct_align_complex_##name {... \. char c;...... \. _Complex type x;..... \. };....... \. ffi_type ffi_type_complex_##name = {.. \. sizeof(_Complex type),.... \. offsetof(struct st

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\complex_longdouble.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	217
Entropy (8bit):	4.895905870747327
Encrypted:	false
SSDEEP:	6:UmfJ4QZwAfWLg0KLfXDnSKhDKv7PZAkToe9F+IAkTm:UXA+M0q7SKhaPZAveSIAx
MD5:	C63BB413E057C3B737A6FEB9BD950ADE
SHA1:	96C7219E5BC239D0F47FB49B452BD77D42CEBE5B
SHA-256:	4AA805D660AB74199467C43F091B20D46A1D7E029EAFC14CF82CDE82927C6783
SHA-512:	03B654C648CF9CFA3CD920A016A7EDDFD1B37DDF234C895BBE449C6172291259E00C70DE451FCA3056B43C5B677E0B6D9FC3FC0B002BE1105D8683998457270B
Malicious:	false
Preview:	/* Area:.ffi_call. Purpose:.Check complex types.. Limitations:.none.. PR:..none.. Originator:.<vogt@linux.vnet.ibm.com>. /../ { dg-do run } */..#include "complex_defs_longdouble.inc".#include "complex.inc".

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\ffitest.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	36
Entropy (8bit):	4.003258334775645
Encrypted:	false
SSDEEP:	3:XBA9CJME6tWZv:RAcME7Zv
MD5:	0F3C94E520870E194CF525DE7EC404DC
SHA1:	CC165E031F7FD38874AB028D1259F632E276D0FD
SHA-256:	7F5BAE05440E1CA8BE4259A8B2A28958ED76D78B6FD77DF401AC5D669C3DC877
SHA-512:	58D05DF381EFDA3782FC2E0D37D6C90D8BB743E6B72FC067F24C5E0D34193BBB970F55C5530DAF28026BAA57FB371CA9C126B619D2D808AA3D4E04981BE1C1B3
Malicious:	false
Preview:	#include "../libffi.call/ffitest.h".

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\many_complex.inc

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1944
Entropy (8bit):	5.170874930649441
Encrypted:	false
SSDEEP:	24:YzPutquJnAIBrkGBQBLnw2OYF8sp/4SnxMJc2RY64XObLSDSC8Os:MKACB1RYKakcX6EOfGsp
MD5:	1644B630E950122ADDB928AE8BCD814F
SHA1:	C4D28CECD8058C30DE18F01787CA6A35CA113E67
SHA-256:	E8F2557AF7513191D27425E562519095031A619830CAC9BBCD0B36A9F5D3D9BC
SHA-512:	2CDC8537525DC9DAF1F667361BA2277E1095F655C64E7F3554B046CF8FED2BDC5B55A42CBE53CA2BF6C27EB27E0C4A4C62B631B8324116CD6DF7A6D34E4578F9
Malicious:	false
Preview:	/* --c-- */.#include "ffitest.h"..#include <stdlib.h>.#include <complex.h>..static _Complex T_C_TYPE many(_Complex T_C_TYPE c1,.... _Complex T_C_TYPE c2,.... _Complex T_C_TYPE c3,.... _Complex T_C_TYPE c4,.... _Complex T_C_TYPE c5,.... _Complex T_C_TYPE c6,.... _Complex T_C_TYPE c7,.... _Complex T_C_TYPE c8,.... _Complex T_C_TYPE c9,.... _Complex T_C_TYPE c10,.... _Complex T_C_TYPE c11,.... _Complex T_C_TYPE c12,.... _Complex T_C_TYPE c13).{. printf("0 :%f,%fi\n".. "1 :%f,%fi\n".. "2 :%f,%fi\n".. "3 :%f,%fi\n".. "4 :%f,%fi\n".. "5 :%f,%fi\n".. "6 :%f,%fi\n".. "7 :%f,%fi\n".. "8 :%f,%fi\n".. "9 :%f,%fi\n".. "10:%f,%fi\n".. "11:%f,%fi\n".. "12:%f,%fi\n",.. T_CONV creal (c1), T_CONV cimag (c1),.. T_CONV creal (c2), T_CONV cimag (c2),.. T_CONV creal (c3), T_CONV cimag (c3),.. T_CONV creal (c4), T_CONV cimag (c4),.. T_CONV creal (c5), T_CONV cimag (c5),.. T_CONV creal (c6), T_CONV cimag (c6),.. T_CONV creal (c7), T_CONV cimag (c

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\many_complex_double.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	245
Entropy (8bit):	4.92409291523377
Encrypted:	false
SSDEEP:	6:UmfJ4QZtAHVoOJM3TKLfXDnSKhDKv7PZAkTo2Qg+IAqyGwz:UnVZu3Tq7SKhaPZAv2UIAqVy
MD5:	7396D17415094382C7A7936F7AE28975
SHA1:	1817CA687D92E79141867F23B8D884578965B048
SHA-256:	5B9059DD34FF8FDB5F7CB0FB351E5FEEAB538596281F9AC204389396CAC239B7
SHA-512:	82B4793E03E02C996D8E9C56C1EED8361B875A9F13A2B6999A2067B7E5F069073ED7898E90C0D0076A60DAD3C9F4367DC10483A26AF0F52DB88368BB6C306336
Malicious:	false
Preview:	/* Area:.ffi_call. Purpose:.Check return value complex, with many arguments. Limitations:.none.. PR:..none.. Originator:.<vogt@linux.vnet.ibm.com>. /../ { dg-do run } */..#include "complex_defs_double.inc".#include "many_complex.inc".

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\many_complex_float.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	244
Entropy (8bit):	4.920281629618575
Encrypted:	false
SSDEEP:	6:UmfJ4QZtAHVoOJM3TKLfXDnSKhDKv7PZAkToWIAqyGwz:UnVZu3Tq7SKhaPZAvWIAqVy
MD5:	CB4CEE311DEF9CA0A67305FD914ADA0B
SHA1:	4E3BDDC3F7F654C0EBB2D98435531C0578209E00
SHA-256:	CEF6F14295C99313BCD05105B9CA43360F8FE7532F7494BB8F629CAF71176367
SHA-512:	BDE41CD730D9389887577AB5036A3C89048338673AE85ACA2D8A5374AF977727EC71F2106D05BC1721608D4DAB2B6EE824EEEF11C02D6A22B4C61633C085F1D0
Malicious:	false
Preview:	/* Area:.ffi_call. Purpose:.Check return value complex, with many arguments. Limitations:.none.. PR:..none.. Originator:.<vogt@linux.vnet.ibm.com>. /../ { dg-do run } */..#include "complex_defs_float.inc".#include "many_complex.inc".

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\many_complex_longdouble.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	249
Entropy (8bit):	4.919136124012591
Encrypted:	false
SSDEEP:	6:UmfJ4QZtAHVoOJM3TKLfXDnSKhDKv7PZAkToe9F+IAqyGwz:UnVZu3Tq7SKhaPZAveSIAqVy
MD5:	05F9F75ACAA58FF001388856513B0BF1
SHA1:	94D01190E92490F6E742B70E16136F27B839909B
SHA-256:	D59C3AB56654D83563EE162B07FAA4628038A7F776F9B3CBD50C078D7B95DD15
SHA-512:	1BFB1A9975D3D8850A9FBF877FC8C451002FA46C63D56F12F56EC8C1FA6DEF1C2821B66C330B2640E05A3C4B23E50E040D05EF986A5C8A719DC9A163F18ED443
Malicious:	false
Preview:	/* Area:.ffi_call. Purpose:.Check return value complex, with many arguments. Limitations:.none.. PR:..none.. Originator:.<vogt@linux.vnet.ibm.com>. /../ { dg-do run } */..#include "complex_defs_longdouble.inc".#include "many_complex.inc".

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\return_complex.inc

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	829
Entropy (8bit):	5.125894295643923
Encrypted:	false
SSDEEP:	12:UVhRA38AL3dlETUXVZJVwlOcMqtY+oyMbtsxMmLCzFXee8GEnI3zCkCtATwTCGGC:YzfunEYjmOYjMsxMQCzFobA2kCacThX
MD5:	27423258F578F0C8F60FF22409CCC31C
SHA1:	2ADE1A92D90E39D2390B804F105DB9490A318173
SHA-256:	93915A0C784C3383BB8480F96871384A2AC1847B097CBE69D619AB307C5FC2D6
SHA-512:	18E4322CBB2018676C457CAE0A0A86A342DCA93F4E3DDCBD6E2C0D300D9790B10DDF1FE13D51CDEC82AC05EC9E3DEBFD5AD172AB9DC9708CB050DA34D1A0E6E5
Malicious:	false
Preview:	/* --c-- /.#include "ffitest.h".#include <complex.h>..static _Complex T_C_TYPE return_c(_Complex T_C_TYPE c).{. printf ("%f,%fi\n", T_CONV creal (c), T_CONV cimag (c));. return 2 c;.}.int main (void).{. ffi_cif cif;. ffi_type args[MAX_ARGS];. void values[MAX_ARGS];. _Complex T_C_TYPE c, rc, rc2;. T_C_TYPE cr, ci;.. args[0] = &T_FFI_TYPE;. values[0] = &c;.. /* Initialize the cif /. CHECK(ffi_prep_cif(&cif, FFI_DEFAULT_ABI, 1,... &T_FFI_TYPE, args) == FFI_OK);.. for (cr = -127.0; cr < 127; cr++). {. ci = 1000.0 - cr;. c = cr + ci I;. ffi_call(&cif, FFI_FN(return_c), &rc, values);. rc2 = return_c(c);. printf ("%f,%fi vs %f,%fi\n",.. T_CONV creal (rc), T_CONV cimag (rc),.. T_CONV creal (rc2), T_CONV cimag (rc2));. CHECK(rc == 2 * c);. }. exit(0);.}.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\return_complex1.inc

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	970
Entropy (8bit):	5.327661802993474
Encrypted:	false
SSDEEP:	24:Yzfgj3MEYj2Ow/3Vc5j6LkMsx62/T2WcA:HbMEY4PVAgkB4QbcA
MD5:	6272CD29ABEB40C1E6616D505DCB7FF7
SHA1:	E87B2D3EBFA99548AFC4A0B40AC701CED84198E4
SHA-256:	3CC27239E2F5E0FBEFF661B1F59C4325DCA27702B3B805471F842FF14D3995A7
SHA-512:	F22001BB381D8CB75B82334B3E64D4BE0820302A0E2D74E1C909C1158B5010996228366D61DB7B1948EA617EFA91CCBC91ABEFF1737EE66175A40D8AB310FEA8
Malicious:	false
Preview:	/* --c-- /.#include "ffitest.h".#include <complex.h>..static _Complex T_C_TYPE return_c(_Complex T_C_TYPE c1, float fl2, unsigned int in3, _Complex T_C_TYPE c4).{. return c1 + fl2 + in3 + c4;.}.int main (void).{. ffi_cif cif;. ffi_type args[MAX_ARGS];. void values[MAX_ARGS];. _Complex T_C_TYPE c1, c4, rc, rc2;. float fl2;. unsigned int in3;. args[0] = &T_FFI_TYPE;. args[1] = &ffi_type_float;. args[2] = &ffi_type_uint;. args[3] = &T_FFI_TYPE;. values[0] = &c1;. values[1] = &fl2;. values[2] = &in3;. values[3] = &c4;.. / Initialize the cif /. CHECK(ffi_prep_cif(&cif, FFI_DEFAULT_ABI, 4,... &T_FFI_TYPE, args) == FFI_OK);. c1 = 127.0 + 255.0 I;. fl2 = 128.0;. in3 = 255;. c4 = 512.7 + 1024.1 * I;.. ffi_call(&cif, FFI_FN(return_c), &rc, values);. rc2 = return_c(c1, fl2, in3, c4);. printf ("%f,%fi vs %f,%fi\n",.. T_CONV creal (rc), T_CONV cimag (rc),.. T_CONV creal (rc2), T_CONV cimag (rc2));. CHECK(rc == rc2);. exit(0);.}.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\return_complex1_double.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.883748250979311
Encrypted:	false
SSDEEP:	6:UmfJ4QZtAHVoOJA0KLfXDnSKhDKv7PZAkTo2Qg+IA18Z6:UnVZO0q7SKhaPZAv2UIA1r
MD5:	9D4B914A7CE2747641701799459873A5
SHA1:	CBBACF1B598F1E1D5C1FCB3099FF95D39236A3BC
SHA-256:	0D1268B6E8BC6AF5D1B8AA0249749F8F405CCB6B8464559DFBF500F5032AF481
SHA-512:	C6949233365F0E7DEBD91EF4E0E9D3A7C0AF7C749E4A9997E5725BCC72870D1D1A73C541D703CE33970ED05CF86F7B4A0860F5DD528D6CFEFBAC5B8784E3F7AA
Malicious:	false
Preview:	/* Area:.ffi_call. Purpose:.Check return value complex.. Limitations:.none.. PR:..none.. Originator:.<vogt@linux.vnet.ibm.com>. /../ { dg-do run } */..#include "complex_defs_double.inc".#include "return_complex1.inc".

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\return_complex1_float.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	227
Entropy (8bit):	4.883500099754091
Encrypted:	false
SSDEEP:	6:UmfJ4QZtAHVoOJA0KLfXDnSKhDKv7PZAkToWIA18Z6:UnVZO0q7SKhaPZAvWIA1r
MD5:	ED394D1DD9B2DE43171621A9604A192B
SHA1:	F80E3A6658AF758F3E25536A6C8891409DA2F75C
SHA-256:	FAE681C372B0C3ACF67685E3276629C3908F05B47EF7AC7601BF051BBBEA3C9B
SHA-512:	E53C15E33D1FB1EE42D25A125A6599DD3DD4E90643D16EA36E87BE6AC9E4ED598E394174CB7E4DCBD101F4CA2A5D134B70E116007FCF3A65703089F93465C581
Malicious:	false
Preview:	/* Area:.ffi_call. Purpose:.Check return value complex.. Limitations:.none.. PR:..none.. Originator:.<vogt@linux.vnet.ibm.com>. /../ { dg-do run } */..#include "complex_defs_float.inc".#include "return_complex1.inc".

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\return_complex1_longdouble.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	232
Entropy (8bit):	4.879676216018501
Encrypted:	false
SSDEEP:	6:UmfJ4QZtAHVoOJA0KLfXDnSKhDKv7PZAkToe9F+IA18Z6:UnVZO0q7SKhaPZAveSIA1r
MD5:	3B3AF37B33F1A68B750A7658B6ACEFD4
SHA1:	E6437A4BD8D3364EE415152480B93182451FB671
SHA-256:	38DB54C312C994BE3BA90D932753211FE5D7CEA24A60E516EBB8BC2F30ECA310
SHA-512:	5875830A76705097486CA7A391FB319D2CE3B01355802E298DAE57968F28B81E9432BB3B4743D4ADE82BB37ED0F83D67A4E80D7C11C6AD65DFB373790C416F5F
Malicious:	false
Preview:	/* Area:.ffi_call. Purpose:.Check return value complex.. Limitations:.none.. PR:..none.. Originator:.<vogt@linux.vnet.ibm.com>. /../ { dg-do run } */..#include "complex_defs_longdouble.inc".#include "return_complex1.inc".

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\return_complex2.inc

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	5.339712010548706
Encrypted:	false
SSDEEP:	12:UVhRA38Ae67v3Vs9TUXVZJVwsnOpXv3aiB5+o9Ml6HQLZUvRJMbtsxULXskBtEmA:YzfyT3UYj5Op/3xc5jLkMsx6Xz62WcA
MD5:	F4D6FA89228667A3F32B2E83BEADB7DF
SHA1:	D5E205B4568CABD4928B99485B62A83D391A02ED
SHA-256:	86B98BEC9FFA3F3A0C1359D0245C02F01068EB82246CC1D3CEE22F80324117EE
SHA-512:	A1F19B533045C8A9DEFE6FB3A24117930D85EA4CF1D6AE0606A6EA4D25DF9B21FA260CE2FEA445D9F73DE0AD900F262267F2D939EA140E054582AFDFAC4769C3
Malicious:	false
Preview:	/* --c-- /.#include "ffitest.h".#include <complex.h>.._Complex T_C_TYPE.return_c(_Complex T_C_TYPE c1, _Complex T_C_TYPE c2,.. unsigned int in3, _Complex T_C_TYPE c4).{. volatile _Complex T_C_TYPE r = c1 + c2 + in3 + c4;. return r;.}..int main (void).{. ffi_cif cif;. ffi_type args[MAX_ARGS];. void values[MAX_ARGS];. _Complex T_C_TYPE c1, c2, c4, rc, rc2;. unsigned int in3;. args[0] = &T_FFI_TYPE;. args[1] = &T_FFI_TYPE;. args[2] = &ffi_type_uint;. args[3] = &T_FFI_TYPE;. values[0] = &c1;. values[1] = &c2;. values[2] = &in3;. values[3] = &c4;.. / Initialize the cif /. CHECK(ffi_prep_cif(&cif, FFI_DEFAULT_ABI, 4,... &T_FFI_TYPE, args) == FFI_OK);. c1 = 127.0 + 255.0 I;. c2 = 128.0 + 256.0;. in3 = 255;. c4 = 512.7 + 1024.1 * I;.. ffi_call(&cif, FFI_FN(return_c), &rc, values);. rc2 = return_c(c1, c2, in3, c4);. printf ("%f,%fi vs %f,%fi\n",.. T_CONV creal (rc), T_CONV cimag (rc),.. T_CONV creal (rc2), T_CONV cimag (rc2));. CHECK(rc == rc2);. exit(0)

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\return_complex2_double.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.883748250979311
Encrypted:	false
SSDEEP:	6:UmfJ4QZtAHVoOJA0KLfXDnSKhDKv7PZAkTo2Qg+IA18jP:UnVZO0q7SKhaPZAv2UIA14P
MD5:	19708386F33EBD3A3E0E91EE3483EA56
SHA1:	DD6F5E8AE9602552AE74642ED49573F8C4354319
SHA-256:	74663E04A8F9E0B6C1FF1607DE1D36AE08FFD9512978847B74A8104B5E2B0E6D
SHA-512:	9791E47F6185DAB235C2F6E0A9049D2AFC0D29AADAB1604F24BB6C36BDAAE9FA57647C37FBFB40AB3EFA561F1922D826DE0FC4834EB152B3BDAE6971EF18F971
Malicious:	false
Preview:	/* Area:.ffi_call. Purpose:.Check return value complex.. Limitations:.none.. PR:..none.. Originator:.<vogt@linux.vnet.ibm.com>. /../ { dg-do run } */..#include "complex_defs_double.inc".#include "return_complex2.inc".

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\return_complex2_float.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	227
Entropy (8bit):	4.883500099754091
Encrypted:	false
SSDEEP:	6:UmfJ4QZtAHVoOJA0KLfXDnSKhDKv7PZAkToWIA18jP:UnVZO0q7SKhaPZAvWIA14P
MD5:	60F373EA65846C65649F4040447C698E
SHA1:	D2A429AD40DAE63F1E9BB099324F964CF0E0B3B1
SHA-256:	4F86A6A7CF4B901CF5AA282B0D8CF5F95E292EEA3D6E39582FE863C12E95C365
SHA-512:	806FCB26842CFAF24CDB3243AEBB1DFAD1CF1EC830BAC3E5ABB31CEEBBC7E309685DE0E0ED1D159F626E0E6B2C4F7876E0820561D9DF37BC0A83BE9DA41EDAAB
Malicious:	false
Preview:	/* Area:.ffi_call. Purpose:.Check return value complex.. Limitations:.none.. PR:..none.. Originator:.<vogt@linux.vnet.ibm.com>. /../ { dg-do run } */..#include "complex_defs_float.inc".#include "return_complex2.inc".

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\return_complex2_longdouble.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	232
Entropy (8bit):	4.879676216018501
Encrypted:	false
SSDEEP:	6:UmfJ4QZtAHVoOJA0KLfXDnSKhDKv7PZAkToe9F+IA18jP:UnVZO0q7SKhaPZAveSIA14P
MD5:	0F86B92379C2BAB5B8CC960AFE355178
SHA1:	69C696991CD7B2F7CB527A30617B234311E612F5
SHA-256:	6A58D12076D4674182F5A9FB10172C2D4DE220775E8C3ACE93FA68590A8F2CC5
SHA-512:	68A50FA38500C1CA69D791711F10CA3A87A5DB9727FB0EE871324ED0A7BC0E5B5052BD40727AB9C5C8AC11A37A3064189E287B6B8354C97FBCA71E2012EC2BFC
Malicious:	false
Preview:	/* Area:.ffi_call. Purpose:.Check return value complex.. Limitations:.none.. PR:..none.. Originator:.<vogt@linux.vnet.ibm.com>. /../ { dg-do run } */..#include "complex_defs_longdouble.inc".#include "return_complex2.inc".

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\return_complex_double.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	227
Entropy (8bit):	4.864414910170743
Encrypted:	false
SSDEEP:	6:UmfJ4QZtAHVoOJA0KLfXDnSKhDKv7PZAkTo2Qg+IA18z:UnVZO0q7SKhaPZAv2UIA1m
MD5:	062DE152852BF7AEF6A661607CFE1E7C
SHA1:	89BB8A7404F75E705CBDB748DF9725247FD1799D
SHA-256:	D99CC7DA897F116E0F129C69097A7DDA4A48029E1A9CAA61F0B3F3FD0597FC9D
SHA-512:	E38024444F2799737AD22774B449ACFF019402CBC5A9ACF7F0ACC36D152A36C3FDB5AD660E96C24D24C6180D8AD822C5BBC1E542851DFE037156CAF752D2EC1C
Malicious:	false
Preview:	/* Area:.ffi_call. Purpose:.Check return value complex.. Limitations:.none.. PR:..none.. Originator:.<vogt@linux.vnet.ibm.com>. /../ { dg-do run } */..#include "complex_defs_double.inc".#include "return_complex.inc".

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\return_complex_float.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	226
Entropy (8bit):	4.864108236880416
Encrypted:	false
SSDEEP:	6:UmfJ4QZtAHVoOJA0KLfXDnSKhDKv7PZAkToWIA18z:UnVZO0q7SKhaPZAvWIA1m
MD5:	A3EB5DEE2788FE0A6C42502BA658EDDD
SHA1:	66B64909C8FB04EB59B48CDFA580DB0A10FDDB38
SHA-256:	0439D4C1204361227F0D628A4E749554BF0799608AF7056B85336DCC323F1DBB
SHA-512:	32CEAE136C1069D871FED1770ECE8E1ED9FC7D9F8DA8AC53C226AF79C89409B64415AFA83C358A2D7796BD586786E094A113824A4315B3E6F52F270D0D2625DE
Malicious:	false
Preview:	/* Area:.ffi_call. Purpose:.Check return value complex.. Limitations:.none.. PR:..none.. Originator:.<vogt@linux.vnet.ibm.com>. /../ { dg-do run } */..#include "complex_defs_float.inc".#include "return_complex.inc".

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.complex\return_complex_longdouble.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	231
Entropy (8bit):	4.860551168025131
Encrypted:	false
SSDEEP:	6:UmfJ4QZtAHVoOJA0KLfXDnSKhDKv7PZAkToe9F+IA18z:UnVZO0q7SKhaPZAveSIA1m
MD5:	621F1E1E55F7CDDD72D1CA0617C45577
SHA1:	A91C8956AA1DAB72959546E1DEE22227B2DCC0EA
SHA-256:	9BA9B81867E143EEA96AE1088D83304201D7A9C15B850AA5F32C6DB98148707E
SHA-512:	0D50C17F1B4EF5DB0ADFC80D569BBCB532ECB508F10457839080687BEEF396C9847F3307853915A47633FBE2EA14B6D5E9F1ED69EE891C8C2239F5F9FDBA7250
Malicious:	false
Preview:	/* Area:.ffi_call. Purpose:.Check return value complex.. Limitations:.none.. PR:..none.. Originator:.<vogt@linux.vnet.ibm.com>. /../ { dg-do run } */..#include "complex_defs_longdouble.inc".#include "return_complex.inc".

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.go\aa-direct.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	723
Entropy (8bit):	5.156698258325706
Encrypted:	false
SSDEEP:	12:U8PZAoYvc+4nI7lbyAA3Yac//VfM+eH3/B7U7KIiqs9hh3jxsOESdT4crsWvZ:zPZ7m4nUZZ7NE+eH3/6KZjTxsTo4crs2
MD5:	74F6F3A5A0B2DD97FFE91DBFDFD11286
SHA1:	8B8D3EBE1D8361AA7B5CC1EE143E1801AF886799
SHA-256:	DFD5ADA446CBE8D4B13F9109CD685014788752EEB24870023DC0DE57DC7F9081
SHA-512:	D2C5FC02AE171288199A0FD2FC9A2BFB98B8C3ED5EC1BEA6A89438BCA8735E60067A6EB603387D7BA1A89C1C7BB3DCEE14D3E708E7CA242B3BC1978AAB42E07E
Malicious:	false
Preview:	/* { dg-do run } /..#include "static-chain.h"..#if defined(__GNUC__) && !defined(__clang__) && defined(STATIC_CHAIN_REG)..#include "ffitest.h"../ Blatent assumption here that the prologue doesn't clobber the. static chain for trivial functions. If this is not true, don't. define STATIC_CHAIN_REG, and we'll test what we can via other tests. /.void doit(void).{. register void chain __asm__(STATIC_CHAIN_REG);. return chain;.}..int main().{. ffi_cif cif;. void result;.. CHECK(ffi_prep_cif(&cif, ABI_NUM, 0, &ffi_type_pointer, NULL) == FFI_OK);.. ffi_call_go(&cif, FFI_FN(doit), &result, NULL, &result);.. CHECK(result == &result);.. return 0;.}..#else /* UNSUPPORTED */.int main() { return 0; }.#endif.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.go\closure1.c

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	504
Entropy (8bit):	4.984600385258493
Encrypted:	false
SSDEEP:	12:U8PZA3/klrAXj4dlq4maK3Hh93jxsOEjTyB49SdlTrhJ2yC:zPZx+XjXLXHXTxsTjTfWrhJ2b
MD5:	2CE6F3CFC3E18A428E0CD7DA8F1DF6D5
SHA1:	64E2DC5EC9A661565FC23A0CCDC689231243A514
SHA-256:	71653402F2E619A328822293DF880432BE8A99075463AF1B612F13D0652D99CE
SHA-512:	DCEC68CAE914C1CA51FABB268EB37DFEF122F7089EF505FB7F97890F893D14EEC837E38E93A9D523EB0196529BB8D2E3FCF61EAAF388E21C8347B417EC77F0EE
Malicious:	false
Preview:	/* { dg-do run } /..#include "ffitest.h"..void doit(ffi_cif cif, void rvalue, void avalue, void closure).{. (void)cif;. (void)avalue;. (void )rvalue = closure;.}..typedef void (FN)(void);..int main().{. ffi_cif cif;. ffi_go_closure cl;. void result;.. CHECK(ffi_prep_cif(&cif, ABI_NUM, 0, &ffi_type_pointer, NULL) == FFI_OK);. CHECK(ffi_prep_go_closure(&cl, &cif, doit) == FFI_OK);.. ffi_call_go(&cif, FFI_FN((FN )&cl), &result, NULL, &cl);.. CHECK(result == &cl);.. exit(0);.}.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.go\ffitest.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	36
Entropy (8bit):	4.003258334775645
Encrypted:	false
SSDEEP:	3:XBA9CJME6tWZv:RAcME7Zv
MD5:	0F3C94E520870E194CF525DE7EC404DC
SHA1:	CC165E031F7FD38874AB028D1259F632E276D0FD
SHA-256:	7F5BAE05440E1CA8BE4259A8B2A28958ED76D78B6FD77DF401AC5D669C3DC877
SHA-512:	58D05DF381EFDA3782FC2E0D37D6C90D8BB743E6B72FC067F24C5E0D34193BBB970F55C5530DAF28026BAA57FB371CA9C126B619D2D808AA3D4E04981BE1C1B3
Malicious:	false
Preview:	#include "../libffi.call/ffitest.h".

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.go\go.exp

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1053
Entropy (8bit):	5.117800013798481
Encrypted:	false
SSDEEP:	24:QNLI2SSCUgiyUVOkHxHqTbV331seDz84AXvl+/F:IhPzjyUjH031B84Ad+t
MD5:	6CFB66C1C00023ABB2C2276D85F16E77
SHA1:	D4D7F23AC63C04449991DD0E2752B23657F64DB5
SHA-256:	B8C688A6151C1EE7814232CDA1C073041D3B85E2F65A45DB7402362752533070
SHA-512:	012CC1B2092DC51F8E67116B3201A3366DEDAB7B03DE3741FC0F46F63954930CAFC959F45CE393486832600B3162D5111EB418156BA1E8BA4E8787E85A16D99D
Malicious:	false
Preview:	# Copyright (C) 2003, 2006, 2009, 2010, 2014 Free Software Foundation, Inc...# This program is free software; you can redistribute it and/or modify.# it under the terms of the GNU General Public License as published by.# the Free Software Foundation; either version 3 of the License, or.# (at your option) any later version..#.# This program is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.# GNU General Public License for more details..#.# You should have received a copy of the GNU General Public License.# along with this program; see the file COPYING3. If not see.# <http://www.gnu.org/licenses/>...dg-init.libffi-init..global srcdir subdir..set tlist [lsort [glob -nocomplain -- $srcdir/$subdir/*.{c,cc}]]..if { [libffi_feature_test "#ifdef FFI_GO_CLOSURES"] } {. run-many-tests $tlist "".} else {. foreach test $tlist {..unsupported "$test". }.}..dg-fi

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.go\static-chain.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	491
Entropy (8bit):	4.906960186093507
Encrypted:	false
SSDEEP:	12:7nM+R+JK4Mw+C4M6+tt+zG+KGMLMZ+rB4MQ/5+dbYGMw:w+oJKLDCLdWtKFwArBLwgUw
MD5:	189DC193FD0E627A2D55B2E84871EDC5
SHA1:	CF09F2A3FE50188BBCF46A7D5E5C185B0B521F2B
SHA-256:	B3F47DDB1DEEBF38BDDC38F2A66CE648C569A1E794B05D5071211D9490868A9B
SHA-512:	A82D84287D1D498BE611E535398638F22141DE4F8BD4671876FD6BD8860E7B9388BEB346D4C0B5A43422CF2075DDCF0B3BE5CBF053B6657201F4822E78F36EFC
Malicious:	false
Preview:	#ifdef __aarch64__.# define STATIC_CHAIN_REG "x18".#elif defined(__alpha__).# define STATIC_CHAIN_REG "$1".#elif defined(__arm__).# define STATIC_CHAIN_REG "ip".#elif defined(__sparc__).# if defined(__arch64__) \|\| defined(__sparcv9).# define STATIC_CHAIN_REG "g5".# else.# define STATIC_CHAIN_REG "g2".# endif.#elif defined(__x86_64__).# define STATIC_CHAIN_REG "r10".#elif defined(__i386__).# ifndef ABI_NUM.# define STATIC_CHAIN_REG "ecx"./* FFI_DEFAULT_ABI only */.# endif.#endif.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.special\ffitestcxx.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	5.2968470460504715
Encrypted:	false
SSDEEP:	24:Rutr9N0kT4nnnScF8FgRFgNHXL3IimI6OqHof65I5tHkP65I5tOVopH:XkT8n3F+g7glXTIimIkZ5I51kC5I50s
MD5:	D47C79B281339983862A8E52D8C73F0F
SHA1:	03126980A76ED0CAD1827C638918E02A475ADD1F
SHA-256:	472C865634F000E7FE96DA1DB148E123AA5C5E0B137F4DCD2CB254DC3F02D1DA
SHA-512:	D338F104CC589CD0B3ACE559E30B072A1542005D04CF8C47BB2AFAB4B426161CD537965FF5E0F45C1468BC9CCDE5EAD66150ACC6F686AD01A6C3E8320E3CB3C6
Malicious:	false
Preview:	#include <stdlib.h>.#include <stdio.h>.#include <fcntl.h>.#include <ffi.h>.#include "fficonfig.h"..#define MAX_ARGS 256.../* Define __UNUSED__ that also other compilers than gcc can run the tests. /.#undef __UNUSED__.#if defined(__GNUC__).#define __UNUSED__ __attribute__((__unused__)).#else.#define __UNUSED__.#endif..#define CHECK(x) (!(x) ? abort() : (void)0)../ Prefer MAP_ANON(YMOUS) to /dev/zero, since we don't need to keep a. file open. /.#ifdef HAVE_MMAP_ANON.# undef HAVE_MMAP_DEV_ZERO..# include <sys/mman.h>.# ifndef MAP_FAILED.# define MAP_FAILED -1.# endif.# if !defined (MAP_ANONYMOUS) && defined (MAP_ANON).# define MAP_ANONYMOUS MAP_ANON.# endif.# define USING_MMAP..#endif..#ifdef HAVE_MMAP_DEV_ZERO..# include <sys/mman.h>.# ifndef MAP_FAILED.# define MAP_FAILED -1.# endif.# define USING_MMAP..#endif.../ MinGW kludge. */.#ifdef _WIN64.#define PRIdLL "I64d".#define PRIuLL "I64u".#else.#define PRIdLL "lld".#define PRIuLL "llu".#endif..#ifdef USING_MMAP.static inline

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\testsuite\libffi.special\special.exp

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1217
Entropy (8bit):	5.160036893946469
Encrypted:	false
SSDEEP:	24:QNt2SSCUgiyUVOkHxHqTbV331EpN8GuSGCHG9GQ+/F:nPzjyUjH031L+t
MD5:	291BE426192F460F6A07DFE1C96AB094
SHA1:	99530BE99833DEBB44CAB42592C0E43AD7897315
SHA-256:	DC1649501961D9FB70069D32A6707999676C3EA2B5B7D5A704D63FCAC554330A
SHA-512:	56344D03DF8AF3A283C7A05A8E966FE58B5569D9B15976A49E883CC71355400B2C20A951F208C29352725A5CCAE137067B668DB164946DB68C43851FF2BD8AC9
Malicious:	false
Preview:	# Copyright (C) 2003, 2006, 2009, 2010 Free Software Foundation, Inc...# This program is free software; you can redistribute it and/or modify.# it under the terms of the GNU General Public License as published by.# the Free Software Foundation; either version 3 of the License, or.# (at your option) any later version..#.# This program is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.# GNU General Public License for more details..#.# You should have received a copy of the GNU General Public License.# along with this program; see the file COPYING3. If not see.# <http://www.gnu.org/licenses/>...dg-init.libffi-init..global srcdir subdir..global cxx_options..set cxx_options " -shared-libgcc -lstdc++"..dg-runtest [lsort [glob -nocomplain $srcdir/$subdir/.cc]] $cxx_options "-O0 -W -Wall".dg-runtest [lsort [glob -nocomplain $srcdir/$subdir/.cc]] $cxx_options "-O2

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\deps\libffi\texinfo.tex

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	230259
Entropy (8bit):	4.816622958202003
Encrypted:	false
SSDEEP:	3072:TlCS/Pi6qaRAnl6iSPEOddXHOpmJ2GaVhlnD2y7BIGK+Y87ZxA0D:QS/PimRAwTupg2HhlniwSz87ZxA0D
MD5:	330CC83E650CC581DC85FFAA9CABB184
SHA1:	4F42268B4D0F665268AD4710D1AC53F2D6D36554
SHA-256:	EBA29AD63754C59B92AB8861A582F02A86A948A73D2133F6E6E2D11B1C06671D
SHA-512:	8E3E5F509D4ABE736FC5003B86C7A7467876E56096FE58DB7BC8D53F373765296C96963716D2D11F2846006F5952EA69F680CF88882874952BF25AFFBC14A3B6
Malicious:	false
Preview:	% texinfo.tex -- TeX macros to handle Texinfo files..%.% Load plain if necessary, i.e., if running under initex..\expandafter\ifx\csname fmtname\endcsname\relax\input plain\fi.%.\def\texinfoversion{2005-07-05.19}.%.% Copyright (C) 1985, 1986, 1988, 1990, 1991, 1992, 1993, 1994, 1995,.% 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005 Free Software.% Foundation, Inc..%.% This texinfo.tex file is free software; you can redistribute it and/or.% modify it under the terms of the GNU General Public License as.% published by the Free Software Foundation; either version 2, or (at.% your option) any later version..%.% This texinfo.tex file is distributed in the hope that it will be.% useful, but WITHOUT ANY WARRANTY; without even the implied warranty.% of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.% General Public License for more details..%.% You should have received a copy of the GNU General Public License.% along with this texinfo.tex file; see the file COPYI

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\lib\_foreign_function.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3642
Entropy (8bit):	4.757809995826439
Encrypted:	false
SSDEEP:	96:hb8/6TtY1fJbVaj0FnkjW6QzcWDkynkjaF71/Ldkry:t466pVwEnkjWDcWvnkja3Ldkry
MD5:	2A49BF4AB3FAAA4D12181FD4BCE729AC
SHA1:	8D409F1435168588B103C08FB07DCE76BB28311C
SHA-256:	55B15DE548D85992BF6F8E0D85DD0358860896925F95FB86851C958DB42D18C5
SHA-512:	AC54EDFC71AEEE3EC91AC0A70E421B76A843A1DEF29187154E2AF07235D579C5B699E5E9435A675220EF97D5A635D20A38796D56B86525A930DFEA79B9741938
Malicious:	false
Preview:	'use strict';./*. Module dependencies.. /..const assert = require('assert');.const debug = require('debug')('ffi:_ForeignFunction');.const ref = require('ref-napi');.const bindings = require('./bindings');.const POINTER_SIZE = ref.sizeof.pointer;.const FFI_ARG_SIZE = bindings.FFI_ARG_SIZE;...function ForeignFunction (cif, funcPtr, returnType, argTypes) {. debug('creating new ForeignFunction', funcPtr);.. const numArgs = argTypes.length;. const argsArraySize = numArgs POINTER_SIZE;.. // "result" must point to storage that is sizeof(long) or larger. For smaller. // return value sizes, the ffi_arg or ffi_sarg integral type must be used to. // hold the return value. const resultSize = returnType.size >= ref.sizeof.long ? returnType.size : FFI_ARG_SIZE;. assert(resultSize > 0);.. /*. This is the actual JS function that gets returned.. * It handles marshalling input arguments into C values,. * and unmarshalling the return value back into a JS value. */.. const prox

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\lib\bindings.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	267
Entropy (8bit):	4.65579883707671
Encrypted:	false
SSDEEP:	6:Qo+cKX7YanMuH8ykKnLbgaEI+0B0WM9ZL6LAa:BKXEanMhyfMaEI+0BTM/a
MD5:	2E91A7108595E41B0EAC9B66FE48B16E
SHA1:	63367F1B77573B46C41FC84B02AD8B39E8899EAA
SHA-256:	344785DEFA0ACB2861C7B64CF46D096669CC085371B8C4BE9DA9932732D55153
SHA-512:	0E9DE1C2FBB16B50D74FF97D6BED8DC844BB5F71DE99EB8914A56D7EF0291A5CF8F2DBE2768A3CE1F44804D9D4520A4C8FCF79FBE7DCC7B5D2D61F0304B1647C
Malicious:	false
Preview:	'use strict';.const path = require('path');.const ref = require('ref-napi');.const assert = require('assert');..assert(ref.instance);..const bindings = require('node-gyp-build')(path.join(__dirname, '..'));.module.exports = bindings.initializeBindings(ref.instance);.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\lib\callback.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2337
Entropy (8bit):	4.680520734226363
Encrypted:	false
SSDEEP:	48:FAga87/FBbiyaXZz5fCQPsgCYz/LGvL4G0Nu6zsvaq6cqTeuiE7N:w8jYhHPuGRq6RKE7N
MD5:	6C5FD7A740F4CBA6EE05A9353E5DE1C9
SHA1:	8D9890F962287E7EFD070526E72FDA7AC76484C2
SHA-256:	17BD1E66EA9AC57324EDD824325D4DD64C5CCEEB8121A0F61AC9A8BA23B6BB3D
SHA-512:	0578F2D0887CD8538DEA6D4D946677FB6BC0C2FB54A74A85F06F42CAE812C4C50A4CDF51C8BE7E5103EBF001A706CD6BF5DB3AB668FFC9E989DF2A7F4A085195
Malicious:	false
Preview:	'use strict';./*. Module dependencies.. /..const ref = require('ref-napi');.const CIF = require('./cif');.const assert = require('assert');.const debug = require('debug')('ffi:Callback');.const _Callback = require('./bindings').Callback;..// Function used to report errors to the current process event loop,.// When user callback function gets gced..function errorReportCallback (err) {. if (err) {. process.nextTick(function () {. if (typeof err === 'string') {. throw new Error(err);. } else {. throw err;. }. }). }.}../. Turns a JavaScript function into a C function pointer.. * The function pointer may be used in other C functions that. * accept C callback functions.. */..function Callback (retType, argTypes, abi, func) {. debug('creating new Callback');.. if (typeof abi === 'function') {. func = abi;. abi = undefined;. }.. // check args. assert(!!retType, 'expected a return "type" object as the first argument');. assert(Array.isArr

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\lib\cif.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2454
Entropy (8bit):	4.991336644212226
Encrypted:	false
SSDEEP:	48:0xgvI+t3JYNE5h8X1pKUkGJ74GuZPpw4GhOK0CY3J4Gh8keCa279RCb+Xf95cfjc:+23JQGyXj/+nhZesCbq7urVRQ
MD5:	DE0C9CBF00112933FE4D4C52ECA1F7D9
SHA1:	C82430F41794EF6C88DA77A74E00E92C9D8EC71C
SHA-256:	3CF7EC1AE4D7FE843FBA10E4901003A1093E5CC13135D4043BB27E32759781DC
SHA-512:	A8E2A257F30DCEB7F5901D4ABF8CDD436B5F22E6A82271595156E7A57EBDE7A5E44B6CFF6AFE5AB213C1AAB51332669468C1517C7BCF7092CDCFC25B4ED02C72
Malicious:	false
Preview:	'use strict';./*. Module dependencies.. /..var Type = require('./type');.const assert = require('assert');.const debug = require('debug')('ffi:cif');.const ref = require('ref-napi');.const bindings = require('./bindings');.const POINTER_SIZE = ref.sizeof.pointer;.const ffi_prep_cif = bindings.ffi_prep_cif;.const FFI_CIF_SIZE = bindings.FFI_CIF_SIZE;.const FFI_DEFAULT_ABI = bindings.FFI_DEFAULT_ABI;. // status codes.const FFI_OK = bindings.FFI_OK;.const FFI_BAD_TYPEDEF = bindings.FFI_BAD_TYPEDEF;.const FFI_BAD_ABI = bindings.FFI_BAD_ABI;../. JS wrapper for the `ffi_prep_cif` function.. * Returns a Buffer instance representing a `ffi_cif ` instance.. /..const cifs = [];.function CIF (rtype, types, abi) {. debug('creating `ffi_cif *` instance');.. // the return and arg types are expected to be coerced at this point.... assert(!!rtype, 'expected a return "type" object as the first argument');. assert(Array.isArray(types), 'expected an Array of arg "type" objects as the secon

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\lib\cif_var.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2611
Entropy (8bit):	4.963488884866172
Encrypted:	false
SSDEEP:	48:4gpI+PJWNE5h8X1pKUuGJ8bb4Gubr8w4GXOOK0CY324Gh8k9M9RCb+XGD5cpjgmb:S4J6GyXjd86PZHg+Cb98UDRK
MD5:	12BA004C1E200B77F3155DAB2258C295
SHA1:	C5220A70DBB7C679088C02348945946B2462CDAD
SHA-256:	053FEA5AD12360DAD86CDCF01A17EB92CCB9180CDA69341E7229EF5F6C8762F0
SHA-512:	AB66CB967E7AC4407EB057B8D7E35C20F396805588D2E4EA668EAEFAFB59B37ABC4EAEABC202E7213AE55957981572656A3A64C747A12888326B626BFB3386C3
Malicious:	false
Preview:	'use strict';./*. Module dependencies.. /..const Type = require('./type');.const assert = require('assert');.const debug = require('debug')('ffi:cif_var');.const ref = require('ref-napi');.const bindings = require('./bindings');.const POINTER_SIZE = ref.sizeof.pointer;.const ffi_prep_cif_var = bindings.ffi_prep_cif_var;.const FFI_CIF_SIZE = bindings.FFI_CIF_SIZE;.const FFI_DEFAULT_ABI = bindings.FFI_DEFAULT_ABI;. // status codes.const FFI_OK = bindings.FFI_OK;.const FFI_BAD_TYPEDEF = bindings.FFI_BAD_TYPEDEF;.const FFI_BAD_ABI = bindings.FFI_BAD_ABI;../. JS wrapper for the `ffi_prep_cif_var` function.. * Returns a Buffer instance representing a variadic `ffi_cif ` instance.. /..function CIF_var (rtype, types, numFixedArgs, abi) {. debug('creating `ffi_cif *` instance with `ffi_prep_cif_var()`');.. // the return and arg types are expected to be coerced at this point.... assert(!!rtype, 'expected a return "type" object as the first argument');. assert(Array.isArray(types),

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\lib\dynamic_library.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4087
Entropy (8bit):	4.925659454207396
Encrypted:	false
SSDEEP:	48:ISgQ2gziM0NpRxMwBAwaIST11CTGbZTnsGZDZFl5ECbO6p4NtJvnoFlMYKKrcu8f:IqvaRf6LT9j3ECbFOHQlXvcuv3c
MD5:	52F5A7811925B9F5BA30E2F5F832BB1F
SHA1:	E3054E2D3F93830B7DE74CE3913574F5B5F9CFFB
SHA-256:	1D096E4F8C4F46BF05D5283F6B15E0ADCEC6C5055D1F4FD0620087D6E1BA0193
SHA-512:	3B1C9F005578AFBFD40DFFB94B5A347FDE498FBEFC9365B27D5DC59D20F49B3B22F78782C9227F5A549078E4204E360DE8266DDA5435D655F2A0FD58D7876B53
Malicious:	false
Preview:	'use strict';./*. Module dependencies.. /..const ForeignFunction = require('./foreign_function');.const assert = require('assert');.const debug = require('debug')('ffi:DynamicLibrary');.const bindings = require('./bindings');.const funcs = bindings.StaticFunctions;.const ref = require('ref-napi');.const read = require('fs').readFileSync;..// typedefs.const int = ref.types.int;.const voidPtr = ref.refType(ref.types.void);..const dlopen = ForeignFunction(funcs.dlopen, voidPtr, [ 'string', int ]);.const dlclose = ForeignFunction(funcs.dlclose, int, [ voidPtr ]);.const dlsym = ForeignFunction(funcs.dlsym, voidPtr, [ voidPtr, 'string' ]);.const dlerror = ForeignFunction(funcs.dlerror, 'string', [ ]);../. `DynamicLibrary` loads and fetches function pointers for dynamic libraries. * (.so, .dylib, etc). After the libray's function pointer is acquired, then you. * call `get(symbol)` to retreive a pointer to an exported symbol. You need to. * call `get___()` on the pointer to

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\lib\errno.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	613
Entropy (8bit):	4.71547278252408
Encrypted:	false
SSDEEP:	12:hSUWcASRMHg+TXEkeG2SgJMLl8tDkLKzmwGlbwlxJT7sRBg:gjcAS2gzkCI+dQbuABg
MD5:	679569DD1FB25189AC4583D36AAE2DB8
SHA1:	3053BC6A8F1FEA6E00CB894A4354193B08ED3DA0
SHA-256:	64AFAF09BBBD57BB00F80756DB4F34C13E0D181BA0DEE7AE206F96F11F526768
SHA-512:	8F21CB45F042A69098D4CEEFD6868DAD182F557458351E126323074781409F57435F12498A8E6337B09C4C3FF23BCC02E8D6C3AFA28315182A581E699FB87238
Malicious:	false
Preview:	'use strict';.const DynamicLibrary = require('./dynamic_library');.const ForeignFunction = require('./foreign_function');.const bindings = require('./bindings');.const funcs = bindings.StaticFunctions;.const ref = require('ref-napi');.const int = ref.types.int;.const intPtr = ref.refType(int);.let errno = null;..if (process.platform == 'win32') {. const _errno = DynamicLibrary('msvcrt.dll').get('_errno');. const errnoPtr = ForeignFunction(_errno, intPtr, []);. errno = function() {. return errnoPtr().deref();. };.} else {. errno = ForeignFunction(funcs._errno, 'int', []);.}..module.exports = errno;.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\lib\ffi.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2930
Entropy (8bit):	5.322686208633086
Encrypted:	false
SSDEEP:	48:3CguO05kdOGWnr+e3IKROFgzy7AzKGQnI4Kj4t84FK/A64YB4P64pB4z8Z4YdQ1Y:IOiUOGWnB3IKROFgeczKGQnIhjI8NA68
MD5:	CD1CF69F292CF1E9A6CB336D609D18F2
SHA1:	8AFEDD0FF29831A13CB24AA9336D7D5C1F4C2128
SHA-256:	F51E271B2C7008886D4FE77685B536770A99F66CEC816674446A8A8BD8AC4E2E
SHA-512:	CBE42FAD5C1895F1F53064430E4D5A58F6BE76C52937876B0AEC1504E1335756558D83FC35B8A701C51B9989559AC3F463A48A293CD66919584DB6662F64337A
Malicious:	false
Preview:	'use strict';../*. Module dependencies.. /..const ref = require('ref-napi');.const assert = require('assert');.const debug = require('debug')('ffi:ffi');.const Struct = require('ref-struct-di')(ref);.const bindings = require('./bindings');../. Export some of the properties from the "bindings" file.. /..['FFI_TYPES',. 'FFI_OK', 'FFI_BAD_TYPEDEF', 'FFI_BAD_ABI',. 'FFI_DEFAULT_ABI', 'FFI_FIRST_ABI', 'FFI_LAST_ABI', 'FFI_SYSV', 'FFI_UNIX64',. 'FFI_WIN64', 'FFI_VFP', 'FFI_STDCALL', 'FFI_THISCALL', 'FFI_FASTCALL',. 'RTLD_LAZY', 'RTLD_NOW', 'RTLD_LOCAL', 'RTLD_GLOBAL', 'RTLD_NOLOAD',. 'RTLD_NODELETE', 'RTLD_FIRST', 'RTLD_NEXT', 'RTLD_DEFAULT', 'RTLD_SELF',. 'RTLD_MAIN_ONLY', 'FFI_MS_CDECL'].forEach(prop => {. if (!bindings.hasOwnProperty(prop)) {. return debug('skipping exporting of non-existant property', prop);. }. const desc = Object.getOwnPropertyDescriptor(bindings, prop);. Object.defineProperty(exports, prop, desc);.});../. Set the `ffi_type` property on the built-in

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\lib\foreign_function.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1304
Entropy (8bit):	4.7551160553128184
Encrypted:	false
SSDEEP:	24:l0cAJgtSM2LyxRVyBO8OfODlkO8nqXtCY3dPGgmDX/D4Gy/+hRv77BA:mvgoLyxz0O8yOJOnq9CY3BGgoXL4G06w
MD5:	B702BF7F07D25F7BD81B4A91CB71F7D8
SHA1:	4D11D1A34A389F4CDFB8247C9738E022FAC781EC
SHA-256:	DDDD5A1ECBF82687C37EC071FEB50953CFAB2889BB5E7FAE84367D2E12115905
SHA-512:	0D31386344366861ADA78E57A843C9C90D82089592863AA50D2785089879958BD985A750FB1DAE889108C23273EAA6EDFF679CEA9D41B3C998B8FCEB48B349FD
Malicious:	false
Preview:	'use strict';./*. Module dependencies.. /..const CIF = require('./cif');.const _ForeignFunction = require('./_foreign_function');.const debug = require('debug')('ffi:ForeignFunction');.const assert = require('assert');.const ref = require('ref-napi');../. Represents a foreign function in another library. Manages all of the aspects. * of function execution, including marshalling the data parameters for the. * function into native types and also unmarshalling the return from function. * execution.. */..function ForeignFunction (funcPtr, returnType, argTypes, abi) {. debug('creating new ForeignFunction', funcPtr);.. // check args. assert(Buffer.isBuffer(funcPtr), 'expected Buffer as first argument');. assert(!!returnType, 'expected a return "type" object as the second argument');. assert(Array.isArray(argTypes), 'expected Array of arg "type" objects as the third argument');.. // normalize the "types" (they could be strings,. // so turn into real type instances). returnType

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\lib\foreign_function_var.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3313
Entropy (8bit):	4.826267002069261
Encrypted:	false
SSDEEP:	48:ASguI+3BSBGA/LxtMPtGsternqhCY3gGoklA6J1XfH2WctzqL4GqGMrDQSzV2Uc8:Al8yQRzbAi23Q+9Ss
MD5:	CC6F1F07D2C0BD68EA65052BEEEBD471
SHA1:	268DBBA500C7EB2B1A80A9D17C51FD68B3B9A670
SHA-256:	7C6F037C21635F215E667BA52C4BF1139EA3519B33B891E48A2EB7F4AEC1F289
SHA-512:	955AB9B737D0B0DC97EB18F2F832F08116B1280E584F14171E223E724154259CF18177995E27DFEEA4DA630C350DC8295E9B4B15F8A0CC15D56B462D1DE3FEF6
Malicious:	false
Preview:	'use strict';./*. Module dependencies.. /..const CIF_var = require('./cif_var');.const Type = require('./type');.const _ForeignFunction = require('./_foreign_function');.const assert = require('assert');.const debug = require('debug')('ffi:VariadicForeignFunction');.const ref = require('ref-napi');.const bindings = require('./bindings');.const POINTER_SIZE = ref.sizeof.pointer;.const FFI_ARG_SIZE = bindings.FFI_ARG_SIZE;../. For when you want to call to a C function with variable amount of arguments.. * i.e. `printf()`.. . This function takes care of caching and reusing ForeignFunction instances that. * contain the same ffi_type argument signature.. */..function VariadicForeignFunction (funcPtr, returnType, fixedArgTypes, abi) {. debug('creating new VariadicForeignFunction', funcPtr);.. // the cache of ForeignFunction instances that this. // VariadicForeignFunction has created so far. const cache = {};.. // check args. assert(Buffer.isBuffer(funcPtr), 'expected Buffer

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\lib\function.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2641
Entropy (8bit):	4.862396189329612
Encrypted:	false
SSDEEP:	48:F9hvgYqzdSPDGb2YO7gCYqLGaT6r4a7rbBwI6MGuToCr7p:7hpSdVOcC+rzbH6OToCrV
MD5:	16F8F45C01DC9B63697F76E9CE43FE1C
SHA1:	33C61CE3BE0526088C51E506F2505383AA3E3F06
SHA-256:	6EE34A976C81348D3E9B99EEB48BAFD8C1DC6D292048C9009A927B7E018EACD6
SHA-512:	327FE4155752C5817C69016828A5B324EE198184C157227A4111E56A50D90F22008079C937F1A5040042FBE51A18E9DD2E7942EDAD9FCCB78E222B7D39328815
Malicious:	false
Preview:	'use strict';./*. Module dependencies.. /..const ref = require('ref-napi');.const assert = require('assert');.const bindings = require('./bindings');.const Callback = require('./callback');.const ForeignFunction = require('./foreign_function');.const debug = require('debug')('ffi:FunctionType');../. Module exports.. /..module.exports = Function;../. Creates and returns a "type" object for a C "function pointer".. . @api public. */..function Function (retType, argTypes, abi) {. if (!(this instanceof Function)) {. return new Function(retType, argTypes, abi);. }.. debug('creating new FunctionType');.. // check args. assert(!!retType, 'expected a return "type" object as the first argument');. assert(Array.isArray(argTypes), 'expected Array of arg "type" objects as the second argument');.. // normalize the "types" (they could be strings, so turn into real type. // instances). this.retType = ref.coerceType(retType);. this.argTypes = argTypes.map(ref.coerceType);.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\lib\library.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1953
Entropy (8bit):	4.9501480233928925
Encrypted:	false
SSDEEP:	48:FHVgztrN6Lmx9aumvdN8LEGmXvZ7KwRGldIaia7:FHITzxDmVN3x3+NH7
MD5:	05D25D395B1FDC8F0AB948407876CA2C
SHA1:	C348FA788187F89898FB198411415C5AE3E09E71
SHA-256:	70C0ECC048E4756ECD8DA73BE6F9C5562F69CBD6F1F6DEA0F28F15461CB8456B
SHA-512:	09B024F687DE7508F866415476FBC2D94B9DDD763C48969AF2DCB95D12052C1C1DD2D78FBE2BFEE7B40465C69EDF69C21F3F9AB28BBC81F92C1310E9B5924970
Malicious:	false
Preview:	'use strict';./*. Module dependencies.. /..const DynamicLibrary = require('./dynamic_library');.const ForeignFunction = require('./foreign_function');.const VariadicForeignFunction = require('./foreign_function_var');.const debug = require('debug')('ffi:Library');.const RTLD_NOW = DynamicLibrary.FLAGS.RTLD_NOW;../. The extension to use on libraries.. * i.e. libm -> libm.so on linux. /..const EXT = Library.EXT = {. 'linux': '.so',. 'linux2': '.so',. 'sunos': '.so',. 'solaris':'.so',. 'freebsd':'.so',. 'openbsd':'.so',. 'darwin': '.dylib',. 'mac': '.dylib',. 'win32': '.dll'.}[process.platform];../. Provides a friendly abstraction/API on-top of DynamicLibrary and. * ForeignFunction.. */..function Library (libfile, funcs, lib) {. debug('creating Library object for', libfile);.. if (libfile && typeof libfile === 'string' && libfile.indexOf(EXT) === -1) {. debug('appending library extension to library name', EXT);. libfile += EXT;. }.. if (!lib) {.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\lib\type.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4464
Entropy (8bit):	4.823938252522791
Encrypted:	false
SSDEEP:	96:oGANSNinA1mtZRPkPLk+6yWKWZlJTiTYthE97hteiLUeKi5Ref0JY025d66a1:oNNSNF1WZRPOL36Bl5gOhE97yinKi502
MD5:	8F993199FE24730A79A35C7BA50D7962
SHA1:	63F0AF521C62A99E29611263B4552966C3DADFC5
SHA-256:	527012790480AEB4C8E4EA47AA6EFD63CCFA2FC6727AC560F2DCD398F9E1E808
SHA-512:	A7A72CC716ACCA0050B0C11CBF6A554915497D135751C908FE6DB035AC0FF20A1D4752F953EB312532725AEAA3774B9BE4F209AC7FB667CA0BD8B98150B44998
Malicious:	false
Preview:	'use strict';./*. Module dependencies.. /..const ref = require('ref-napi');.const assert = require('assert');.const debug = require('debug')('ffi:types');.const Struct = require('ref-struct-di')(ref);.const bindings = require('./bindings');../. Define the `ffi_type` struct (see deps/libffi/include/ffi.h) for use in JS.. * This struct type is used internally to define custom struct ret/arg types.. /..const FFI_TYPE = Type.FFI_TYPE = Struct();.FFI_TYPE.defineProperty('size', ref.types.size_t);.FFI_TYPE.defineProperty('alignment', ref.types.ushort);.FFI_TYPE.defineProperty('type', ref.types.ushort);.// this last prop is a C Array of `ffi_type ` elements, so this is `ffi_type `.const ffi_type_ptr_array = ref.refType(ref.refType(FFI_TYPE));.FFI_TYPE.defineProperty('elements', ffi_type_ptr_array);.assert.strictEqual(bindings.FFI_TYPE_SIZE, FFI_TYPE.size);../. * Returns a `ffi_type ` Buffer appropriate for the given "type".. . * @param {Type\|String} type A "ref" typ

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\node_modules\node-addon-api\LICENSE.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1245
Entropy (8bit):	5.198916936408371
Encrypted:	false
SSDEEP:	24:x5c2DpWHr4JHBH0yPP3gtAHw1hl9QHcsUv48Ok4/+dbo3oqxFz:xvVo8JplPvEDvQHcs5ITc3omFz
MD5:	0492EF29A9D558A3E9660E7ACCC9CA6A
SHA1:	0AEF1FF2A58152DC83BAAA6D5E97E54525C4FF21
SHA-256:	4FCF69BBECB999EC8FA0ECE62BC8934B7CDD45061AC1A8B1939A09BE64CD4352
SHA-512:	2FF6743661D190A0C7DABF3508D57C0D86C7ECD7B8200577E4EBFD937D3782A15D49F327B81428AFABC706D378C45F20ECA067C084A3376D770D4DFCE0F3E29F
Malicious:	false
Preview:	The MIT License (MIT).=====================..Copyright (c) 2017 Node.js API collaborators.-----------------------------------..Node.js API collaborators listed at <https://github.com/nodejs/node-addon-api#collaborators>..Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT S

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\node_modules\node-addon-api\common.gypi

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	762
Entropy (8bit):	5.173881166313352
Encrypted:	false
SSDEEP:	12:mCtwwcw9LRLCv9cxznCGyNeR0a5VCTze5hsLV2FfWN+AEuQcWnqLpA5Z3MVeZ3ZR:4lwNRWGyNeR0gYSTsLgjAEFn8A5RM2fL
MD5:	98F8C21891914449F85FDBEBDE5EE6F2
SHA1:	40F91D126351B0FC9FD4F03B33CCA72D952DEFC3
SHA-256:	F15742E3019096B85EF3E8985E2FE66C4DDA722908577E113A1B0264893ECCA8
SHA-512:	E2254B498E89D972733B3F390010843E924C68AEAB96F6C00CD6B3FB6C447E69ADF3A9B9CAF66ADC9DBC9BB57DFD92873D931A3D2E9FC37D8F934CA5B258BBE0
Malicious:	false
Preview:	{. 'variables': {. 'NAPI_VERSION%': "<!(node -p \"process.versions.napi\")",. 'disable_deprecated': "<!(node -p \"process.env['npm_config_disable_deprecated']\")". },. 'conditions': [. ['NAPI_VERSION!=""', { 'defines': ['NAPI_VERSION=<@(NAPI_VERSION)'] } ],. ['disable_deprecated=="true"', {. 'defines': ['NODE_ADDON_API_DISABLE_DEPRECATED']. }],. ['OS=="mac"', {. 'cflags+': ['-fvisibility=hidden'],. 'xcode_settings': {. 'OTHER_CFLAGS': ['-fvisibility=hidden']. }. }]. ],. 'include_dirs': ["<!(node -p \"require('../').include_dir\")"],. 'cflags': [ '-Werror', '-Wall', '-Wextra', '-Wpedantic', '-Wunused-parameter' ],. 'cflags_cc': [ '-Werror', '-Wall', '-Wextra', '-Wpedantic', '-Wunused-parameter' ].}.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\node_modules\node-addon-api\except.gypi

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	381
Entropy (8bit):	5.033837554185557
Encrypted:	false
SSDEEP:	6:GeQEILMdDAhhDAIjcWome9I5yz/9aCpI9UxcWLu3KnagPXiLukBJH3:GeUvcWomU2yz/9aYI9QcWLyWaOXwBJ3
MD5:	0A0F340CC9A807DBF4F8B706BCAEDAEA
SHA1:	03768A848E11C21B33A9EBC43CB337CA146D0C74
SHA-256:	DA3A1C3C08FDF60C68D7D8D11EF1C73ADC5D8B73D8AC8D649922109E077A7808
SHA-512:	CE0F1D34999FB1E5719CE9ABE6F9A89E8ECCD8AAC80995580927BE6AC39812CFA0BA063AFBE29E001CC3B071F56294F591D948DA32969B070AF3B8BCAB1B5E26
Malicious:	false
Preview:	{. 'defines': [ 'NAPI_CPP_EXCEPTIONS' ],. 'cflags!': [ '-fno-exceptions' ],. 'cflags_cc!': [ '-fno-exceptions' ],. 'msvs_settings': {. 'VCCLCompilerTool': {. 'ExceptionHandling': 1,. 'EnablePREfast': 'true',. },. },. 'xcode_settings': {. 'CLANG_CXX_LIBRARY': 'libc++',. 'MACOSX_DEPLOYMENT_TARGET': '10.7',. 'GCC_ENABLE_CPP_EXCEPTIONS': 'YES',. },.}.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\node_modules\node-addon-api\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	296
Entropy (8bit):	4.884319320380166
Encrypted:	false
SSDEEP:	6:FcPA3WV4OTfL6RTBSElAbEgjZ2JwKjlA3tVe36mipE0kT:C43WeM6RTBiggjs/u3tM3tiefT
MD5:	B6CC90D5B932A30E0F0CCC50AD604B14
SHA1:	8ADC616FC0A9AEBDFCE536AA9BF7E552FAFDC403
SHA-256:	6528E924B31E091C3243132FE713EA0F1FA6362FFAA3C2DD09D12670DB6B60DC
SHA-512:	11C964D1B60030C9F750EBF078F46836238B4D4334BBBF1A85F32C759111EA6099FAC1C827C88A17B8D17876583EEA357DAD2D55F3CBBAC14690A58CD0CBEC5D
Malicious:	false
Preview:	const path = require('path');..const include_dir = path.relative('.', __dirname);..module.exports = {. include: `"${__dirname}"`, // deprecated, can be removed as part of 4.0.0. include_dir,. gyp: path.join(include_dir, 'node_api.gyp:nothing'),. isNodeApiBuiltin: true,. needsFlag: false.};.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\node_modules\node-addon-api\napi-inl.deprecated.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7251
Entropy (8bit):	3.9808680664415825
Encrypted:	false
SSDEEP:	96:yLK7W38K7G5Cxi97aYYiFi97avutoz7ShthXz7DP:yL+W38+GwxiJMiFiJoutoncthXnDP
MD5:	9449D419B251F86FBFE7A48795347026
SHA1:	3B05F270E067B03608BA2479CAE3B0F04307EFF9
SHA-256:	96AFB169FD8AF899DDCADC102EA137E3CD253C13B8862CB11BD58601FE2A5F90
SHA-512:	2B2797394C59CAC5B73E6E39604E4EE5A51E6624F55426FB5FC125A1F29EC0FD9B0B3C2A4715E7B9475F814D364D684A1655ACC68D34DE89795475420BE9544F
Malicious:	false
Preview:	#ifndef SRC_NAPI_INL_DEPRECATED_H_.#define SRC_NAPI_INL_DEPRECATED_H_..////////////////////////////////////////////////////////////////////////////////.// PropertyDescriptor class.////////////////////////////////////////////////////////////////////////////////..template <typename Getter>.inline PropertyDescriptor.PropertyDescriptor::Accessor(const char* utf8name,. Getter getter,. napi_property_attributes attributes,. void* /data/) {. using CbData = details::CallbackData<Getter, Napi::Value>;. // TODO: Delete when the function is destroyed. auto callbackData = new CbData({ getter, nullptr });.. return PropertyDescriptor({. utf8name,. nullptr,. nullptr,. CbData::Wrapper,. nullptr,. nullptr,. attributes,. callbackData. });.}..template <typename Getter>.inline PropertyDescriptor PropertyDescriptor::Accessor(const std::string& utf8name,.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\node_modules\node-addon-api\napi-inl.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	186981
Entropy (8bit):	4.897196625190984
Encrypted:	false
SSDEEP:	3072:AvFd56vtQpuE/wnOFGS0VJnwZFW19wOKEcDRzbfG62w7Nvx38yZXobBHbtR7VX3x:S6vtQpuE/wnOFGS0VJnwZFW19wOKEcDk
MD5:	2CEE9A214A79B9D8C7D472FD896CBAD3
SHA1:	194F76484E58746A25C1059E123B1FA37EBB71F5
SHA-256:	732F3D74B7C64C761A989455BCA127D9C384651264AB27E5009D0BC78882BF81
SHA-512:	88319846081CADE57DAC7FBD85B8BD4D2F365F8401E9703D83FB3D0DD474F21772BD83A265CB14012DEF6E70CB6D26E7D112C11C592B343B82F64FE82665D339
Malicious:	false
Preview:	#ifndef SRC_NAPI_INL_H_.#define SRC_NAPI_INL_H_..////////////////////////////////////////////////////////////////////////////////.// Node-API C++ Wrapper Classes.//.// Inline header-only implementations for "Node-API" ABI-stable C APIs for.// Node.js..////////////////////////////////////////////////////////////////////////////////..// Note: Do not include this file directly! Include "napi.h" instead...#include <algorithm>.#include <cstring>.#include <mutex>.#include <type_traits>..namespace Napi {..// Helpers to handle functions exposed from C++..namespace details {..// Attach a data item to an object and delete it when the object gets.// garbage-collected..// TODO: Replace this code with `napi_add_finalizer()` whenever it becomes.// available on all supported versions of Node.js..template <typename FreeType>.static inline napi_status AttachData(napi_env env,. napi_value obj,. FreeType* data,.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\node_modules\node-addon-api\napi.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	111175
Entropy (8bit):	4.531542944884292
Encrypted:	false
SSDEEP:	1536:+cT0Ce3ffEBK6uRkLHUjKirLviDpKV5rtqBwKKgqzC9QeTgEzK7sKwDK73KbD0KJ:H0F3e6KirLviD85rtqBwh0gE8I6WDdMG
MD5:	B59FA48B954ADC35A55A508082DA0E5C
SHA1:	6F85F0DAF46E606933B6033CD3DB5B80EFEDA429
SHA-256:	1084A55623F0357F42FF55918BDD960C226FD90DDD1815B55CE094E55486689E
SHA-512:	4AC95F06A6B905FB94221607482EA712BEA0CF3CBAD9DD3C855A0256F2C908BF0E0467C66A8A74DDF16A0F6E26DFDE203BB186852922B53EE7ED090E1172F0BD
Malicious:	false
Preview:	#ifndef SRC_NAPI_H_.#define SRC_NAPI_H_..#include <node_api.h>.#include <functional>.#include <initializer_list>.#include <memory>.#include <mutex>.#include <string>.#include <vector>..// VS2015 RTM has bugs with constexpr, so require min of VS2015 Update 3 (known good version).#if !defined(_MSC_VER) \|\| _MSC_FULL_VER >= 190024210.#define NAPI_HAS_CONSTEXPR 1.#endif..// VS2013 does not support char16_t literal strings, so we'll work around it using wchar_t strings.// and casting them. This is safe as long as the character sizes are the same..#if defined(_MSC_VER) && _MSC_VER <= 1800.static_assert(sizeof(char16_t) == sizeof(wchar_t), "Size mismatch between char16_t and wchar_t");.#define NAPI_WIDE_TEXT(x) reinterpret_cast<char16_t*>(L ## x).#else.#define NAPI_WIDE_TEXT(x) u ## x.#endif..// If C++ exceptions are not explicitly enabled or disabled, enable them.// if exceptions were enabled in the compiler settings..#if !defined(NAPI_CPP_EXCEPTIONS) && !defined(NAPI_DISABLE_CPP_EXCEPTIONS).

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\node_modules\node-addon-api\node_api.gyp

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	132
Entropy (8bit):	4.010854302019321
Encrypted:	false
SSDEEP:	3:S9Wcz/t969fFIKNKFNFt5wDAvXFuCGQj+mGsFFFiCYv:S9Wa96aFd5UJmhKbv
MD5:	FCEC1557AC47891385AE1F67E6DA343A
SHA1:	E361D3A3BE19E802820F2FE59BFDF7C9EF72FC74
SHA-256:	3CD2C44FB0974F016376B676D46BBEBBCA7C89D4383B09ECE30E4CB4122A1499
SHA-512:	43715845F701ABDC09FE59D33E3F61E19278ABBACB122EDAF1B26DE55BD80B3354B76D5616905C8038EB6158C3399162B40A73742B7E4C733B3AC187E9DB0AA3
Malicious:	false
Preview:	{. 'targets': [. {. 'target_name': 'nothing',. 'type': 'static_library',. 'sources': [ 'nothing.c' ]. }. ].}.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\node_modules\node-addon-api\noexcept.gypi

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	386
Entropy (8bit):	5.035056853339696
Encrypted:	false
SSDEEP:	6:GeQEPs7VmQyDAhGFDAIjcWome9I5ys9aCpI9UxcWLu3KnagPXiLukV:GeTs7VmpcWomU2ys9aYI9QcWLyWaOXwV
MD5:	E930234C43421C4646A6E97CA67C4A51
SHA1:	E95ED77F1DE8896691D2AD75290F39E89C51F845
SHA-256:	780402B7ACD03EA966DE2F89F08A13FDE81ACE1B498B748621F908478F3778B0
SHA-512:	60644B83C2B550F329516EF3D5A80E80CE73436BA2BA017E445BA2D6B99C117051A46F0AC96021EA636ED516074DC5F61AF65323C83D5626D5F74BC41EE0A7A5
Malicious:	false
Preview:	{. 'defines': [ 'NAPI_DISABLE_CPP_EXCEPTIONS' ],. 'cflags': [ '-fno-exceptions' ],. 'cflags_cc': [ '-fno-exceptions' ],. 'msvs_settings': {. 'VCCLCompilerTool': {. 'ExceptionHandling': 0,. 'EnablePREfast': 'true',. },. },. 'xcode_settings': {. 'CLANG_CXX_LIBRARY': 'libc++',. 'MACOSX_DEPLOYMENT_TARGET': '10.7',. 'GCC_ENABLE_CPP_EXCEPTIONS': 'NO',. },.}.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\node_modules\node-addon-api\package-support.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	467
Entropy (8bit):	4.019589958784576
Encrypted:	false
SSDEEP:	6:lQS1kS0NwPpUjCAnqHZmA/yOQzFwWJBBzz5WQrBy+qkZGx5WKvNCL1e9TuPi1/zL:d1d0Nc0qKRzrnP5WI8+8x5W5eTT9v
MD5:	33E3FB94807BCD5102535F476C6A46A8
SHA1:	DEDC07E9973F104E29D2EEE9AD3468B0F40DD620
SHA-256:	B1CB7DA23CCA1681C7392A3C889EB0CC4916C53D2D7692D4B654AE751F3442F3
SHA-512:	BBC762C8886EC78FD889B46ABFD9F9ACA7F5D2CADBF9676F6A010026D4056CAA076516380B3C0737C61962E8BB5B0555095DD0386C99D9DA773C200CFA130755
Malicious:	false
Preview:	{. "versions": [. {. "version": "*",. "target": {. "node": "active". },. "response": {. "type": "time-permitting",. "paid": false,. "contact": {. "name": "node-addon-api team",. "url": "https://github.com/nodejs/node-addon-api/issues". }. },. "backing": [ { "project": "https://github.com/nodejs" },. { "foundation": "https://openjsf.org/" }. ]. }. ].}.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\node_modules\node-addon-api\package.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	705
Entropy (8bit):	4.768394190159866
Encrypted:	false
SSDEEP:	12:f76fItW6KgQlsn8r1KVG38S/FE4h5WIK6a2VsMbmF25WIYWAkH11a:f76kW6F8J3M9IWx38W0ZH11a
MD5:	D357ED2DFF064EA64D84D94180EED45E
SHA1:	5B9E608470B4BF2986296FF844671970EB5F0EBA
SHA-256:	5EE11D01F64E9220B576943E6836B10CA51DF41808716C5E1AAAC4FEEA1D8842
SHA-512:	7CC1C09698756DB93FD3CD5DD734F628D06B4C0648361BB3FE266C8CE12FDA56A50A7A15E0367D0642AD1E6014529B18117F89D86379A02E524F89503F7B7D8C
Malicious:	false
Preview:	{. "dependencies": {},. "description": "Node.js API (Node-API)",. "devDependencies": {. "benchmark": "^2.1.4",. "bindings": "^1.5.0",. "clang-format": "^1.4.0",. "fs-extra": "^9.0.1",. "pre-commit": "^1.2.2",. "safe-buffer": "^5.1.1". },. "directories": {},. "files": [. "*.{c,h,gyp,gypi}",. "package-support.json",. "tools/". ],. "gypfile": false,. "homepage": "https://github.com/nodejs/node-addon-api",. "license": "MIT",. "main": "index.js",. "name": "node-addon-api",. "optionalDependencies": {},. "pre-commit": "lint",. "repository": {. "type": "git",. "url": "git://github.com/nodejs/node-addon-api.git". },. "support": true,. "version": "3.2.1".}

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\node_modules\node-addon-api\tools\README.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3217
Entropy (8bit):	4.926428555338531
Encrypted:	false
SSDEEP:	48:3ZLLUOJJN8urv5xC6YiOCNGtALdb8sbgn14vghToliQejA5dfUeUAhgjLMGKxMRw:3xL3ePvGgn1PEPUJ4ILLKw/Hdyf
MD5:	34143C24D232AC62205EC0B7601CB109
SHA1:	3DECBDEED6F0C742925A5BE9B78F5251A4C0B569
SHA-256:	65E9EA918538F453166B10A1D609CF44CEC3D2D01F23FECB5265FB3A4BF303D5
SHA-512:	07DAD1D9C5C618AFC5FE2B8183EA40DB0CD736E0600BA8BDE4F38DB726D85E277C460140EF312C91A748A208FFA72283BE01A224F976F3421F144A2977EA4B2F
Malicious:	false
Preview:	# Tools..## clang-format..The clang-format checking tools is designed to check changed lines of code compared to given git-refs...## Migration Script..The migration tool is designed to reduce repetitive work in the migration process. However, the script is not aiming to convert every thing for you. There are usually some small fixes and major reconstruction required...### How To Use..To run the conversion script, first make sure you have the latest `node-addon-api` in your `node_modules` directory..```.npm install node-addon-api.```..Then run the script passing your project directory.```.node ./node_modules/node-addon-api/tools/conversion.js ./.```..After finish, recompile and debug things that are missed by the script....### Quick Fixes.Here is the list of things that can be fixed easily.. 1. Change your methods' return value to void if it doesn't return value to JavaScript.. 2. Use `.` to access attribute or to invoke member function in Napi::Object instead of `->`.. 3. `Napi::New

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\node_modules\node-addon-api\tools\check-napi.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3210
Entropy (8bit):	4.725163839814415
Encrypted:	false
SSDEEP:	96:xDAt4XvYzVlBcaiQLOiQQK2HjaR5D/v/l:xE4AzZcaiQaiQQ9HjafDHt
MD5:	E0319363C4E8D95A44A00BF037061414
SHA1:	2E3895647CCDB1D20EEA6C325D32F7E12F4D7F2C
SHA-256:	F3264FD3F9DD9BC3E051CDCF72125D34617B2B06B914C49F1E1297E53CFD524B
SHA-512:	3555A6F001DC983EAEB6F63368DC7C6C3962003B73F15991112E16E8942B90B83F8AA83E16AE35EB076DB9422924B9AAC00D7AD312B27589B10264FC249B3915
Malicious:	false
Preview:	'use strict';.// Descend into a directory structure and, for each file matching *.node, output.// based on the imports found in the file whether it's an N-API module or not...const fs = require('fs');.const path = require('path');.const child_process = require('child_process');..// Read the output of the command, break it into lines, and use the reducer to.// decide whether the file is an N-API module or not..function checkFile(file, command, argv, reducer) {. const child = child_process.spawn(command, argv, {. stdio: ['inherit', 'pipe', 'inherit']. });. let leftover = '';. let isNapi = undefined;. child.stdout.on('data', (chunk) => {. if (isNapi === undefined) {. chunk = (leftover + chunk.toString()).split(/[\r\n]+/);. leftover = chunk.pop();. isNapi = chunk.reduce(reducer, isNapi);. if (isNapi !== undefined) {. child.kill();. }. }. });. child.on('close', (code, signal) => {. if ((code === null && signal !== null) \|\| (code !== 0)) {.

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\node_modules\node-addon-api\tools\clang-format.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1912
Entropy (8bit):	4.997300011341668
Encrypted:	false
SSDEEP:	48:5OFy40fh7lALJWy01veQtU9eky2Jm2Jepo/ljI0PIWa:kFmVy01veQIbtJjIyIWa
MD5:	0E9D1C651C03536F6C961FCBF939778E
SHA1:	F9899A415350DDDD7F894AA037627434DBD157B0
SHA-256:	F046340B3D14125BDFD6BF72AF97A14967E8BC78816FCECC4DF2DB15F7472FA4
SHA-512:	B6DC12DD65DB5954C8BD43E371415877EC0A8FDC4395F8A92835F9780156DBB34A808127B6C11017DB7659784E246F5476280B82A6CD9531202561834BCD102D
Malicious:	false
Preview:	#!/usr/bin/env node..const spawn = require('child_process').spawnSync;.const path = require('path');..const filesToCheck = ['.h', '.cc'];.const CLANG_FORMAT_START = process.env.CLANG_FORMAT_START \|\| 'main';..function main(args) {. let fix = false;. while (args.length > 0) {. switch (args[0]) {. case '-f':. case '--fix':. fix = true;. default:. }. args.shift();. }.. let clangFormatPath = path.dirname(require.resolve('clang-format'));. const options = ['--binary=node_modules/.bin/clang-format', '--style=file'];. if (fix) {. options.push(CLANG_FORMAT_START);. } else {. options.push('--diff', CLANG_FORMAT_START);. }.. const gitClangFormatPath = path.join(clangFormatPath,. 'bin/git-clang-format');. const result = spawn('python', [. gitClangFormatPath,. ...options,. '--',. ...filesToCheck. ], { encoding: 'utf-8' });.. if (result.stderr) {. console.error('Error running git-clang-format:', result.stderr);. return 2;. }..

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\node_modules\node-addon-api\tools\conversion.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	15275
Entropy (8bit):	5.515853837423564
Encrypted:	false
SSDEEP:	192:85F2BOFlkjlyVK3y+lonvzINqXw29FjNqSL/8KC0VKNfbanDrQ6gy12R3NuO03Mp:G8a2LgvEFvKWjpPGCtBINjo
MD5:	3F6FE59495A8968E296547DBADE7C73B
SHA1:	1C603B7606A5F36515CEC6781DB65BAB8BB0864F
SHA-256:	DF2F681BDB4A1DAC5FAF7FA70A60DACE4DD12CE0B9964EFFCEE56A43F693FC6C
SHA-512:	CFBEA2B2ACF0AE37C6F50DF8A5F2CC96F54F480C05655BA5D8D5AE0E59E34315F0D71082EF3E5A7AB8B6CD38EA8F621C9AA137DF7E9086E1B5DDE486E49ED52B
Malicious:	false
Preview:	#! /usr/bin/env node..'use strict'..const fs = require('fs');.const path = require('path');..const args = process.argv.slice(2);.const dir = args[0];.if (!dir) {. console.log('Usage: node ' + path.basename(__filename) + ' <target-dir>');. process.exit(1);.}..const NodeApiVersion = require('../package.json').version;..const disable = args[1];.if (disable != "--disable" && dir != "--disable") {. var ConfigFileOperations = {. 'package.json': [. [ /([ ])"dependencies": {/g, '$1"dependencies": {\n$1 "node-addon-api": "' + NodeApiVersion + '",'],. [ /[ ]"nan": "[^"]+"(,\|)[\n\r]/g, '' ]. ],. 'binding.gyp': [. [ /([ ])'include_dirs': \[/g, '$1\'include_dirs\': [\n$1 \'<!(node -p "require(\\\'node-addon-api\\\').include_dir")\',' ],. [ /([ ])"include_dirs": \[/g, '$1"include_dirs": [\n$1 "<!(node -p \\"require(\'node-addon-api\').include_dir\\")",' ],. [ /[ ]("\|')<!$node -e ("\|'\|\\"\|\\')require\(("\|'\|\\"\|\\')nan("\|'\|\\"\|\\')$("\|'\|\\"\|\\')\)("

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\package.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	875
Entropy (8bit):	4.769200293012242
Encrypted:	false
SSDEEP:	24:bSALJfEMpH3Ew/ZUJWT7UabkkeuuTHQOk1v:b/EM1EwGITk8TOEv
MD5:	5AB0385299B2D3108FCA3EFC386539DF
SHA1:	BEF362157E17AA3C8A6F8820CBFE2CC66E54B25D
SHA-256:	CE81289803C2E91442052C9EDA09AE70F0FB53675E549022AEDBEE2D18345CE7
SHA-512:	9EAB10F765E6A3C00D32563022FE0DF14239A8668ABAF1CDBE87F664DAB355ECD4AC8BA50E91168E435882DD253AE41B066766BA5D024B0EE0CBF2C3B8DE9C70
Malicious:	false
Preview:	{. "author": {. "name": "Anna Henningsen",. "email": "anna@addaleax.net". },. "dependencies": {. "debug": "^4.1.1",. "get-uv-event-loop-napi-h": "^1.0.5",. "node-addon-api": "^3.0.0",. "node-gyp-build": "^4.2.1",. "ref-napi": "^2.0.1 \|\| ^3.0.2",. "ref-struct-di": "^1.1.0". },. "description": "A foreign function interface (FFI) for Node.js, N-API style",. "devDependencies": {. "fs-extra": "^9.0.0",. "mocha": "^7.1.1",. "nyc": "^15.0.0",. "prebuildify": "^4.0.0",. "prebuildify-ci": "^1.0.5",. "ref-array-di": "^1.2.1". },. "engines": {. "node": ">=10". },. "homepage": "http://github.com/node-ffi-napi/node-ffi-napi",. "license": "MIT",. "main": "./lib/ffi",. "name": "ffi-napi",. "repository": {. "type": "git",. "url": "git+ssh://git@github.com/node-ffi-napi/node-ffi-napi.git". },. "version": "4.0.3".}

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\prebuilds\darwin-x64\node.napi.uv1.node

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	136444
Entropy (8bit):	5.687981501209651
Encrypted:	false
SSDEEP:	3072:SWTxcGpXA52LxlUJ6fFdDP8Vspybzq38UkBXRQ:DpFdYwybGkBXRQ
MD5:	FFF7F846166615943BCA9C8B79C4C7B4
SHA1:	BD00DD2D40F79C509D8E347936C5E6C7425AB6F8
SHA-256:	D373D88695CAD6206E9160593057FBDF5D7C135F5046E3F9AD7327B4E0520977
SHA-512:	B1321AF244EA7FC052704C7C04E20C8BC1069C386303FE383172554C0DE1524FD51CD9B301DD6BCB316C999B6EA520DA8F51071566EAC3103117A8114F6A6ABA
Malicious:	false
Preview:	........................................__TEXT...................`...............`......................__text..........__TEXT..................V.......................................__stubs.........__TEXT..........V.......@.......V...............................__stub_helper...__TEXT..........................................................__gcc_except_tab__TEXT..........@...............@...............................__const.........__TEXT..........0=......0.......0=..............................__cstring.......__TEXT..........`@......-.......`@..............................__unwind_info...__TEXT...........G...............G..............................__eh_frame......__TEXT.......... K...... ....... K..................................x...__DATA...........`...............`..............................__nl_symbol_ptr.__DATA...........`...............`..................`...........__got...........__DATA...........`...............`..................b...........__la_symbol_ptr.__DATA..

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\prebuilds\linux-arm64\node.napi.uv1.armv8.node

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	126792
Entropy (8bit):	5.823023079634132
Encrypted:	false
SSDEEP:	3072:1m6bB2dnsnRaAWiRzV1IhZQehqUnPnP7Vs3:VbBusXWSV13tWP7Vg
MD5:	3ECBB36951061CD528577F0C3197E0AF
SHA1:	4928B52EF6823C05893759D6B949F431B7E2E016
SHA-256:	41D483C3343E171102C408BBBE00A15676DD0061170A095A91CA8B21CE7486FF
SHA-512:	0407BF87A8EFAD2DB486EFDB6264E72E535E5AD7C79394B230E6AF345DEE3E67CA6CCB15F48A387D09360B9D753E6242A4B302A1028FCAE053995A6B2DB59DE4
Malicious:	false
Preview:	.ELF.....................]......@...................@.8...@.....................................................................................................p.......................8.......8.......8...............................................................$.......$...............P.td.....W.......W.......W......\.......\...............Q.td....................................................R.td............................`.......`...........................GNU..'0g..U.U.9..at.+.....a...................@....."...H@..........I.............l...".I..."@H...A....h.Q.0... ..0.a..2.. ...n......=8.....................Q..+. ..............................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\prebuilds\linux-x64\node.napi.uv1.node

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	141088
Entropy (8bit):	5.874863824120946
Encrypted:	false
SSDEEP:	1536:4EnLobBd9t+bnB1lfeLi6qFaoR7bnTW2E5kVrDTyX/+fAzbHjX0hYnvNd1FEb9DD:4nbBd6TL6qLR7b7VDU/jX0hYFKPTS
MD5:	333FC5B2DBCE55C3FFDE1083AB76F3CE
SHA1:	32564326567E9DADED173E354A2EF2BDFDD6ED17
SHA-256:	FA890D3EFE4457D7FB390CD65E29A8D5628D6AF12F84EB1806711CEDC75E9004
SHA-512:	25F6E28E035A727D9A06BB53EC08DA1ECD1148832117F6C663A1571BA5AB5DF395B6283F1F178CF9A8FC1C5C06D8C67A90EC354D70A052D7DAAD22CB80A194C4
Malicious:	false
Preview:	.ELF..............>......Z......@....... ...........@.8...@. ..................................................... .............`.......`.!.....`.!.....8................. .............X.......X.!.....X.!.............................................................$.......$...............P.td....P.......P.......P.......T.......T...............Q.td....................................................R.td....`.......`.!.....`.!.........................................GNU...;.Q.@n1.n.s.`........a...................@..........@..........I.............l...".I..."@H...A....h.Q.0... ..0.a..2.. ...n2.....=8.....................Q..+. ..............................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\prebuilds\win32-ia32\node.napi.uv1.node

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	479744
Entropy (8bit):	5.951544867533208
Encrypted:	false
SSDEEP:	6144:nRCAWMgXdMAnqNf5WM8GEYo6cBfm6RUStHhlgdF8:Rp7+uOqNf5W/GfBclvfCdm
MD5:	52CF682D79FD3A384603D175D591A12C
SHA1:	D0598EF1875C9069053BBB5D184AA3431CF9649F
SHA-256:	E2A3918AA995527FE9D2A7428196C98C258A02CAB1ACBF15FF0CE4425E1D4395
SHA-512:	9392A6E917C902DEE60F7134441C3DA19CC94C842BC884BFCF131DE1C6217927BE0AB29683D16E846B5581CE1011DB12930B5D273753D4C2D995DA1E9D816D3A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........>D.D_.D_.D_.....M_.....?_.....\_...).V_.....T_.....@_...).E_.../.f_....G_.D_+.._.../.A_....E_.....E_...(.E_.RichD_*.................PE..L...mPS`...........!.........`......2........ ............................................@.............................n....1..(....p..<........................-......8...............................@............0.......@..@....................text............................... ..`.rdata....... ......................@..@.data...p(..........................@....idata.......0......................@..@.didat.......@......................@....gfids.......P......................@..@.00cfg.......`......................@..@.rsrc...<....p......................@..@.reloc...4.......6..................@..B................................................................................................................

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\prebuilds\win32-x64\node.napi.uv1.node

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	602112
Entropy (8bit):	5.762931028900686
Encrypted:	false
SSDEEP:	12288:SIAsJ4jRp/N37hbzMqG7WtBNRjaDepQCKKO:UsJ4jRtN37hbzMqG7Wp4DepQA
MD5:	D1F6E50334A50A3F1F8E35E02D788AD9
SHA1:	1EAB95B23D8EF82BB3171ED751EB14E178CB88D2
SHA-256:	B0E0C6AD80FCCC92A41F644AFE3AD1D7E4EBCAC9CAA94A9CCF4EAA0DEA2247E3
SHA-512:	9F40996F4A8A5C6FE17687162306A02A5292FFB82BF62A0A7AFA4AF8F4F52F6D44BFF34B8E14CF936EA9C51780603CFAA0A9CE84935A7B509892E51BE18B2C03
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.,...B...B...B..S....B..S..\|.B..S....B.<.A...B.<.F...B...F...B...A...B.<.G.&.B..0....B...C...B...G...B...B...B.......B...@...B.Rich..B.................PE..d....PS`.........." .........T.......>....................................................`.............................................n....D..(.......<........M.................. ...8...........................`................@.......`..@....................text............................... ..`.rdata..............................@..@.data....7..........................@....pdata...V.......X..................@..@.idata..#....@......................@..@.didat..e....`......................@....gfids..k....p......................@..@.00cfg..............................@..@.rsrc...<...........................@..@.reloc..............................@..B........................................................

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\src\ffi.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4193
Entropy (8bit):	4.972965307419885
Encrypted:	false
SSDEEP:	96:jeTG0n9lgF8XVW+dDYjzUA+JxScH7qx8YppsiOE+mAy9rby+/SM:jeTvDYNaS/O/iOEhN9qi
MD5:	7A7C5321C07E9B1048A0254E97AB590D
SHA1:	80B7671D5AD3F5B13AEE40E57E5FEF87E11F6A1A
SHA-256:	994013BB6DC9261A38F431CA768ED31C3C360ACDC3DAE64D75ECC70B187947CC
SHA-512:	AEB11EB2D14766ED33EC330EA811D2E00503B6CEE2C7F6F791977757728D2453B59E3C6C1047E9D16CFF00D0F1AC951B35ED6568886C6CBE8FD0772E221A2318
Malicious:	false
Preview:	#include <uv.h>.#include <napi.h>..#include <limits.h>.#include <errno.h>.#ifndef __STDC_LIMIT_MACROS.#define __STDC_LIMIT_MACROS true.#endif.#include <stdint.h>.#include <queue>.#include <memory>.#include <unordered_map>..#ifdef WIN32.#include "win32-dlfcn.h".#else.#include <dlfcn.h>.#endif..#include "ref-napi.h"../* define FFI_BUILDING before including ffi.h because this is a static build /.#define FFI_BUILDING.#include <ffi.h>..#define FFI_ASYNC_ERROR static_cast<ffi_status>(1)..namespace FFI {..using namespace Napi;..class InstanceData;../. * Class used to store stuff during async ffi_call() invokations.. /..class AsyncCallParams {. public:. explicit AsyncCallParams(Env env_) : env(env_) {}. Env env;. ffi_status result;. std::string err;. ffi_cif cif;. char* fn;. char* res;. void** argv;. FunctionReference callback;. uv_work_t req;.};..class FFI {. public:. static Object InitializeStaticFunctions(Env env);. static void InitializeBindings(En

C:\Program Files (x86)\????????\resources\app\node_modules\ffi-napi\src\win32-dlfcn.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1101
Entropy (8bit):	4.849545801541321
Encrypted:	false
SSDEEP:	24:VuDFf8+uzsNkeMgzqmgS68hHYmxXL91tKs9/quMMeE:Vw5uYNd96o4mxXB1Meiu5eE
MD5:	55F9B83D3B32CB251A94F013EF519487
SHA1:	DE4A87A01403D5CD767F306C9C098B3A5DAFBB97
SHA-256:	A2C5DD5E861E4498F08DD847A36E716B6F2E2FDA809F93CAE9B4BBAFC4BEC553
SHA-512:	806DA440EC698DD29DEFA865E61B639C56939008D32A66E930DC8E5F5787E31675F8CC51A16140C03EBB686507E2BCEE5199B08BDFD9E4E8FFE5D0A350790999
Malicious:	false
Preview:	/*. @file Minimal emulation of POSIX dlopen/dlsym/dlclose on Windows.. * @license Public domain.. . This code works fine for the common scenario of loading a. * specific DLL and calling one (or more) functions within it.. * No attempt is made to emulate POSIX symbol table semantics.. /..#ifndef _INCLUDE_DLFCN_H_.#define _INCLUDE_DLFCN_H_..#ifdef __cplusplus.extern "C" {.#endif..#define RTLD_LAZY 0.#define RTLD_NOW 0.#define RTLD_GLOBAL 0.#define RTLD_LOCAL 0..#define RTLD_DEFAULT ((void) NULL).#define RTLD_NEXT ((void) NULL)../. Open DLL, returning a handle.. /..void.dlopen(. const char file, /* DLL filename. /. int mode /* mode flags (ignored). /.);../. Close DLL.. /..int.dlclose(. void handle /** Handle from dlopen(). /.);../. Look up symbol exported by DLL.. /..void.dlsym(. void* handle, /** Handle from dlopen(). /. const char name /** Name of exported symbol. /.);../.

C:\Program Files (x86)\????????\resources\app\node_modules\follow-redirects\LICENSE

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1136
Entropy (8bit):	5.154443391618571
Encrypted:	false
SSDEEP:	24:9hrOJH7H0yxgtUHw1hC09QHOsUv4eOk4/+/boBoqy4FD:9hSJrlxEvdQHOs5excBowFD
MD5:	2913574E921AEFE1275CD5864B4F9B66
SHA1:	B3598D193B623FBA8216FF61F67CDB66A4F26C40
SHA-256:	BFA8A54BB952CCDA79F0F1889721D108F5B605BABBB2B8A3705FFB52F4132EB7
SHA-512:	E2259701F5D70901EAD0EAF1B6B7606C466B167169E57D243C3865900570393AACC723AE0AB9628BED5382DC76FFD820E33DF9B18EA9D2A6CC0970DDA8307DD1
Malicious:	false
Preview:	Copyright 2014.present Olivier Lalonde <olalonde@gmail.com>, James Talmage <james@talmage.io>, Ruben Verborgh..Permission is hereby granted, free of charge, to any person obtaining a copy of.this software and associated documentation files (the "Software"), to deal in.the Software without restriction, including without limitation the rights to.use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies.of the Software, and to permit persons to whom the Software is furnished to do.so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,.WHETHER IN AN ACTIO

C:\Program Files (x86)\????????\resources\app\node_modules\follow-redirects\debug.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	315
Entropy (8bit):	4.508868381039866
Encrypted:	false
SSDEEP:	6:qEqIYBQE2UDQ4EkAxDZNQCFKgCmaHVNifG3wFa+XK7PQCFewEv/FiECLESWoW:8BR2yQ4sNggBlFgf0F8LEHoW
MD5:	8CA5D5ED865107A8509FAAA751B01F2F
SHA1:	42E41336009FEBAD983C2E1AD574F33D17088386
SHA-256:	8DBF7E71A9292BE180E3469A6B7A164171D3C39DEC79E5DBC4AA1C9F09509FAF
SHA-512:	878B2A158CAFF5FF0B464206F3D1876CAA2F91D9924EDC9945B50A164920D21F414DD2030290A279BFA019EC03E49AE8C72EE42AC2DF421B7AC83A8DAB922925
Malicious:	false
Preview:	var debug;..module.exports = function () {. if (!debug) {. try {. /* eslint global-require: off /. debug = require("debug")("follow-redirects");. }. catch (error) { / / }. if (typeof debug !== "function") {. debug = function () { / */ };. }. }. debug.apply(null, arguments);.};.

C:\Program Files (x86)\????????\resources\app\node_modules\follow-redirects\http.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	37
Entropy (8bit):	4.337435460048129
Encrypted:	false
SSDEEP:	3:3BBBbJA9avn:xBBOavn
MD5:	F94BFD10B869E19D4EBF749CCBC44FB4
SHA1:	421F81884053079054CCE769DDE18AE3215DE81D
SHA-256:	754C0078C57625DB7B55B4C3FB30FF5C207FC49284A5022742E81D0C595403C5
SHA-512:	73D000123449665CA9B99FE0E08C1DF5680B2C1EC2B2F3753D65860C06607C76212F8ECFC2533262272C937259D880C46BA29DE7F92EF02A0B654A9CC648FF33
Malicious:	false
Preview:	module.exports = require("./").http;.

C:\Program Files (x86)\????????\resources\app\node_modules\follow-redirects\https.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	38
Entropy (8bit):	4.346225868535944
Encrypted:	false
SSDEEP:	3:3BBBbJA9Sw:xBBOSw
MD5:	4DB3F05178B291F5F607F677D82D064F
SHA1:	041F66C64E56C3F69535054924B55BEF833723D2
SHA-256:	7A28E323FFD91094E083A8954FE027839C06D948603D7F2719ED17C446885272
SHA-512:	6C818187785A73E073C4A2C482CACF4FABB6577A2E52B9C049F6B76E30EE6AA20EE921DCB0652E89145AF74159D94871507CA11A57CD3EF1BD919BA7A6810DBF
Malicious:	false
Preview:	module.exports = require("./").https;.

C:\Program Files (x86)\????????\resources\app\node_modules\follow-redirects\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	17645
Entropy (8bit):	4.828768167532486
Encrypted:	false
SSDEEP:	384:rWpQudGZIiJbOC/7xNwpoj54JWazbe+g7KdoevhX/X8TgVEAjO:rNxSxZZg7KdVX/XegVE
MD5:	B03F6AF66FA0EE2FCD70F70FA773ABCE
SHA1:	B546DFF3CEFE24F2EDB1EBA58FAC402C6E7664D0
SHA-256:	960F89167BAE370FE778653554A73347A301D46FBBB217214B4A104B60B04C4E
SHA-512:	C61281E5BFEE1194E681A6C2A35F9F77CDF9440D1A2BEC82F0DFD5ECF5B3676945281B9A16F29691876841614951B42EE45E01231C9F3B950EDBB3DFB045601B
Malicious:	false
Preview:	var url = require("url");.var URL = url.URL;.var http = require("http");.var https = require("https");.var Writable = require("stream").Writable;.var assert = require("assert");.var debug = require("./debug");..// Create handlers that pass events from native requests.var events = ["abort", "aborted", "connect", "error", "socket", "timeout"];.var eventHandlers = Object.create(null);.events.forEach(function (event) {. eventHandlers[event] = function (arg1, arg2, arg3) {. this._redirectable.emit(event, arg1, arg2, arg3);. };.});..// Error types with codes.var RedirectionError = createErrorType(. "ERR_FR_REDIRECTION_FAILURE",. "Redirected request failed".);.var TooManyRedirectsError = createErrorType(. "ERR_FR_TOO_MANY_REDIRECTS",. "Maximum number of redirects exceeded".);.var MaxBodyLengthExceededError = createErrorType(. "ERR_FR_MAX_BODY_LENGTH_EXCEEDED",. "Request body larger than maxBodyLength limit".);.var WriteAfterEndError = createErrorType(. "ERR_STREAM_WRITE_AFTER_END"

C:\Program Files (x86)\????????\resources\app\node_modules\follow-redirects\package.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	916
Entropy (8bit):	4.743765395943424
Encrypted:	false
SSDEEP:	24:bS9h4W5SRJIR2AniJmZoWze1WU8m5gt/GOA1ug:b6v5SRW2AnrZvqaWgtOOIug
MD5:	E24AEAFC6282F1D97CAC70EAB2A9F4F8
SHA1:	2CEEB68E08CD63EBEA6C3C23E0ED054D06E3053B
SHA-256:	A68E9BDBE5766878B4242DC1921E408C78521B6D6DC4FDF0A68E1CF0A15DFE6C
SHA-512:	447A692F3032568B4E81B0D82150CF47D0A73CA27B5D947373C20E6E7F66BA198411FA918F59FCD0F3EEDB97EF6A8C8FA8F9348236E2EA6C041F51C80E61EF44
Malicious:	false
Preview:	{. "author": {. "name": "Ruben Verborgh",. "email": "ruben@verborgh.org",. "url": "https://ruben.verborgh.org/". },. "description": "HTTP and HTTPS modules that follow redirects.",. "devDependencies": {. "concat-stream": "^2.0.0",. "eslint": "^5.16.0",. "express": "^4.16.4",. "lolex": "^3.1.0",. "mocha": "^6.0.2",. "nyc": "^14.1.1". },. "engines": {. "node": ">=4.0". },. "files": [. "*.js". ],. "funding": [. {. "type": "individual",. "url": "https://github.com/sponsors/RubenVerborgh". }. ],. "homepage": "https://github.com/follow-redirects/follow-redirects",. "license": "MIT",. "main": "index.js",. "name": "follow-redirects",. "peerDependenciesMeta": {. "debug": {. "optional": true. }. },. "repository": {. "type": "git",. "url": "git+ssh://git@github.com/follow-redirects/follow-redirects.git". },. "version": "1.14.9".}

C:\Program Files (x86)\????????\resources\app\node_modules\fs-extra\LICENSE

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1084
Entropy (8bit):	5.1035625531374365
Encrypted:	false
SSDEEP:	24:Cr4JH5HH0yPPYt4Hw1hl9MPHcs648Ok4/+wYo3HxFD:C8JxlPkrvMPHcsTIC3RFD
MD5:	EA817882455C03503F7D014A8F54F095
SHA1:	DD164BC611BCA7BA8EAD40EC4C2851081E5A16B9
SHA-256:	1E76029602AE9B21CC4E612DB2496D92FEBED882BA13BA745F8B3309E85F9D39
SHA-512:	0EA343D0E696BA27877DC0611766C526AA73F6E7AF46DF5A0F83840DC4C7851FB5837B7F6BDA8A014302BF877FE3B4B3E392B943CEFB3AF979E8AFC67559A5FF
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2011-2017 JP Richardson..Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files.(the 'Software'), to deal in the Software without restriction, including without limitation the rights to use, copy, modify,. merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is. furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE.WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS.OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,. ARISING FROM, OUT

C:\Program Files (x86)\????????\resources\app\node_modules\fs-extra\lib\copy\copy-sync.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5776
Entropy (8bit):	4.784741734651033
Encrypted:	false
SSDEEP:	96:TI+dXKds8sFhjf7cr3AzOalAvxx6OLItjCKsMm+qmn6iv0EWg5C5KfM2JQD0N:TIeADyNf3zrmxBSCKsx+qmn6iv0v+C5+
MD5:	5FFF9A20FADAC6CD5EBE23DD28D4FA1C
SHA1:	63F02F565B741C3148D2A1D16B92ECAF353CD05D
SHA-256:	A50856FE7FAB3D1D22E8FBF5F32543D46342257CAD5E31DF8F2A7409FDF19C97
SHA-512:	88E675BE5C57F20EF6015892CEA7F79303991EE0A6974A7DB105E8327572F554ABDD76D126ACE3A07CD360738617BEADAAA8254933A18E386F91C28B51A36388
Malicious:	false
Preview:	'use strict'..const fs = require('graceful-fs').const path = require('path').const mkdirsSync = require('../mkdirs').mkdirsSync.const utimesMillisSync = require('../util/utimes').utimesMillisSync.const stat = require('../util/stat')..function copySync (src, dest, opts) {. if (typeof opts === 'function') {. opts = { filter: opts }. }.. opts = opts \|\| {}. opts.clobber = 'clobber' in opts ? !!opts.clobber : true // default to true for now. opts.overwrite = 'overwrite' in opts ? !!opts.overwrite : opts.clobber // overwrite falls back to clobber.. // Warn about using preserveTimestamps on 32-bit node. if (opts.preserveTimestamps && process.arch === 'ia32') {. process.emitWarning(. 'Using the preserveTimestamps option in 32-bit node is not recommended;\n\n' +. '\tsee https://github.com/jprichardson/node-fs-extra/issues/269',. 'Warning', 'fs-extra-WARN0002'. ). }.. const { srcStat, destStat } = stat.checkPathsSync(src, dest, 'copy', opts). stat.checkParentPat

C:\Program Files (x86)\????????\resources\app\node_modules\fs-extra\lib\copy\copy.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7756
Entropy (8bit):	4.655061712735711
Encrypted:	false
SSDEEP:	192:MPIeAE4wH/d+ENXZCI+9MqhvQKrC4qeN0GbUEypnf4du:sT+PoKmNaUsu
MD5:	804010A645F486C177C203770C4F4BAF
SHA1:	04F7A9677E48834CBBF086E3FECEEAF7BD0E3822
SHA-256:	B1EF00CADD368EA903C9A86927E40636CD832D8FA64344637C96E0E223FAF876
SHA-512:	8A8896DBC7C9ED251C1083C131A31108B236DD756608AB314B26923FEA667052C2AE7CE72A5F6F317A294DA2983E9A0C4BAB9B862547E4AF2EFF298CA86FD4E5
Malicious:	false
Preview:	'use strict'..const fs = require('graceful-fs').const path = require('path').const mkdirs = require('../mkdirs').mkdirs.const pathExists = require('../path-exists').pathExists.const utimesMillis = require('../util/utimes').utimesMillis.const stat = require('../util/stat')..function copy (src, dest, opts, cb) {. if (typeof opts === 'function' && !cb) {. cb = opts. opts = {}. } else if (typeof opts === 'function') {. opts = { filter: opts }. }.. cb = cb \|\| function () {}. opts = opts \|\| {}.. opts.clobber = 'clobber' in opts ? !!opts.clobber : true // default to true for now. opts.overwrite = 'overwrite' in opts ? !!opts.overwrite : opts.clobber // overwrite falls back to clobber.. // Warn about using preserveTimestamps on 32-bit node. if (opts.preserveTimestamps && process.arch === 'ia32') {. process.emitWarning(. 'Using the preserveTimestamps option in 32-bit node is not recommended;\n\n' +. '\tsee https://github.com/jprichardson/node-fs-extra/issues/269',

C:\Program Files (x86)\????????\resources\app\node_modules\fs-extra\lib\copy\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	147
Entropy (8bit):	4.754574580784623
Encrypted:	false
SSDEEP:	3:agWAvGKLWnJ4LMMGEJMDcPTJb0BbmOOuwAUQhzNhFXFXAUk5eC/:QKGqMRgMeN0BSOOJWh9FQDES
MD5:	6C5FAA4EE2D127AFC7B6C104DFFB7E83
SHA1:	87C79A964F170540C2117198144011ABAE54A27D
SHA-256:	F94AD0B8C5F5131A682BE2D0427189C260E49FA748FB6F6BCC1F78678354E5D2
SHA-512:	CDD6B740F89E9D535A526196BF319AF18720537219CDA5B55C201EAD6F4180DDD68912DFD2F5974C3C13DD7E29C57AA60538E5590DAB646DCFDA522FF07C3145
Malicious:	false
Preview:	'use strict'..const u = require('universalify').fromCallback.module.exports = {. copy: u(require('./copy')),. copySync: require('./copy-sync').}.

C:\Program Files (x86)\????????\resources\app\node_modules\fs-extra\lib\empty\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	747
Entropy (8bit):	4.613486455525382
Encrypted:	false
SSDEEP:	12:oqMqTWFuCCoX+ctJxl+wfMiyBOgwihJ2pfyvyBHFQMKhwPyiLm0Bp31Q:JMqqX7BmiSYizDvSHFQMK2PyiLrBp31Q
MD5:	61A5CC7024F38B1966C1D0BB15C54E4B
SHA1:	30ED3A4D4899176386A40DAD0CECC0DEB37C657A
SHA-256:	1096EDCB5EC0ED015B36914BEFF0826F6CD5D7CE2645EE9DEE60C0B272E57856
SHA-512:	D53543E4DD6CD967C7F2EF9B602E926952052F76F145A67F1F4052866944AAB5E023F0A612168D740A3E1BF971319940292C557D3F1704E18B95194A6C09A100
Malicious:	false
Preview:	'use strict'..const u = require('universalify').fromPromise.const fs = require('../fs').const path = require('path').const mkdir = require('../mkdirs').const remove = require('../remove')..const emptyDir = u(async function emptyDir (dir) {. let items. try {. items = await fs.readdir(dir). } catch {. return mkdir.mkdirs(dir). }.. return Promise.all(items.map(item => remove.remove(path.join(dir, item)))).})..function emptyDirSync (dir) {. let items. try {. items = fs.readdirSync(dir). } catch {. return mkdir.mkdirsSync(dir). }.. items.forEach(item => {. item = path.join(dir, item). remove.removeSync(item). }).}..module.exports = {. emptyDirSync,. emptydirSync: emptyDirSync,. emptyDir,. emptydir: emptyDir.}.

C:\Program Files (x86)\????????\resources\app\node_modules\fs-extra\lib\ensure\file.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1709
Entropy (8bit):	4.4491689931753795
Encrypted:	false
SSDEEP:	48:JXkyWt+nlPt2EgCnyjuPeXgJdtuQSjuPM0yyjzcF:J0fwn//zyjFkZSjwjjza
MD5:	CF3696FE43FE778D704FCF8FCD486D74
SHA1:	80C2A847A193AB5A9732746B6F5953CB50593F33
SHA-256:	A104FF42C9AEFD0E34556B9DF2E4B5C9CD15315B0B0F70B07938901428B3C608
SHA-512:	CE5CC7FB9FA23A2ED9489E17FCC9702D6291EC656E2C6C56A340C14E60CF154FC3D9FD274C59E3FCEE7C940ED0C66A0E1D56476B11B0C554126B37BA15A9C571
Malicious:	false
Preview:	'use strict'..const u = require('universalify').fromCallback.const path = require('path').const fs = require('graceful-fs').const mkdir = require('../mkdirs')..function createFile (file, callback) {. function makeFile () {. fs.writeFile(file, '', err => {. if (err) return callback(err). callback(). }). }.. fs.stat(file, (err, stats) => { // eslint-disable-line handle-callback-err. if (!err && stats.isFile()) return callback(). const dir = path.dirname(file). fs.stat(dir, (err, stats) => {. if (err) {. // if the directory doesn't exist, make it. if (err.code === 'ENOENT') {. return mkdir.mkdirs(dir, err => {. if (err) return callback(err). makeFile(). }). }. return callback(err). }.. if (stats.isDirectory()) makeFile(). else {. // parent is not a directory. // This is just to cause an internal ENOTDIR error to be thrown. fs.readdir(dir, err => {.

C:\Program Files (x86)\????????\resources\app\node_modules\fs-extra\lib\ensure\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	542
Entropy (8bit):	4.452552043669699
Encrypted:	false
SSDEEP:	12:oz3cRbZ4Lobsc19Tc1tobgzBp9fcVvRMI8RRczVHOJjzXJwRRHoJKTTc13Tc1hOh:McILi3QDLzBp9fcoLszVb4JgQtQ91Q0g
MD5:	5CCA6EBC01319F902EA96524EB51D0E7
SHA1:	F5CA7320904103DB5FE126730F34CAFD25F2BCAE
SHA-256:	77CCB9B4D1EAB607CE7BA8D3D5BED59B0CB9CC4748D02AA896A2413B71DBFE60
SHA-512:	CA42F90FE6CB581084B809E61BC2838402DC52FD8B54BE39F2249E394B27A34312B38FE082E3D7D79AD4B8D3BCCD6ED18C9BD2C1531D6DA0C940644926C78E7B
Malicious:	false
Preview:	'use strict'..const { createFile, createFileSync } = require('./file').const { createLink, createLinkSync } = require('./link').const { createSymlink, createSymlinkSync } = require('./symlink')..module.exports = {. // file. createFile,. createFileSync,. ensureFile: createFile,. ensureFileSync: createFileSync,. // link. createLink,. createLinkSync,. ensureLink: createLink,. ensureLinkSync: createLinkSync,. // symlink. createSymlink,. createSymlinkSync,. ensureSymlink: createSymlink,. ensureSymlinkSync: createSymlinkSync.}.

C:\Program Files (x86)\????????\resources\app\node_modules\fs-extra\lib\ensure\link.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	4.549334689634962
Encrypted:	false
SSDEEP:	24:JMqft4tRLQZbtnJJ2xToRTWe2xii2LwOp8obWP2hGbWPBp9nkgz4wzrkLmcSawbd:J4tRUIv5ynNzrmekTtjvA
MD5:	4B05FBD2FAD601695C18C2E1504A7C2B
SHA1:	09355BA54B37B58011B390A04E33A928F28F8A51
SHA-256:	339CE737E858367C65F79C0960BC6D1D617638AAE07D396AC8AE5C8670B500C3
SHA-512:	C604958B7A5EE99CD8686324A5D4D56B949FFED5AD427B760DED55A8D19424EC59578AF55938E5774FCFE39821CB55E51611027293335FBBA90DA02245B9722F
Malicious:	false
Preview:	'use strict'..const u = require('universalify').fromCallback.const path = require('path').const fs = require('graceful-fs').const mkdir = require('../mkdirs').const pathExists = require('../path-exists').pathExists.const { areIdentical } = require('../util/stat')..function createLink (srcpath, dstpath, callback) {. function makeLink (srcpath, dstpath) {. fs.link(srcpath, dstpath, err => {. if (err) return callback(err). callback(null). }). }.. fs.lstat(dstpath, (_, dstStat) => {. fs.lstat(srcpath, (err, srcStat) => {. if (err) {. err.message = err.message.replace('lstat', 'ensureLink'). return callback(err). }. if (dstStat && areIdentical(srcStat, dstStat)) return callback(null).. const dir = path.dirname(dstpath). pathExists(dir, (err, dirExists) => {. if (err) return callback(err). if (dirExists) return makeLink(srcpath, dstpath). mkdir.mkdirs(dir, err => {. if (err) return callback(err).

C:\Program Files (x86)\????????\resources\app\node_modules\fs-extra\lib\ensure\symlink-paths.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3374
Entropy (8bit):	4.458586624773849
Encrypted:	false
SSDEEP:	48:1twWV99H9M4w0hI6UmFwB7C9e6d2Uk+CyT51pwdS+avt+J6T5wQAZR36y:1tX99H9Hb4mmBO9e6W/grpV+LIWQw6y
MD5:	BE9C8F74132D37198FABEE775B684481
SHA1:	50FBB32D40B697A96FDE72B07259933A9A72411A
SHA-256:	5595B764059FB90CE4A13F5CDF43988DA97E636521D3C599CE5260681D75BDFC
SHA-512:	BE3430875E0FEC0030C263AAC0757B559A4FDC3ACCD681D2BF58371BE1873D6EB959BD3678B7B72D8B785C4B74215560BB9BD169B5B81AC689C9080CDF905156
Malicious:	false
Preview:	'use strict'..const path = require('path').const fs = require('graceful-fs').const pathExists = require('../path-exists').pathExists../*. Function that returns two types of paths, one relative to symlink, and one. * relative to the current working directory. Checks if path is absolute or. * relative. If the path is relative, this function checks if the path is. * relative to symlink or relative to current working directory. This is an. * initiative to find a smarter `srcpath` to supply when building symlinks.. * This allows you to determine which path to use out of one of three possible. * types of source paths. The first is an absolute path. This is detected by. * `path.isAbsolute()`. When an absolute path is provided, it is checked to. * see if it exists. If it does it's used, if not an error is returned. * (callback)/ thrown (sync). The other two options for `srcpath` are a. * relative url. By default Node's `fs.symlink` works by creating a symlink. * using `dstpath` and expects

C:\Program Files (x86)\????????\resources\app\node_modules\fs-extra\lib\ensure\symlink-type.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	694
Entropy (8bit):	4.574450216943041
Encrypted:	false
SSDEEP:	12:o7H23t405elS5e+jSMkQEiF51M4VNfEl22jSP4dFpMpVYB16uLC:EHwt405eI5e+oQ15zfElJUmFpYVYBC
MD5:	75871BC803A6046DEEFE24A3F02F4F3D
SHA1:	60686B2062037AFE9661F006A43E124441409353
SHA-256:	17ABE9590176305DD04316B2AC5C972DCF54CEA32D279F955FBCF25098743DC8
SHA-512:	A6702949CDC3B80AFA6AF280508C9514CD4F98907F2B109FF1AB63E030FDB9E9C1BE6117D52B4F603BD402EC9FC1EF2A3E5B234280679D0CC4B8F043E0DE96AF
Malicious:	false
Preview:	'use strict'..const fs = require('graceful-fs')..function symlinkType (srcpath, type, callback) {. callback = (typeof type === 'function') ? type : callback. type = (typeof type === 'function') ? false : type. if (type) return callback(null, type). fs.lstat(srcpath, (err, stats) => {. if (err) return callback(null, 'file'). type = (stats && stats.isDirectory()) ? 'dir' : 'file'. callback(null, type). }).}..function symlinkTypeSync (srcpath, type) {. let stats.. if (type) return type. try {. stats = fs.lstatSync(srcpath). } catch {. return 'file'. }. return (stats && stats.isDirectory()) ? 'dir' : 'file'.}..module.exports = {. symlinkType,. symlinkTypeSync.}.

C:\Program Files (x86)\????????\resources\app\node_modules\fs-extra\lib\ensure\symlink.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2522
Entropy (8bit):	4.691944586456869
Encrypted:	false
SSDEEP:	48:JCAtA8eC3LiPKMPK4MvL1u0JRb8DhZKMXOta9lqfRkVbQ+xjQNWQI:J5tBeWOHMz1/RA3XZ0RmEsjQNWQI
MD5:	D753DFF5D513BD78C5C7F612316B077E
SHA1:	A22DAB4094787907AF298A0F64CB06D566D0D36C
SHA-256:	8B1FA73E5B5554380B710CCFBB4FE23764E53F0E5CE046689741310A82A19E21
SHA-512:	3ACAFBA8EEB45357AD405C2CB8029497FBA9734F84622548514604FA59313867BCA2065E116401E444C9FF6F82640CF4968CB1BA9B7D6F3325DBD06BD87CADCB
Malicious:	false
Preview:	'use strict'..const u = require('universalify').fromCallback.const path = require('path').const fs = require('../fs').const _mkdirs = require('../mkdirs').const mkdirs = _mkdirs.mkdirs.const mkdirsSync = _mkdirs.mkdirsSync..const _symlinkPaths = require('./symlink-paths').const symlinkPaths = _symlinkPaths.symlinkPaths.const symlinkPathsSync = _symlinkPaths.symlinkPathsSync..const _symlinkType = require('./symlink-type').const symlinkType = _symlinkType.symlinkType.const symlinkTypeSync = _symlinkType.symlinkTypeSync..const pathExists = require('../path-exists').pathExists..const { areIdentical } = require('../util/stat')..function createSymlink (srcpath, dstpath, type, callback) {. callback = (typeof type === 'function') ? type : callback. type = (typeof type === 'function') ? false : type.. fs.lstat(dstpath, (err, stats) => {. if (!err && stats.isSymbolicLink()) {. Promise.all([. fs.stat(srcpath),. fs.stat(dstpath). ]).then(([srcStat, dstStat]) => {.

C:\Program Files (x86)\????????\resources\app\node_modules\fs-extra\lib\fs\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3373
Entropy (8bit):	4.8239565211080055
Encrypted:	false
SSDEEP:	96:pqA+pBGaj8F0mpwe/YiC/ymVRcHGnx8sy5cnsr32tzJTH1:pqQaGYiayrH8Zy5cnltFL1
MD5:	3D18CFA482CE7CFA8C126727829FECDB
SHA1:	6A329E0CC604FEA83F292D8F0785BE3DF52A185A
SHA-256:	620B6E703880FD6718C354C5359A5C37A2379054C037269DBCF7AFD2503E4A6F
SHA-512:	2F9E430D818A48AA712EEB02A70A6E65D900984D9F818664C024D198FA4D2F3AAC139AB935D75947409700829BDA7A16EE41BE08AE9AF2A02811E43B74BF9259
Malicious:	false
Preview:	'use strict'.// This is adapted from https://github.com/normalize/mz.// Copyright (c) 2014-2016 Jonathan Ong me@jongleberry.com and Contributors.const u = require('universalify').fromCallback.const fs = require('graceful-fs')..const api = [. 'access',. 'appendFile',. 'chmod',. 'chown',. 'close',. 'copyFile',. 'fchmod',. 'fchown',. 'fdatasync',. 'fstat',. 'fsync',. 'ftruncate',. 'futimes',. 'lchmod',. 'lchown',. 'link',. 'lstat',. 'mkdir',. 'mkdtemp',. 'open',. 'opendir',. 'readdir',. 'readFile',. 'readlink',. 'realpath',. 'rename',. 'rm',. 'rmdir',. 'stat',. 'symlink',. 'truncate',. 'unlink',. 'utimes',. 'writeFile'.].filter(key => {. // Some commands are not available on some systems. Ex:. // fs.opendir was added in Node.js v12.12.0. // fs.rm was added in Node.js v14.14.0. // fs.lchown is not available on at least some Linux. return typeof fs[key] === 'function'.})..// Export cloned fs:.Object.assign(exports, fs)..// Universalify async methods:.a

C:\Program Files (x86)\????????\resources\app\node_modules\fs-extra\lib\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	358
Entropy (8bit):	4.4991333192690535
Encrypted:	false
SSDEEP:	6:QKIYBSCCXRPxMzRHXR6CzAMHLpp/L3sFWxADfamJotyxvDWK:dBpCBPxMzlB6CkeVp/Dswu7KyxSK
MD5:	E232567A1DDC2D3CD9C9B79CB25D56F3
SHA1:	B14E3F3C4C5AC2F761373E6377EABA7D23169A1D
SHA-256:	4967E903B3DC290F2B401B81BFCAD8B2D94FD68C1BF4563DF63AC082AF0E1DAE
SHA-512:	274EEFF55225E3B9E22A65443D2C33734FFDE680D8CE9FA8994D9B3966B4F3897DC5C8BD41DE811B212F7B9793BB31D5B988AD91596926B933EAB61C28B0AB2F
Malicious:	false
Preview:	'use strict'..module.exports = {. // Export promiseified graceful-fs:. ...require('./fs'),. // Export extra methods:. ...require('./copy'),. ...require('./empty'),. ...require('./ensure'),. ...require('./json'),. ...require('./mkdirs'),. ...require('./move'),. ...require('./output-file'),. ...require('./path-exists'),. ...require('./remove').}.

C:\Program Files (x86)\????????\resources\app\node_modules\fs-extra\lib\json\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	508
Entropy (8bit):	4.6917572403617225
Encrypted:	false
SSDEEP:	12:oqMqTQuvxJmovdbLbWPoou2PVvojEu2vSBntu2MBHN:JMqM9QdjW63X0bBt
MD5:	DBCED9952C4222C32A88BBA2D8B4EF06
SHA1:	047CEDB67B8047183DFDED82B56969C688DC5008
SHA-256:	C5AC6A8005308E5BB36619FED225C987872300D356FA95D0D56878029EBBDC45
SHA-512:	47860F155814C0744FBB2788010C0D8188E811E562B653FA5DE5C6B852B870A0D29C7E8CC6D1FA55278311B8C8625C93ED1435BF06CCF6E1598CA864B369E06A
Malicious:	false
Preview:	'use strict'..const u = require('universalify').fromPromise.const jsonFile = require('./jsonfile')..jsonFile.outputJson = u(require('./output-json')).jsonFile.outputJsonSync = require('./output-json-sync').// aliases.jsonFile.outputJSON = jsonFile.outputJson.jsonFile.outputJSONSync = jsonFile.outputJsonSync.jsonFile.writeJSON = jsonFile.writeJson.jsonFile.writeJSONSync = jsonFile.writeJsonSync.jsonFile.readJSON = jsonFile.readJson.jsonFile.readJSONSync = jsonFile.readJsonSync..module.exports = jsonFile.

C:\Program Files (x86)\????????\resources\app\node_modules\fs-extra\lib\json\jsonfile.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	238
Entropy (8bit):	4.573716472647597
Encrypted:	false
SSDEEP:	6:QKGVMZEuvIYBSCWogqTl5E4KX5xeEVvWQtlBJHvWQtKXBJeFn:oTuvIYBpxgurYVWOPWaCeF
MD5:	9A378D46C0C6A89B9E32D5C90AE44BE9
SHA1:	6631D5DAB8EA65A104DD9113357B4F0A2ADA6FCC
SHA-256:	A986AD3C13166F3BF8F30B18140BFC8EA1754760AB3802AA7C8C3780D54F07BA
SHA-512:	F3E3743064DCC5BCF399892415AB04D85B9CED33B35EF64B9AD9B65B000D77F25F1EA39A80B13D309A34B6DBF596D83FDAC825E7EBD001DB32CA4EC887D07510
Malicious:	false
Preview:	'use strict'..const jsonFile = require('jsonfile')..module.exports = {. // jsonfile exports. readJson: jsonFile.readFile,. readJsonSync: jsonFile.readFileSync,. writeJson: jsonFile.writeFile,. writeJsonSync: jsonFile.writeFileSync.}.

C:\Program Files (x86)\????????\resources\app\node_modules\fs-extra\lib\json\output-json-sync.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	276
Entropy (8bit):	4.5890260795441415
Encrypted:	false
SSDEEP:	6:QKGYr4FQAZMERGIeSobNmJuvdq3v3iqQpCWXCc0JLIIeaoZp3DBHEG:oYEFQtWteRbN+uvA/3+2LPehZpTBHZ
MD5:	D906E5CA3969A13D69D393621EE6B575
SHA1:	D1A6975DC8D44D7C8C3850923D0AA303673FD002
SHA-256:	A68FDE22AD1A194755DE03E90861805248F883342E05BD685258E76A90E7A6AB
SHA-512:	A2D3C6E3762C4F02BC83793274AB2D97D7356BDE2208272F9DA00C2D0F2A102AD9E8238824D0148CC70235F62E619241BC9C7C87661654DBA6F9F4092FE51E7B
Malicious:	false
Preview:	'use strict'..const { stringify } = require('jsonfile/utils').const { outputFileSync } = require('../output-file')..function outputJsonSync (file, data, options) {. const str = stringify(data, options).. outputFileSync(file, str, options).}..module.exports = outputJsonSync.

C:\Program Files (x86)\????????\resources\app\node_modules\fs-extra\lib\json\output-json.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	277
Entropy (8bit):	4.5468961117762765
Encrypted:	false
SSDEEP:	6:QKGYr4FQAZMERGIdFNmJuvEb5/N9Oiqa8CWXCc0JXKITrZp3DBHER:oYEFQtWt7N+uvEb5WI7XZTrZpTBHS
MD5:	AD5D1866F3563F3BBF6F92F6179F0F2A
SHA1:	7E1288FCD6AEE8740A0CD05264576B74A24B3990
SHA-256:	B738AAF8FF9AAE265B0512CB2554E1F8CE8605D21DC6230189A9BE6980079FC8
SHA-512:	B3B9C89CBECE7EB41AADE4611F68E97C2593534E679142909E9BF0EB33D4690931FC5C87723AD7BD1CE00310BCE5D20A69453F08EBCFEC1E7AA51DD826F8324C
Malicious:	false
Preview:	'use strict'..const { stringify } = require('jsonfile/utils').const { outputFile } = require('../output-file')..async function outputJson (file, data, options = {}) {. const str = stringify(data, options).. await outputFile(file, str, options).}..module.exports = outputJson.

C:\Program Files (x86)\????????\resources\app\node_modules\fs-extra\lib\mkdirs\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	328
Entropy (8bit):	4.623210286041676
Encrypted:	false
SSDEEP:	6:QuMRgMefyQA9bTdfIFbb7BSAy6OyQdlF4boE/X04Dn:BMqTyvb+Fbb7BiwJ0S
MD5:	9CC1D8BB2C89810566F60C0664D974B9
SHA1:	B0D9FCF6032F19505D113A6EA1BA769600751F28
SHA-256:	ADCD576E2E3868B94ADB1BAD6D1E3CF2312FFDFA71E49A57FE6247E116E75ECF
SHA-512:	58652F4F9E3A082A0471B2705472E126AB8249F1805F78C6966625AEAC306ED187323B0C4CC145EAFB39F6F9D0465AA8C2ABBE13F273AB2A722E03901994BB78
Malicious:	false
Preview:	'use strict'.const u = require('universalify').fromPromise.const { makeDir: _makeDir, makeDirSync } = require('./make-dir').const makeDir = u(_makeDir)..module.exports = {. mkdirs: makeDir,. mkdirsSync: makeDirSync,. // alias. mkdirp: makeDir,. mkdirpSync: makeDirSync,. ensureDir: makeDir,. ensureDirSync: makeDirSync.}.

C:\Program Files (x86)\????????\resources\app\node_modules\fs-extra\lib\mkdirs\make-dir.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	545
Entropy (8bit):	4.698712446840127
Encrypted:	false
SSDEEP:	12:XFuR5Fw6FZib2s+CB4oWDYBSFlFxgAanDa6tB5AUFxgAvnDa6h:XSFZfs+CB4dYB2fGa6tBecva6h
MD5:	AFA3DBD8A8D3F72023488A2A015B8EFD
SHA1:	A796D2F41FB121C4CB6FDC27E94F09DF8FECE732
SHA-256:	23C7CE8A3D6B39D1C7CF5D16BA6447C1690A6FDAA8C5F41E6B76526B7AFE96F3
SHA-512:	BB546CE2F9648F79649743B82D037BC35FB74BA492866D09A5B1173443F703A004128D24A3A44F7920E8F8DE579EB612235EF98BB466F5B5ED164E8F34512AA8
Malicious:	false
Preview:	'use strict'.const fs = require('../fs').const { checkPath } = require('./utils')..const getMode = options => {. const defaults = { mode: 0o777 }. if (typeof options === 'number') return options. return ({ ...defaults, ...options }).mode.}..module.exports.makeDir = async (dir, options) => {. checkPath(dir).. return fs.mkdir(dir, {. mode: getMode(options),. recursive: true. }).}..module.exports.makeDirSync = (dir, options) => {. checkPath(dir).. return fs.mkdirSync(dir, {. mode: getMode(options),. recursive: true. }).}.

C:\Program Files (x86)\????????\resources\app\node_modules\fs-extra\lib\mkdirs\utils.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1655
Entropy (8bit):	5.257347535907614
Encrypted:	false
SSDEEP:	24:6scr4JHBH0yPP3gtAHk1h99QHcsUv48Ok4/+dbo3oqxFoyPWPRBVhJ80gQak:6p8JplPvEvnQHcs5ITc3omFjuHfym
MD5:	66B255ED6A221E98AAD514377646FF42
SHA1:	B46CFD4D2CF4B47D1BFFA32BD70DE757390F2DFC
SHA-256:	5372A36F4B2C5023788C23DBC6639155CB016A1B111E8FC1D6BF97CBAF11B1F8
SHA-512:	981438AC4323CC29BA8DD8A6CA5663A2C99C35E06C6AA27C6F7C173EBB3EBEDC0BBCC4C1B47AB4E3EC2DF06AAF3502629AFAB4193C0AE16515C58683684923E2
Malicious:	false
Preview:	// Adapted from https://github.com/sindresorhus/make-dir.// Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com).// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:.// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software..// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIAB

C:\Program Files (x86)\????????\resources\app\node_modules\fs-extra\lib\move\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	147
Entropy (8bit):	4.742484910897031
Encrypted:	false
SSDEEP:	3:agWAvGKLWnJ4LMMGEJMDcPTJb0BbmA6xQJMaLT6ItAUSMhS:QKGqMRgMeN0BSA6WRT6IyYS
MD5:	F24D129C9DF3B1FAB4BD943445B82B1F
SHA1:	361D93691265C8A305558BB8FD11F953E3B3592A
SHA-256:	274F9FD31AC65CDC7DD9A6C568FB1163C2B043F6D5FCAD30D5177961E9E3E240
SHA-512:	A8EA10FF0AD7B64B9FAF84A7819AA4F89CA81D1247653654075AB4434A5B36C409F007F0110D0C0F01027E83B46897314CBFAAE658854A79FD5D46A6A4B37692
Malicious:	false
Preview:	'use strict'..const u = require('universalify').fromCallback.module.exports = {. move: u(require('./move')),. moveSync: require('./move-sync').}.

C:\Program Files (x86)\????????\resources\app\node_modules\fs-extra\lib\move\move-sync.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1485
Entropy (8bit):	4.698619220188821
Encrypted:	false
SSDEEP:	24:Etu6LspLXW2onpeCKPfAV8ZFt0Hy3QYxiHuAY8mc8N73fcLw+ZKPe6+sID52Ad1a:eYpLxooCAAep2+QasuALmc8N73fcUDe6
MD5:	59A95AEB0CB4FC129EAB2EBBEBC0F0BA
SHA1:	3079F4EE748C05F321463260E99CF4A3055BFD8C
SHA-256:	10C9F85215ADCBC49661E5629D81AB4A5DBAE552DD59032836D28CB2836D1CCE
SHA-512:	1232D338EF0D385E52EE1208E08320F50CFA6D0DB72BA59278071476470AFE1E508CDEBBD9583D9D383F595B0CFC859A4B2D4B49F40A117AFFA3DF9A2307731C
Malicious:	false
Preview:	'use strict'..const fs = require('graceful-fs').const path = require('path').const copySync = require('../copy').copySync.const removeSync = require('../remove').removeSync.const mkdirpSync = require('../mkdirs').mkdirpSync.const stat = require('../util/stat')..function moveSync (src, dest, opts) {. opts = opts \|\| {}. const overwrite = opts.overwrite \|\| opts.clobber \|\| false.. const { srcStat, isChangingCase = false } = stat.checkPathsSync(src, dest, 'move', opts). stat.checkParentPathsSync(src, srcStat, dest, 'move'). if (!isParentRoot(dest)) mkdirpSync(path.dirname(dest)). return doRename(src, dest, overwrite, isChangingCase).}..function isParentRoot (dest) {. const parent = path.dirname(dest). const parsedPath = path.parse(parent). return parsedPath.root === parent.}..function doRename (src, dest, overwrite, isChangingCase) {. if (isChangingCase) return rename(src, dest, overwrite). if (overwrite) {. removeSync(dest). return rename(src, dest, overwrite). }. if (fs

C:\Program Files (x86)\????????\resources\app\node_modules\fs-extra\lib\move\move.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2010
Entropy (8bit):	4.56610637968053
Encrypted:	false
SSDEEP:	48:Y+tRtQmCAAzDGW5VfOPLmc8N7EKNA4Tyhe0Wg5dlgn+:Y+tRKRyWjWid7EKzTy0gSn+
MD5:	218376D225037910C7DFBDCF5D70D1B0
SHA1:	D92FE381AC803F427F1CA8D9E3873E6286BA2144
SHA-256:	5487CD460CB8AF3E0B2ED0055D61185E56BEA35D08C01972B7F1A87E0433AABE
SHA-512:	767FDEB18FC5E509BFE2F55F4D7B914A5700344E1A114D9A1A8DBC6EE1ABE2FAB03098F64915E8DA3D2318AC97DF65C981157CC02B0120D22A9553FE6538CFF2
Malicious:	false
Preview:	'use strict'..const fs = require('graceful-fs').const path = require('path').const copy = require('../copy').copy.const remove = require('../remove').remove.const mkdirp = require('../mkdirs').mkdirp.const pathExists = require('../path-exists').pathExists.const stat = require('../util/stat')..function move (src, dest, opts, cb) {. if (typeof opts === 'function') {. cb = opts. opts = {}. }.. opts = opts \|\| {}.. const overwrite = opts.overwrite \|\| opts.clobber \|\| false.. stat.checkPaths(src, dest, 'move', opts, (err, stats) => {. if (err) return cb(err). const { srcStat, isChangingCase = false } = stats. stat.checkParentPaths(src, srcStat, dest, 'move', err => {. if (err) return cb(err). if (isParentRoot(dest)) return doRename(src, dest, overwrite, isChangingCase, cb). mkdirp(path.dirname(dest), err => {. if (err) return cb(err). return doRename(src, dest, overwrite, isChangingCase, cb). }). }). }).}..function isParentRoot (dest)

C:\Program Files (x86)\????????\resources\app\node_modules\fs-extra\lib\output-file\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	947
Entropy (8bit):	4.736574077479858
Encrypted:	false
SSDEEP:	24:JMqHtAtj0aedXlOItdy5EvdXM+2xavdXd90egxe/mJeNBp8jpPPeF:JEtj0aedVOI3Jd5db0egQlN/8jxeF
MD5:	B0ADFC74C8E51CE2AB659BFC13752ED3
SHA1:	1B0879DB53A00BBFEDDCFDC0C190901387BAB7BD
SHA-256:	A27D1A72ED1ECDDFFC57E70187A4B72467ED0DD34092B7E3D2817B9F4359AB5D
SHA-512:	4BD96FA626592E856431C3DA18F7F2C5262FCF7F8FC95A4FA8B3ECD6BD7F53E82EE27D3255711DF0ADDAAAA3FC7BA5E11104DD448F90F490E5517EABC1CDAD42
Malicious:	false
Preview:	'use strict'..const u = require('universalify').fromCallback.const fs = require('graceful-fs').const path = require('path').const mkdir = require('../mkdirs').const pathExists = require('../path-exists').pathExists..function outputFile (file, data, encoding, callback) {. if (typeof encoding === 'function') {. callback = encoding. encoding = 'utf8'. }.. const dir = path.dirname(file). pathExists(dir, (err, itDoes) => {. if (err) return callback(err). if (itDoes) return fs.writeFile(file, data, encoding, callback).. mkdir.mkdirs(dir, err => {. if (err) return callback(err).. fs.writeFile(file, data, encoding, callback). }). }).}..function outputFileSync (file, ...args) {. const dir = path.dirname(file). if (fs.existsSync(dir)) {. return fs.writeFileSync(file, ...args). }. mkdir.mkdirsSync(dir). fs.writeFileSync(file, ...args).}..module.exports = {. outputFile: u(outputFile),. outputFileSync.}.

C:\Program Files (x86)\????????\resources\app\node_modules\fs-extra\lib\path-exists\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	263
Entropy (8bit):	4.694893060075307
Encrypted:	false
SSDEEP:	6:QuMRgMefWFuVqd9GKSHTZe9BSG3YSUyII056Fn:BMqTWFuIOKo1e9Bt3Y3S0u
MD5:	DFB2813673EA5279A9AA7305E5FE33F3
SHA1:	6E6491C1AB3389433D1B39A33B3AC8760649A2C8
SHA-256:	5CE096C95DAEC0259817248921B39A9E0DF4D342DB171138CCB62440CC7A0CBE
SHA-512:	53D93B66ED4A2ECA23046E6F2B08FCBE4CDE40A2B841AB38DB838AC75B0882947371024CB74AE43D2C9A2E095E2457E2207979C45F07D46E6E2B5F99EFCFC794
Malicious:	false
Preview:	'use strict'.const u = require('universalify').fromPromise.const fs = require('../fs')..function pathExists (path) {. return fs.access(path).then(() => true).catch(() => false).}..module.exports = {. pathExists: u(pathExists),. pathExistsSync: fs.existsSync.}.

C:\Program Files (x86)\????????\resources\app\node_modules\fs-extra\lib\remove\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	489
Entropy (8bit):	4.820625586736303
Encrypted:	false
SSDEEP:	12:o7IMqdnUxVd4bS9QAILo4FK4Db13MRBfeFzLF:EIMqdnUxWS9fIL4013ABWFzLF
MD5:	EE72DF2C2433AC2D44C2848544C32018
SHA1:	9134379DDBCA3C8AB78BFB83381ADDCDA5D28DC1
SHA-256:	AD79431E3D1CAE731565D3E7403F619AEE21F3B276D3541FE794EC7FD59AB0DA
SHA-512:	D57727AC8CA96D180DD9E62BAD6105CF2C68A73FC57275ADEBB5DFC33B00348F35AB6FF56A8D0E2FF9C9B1DC06D61D4588EAFB682A51E47EE3BD68984264AF31
Malicious:	false
Preview:	'use strict'..const fs = require('graceful-fs').const u = require('universalify').fromCallback.const rimraf = require('./rimraf')..function remove (path, callback) {. // Node 14.14.0+. if (fs.rm) return fs.rm(path, { recursive: true, force: true }, callback). rimraf(path, callback).}..function removeSync (path) {. // Node 14.14.0+. if (fs.rmSync) return fs.rmSync(path, { recursive: true, force: true }). rimraf.sync(path).}..module.exports = {. remove: u(remove),. removeSync.}.

C:\Program Files (x86)\????????\resources\app\node_modules\fs-extra\lib\remove\rimraf.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	7443
Entropy (8bit):	4.680282231248625
Encrypted:	false
SSDEEP:	192:ZoLKCXrsNPuOqrCMZA/FPjUZaL/rTtTLDXpM0OwOs6DEYyn1J71iNfM8Dnp:yKCXANPuXZAN5VTLDXpixIDJUp
MD5:	8AF4D4ABB5011A6543699BFC934D2522
SHA1:	9AAF8A271693DE5FAD3F942D7CA303E10BE07C40
SHA-256:	931CD85D1564A59DB583841196CF2773940E7EEE30830514B448D2D4919CC534
SHA-512:	81C82CC109B2FD05D2158A258BCE6C4457F3A39D305C68243E18E01FAA8C10CFD2A7A85E8980B339F2B266EFC5F8EBA8888F55B1A0F56355A81B266CF535A86C
Malicious:	false
Preview:	'use strict'..const fs = require('graceful-fs').const path = require('path').const assert = require('assert')..const isWindows = (process.platform === 'win32')..function defaults (options) {. const methods = [. 'unlink',. 'chmod',. 'stat',. 'lstat',. 'rmdir',. 'readdir'. ]. methods.forEach(m => {. options[m] = options[m] \|\| fs[m]. m = m + 'Sync'. options[m] = options[m] \|\| fs[m]. }).. options.maxBusyTries = options.maxBusyTries \|\| 3.}..function rimraf (p, options, cb) {. let busyTries = 0.. if (typeof options === 'function') {. cb = options. options = {}. }.. assert(p, 'rimraf: missing path'). assert.strictEqual(typeof p, 'string', 'rimraf: path should be a string'). assert.strictEqual(typeof cb, 'function', 'rimraf: callback function required'). assert(options, 'rimraf: invalid options argument provided'). assert.strictEqual(typeof options, 'object', 'rimraf: options should be object').. defaults(options).. rimraf_(p, options, function C

C:\Program Files (x86)\????????\resources\app\node_modules\fs-extra\lib\util\stat.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5226
Entropy (8bit):	4.639450312710158
Encrypted:	false
SSDEEP:	96:KUebxr6dh4rAuD0cFKiFWoUQrjbydArqaP3xtCNmTSYeiPUQ8/C0yCOgH:le12dGAdJnVQH+dIqaPhori8Q8/C0agH
MD5:	245B57B6E98C2DBB3D6E2CD8D9E9F8EB
SHA1:	34C08B29A919C6195B113C9D96F0EA61884735C3
SHA-256:	FE33D6C739866764C937E8AAEB518BBDA7A36B0F3C006855B26C5BDD846081C3
SHA-512:	6B13FB8B4CA2EA7D64974CF8E1EFD40D2A2C4FDD51490DC26CE251466FFB2EBFD4BCEE419D620FAA30F253D5E818AEA6227BBD414D6EFFAED123D68B9E1C8BB3
Malicious:	false
Preview:	'use strict'..const fs = require('../fs').const path = require('path').const util = require('util')..function getStats (src, dest, opts) {. const statFunc = opts.dereference. ? (file) => fs.stat(file, { bigint: true }). : (file) => fs.lstat(file, { bigint: true }). return Promise.all([. statFunc(src),. statFunc(dest).catch(err => {. if (err.code === 'ENOENT') return null. throw err. }). ]).then(([srcStat, destStat]) => ({ srcStat, destStat })).}..function getStatsSync (src, dest, opts) {. let destStat. const statFunc = opts.dereference. ? (file) => fs.statSync(file, { bigint: true }). : (file) => fs.lstatSync(file, { bigint: true }). const srcStat = statFunc(src). try {. destStat = statFunc(dest). } catch (err) {. if (err.code === 'ENOENT') return { srcStat, destStat: null }. throw err. }. return { srcStat, destStat }.}..function checkPaths (src, dest, funcName, opts, cb) {. util.callbackify(getStats)(src, dest, opts, (err, stats) => {

C:\Program Files (x86)\????????\resources\app\node_modules\fs-extra\lib\util\utimes.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	615
Entropy (8bit):	4.72927776005062
Encrypted:	false
SSDEEP:	12:o7HqpSA8pEGCkIvF51MoJTNp3h0YHp9qk61hCuoQ9oEqR3YBkyDE:EHQr8pEVk25hD3aYHp9B6muoQmkBPw
MD5:	B95E8F0F6D31E27CACAF907E04D44AD7
SHA1:	DAD744F8EDF8218685028574C168F77F9F1D75A8
SHA-256:	4A049BCD580984957B8690FB05F7A6BF5C7E59BFC78D6817882945C35F3A44D4
SHA-512:	24EEC0A03CCF8625A8C86CB4BC70A05EA4365FFEE5190411995D54EF5FC5248247E56B87A8D4E5CB56E6CD9D929B2DFABBBDE7C6FFF31FBBE4B0CDBF6C8234F8
Malicious:	false
Preview:	'use strict'..const fs = require('graceful-fs')..function utimesMillis (path, atime, mtime, callback) {. // if (!HAS_MILLIS_RES) return fs.utimes(path, atime, mtime, callback). fs.open(path, 'r+', (err, fd) => {. if (err) return callback(err). fs.futimes(fd, atime, mtime, futimesErr => {. fs.close(fd, closeErr => {. if (callback) callback(futimesErr \|\| closeErr). }). }). }).}..function utimesMillisSync (path, atime, mtime) {. const fd = fs.openSync(path, 'r+'). fs.futimesSync(fd, atime, mtime). return fs.closeSync(fd).}..module.exports = {. utimesMillis,. utimesMillisSync.}.

C:\Program Files (x86)\????????\resources\app\node_modules\fs-extra\package.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	950
Entropy (8bit):	4.835668007119983
Encrypted:	false
SSDEEP:	12:91RncOs2ROnObVVDoP0AhYWHTBbmPYWHT7nGQgWfjHRJtS0c8nBKRhurWjBpVBkA:91Re2kOISTzPtfRBKRhurWjBpkcaQ
MD5:	099A518D3F718D2F9FFE1B15F9B87AED
SHA1:	EA5B31AFC94B0FE7F48BF4098EACD10029CA9BED
SHA-256:	8625F8D6674F3DACBDD5ED9FC553D9583234A6403EF90B1612F786B8FAD17711
SHA-512:	8E457E75E7A0AA5051B743F39C3F9BF100AFFCC976508F8A0F2AF3990D16C13452E57F342E6D745944D9D1E72BC5940755C7D0F8A101B84EA0FF0810580678C6
Malicious:	false
Preview:	{. "name": "fs-extra",. "version": "10.1.0",. "description": "fs-extra contains methods that aren't included in the vanilla Node.js fs package. Such as recursive mkdir, copy, and remove.",. "engines": {. "node": ">=12". },. "homepage": "https://github.com/jprichardson/node-fs-extra",. "repository": {. "type": "git",. "url": "https://github.com/jprichardson/node-fs-extra". },. "author": "JP Richardson <jprichardson@gmail.com>",. "license": "MIT",. "dependencies": {. "graceful-fs": "^4.2.0",. "jsonfile": "^6.0.1",. "universalify": "^2.0.0". },. "devDependencies": {. "at-least-node": "^1.0.0",. "klaw": "^2.1.1",. "klaw-sync": "^3.0.2",. "minimist": "^1.1.1",. "mocha": "^5.0.5",. "nyc": "^15.0.0",. "proxyquire": "^2.0.1",. "read-dir-files": "^0.1.1",. "standard": "^16.0.3". },. "main": "./lib/index.js",. "files": [. "lib/",. "!lib/**/__tests__/". ],. "sideEffects": false.}

C:\Program Files (x86)\????????\resources\app\node_modules\get-symbol-from-current-process-h\LICENSE

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	754
Entropy (8bit):	5.052288255098325
Encrypted:	false
SSDEEP:	12:DpS4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2C5ErK2PF3ew:kICCtEmq6s9iOnc4PRnA+qpF3ew
MD5:	B84D942CB3F2D7BB0AD389A241B3D9A7
SHA1:	854ACA247E9A4A00B9FD32F03CD9ACF2D9EDACEB
SHA-256:	582F873C77A5387B229401F1585DC59E81B2CB33611AB8CB8161AF216F5A7D9C
SHA-512:	56EDF88EF49409FF44299421175DBECBF6FE352208810CD8A44B358E326844AD9038685BFA8760EC27591C75ADFFCCEF8C5FB7F15A8F601C71D136A2A50E63FF
Malicious:	false
Preview:	Copyright (c) 2017, Anna Henningsen <anna@addaleax.net>..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF.OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Program Files (x86)\????????\resources\app\node_modules\get-symbol-from-current-process-h\code-of-conduct.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3198
Entropy (8bit):	4.492273938065113
Encrypted:	false
SSDEEP:	96:M1317qsii/PEFCH3Ybr3dfUmZ1f9k/W0pYGsPRdEb51e:6ZqsJEcH3EddlROX+RN
MD5:	A7A07214385103A16E0A3A99362DECE0
SHA1:	43568C5D7E147E299116C514AA307051377444A3
SHA-256:	5740AF8A8E97F17C0E601A38345F268DCE0716BA9021F170442021BBB879AED1
SHA-512:	9089052A5501F384300C44CD7D2068BF9012721877740AF2AD0BA5895C0AB3D2881B5A4134AE801B06CF0291C0A18AF5B9B5B6131814A0599234CF0A56CD69D4
Malicious:	false
Preview:	# Contributor Covenant Code of Conduct..## Our Pledge..In the interest of fostering an open and welcoming environment, we as.contributors and maintainers pledge to making participation in our project and.our community a harassment-free experience for everyone, regardless of age, body.size, disability, ethnicity, gender identity and expression, level of experience,.nationality, personal appearance, race, religion, or sexual identity and.orientation...## Our Standards..Examples of behavior that contributes to creating a positive environment.include:..* Using welcoming and inclusive language.* Being respectful of differing viewpoints and experiences.* Gracefully accepting constructive criticism.* Focusing on what is best for the community.* Showing empathy towards other community members..Examples of unacceptable behavior by participants include:..* The use of sexualized language or imagery and unwelcome sexual attention or. advances.* Trolling, insulting/derogatory comments, and persona

C:\Program Files (x86)\????????\resources\app\node_modules\get-symbol-from-current-process-h\get-paths.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	211
Entropy (8bit):	4.997463949282048
Encrypted:	false
SSDEEP:	6:Qo+cho3E27EFaUaBoipe3E4IEGhC8gsmX5myAiw:Bho3E27EFabBot3E+98apTRw
MD5:	A30E50B9AA5AF635F41EA2E31CD07332
SHA1:	8C029CC879518A876F38BBB5E1D828F5270CA38B
SHA-256:	D3E1BB2EF71D73027B97A52EEFDD9484E790794EBE19D22AEB285421B5586214
SHA-512:	BAAE82039B1A674E59512D09F6D1B76CEB1C8B0AD1F827237C256AF744DCF1DB826DE12B249525989C0B60F52960B7B352A9D8108B246B67A460CBF74D4A4873
Malicious:	false
Preview:	'use strict';.const path = require('path');.exports.includeRaw = [path.resolve(__dirname, 'include')];.exports.include = exports.includeRaw.map(x => `"${x}"`.replace(/\\/g, '\\\\')).join(' ');.exports.gyp = '';.

C:\Program Files (x86)\????????\resources\app\node_modules\get-symbol-from-current-process-h\include\get-symbol-from-current-process.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	572
Entropy (8bit):	5.256515449942489
Encrypted:	false
SSDEEP:	12:ukhruk+AT6AyAMZWPCSjSdLTwWAAHcQskDFxuSYvG:7h/+r1BejUTrAaTsAr9
MD5:	A989984DCB3FBA3DBABB837ABA2A8B9E
SHA1:	41D2A28124DCBE61D57D358CC69F41C93A727C71
SHA-256:	436456BCD71E58EE33FDD9147066E95177C1C7B4680790641DDBA5AEB2DC1DA3
SHA-512:	97803FD144B73464DF91A381CEB2A2FA4E17E93470AB5D44B603EBBB6F33A4CAA9336D5E77CF7A000CCC3B7A0C0C14286C8E69F6516E9C9D8A7291872300E3A1
Malicious:	false
Preview:	#ifndef _GET_SYMBOL_FROM_CURRENT_PROCESS_H.#define _GET_SYMBOL_FROM_CURRENT_PROCESS_H..#include <assert.h>.#ifdef _WIN32.#include <windows.h>.#else.#include <dlfcn.h>.#endif..inline.void* get_symbol_from_current_process(const char* name) {.#ifdef _WIN32. HMODULE handle = GetModuleHandle(NULL);. assert(handle != NULL);. return (void) GetProcAddress(handle, name);.#else. void handle = dlopen(NULL, RTLD_LAZY);. assert(handle != NULL);. void* sym = dlsym(handle, name);. dlclose(handle);. dlerror(); // Clear any possible errors.. return sym;.#endif.}..#endif.

C:\Program Files (x86)\????????\resources\app\node_modules\get-symbol-from-current-process-h\package.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	544
Entropy (8bit):	4.708716750290327
Encrypted:	false
SSDEEP:	12:ZuESALQDByxCxTFUf8PGhgh54B5sbmF2gh5SV18XA:bSALw5TFUf8d/OXn/41z
MD5:	92CC796AD6CAE6A4B8ADA078E776E32B
SHA1:	0E684F8458A20D10743FE1788B555367749FA198
SHA-256:	313B1A71F1E75AFE0AC69590655ED3E31190FAE009988FB3A6D7ABCBC8B215C8
SHA-512:	423D6C4802A0C9E488AB373D3DF93F886C1DF825F4281994ABDDFFC5E9DEA548CDD300D8BF60DF1446DEBEB28455C6A962C990A5A57308A0BE42EF670903E4F6
Malicious:	false
Preview:	{. "author": {. "name": "Anna Henningsen",. "email": "anna@addaleax.net". },. "description": "C function to get a symbol from the current process",. "devDependencies": {. "reverse-test": "^1.1.0". },. "homepage": "https://github.com/node-ffi-napi/get-symbol-from-current-process-h#readme",. "license": "MIT",. "main": "get-paths.js",. "name": "get-symbol-from-current-process-h",. "repository": {. "type": "git",. "url": "git://github.com/node-ffi-napi/get-symbol-from-current-process-h.git". },. "version": "1.0.2".}

C:\Program Files (x86)\????????\resources\app\node_modules\get-uv-event-loop-napi-h\LICENSE

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	754
Entropy (8bit):	5.052288255098325
Encrypted:	false
SSDEEP:	12:DpS4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2C5ErK2PF3ew:kICCtEmq6s9iOnc4PRnA+qpF3ew
MD5:	B84D942CB3F2D7BB0AD389A241B3D9A7
SHA1:	854ACA247E9A4A00B9FD32F03CD9ACF2D9EDACEB
SHA-256:	582F873C77A5387B229401F1585DC59E81B2CB33611AB8CB8161AF216F5A7D9C
SHA-512:	56EDF88EF49409FF44299421175DBECBF6FE352208810CD8A44B358E326844AD9038685BFA8760EC27591C75ADFFCCEF8C5FB7F15A8F601C71D136A2A50E63FF
Malicious:	false
Preview:	Copyright (c) 2017, Anna Henningsen <anna@addaleax.net>..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF.OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Program Files (x86)\????????\resources\app\node_modules\get-uv-event-loop-napi-h\code-of-conduct.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3198
Entropy (8bit):	4.492273938065113
Encrypted:	false
SSDEEP:	96:M1317qsii/PEFCH3Ybr3dfUmZ1f9k/W0pYGsPRdEb51e:6ZqsJEcH3EddlROX+RN
MD5:	A7A07214385103A16E0A3A99362DECE0
SHA1:	43568C5D7E147E299116C514AA307051377444A3
SHA-256:	5740AF8A8E97F17C0E601A38345F268DCE0716BA9021F170442021BBB879AED1
SHA-512:	9089052A5501F384300C44CD7D2068BF9012721877740AF2AD0BA5895C0AB3D2881B5A4134AE801B06CF0291C0A18AF5B9B5B6131814A0599234CF0A56CD69D4
Malicious:	false
Preview:	# Contributor Covenant Code of Conduct..## Our Pledge..In the interest of fostering an open and welcoming environment, we as.contributors and maintainers pledge to making participation in our project and.our community a harassment-free experience for everyone, regardless of age, body.size, disability, ethnicity, gender identity and expression, level of experience,.nationality, personal appearance, race, religion, or sexual identity and.orientation...## Our Standards..Examples of behavior that contributes to creating a positive environment.include:..* Using welcoming and inclusive language.* Being respectful of differing viewpoints and experiences.* Gracefully accepting constructive criticism.* Focusing on what is best for the community.* Showing empathy towards other community members..Examples of unacceptable behavior by participants include:..* The use of sexualized language or imagery and unwelcome sexual attention or. advances.* Trolling, insulting/derogatory comments, and persona

C:\Program Files (x86)\????????\resources\app\node_modules\get-uv-event-loop-napi-h\get-paths.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	306
Entropy (8bit):	5.069178453920735
Encrypted:	false
SSDEEP:	6:QoOAJBQmlCFcho3E27EFaWfGe3E9Qoipe3E4IEGhC8gsmX5myAF3:l5rho3E27EFaWfR3EKot3E+98apTG
MD5:	AD7C8CB8E4E3A1AA59393983EB095AAF
SHA1:	F2B6C56D7B217F4EB62E697F97449CE9AEC3791E
SHA-256:	FC1B05323A6B21B622E5C1340F3A3387B7D0E4574A29C2994179031595630CD6
SHA-512:	1954B2581E60EB75CD66D5C97849D00F84086D855F6929D4BCC48AA99FEBA2EFE639688B751D1F015FAB5D758415345629473F62660CDACB8EA98516D8DB8462
Malicious:	false
Preview:	'use strict';.const symbol = require('get-symbol-from-current-process-h');.const path = require('path');.exports.includeRaw = [path.resolve(__dirname, 'include')].concat(symbol.includeRaw);.exports.include = exports.includeRaw.map(x => `"${x}"`.replace(/\\/g, '\\\\')).join(' ');.exports.gyp = symbol.gyp;.

C:\Program Files (x86)\????????\resources\app\node_modules\get-uv-event-loop-napi-h\include\get-uv-event-loop-napi.h

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.960853957615749
Encrypted:	false
SSDEEP:	24:sFVhAFV+E8ES5p06PpL8HNPeq+UwT9odq7mES5020Sak5s0DWmb:0osESro20w54OmESUJ0Dp
MD5:	45211E02BF86AB387A2C12BE6C65CBBB
SHA1:	8FA5BB307AA359A0F1CBF062CF88CCC058ED61AE
SHA-256:	3729E385EA32BC4DBDC60339912E89E1ECA9F6C7C75F3F2C5B5F1F29957698AF
SHA-512:	6157521146007AE0D075566FB0A0F614C5D38EDF3832528C6D4394022B575112005ACB22BFA4114F11305FCF0689889ABE23C46781907B6A207A5FDD8E543853
Malicious:	false
Preview:	#ifndef _GET_UV_EVENT_LOOP_NAPI_H.#define _GET_UV_EVENT_LOOP_NAPI_H..#include <assert.h>.#include <node_api.h>..#if !defined(NAPI_VERSION) \|\| NAPI_VERSION < 2.#include <get-symbol-from-current-process.h>.#endif..inline.uv_loop_t* get_uv_event_loop(napi_env env) {. typedef napi_status (get_uv_event_loop_fn)(napi_env env, uv_loop_t* loop);. get_uv_event_loop_fn napi_get_uv_event_loop__ = NULL;. uint32_t napi_version = 0;. napi_status status;. status = napi_get_version(env, &napi_version);. assert(status == napi_ok);. if (napi_version < 2). return uv_default_loop();..#if !defined(NAPI_VERSION) \|\| NAPI_VERSION < 2. napi_get_uv_event_loop__ = (get_uv_event_loop_fn). get_symbol_from_current_process("napi_get_uv_event_loop");.#else. napi_get_uv_event_loop__ = &napi_get_uv_event_loop;.#endif.. uv_loop_t* ret;. status = napi_get_uv_event_loop__(env, &ret);. assert(status == napi_ok);. return ret;.}..#endif.

C:\Program Files (x86)\????????\resources\app\node_modules\get-uv-event-loop-napi-h\package.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	597
Entropy (8bit):	4.710773571931467
Encrypted:	false
SSDEEP:	12:ZuESALQDFY5EnBy1zf8PGhjE9MJENbmF2jENV18LA:bSALhEB2f8AEoEM2Eb1EA
MD5:	C1EF6F951DFD88C5CED5F679FF2F8F15
SHA1:	B2D0CBBA5726D91FCB61A1E6A8BCAB0E69384AD4
SHA-256:	8C8D2629E971BB887891FF2859DC36CA6548B84E140D8BED8410322FE62B845F
SHA-512:	365B298AFE59CB0F347BA77AD875FF2DD6A5835C0257C99F520A62A755BA346830011E7713FD2FD03AA4D0E522D07F65E15574C508750AF770CF14975D3BD321
Malicious:	false
Preview:	{. "author": {. "name": "Anna Henningsen",. "email": "anna@addaleax.net". },. "dependencies": {. "get-symbol-from-current-process-h": "^1.0.1". },. "description": "C function to get the current libuv event loop for N-API",. "devDependencies": {. "reverse-test": "^1.1.0". },. "homepage": "https://github.com/node-ffi-napi/get-uv-event-loop-napi-h#readme",. "license": "MIT",. "main": "get-paths.js",. "name": "get-uv-event-loop-napi-h",. "repository": {. "type": "git",. "url": "git://github.com/node-ffi-napi/get-uv-event-loop-napi-h.git". },. "version": "1.0.6".}

C:\Program Files (x86)\????????\resources\app\node_modules\graceful-fs\LICENSE

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	781
Entropy (8bit):	5.00880953578757
Encrypted:	false
SSDEEP:	12:9FM9ZksTES4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PFd:9SZkcICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	FD63805FD8E3797063B247781E5EE6E4
SHA1:	6560C016F1644CE652D83D039D8BA9E64795FD49
SHA-256:	2FC5460F1526810979054ECD18CD01349B57F38EA56D1E920AFDEA34D104540C
SHA-512:	DEC4ED2CCA263ADCADB892FDF3D7C5EB2E2C37C13760D161ECDF5317DB544C614D1BF451C015BCF526FCF330288EDFA303747C8DBA956D0E58681A4159F7C1F5
Malicious:	false
Preview:	The ISC License..Copyright (c) Isaac Z. Schlueter, Ben Noordhuis, and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Program Files (x86)\????????\resources\app\node_modules\graceful-fs\clone.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	496
Entropy (8bit):	4.684867221855962
Encrypted:	false
SSDEEP:	12:dBca//U2pHohSyoGbVI7P/gYwo6hxbOtG:dB1/VHohSyoGba7P/gvomr
MD5:	F8B8F88D8550294C47EE5CC6E8EC141C
SHA1:	C912F366FE0025EA74E0E76E58277147DC0A3167
SHA-256:	7258ECA52E65D69845759503F9FDD66C252F40E5EAFB76DB5D481172E31AC9ED
SHA-512:	57FD42C80A8DB172734CA9D270348EB29825E52EFB0619D53149084D6CD8CDBCE8159ABC2F89A3BC127AA7BE44E223BCF1F43DD0F4B0DE607DEC2E80B1B5A1E4
Malicious:	false
Preview:	'use strict'..module.exports = clone..var getPrototypeOf = Object.getPrototypeOf \|\| function (obj) {. return obj.__proto__.}..function clone (obj) {. if (obj === null \|\| typeof obj !== 'object'). return obj.. if (obj instanceof Object). var copy = { __proto__: getPrototypeOf(obj) }. else. var copy = Object.create(null).. Object.getOwnPropertyNames(obj).forEach(function (key) {. Object.defineProperty(copy, key, Object.getOwnPropertyDescriptor(obj, key)). }).. return copy.}.

C:\Program Files (x86)\????????\resources\app\node_modules\graceful-fs\graceful-fs.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9469
Entropy (8bit):	4.702274188532585
Encrypted:	false
SSDEEP:	192:eczUc4nUaF+wvbGdjIt/X5/PtcX8/vlntAaUEXSk/K9QrXnHkqoXpHq/gysrFTkP:bUc9wvFXVyX0ln6aUEXSYXKXXgcacecg
MD5:	77712764BF9B49E5738112B410979F4E
SHA1:	E5D46C7CB9B7AE8D9734DE686C9D1EB96906A5C0
SHA-256:	76C7B276D9FE190C22FD0E5F8F68BF77EE1DD4A603CCE6C9A441F4965F9EE219
SHA-512:	C2EF5B15EDCCF6581E45D2555CEE775AF361933D5613E09BBC4C6117A4512300F1918AB5A5CA0A286F9AEC01A8A20C1E10A59F52787817D5F9AF9906D58DB714
Malicious:	false
Preview:	var fs = require('fs').var polyfills = require('./polyfills.js').var legacy = require('./legacy-streams.js').var clone = require('./clone.js')..var util = require('util')../* istanbul ignore next - node 0.x polyfill /.var gracefulQueue.var previousSymbol../ istanbul ignore else - node 0.x polyfill */.if (typeof Symbol === 'function' && typeof Symbol.for === 'function') {. gracefulQueue = Symbol.for('graceful-fs.queue'). // This is used in testing by future versions. previousSymbol = Symbol.for('graceful-fs.previous').} else {. gracefulQueue = '___graceful-fs.queue'. previousSymbol = '___graceful-fs.previous'.}..function noop () {}..function publishQueue(context, queue) {. Object.defineProperty(context, gracefulQueue, {. get: function() {. return queue. }. }).}..var debug = noop.if (util.debuglog). debug = util.debuglog('gfs4').else if (/\bgfs4\b/i.test(process.env.NODE_DEBUG \|\| '')). debug = function() {. var m = util.format.apply(util, arguments). m = 'GFS4

C:\Program Files (x86)\????????\resources\app\node_modules\graceful-fs\legacy-streams.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2655
Entropy (8bit):	4.567539088339503
Encrypted:	false
SSDEEP:	48:x5iyJWcGGbfRPB6mBnRIp7PvrzfTvGGbGTnQHpq6WmiSfW:x0yJWcxRP0cKp7nrzfTvg8pq6hiD
MD5:	620FC152DC9BFA087F9901703B1E2616
SHA1:	F4A3583D4C3E8B0C407AB8406BDAFB02B4055B7F
SHA-256:	60A6A7ECF7C3E55A3FFAAE13433B6CFF388B7205BBA6DAF393C863F77A949E36
SHA-512:	7C9DA94D2DADECAFE60DA4C7B739AE00B150610B2B5C0A45450453ADF932A852FB655114CB27249C21E31C2A0F647605A21A7FE1D06FFF7848EA996A367CD9F2
Malicious:	false
Preview:	var Stream = require('stream').Stream..module.exports = legacy..function legacy (fs) {. return {. ReadStream: ReadStream,. WriteStream: WriteStream. }.. function ReadStream (path, options) {. if (!(this instanceof ReadStream)) return new ReadStream(path, options);.. Stream.call(this);.. var self = this;.. this.path = path;. this.fd = null;. this.readable = true;. this.paused = false;.. this.flags = 'r';. this.mode = 438; /=0666/. this.bufferSize = 64 * 1024;.. options = options \|\| {};.. // Mixin options into this. var keys = Object.keys(options);. for (var index = 0, length = keys.length; index < length; index++) {. var key = keys[index];. this[key] = options[key];. }.. if (this.encoding) this.setEncoding(this.encoding);.. if (this.start !== undefined) {. if ('number' !== typeof this.start) {. throw TypeError('start must be a Number');. }. if (this.end === undefined) {. this.end = Infin

C:\Program Files (x86)\????????\resources\app\node_modules\graceful-fs\package.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	632
Entropy (8bit):	4.687897217627529
Encrypted:	false
SSDEEP:	12:m9vg5zeUohjihcB+8rcVHAkYuSncYIoLg0SMN1B72mbmWN1KAV16:mVT4hymnuVLg0vBO+X16
MD5:	93AF4F4A8A0BB6991FBD1D2AFF16EDFD
SHA1:	7612760F6E63E37B47F3F1F2778A26EF9A81A82B
SHA-256:	46B0DB00D8B14DFFB2C193E71211D3E9A66CAB9723E94355C8916B7EDB8EADB2
SHA-512:	A1090411C142800A3C7A2308016F92BEC683CA1D721DC43B85AC2E1DF67328563233EC7989386B6890CF61DBCF1E36361DC16240EE4A171FC60BC790B9E81318
Malicious:	false
Preview:	{. "description": "A drop-in replacement for fs, making various improvements.",. "devDependencies": {. "import-fresh": "^2.0.0",. "mkdirp": "^0.5.0",. "rimraf": "^2.2.8",. "tap": "^12.7.0". },. "directories": {. "test": "test". },. "files": [. "fs.js",. "graceful-fs.js",. "legacy-streams.js",. "polyfills.js",. "clone.js". ],. "homepage": "https://github.com/isaacs/node-graceful-fs#readme",. "license": "ISC",. "main": "graceful-fs.js",. "name": "graceful-fs",. "repository": {. "type": "git",. "url": "git+https://github.com/isaacs/node-graceful-fs.git". },. "version": "4.2.6".}

C:\Program Files (x86)\????????\resources\app\node_modules\graceful-fs\polyfills.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9740
Entropy (8bit):	4.565594524552511
Encrypted:	false
SSDEEP:	192:BxDN/EaCTlttD2kaBWJv+WaDKmtmyaF/wFd+5wpjWjWhlw8kZXjRKPu/b:BxyamtN4PI1zG0OY
MD5:	36D322F4E00214B5E36DA9B75150973E
SHA1:	E0D1A7BC7274E1B091A0F7754E36105F715C429A
SHA-256:	B20E26E07FF1368A4509BF312AA6A37F82EB44ED1B3F2D28EB5B284BA8275597
SHA-512:	56B1E95E10FB2E5DED2C643857E392EDC725B3941A9DF4E853A56901AE65573E5DF1B1C7EDDB5B0A7A3C738AE2661EDDF29D5C2A11CBDCCD721A4CF38A74AAE9
Malicious:	false
Preview:	var constants = require('constants')..var origCwd = process.cwd.var cwd = null..var platform = process.env.GRACEFUL_FS_PLATFORM \|\| process.platform..process.cwd = function() {. if (!cwd). cwd = origCwd.call(process). return cwd.}.try {. process.cwd().} catch (er) {}..// This check is needed until node.js 12 is required.if (typeof process.chdir === 'function') {. var chdir = process.chdir. process.chdir = function (d) {. cwd = null. chdir.call(process, d). }. if (Object.setPrototypeOf) Object.setPrototypeOf(process.chdir, chdir).}..module.exports = patch..function patch (fs) {. // (re-)implement some things that are known busted or missing... // lchmod, broken prior to 0.6.2. // back-port the fix here.. if (constants.hasOwnProperty('O_SYMLINK') &&. process.version.match(/^v0\.6\.[0-2]\|^v0\.5\./)) {. patchLchmod(fs). }.. // lutimes implementation, or no-op. if (!fs.lutimes) {. patchLutimes(fs). }.. // https://github.com/isaacs/node-graceful-fs/issues/4

C:\Program Files (x86)\????????\resources\app\node_modules\iconv-lite\.github\dependabot.yml

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	321
Entropy (8bit):	4.51975744246791
Encrypted:	false
SSDEEP:	6:S1HvuuNbDQIcKNfUHr4kQC/+G4/NxQIA2j3MKSEzdqSy/qtdfDtithEI5r/tXqG9:U3NpxNUkkQP3xFjHS0qyKhE6xT
MD5:	03771727A64044FF18DD056458498DA0
SHA1:	EAA301A496FB989C5A19D896EEC73C1ACC50BDB1
SHA-256:	C5FCF6E10E93D44501521F1926DF5BD30197BC311BCB76FB731198D0DEB090AB
SHA-512:	77F22A9458E3FB9CE77F78CE30125DC9DB985EB31F93646F58AFFA72D36A859D706DADDDCE2131FC2A0617F8D305DB80E41C4B6D9C415A19BA4B1C6EB4F54078
Malicious:	false
Preview:	# Please see the documentation for all configuration options:.# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates..version: 2.updates:. - package-ecosystem: "npm". directory: "/". schedule:. interval: "daily". allow:. - dependency-type: production.

C:\Program Files (x86)\????????\resources\app\node_modules\iconv-lite\LICENSE

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1064
Entropy (8bit):	5.109065218676079
Encrypted:	false
SSDEEP:	24:ciJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFz:ciJzfPvGt7ICQH+sfIte36AFz
MD5:	F942263D98F0D75E0E0101884E86261D
SHA1:	4F3CA49A793F6BB8465A3731FD965A128757B8CE
SHA-256:	AC779F7314C74F232EF847EA86E714ABE25CF6EEB5CC97B69451B74E2AF6492D
SHA-512:	B500B93AE948BE0023297CCD98873B4B8C8A73798326B865EB8D01812F8C22551BF44EADFEEC2ADE17D4AA94BBFBA4A9B456D9737BC7A56ED6D1F913C52613EC
Malicious:	false
Preview:	Copyright (c) 2011 Alexander Shtuchkin..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION.W

C:\Program Files (x86)\????????\resources\app\node_modules\iconv-lite\encodings\dbcs-codec.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	23065
Entropy (8bit):	4.66036884245835
Encrypted:	false
SSDEEP:	384:Kz2Dimkmaf6pQk8hRVVkhSdj8Wwj4CsmTFZy5GlIdnrtM3g8vpf5V:KzqimkbypQkQVVc4j8Wwj4QTFZqAKnhS
MD5:	68A674BE42E7CE3248FFD90E076C4171
SHA1:	7604F3652777C0BAC059E1F526B3715CE8F938FA
SHA-256:	709D9D2E467540B9414AE53F72E43780F9A49FBF648D9A81983EACD34F501E25
SHA-512:	988E4EF65AFFBD9666C2AF41388C7B987D69459B30360AE2A9B752EB97D7566F2F744E06E480D486B8C13632198B2BD0A3ED1D1C29E51E479ABE18605F2F13F5
Malicious:	false
Preview:	"use strict";.var Buffer = require("safer-buffer").Buffer;..// Multibyte codec. In this scheme, a character is represented by 1 or more bytes..// Our codec supports UTF-16 surrogates, extensions for GB18030 and unicode sequences..// To save memory and loading time, we read table files only when requested...exports._dbcs = DBCSCodec;..var UNASSIGNED = -1,. GB18030_CODE = -2,. SEQ_START = -10,. NODE_START = -1000,. UNASSIGNED_NODE = new Array(0x100),. DEF_CHAR = -1;..for (var i = 0; i < 0x100; i++). UNASSIGNED_NODE[i] = UNASSIGNED;...// Class DBCSCodec reads and initializes mapping tables..function DBCSCodec(codecOptions, iconv) {. this.encodingName = codecOptions.encodingName;. if (!codecOptions). throw new Error("DBCS codec is called without the data."). if (!codecOptions.table). throw new Error("Encoding '" + this.encodingName + "' has no data.");.. // Load tables.. var mappingTable = codecOptions.table();... // Decode tables: MBCS ->

C:\Program Files (x86)\????????\resources\app\node_modules\iconv-lite\encodings\dbcs-data.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9389
Entropy (8bit):	5.144123459324624
Encrypted:	false
SSDEEP:	96:ZeO1igeleOWQSZuMqz7t+zOhbIy3RJ8nhBlulK2KQ+uQ515l66AzCz51nrpMZbzt:kO1kxWQSYJtbV3nYzckvlMZR/Wyfyw
MD5:	688736E83F355A67A59C252841D85E37
SHA1:	B4AB8F50253A46822D79749B4FBE632B07D99C63
SHA-256:	9D02B706A5F5411E2CF52B5191971B93F6B05B19D7529D829EBD17A1E060E158
SHA-512:	E3559CC1E638070ECF2C9914891740B1901A2191BD80C4304F989E92F8F9F32635E8CBB2F82A528350DDE44F00439BA744BA263B22CF5B6A6CA53A7E6ECB3D51
Malicious:	false
Preview:	"use strict";..// Description of supported double byte encodings and aliases..// Tables are not require()-d until they are needed to speed up library load..// require()-s are direct to support Browserify...module.exports = {. . // == Japanese/ShiftJIS ====================================================. // All japanese encodings are based on JIS X set of standards:. // JIS X 0201 - Single-byte encoding of ASCII + . + Kana chars at 0xA1-0xDF.. // JIS X 0208 - Main set of 6879 characters, placed in 94x94 plane, to be encoded by 2 bytes. . // Has several variations in 1978, 1983, 1990 and 1997.. // JIS X 0212 - Supplementary plane of 6067 chars in 94x94 plane. 1990. Effectively dead.. // JIS X 0213 - Extension and modern replacement of 0208 and 0212. Total chars: 11233.. // 2 planes, first is superset of 0208, second - revised 0212.. // Introduced in 2000, revised 2004. Some characters are in Unicode Plane 2 (0x2xxxx).

C:\Program Files (x86)\????????\resources\app\node_modules\iconv-lite\encodings\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	733
Entropy (8bit):	4.7593655475258885
Encrypted:	false
SSDEEP:	12:uucCK5RHzFLgdrxJvnzIzqzmYaMmOjsm9XHMuPfsErISU7yCQiTJX:SBXHFgJ/fzIzqzmYGOjsmZIRSLYTJX
MD5:	6322D5F9B2261E668213CA23C3CA063E
SHA1:	7475522D841D9933E63EE9AEF343E9F973D599CD
SHA-256:	EE406729FDEA34F4C77EEA5AFAD5025EA374BC41089FAFB6FA0F7336E1216713
SHA-512:	8C0967C54503631AE6092FEDB6BC4C8F93DEDBB2085593DC1EDF7BA53EB16DC3DC1B16375800BAD9922DB60C759886568C8DA0D89E5C702F795326D0895F94FF
Malicious:	false
Preview:	"use strict";..// Update this array if you add/rename/remove files in this directory..// We support Browserify by skipping automatic module discovery and requiring modules directly..var modules = [. require("./internal"),. require("./utf32"),. require("./utf16"),. require("./utf7"),. require("./sbcs-codec"),. require("./sbcs-data"),. require("./sbcs-data-generated"),. require("./dbcs-codec"),. require("./dbcs-data"),.];..// Put all encoding/alias/codec definitions to single object and export it..for (var i = 0; i < modules.length; i++) {. var module = modules[i];. for (var enc in module). if (Object.prototype.hasOwnProperty.call(module, enc)). exports[enc] = module[enc];.}.

C:\Program Files (x86)\????????\resources\app\node_modules\iconv-lite\encodings\internal.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6309
Entropy (8bit):	4.706827114237772
Encrypted:	false
SSDEEP:	192:XXzBkDaCh7nTFHJlY5QzkKH5MhJpkt1iQarFQbvvoCyie7e:XXzBva5vsUikFbvr
MD5:	FB275BB945A15C99D4684B88BEE661E6
SHA1:	6CB61C7619296F5373FC4884B1F52B8CC85F45D4
SHA-256:	78B012B90E43A9D4648D0526F46E26BF07C572BBD3AE5EAEDACB244E343609C5
SHA-512:	07444F23DC06B679535A0D86BDF2FD015979A20B9E4A847D873648E2041B80F62409B602F8DA47C672F10BAA11369CADC96DAFFA91B1E5B8A5F6EB01F46AA92C
Malicious:	false
Preview:	"use strict";.var Buffer = require("safer-buffer").Buffer;..// Export Node.js internal encodings...module.exports = {. // Encodings. utf8: { type: "_internal", bomAware: true},. cesu8: { type: "_internal", bomAware: true},. unicode11utf8: "utf8",.. ucs2: { type: "_internal", bomAware: true},. utf16le: "ucs2",.. binary: { type: "_internal" },. base64: { type: "_internal" },. hex: { type: "_internal" },.. // Codec.. _internal: InternalCodec,.};..//------------------------------------------------------------------------------..function InternalCodec(codecOptions, iconv) {. this.enc = codecOptions.encodingName;. this.bomAware = codecOptions.bomAware;.. if (this.enc === "base64"). this.encoder = InternalEncoderBase64;. else if (this.enc === "cesu8") {. this.enc = "utf8"; // Use utf8 for decoding.. this.encoder = InternalEncoderCesu8;.. // Add decoder for versions of Node not supporting CESU-8. if (Buffer

C:\Program Files (x86)\????????\resources\app\node_modules\iconv-lite\encodings\sbcs-codec.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2191
Entropy (8bit):	4.872958302882698
Encrypted:	false
SSDEEP:	48:dzNyvH+G49CEqHbDKuxVyJnV/1OVEq5RMRtRTOfDSx+fEc76Qd:xsY9fubyxV/m/RMrR4DFfSQd
MD5:	6F257833A4D930EAA9AF9225FAEF16B8
SHA1:	D0C2BDE053DCE8027EFF00B2E172CBED45579E6C
SHA-256:	FB511C4C70A6CB0E2A06D03E67CA88DCA9F4DA6266B909C7338E453D2ECC9FDB
SHA-512:	8285675ABD62F7174D2D94C15047B3032E616E73E885F8075B7CA073A59322C391EBD68CA3144BBEB8B06E7026600EF9C3BDE43733F25EB7D6890167D0F907A5
Malicious:	false
Preview:	"use strict";.var Buffer = require("safer-buffer").Buffer;..// Single-byte codec. Needs a 'chars' string parameter that contains 256 or 128 chars that.// correspond to encoded bytes (if 128 - then lower half is ASCII). ..exports._sbcs = SBCSCodec;.function SBCSCodec(codecOptions, iconv) {. if (!codecOptions). throw new Error("SBCS codec is called without the data."). . // Prepare char buffer for decoding.. if (!codecOptions.chars \|\| (codecOptions.chars.length !== 128 && codecOptions.chars.length !== 256)). throw new Error("Encoding '"+codecOptions.type+"' has incorrect 'chars' (must be of len 128 or 256)");. . if (codecOptions.chars.length === 128) {. var asciiString = "";. for (var i = 0; i < 128; i++). asciiString += String.fromCharCode(i);. codecOptions.chars = asciiString + codecOptions.chars;. }.. this.decodeBuf = Buffer.from(codecOptions.chars, 'ucs2');. . // Encoding buffer.. var encodeBuf = Buffer.al

C:\Program Files (x86)\????????\resources\app\node_modules\iconv-lite\encodings\sbcs-data-generated.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	32034
Entropy (8bit):	6.328773645887887
Encrypted:	false
SSDEEP:	768:j2lyKokKKZ2DVsRUdQJkEkSFnCrHmUFC5uyr:j24MKKRI/fakmU+
MD5:	78C27D9268D36644AC77B82B956F5B1F
SHA1:	8CEB7540842B7FB237391EC3C324035A3FEB7336
SHA-256:	2CF44B3F70C61C9CDD59FDA7EC085BC3180809638F208C7239688CCB90A48866
SHA-512:	AB9154847D29136D4A5E7C7B06105704E6CF42966F26066D87F8E54EB5CE49849757400A9E84E09D8F0C22FFA45F4EDF47339525F8E5DC06FD427DC85A5A3416
Malicious:	false
Preview:	"use strict";..// Generated data for sbcs codec. Don't edit manually. Regenerate using generation/gen-sbcs.js script..module.exports = {. "437": "cp437",. "737": "cp737",. "775": "cp775",. "850": "cp850",. "852": "cp852",. "855": "cp855",. "856": "cp856",. "857": "cp857",. "858": "cp858",. "860": "cp860",. "861": "cp861",. "862": "cp862",. "863": "cp863",. "864": "cp864",. "865": "cp865",. "866": "cp866",. "869": "cp869",. "874": "windows874",. "922": "cp922",. "1046": "cp1046",. "1124": "cp1124",. "1125": "cp1125",. "1129": "cp1129",. "1133": "cp1133",. "1161": "cp1161",. "1162": "cp1162",. "1163": "cp1163",. "1250": "windows1250",. "1251": "windows1251",. "1252": "windows1252",. "1253": "windows1253",. "1254": "windows1254",. "1255": "windows1255",. "1256": "windows1256",. "1257": "windows1257",. "1258": "windows1258",. "28591": "iso88591",. "28592": "iso88592",. "28593": "iso88593",. "28594": "iso88594",. "28595": "iso88595",. "28596": "iso8

C:\Program Files (x86)\????????\resources\app\node_modules\iconv-lite\encodings\sbcs-data.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5116
Entropy (8bit):	5.4242106252067765
Encrypted:	false
SSDEEP:	96:xVYsSWJdoczNE7keVWdU2AgpRJhGZfkfbp4gyWDEpqs:nGWF27kMMYgpPhGZfkfbpSLn
MD5:	813AB0357C738EF0F84B345676F85608
SHA1:	3FFF3786F5B669A24A56FFBE66593829DB7679B4
SHA-256:	ECD0497DB604060A3BF432EA4E2BDE76A427DCB6AFCEDC05C24567773EB0D25C
SHA-512:	6CAF317BCF8586E012058F997B17D7C53309C8F520EDC08A01510BE27F959792E3B0C811D938EDAABDC483887518EF97F3F8B268509B550D15CA42E8F4CA3641
Malicious:	false
Preview:	"use strict";..// Manually added data to be used by sbcs codec in addition to generated one...module.exports = {. // Not supported by iconv, not sure why.. "10029": "maccenteuro",. "maccenteuro": {. "type": "_sbcs",. "chars": "................................................................................................................................". },.. "808": "cp808",. "ibm808": "cp808",. "cp808": {. "type": "_sbcs",. "chars": "................................................................................................................................". },.. "mik": {. "type": "_sbcs",.

C:\Program Files (x86)\????????\resources\app\node_modules\iconv-lite\encodings\tables\big5-added.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	17717
Entropy (8bit):	6.109390635315052
Encrypted:	false
SSDEEP:	384:UdWyG4Gg/Dutxccky/pqyPtayOsXO5jrzVqMgoeeJJ5guJ3i:R4ovk+nPJOsov5qEeeJJK3
MD5:	F29EDA07F68F9E3F234638D42956F9AB
SHA1:	E61B2D77A36BCE976F563F659300E06A33C9E6E9
SHA-256:	DB94DB5E5D3AB696DDB0025685CFA85DA1864839A4A26AAB2F8F86F6B8382288
SHA-512:	AC83EF6C09AF9258273B586B0B33614B6DA6759930A23BCBF1D0E5428AFC076767916BC49B04A98A1BF952B8E8F9CB0F81283D747A724AF01162DBA184079BE4
Malicious:	false
Preview:	[.["8740","....................................................."],.["8767","................................"],.["87a1","................................................................................"],.["8840",".",4,"....................................................................."],.["88a1",".............."],.["8940","...."],.["8943","."],.["8946","...."],.["894c","...................................................."],.["89a1","......"],.["89ab","...."],.["89b0","...."],.["89b5","...

C:\Program Files (x86)\????????\resources\app\node_modules\iconv-lite\encodings\tables\cp936.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	47320
Entropy (8bit):	5.975707024029791
Encrypted:	false
SSDEEP:	768:qHRrIrFlXsioCUVgEHFrg232EXPIOqqGBMhHoVE9OfZ+mssnXpOH:qhI5aHCU7HFrtXPgqGOxbU5E
MD5:	9EAE47ACF0B20461508FDC4506BD905E
SHA1:	22B95CE3E9743DC8DF815B8A6B9C13D1A9F7C229
SHA-256:	8225BB693EFD380279ED7280B8F8419FD069C5F018D20D5946BF187AD92C0CF7
SHA-512:	781667081C82281F69334D917C53ED81A7D283C0B7CCD5C393591790A746C9C0096265403F28555157340C69E37A340BCEE23C3E27AA0BD9A7203D5FC81FDE74
Malicious:	false
Preview:	[.["0","\u0000",127,"."],.["8140","......................................",5,"..",9,".",6,".."],.["8180",".............................................",6,"...",4,"................",4,"...",5,"........................................."],.["8240","....",4,".",8,"...........",4,"....................",11],.["8280","..................",10,"..............",4,"......",7,".",5,".",8,"................",20,".....",4,".",6,"."],.["8340",".",17,".",5,"....",10,".........."

C:\Program Files (x86)\????????\resources\app\node_modules\iconv-lite\encodings\tables\cp949.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	38122
Entropy (8bit):	6.187510295563581
Encrypted:	false
SSDEEP:	768:VY4aBEddk76wYCuos24JmKyOgGcIFWS5gGMY5u0v5uXV4siZoCTQtPAFRp:C4a+jjwYfodOmKyOgGcIQS5gg5r+iZo2
MD5:	D99876B274D44FC737C8495BA36B3784
SHA1:	A3A6E6F61A78B50E54947F11CE8DAEBB8756209D
SHA-256:	77A56EA83D0D94D1DC620042AD3C897F0E40814BB05C0085D3AEED0018E8A3E8
SHA-512:	308E4A1051163AA335DE4A255689C579488CB0A01EFFC4CF57392C0F429BBFCAD466F698614EBBFAE38782BD6DED091DEAB012196605CA023E26B6A1C45C900C
Malicious:	false
Preview:	[.["0","\u0000",127],.["8141",".....",4,".......",6,"...."],.["8161",".........",9,"..",5,"."],.["8181","......",18,"......",4,"..........",6,"..",5,"....",6,".............",7,"..",7,"...........",4,".......",4,"...."],.["8241","...........",7,"...",5],.["8261","......",6,"...",5,"......"],.["8281",".",7,"..",7,"...........",4,"......",10,".",5,".",17,".",7,"......",6,"..",7,".......",18],.["8341",".....",5,"...",5,".",7],.["8361",".",18,"......."],.["8381","...............",4,"............",6,"..",5,".",5,".",46,".....",6,"..",5,"...",8],.["8441","...

C:\Program Files (x86)\????????\resources\app\node_modules\iconv-lite\encodings\tables\cp950.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	42356
Entropy (8bit):	5.945150159976492
Encrypted:	false
SSDEEP:	768:R69o3X4Rf9i7bwjpM+aweZjh8WcwLhYQB4nbwjTfjPMvTD3gFWCXxDJK98:4o3XK1i/Ay+aDZ4ChpBuorjk3IXxDJC8
MD5:	15D09686CE9E9BA80B3014D3161E2E7E
SHA1:	33AD3790A0660CD2B7C0C599A7F5D3C147596BEC
SHA-256:	99E2114DC4B39092617967C763F9EAEB4D8E70551AFC5884BAA3FB92827F3420
SHA-512:	6008770D8E8FCE0F18B1C5F2BC37B51908ECC75FC50D629AA505713FF5E8A934F5F9571703822DF0D22D3B6777B4192B727005E76CCEB578135A41B46C2FDE62
Malicious:	false
Preview:	[.["0","\u0000",127],.["a140","..............................................................."],.["a1a1","..............................................................",4,"............................"],.["a240","...................................",7,"....................."],.["a2a1","...............",9,".",9,".",8,"....",25,".",21],.["a340",".....",16,".",6,".",16,".",6,".",10],.["a3a1",".",25,"....."],.["a3e1","."],.["a440","..............................

C:\Program Files (x86)\????????\resources\app\node_modules\iconv-lite\encodings\tables\eucjp.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	41064
Entropy (8bit):	6.013263121353981
Encrypted:	false
SSDEEP:	768:WMC+35C36zZTSrW9QrABsFntp6dFW+uf0IlE50bOfoYZnkeNt9KPRr1:WMC+35C3kuW9uABOtMy0Iu50bOGeERr1
MD5:	98D5CF16FC6B791A0B2C829339766D16
SHA1:	9BEB6AFA39229A044FD6935A92CA5E997F6FAC78
SHA-256:	7C4FE279000F7E99FC7CD59AFB1DA21725DCEBDC1BABD9E3B883253A77ABB042
SHA-512:	1A923573B2D41EE7AB42BF6CD21BD17D04B8F0DFE2EBA7419000B2768BB5693C8ED5A32171A9F4E382981368C582C8409CD32A4E1067A4D4D47635C127A042C0
Malicious:	false
Preview:	[.["0","\u0000",127],.["8ea1",".",62],.["a1a1","..................................................",9,"..................................."],.["a2a1",".............."],.["a2ba","........"],.["a2ca","......."],.["a2dc","..............."],.["a2f2","........"],.["a2fe","."],.["a3b0",".",9],.["a3c1",".",25],.["a3e1",".",25],.["a4a1",".",82],.["a5a1",".",85],.["a6a1",".",16,".",6],.["a6c1",".",16,".",6],.["a7a1",".",5,"..",25],.["a7d1",".",5,"..",25],.["a8a1","................................"],.["ada1",".",19,".",9],.["adc0","......................."],.["addf",".......",4,"..

C:\Program Files (x86)\????????\resources\app\node_modules\iconv-lite\encodings\tables\gb18030-ranges.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2216
Entropy (8bit):	3.4322567660280536
Encrypted:	false
SSDEEP:	48:Y7U0CyxAMT6nlPZJ5kHK6TC74MUxUULKqXJU0X2VLO/wt2J8QbK:f0p2JGq6O7KK6XBYp
MD5:	4FBEC8C88ACBB1EF60A5AEBF9E8E719B
SHA1:	BFCE88FC92E98C19910FBEF1B02B85FB5D2CF2F9
SHA-256:	5A3CC11E38F05A0908442ACBF1C921D0B73F2A304FB6A9E4484E26EB1CA07D76
SHA-512:	B57A454D71E4F01D49ADC606A5C6AB5616869C54F0C3F9C30B80E7EF13A67246E9DFA5AACA06E96B0A76004CCFCA180175825141BB2A7366E65E8F7E443A43DA
Malicious:	false
Preview:	{"uChars":[128,165,169,178,184,216,226,235,238,244,248,251,253,258,276,284,300,325,329,334,364,463,465,467,469,471,473,475,477,506,594,610,712,716,730,930,938,962,970,1026,1104,1106,8209,8215,8218,8222,8231,8241,8244,8246,8252,8365,8452,8454,8458,8471,8482,8556,8570,8596,8602,8713,8720,8722,8726,8731,8737,8740,8742,8748,8751,8760,8766,8777,8781,8787,8802,8808,8816,8854,8858,8870,8896,8979,9322,9372,9548,9588,9616,9622,9634,9652,9662,9672,9676,9680,9702,9735,9738,9793,9795,11906,11909,11913,11917,11928,11944,11947,11951,11956,11960,11964,11979,12284,12292,12312,12319,12330,12351,12436,12447,12535,12543,12586,12842,12850,12964,13200,13215,13218,13253,13263,13267,13270,13384,13428,13727,13839,13851,14617,14703,14801,14816,14964,15183,15471,15585,16471,16736,17208,17325,17330,17374,17623,17997,18018,18212,18218,18301,18318,18760,18811,18814,18820,18823,18844,18848,18872,19576,19620,19738,19887,40870,59244,59336,59367,59413,59417,59423,59431,59437,59443,59452,59460,59478,59493,63789,63866,6

C:\Program Files (x86)\????????\resources\app\node_modules\iconv-lite\encodings\tables\gbk-added.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1247
Entropy (8bit):	5.05180472379974
Encrypted:	false
SSDEEP:	24:rKb78DifMioZMYxTChDzC98DpPciYKl6n6ES1L8JaxbtaXuAXGEu984zEb2YLBGQ:wfMrreh3CKxdl66XraXN6Y1GHt/dij
MD5:	73B54C6D97C0383EB3251D7764528672
SHA1:	013B886FF382CE21352B60717B7287AEB0CEB532
SHA-256:	10CBB08708F3A431977271887B2663F734390A22CEDF90875FAC9FDBD4BB5317
SHA-512:	F039C139D4D3C7E0DCF04EBA31FDA6725B868D2CD41764BBA00727E458E2BC3B9BFD1C883465EB525DD2942A0C1156B054E0FAB0420614A10D8D8F94B89FC372
Malicious:	false
Preview:	[.["a140",".",62],.["a180",".",32],.["a240",".",62],.["a280",".",32],.["a2ab",".",5],.["a2e3",".."],.["a2ef",".."],.["a2fd",".."],.["a340",".",62],.["a380",".",31,"."],.["a440",".",62],.["a480",".",32],.["a4f4",".",10],.["a540",".",62],.["a580",".",32],.["a5f7",".",7],.["a640",".",62],.["a680",".",32],.["a6b9",".",7],.["a6d9",".",6],.["a6ec",".."],.["a6f3","."],.["a6f6",".",8],.["a740",".",62],.["a780",".",32],.["a7c2",".",14],.["a7f2",".",12],.["a896",".",10],.["a8bc","."],.["a8bf","."],.["a8c1","...."],.["a8ea",".",20],.["a958","."],.["a95b","."],.["a95d","..."],.["a989","..",11],.["a997",".",12],.["a9f0",".",14],.["aaa1",".",93],.["aba1",".",93],.["aca1",".",93],.["ada1",".",93],.["aea1",".",93],.["afa1",".",93],.["d7fa",".",4],.["f8a1",".",93],.["f9a1",".",93],.["faa1",".",93],.["fba1",".",93],.["fca1",".",93],.["fda1",".",93],.["fe50","........

C:\Program Files (x86)\????????\resources\app\node_modules\iconv-lite\encodings\tables\shiftjis.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	23782
Entropy (8bit):	6.017531553224289
Encrypted:	false
SSDEEP:	384:OcKDbyVNOvQLWFycfjdVjI6VN2kW1cOxdYNjL7UujgTDE/gTD8:dKDbGMFFbZhb/IcOxgjPUPVQ
MD5:	6D542FFDF3409FD2E8BD01247777B6F7
SHA1:	E02D26E47A7B295222C3CA70015024CA163E7381
SHA-256:	02B0B120F697C48133E8B547E8DC594BC5B9F1C1799B50C2C5FF917298548558
SHA-512:	E02449D3561A4D3856C981FCC350D0836BA3E55C82DD96585E055F6E16DCFD2C1D3ECE44CF473F55924301A1143F66DD372793EDD13BA30254B2944657A3841C
Malicious:	false
Preview:	[.["0","\u0000",128],.["a1",".",62],.["8140","..................................................",9,"...."],.["8180","............................................."],.["81b8","........"],.["81c8","......."],.["81da","..............."],.["81f0","........"],.["81fc","."],.["824f",".",9],.["8260",".",25],.["8281",".",25],.["829f",".",82],.["8340",".",62],.["8380",".",22],.["839f",".",16,".",6],.["83bf",".",16,".",6],.["8440",".",5,"..",25],.["8470",".",5,"..",7],.["8480",".",17],.["849f","................................"],.["8740",".",19,".",9],.["875f","......................."],.["877e"

C:\Program Files (x86)\????????\resources\app\node_modules\iconv-lite\encodings\utf16.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	5502
Entropy (8bit):	4.828208670463655
Encrypted:	false
SSDEEP:	96:x+reLQ49g1BccQSYQxssARQ1zCy/UX2Ga:zLQ49glYQxCRQxCyMXRa
MD5:	CFBD24DE620BD461D2D1DD9B9553E69C
SHA1:	4D16C1C169AE5902B17009D5F54216EF2A503713
SHA-256:	506EABEE3546C0551F78E6ADB3102F4E73E7312B4C709117D0DA016B0F5B3D80
SHA-512:	35497628821452BE9729955BD4870C6626799C94EDCAD60D6F638141E253E0947319DC044E34F84059AECF7231C9DA65562B9AD84BCE6FE68D8504279025BDA2
Malicious:	false
Preview:	"use strict";.var Buffer = require("safer-buffer").Buffer;..// Note: UTF16-LE (or UCS2) codec is Node.js native. See encodings/internal.js..// == UTF16-BE codec. ==========================================================..exports.utf16be = Utf16BECodec;.function Utf16BECodec() {.}..Utf16BECodec.prototype.encoder = Utf16BEEncoder;.Utf16BECodec.prototype.decoder = Utf16BEDecoder;.Utf16BECodec.prototype.bomAware = true;...// -- Encoding..function Utf16BEEncoder() {.}..Utf16BEEncoder.prototype.write = function(str) {. var buf = Buffer.from(str, 'ucs2');. for (var i = 0; i < buf.length; i += 2) {. var tmp = buf[i]; buf[i] = buf[i+1]; buf[i+1] = tmp;. }. return buf;.}..Utf16BEEncoder.prototype.end = function() {.}...// -- Decoding..function Utf16BEDecoder() {. this.overflowByte = -1;.}..Utf16BEDecoder.prototype.write = function(buf) {. if (buf.length == 0). return '';.. var buf2 = Buffer.alloc(buf.length + 1),. i = 0, j = 0;.. if (this.overflowByt

C:\Program Files (x86)\????????\resources\app\node_modules\iconv-lite\encodings\utf32.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9982
Entropy (8bit):	4.733283798893383
Encrypted:	false
SSDEEP:	192:/ZzpR+fLmFv3f+To4oxezCG/DBc6BPXXXxin+Y48DY2V/NCylM:/ZzpR+51oxexjXYn+UD8
MD5:	58140AA0971B80549F981B175E0F0625
SHA1:	FE68FF5F07B7AD791DD041F9183F68690BB05F0F
SHA-256:	3A762514744C1EDCAF5262F77DF105F89581C1292B8321B6F96AD49E9244D95A
SHA-512:	DD2DA193982EF298856E62B8F6098F8AFCA1D33D83A46F487F654BC67B0795F75941DFF8A50502E534244CC70B1F4539CA1D4F9F60DE132A03C5C7B20A40FC45
Malicious:	false
Preview:	'use strict';..var Buffer = require('safer-buffer').Buffer;..// == UTF32-LE/BE codec. ==========================================================..exports._utf32 = Utf32Codec;..function Utf32Codec(codecOptions, iconv) {. this.iconv = iconv;. this.bomAware = true;. this.isLE = codecOptions.isLE;.}..exports.utf32le = { type: '_utf32', isLE: true };.exports.utf32be = { type: '_utf32', isLE: false };..// Aliases.exports.ucs4le = 'utf32le';.exports.ucs4be = 'utf32be';..Utf32Codec.prototype.encoder = Utf32Encoder;.Utf32Codec.prototype.decoder = Utf32Decoder;..// -- Encoding..function Utf32Encoder(options, codec) {. this.isLE = codec.isLE;. this.highSurrogate = 0;.}..Utf32Encoder.prototype.write = function(str) {. var src = Buffer.from(str, 'ucs2');. var dst = Buffer.alloc(src.length * 2);. var write32 = this.isLE ? dst.writeUInt32LE : dst.writeUInt32BE;. var offset = 0;.. for (var i = 0; i < src.length; i += 2) {. var code = src.readUInt16LE(i);. va

C:\Program Files (x86)\????????\resources\app\node_modules\iconv-lite\encodings\utf7.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	9283
Entropy (8bit):	4.799985407303719
Encrypted:	false
SSDEEP:	192:kh8t8ooyeQ+OpVwnHLj9ZiK/Cyb6Mu0qB8kFydwe+a:Ae86HCnHLj69QqBTeT
MD5:	B58375812EB310C311ECE8E9FABC6383
SHA1:	DDE9466EC5423F26F0A70D151FA7A0E2D4555D42
SHA-256:	289DA5C0C44B1EC4A502E2862EE9E46D9B1758420904385FED0ABAE41F138A6C
SHA-512:	AA9F4ABBFC7441D930078C30733EF01A17FCD79CBB0E80C4F0F04FA914E70D813227912EBA21009A3E66FFFFBF6713E066E354ADFC392117A7F4921224C5AAD9
Malicious:	false
Preview:	"use strict";.var Buffer = require("safer-buffer").Buffer;..// UTF-7 codec, according to https://tools.ietf.org/html/rfc2152.// See also below a UTF-7-IMAP codec, according to http://tools.ietf.org/html/rfc3501#section-5.1.3..exports.utf7 = Utf7Codec;.exports.unicode11utf7 = 'utf7'; // Alias UNICODE-1-1-UTF-7.function Utf7Codec(codecOptions, iconv) {. this.iconv = iconv;.};..Utf7Codec.prototype.encoder = Utf7Encoder;.Utf7Codec.prototype.decoder = Utf7Decoder;.Utf7Codec.prototype.bomAware = true;...// -- Encoding..var nonDirectChars = /[^A-Za-z0-9',-\.\/:\? \n\r\t]+/g;..function Utf7Encoder(options, codec) {. this.iconv = codec.iconv;.}..Utf7Encoder.prototype.write = function(str) {. // Naive implementation.. // Non-direct chars are encoded as "+<base64>-"; single "+" char is encoded as "+-".. return Buffer.from(str.replace(nonDirectChars, function(chunk) {. return "+" + (chunk === '+' ? '' : . this.iconv.encode(chunk, 'utf16-be').toString('base64').

C:\Program Files (x86)\????????\resources\app\node_modules\iconv-lite\lib\bom-handling.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1109
Entropy (8bit):	4.6422103165542135
Encrypted:	false
SSDEEP:	24:vV55erOVEJPASyl6ZSQtNOovWmzkALvNF8lG8:vVberOVEdASyl6ZVtNOKWmzkAZ2lG8
MD5:	7B3D4519F05BF0CC8D70A4D950C72C55
SHA1:	5C6518CE3ACC35C3E1DA961BC02C110E08F81DB2
SHA-256:	C230D25D8E7FBB50960C634B636B71327C409E9A77E67FE9446B566BDCEA362D
SHA-512:	BD62DF0406AF2F67D45FC418FAEC70D6D63F58112704CFDF9A28BC633696043554A09048E69ABBB4E3DDE653D85F9D64E9D0D5C0117C7D9D404914DA5323FC07
Malicious:	false
Preview:	"use strict";..var BOMChar = '\uFEFF';..exports.PrependBOM = PrependBOMWrapper.function PrependBOMWrapper(encoder, options) {. this.encoder = encoder;. this.addBOM = true;.}..PrependBOMWrapper.prototype.write = function(str) {. if (this.addBOM) {. str = BOMChar + str;. this.addBOM = false;. }.. return this.encoder.write(str);.}..PrependBOMWrapper.prototype.end = function() {. return this.encoder.end();.}...//------------------------------------------------------------------------------..exports.StripBOM = StripBOMWrapper;.function StripBOMWrapper(decoder, options) {. this.decoder = decoder;. this.pass = false;. this.options = options \|\| {};.}..StripBOMWrapper.prototype.write = function(buf) {. var res = this.decoder.write(buf);. if (this.pass \|\| !res). return res;.. if (res[0] === BOMChar) {. res = res.slice(1);. if (typeof this.options.stripBOM === 'function'). this.options.stripBOM();. }.. this.pa

C:\Program Files (x86)\????????\resources\app\node_modules\iconv-lite\lib\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	6321
Entropy (8bit):	4.6950977763502
Encrypted:	false
SSDEEP:	96:TWY5niEC/jgNGAPtbCnz1lrDVOlraCr3q14lYU5cO5FnTncIWyY4jAvBsPwFnqei:6EiEajiLCzLrDCraMaal95jFngblK45i
MD5:	B09DB055087D9A4CCA8FED2D3193413A
SHA1:	0FF1265A3076562AD4830C8C5F247A80BB1832C5
SHA-256:	0CB1506E70126AA00BC5BDF12F2200DB89DB032E8DABF23DCDD6A92B37D0F2AF
SHA-512:	0AFAD6EE7587FEAFBBEBBCD4410F78C1B888C0D22B3068B250761CAD6192E99DDC28E78E328C2B05DA3A23B5AC384DC3A76D75703D63325363757EE7A018208D
Malicious:	false
Preview:	"use strict";..var Buffer = require("safer-buffer").Buffer;..var bomHandling = require("./bom-handling"),. iconv = module.exports;..// All codecs and aliases are kept here, keyed by encoding name/alias..// They are lazy loaded in `iconv.getCodec` from `encodings/index.js`..iconv.encodings = null;..// Characters emitted in case of error..iconv.defaultCharUnicode = '.';.iconv.defaultCharSingleByte = '?';..// Public API..iconv.encode = function encode(str, encoding, options) {. str = "" + (str \|\| ""); // Ensure string... var encoder = iconv.getEncoder(encoding, options);.. var res = encoder.write(str);. var trail = encoder.end();. . return (trail && trail.length > 0) ? Buffer.concat([res, trail]) : res;.}..iconv.decode = function decode(buf, encoding, options) {. if (typeof buf === 'string') {. if (!iconv.skipDecodeWarning) {. console.error('Iconv-lite warning: decode()-ing strings is deprecated. Refer to https://github.com/ashtuchkin/iconv-lite

C:\Program Files (x86)\????????\resources\app\node_modules\iconv-lite\lib\streams.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3380
Entropy (8bit):	4.44077698521686
Encrypted:	false
SSDEEP:	48:TzamT6OEEDBHFYUOba6byHBelgtqFcMSsGb3rVbiBrVb4HC1x:TzF6OEEfYbbHbyHBelgwczb8b4HC1x
MD5:	8411EA9ECD953ED52D7554EFC623934D
SHA1:	C837BB91B645BA82E9EFFA399DB4B0ACF263C83B
SHA-256:	368596CFA80B9B9C6B93F2FDE73615F10E89D650E6A1C92D3C07D56C34E4E393
SHA-512:	26BE5E7E7D4699084E34E960DAFAC3DBAAD3A71B8D28529CD5907FA82BE058BA085F57136496C1F96AA30EF3DE5AC387981751E806A35446F709396ED769FE35
Malicious:	false
Preview:	"use strict";..var Buffer = require("safer-buffer").Buffer;..// NOTE: Due to 'stream' module being pretty large (~100Kb, significant in browser environments), .// we opt to dependency-inject it instead of creating a hard dependency..module.exports = function(stream_module) {. var Transform = stream_module.Transform;.. // == Encoder stream =======================================================.. function IconvLiteEncoderStream(conv, options) {. this.conv = conv;. options = options \|\| {};. options.decodeStrings = false; // We accept only strings, so we don't need to decode them.. Transform.call(this, options);. }.. IconvLiteEncoderStream.prototype = Object.create(Transform.prototype, {. constructor: { value: IconvLiteEncoderStream }. });.. IconvLiteEncoderStream.prototype._transform = function(chunk, encoding, done) {. if (typeof chunk != 'string'). return done(new Error("Iconv encoding stream needs strings as its

C:\Program Files (x86)\????????\resources\app\node_modules\iconv-lite\package.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	825
Entropy (8bit):	4.7204407966929365
Encrypted:	false
SSDEEP:	12:Q6qySAKkPcnvATxsHxE7BLac0zH6fMHWPfVb3YguPxhWhTVbmF2Wu/EGH1p:QaSAKAcvZSGZ7HWnx0IQw9H1p
MD5:	7EAA50FB7C715068FB2BAF1FF08BAE78
SHA1:	810C63352FFA15AB3BDA8F3ECF9A4A5782A88323
SHA-256:	9F9D0DAAC6B1CFFC2F54E4D830353573E0A5FC95E5721C3245B5E7DCDEC29AAD
SHA-512:	6A16BA40E2759BC23F5E18385CDDEF53A8BBD652C659FD5E6E85C0500385C69E70B9F4362649E273D78CFD4785F54ED930827EB330790BC756756993E63399D4
Malicious:	false
Preview:	{. "author": {. "name": "Alexander Shtuchkin",. "email": "ashtuchkin@gmail.com". },. "browser": {. "stream": false. },. "dependencies": {. "safer-buffer": ">= 2.1.2 < 3.0.0". },. "deprecated": false,. "description": "Convert character encodings in pure javascript.",. "devDependencies": {. "async": "^3.2.0",. "c8": "^7.2.0",. "errto": "^0.2.1",. "iconv": "^2.3.5",. "mocha": "^3.5.3",. "request": "^2.88.2",. "semver": "^6.3.0",. "unorm": "^1.6.0". },. "engines": {. "node": ">=0.10.0". },. "homepage": "https://github.com/ashtuchkin/iconv-lite",. "license": "MIT",. "main": "./lib/index.js",. "name": "iconv-lite",. "repository": {. "type": "git",. "url": "git://github.com/ashtuchkin/iconv-lite.git". },. "typings": "./lib/index.d.ts",. "version": "0.6.3".}

C:\Program Files (x86)\????????\resources\app\node_modules\js-yaml\LICENSE

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1084
Entropy (8bit):	5.134279905644587
Encrypted:	false
SSDEEP:	24:zrmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:zaJHlxE35QHOs5exm3ogF5n
MD5:	EFFD621A9BF5D72D6A7E6EF819BF3AFB
SHA1:	CF1619AED46C3C608C54E1E4BDEC5E7E38E436A7
SHA-256:	A07BC24468B9654CE76A547D47A2DB282D07733B715DB4C73A98BD63961F9550
SHA-512:	3114CC7BC9E621038ADCEB8D4A990C2201182C3B851E18D1D9BE8BC1E891636550131CA6D2D0FA3B284A6596FE1DB6D83424756E51BE98EC04FAA5FB3D76EE51
Malicious:	false
Preview:	(The MIT License)..Copyright (C) 2011-2015 by Vitaly Puzrin..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT

C:\Program Files (x86)\????????\resources\app\node_modules\js-yaml\bin\js-yaml.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2736
Entropy (8bit):	4.748509095104565
Encrypted:	false
SSDEEP:	48:s1DGbbXdrmwH3cWKK57f7Lsu6d4tTD+DIuhvg0yrmGbWdmavgAaBG:xdrmFKMzJYrI
MD5:	48FBBB5E28323773255519306AD9F477
SHA1:	61236DB81BFCDC4F46A3BE31C3D208E356A7D49B
SHA-256:	6D7749DFD8019095970F4366CD09EC3ABEF9DEAA3F870709DFFECB027E58902D
SHA-512:	8A4E547EF22DDF054ACADFE74EC7E8A083AF03D7FDFE918FCF0B41D155F0E3163C58F94097E4FFFEFFA628DED2DE364F9620D0208BBE7E5AC9C01073C374AA26
Malicious:	false
Preview:	#!/usr/bin/env node...'use strict';../eslint-disable no-console/...var fs = require('fs');.var argparse = require('argparse');.var yaml = require('..');...////////////////////////////////////////////////////////////////////////////////...var cli = new argparse.ArgumentParser({. prog: 'js-yaml',. add_help: true.});..cli.add_argument('-v', '--version', {. action: 'version',. version: require('../package.json').version.});..cli.add_argument('-c', '--compact', {. help: 'Display errors in compact mode',. action: 'store_true'.});..// deprecated (not needed after we removed output colors).// option suppressed, but not completely removed for compatibility.cli.add_argument('-j', '--to-json', {. help: argparse.SUPPRESS,. dest: 'json',. action: 'store_true'.});..cli.add_argument('-t', '--trace', {. help: 'Show stack trace on error',. action: 'store_true'.});..cli.add_argument('file', {. help: 'File to read, utf-8 encoded without BOM',. nargs: '?',. defaul

C:\Program Files (x86)\????????\resources\app\node_modules\js-yaml\dist\js-yaml.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	114359
Entropy (8bit):	4.865865725619177
Encrypted:	false
SSDEEP:	1536:Gm+C8yok2CgEiQM+lPN3VHatOcUeYepSQ:G3Cyk2CdiQM+ldVHatpSQ
MD5:	DCD17F59C2806A87A22831D9E9457236
SHA1:	F43D726B2DDBD6576493635FB448B3FF779FA5C7
SHA-256:	C738B0020702AA631ABD8DE23A902A3079D99D3060E44166955CB51F570881C4
SHA-512:	0B0C6B2C8374770C3A95173FA0A799888F681A53A86F61CF314D18BB483E3F7FC6D5CB938A2FADB748E9C842A18A57EB57B0FFCE6BCA8953C81D40D4EB16C1C6
Malicious:	false
Preview:	./! js-yaml 4.1.0 https://github.com/nodeca/js-yaml @license MIT /.(function (global, factory) {. typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :. typeof define === 'function' && define.amd ? define(['exports'], factory) :. (global = typeof globalThis !== 'undefined' ? globalThis : global \|\| self, factory(global.jsyaml = {}));.}(this, (function (exports) { 'use strict';.. function isNothing(subject) {. return (typeof subject === 'undefined') \|\| (subject === null);. }... function isObject(subject) {. return (typeof subject === 'object') && (subject !== null);. }... function toArray(sequence) {. if (Array.isArray(sequence)) return sequence;. else if (isNothing(sequence)) return [];.. return [ sequence ];. }... function extend(target, source) {. var index, length, key, sourceKeys;.. if (source) {. sourceKeys = Object.keys(source);.. for (index = 0, length = sourceKeys.length; index < length; index += 1) {.

C:\Program Files (x86)\????????\resources\app\node_modules\js-yaml\dist\js-yaml.min.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	39430
Entropy (8bit):	5.376678276615718
Encrypted:	false
SSDEEP:	768:k5JZiL3lrXSzwprdYKitpclqasyZiFNU/KMTbHlII:k8L3xqPtSqaKvACI
MD5:	99F96803D123239C14D61D54DE76A2BF
SHA1:	64052AE48AF66FF9C997D75497C8A1495AE99FB5
SHA-256:	45DC3DD03DC07A06705A2C2989B8C7F709013F04BD5386E3279D4E447F07EBD7
SHA-512:	092061551132CC70230057C194805A923A1150AA7987B552C1E3F422747FA40272A6D1FBA5EBA10ACA8023FB2757E4F06665D9AA85249695E9E91EB032761FE5
Malicious:	false
Preview:	/! js-yaml 4.1.0 https://github.com/nodeca/js-yaml @license MIT /.!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globalThis:e\|\|self).jsyaml={})}(this,(function(e){"use strict";function t(e){return null==e}var n={isNothing:t,isObject:function(e){return"object"==typeof e&&null!==e},toArray:function(e){return Array.isArray(e)?e:t(e)?[]:[e]},repeat:function(e,t){var n,i="";for(n=0;n<t;n+=1)i+=e;return i},isNegativeZero:function(e){return 0===e&&Number.NEGATIVE_INFINITY===1/e},extend:function(e,t){var n,i,r,o;if(t)for(n=0,i=(o=Object.keys(t)).length;n<i;n+=1)e[r=o[n]]=t[r];return e}};function i(e,t){var n="",i=e.reason\|\|"(unknown reason)";return e.mark?(e.mark.name&&(n+='in "'+e.mark.name+'" '),n+="("+(e.mark.line+1)+":"+(e.mark.column+1)+")",!t&&e.mark.snippet&&(n+="\n\n"+e.mark.snippet),i+" "+n):i}function r(e,t){Error.call(this),this.name="YAMLException",this.

C:\Program Files (x86)\????????\resources\app\node_modules\js-yaml\dist\js-yaml.mjs

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	107533
Entropy (8bit):	5.02094066617432
Encrypted:	false
SSDEEP:	1536:3uq8aQ0+agcaQ8+XFnFvdPqdWUkeQepigiN:eqa0+ataQ8+1FdPqdBiBN
MD5:	734A616792F01CF863410F6191A155D5
SHA1:	1AE28E0B6B6E9C4D2D2E7A8D315166D992F5A448
SHA-256:	16F210B939B359B6EC8DDE581EB62C157185711DC7B719B33779C43DB5C31A91
SHA-512:	A96E34CFC41AB6E64FE4E1DA6D585FB0DB6B786D941B5A59DAF0F8719D2EF6D740EB3E9660507E1C78104A47B021136E3EA62B5CFF22FE1E75FB5F471D822A90
Malicious:	false
Preview:	./! js-yaml 4.1.0 https://github.com/nodeca/js-yaml @license MIT /.function isNothing(subject) {. return (typeof subject === 'undefined') \|\| (subject === null);.}...function isObject(subject) {. return (typeof subject === 'object') && (subject !== null);.}...function toArray(sequence) {. if (Array.isArray(sequence)) return sequence;. else if (isNothing(sequence)) return [];.. return [ sequence ];.}...function extend(target, source) {. var index, length, key, sourceKeys;.. if (source) {. sourceKeys = Object.keys(source);.. for (index = 0, length = sourceKeys.length; index < length; index += 1) {. key = sourceKeys[index];. target[key] = source[key];. }. }.. return target;.}...function repeat(string, count) {. var result = '', cycle;.. for (cycle = 0; cycle < count; cycle += 1) {. result += string;. }.. return result;.}...function isNegativeZero(number) {. return (number === 0) && (Number.NEGATIVE_INFINITY === 1 / number);.}...var isNothing_1 = i

C:\Program Files (x86)\????????\resources\app\node_modules\js-yaml\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1793
Entropy (8bit):	4.774946677389129
Encrypted:	false
SSDEEP:	48:s5UIglG0l+08000+D0DmX0pPzoiC+EfdhXGDLRA030f:YdglG0U08000w0Ds0pPzLC+Efdh2DLR8
MD5:	2416FBE5CB4F084FEB14864AF72A25FB
SHA1:	D344F19401813A119112BC745AE95BBC1D1E0096
SHA-256:	7D1EBC0D9929B9124997B439D1A1FD9AFF8FEB6BB0A1B59E977EA638944F34BA
SHA-512:	42222B866A5CB8C0080FC42B0F0B49C11E83813E150BD604D07BA1C6DF7E2B0FB58083118BA6F972396EDD6B966A7833CEC06BE9DD414004443505ECA686A516
Malicious:	false
Preview:	'use strict';...var loader = require('./lib/loader');.var dumper = require('./lib/dumper');...function renamed(from, to) {. return function () {. throw new Error('Function yaml.' + from + ' is removed in js-yaml 4. ' +. 'Use yaml.' + to + ' instead, which is now safe by default.');. };.}...module.exports.Type = require('./lib/type');.module.exports.Schema = require('./lib/schema');.module.exports.FAILSAFE_SCHEMA = require('./lib/schema/failsafe');.module.exports.JSON_SCHEMA = require('./lib/schema/json');.module.exports.CORE_SCHEMA = require('./lib/schema/core');.module.exports.DEFAULT_SCHEMA = require('./lib/schema/default');.module.exports.load = loader.load;.module.exports.loadAll = loader.loadAll;.module.exports.dump = dumper.dump;.module.exports.YAMLException = require('./lib/exception');..// Re-export all types in case user wants to create custom schema.module.exports.ty

C:\Program Files (x86)\????????\resources\app\node_modules\js-yaml\lib\common.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1177
Entropy (8bit):	4.786365193141055
Encrypted:	false
SSDEEP:	24:5USnRIlMI6gI6gwOI0A+BTzoRlc5IveQ4tBOBkBQBXMBwBpy:5xRIlMI6/wl+BTSlc5SWQa6CWDy
MD5:	338AC6E1778DB262F368223D252FDDEA
SHA1:	F98F5657B7F32C09D39B720D18D07FAB29B09C05
SHA-256:	9211491F8E0058A419A4664E36BB4EC6509655AABE6BD537EDDF941FDF34E734
SHA-512:	6A474DA0F25C5D3554F590B4CE800D025002C6731FE8399D25E89B0DE609666081C4D205A515F2029B96CE1ED22F4F37712D095C61305D8480D0E30FF7BBEE4F
Malicious:	false
Preview:	'use strict';...function isNothing(subject) {. return (typeof subject === 'undefined') \|\| (subject === null);.}...function isObject(subject) {. return (typeof subject === 'object') && (subject !== null);.}...function toArray(sequence) {. if (Array.isArray(sequence)) return sequence;. else if (isNothing(sequence)) return [];.. return [ sequence ];.}...function extend(target, source) {. var index, length, key, sourceKeys;.. if (source) {. sourceKeys = Object.keys(source);.. for (index = 0, length = sourceKeys.length; index < length; index += 1) {. key = sourceKeys[index];. target[key] = source[key];. }. }.. return target;.}...function repeat(string, count) {. var result = '', cycle;.. for (cycle = 0; cycle < count; cycle += 1) {. result += string;. }.. return result;.}...function isNegativeZero(number) {. return (number === 0) && (Number.NEGATIVE_INFINITY === 1 / number);.}...module.exports.isNothing = isNothing;.module.exports.isObject = is

C:\Program Files (x86)\????????\resources\app\node_modules\js-yaml\lib\dumper.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	31893
Entropy (8bit):	5.113702104669201
Encrypted:	false
SSDEEP:	384:GazGKJKw+QE1qtZdX0PA+wiOxKeQeRbIStKStrO4Cu:cIMwX0kKeQepRtKSwO
MD5:	374BAA01E89D997331F6E5AD6604D090
SHA1:	16663E5B216D9D4807DCC9C0DDA43EBD5B624086
SHA-256:	1A0C7FC01DF0E950CAF526C2A96B1E9FBAC1DBC5DC125E83657F7B723A505CA3
SHA-512:	EE131A39BEE66B20429AC65E2FE2C4F3F14CF4B68E8FBA1422E8354968D61675013105F113CC60DD270BBB874A17231EC975D0BA0E4A64F507492AD1E5F67009
Malicious:	false
Preview:	'use strict';../eslint-disable no-use-before-define/..var common = require('./common');.var YAMLException = require('./exception');.var DEFAULT_SCHEMA = require('./schema/default');..var _toString = Object.prototype.toString;.var _hasOwnProperty = Object.prototype.hasOwnProperty;..var CHAR_BOM = 0xFEFF;.var CHAR_TAB = 0x09; /* Tab /.var CHAR_LINE_FEED = 0x0A; / LF /.var CHAR_CARRIAGE_RETURN = 0x0D; / CR /.var CHAR_SPACE = 0x20; / Space /.var CHAR_EXCLAMATION = 0x21; / ! /.var CHAR_DOUBLE_QUOTE = 0x22; / " /.var CHAR_SHARP = 0x23; / # /.var CHAR_PERCENT = 0x25; / % /.var CHAR_AMPERSAND = 0x26; / & /.var CHAR_SINGLE_QUOTE = 0x27; / ' /.var CHAR_ASTERISK = 0x2A; / * /.var CHAR_COMMA = 0x2C; / , /.var CHAR_MINUS = 0x2D; / - /.var CHAR_COLON = 0x3A; /

C:\Program Files (x86)\????????\resources\app\node_modules\js-yaml\lib\exception.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1299
Entropy (8bit):	4.9129904931784765
Encrypted:	false
SSDEEP:	24:BR6Zk6JMc2JTpDL73t6rIGMI7c3o36myvRIiTUR54RITXgkc+ZK6YRcBQ:BQZTGcsBtSW33g8RZGGRItuvcO
MD5:	DA3D481A9D95FDF5C7675D687FD2E6C4
SHA1:	02F86AE28B5D3D193365B2592C2F5E9600D0C008
SHA-256:	3DCD70E20270A93B8769204174A1949A133A41AFBC8F1A74A9C6AB73FD60A179
SHA-512:	52D1B352FF26C90BD6B6C6B910044F63E0A5B8997C2C0AB31B1AE7D2DDE7B506301D4820A7D606B44EB38FB183D235A08C52C752DACC3B03189A68BE83B09699
Malicious:	false
Preview:	// YAML error class. http://stackoverflow.com/questions/8458984.//.'use strict';...function formatError(exception, compact) {. var where = '', message = exception.reason \|\| '(unknown reason)';.. if (!exception.mark) return message;.. if (exception.mark.name) {. where += 'in "' + exception.mark.name + '" ';. }.. where += '(' + (exception.mark.line + 1) + ':' + (exception.mark.column + 1) + ')';.. if (!compact && exception.mark.snippet) {. where += '\n\n' + exception.mark.snippet;. }.. return message + ' ' + where;.}...function YAMLException(reason, mark) {. // Super constructor. Error.call(this);.. this.name = 'YAMLException';. this.reason = reason;. this.mark = mark;. this.message = formatError(this, false);.. // Include stack trace in error object. if (Error.captureStackTrace) {. // Chrome and NodeJS. Error.captureStackTrace(this, this.constructor);. } else {. // FF, IE 10+ and Safari 6+. Fallback for others. this.stack = (new Error()).stack \|\| '';.

C:\Program Files (x86)\????????\resources\app\node_modules\js-yaml\lib\loader.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	47142
Entropy (8bit):	4.852382248845807
Encrypted:	false
SSDEEP:	768:LEorz2gxgcaQ8+fxPLJgnFa6dPqdR3UTaW:AagcaQ8+f4nFvdPqd5Uh
MD5:	D9F2C741C38159FF1651D77785DCF3E2
SHA1:	C8E4DA323458D58DE432A9B35C4A723E33E13541
SHA-256:	DD1053D4A607CC29DD2020AC77AFA283002C8FD1D9B0D7042A7FC763C883F794
SHA-512:	E8E69D725DD7708A374142210DDE266862041F04ECEF4B40BB44DD156F354786D2B179B03ED47CAD12D84AE8C832FE75D5E2CDBBE0B2D42CEEACEDC6FD07DB2E
Malicious:	false
Preview:	'use strict';../eslint-disable max-len,no-use-before-define/..var common = require('./common');.var YAMLException = require('./exception');.var makeSnippet = require('./snippet');.var DEFAULT_SCHEMA = require('./schema/default');...var _hasOwnProperty = Object.prototype.hasOwnProperty;...var CONTEXT_FLOW_IN = 1;.var CONTEXT_FLOW_OUT = 2;.var CONTEXT_BLOCK_IN = 3;.var CONTEXT_BLOCK_OUT = 4;...var CHOMPING_CLIP = 1;.var CHOMPING_STRIP = 2;.var CHOMPING_KEEP = 3;...var PATTERN_NON_PRINTABLE = /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F-\x84\x86-\x9F\uFFFE\uFFFF]\|[\uD800-\uDBFF](?![\uDC00-\uDFFF])\|(?:[^\uD800-\uDBFF]\|^)[\uDC00-\uDFFF]/;.var PATTERN_NON_ASCII_LINE_BREAKS = /[\x85\u2028\u2029]/;.var PATTERN_FLOW_INDICATORS = /[,\[\]\{\}]/;.var PATTERN_TAG_HANDLE = /^(?:!\|!!\|![a-z\-]+!)$/i;.var PATTERN_TAG_URI = /^(?:!\|[^,\[\]\{\}])(?:%[0-9a-f]{2}\|[0-9a-z\-#;\/\?:@&=\+\$,_\.!~\'\[\]])$/i;...function _class(obj) { return

C:\Program Files (x86)\????????\resources\app\node_modules\js-yaml\lib\schema.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	4.775427527050755
Encrypted:	false
SSDEEP:	96:s0t9GJ1Y23UandT3fMZGxiD5XoCo8E6stpa9:s02J1Y23/3fMoYD5XoCoM9
MD5:	2B5D449469E0A39DAA0762E7B23861B3
SHA1:	5DD8D0CA73A42D81AE4484DDBD20A24870804B66
SHA-256:	BE14297EA2917DCB9EE11A7DEB5B3A871F57AD978E5368C62407C83CD4DD18BF
SHA-512:	50781EA5E7C1658B053254EFB3E66FE2339C6C5F2E544F8A7418DE47B35F8E4DF95AF0F71165053392C71C02ABEFFB7C0B08020CB71255F59C0721AEA95CEE85
Malicious:	false
Preview:	'use strict';../eslint-disable max-len/..var YAMLException = require('./exception');.var Type = require('./type');...function compileList(schema, name) {. var result = [];.. schema[name].forEach(function (currentType) {. var newIndex = result.length;.. result.forEach(function (previousType, previousIndex) {. if (previousType.tag === currentType.tag &&. previousType.kind === currentType.kind &&. previousType.multi === currentType.multi) {.. newIndex = previousIndex;. }. });.. result[newIndex] = currentType;. });.. return result;.}...function compileMap(/* lists... */) {. var result = {. scalar: {},. sequence: {},. mapping: {},. fallback: {},. multi: {. scalar: [],. sequence: [],. mapping: [],. fallback: []. }. }, index, length;.. function collectType(type) {. if (type.multi) {. result.multi[type.kind].push(type);. result.multi['f

C:\Program Files (x86)\????????\resources\app\node_modules\js-yaml\lib\schema\core.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	288
Entropy (8bit):	5.0278867782979635
Encrypted:	false
SSDEEP:	6:jUx+vKKhn4ffcELVyzjTYFBNtw8zt7sRZNZiI/R2J1XxDB1n:jy+5AWjTetw8OvalB1n
MD5:	99C2F155E07E4A1D3614C2AA0CDD2A96
SHA1:	743E3D8D55BB47EEB2AF13C160091B6FA8D4E88B
SHA-256:	D736E58B5A947A5B86056BF4B881C8002314B6534AB1A697A67CC47E1B2DC2A0
SHA-512:	F7CB95993770A1A8D98B9A650D2DDE7EA2593014598B1121997D138C9CCA99BAF67B459743D2131D7A9A368DB6BB8C619B1163833314FA0EF3D68A3C8BC6E52B
Malicious:	false
Preview:	// Standard YAML's Core schema..// http://www.yaml.org/spec/1.2/spec.html#id2804923.//.// NOTE: JS-YAML does not support schema-specific tag resolution restrictions..// So, Core schema has no distinctions from JSON schema is JS-YAML....'use strict';...module.exports = require('./json');.

C:\Program Files (x86)\????????\resources\app\node_modules\js-yaml\lib\schema\default.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	538
Entropy (8bit):	4.7735461574831834
Encrypted:	false
SSDEEP:	12:j/TiXXpE5VBD/Fl9vrAUAv4B68zOyfvFFyLyLpNyCT:DOXXp4VBTLJ8Vv4BXzhfv6mKu
MD5:	B44215C56A47A9AE6D6E7BB11A2D59A8
SHA1:	18ACB30562577D46A30A6E6DC8E23B3B80A719AB
SHA-256:	AA09D88B4BE7C51D8B6CB0B533C51AE17F534DEED476C576B8D4CD3CE1BF165A
SHA-512:	96CDB14A708A5582FB4864AE12DCA3F894685FDF7350B08E82B172EA50C293737C584688559F294E81390D6ED96D6D0C7FE92DC0E3089B073A9496BEF4F36E29
Malicious:	false
Preview:	// JS-YAML's default schema for `safeLoad` function..// It is not described in the YAML specification..//.// This schema is based on standard YAML's Core schema and includes most of.// extra types described at YAML tag repository. (http://yaml.org/type/)...'use strict';...module.exports = require('./core').extend({. implicit: [. require('../type/timestamp'),. require('../type/merge'). ],. explicit: [. require('../type/binary'),. require('../type/omap'),. require('../type/pairs'),. require('../type/set'). ].});.

C:\Program Files (x86)\????????\resources\app\node_modules\js-yaml\lib\schema\failsafe.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	278
Entropy (8bit):	4.940054524667476
Encrypted:	false
SSDEEP:	6:jUxQvKKhn4ffcELVGj3CxCbXWBd7/FHr/JLpF/y/Jjy/JfAMw:jyQ5AUj35bGB9ZByByA
MD5:	11B24BB3C0FA99924F6B074FCF26DF2A
SHA1:	93B94B7577F2529BD0FBBB9115DF58D994204B8F
SHA-256:	96D4B5B129B966F49D8028FC752A54CB9CA0C80CC4D076240766B946A2B329C5
SHA-512:	AD7DD4EAFBABBF1FF0E28E3BFFB3DD60606D9BCA77725A6E8189EC1E4924FB20E98DA1DE253562CCCD3A1A70201327263BC80090FD2C2FE92798744621ECDB6B
Malicious:	false
Preview:	// Standard YAML's Failsafe schema..// http://www.yaml.org/spec/1.2/spec.html#id2802346...'use strict';...var Schema = require('../schema');...module.exports = new Schema({. explicit: [. require('../type/str'),. require('../type/seq'),. require('../type/map'). ].});.

C:\Program Files (x86)\????????\resources\app\node_modules\js-yaml\lib\schema\json.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	523
Entropy (8bit):	4.999363823887022
Encrypted:	false
SSDEEP:	12:jyB5AbjTetw8OnB2/MKSxPTBrbk8fyNUy7yaz:mzYTg5SFTBFaFWU
MD5:	ECC96D1F82D1A9C61016C83A9AE32FB6
SHA1:	AA11210667A11A7995618B466FDBD9090A489958
SHA-256:	AA53E414F077035B4D477D19095AC01E60D9DF73AF716A188FD2772314041F92
SHA-512:	F55180DA769B58FD0664845531216B7D172C19CC847494AAE53B0F2374F58BBFF0D67F9401556CCB32ED03CF72241B4D078240740B080FA8D7AA16197E6EF744
Malicious:	false
Preview:	// Standard YAML's JSON schema..// http://www.yaml.org/spec/1.2/spec.html#id2803231.//.// NOTE: JS-YAML does not support schema-specific tag resolution restrictions..// So, this schema is not such strict as defined in the YAML specification..// It allows numbers in binary notaion, use `Null` and `NULL` as `null`, etc....'use strict';...module.exports = require('./failsafe').extend({. implicit: [. require('../type/null'),. require('../type/bool'),. require('../type/int'),. require('../type/float'). ].});.

C:\Program Files (x86)\????????\resources\app\node_modules\js-yaml\lib\snippet.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3088
Entropy (8bit):	4.804629070771022
Encrypted:	false
SSDEEP:	48:K2ASEl9jOxqctyvnKvnevfvw4U6Xq9Ie8vNlvnenjVXFLMrvrWxjCon:SSEW1tu2n4U6XHvxenjkfWxjRn
MD5:	09D88DDA32E57CBD6DD6F9C0448B3D76
SHA1:	BC7C3969251528A46C9249F4BC17B2A5FC7795D9
SHA-256:	1658B8EC688EBDD2E2DFFC93FFFC9CBA0E9A93AD2A9A1D39B08ED5A1DF5AFADE
SHA-512:	7F7FC7B2E6B63652CD1E1D0C8907C5BAB6488BAA12A90E637AADF64A44387C4922F1845F9284B6A5B9039E9AD81A28C0488708A7B6A429B1F0E583638ABABF6C
Malicious:	false
Preview:	'use strict';...var common = require('./common');...// get snippet for a single line, respecting maxLength.function getLine(buffer, lineStart, lineEnd, position, maxLineLength) {. var head = '';. var tail = '';. var maxHalfLength = Math.floor(maxLineLength / 2) - 1;.. if (position - lineStart > maxHalfLength) {. head = ' ... ';. lineStart = position - maxHalfLength + head.length;. }.. if (lineEnd - position > maxHalfLength) {. tail = ' ...';. lineEnd = position + maxHalfLength - tail.length;. }.. return {. str: head + buffer.slice(lineStart, lineEnd).replace(/\t/g, '.') + tail,. pos: position - lineStart + head.length // relative position. };.}...function padStart(string, max) {. return common.repeat(' ', max - string.length) + string;.}...function makeSnippet(mark, options) {. options = Object.create(options \|\| null);.. if (!mark.buffer) return null;.. if (!options.maxLength) options.maxLength = 79;. if (typeof options.indent !== 'number') option

C:\Program Files (x86)\????????\resources\app\node_modules\js-yaml\lib\type.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1849
Entropy (8bit):	4.884034076782002
Encrypted:	false
SSDEEP:	48:yZ+N/BSORUHmCZ4GpX0DYjF/84wRk2rpF00XX46cnYAk2ImCa1:yA9+zZ4Gp9jFBwRk21H46P2ImCa1
MD5:	60E6B75E16E8D8B77E5B5EB9779EE1B8
SHA1:	7D6D9BC41C5B2969E4778575906770F94D020D08
SHA-256:	11D7FF8E46ECC9EF8B5334AA491973EE95A5F43841AFA27E14A0594CCA464170
SHA-512:	E82F1C32CA189BE24A5E4D3FA3A1F9AD8A72C9E98334E01DE8817B75EA0C8927C15EEE9BA3BAB767AA49B8BA8BF81D943BAFC0D210771AAA6A3AC890AD1499D3
Malicious:	false
Preview:	'use strict';..var YAMLException = require('./exception');..var TYPE_CONSTRUCTOR_OPTIONS = [. 'kind',. 'multi',. 'resolve',. 'construct',. 'instanceOf',. 'predicate',. 'represent',. 'representName',. 'defaultStyle',. 'styleAliases'.];..var YAML_NODE_KINDS = [. 'scalar',. 'sequence',. 'mapping'.];..function compileStyleAliases(map) {. var result = {};.. if (map !== null) {. Object.keys(map).forEach(function (style) {. map[style].forEach(function (alias) {. result[String(alias)] = style;. });. });. }.. return result;.}..function Type(tag, options) {. options = options \|\| {};.. Object.keys(options).forEach(function (name) {. if (TYPE_CONSTRUCTOR_OPTIONS.indexOf(name) === -1) {. throw new YAMLException('Unknown option "' + name + '" is met in definition of "' + tag + '" YAML type.');. }. });.. // TODO: Add tag format check.. this.options = options; // keep original options in case user wants to extend this type later. this.tag

C:\Program Files (x86)\????????\resources\app\node_modules\js-yaml\lib\type\binary.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2912
Entropy (8bit):	5.050524013690377
Encrypted:	false
SSDEEP:	48:CtJ1CTiU2rq0hCr0oghpcMYlcRim2RwvDIfPd6J6a6/BX6obmo2SI0Tc4GLAgRjV:Erad0hCrd3Mf0RvPd60dpqeESPc4GLAg
MD5:	18E8A5939236B4C3F9FB0F0CCEC4E688
SHA1:	F5E913A31A9CCFBE132B0B6428E507E3F7CD122C
SHA-256:	245745C866E306704407D6738E1A77776CE41E79E4CC3B2F418AE475BD00C3C9
SHA-512:	1401B0DF46250FF959291E128F5B3D11AABD16E1CDD8FCE6DADF879A068BE215C05FEF37652AC70C1E7F89912E77F553652EE6BB3ABA90A559FF2C0FB8EE89D6
Malicious:	false
Preview:	'use strict';../eslint-disable no-bitwise/...var Type = require('../type');...// [ 64, 65, 66 ] -> [ padding, CR, LF ].var BASE64_MAP = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\n\r';...function resolveYamlBinary(data) {. if (data === null) return false;.. var code, idx, bitlen = 0, max = data.length, map = BASE64_MAP;.. // Convert one by one.. for (idx = 0; idx < max; idx++) {. code = map.indexOf(data.charAt(idx));.. // Skip CR/LF. if (code > 64) continue;.. // Fail on illegal characters. if (code < 0) return false;.. bitlen += 6;. }.. // If there are any bits left, source was corrupted. return (bitlen % 8) === 0;.}..function constructYamlBinary(data) {. var idx, tailbits,. input = data.replace(/[\r\n=]/g, ''), // remove CR/LF & padding to simplify scan. max = input.length,. map = BASE64_MAP,. bits = 0,. result = [];.. // Collect by 6*4 bits (3 bytes).. for (idx = 0; idx < max; idx++) {. if ((idx % 4 ==

C:\Program Files (x86)\????????\resources\app\node_modules\js-yaml\lib\type\bool.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	971
Entropy (8bit):	4.822048062495944
Encrypted:	false
SSDEEP:	24:Dku+crq9zQpQayj+c36NQ8HhB5BTz2rui9uCvrr2R:DfNrq9aDct8HhBzKui9uCjr2R
MD5:	D4DF0D2A71C9AF0AB52F29F89773F028
SHA1:	2524FE24D6DCD4E4A14B62696A5FD16E54D8F3F4
SHA-256:	634B7821CEB0877B5320A17B3B0FC3FB60AC3092B86C9D069722F18E2421C1DB
SHA-512:	F5C153ED5C72D3FCEF013776C9FA7E5C36C3517F34D5FF7C1E69A2B2CD30C66FE8D3C8FF4BC1F4375190E1B5A6E324F16790BBB4968A81A8DC67065EB35E875C
Malicious:	false
Preview:	'use strict';..var Type = require('../type');..function resolveYamlBoolean(data) {. if (data === null) return false;.. var max = data.length;.. return (max === 4 && (data === 'true' \|\| data === 'True' \|\| data === 'TRUE')) \|\|. (max === 5 && (data === 'false' \|\| data === 'False' \|\| data === 'FALSE'));.}..function constructYamlBoolean(data) {. return data === 'true' \|\|. data === 'True' \|\|. data === 'TRUE';.}..function isBoolean(object) {. return Object.prototype.toString.call(object) === '[object Boolean]';.}..module.exports = new Type('tag:yaml.org,2002:bool', {. kind: 'scalar',. resolve: resolveYamlBoolean,. construct: constructYamlBoolean,. predicate: isBoolean,. represent: {. lowercase: function (object) { return object ? 'true' : 'false'; },. uppercase: function (object) { return object ? 'TRUE' : 'FALSE'; },. camelcase: function (object) { return object ? 'True' : 'False'; }. },. defaultStyle: 'lowercase'.});.

C:\Program Files (x86)\????????\resources\app\node_modules\js-yaml\lib\type\float.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2467
Entropy (8bit):	5.21899407825232
Encrypted:	false
SSDEEP:	48:xrh1HnrzQgvzw76ccsbXoqRUq0Ie8T7ziLpE2jymRYyq/BEy1/Zv6nuatLf4h7Xz:xrh1Agvzw76jszovq0Ie8vupE2yVyq/D
MD5:	921BE2E2C7A9E61F1D45DE6FE25022C0
SHA1:	24F6AACA6FA244EBD94AF52644D9DF44EA33A0F3
SHA-256:	2D762D35AD3E06D96F512FB5ECE8F7172E2543BB19C551F64C5E4005A66BBCA2
SHA-512:	2CA6BB17B40D33D0F7F693CFB5CD7D9A3568FABBADCAF4680423D24AC89519134EB98BE82F63D99BAAD52BC54369F1341DBEEF760A2FB8E9484D0F8A0340C73F
Malicious:	false
Preview:	'use strict';..var common = require('../common');.var Type = require('../type');..var YAML_FLOAT_PATTERN = new RegExp(. // 2.5e4, 2.5 and integers. '^(?:[-+]?(?:[0-9][0-9_])(?:\\.[0-9_])?(?:[eE][-+]?[0-9]+)?' +. // .2e4, .2. // special case, seems not from spec. '\|\\.[0-9_]+(?:[eE][-+]?[0-9]+)?' +. // .inf. '\|[-+]?\\.(?:inf\|Inf\|INF)' +. // .nan. '\|\\.(?:nan\|NaN\|NAN))$');..function resolveYamlFloat(data) {. if (data === null) return false;.. if (!YAML_FLOAT_PATTERN.test(data) \|\|. // Quick hack to not allow integers end with `_`. // Probably should update regexp & check speed. data[data.length - 1] === '_') {. return false;. }.. return true;.}..function constructYamlFloat(data) {. var value, sign;.. value = data.replace(/_/g, '').toLowerCase();. sign = value[0] === '-' ? -1 : 1;.. if ('+-'.indexOf(value[0]) >= 0) {. value = value.slice(1);. }.. if (value === '.inf') {. return (sign === 1) ? Number.POSITIVE_INFINITY : Number.NEGATIVE_INFIN

C:\Program Files (x86)\????????\resources\app\node_modules\js-yaml\lib\type\int.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3691
Entropy (8bit):	4.827188990695394
Encrypted:	false
SSDEEP:	96:2XIePEZHocSH3bHXNHCoH9+qiuzqgug9ntz:22iLAoDdOrg9ntz
MD5:	48EF2C29430F85AF8873057019C803D6
SHA1:	65ADF9458641B785A81C9D8ADA02512E7295142A
SHA-256:	0DAC842D32923113F2A6A153A280F6120F6CCC2DA9024BA01FD4D99065D29FCF
SHA-512:	82EAF85C5863A1C2D36055D54B89F175AED6D61417B1D15098AA05C25232EFFF96882C2A4C20480A0035B865EBDBC1B0FAE21052884BEE3E3BC7A1C6304659AF
Malicious:	false
Preview:	'use strict';..var common = require('../common');.var Type = require('../type');..function isHexCode(c) {. return ((0x30/* 0 / <= c) && (c <= 0x39/ 9 /)) \|\|. ((0x41/ A / <= c) && (c <= 0x46/ F /)) \|\|. ((0x61/ a / <= c) && (c <= 0x66/ f /));.}..function isOctCode(c) {. return ((0x30/ 0 / <= c) && (c <= 0x37/ 7 /));.}..function isDecCode(c) {. return ((0x30/ 0 / <= c) && (c <= 0x39/ 9 */));.}..function resolveYamlInteger(data) {. if (data === null) return false;.. var max = data.length,. index = 0,. hasDigits = false,. ch;.. if (!max) return false;.. ch = data[index];.. // sign. if (ch === '-' \|\| ch === '+') {. ch = data[++index];. }.. if (ch === '0') {. // 0. if (index + 1 === max) return true;. ch = data[++index];.. // base 2, base 8, base 16.. if (ch === 'b') {. // base 2. index++;.. for (; index < max; index++) {. ch = data[index];. if (ch === '_') continue;. if (ch !==

C:\Program Files (x86)\????????\resources\app\node_modules\js-yaml\lib\type\map.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.858333690755047
Encrypted:	false
SSDEEP:	3:agWIFxcVdFT6kAPe4KzBb/aVfRrfCFKXCBXfIWvGzaLnFbEHJkQb7tWcKBEmszyw:Q8cnFeJLKzB8RLCFKGgWvGG5oH2xsR
MD5:	25960BC03A1D75DDB2ABB5270C177D4F
SHA1:	2C6BD8F6087B3BA90952279DC4B40E283A6A4B7D
SHA-256:	B9BF146012164A0A59EA8C5F6576052706D330A1E41AB8092E11A67D6B9CCF2C
SHA-512:	9ACBF54E6863BDC4D4896570FC36236721AF6FE85B4DBC61DA45FFC99B8E25E4E1C3D033817DB58CDCE9377AA8E22E4AD667F7E24FB92B7D898F5C3F2385DB15
Malicious:	false
Preview:	'use strict';..var Type = require('../type');..module.exports = new Type('tag:yaml.org,2002:map', {. kind: 'mapping',. construct: function (data) { return data !== null ? data : {}; }.});.

C:\Program Files (x86)\????????\resources\app\node_modules\js-yaml\lib\type\merge.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	230
Entropy (8bit):	4.863918925600679
Encrypted:	false
SSDEEP:	6:Q8cnFeJFLZEImnICFn7JDxB8RLCFKGgZw0LeskgZEImJvn:DsFuFERnICF9DxBGCcwybERJvn
MD5:	22C9334FBE8557AFD8DC4896C2AEE6A6
SHA1:	5B5D2BE0A4EC4CA47376D88C872A2772BD876FFA
SHA-256:	BF34D9DA7BB1158C5BDD8AE4474D11645C824440F68DE79813C384CD77C4791B
SHA-512:	965D702BD140C373F78D1E0AD0736119D77EC62F365C21CA2C23C50D5369F81AFC1DEDB6ED813B8AA7A805E931F4E33BA640096E6F3A19139B8580CE8A3EDA6E
Malicious:	false
Preview:	'use strict';..var Type = require('../type');..function resolveYamlMerge(data) {. return data === '<<' \|\| data === null;.}..module.exports = new Type('tag:yaml.org,2002:merge', {. kind: 'scalar',. resolve: resolveYamlMerge.});.

C:\Program Files (x86)\????????\resources\app\node_modules\js-yaml\lib\type\null.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	808
Entropy (8bit):	4.7114082955077
Encrypted:	false
SSDEEP:	12:DsFuFERHKi85zqVtFS3lG4vc8voxWQtMu9JxBGCNmEbEVmHJQWQpCZdqeuTEel/c:Dku+d5xVTFt9fBSV4YpCZdqeWEJrvR
MD5:	4CE63CA08BFFCAA7A0A9C95351F23E9B
SHA1:	3592BC5A235952C08F23E71C73D0F0DFF3683AE8
SHA-256:	8F3ABF27966DFC51E80EA72B363CA74B6D3BCA0B15695F61E93BFEE2858531F1
SHA-512:	1FF58D26F11EC1199856D24B2C29EE9579CB01FFA5B205BE8245DC60F4BCAB857A7AA47E50EC684504B144FB45C8FBDBF154089894A93D75E6C33260B2FD5D81
Malicious:	false
Preview:	'use strict';..var Type = require('../type');..function resolveYamlNull(data) {. if (data === null) return true;.. var max = data.length;.. return (max === 1 && data === '~') \|\|. (max === 4 && (data === 'null' \|\| data === 'Null' \|\| data === 'NULL'));.}..function constructYamlNull() {. return null;.}..function isNull(object) {. return object === null;.}..module.exports = new Type('tag:yaml.org,2002:null', {. kind: 'scalar',. resolve: resolveYamlNull,. construct: constructYamlNull,. predicate: isNull,. represent: {. canonical: function () { return '~'; },. lowercase: function () { return 'null'; },. uppercase: function () { return 'NULL'; },. camelcase: function () { return 'Null'; },. empty: function () { return ''; }. },. defaultStyle: 'lowercase'.});.

C:\Program Files (x86)\????????\resources\app\node_modules\js-yaml\lib\type\omap.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1023
Entropy (8bit):	4.843109150296852
Encrypted:	false
SSDEEP:	24:DkEBSU+J5UA6A85fy4cwqaERQBQthgaPv:DlFy5UrFadwqxQcvPv
MD5:	3B430D0920569D39CF59F93E6F592DAC
SHA1:	27AE167AB147E1A9A155440EEF86C78A6776999E
SHA-256:	A4FA54CA0343665EB199503D772A4FE4AAB792E4E08BEE682E70C0D4A5ADA043
SHA-512:	2AD0A21263F0BEA33E976F6FB47824031D339B04999A02542A4F27D41A8245EB1D28AD122B67676571E061BAFACF3B2139B8385BCEDC55D4AF267817BC184570
Malicious:	false
Preview:	'use strict';..var Type = require('../type');..var _hasOwnProperty = Object.prototype.hasOwnProperty;.var _toString = Object.prototype.toString;..function resolveYamlOmap(data) {. if (data === null) return true;.. var objectKeys = [], index, length, pair, pairKey, pairHasKey,. object = data;.. for (index = 0, length = object.length; index < length; index += 1) {. pair = object[index];. pairHasKey = false;.. if (_toString.call(pair) !== '[object Object]') return false;.. for (pairKey in pair) {. if (_hasOwnProperty.call(pair, pairKey)) {. if (!pairHasKey) pairHasKey = true;. else return false;. }. }.. if (!pairHasKey) return false;.. if (objectKeys.indexOf(pairKey) === -1) objectKeys.push(pairKey);. else return false;. }.. return true;.}..function constructYamlOmap(data) {. return data !== null ? data : [];.}..module.exports = new Type('tag:yaml.org,2002:omap', {. kind: 'sequence',. resolve: resolveYamlOmap,. construct:

C:\Program Files (x86)\????????\resources\app\node_modules\js-yaml\lib\type\pairs.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1084
Entropy (8bit):	4.854430031161823
Encrypted:	false
SSDEEP:	24:DkBMBU+95G2qMdAuy1/Bomo5SMYiPZG2qMdAG/Qmo5SMYnuBkhguZ:DE85GKyZBomCSMYiPZGKxQmCSMYnuS1Z
MD5:	679B89F1B770B24087122047DA2B4364
SHA1:	A62980F470F956A1102DDC33A533DD356D964342
SHA-256:	FAEBB6D8A9D1B0CD755F92113E49464711D87060F17D1E807695924866F89A4A
SHA-512:	36FDB5A1F0B898C577C6ED40DC21CE6C3F4F59CA53CCB902FE861EBA607DB7F2B4638AD12181057FC1EF5B0D2403CC2C3BCD95961BA9A64F3244C2DAC562A5B9
Malicious:	false
Preview:	'use strict';..var Type = require('../type');..var _toString = Object.prototype.toString;..function resolveYamlPairs(data) {. if (data === null) return true;.. var index, length, pair, keys, result,. object = data;.. result = new Array(object.length);.. for (index = 0, length = object.length; index < length; index += 1) {. pair = object[index];.. if (_toString.call(pair) !== '[object Object]') return false;.. keys = Object.keys(pair);.. if (keys.length !== 1) return false;.. result[index] = [ keys[0], pair[keys[0]] ];. }.. return true;.}..function constructYamlPairs(data) {. if (data === null) return [];.. var index, length, pair, keys, result,. object = data;.. result = new Array(object.length);.. for (index = 0, length = object.length; index < length; index += 1) {. pair = object[index];.. keys = Object.keys(pair);.. result[index] = [ keys[0], pair[keys[0]] ];. }.. return result;.}..module.exports = new Type('tag:yaml.org,2002:pairs', {.

C:\Program Files (x86)\????????\resources\app\node_modules\js-yaml\lib\type\seq.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	191
Entropy (8bit):	4.873525892964973
Encrypted:	false
SSDEEP:	3:agWIFxcVdFT6kAPe4KzBb/aVfRrfCFKXCBXfWAbJkvF0zHUQusbEHJkQb7tWcKBM:Q8cnFeJLKzB8RLCFKG+Eqd0AQu9H2xMx
MD5:	713607F1161970831AECA64D9796E4DC
SHA1:	02DEEF81E8770EC42ADF39E0AC93A8EFCAE87CF2
SHA-256:	F3D76A1DB2A6772A51AC32059DCC18B6666AE9C5A60A649467B5853A2FBAF425
SHA-512:	2EC57F2CC83F681DC142C8B128D97D85EA9B19D16E88E630DF24C38CC104920291D471BCEFA34C70DDC84B0D4D4DD7FFF6A8AE16AB5F45C1CAE10233ED5C36F4
Malicious:	false
Preview:	'use strict';..var Type = require('../type');..module.exports = new Type('tag:yaml.org,2002:seq', {. kind: 'sequence',. construct: function (data) { return data !== null ? data : []; }.});.

C:\Program Files (x86)\????????\resources\app\node_modules\js-yaml\lib\type\set.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	547
Entropy (8bit):	4.876975212989837
Encrypted:	false
SSDEEP:	12:DsFE+QMFEQAi85zq9ReDkkFeWzdxUMPBGCeCSEVFHJQj:DkEG+Qd59MgkFesO+BX3PQ
MD5:	22EEA89AFFD984BC6CD10F471159750D
SHA1:	54BD5EEC6A8A57A8792D540F30343513077FE7E8
SHA-256:	60D13EDC50B58B037A6EF561D2F751C601826E455C011ACF48C830BAA1412107
SHA-512:	69F616211A83423F5A205858243312494D4116F343C4D1FB1FA6EE0ACE3C94AFE614E38B253D2EB1E0948D146704865995F5EAA7AF2F4D58FFF941BEBAED8258
Malicious:	false
Preview:	'use strict';..var Type = require('../type');..var _hasOwnProperty = Object.prototype.hasOwnProperty;..function resolveYamlSet(data) {. if (data === null) return true;.. var key, object = data;.. for (key in object) {. if (_hasOwnProperty.call(object, key)) {. if (object[key] !== null) return false;. }. }.. return true;.}..function constructYamlSet(data) {. return data !== null ? data : {};.}..module.exports = new Type('tag:yaml.org,2002:set', {. kind: 'mapping',. resolve: resolveYamlSet,. construct: constructYamlSet.});.

C:\Program Files (x86)\????????\resources\app\node_modules\js-yaml\lib\type\str.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.8115874645397065
Encrypted:	false
SSDEEP:	3:agWIFxcVdFT6kAPe4KzBb/aVfRrfCFKXCBXfWRS3zBgEEFFGKEHJkQb7tWcKBEm2:Q8cnFeJLKzB8RLCFKG+RIL9H2xwCm
MD5:	55642179510BC9B99583D7D5D1C9C586
SHA1:	EFD9F046C952CD16F88E8B5DCDCF25F612F6974F
SHA-256:	41E56AF5FAD426839BFE41C9A3F489DE6EFEC71447490124A69F8F4785C46AB9
SHA-512:	2A6ABDCBDAF86A43744DC69FE475AB454EEC8BDFC1953D7A2F970BE9A84A395AF21A7FBB66CF1E2FE1023D4A5316F3F24FAF1207272B973AE135B491FE3FBC16
Malicious:	false
Preview:	'use strict';..var Type = require('../type');..module.exports = new Type('tag:yaml.org,2002:str', {. kind: 'scalar',. construct: function (data) { return data !== null ? data : ''; }.});.

C:\Program Files (x86)\????????\resources\app\node_modules\js-yaml\lib\type\timestamp.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2571
Entropy (8bit):	5.0561272270105935
Encrypted:	false
SSDEEP:	48:DU0F0FGHxCUmXaWUWNZYWwVCDYeh6s2gyaTNvxBiGvwc:Q8rRxweBVdehXzNxkc
MD5:	80FBD1E71BAC0386B2188A6BF42E1A4D
SHA1:	1746736BDAEE28BF5CB426370FD6D1D609721FDC
SHA-256:	9E4F77C8D504A3A8319108343D6D6B2B6ED95BA6E96F4FE9B204208D04CFD691
SHA-512:	7C9679B23933EA2ED3E285D85C51C9DD7ED580360F7301DD58401D2E70072EC6453787FA65852659F64D5251BDDD196B1E98CD9F43ACDCF8E33B230D65E484D2
Malicious:	false
Preview:	'use strict';..var Type = require('../type');..var YAML_DATE_REGEXP = new RegExp(. '^([0-9][0-9][0-9][0-9])' + // [1] year. '-([0-9][0-9])' + // [2] month. '-([0-9][0-9])$'); // [3] day..var YAML_TIMESTAMP_REGEXP = new RegExp(. '^([0-9][0-9][0-9][0-9])' + // [1] year. '-([0-9][0-9]?)' + // [2] month. '-([0-9][0-9]?)' + // [3] day. '(?:[Tt]\|[ \\t]+)' + // .... '([0-9][0-9]?)' + // [4] hour. ':([0-9][0-9])' + // [5] minute. ':([0-9][0-9])' + // [6] second. '(?:\\.([0-9]))?' + // [7] fraction. '(?:[ \\t](Z\|([-+])([0-9][0-9]?)' + // [8] tz [9] tz_sign [10] tz_hour. '(?::([0-9][0-9]))?))?$'); // [11] tz_minute..function resolveYamlTimestamp(data) {. if (data === null) return false;. if (YAML_DATE_REGEXP.exec(data) !== null) return true;. if (YAML_TIMESTAMP_REGEXP.exec(data) !== null) re

C:\Program Files (x86)\????????\resources\app\node_modules\js-yaml\package.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1228
Entropy (8bit):	4.741150958262094
Encrypted:	false
SSDEEP:	24:0CVSGcq/S2Bu/EV4s6lxE2oWhykD7gkOIjwJqnOBqt1d:1nchOw8qlxE2vhykPgk0Cq2d
MD5:	EAC67C7FB115968B81CD325EA3BB5D5B
SHA1:	7523D06B11FDFD74959104D6C3171008D2B0DB36
SHA-256:	85ACBA5846F8E4B3AC28C8F06C79FCDC6150E4B07C082F53190B5D1CED2471DB
SHA-512:	8F09A3F035F630DC0206259CB2BB1EAF9ADAAF13B3BEB0E9F087742BB280ABB6609F88D3C5B145C8758A7256B39AF547BB73CFD61FED6567CF2FCD5B602E96DB
Malicious:	false
Preview:	{. "author": {. "name": "Vladimir Zapparov",. "email": "dervus.grim@gmail.com". },. "bin": {. "js-yaml": "bin/js-yaml.js". },. "dependencies": {. "argparse": "^2.0.1". },. "description": "YAML 1.2 parser and serializer",. "devDependencies": {. "@rollup/plugin-commonjs": "^17.0.0",. "@rollup/plugin-node-resolve": "^11.0.0",. "ansi": "^0.3.1",. "benchmark": "^2.1.4",. "codemirror": "^5.13.4",. "eslint": "^7.0.0",. "fast-check": "^2.8.0",. "gh-pages": "^3.1.0",. "mocha": "^8.2.1",. "nyc": "^15.1.0",. "rollup": "^2.34.1",. "rollup-plugin-node-polyfills": "^0.2.1",. "rollup-plugin-terser": "^7.0.2",. "shelljs": "^0.8.4". },. "exports": {. ".": {. "import": "./dist/js-yaml.mjs",. "require": "./index.js". },. "./package.json": "./package.json". },. "files": [. "index.js",. "lib/",. "bin/",. "dist/". ],. "homepage": "https://github.com/nodeca/js-yaml#readme",. "jsdelivr": "dist/js-yaml.min.js",.

C:\Program Files (x86)\????????\resources\app\node_modules\jsonfile\LICENSE

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	5.133852620051759
Encrypted:	false
SSDEEP:	24:br4JH5HH0yPPYt4Hw1hl9MPHcs648Ok4/+wYo3HxFD:b8JxlPkrvMPHcsTIC3RFD
MD5:	423F377ADE95936F6FE009B1C137BFDB
SHA1:	8710B30864159D0AB7F1887F1A7B5EDCFC7D849A
SHA-256:	A9801FB52BA22EF808682A094DA8A7A480584B7ED0DFD0D888AB543616335031
SHA-512:	EBF590A7EADDA54CC1BDFB7327F3D9DFC93C8EBA9E28D3C137CAA78E2136D88B5D9CA1E27D7ED9ABC73B095A3D5E42227C8EF7321716F1DB11B9ED3618074E29
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2012-2015, JP Richardson <jprichardson@gmail.com>..Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files.(the 'Software'), to deal in the Software without restriction, including without limitation the rights to use, copy, modify,. merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is. furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE.WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS.OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHE

C:\Program Files (x86)\????????\resources\app\node_modules\jsonfile\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1900
Entropy (8bit):	4.652967432001605
Encrypted:	false
SSDEEP:	48:+y8NgCJTfN5Pqg1U2cNIovRJ+pzUQdg1GBz6jcYsxqoZGgUDqk1hZqapX:+y8NgqfvPqgC28IosgaG7s4oArX
MD5:	C18CDB1953C23651297EECD0C2A35DF9
SHA1:	91C9C57AF8BD81EE9A62A5B25797EA32883C15B0
SHA-256:	2CDF22FFB5A170AD2CF10CBDF647E2A9366B6AFA11E9B4C2370D0CF5B1F700B1
SHA-512:	14EC70B8AAC0017D3E8F7D4BD3BCD9D078957F6A639A0217D84310F198E8652EEA06AF3940658C91FB5E8A140D7E1C52D40F0F65D5AFCC342060FFFA48DAA56D
Malicious:	false
Preview:	let _fs.try {. _fs = require('graceful-fs').} catch (_) {. _fs = require('fs').}.const universalify = require('universalify').const { stringify, stripBom } = require('./utils')..async function _readFile (file, options = {}) {. if (typeof options === 'string') {. options = { encoding: options }. }.. const fs = options.fs \|\| _fs.. const shouldThrow = 'throws' in options ? options.throws : true.. let data = await universalify.fromCallback(fs.readFile)(file, options).. data = stripBom(data).. let obj. try {. obj = JSON.parse(data, options ? options.reviver : null). } catch (err) {. if (shouldThrow) {. err.message = `${file}: ${err.message}`. throw err. } else {. return null. }. }.. return obj.}..const readFile = universalify.fromPromise(_readFile)..function readFileSync (file, options = {}) {. if (typeof options === 'string') {. options = { encoding: options }. }.. const fs = options.fs \|\| _fs.. const shouldThrow = 'throws' in options ? opt

C:\Program Files (x86)\????????\resources\app\node_modules\jsonfile\package.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	558
Entropy (8bit):	4.7356582243877785
Encrypted:	false
SSDEEP:	12:31105anypv2bmU00WpGQgWfjFtSKACRS+0QW6nP6a8/GaAFo:311YanQFxztFIbQW6Xm
MD5:	7F3B49A1ED04717920588EFB35A78E5D
SHA1:	15726E0C64B4B73EF7D35EFA74F1A7035DADAC71
SHA-256:	97DD73DA7FECF4B16CF7BB766CBFEE7D55DE9C7E2B864B982A0936247310EAC8
SHA-512:	F9AC68C96E65A6CD9166AD0D64491F7D8464FB4D9F4646648656A1716183FEF16BC148AF8BE1B40068CD9C59929D8566EDF7E34B559FD55D5213E1C303C25A15
Malicious:	false
Preview:	{. "name": "jsonfile",. "version": "6.1.0",. "description": "Easily read/write JSON files.",. "repository": {. "type": "git",. "url": "git@github.com:jprichardson/node-jsonfile.git". },. "author": "JP Richardson <jprichardson@gmail.com>",. "license": "MIT",. "dependencies": {. "universalify": "^2.0.0". },. "optionalDependencies": {. "graceful-fs": "^4.1.6". },. "devDependencies": {. "mocha": "^8.2.0",. "rimraf": "^2.4.0",. "standard": "^16.0.1". },. "main": "index.js",. "files": [. "index.js",. "utils.js". ].}

C:\Program Files (x86)\????????\resources\app\node_modules\jsonfile\utils.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	498
Entropy (8bit):	4.8291552593121825
Encrypted:	false
SSDEEP:	12:A6v2SVMVZXrSQL4jZu9rSRbMFc1XBkL/xLBDBOZ:BVMuQLEZEY9XBkxLBDBOZ
MD5:	DBF76159EA111D8F0A848E94285B0B68
SHA1:	9FCB3C2E8D7B909360C945CD568CC32FE7CF4596
SHA-256:	B0C188696676561411F3C5784D7DE61BF21927F9C334E0CFB9136A8B7C82BE5D
SHA-512:	DD6DF7ADD03726A8528CBC261258A4B133DA7267BA082A8CE83FE23A646FB7D68E1AE4E1709025673914B6DBC2355ED486129039A993089F250A1801A7A93B3F
Malicious:	false
Preview:	function stringify (obj, { EOL = '\n', finalEOL = true, replacer = null, spaces } = {}) {. const EOF = finalEOL ? EOL : ''. const str = JSON.stringify(obj, replacer, spaces).. return str.replace(/\n/g, EOL) + EOF.}..function stripBom (content) {. // we do this because JSON.parse would convert it to a utf8 string if encoding wasn't specified. if (Buffer.isBuffer(content)) content = content.toString('utf8'). return content.replace(/^\uFEFF/, '').}..module.exports = { stringify, stripBom }.

C:\Program Files (x86)\????????\resources\app\node_modules\lazy-val\out\main.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	605
Entropy (8bit):	4.312764085882548
Encrypted:	false
SSDEEP:	12:BETNy5PvW2ALZlyBFOUlN7kePlhtPYc6BWqwTv3cRIKKp:KRy5wLZcBwUlaedLf6BWq0vcRIKKp
MD5:	DF8D58F4241E165AD3B6C2C5F75D6F10
SHA1:	0746D5005A8BCA12FDCFD7A1C9FF5BF86A8CD78B
SHA-256:	358FA8CBA70C9140EDAFA85C0B7B25C7261939480186167E6B3440905F5B47DA
SHA-512:	5B49E04C6E274C70739C8041F5F9818EFB98FEE547CE1AE145120C47497EE77FA43E887C823F953425132DDDE7314BB21ED790B312709439BFD54DB416ED69E8
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.Lazy = void 0;.class Lazy {. constructor(creator) {. this._value = null;. this.creator = creator;. }. get hasValue() {. return this.creator == null;. }. get value() {. if (this.creator == null) {. return this._value;. }. const result = this.creator();. this.value = result;. return result;. }. set value(value) {. this._value = value;. this.creator = null;. }.}.exports.Lazy = Lazy;.//# sourceMappingURL=main.js.map

C:\Program Files (x86)\????????\resources\app\node_modules\lazy-val\out\main.js.map

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1156
Entropy (8bit):	4.9495138851584475
Encrypted:	false
SSDEEP:	24:YWLSy1IU5tQ6OLLZJnLD3M3LDZ93HLx675yMHVLnYebrF4mSFAiVHP42whNl4IYX:YWLFfPIZJ+3dO5yAhDBQHjwhjY8dpq5/
MD5:	42D5179A6B1205B3144399E1A2ADEF15
SHA1:	9CB6A6E3B0F212699C2ADDA0D2037F76B4599D31
SHA-256:	AA3E70F08A0CE115832E5324C4B96AA1475A3B8B36728F50091EBD22AA0F6646
SHA-512:	6CB29BDE1DB4FE8D775D2AC4AC213A7628551EB4896CC0DB205CD5802E1ED8BB957FA8AE663CF16802CAB2C11DCFB7498751704BF98D1CDE581DAD3E1ABCD880
Malicious:	false
Preview:	{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";;;AAAA,MAAa,IAAI;IAIf,YAAY,OAAyB;QAH7B,WAAM,GAAsB,IAAI,CAAA;QAItC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,OAAO,IAAI,IAAI,CAAA;IAC7B,CAAC;IAED,IAAI,KAAK;QACP,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,EAAE;YACxB,OAAO,IAAI,CAAC,MAAQ,CAAA;SACrB;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,CAAA;QAC7B,IAAI,CAAC,KAAK,GAAG,MAAM,CAAA;QACnB,OAAO,MAAM,CAAA;IACf,CAAC;IAED,IAAI,KAAK,CAAC,KAAiB;QACzB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;QACnB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;IACrB,CAAC;CACF;AA1BD,oBA0BC","sourcesContent":["export class Lazy<T> {\n private _value: Promise<T> \| null = null\n private creator: (() => Promise<T>) \| null\n\n constructor(creator: () => Promise<T>) {\n this.creator = creator\n }\n\n get hasValue() {\n return this.creator == null\n }\n\n get value(): Promise<T> {\n if (this.creator == null) {\n return this._value!!\n }\n\n const result = this

C:\Program Files (x86)\????????\resources\app\node_modules\lazy-val\package.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	443
Entropy (8bit):	4.679323530574619
Encrypted:	false
SSDEEP:	12:0Cx+B2aRJki/M2NfN31bmW2NfNtHZHH18p:0Cs2aRBN30rNtF12
MD5:	46560047A730CE515C917C96C249EBE3
SHA1:	57AAB0AC387EF8BA68C34EBFAF846440888B3884
SHA-256:	54CA66B5410268BBEC1FC97628DDEC05878D58944DE3D413A5BCC50F69462DB6
SHA-512:	B7ED4DAE339F85ACACD9C0251704BDC70E01B40220AC06F94C11B2E64C0BBCB4DF1F90B3A73C77BC511E956241DA1FEAC805547D299C3F88227D197BC5B19A91
Malicious:	false
Preview:	{. "author": {. "name": "Vladimir Krivosheev". },. "description": "Lazy value.",. "devDependencies": {. "typescript": "^4.2.4". },. "files": [. "out". ],. "homepage": "https://github.com/develar/lazy-val",. "license": "MIT",. "main": "out/main.js",. "name": "lazy-val",. "repository": {. "type": "git",. "url": "git+https://github.com/develar/lazy-val.git". },. "typings": "./out/main.d.ts",. "version": "1.0.5".}

C:\Program Files (x86)\????????\resources\app\node_modules\lodash.escaperegexp\LICENSE

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1951
Entropy (8bit):	5.107383685794437
Encrypted:	false
SSDEEP:	48:UzR7Stub9EniJzfPvGt7ICQH+sfIte36AFdMMFwh+dpbt49:uR7StybPut0CQHT6fMOh+dle9
MD5:	A3B2B7770DF62392C164DE4001B59F8F
SHA1:	FC4DE79D3E95696F11DBEC64B0F99D421DEADD30
SHA-256:	FFD8B33B354585F4CE119F19C53728281E48A97B074491EB6BF6D5C5FF305272
SHA-512:	B7F602A93A363A6D01B8713F0BE0BF1E70C431B6C573E230EC7759E66DFE231BFA780154607B9A59F0E03322F7CEDF57D2ABD7A083C0F2EF2AABC8BC215BDB32
Malicious:	false
Preview:	Copyright jQuery Foundation and other contributors <https://jquery.org/>..Based on Underscore.js, copyright Jeremy Ashkenas,.DocumentCloud and Investigative Reporters & Editors <http://underscorejs.org/>..This software consists of voluntary contributions made by many.individuals. For exact contribution history, see the revision history.available at https://github.com/lodash/lodash..The following license applies to all parts of this software except as.documented below:..====..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies

C:\Program Files (x86)\????????\resources\app\node_modules\lodash.escaperegexp\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4398
Entropy (8bit):	5.157641143192757
Encrypted:	false
SSDEEP:	96:/npl7CjxHFoiW55Sx85AMLBoAGf7cvWOogxMi:fpcVSuxf6BDQ7c+3pi
MD5:	CA3D4A7E2487B07F917EA0002F87B8F5
SHA1:	DFFA030E00DEE6B226B2EEEA397605F2DE5A7510
SHA-256:	584DE6EC78E35344EAEF8291338A671F223EC225C4DF4220B6F91D8F0C004D8D
SHA-512:	A9450A215E1F3333EE7FE5E7AEA53B0AF324BCE22644795CFE9973E37F5631374BFDC2273129A10D2DF71F3C363F543D859DAEF68C6EC46FE29D922E13C19CDF
Malicious:	false
Preview:	/*. lodash (Custom Build) <https://lodash.com/>. * Build: `lodash modularize exports="npm" -o ./`. * Copyright jQuery Foundation and other contributors <https://jquery.org/>. * Released under MIT license <https://lodash.com/license>. * Based on Underscore.js 1.8.3 <http://underscorejs.org/LICENSE>. * Copyright Jeremy Ashkenas, DocumentCloud and Investigative Reporters & Editors. /../* Used as references for various `Number` constants. /.var INFINITY = 1 / 0;../* `Object#toString` result references. /.var symbolTag = '[object Symbol]';../. Used to match `RegExp`. * [syntax characters](http://ecma-international.org/ecma-262/6.0/#sec-patterns).. /.var reRegExpChar = /[\\^$.+?()[\]{}\|]/g,. reHasRegExpChar = RegExp(reRegExpChar.source);../** Detect free variable `global` from Node.js. /.var freeGlobal = typeof global == 'object' && global && global.Object === Object && global;../* Detect free variable `self`. */.var freeSelf = typeof self == 'object' && self && self.Objec

C:\Program Files (x86)\????????\resources\app\node_modules\lodash.escaperegexp\package.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	463
Entropy (8bit):	4.673633361533849
Encrypted:	false
SSDEEP:	6:q/OYkqS7B5pIzi0K2bA9/BlVV4+JVL2t5X3s947O/Ly+T6z6SBmJnqS18Q:QSd5GzbbABDVVxAtKbmWSBSV1z
MD5:	D1B5A91B96A0C6D440D23549EAB9C363
SHA1:	56B4EAE423ECDC418A48325BED6C2EE7E4A16C57
SHA-256:	430E135600ADB8E5ED643775327528E89797384B768AEDCB81E37A633AEA2224
SHA-512:	E7B0D3BE629E9C6A473078BF0C755C7EB17AADD0C2CFC4C07987DDBF132460E0CBB739E53A5DF6981A652F4171E0D308C5DEA32E27C4A08265BBF9831DAF5F90
Malicious:	false
Preview:	{. "author": {. "name": "John-David Dalton",. "email": "john.david.dalton@gmail.com",. "url": "http://allyoucanleet.com/". },. "description": "The lodash method `_.escapeRegExp` exported as a module.",. "homepage": "https://lodash.com/",. "icon": "https://lodash.com/icon.svg",. "license": "MIT",. "name": "lodash.escaperegexp",. "repository": {. "type": "git",. "url": "git+https://github.com/lodash/lodash.git". },. "version": "4.1.2".}

C:\Program Files (x86)\????????\resources\app\node_modules\lodash.isequal\LICENSE

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1950
Entropy (8bit):	5.098747151739611
Encrypted:	false
SSDEEP:	48:1NStub9EniJzfPvGt7ICQH+sfIte36AFdMMFwh+dpbt49:1NStybPut0CQHT6fMOh+dle9
MD5:	8F10C81975F996C3BA5B424884B4AF96
SHA1:	4AA67FB8F8B16D40701F21A8089A410A7D178EDE
SHA-256:	E159C6D48C989185448658F276375BFB2300362EC6D4AE5525A2D49C4BCB947D
SHA-512:	424A882CD282C7E925513B0199DEC3DE4A5A4950A64DC5C83DD665DE35D7A27C63FA27B39443614369157DC5601CA7B4ADD160B0C9F85DB2E3E3AFA4F4D4ECF3
Malicious:	false
Preview:	Copyright JS Foundation and other contributors <https://js.foundation/>..Based on Underscore.js, copyright Jeremy Ashkenas,.DocumentCloud and Investigative Reporters & Editors <http://underscorejs.org/>..This software consists of voluntary contributions made by many.individuals. For exact contribution history, see the revision history.available at https://github.com/lodash/lodash..The following license applies to all parts of this software except as.documented below:..====..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies o

C:\Program Files (x86)\????????\resources\app\node_modules\lodash.isequal\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	49598
Entropy (8bit):	5.020377347799417
Encrypted:	false
SSDEEP:	768:24o6hZkXrXUnKC5WQJRBcqQ1Gf5RXj5qjoDGJLs/J6VqV1wINNRK6nqo6TJ6mV+F:K6hZMUWQHPpl5DnNqDZVj8qk
MD5:	A9554FB6B4B048098B9FB116AD78A833
SHA1:	8EB0D213A060DB92F48885444420F8C8E367AD5B
SHA-256:	E552928A511748303101CFD03826A777CFA359EADE6A4A60F92C923EDBF9184C
SHA-512:	B7C407F1EA7F48D321B763428996195D0DDB8698F05452DC7182295884A021D99683C7A2363BE28790F7054D03C3E286719F1D14CFDD49B946897602F87C9EB2
Malicious:	false
Preview:	/*. Lodash (Custom Build) <https://lodash.com/>. * Build: `lodash modularize exports="npm" -o ./`. * Copyright JS Foundation and other contributors <https://js.foundation/>. * Released under MIT license <https://lodash.com/license>. * Based on Underscore.js 1.8.3 <http://underscorejs.org/LICENSE>. * Copyright Jeremy Ashkenas, DocumentCloud and Investigative Reporters & Editors. /../* Used as the size to enable large array optimizations. /.var LARGE_ARRAY_SIZE = 200;../* Used to stand-in for `undefined` hash values. /.var HASH_UNDEFINED = '__lodash_hash_undefined__';../* Used to compose bitmasks for value comparisons. /.var COMPARE_PARTIAL_FLAG = 1,. COMPARE_UNORDERED_FLAG = 2;../* Used as references for various `Number` constants. /.var MAX_SAFE_INTEGER = 9007199254740991;../* `Object#toString` result references. */.var argsTag = '[object Arguments]',. arrayTag = '[object Array]',. asyncTag = '[object AsyncFunction]',. boolTag = '[object Boolean]',. dateTag

C:\Program Files (x86)\????????\resources\app\node_modules\lodash.isequal\package.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	453
Entropy (8bit):	4.673405130329834
Encrypted:	false
SSDEEP:	6:q/OYkqS7B5pIzi0K2bA9/jVy+JVL2t5X3sD9/Ly+T6z6SBmJnqS1oa:QSd5GzbbABjVrAt69bmWSBSV1x
MD5:	77D0148A081D5E83038BAC0592EB060F
SHA1:	235AB71D9C21837426950F560F7AADD28ACF10D0
SHA-256:	9A201F0E3354997753F098EBE5EEF70EC0E15CD561E8EF31E78768C58D9EED8D
SHA-512:	6123DA30D1A096FE1DBA1F3467EA7D3EA5A7FE1673C111ADF78BC7FF8B9432955BCD69888A4420C94F6FD7CF0CF019E6F58B51B2069B322F19EA141FC5E9CF08
Malicious:	false
Preview:	{. "author": {. "name": "John-David Dalton",. "email": "john.david.dalton@gmail.com",. "url": "http://allyoucanleet.com/". },. "description": "The Lodash method `_.isEqual` exported as a module.",. "homepage": "https://lodash.com/",. "icon": "https://lodash.com/icon.svg",. "license": "MIT",. "name": "lodash.isequal",. "repository": {. "type": "git",. "url": "git+https://github.com/lodash/lodash.git". },. "version": "4.5.0".}

C:\Program Files (x86)\????????\resources\app\node_modules\lru-cache\LICENSE

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	765
Entropy (8bit):	4.999520559493967
Encrypted:	false
SSDEEP:	12:9FM9Z7TES4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3t:9SZvICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	82703A69F6D7411DDE679954C2FD9DCA
SHA1:	BB408E929CAEB1731945B2BA54BC337EDB87CC66
SHA-256:	4EC3D4C66CD87F5C8D8AD911B10F99BF27CB00CDFCFF82621956E379186B016B
SHA-512:	3FA748E59FB3AF0C5293530844FAA9606D9271836489D2C8013417779D10CC180187F5E670477F9EC77D341E0EF64EAB7DCFB876C6390F027BC6F869A12D0F46
Malicious:	false
Preview:	The ISC License..Copyright (c) Isaac Z. Schlueter and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Program Files (x86)\????????\resources\app\node_modules\lru-cache\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8186
Entropy (8bit):	4.908640295218627
Encrypted:	false
SSDEEP:	192:M2JIELyidQ+OCuuqCiu0L3N45nGFlo5PAYVzETPatAS+iQHBlIor1Ddi:JJTemlYCnkSNETYUi
MD5:	48445C2C358DBFFCE2099AAF18F5A645
SHA1:	B8B9A8EC246E3EF6FEC472A55AB97CD03E0CE0F2
SHA-256:	F527D2386A6266B9BF67D264194948CF741B12DAA19FEA19E3537414EE31F9A7
SHA-512:	F712B721509485B87A810802A48EEF1C4EBD06276D0E28CD4F00671E76E3C0F9FA1BBF872DA2C93FB5B3BCF8146264C0CBC8D09AFD8E3B9AA4A92F901DF11E7A
Malicious:	false
Preview:	'use strict'..// A linked list to keep track of recently-used-ness.const Yallist = require('yallist')..const MAX = Symbol('max').const LENGTH = Symbol('length').const LENGTH_CALCULATOR = Symbol('lengthCalculator').const ALLOW_STALE = Symbol('allowStale').const MAX_AGE = Symbol('maxAge').const DISPOSE = Symbol('dispose').const NO_DISPOSE_ON_SET = Symbol('noDisposeOnSet').const LRU_LIST = Symbol('lruList').const CACHE = Symbol('cache').const UPDATE_AGE_ON_GET = Symbol('updateAgeOnGet')..const naiveLength = () => 1..// lruList is a yallist where the head is the youngest.// item, and the tail is the oldest. the list contains the Hit.// objects as the entries..// Each Hit object has a reference to its Yallist.Node. This.// never changes..//.// cache is a Map (or PseudoMap) that matches the keys to.// the Yallist.Node object..class LRUCache {. constructor (options) {. if (typeof options === 'number'). options = { max: options }.. if (!options). options = {}.. if (option

C:\Program Files (x86)\????????\resources\app\node_modules\lru-cache\package.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	606
Entropy (8bit):	4.657271189092513
Encrypted:	false
SSDEEP:	12:sbSIn+kMaBec9taf3W6zouPuok/GC2NU7R6a7bmF2N2V1Mn:sbSInxecz23W6zNu/Er1M
MD5:	AE0E39BEAF2C6FE7A3B8CE2598C3B970
SHA1:	384A864AA18AB0587712A263895488F0F008E438
SHA-256:	614D7C579123F8ABF2ABEDA2EA4D356A7226618FDB5501D087B723488F3DED45
SHA-512:	506CD1DB287383AD1324C873436726041FDAB6AA6B1339CCC71C50B8171219D16E056440E29F7F4817AFF19E4F9E2EC357E612F45C797D409383C988713734AD
Malicious:	false
Preview:	{. "author": {. "name": "Isaac Z. Schlueter",. "email": "i@izs.me". },. "dependencies": {. "yallist": "^4.0.0". },. "description": "A cache object that deletes the least-recently-used items.",. "devDependencies": {. "benchmark": "^2.1.4",. "tap": "^14.10.7". },. "engines": {. "node": ">=10". },. "files": [. "index.js". ],. "homepage": "https://github.com/isaacs/node-lru-cache#readme",. "license": "ISC",. "main": "index.js",. "name": "lru-cache",. "repository": {. "type": "git",. "url": "git://github.com/isaacs/node-lru-cache.git". },. "version": "6.0.0".}

C:\Program Files (x86)\????????\resources\app\node_modules\ms\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	3023
Entropy (8bit):	4.755253471176512
Encrypted:	false
SSDEEP:	48:OvI4pOT+6FLQtahYQlCrFWn5V4W55i8v1BeH321aEEg1JPjayheWy0DywdjyG1JC:OgNy6FLQY2SChWn5V4W55F6XeaErOyX4
MD5:	FDDCC2097091479666D0865C176D6615
SHA1:	55F9B3A7D4CFBF68B19CCD0D698AA86483DD4694
SHA-256:	55986972F5F3C9446F876C576E1CD30FD4F04CD26527EFBB5AD834637C740E4C
SHA-512:	252644169A9398527927B69A2F19C6578BD62DCD180B94984D991939F53BF4E77CA687E840DB42F7DBA3B37124A5E3F3EDA83535E75491BBE6CA440A7149913F
Malicious:	false
Preview:	/*. Helpers.. /..var s = 1000;.var m = s 60;.var h = m * 60;.var d = h * 24;.var w = d * 7;.var y = d * 365.25;../*. Parse or format the given `val`.. . Options:. . - `long` verbose formatting [false]. . @param {String\|Number} val. * @param {Object} [options]. * @throws {Error} throw an error if val is not a non-empty string or a number. * @return {String\|Number}. * @api public. /..module.exports = function(val, options) {. options = options \|\| {};. var type = typeof val;. if (type === 'string' && val.length > 0) {. return parse(val);. } else if (type === 'number' && isFinite(val)) {. return options.long ? fmtLong(val) : fmtShort(val);. }. throw new Error(. 'val is not a non-empty string or a valid number. val=' +. JSON.stringify(val). );.};../. Parse the given `str` and return milliseconds.. . @param {String} str. * @return {Number}. * @api private. */..function parse(str) {. str = String(str);. if (str.length > 100) {. return;. }.

C:\Program Files (x86)\????????\resources\app\node_modules\ms\license.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1077
Entropy (8bit):	5.1041829250749355
Encrypted:	false
SSDEEP:	24:buyDrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:bBDaJHlxE3dQHOs5exm3ogFh
MD5:	FD56FD5F1860961DFA92D313167C37A6
SHA1:	884E84EBFDDAFD93B5BB814DF076D2EBD1757BA8
SHA-256:	6652830C2607C722B66F1B57DE15877AB8FC5DCA406CC5B335AFEB365D0F32C1
SHA-512:	2BEC1EFB4DC59FA436C38A1B45B3DBD54A368460BCBBB3D9791B65275B5DC3C71A4C54BE458F4C74761DCCB8897EFAAB46DF5A407723DA5C48F3DB02D555D5B9
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2016 Zeit, Inc...Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR I

C:\Program Files (x86)\????????\resources\app\node_modules\ms\package.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	584
Entropy (8bit):	4.587577222809471
Encrypted:	false
SSDEEP:	12:mLRPYZQCVCYcCWZnk/GC2pss5RBR74JJy2bmWBV1aA:mLRPYZQCIY1WZ0s1R7UW41R
MD5:	6D1A91E3B4481B49526691670EB03134
SHA1:	19A1E8BBA588BBFDD3FE6AC332E3C7757D67B043
SHA-256:	7FACC3283B9BDC72541307299A20E163CBBB60A27D573DE8287C1257D5E847F5
SHA-512:	966A0C42BD36094D2A7FB357E284F9BB7409639A57B9FEE9DDD8F460AAAF543F5D0DBA83DFA840F81A7C2A0F230244FD1629A93FC25CC53F871D8EE06FF3E5A1
Malicious:	false
Preview:	{. "description": "Tiny millisecond conversion utility",. "devDependencies": {. "eslint": "4.12.1",. "expect.js": "0.3.1",. "husky": "0.14.3",. "lint-staged": "5.0.0",. "mocha": "4.0.1". },. "files": [. "index.js". ],. "homepage": "https://github.com/zeit/ms#readme",. "license": "MIT",. "lint-staged": {. "*.js": [. "npm run lint",. "prettier --single-quote --write",. "git add". ]. },. "main": "./index",. "name": "ms",. "repository": {. "type": "git",. "url": "git+https://github.com/zeit/ms.git". },. "version": "2.1.2".}

C:\Program Files (x86)\????????\resources\app\node_modules\next-tick\.editorconfig

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	288
Entropy (8bit):	4.627942599735893
Encrypted:	false
SSDEEP:	6:SlBQh+AmQS2Qpo1vngODdedOZaZw/Pv1sVTmw/y:ek+6vjodOZlPvyby
MD5:	D0A659A1700857990A78667D6AFA3FC0
SHA1:	D45F7F68B281C0FDB09FE3EEB23D5B5F011CE0F8
SHA-256:	1A8D6FEAC06860DF9742D39A173E76557ED4B85254EC67D384C77D187F1D6A17
SHA-512:	531154A7723EE71B98832AC8DCD1ABC6DD4F736DA0A66A5C5985E32E07FB0C4287CBFA8230DE3F02EB823AB9BE5B39E2A28191395904C8361AA15922BDB170A3
Malicious:	false
Preview:	# EditorConfig is awesome: http://EditorConfig.org..# top-most EditorConfig file.root = true..[].charset = utf-8.end_of_line = lf.insert_final_newline = true.indent_style = tab.trim_trailing_whitespace = true..[.md].indent_size = 2.indent_style = space.trim_trailing_whitespace = false.

C:\Program Files (x86)\????????\resources\app\node_modules\next-tick\.github\FUNDING.yml

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.979097891134805
Encrypted:	false
SSDEEP:	3:sRBiZHv:sOv
MD5:	CA231B97D2481CE07BA979A762338BB7
SHA1:	A857465F715FF64C6A65FEF6E25BDA72920EF7DC
SHA-256:	33EF1A3F7D9873BECA2E636ED5D36AE7200F24915E7E1098A13F072A21634F4D
SHA-512:	4AC77395B0228E36689E34226E90C59459A85A082AA72CB6AE4BAF216F561575F9DDFF4030049E5461E2CEFC4E722CF0585DFF7B960EA56B557BD7812A9B2DB5
Malicious:	false
Preview:	tidelift: "npm/next-tick".

C:\Program Files (x86)\????????\resources\app\node_modules\next-tick\.lint

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.538940015192577
Encrypted:	false
SSDEEP:	6:YW3+HjAwKMVv8CQIgjH/oKReF2GFQRw7QR1iFbi7iT:MsiQIcHQ9FFfQoi0
MD5:	A7A3EB7A15FCA7FAB4792E35763DA664
SHA1:	38C98E703AEACCDAD0C5DE62C2289A63EB0BCD91
SHA-256:	872178B0A5E703878954A3A62515F8C6FFD32B4D83E10BBE2E7C3C5B0AAA3DEF
SHA-512:	54D740654D52683A311F6670FE316A4E4F817C0E942880D64323814F852DCC9EF7E3BEEAB0026DDDD2CBA71014E59EA5A5943A2AB85B5B684E029BE684C460F1
Malicious:	false
Preview:	@root..module.es5..indent 2.maxlen 100.tabs..ass.bitwise.nomen.plusplus.vars..predef+ queueMicrotask, process, setImmediate, setTimeout, clearTimeout, document, MutationObserver, WebKitMutationObserver.

C:\Program Files (x86)\????????\resources\app\node_modules\next-tick\CHANGES

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	947
Entropy (8bit):	4.889100631146473
Encrypted:	false
SSDEEP:	24:L1BCA+7kq/DO9WJOMcZ2d1s/zwLeZROOvK5xJ9pejp:5BCA+7v/6MAP2d1sr2eny5xJ9pet
MD5:	3E6232A2FE101FB1D81D49D42D8D4CB5
SHA1:	796E9BCF1927FC53B10D2671F5E488F78009BDAF
SHA-256:	33194D2559C32F5DCF8D357B814D8A991B83FFC0AFB8DDDEABBFD3D696B0E15F
SHA-512:	F7D138146815538358113CF89B13A9D470CBCE7C831664C40D0E6C95FAE1B49948FA5D016D913EC6CA6EBC551A34E2D8737CEBD071C0B64A7BEF5CEDBD9D0DE0
Malicious:	false
Preview:	For recent changelog see CHANGELOG.md..-----..v1.0.0 -- 2016.06.09.* In case MutationObserver based solution ensure all callbacks are propagated. even if any on the way crashes (fixes #3).* Support older engines (as IE8) which see typeof setTimeout as 'object'.* Fix spelling of LICENSE.* Configure lint scripts..v0.2.2 -- 2014.04.18.- Do not rely on es5-ext's valid-callable. Replace it with simple internal function.- In MutationObserver fallback rely on text node instead of attribute and assure. mutation event is invoked by real change of data..v0.2.1 -- 2014.02.24.- Fix case in import path..v0.2.0 -- 2014.02.24.- Assure microtask resultion if MutationObserver is available (thanks @Raynos) #1.- Unify validation of callback. TypeError is throw for any non callable input.- Move main module from `lib` to root directory.- Improve documentation.- Remove Makefile (it's environment agnostic pacakge)..v0.1.0 -- 2012.08.29.Initial.

C:\Program Files (x86)\????????\resources\app\node_modules\next-tick\LICENSE

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	773
Entropy (8bit):	5.079961224972419
Encrypted:	false
SSDEEP:	12:GnYPS4dCPXeTbbtLgmq6KX9KsA8ZXs1HGA3+djz2AvPNj2M3khXgKCgK2P/ew:oICCtEmq6s9imgmc2jZ6how/ew
MD5:	86D1F749528CBB61ADE016A7F823CE94
SHA1:	F9988CF82CBF48606F13425A8A7FC4308C5B5EAB
SHA-256:	D61B7B0B7EF23FE17A4CF996C50362BA842725E9B1A0686792A9C16894A6D5C0
SHA-512:	6140A8EBE5A754F33F3546BDD7879A9E218CCCF84A8246866186783656E532646681BF36B737ECB7348E5A5F5099BFC4BF61B8F9AC58754D52BBB04822CB4102
Malicious:	false
Preview:	ISC License..Copyright (c) 2012-2020, Mariusz Nowak, @medikoo, medikoo.com..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH.REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY.AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,.INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM.LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE.OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR.PERFORMANCE OF THIS SOFTWARE..

C:\Program Files (x86)\????????\resources\app\node_modules\next-tick\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2039
Entropy (8bit):	4.9360916812040205
Encrypted:	false
SSDEEP:	48:7rZWQJVtUrW0MlJ3TGYWBjWFmyDiEgzda3Rh+HzCKXgzdu64RzG:7ZzxhL3qxWFBDiEgzda3nfz8NRzG
MD5:	C910FEF070C13C355D09EDA599466CC6
SHA1:	FA9BB7D33E038A9C2EAE2391134D9FD2D9ED38CA
SHA-256:	75C6AE73DD167D796AC815EB527345A10350452B444FD495E215A3D8E54CA950
SHA-512:	07A6CA450612A4AC037A3E97CBA2FBE90C6F0FD3083C0CCF6F536CE98155D7F0B3A948095E758E5581D539A8D472AF73BF42EDEC6F389BB3DB394A4C93A0213D
Malicious:	false
Preview:	'use strict';..var ensureCallable = function (fn) {..if (typeof fn !== 'function') throw new TypeError(fn + " is not a function");..return fn;.};..var byObserver = function (Observer) {..var node = document.createTextNode(''), queue, currentQueue, i = 0;..new Observer(function () {...var callback;...if (!queue) {....if (!currentQueue) return;....queue = currentQueue;...} else if (currentQueue) {....queue = currentQueue.concat(queue);...}...currentQueue = queue;...queue = null;...if (typeof currentQueue === 'function') {....callback = currentQueue;....currentQueue = null;....callback();....return;...}...node.data = (i = ++i % 2); // Invoke other batch, to handle leftover callbacks in case of crash...while (currentQueue) {....callback = currentQueue.shift();....if (!currentQueue.length) currentQueue = null;....callback();...}..}).observe(node, { characterData: true });..return function (fn) {...ensureCallable(fn);...if (queue) {....if (typeof queue === 'function') queue = [queue, fn];...

C:\Program Files (x86)\????????\resources\app\node_modules\next-tick\package.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	404
Entropy (8bit):	4.841168921946752
Encrypted:	false
SSDEEP:	6:vFIJKS13l/OCt8KkI1z6dzn4wlvHQ/Ly+T6zRRPEuF8PBQJn02qqWNLLILAe71Jm:U115O6Yc+hNwbmF2lq09No8e5JZY
MD5:	9BC28B4EC81B0F2C44ABD342CF42A152
SHA1:	9A1C4F8517F02B00529C74AABF6F3FE0B94B4E5A
SHA-256:	19B29EF2FF032A3AD2D984C10883A87263ED15A31597833229AE490C911C4720
SHA-512:	66906781D705139910CEA0E9C9B48B082BDA44AA3D893FD363C74796487B19D98E5481129D02B8BD02A8BC292AE8E898E98D68F8194BC2EB3E352B8E84F8FE32
Malicious:	false
Preview:	{. "name": "next-tick",. "version": "1.1.0",. "description": "Environment agnostic nextTick polyfill",. "author": "Mariusz Nowak <medyk@medikoo.com> (http://www.medikoo.com/)",. "repository": {. "type": "git",. "url": "git://github.com/medikoo/next-tick.git". },. "devDependencies": {. "tad": "^3.0.1",. "xlint": "^0.2.2",. "xlint-jslint-medikoo": "^0.1.4". },. "license": "ISC".}

C:\Program Files (x86)\????????\resources\app\node_modules\node-gyp-build\LICENSE

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	5.10194304910543
Encrypted:	false
SSDEEP:	24:birmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:biaJHlxE35QHOs5exm3ogF5n
MD5:	BB7EAE1C2FBB280C72665DB9A1EFC896
SHA1:	D8B48E299B050FC23D408C2B0D526FB443F7016B
SHA-256:	7B3638496004B2DAED183A91C4BA45D3EF6331DB6C9D0EB1DD882A505630C172
SHA-512:	EA19F7F121BE376FB9EBDF017DBAE933C3362AD2852D46D223FC570624BC1F57B40510C67B33BEA37C249378290A9EEA692BEDE669C98DDBC22053907FBA55AF
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2017 Mathias Buus..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR

C:\Program Files (x86)\????????\resources\app\node_modules\node-gyp-build\bin.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1977
Entropy (8bit):	4.933368958890559
Encrypted:	false
SSDEEP:	48:l321QZrIEz8+DzJ37aouL+5xGNo06F9Ljb:pKwrX8+jTEo39Ljb
MD5:	A80AC991CF67A439CD21021C548244ED
SHA1:	7AB3DCB8134103775BD15F53BF3A22429F2FEBC1
SHA-256:	EAFC529B86883777CE0B2EC1FC1644665B970BC7350EAFCBA7DC8492D8606A46
SHA-512:	696B8CD40498D90467C415DBEC7FA4668D4067711514ECBC02AF69CF70D00488F409AFD329F225DCB60B2D39F14B79E121B189C1CBC06527C0DFE19A9D657B44
Malicious:	false
Preview:	#!/usr/bin/env node..var proc = require('child_process').var os = require('os').var path = require('path')..if (!buildFromSource()) {. proc.exec('node-gyp-build-test', function (err, stdout, stderr) {. if (err) {. if (verbose()) console.error(stderr). preinstall(). }. }).} else {. preinstall().}..function build () {. var args = [os.platform() === 'win32' ? 'node-gyp.cmd' : 'node-gyp', 'rebuild'].. try {. args = [. process.execPath,. path.join(require.resolve('node-gyp/package.json'), '..', require('node-gyp/package.json').bin['node-gyp']),. 'rebuild'. ]. } catch (_) {}.. proc.spawn(args[0], args.slice(1), { stdio: 'inherit' }).on('exit', function (code) {. if (code \|\| !process.argv[3]) process.exit(code). exec(process.argv[3]).on('exit', function (code) {. process.exit(code). }). }).}..function preinstall () {. if (!process.argv[2]) return build(). exec(process.argv[2]).on('exit', function (code) {. if (code) process.exit(

C:\Program Files (x86)\????????\resources\app\node_modules\node-gyp-build\build-test.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	398
Entropy (8bit):	4.895783205511838
Encrypted:	false
SSDEEP:	12:HSEcD/pcKhMfrvGZ0cqtJ0tfnF9HvTVWEhMO0:y1BFOewStvFh7VWEI
MD5:	F1704E9CE6FDDFEA40EF4218C1B27215
SHA1:	9A6433B1049A3418B27DB5E3D95710C6BF112799
SHA-256:	34C19FF8B6675D6D27C63A7DF44D77A442805EEEA8756D1C89E0264F4A3028F6
SHA-512:	562336FE85580E0BD4BE3094CAAC937B9C2BCE1339F0606665E70546062F3966F9B75360C5D9727A97A0CA84CB0586BF09F5C398F7A42D4B640E5CF7B6A209D2
Malicious:	false
Preview:	#!/usr/bin/env node..process.env.NODE_ENV = 'test'..var path = require('path').var test = null..try {. var pkg = require(path.join(process.cwd(), 'package.json')). if (pkg.name && process.env[pkg.name.toUpperCase().replace(/-/g, '_')]) {. process.exit(0). }. test = pkg.prebuild.test.} catch (err) {. // do nothing.}..if (test) require(path.join(process.cwd(), test)).else require('./')().

C:\Program Files (x86)\????????\resources\app\node_modules\node-gyp-build\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	4875
Entropy (8bit):	4.8652405434280945
Encrypted:	false
SSDEEP:	96:NMg30ptyuzQbuRQCKNGK8RGKMLitYhhrlWt+BfTztPBJ8UPCrBx:C86tyuQIbebrlF1TztZJ8UKP
MD5:	C4C7B73509DD1CC4A5066ADB76FDE27F
SHA1:	32A15B07D412DD21065C55F45B4D8E0DB013186D
SHA-256:	114EFFA6C7970F5471B0172B85B935A4B4113BE877BAE3C3F3663FD298FAE5AF
SHA-512:	ABC2387AFA24807EE8DA570CC5C822C69F28CFEB5D6CCE0E69C7BD32193AEB01AD7EE58F37407BF2567ED5FC5C012273EE237860A025AB3AEAA3D3AA5F8EB4CE
Malicious:	false
Preview:	var fs = require('fs').var path = require('path').var os = require('os')..// Workaround to fix webpack's build warnings: 'the request of a dependency is an expression'.var runtimeRequire = typeof __webpack_require__ === 'function' ? __non_webpack_require__ : require // eslint-disable-line..var vars = (process.config && process.config.variables) \|\| {}.var prebuildsOnly = !!process.env.PREBUILDS_ONLY.var abi = process.versions.modules // TODO: support old node where this is undef.var runtime = isElectron() ? 'electron' : 'node'.var arch = os.arch().var platform = os.platform().var libc = process.env.LIBC \|\| (isAlpine(platform) ? 'musl' : 'glibc').var armv = process.env.ARM_VERSION \|\| (arch === 'arm64' ? '8' : vars.arm_version) \|\| ''.var uv = (process.versions.uv \|\| '').split('.')[0]..module.exports = load..function load (dir) {. return runtimeRequire(load.path(dir)).}..load.path = function (dir) {. dir = path.resolve(dir \|\| '.').. try {. var name = runtimeRequire(path.join(dir, 'pa

C:\Program Files (x86)\????????\resources\app\node_modules\node-gyp-build\optional.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	143
Entropy (8bit):	4.518621704521984
Encrypted:	false
SSDEEP:	3:TKQWaHMPM2b+4cNMLWL2ZLOreHiKR8T/UXFvcU4LERSgBjv8vVKO:HWaH6BcKlZKaksXFEHwH6vVKO
MD5:	45F60A072FF4139CD00B0460E3B277A9
SHA1:	5899CFD1B83F050FF6FAB2FAB26C7F0012393ABF
SHA-256:	E0B3A3A04166E6ECF1020CB31C0C4A54432C16D6D88714BD4DE2214CF67DEC81
SHA-512:	3A56C99B00A1CD0CAB8FC5B4EA47346252BE6DBC8075374FC352CDC963136DEB9081B43B65106B7FE6E8F826C1DEEC7A9BBC2D34D726A7A8BB1993192E7EBB64
Malicious:	false
Preview:	#!/usr/bin/env node../.I am only useful as an install script to make node-gyp not compile for purely optional native deps./..process.exit(0).

C:\Program Files (x86)\????????\resources\app\node_modules\node-gyp-build\package.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	663
Entropy (8bit):	4.696729300572723
Encrypted:	false
SSDEEP:	12:zoXPq/0OmYVuhBNv4FzrdMciLWHhs6aZbmWzhvoV1J:cXi/0OiNv4FtMW5Cg1J
MD5:	0B1170DFBB6C1EADD0DAEA435BC7DF91
SHA1:	3FB0239C3BC1F7956F4D48D79DCF84F0BC0E205E
SHA-256:	FB837272A0C3741E110302EF5ECBC4E3C8E9EDEE1B3EE3CA8A912D7743EE06E1
SHA-512:	1B6CA775F8B0F3EFF7ACFE2FA50EB795406AE861E976EFE3D404BED12BAABC2CE31B639640E444BD3D3A3059354782B4580C27845BCFFEB56F56F34DB4DA5421
Malicious:	false
Preview:	{. "author": {. "name": "Mathias Buus",. "url": "@mafintosh". },. "bin": {. "node-gyp-build": "bin.js",. "node-gyp-build-optional": "optional.js",. "node-gyp-build-test": "build-test.js". },. "description": "Build tool and bindings loader for node-gyp that supports prebuilds",. "devDependencies": {. "array-shuffle": "^1.0.1",. "standard": "^14.0.0",. "tape": "^5.0.0". },. "homepage": "https://github.com/prebuild/node-gyp-build",. "license": "MIT",. "main": "index.js",. "name": "node-gyp-build",. "repository": {. "type": "git",. "url": "git+https://github.com/prebuild/node-gyp-build.git". },. "version": "4.2.3".}

C:\Program Files (x86)\????????\resources\app\node_modules\once\LICENSE

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	765
Entropy (8bit):	4.999520559493967
Encrypted:	false
SSDEEP:	12:9FM9Z7TES4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3t:9SZvICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	82703A69F6D7411DDE679954C2FD9DCA
SHA1:	BB408E929CAEB1731945B2BA54BC337EDB87CC66
SHA-256:	4EC3D4C66CD87F5C8D8AD911B10F99BF27CB00CDFCFF82621956E379186B016B
SHA-512:	3FA748E59FB3AF0C5293530844FAA9606D9271836489D2C8013417779D10CC180187F5E670477F9EC77D341E0EF64EAB7DCFB876C6390F027BC6F869A12D0F46
Malicious:	false
Preview:	The ISC License..Copyright (c) Isaac Z. Schlueter and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Program Files (x86)\????????\resources\app\node_modules\once\once.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.542537392816871
Encrypted:	false
SSDEEP:	24:BBkBkP1BNdyYkNWBdZYdlNUWAeKgKhBYoCl/EKgKhBYrqwR:BG+thkNW3OdlNUWAeKgKhBY3l/EKgKhu
MD5:	D1D6962324348AD89BF780A233952C61
SHA1:	F78C8CB8D754261B59D03E867F329C2FFDEFAE45
SHA-256:	3DB73E347ECBDBAFDF8D0DB85145C877E133F5372E767360EF90C09F70AC5103
SHA-512:	9D9667F080E1534260C68A57AAF1D1DB368BD03D8C998D4B5DD3DF68DDE1889E237BB735D73D29D65BDA50C05BF87CC3637CE504BC885E32D2C908D706F3DC9F
Malicious:	false
Preview:	var wrappy = require('wrappy').module.exports = wrappy(once).module.exports.strict = wrappy(onceStrict)..once.proto = once(function () {. Object.defineProperty(Function.prototype, 'once', {. value: function () {. return once(this). },. configurable: true. }).. Object.defineProperty(Function.prototype, 'onceStrict', {. value: function () {. return onceStrict(this). },. configurable: true. }).})..function once (fn) {. var f = function () {. if (f.called) return f.value. f.called = true. return f.value = fn.apply(this, arguments). }. f.called = false. return f.}..function onceStrict (fn) {. var f = function () {. if (f.called). throw new Error(f.onceError). f.called = true. return f.value = fn.apply(this, arguments). }. var name = fn.name \|\| 'Function wrapped with `once`'. f.onceError = name + " shouldn't be called more than once". f.called = false. return f.}.

C:\Program Files (x86)\????????\resources\app\node_modules\once\package.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	555
Entropy (8bit):	4.515496178806181
Encrypted:	false
SSDEEP:	12:sbSILAdrmAsENqnBYRQdFn8rcVHAkVPY7wwbmF2yV1oa:sbSILA9iLB8Qj8m6wZ1oa
MD5:	35A4B0B002CA6B43DABC0C8D515A7FCC
SHA1:	49B73425BD1FFF3C51FAFEB2CD486103234F7C31
SHA-256:	DB2F2D3EA10B5163DC13E8FD88CA0D3450139E6B32A8689B9ADF6FFB4EBCF74B
SHA-512:	73CF03A718FFC739FDBCE372F36CB92DDD0F7BDBB1F53B4C2DC864E37B3658D358BD21B5AD31170D3EAD2549A4A26467C63094A1AB4AE18A73588892E3C71BF3
Malicious:	false
Preview:	{. "author": {. "name": "Isaac Z. Schlueter",. "email": "i@izs.me",. "url": "http://blog.izs.me/". },. "dependencies": {. "wrappy": "1". },. "description": "Run a function exactly one time",. "devDependencies": {. "tap": "^7.0.1". },. "directories": {. "test": "test". },. "files": [. "once.js". ],. "homepage": "https://github.com/isaacs/once#readme",. "license": "ISC",. "main": "once.js",. "name": "once",. "repository": {. "type": "git",. "url": "git://github.com/isaacs/once.git". },. "version": "1.4.0".}

C:\Program Files (x86)\????????\resources\app\node_modules\pend\LICENSE

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1082
Entropy (8bit):	5.115185639445276
Encrypted:	false
SSDEEP:	24:Z7IB4JHbN0yPP3GtEHw1Gg9QH+sUW8Ok4F+d5o32q/Fh:Z7IiJxlPvKfICQH+sfItC32YFh
MD5:	E8A22696B017D8F536112EF54C81F3FA
SHA1:	C2F491F2C81AD3868D3D691EF6E372EFCFAF0A82
SHA-256:	7E64ACFFCB0D20D33F5A86949FFD4A99AE045B10C7332A9C3A58635876C16880
SHA-512:	4474EC11A8148544F77E8785EEC4BAEB5706AC7767E09333156AE17B669A5F2A2627AD5D4F7790C111A3FCF5E75AA35DA425E852200DB0573557CB2C597F3277
Malicious:	false
Preview:	The MIT License (Expat)..Copyright (c) 2014 Andrew Kelley..Permission is hereby granted, free of charge, to any person.obtaining a copy of this software and associated documentation files.(the "Software"), to deal in the Software without restriction,.including without limitation the rights to use, copy, modify, merge,.publish, distribute, sublicense, and/or sell copies of the Software,.and to permit persons to whom the Software is furnished to do so,.subject to the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF

C:\Program Files (x86)\????????\resources\app\node_modules\pend\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1101
Entropy (8bit):	4.622279925928469
Encrypted:	false
SSDEEP:	24:DB8XM/rWbhYBrYiCqFdTqrly/yA0jUQiDKY53:DKXM/rOhYBMjqFdTqrly/yVPs3
MD5:	51CDD3C93701CA33381FABDA25149A99
SHA1:	4B98D801DFCFA16CB4C2F66930704DB959E8EFC7
SHA-256:	4B991290680D9027DD786493C6E816900355956D88AFB6AE4D97B5AC5A3EE0F5
SHA-512:	7B5C4B4D2F7DAEF6E99038DC37859FEDD4B059340CAC258CEA62B0AF54D16FFD67E117D028CD34CC4F22742674A583DA98A5760F72E867A64494D064B1A74B5D
Malicious:	false
Preview:	module.exports = Pend;..function Pend() {. this.pending = 0;. this.max = Infinity;. this.listeners = [];. this.waiting = [];. this.error = null;.}..Pend.prototype.go = function(fn) {. if (this.pending < this.max) {. pendGo(this, fn);. } else {. this.waiting.push(fn);. }.};..Pend.prototype.wait = function(cb) {. if (this.pending === 0) {. cb(this.error);. } else {. this.listeners.push(cb);. }.};..Pend.prototype.hold = function() {. return pendHold(this);.};..function pendHold(self) {. self.pending += 1;. var called = false;. return onCb;. function onCb(err) {. if (called) throw new Error("callback called twice");. called = true;. self.error = self.error \|\| err;. self.pending -= 1;. if (self.waiting.length > 0 && self.pending < self.max) {. pendGo(self, self.waiting.shift());. } else if (self.pending === 0) {. var listeners = self.listeners;. self.listeners = [];. listeners.forEach(cbListener);. }. }. function cbListe

C:\Program Files (x86)\????????\resources\app\node_modules\pend\package.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	381
Entropy (8bit):	4.656769641416467
Encrypted:	false
SSDEEP:	6:q/OchASZZWS7WdyjlsP/kn9/ExDbLQTVxi33eIUFM3oc67OO4Q/Ly+T6zRRPEi3I:EAOoSiulsPcnBExDbLabEe5I6aEbmF2l
MD5:	2BCA88279909B79C6D5366A283966B56
SHA1:	477963E251360D081D06E34D99861D76C3CD320E
SHA-256:	0BBB102818D20827652122ADC7C70FFBA57B97AEC8717DC268EA93A5A1368876
SHA-512:	2673DB69181DBC4199AA34C0B5F2C8FDFEBDD929126A8ABD177F8ED85A7847B15D3D01618CC6112D8257A8035378B4BB4D0D287F9BDAFE3FE3B4EA315788C1CF
Malicious:	false
Preview:	{. "author": {. "name": "Andrew Kelley",. "email": "superjoe30@gmail.com". },. "description": "dead-simple optimistic async helper",. "homepage": "https://github.com/andrewrk/node-pend#readme",. "license": "MIT",. "main": "index.js",. "name": "pend",. "repository": {. "type": "git",. "url": "git://github.com/andrewrk/node-pend.git". },. "version": "1.2.0".}

C:\Program Files (x86)\????????\resources\app\node_modules\pump\LICENSE

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1078
Entropy (8bit):	5.101372122926712
Encrypted:	false
SSDEEP:	24:bHrmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5/:bHaJHlxE35QHOs5exm3ogF5/
MD5:	9BEFE7026BF915886CD566A98117C80E
SHA1:	A95AB3A4B0E4BD978897F09B3B430A449DA20A08
SHA-256:	3FE8D55A98DBF260EACE67C00CF9BC53EDB46234E840098A0B93DF3096B97FB6
SHA-512:	B52BA143042812D6DD1031A12946AFDDB6E8F8EBBC7169C59C138D16AAFC5E261AAE92FE6B1EA94A3D80E39D2415C4B219710EF46939A2DF135DB24A0CF712FB
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2014 Mathias Buus..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR

C:\Program Files (x86)\????????\resources\app\node_modules\pump\index.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2224
Entropy (8bit):	4.6062828577700135
Encrypted:	false
SSDEEP:	48:56SDTgDXGbGQkGbE7LVKjEKpdK7xC7KRWdrFFkNLXuR7KGV8QOArzTlwxy6y:ESDkDQQPVKjB+7gGRWd5F4juRZV8QHPH
MD5:	9C2361A467ECC8BDC786062B892524DF
SHA1:	0E7454E620E2482B0311A99789505FC24C60F2CD
SHA-256:	60AE01725219C69E086E0CFE6A6DA1F94A9BAFCFBF528460B6E04B7B6D983165
SHA-512:	27058A7D101C2A09329862F74377E70E7C561D3ADCF77F29BD38F1A05204F31BF139291A2F6E66006407156C53A0CE988570188A343326B7B2E80346E5EAB2E3
Malicious:	false
Preview:	var once = require('once').var eos = require('end-of-stream').var fs = require('fs') // we only need fs to get the ReadStream and WriteStream prototypes..var noop = function () {}.var ancient = /^v?\.0/.test(process.version)..var isFn = function (fn) {. return typeof fn === 'function'.}..var isFS = function (stream) {. if (!ancient) return false // newer node version do not need to care about fs is a special way. if (!fs) return false // browser. return (stream instanceof (fs.ReadStream \|\| noop) \|\| stream instanceof (fs.WriteStream \|\| noop)) && isFn(stream.close).}..var isRequest = function (stream) {. return stream.setHeader && isFn(stream.abort).}..var destroyer = function (stream, reading, writing, callback) {. callback = once(callback).. var closed = false. stream.on('close', function () {. closed = true. }).. eos(stream, {readable: reading, writable: writing}, function (err) {. if (err) return callback(err). closed = true. callback(). }).. var destroyed = f

C:\Program Files (x86)\????????\resources\app\node_modules\pump\package.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	501
Entropy (8bit):	4.57476758957376
Encrypted:	false
SSDEEP:	12:ySMADQPcnT4aRwznBjDDoWQ8lYG5+bmF28lYNoV1Tn:ySZDccEaRUBjDFXt1T
MD5:	D568F611A2378D4E941335E0EE21BE14
SHA1:	CDF06C07FF424EC07BD5E4FF9E0CCEFB908B733E
SHA-256:	049E21320905F58A5C3BEAA777C044A0C0D5A45BBAC4BEF0ADF0B970008E93B1
SHA-512:	7B72CB95BE775222530420D336C991C0EFBB13EC5451CD0761069CA951A1B3F9AC8BD0455C5559497E7C21A57C3767B29EAE84E0168C15A378AE2B44148D4EF8
Malicious:	false
Preview:	{. "author": {. "name": "Mathias Buus Madsen",. "email": "mathiasbuus@gmail.com". },. "browser": {. "fs": false. },. "dependencies": {. "end-of-stream": "^1.1.0",. "once": "^1.3.1". },. "description": "pipe streams together and close all of them if one of them closes",. "homepage": "https://github.com/mafintosh/pump#readme",. "license": "MIT",. "name": "pump",. "repository": {. "type": "git",. "url": "git://github.com/mafintosh/pump.git". },. "version": "3.0.0".}

C:\Program Files (x86)\????????\resources\app\node_modules\pump\test-browser.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	4.7783098622524705
Encrypted:	false
SSDEEP:	24:B4EnNiGkOhe/IKl3JS7H5MZ6kNzNUFtqAKHnAKoxXKCRv9ccuvwS1:nnEVOhe/Ij7ZMZ6kNzNUF/KgKoxXKgl+
MD5:	FA873AC53F1CEBD3D3EB52F30658C17F
SHA1:	59CAB224EBBBC55B441F36C811879CB00B02EE6C
SHA-256:	BFDD31D421D9975519122715DF56E81662ABF283E386BDA1D7141EF277F70191
SHA-512:	8E172FD0946C6B0DE0A6A3BD0F587FBD4A1599E0A94B6322343262AE0848F7CD17F17D39486D167AB55AD28E7D0CB5DD7F39334E22A0330696FDB3D6B642FA09
Malicious:	false
Preview:	var stream = require('stream').var pump = require('./index')..var rs = new stream.Readable().var ws = new stream.Writable()..rs._read = function (size) {. this.push(Buffer(size).fill('abc')).}..ws._write = function (chunk, encoding, cb) {. setTimeout(function () {. cb(). }, 100).}..var toHex = function () {. var reverse = new (require('stream').Transform)().. reverse._transform = function (chunk, enc, callback) {. reverse.push(chunk.toString('hex')). callback(). }.. return reverse.}..var wsClosed = false.var rsClosed = false.var callbackCalled = false..var check = function () {. if (wsClosed && rsClosed && callbackCalled) {. console.log('test-browser.js passes'). clearTimeout(timeout). }.}..ws.on('finish', function () {. wsClosed = true. check().})..rs.on('end', function () {. rsClosed = true. check().})..var res = pump(rs, toHex(), toHex(), toHex(), ws, function () {. callbackCalled = true. check().})..if (res !== ws) {. throw new Error('should return la

C:\Program Files (x86)\????????\resources\app\node_modules\pump\test-node.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	992
Entropy (8bit):	4.780742627388746
Encrypted:	false
SSDEEP:	24:g86ycVoKl3JS7H5MZ6kNzNOBAK6AKoxXKCRv9dS4:g87cVoj7ZMZ6kNzNOGKBKoxXKgldS4
MD5:	50C3C91E257B613920E54E58C13016C9
SHA1:	0A2DF1E72B556111EE991031DEB6278A2417E954
SHA-256:	04B7B585E056FCCEA011F300815D9F19AFB190B7C88F5BC575AEAC8B5DD00DED
SHA-512:	59291B5F3B29141195467E20F5368CEC2FF4C973623024747A7456A5F2C4A00A2EC0FE8121B48844BAA1C6DE01F24442A55B929BC1114670FF66F064E82326DF
Malicious:	false
Preview:	var pump = require('./index')..var rs = require('fs').createReadStream('/dev/random').var ws = require('fs').createWriteStream('/dev/null')..var toHex = function () {. var reverse = new (require('stream').Transform)().. reverse._transform = function (chunk, enc, callback) {. reverse.push(chunk.toString('hex')). callback(). }.. return reverse.}..var wsClosed = false.var rsClosed = false.var callbackCalled = false..var check = function () {. if (wsClosed && rsClosed && callbackCalled) {. console.log('test-node.js passes'). clearTimeout(timeout). }.}..ws.on('close', function () {. wsClosed = true. check().})..rs.on('close', function () {. rsClosed = true. check().})..var res = pump(rs, toHex(), toHex(), toHex(), ws, function () {. callbackCalled = true. check().})..if (res !== ws) {. throw new Error('should return last stream').}..setTimeout(function () {. rs.destroy().}, 1000)..var timeout = setTimeout(function () {. throw new Error('timeout').}, 5000).

C:\Program Files (x86)\????????\resources\app\node_modules\ref-array-napi\History.md

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	2006
Entropy (8bit):	5.267674885829816
Encrypted:	false
SSDEEP:	48:5Z2BeoZNMi8EFXJAu0cLZzpA5pJ5hF5p1eXfJudgUW:58PLM/sXJx0cLTATL1MJv
MD5:	2D6D27B83F2C77E13F4F8099BA070977
SHA1:	51C07FA5A72D180CA26CF6F930E6CEEF31D01BE7
SHA-256:	A0BC751A57553237550CE1E5FAB6F73A824EBFCC3471FEB07F368977836B405A
SHA-512:	2BFFF72AE964FC05C1D49F7A9DEECA52356A6982FD21583EDA245175A0385FDF09E9514CF7BACEF16BBE0D339B513D35E403D119B72A634ECB3D644E7D884F2B
Malicious:	false
Preview:	1.2.0 / 2016-10-14..==================....* [[`ba418e8fb3`](https://github.com/TooTallNate/ref-array/commit/ba418e8fb3)] - update "array-index" to v1 (Nathan Rajlich)..* [[`991e894d75`](https://github.com/TooTallNate/ref-array/commit/991e894d75)] - package: add "license" field (Nathan Rajlich)..* [[`d0565662a3`](https://github.com/TooTallNate/ref-array/commit/d0565662a3)] - package: update dev deps (Nathan Rajlich)..* [[`cce5fb960c`](https://github.com/TooTallNate/ref-array/commit/cce5fb960c)] - array: s/slicer/slice/ (Nathan Rajlich)..* [[`8050a81587`](https://github.com/TooTallNate/ref-array/commit/8050a81587)] - appveyor: fix node v0.8, test io.js v2.5 and v3 (Nathan Rajlich)..* [[`c636c37e80`](https://github.com/TooTallNate/ref-array/commit/c636c37e80)] - test: add a test for passing Arrays to a native addon function (Nathan Rajlich)....1.1.2 / 2015-08-27..==================.... * appveyor: test node v0.12, and x64 platform.. * package: allow any "ref" v1.. *

C:\Program Files (x86)\????????\resources\app\node_modules\ref-array-napi\lib\array.js

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	8991
Entropy (8bit):	4.814183433293159
Encrypted:	false
SSDEEP:	192:VknwZeeDNmMmmtmmmimmMTLW/HlD1UNoC7ptauUptagte:2n0eANnmvmlmtOfp1UNVtt/ita
MD5:	4A369EEA452D0821CFA00F25CE017B23
SHA1:	79C12DF1D1E66006AF98880687928E8B90343B4C
SHA-256:	5248565B48B83EA9FBA83AD7BA8D49C2AF3871685A04EC4036EE9996350EF0AB
SHA-512:	8C9F45CA9F164B85057C1035039902A8E2AEFA7D2814E3A6D248C7764FF98CDD8EA301166EAD7C1364EE2F7140189FDC7C879A806E2B9D044E312470B77C3F04
Malicious:	false
Preview:	../*.. Module dependencies... /....var _ref = require('ref-napi')..var assert = require('assert')..var debug = require('debug')('ref:array')..var ArrayIndex = require('array-index')..var isArray = Array.isArray..../.. The Array "type" constructor... * The returned constructor's API is highly influenced by the WebGL.. * TypedArray API... /....module.exports = function Array (_type, _length) {.. debug('defining new array "type"').. var type = _ref.coerceType(_type).. var fixedLength = _length \| 0.... /.. This is the ArrayType "constructor" that gets returned... */.... function ArrayType (data, length) {.. if (!(this instanceof ArrayType)) {.. return new ArrayType(data, length).. }.. debug('creating new array instance').. ArrayIndex.call(this).. var item_size = ArrayType.BYTES_PER_ELEMENT.. if (0 === arguments.length) {.. // new IntArray().. // use the "fixedLength" if provided, otherwise throw an Error.. if (fixedLength > 0) {..

C:\Program Files (x86)\????????\resources\app\node_modules\ref-array-napi\node_modules\debug\LICENSE

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	5.12256218715534
Encrypted:	false
SSDEEP:	24:kr4/HHHP0yPP3gtqHw1hH9MPHcv48Ok4MdboHoqDFz:k8/vlPvERdMPHhIjcHoOFz
MD5:	DDD815A475E7338B0BE7A14D8EE35A99
SHA1:	D16A2786962571280A11CAE01D5E59AEB1351C9A
SHA-256:	98C970DE440DCFC77471610AEC2377C9D9B0DB2B3BE6D1ADD524A586E1D7F422
SHA-512:	47B612EF4E93F1AF62891E295E9FBAC05E02CF1726F56C36FAD5314376E28CBCAF7C8355527BC0BDA54C26CBE097BC8CA5CB4F79AA9E3AB6F1D875DCA41D4AAC
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2014 TJ Holowaychuk <tj@vision-media.ca>..Permission is hereby granted, free of charge, to any person obtaining a copy of this software .and associated documentation files (the 'Software'), to deal in the Software without restriction, .including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, .and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so,.subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or substantial .portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT .LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. .IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, .WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWIS

C:\Program Files (x86)\????????\resources\app\node_modules\ref-array-napi\node_modules\debug\component.json

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	321
Entropy (8bit):	4.465851094571166
Encrypted:	false
SSDEEP:	6:vX6aLWJd/k9ExRcUS1YpuXH+HQ6MEwHQJIxKHlOXdHhXdBA7SF9CVNkQ:SaLAh3XI1YpYY5MNsSKOdhdBAmCJ
MD5:	510AF4D67A35446E6DCCEA1429399C3A
SHA1:	4963889B7905ABD5A8955B8D27C3079E2D449564
SHA-256:	2E5AB9AE90F41699E00D00FCA16765024F437300A0568C2208669CC281BA7656
SHA-512:	BB8D1E0E4C99A82D32FB40DAA9A79E2ABF3A3F495B3DC9AFA883021110B3CA9EB93E052D71E98D6494722DF947EC280D66F4BCA36BB0AE975F05D710E8C47415
Malicious:	false
Preview:	{. "name": "debug",. "repo": "visionmedia/debug",. "description": "small debugging utility",. "version": "2.6.9",. "keywords": [. "debug",. "log",. "debugger". ],. "main": "src/browser.js",. "scripts": [. "src/browser.js",. "src/debug.js". ],. "dependencies": {. "rauchg/ms.js": "0.7.1". }.}.

C:\Program Files (x86)\????????\vulkan-1.dll

Download File

Process:	C:\Users\user\Desktop\pK6oGXjugD.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	630784
Entropy (8bit):	6.719902954619518
Encrypted:	false
SSDEEP:	12288:LqVxi0ZmVhGfA8gFlkPdcarfoxpQGyHua8pyE/XPV2Yo:UxJRrfQry4yE
MD5:	186BD63107DE3831E79B92F0C6A6AA00
SHA1:	54FD970A152435CFAEA7405D4D4E11BA596D219F
SHA-256:	83673CE1EC4B42A60BFA3ED07A658375F07E0934D95D6850C12F4CD91E1205A7
SHA-512:	32F653A3860D52ED72A025A5F3BA94EEF741EA393ED734BC4F675E9A5EC36A5EA8F8BB3555BC0980C02943E2EF7A5F772DB0522362BF59F0D1C31D124B134C2D
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....W.`.........."!......................................................................@A........................4...N.......P...............................x\..................................H................................................text............................... ..`.rdata..,0.......2..................@..@.data....4...@....... ..............@....00cfg...............<..............@..@.tls.................>..............@....voltbl.0............@...................reloc..x\.......^...B..............@..B................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.997727030310938
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	pK6oGXjugD.exe
File size:	20968188
MD5:	0a68b271537063af4fa3c46895389b6d
SHA1:	ff106ad1e92511cae026f3d1f772dc8c04d694a2
SHA256:	fa3b15251b20a7b8bba32fdd02993989d28c7a4deecf1b2992e558355bc14584
SHA512:	dfc9628e1c06d21024ec1121029d224361681667cd1539f9a5885a18920c51c64e9514a539107e6ec0aa5f5650a573a6e3456675ff84386eb566439ea82f4ec9
SSDEEP:	393216:2kq4yXJaaAouC7L/6DTkO0JCHyMDNSLrroEdWkoAx/V1i/7N3gaya9oillPMwEWI:3q4yXLZuaenz0sSMWrU0pV1iBgcZEW6h
TLSH:	982733B316B41033E92A367A349375350C8C8BB09B74FE1D979C451A5DF28713ACEA9E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........gQ!..?r..?r..?rj..r..?rj..rU.?rj..r..?r.[<s..?r.[;s..?r.[:s..?r.~.r..?r.~.r..?r..>r&.?r.[:s..?r.[?s..?r.[.r..?r.[=s..?rRich..?

File Icon


Icon Hash:	e8b4a28ac4c6e674

Static PE Info

General

Entrypoint:	0x41cab5
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x57B0C365 [Sun Aug 14 19:15:49 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	027ea80e8125c6dda271246922d4c3b0

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
call 00007F3248B8E73Eh
jmp 00007F3248B8E125h
cmp ecx, dword ptr [004391B8h]
jne 00007F3248B8E2A5h
ret
jmp 00007F3248B8E8B5h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0042FF60h
mov dword ptr [ecx], 004308FCh
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F3248B81AE9h
mov dword ptr [esi], 00430908h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 00430910h
mov dword ptr [ecx], 00430908h
ret
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F3248B8E24Ch
push 00436C58h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F3248B90B72h
int3
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F3248B8E262h
push 00436E8Ch
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F3248B90B55h
int3
jmp 00007F3248B92E1Bh
jmp dword ptr [0042F21Ch]
push 0041FD30h
push dword ptr fs:[00000000h]
mov eax, dword ptr [esp+10h]
mov dword ptr [esp+10h], ebp
lea ebp, dword ptr [esp+10h]
sub esp, eax
push ebx
push esi

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[C++] VS2015 UPD2 build 23918
[EXP] VS2015 UPD2 build 23918
[RES] VS2015 UPD2 build 23918
[LNK] VS2015 UPD2 build 23918

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x37d70	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x37da4	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5a000	0x3aea	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x4ce7208	0x3530
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5e000	0x1f8c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x35ec0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x30890	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2f000	0x21c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x37334	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2dfe8	0x2e000	False	0.5943656589673914	data	6.710245141762556	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2f000	0x99d0	0x9a00	False	0.4611911525974026	data	5.152865190130304	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x39000	0x1f8b8	0xc00	False	0.2893880208333333	data	3.295467193934915	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.gfids	0x59000	0xf0	0x200	False	0.333984375	data	2.1236699043525054	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x5a000	0x3aea	0x3c00	False	0.3943359375	data	5.313933656822349	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x5e000	0x1f8c	0x2000	False	0.79052734375	data	6.629855379679515	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_BITMAP	0x5a57c	0xbb6	Device independent bitmap graphic, 93 x 302 x 4, 2 compression, image size 2894, resolution 2835 x 2835 px/m	Chinese	China
RT_ICON	0x5b134	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Chinese	China
RT_ICON	0x5b25c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	Chinese	China
RT_ICON	0x5b7c4	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Chinese	China
RT_ICON	0x5baac	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	Chinese	China
RT_DIALOG	0x5c354	0x176	data	Chinese	China
RT_DIALOG	0x5c4cc	0xd6	data	Chinese	China
RT_DIALOG	0x5c5a4	0xba	data	Chinese	China
RT_DIALOG	0x5c660	0x102	data	Chinese	China
RT_DIALOG	0x5c764	0x286	data	Chinese	China
RT_DIALOG	0x5c9ec	0x1ce	data	Chinese	China
RT_STRING	0x5cbbc	0xb6	data	Chinese	China
RT_STRING	0x5cc74	0xd6	data	Chinese	China
RT_STRING	0x5cd4c	0xca	data	Chinese	China
RT_STRING	0x5ce18	0x74	data	Chinese	China
RT_STRING	0x5ce8c	0x282	data	Chinese	China
RT_STRING	0x5d110	0x94	data	Chinese	China
RT_STRING	0x5d1a4	0x78	data	Chinese	China
RT_STRING	0x5d21c	0x64	data	Chinese	China
RT_STRING	0x5d280	0x52	data	Chinese	China
RT_STRING	0x5d2d4	0x78	data	Chinese	China
RT_GROUP_ICON	0x5d34c	0x3e	data	Chinese	China
RT_MANIFEST	0x5d38c	0x75e	XML 1.0 document, ASCII text, with CRLF line terminators	Chinese	China

Imports

DLL

Import

KERNEL32.dll

GetLastError, SetLastError, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, CreateDirectoryW, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleFileNameW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, GetCurrentProcessId, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, GetTickCount, SetCurrentDirectoryW, GetExitCodeProcess, GetLocalTime, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetTimeFormatW, GetDateFormatW, GetNumberFormatW, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, TerminateProcess, RtlUnwind, EncodePointer, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, HeapReAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetCommandLineA, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, SetStdHandle, HeapSize, GetConsoleCP, GetConsoleMode, SetFilePointerEx, DecodePointer

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: pK6oGXjugD.exePID: 4104, Parent PID: 3528

General

Target ID:	0
Start time:	19:02:54
Start date:	23/11/2022
Path:	C:\Users\user\Desktop\pK6oGXjugD.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\pK6oGXjugD.exe
Imagebase:	0xa60000
File size:	20968188 bytes
MD5 hash:	0A68B271537063AF4FA3C46895389B6D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: pK6oGXjugD.exePID: 4104, Parent PID: 3528COMMON

Execution Graph

Execution Coverage:	10.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10%
Total number of Nodes:	1447
Total number of Limit Nodes:	36

Executed Functions

Function 00A7B52F Relevance: 38.7, APIs: 17, Strings: 5, Instructions: 180
filewindowcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A6E9FD: GetModuleHandleW.KERNEL32 ref: 00A6EA15
Part of subcall function 00A6E9FD: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00A6EA2D
Part of subcall function 00A6E9FD: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00A6EA50

OleInitialize.OLE32(00000000), ref: 00A7B542

Part of subcall function 00A6FCD8: GetCPInfo.KERNEL32(00000000,?), ref: 00A6FCE9
Part of subcall function 00A6FCD8: IsDBCSLeadByte.KERNEL32(00000000), ref: 00A6FCFD

GetCommandLineW.KERNEL32 ref: 00A7B565
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 00A7B58C
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007002), ref: 00A7B5A1
UnmapViewOfFile.KERNEL32(00000000), ref: 00A7B5CE

Part of subcall function 00A7B1D7: SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 00A7B1ED
Part of subcall function 00A7B1D7: SetEnvironmentVariableW.KERNELBASE(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00A7B229

CloseHandle.KERNEL32(00000000), ref: 00A7B5D5
GetModuleFileNameW.KERNEL32(00000000,00AB3E10,00000800), ref: 00A7B5EF
SetEnvironmentVariableW.KERNELBASE(sfxname,00AB3E10), ref: 00A7B601
GetLocalTime.KERNEL32(?), ref: 00A7B608
_swprintf.LIBCMT ref: 00A7B647
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00A7B659
GetModuleHandleW.KERNEL32(00000000), ref: 00A7B65C
LoadIconW.USER32(00000000,00000064), ref: 00A7B673
LoadBitmapW.USER32(00000065), ref: 00A7B686
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_00018FAC,00000000), ref: 00A7B6D6
Sleep.KERNEL32(?), ref: 00A7B70D

Part of subcall function 00A79CEB: CharUpperW.USER32(?,?,?,?,00001000), ref: 00A79D43
Part of subcall function 00A79CEB: CharUpperW.USER32(?,?,?,?,?,00001000), ref: 00A79D6A

CloseHandle.KERNEL32 ref: 00A7B799

Strings

sfxstime, xrefs: 00A7B654
sfxname, xrefs: 00A7B5FC
STARTDLG, xrefs: 00A7B6CB
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00A7B638
winrarsfxmappingfile.tmp, xrefs: 00A7B580

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCharCloseLoadProcUpperView$BitmapByteCommandDialogIconInfoInitializeLeadLineLocalMappingNameOpenParamSleepTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 906886263-3710569615
Opcode ID: d8fac878cf823e70d269dd6e0b0ed982f9681c75ad55de4ded2e02e1078fecd0
Instruction ID: ad12f19404c7688bd08714b427239f773999418c43b7f5387fc7eef0f797611e
Opcode Fuzzy Hash: d8fac878cf823e70d269dd6e0b0ed982f9681c75ad55de4ded2e02e1078fecd0
Instruction Fuzzy Hash: 7C51C271604211BFC710EBA5ED09F6B3BECFB49750F00851AF949A61A2DF789942CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00A69C91 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E00A69C91(void* __edx, intOrPtr _a4, intOrPtr _a8, char _a32, short _a592, void* _a4692, WCHAR* _a4696, intOrPtr _a4700) {
				struct _WIN32_FIND_DATAW _v0;
				char _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				char _v24;
				signed int _t43;
				signed int _t49;
				signed int _t63;
				void* _t65;
				long _t68;
				char _t69;
				void* _t82;
				intOrPtr _t84;
				void* _t87;
				signed int _t89;
				void* _t90;

				_t82 = __edx;
				E00A7C240();
				_push(_t89);
				_t87 = _a4692;
				_t84 = _a4700;
				_t90 = _t89 | 0xffffffff;
				_push( &_v0);
				if(_t87 != _t90) {
					_t43 = FindNextFileW(_t87, ??);
					__eflags = _t43;
					if(_t43 == 0) {
						_t87 = _t90;
						_t63 = GetLastError();
						__eflags = _t63 - 0x12;
						_t11 = _t63 != 0x12;
						__eflags = _t11;
						 *((char*)(_t84 + 0x1044)) = _t63 & 0xffffff00 | _t11;
					}
					__eflags = _t87 - _t90;
					if(_t87 != _t90) {
						goto L13;
					}
				} else {
					_t65 = FindFirstFileW(_a4696, ??); // executed
					_t87 = _t65;
					if(_t87 != _t90) {
						L13:
						E00A6E847(_t84, _a4696, 0x800);
						_push(0x800);
						E00A6B23F(__eflags, _t84,  &_a32);
						_t49 = 0 + _a8;
						__eflags = _t49;
						 *(_t84 + 0x1000) = _t49;
						asm("adc ecx, 0x0");
						 *((intOrPtr*)(_t84 + 0x1008)) = _v24;
						 *((intOrPtr*)(_t84 + 0x1028)) = _v20;
						 *((intOrPtr*)(_t84 + 0x102c)) = _v16;
						 *((intOrPtr*)(_t84 + 0x1030)) = _v12;
						 *((intOrPtr*)(_t84 + 0x1034)) = _v8;
						 *((intOrPtr*)(_t84 + 0x1038)) = _v4;
						 *(_t84 + 0x103c) = _v0.dwFileAttributes;
						 *((intOrPtr*)(_t84 + 0x1004)) = _a4;
						E00A6F4BA(_t84 + 0x1010,  &_v4);
						E00A6F4BA(_t84 + 0x1018,  &_v24);
						E00A6F4BA(_t84 + 0x1020,  &_v20);
					} else {
						if(E00A6AC19(_t82, _a4696,  &_a592, 0x800) == 0) {
							L4:
							_t68 = GetLastError();
							if(_t68 == 2 || _t68 == 3 || _t68 == 0x12) {
								_t69 = 0;
								__eflags = 0;
							} else {
								_t69 = 1;
							}
							 *((char*)(_t84 + 0x1044)) = _t69;
						} else {
							_t87 = FindFirstFileW( &_a592,  &_v0);
							if(_t87 != _t90) {
								goto L13;
							} else {
								goto L4;
							}
						}
					}
				}
				 *(_t84 + 0x1040) =  *(_t84 + 0x1040) & 0x00000000;
				return _t87;
			}

0x00a69c91
0x00a69c96
0x00a69c9c
0x00a69c9e
0x00a69caa
0x00a69cb1
0x00a69cb4
0x00a69cb7
0x00a69d2c
0x00a69d32
0x00a69d34
0x00a69d36
0x00a69d38
0x00a69d3e
0x00a69d41
0x00a69d41
0x00a69d44
0x00a69d44
0x00a69d4a
0x00a69d4c
0x00000000
0x00000000
0x00a69cb9
0x00a69cc6
0x00a69cc8
0x00a69ccc
0x00a69d52
0x00a69d60
0x00a69d65
0x00a69d6c
0x00a69d77
0x00a69d77
0x00a69d7b
0x00a69d85
0x00a69d88
0x00a69d92
0x00a69d9c
0x00a69da6
0x00a69db0
0x00a69dba
0x00a69dc4
0x00a69dce
0x00a69ddb
0x00a69deb
0x00a69dfb
0x00a69cd2
0x00a69ced
0x00a69d04
0x00a69d04
0x00a69d0d
0x00a69d1e
0x00a69d1e
0x00a69d19
0x00a69d1b
0x00a69d1b
0x00a69d20
0x00a69cef
0x00a69cfe
0x00a69d02
0x00000000
0x00000000
0x00000000
0x00000000
0x00a69d02
0x00a69ced
0x00a69ccc
0x00a69e00
0x00a69e13

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,00000000,00A69B8F,000000FF,?,?,?,?,00A671C2,?,?,00000000), ref: 00A69CC6
FindFirstFileW.KERNEL32(?,?,?,?,00000800,?,00000000,00A69B8F,000000FF,?,?,?,?,00A671C2,?,?), ref: 00A69CFC
GetLastError.KERNEL32(?,?,00000800,?,00000000,00A69B8F,000000FF,?,?,?,?,00A671C2,?,?,00000000,?), ref: 00A69D04
FindNextFileW.KERNEL32(?,?,?,?,?,00000000,00A69B8F,000000FF,?,?,?,?,00A671C2,?,?,00000000), ref: 00A69D2C
GetLastError.KERNEL32(?,00000000,00A69B8F,000000FF,?,?,?,?,00A671C2,?,?,00000000,?,0000003A,00000802), ref: 00A69D38

Strings

@Mqt0Lqt, xrefs: 00A69D04, 00A69D38

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID: @Mqt0Lqt
API String ID: 869497890-1302913217
Opcode ID: 4fbc469e4a404d74e9a11d8aeacb05c6a1590450c6debae3d51ea3273ef3eea6
Instruction ID: c51743fee6cc9f20e8bb0faec5bc174bb801efbbb302d59735e2426cc354d1fe
Opcode Fuzzy Hash: 4fbc469e4a404d74e9a11d8aeacb05c6a1590450c6debae3d51ea3273ef3eea6
Instruction Fuzzy Hash: E6417E76608245AFC324EF64C880AEBF7F8FF48350F104A2AF5A9D3241D734A954CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A6263E Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 761
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E00A6263E(intOrPtr* __ecx, void* __eflags) {
				void* __ebp;
				unsigned int _t329;
				signed int _t336;
				void* _t339;
				signed int _t341;
				char _t356;
				signed short _t363;
				signed int _t368;
				signed int _t376;
				signed char _t378;
				signed int _t383;
				char _t397;
				signed int _t398;
				signed int _t400;
				signed int _t401;
				signed int _t403;
				intOrPtr _t418;
				char _t419;
				signed int _t422;
				signed int _t423;
				signed int _t428;
				char _t431;
				signed int _t435;
				signed short _t440;
				signed short _t445;
				unsigned int _t450;
				void* _t455;
				signed int _t457;
				signed int _t460;
				void* _t467;
				signed int _t472;
				signed int _t476;
				void* _t477;
				void* _t484;
				void* _t485;
				signed char _t491;
				signed int _t503;
				intOrPtr* _t515;
				signed int _t518;
				signed int _t519;
				intOrPtr* _t520;
				signed int _t528;
				intOrPtr _t534;
				signed int _t536;
				unsigned int _t545;
				signed int _t547;
				signed int _t558;
				signed int _t562;
				void* _t584;
				signed int _t608;
				void* _t614;
				signed int _t620;
				signed char _t624;
				signed char _t633;
				signed char _t634;
				signed int _t638;
				signed int _t640;
				signed int _t641;
				unsigned int _t643;
				signed int _t647;
				void* _t649;
				void* _t652;
				signed int _t655;
				signed int _t656;
				signed int _t657;
				signed int _t660;
				signed int _t668;
				signed int _t670;
				void* _t674;
				signed int _t675;
				signed int _t676;
				signed int _t679;
				signed int _t680;
				intOrPtr _t682;
				signed int* _t683;
				void* _t684;
				void* _t685;
				intOrPtr* _t688;
				intOrPtr _t692;

				_t520 = __ecx;
				_t685 = _t684 - 0x74;
				E00A7C16C(E00A8EBB5, _t683);
				E00A7C240();
				_t515 = _t520;
				 *((intOrPtr*)(_t683 + 0x44)) = _t515;
				E00A6BD64(_t683 + 0x48, _t515);
				 *((intOrPtr*)(_t683 + 0x40)) = 0;
				 *((intOrPtr*)(_t683 - 4)) = 0;
				_t647 = 7;
				if( *(_t515 + 0x6cf4) == 0) {
					L6:
					 *((char*)(_t683 + 0x76)) = 0;
					L7:
					E00A6BF68(_t633, _t647);
					if( *((intOrPtr*)(_t683 + 0x5c)) != 0) {
						 *(_t515 + 0x21e4) = E00A6BDA7(_t683 + 0x48) & 0x0000ffff;
						 *(_t515 + 0x21f4) = 0;
						_t668 = E00A6BD8F(_t683 + 0x48) & 0x000000ff;
						_t329 = E00A6BDA7(_t683 + 0x48) & 0x0000ffff;
						 *(_t515 + 0x21ec) = _t329;
						 *(_t515 + 0x21f4) = _t329 >> 0x0000000e & 0x00000001;
						_t528 = E00A6BDA7(_t683 + 0x48) & 0x0000ffff;
						 *(_t515 + 0x21f0) = _t528;
						 *(_t515 + 0x21e8) = _t668;
						__eflags = _t528 - _t647;
						if(_t528 < _t647) {
							L131:
							E00A61F70(_t515);
							goto L133;
						} else {
							_t670 = _t668 - 0x73;
							__eflags = _t670;
							if(_t670 == 0) {
								 *(_t515 + 0x21e8) = 1;
							} else {
								_t679 = _t670 - 1;
								__eflags = _t679;
								if(_t679 == 0) {
									 *(_t515 + 0x21e8) = 2;
								} else {
									_t680 = _t679 - 6;
									__eflags = _t680;
									if(_t680 == 0) {
										 *(_t515 + 0x21e8) = 3;
									} else {
										__eflags = _t680 == 1;
										if(_t680 == 1) {
											 *(_t515 + 0x21e8) = 5;
										}
									}
								}
							}
							_t336 =  *(_t515 + 0x21e8);
							 *(_t515 + 0x21dc) = _t336;
							__eflags = _t336 - 0x75;
							if(_t336 != 0x75) {
								__eflags = _t336 - 1;
								if(_t336 != 1) {
									L22:
									_push(_t528 - 7);
									L23:
									E00A6BF68(_t633);
									_t339 = E00A61974(_t515,  *(_t515 + 0x21f0));
									_t534 = 0;
									asm("adc ecx, [ebx+0x6cdc]");
									 *((intOrPtr*)(_t515 + 0x6ce0)) = _t339 +  *((intOrPtr*)(_t515 + 0x6cd8));
									_t341 =  *(_t515 + 0x21e8);
									 *((intOrPtr*)(_t515 + 0x6ce4)) = _t534;
									__eflags = _t341 - 1;
									if(__eflags == 0) {
										_t649 = _t515 + 0x2208;
										E00A6A2D1(_t649);
										_t536 = 5;
										memcpy(_t649, _t515 + 0x21e4, _t536 << 2);
										 *(_t515 + 0x221c) = E00A6BDA7(_t683 + 0x48);
										_t633 = E00A6BDDC(_t683 + 0x48);
										 *(_t515 + 0x2220) = _t633;
										 *(_t515 + 0x6ced) =  *(_t515 + 0x2210) & 0x00000001;
										 *(_t515 + 0x6cec) =  *(_t515 + 0x2210) >> 0x00000003 & 0x00000001;
										_t545 =  *(_t515 + 0x2210);
										 *(_t515 + 0x6cef) = _t545 >> 0x00000002 & 0x00000001;
										 *(_t515 + 0x6cf3) = _t545 >> 0x00000006 & 0x00000001;
										 *(_t515 + 0x6cf4) = _t545 >> 0x00000007 & 0x00000001;
										__eflags = _t633;
										if(_t633 != 0) {
											L115:
											_t356 = 1;
											__eflags = 1;
											L116:
											 *((char*)(_t515 + 0x6cf0)) = _t356;
											 *(_t515 + 0x2224) = _t545 >> 0x00000001 & 0x00000001;
											_t547 = _t545 >> 0x00000004 & 0x00000001;
											__eflags = _t547;
											 *(_t515 + 0x6cf1) = _t545 >> 0x00000008 & 0x00000001;
											 *(_t515 + 0x6cf2) = _t547;
											L117:
											_t647 = 7;
											L118:
											_t363 = E00A6BE8D(_t683 + 0x48, 0);
											__eflags =  *(_t515 + 0x21e4) - (_t363 & 0x0000ffff);
											if( *(_t515 + 0x21e4) == (_t363 & 0x0000ffff)) {
												L128:
												__eflags =  *((intOrPtr*)(_t515 + 0x6ce4)) -  *((intOrPtr*)(_t515 + 0x6cdc));
												if(__eflags > 0) {
													L132:
													 *((intOrPtr*)(_t683 + 0x40)) =  *((intOrPtr*)(_t683 + 0x5c));
													L133:
													E00A6A6F4(_t683 + 0x48);
													 *[fs:0x0] =  *((intOrPtr*)(_t683 - 0xc));
													return  *((intOrPtr*)(_t683 + 0x40));
												}
												if(__eflags < 0) {
													goto L131;
												}
												__eflags =  *((intOrPtr*)(_t515 + 0x6ce0)) -  *((intOrPtr*)(_t515 + 0x6cd8));
												if( *((intOrPtr*)(_t515 + 0x6ce0)) >  *((intOrPtr*)(_t515 + 0x6cd8))) {
													goto L132;
												}
												goto L131;
											}
											_t368 =  *(_t515 + 0x21e8);
											__eflags = _t368 - 0x79;
											if(_t368 == 0x79) {
												goto L128;
											}
											__eflags = _t368 - 0x76;
											if(_t368 == 0x76) {
												goto L128;
											}
											__eflags = _t368 - 5;
											if(_t368 != 5) {
												L126:
												 *((char*)(_t515 + 0x6cfc)) = 1;
												E00A66ACC(0xa9bbf8, 3);
												__eflags =  *((char*)(_t683 + 0x76));
												if( *((char*)(_t683 + 0x76)) == 0) {
													goto L128;
												}
												E00A61F25(4, _t515 + 0x1e, _t515 + 0x1e);
												 *((char*)(_t515 + 0x6cfd)) = 1;
												goto L133;
											}
											__eflags =  *(_t515 + 0x459e);
											if( *(_t515 + 0x459e) == 0) {
												goto L126;
											}
											 *((intOrPtr*)(_t683 + 0x28)) = _t515;
											 *((intOrPtr*)(_t683 + 0x30)) =  *((intOrPtr*)( *_t515 + 0x10))();
											 *(_t683 + 0x34) = _t633;
											 *((char*)(_t683 - 4)) = 1;
											_t376 =  *((intOrPtr*)( *_t515 + 0x10))() - _t647;
											__eflags = _t376;
											asm("sbb edx, ecx");
											 *((intOrPtr*)( *_t515 + 0xc))(_t376, _t633, 0);
											 *(_t683 + 0x77) = 1;
											do {
												_t378 = E00A6911F(_t515);
												asm("sbb al, al");
												 *(_t683 + 0x77) =  *(_t683 + 0x77) &  !( ~_t378);
												_t647 = _t647 - 1;
												__eflags = _t647;
											} while (_t647 != 0);
											 *((char*)(_t683 - 4)) = 0;
											E00A617E5(_t683 + 0x28);
											__eflags =  *(_t683 + 0x77);
											if( *(_t683 + 0x77) != 0) {
												goto L128;
											}
											goto L126;
										}
										_t356 = 0;
										__eflags =  *(_t515 + 0x221c);
										if( *(_t515 + 0x221c) == 0) {
											goto L116;
										}
										goto L115;
									}
									if(__eflags <= 0) {
										L111:
										__eflags =  *(_t515 + 0x21ec) & 0x00008000;
										if(( *(_t515 + 0x21ec) & 0x00008000) != 0) {
											 *((intOrPtr*)(_t515 + 0x6ce0)) =  *((intOrPtr*)(_t515 + 0x6ce0)) + E00A6BDDC(_t683 + 0x48);
											asm("adc dword [ebx+0x6ce4], 0x0");
										}
										goto L118;
									}
									__eflags = _t341 - 3;
									if(_t341 <= 3) {
										__eflags = _t341 - 2;
										_t652 = _t515 + 0x2280;
										_t383 = _t341 & 0xffffff00 | _t341 == 0x00000002;
										 *(_t683 + 0x77) = _t383;
										__eflags = _t383;
										if(_t383 == 0) {
											_t652 = _t515 + 0x45c0;
										}
										 *(_t683 + 0x68) = _t652;
										E00A6A238(_t652, 0);
										_t558 = 5;
										memcpy(_t652, _t515 + 0x21e4, _t558 << 2);
										_t688 = _t685 + 0xc;
										_t674 =  *(_t683 + 0x68);
										_t634 =  *(_t674 + 8);
										 *(_t674 + 0x1088) =  *(_t674 + 8) & 1;
										 *(_t674 + 0x1089) = _t634 >> 0x00000001 & 1;
										 *(_t674 + 0x108b) = _t634 >> 0x00000002 & 1;
										__eflags =  *(_t683 + 0x77);
										 *(_t674 + 0x1090) = _t634 >> 0x0000000a & 1;
										if( *(_t683 + 0x77) == 0) {
											L36:
											_t562 = 0;
											__eflags = 0;
											_t397 = 0;
											goto L37;
										} else {
											__eflags = _t634 & 0x00000010;
											if((_t634 & 0x00000010) == 0) {
												goto L36;
											}
											_t397 = 1;
											_t562 = 0;
											L37:
											__eflags =  *(_t683 + 0x77);
											 *((char*)(_t674 + 0x10e0)) = _t397;
											if( *(_t683 + 0x77) != 0) {
												L40:
												_t398 = _t562;
												L41:
												 *(_t674 + 0x10ea) = _t398;
												_t400 = _t634 & 0x000000e0;
												__eflags = _t400 - 0xe0;
												_t401 = _t400 & 0xffffff00 | _t400 == 0x000000e0;
												 *(_t674 + 0x10e1) = _t401;
												__eflags = _t401;
												if(_t401 == 0) {
													_t403 = 0x10000 << (_t634 >> 0x00000005 & 0x00000007);
													__eflags = 0x10000;
												} else {
													_t403 = _t562;
												}
												 *(_t674 + 0x10e4) = _t403;
												 *(_t674 + 0x10e3) = _t634 >> 0x0000000b & 0x00000001;
												 *(_t674 + 0x10e2) = _t634 >> 0x00000003 & 0x00000001;
												 *((intOrPtr*)(_t674 + 0x14)) = E00A6BDDC(_t683 + 0x48);
												 *(_t683 + 0x6c) = E00A6BDDC(_t683 + 0x48);
												 *((char*)(_t674 + 0x18)) = E00A6BD8F(_t683 + 0x48);
												 *(_t674 + 0x1060) = 2;
												 *((intOrPtr*)(_t674 + 0x1064)) = E00A6BDDC(_t683 + 0x48);
												 *(_t683 + 0x3c) = E00A6BDDC(_t683 + 0x48);
												 *(_t674 + 0x19) = E00A6BD8F(_t683 + 0x48);
												 *((char*)(_t674 + 0x1a)) = E00A6BD8F(_t683 + 0x48) - 0x30;
												 *(_t683 + 0x70) = E00A6BDA7(_t683 + 0x48) & 0x0000ffff;
												_t655 = E00A6BDDC(_t683 + 0x48);
												 *(_t674 + 0x1c) = _t655;
												 *(_t674 + 0x108c) = 0;
												__eflags =  *(_t674 + 0x108b);
												if( *(_t674 + 0x108b) == 0) {
													L53:
													_t418 =  *((intOrPtr*)(_t674 + 0x18));
													 *(_t674 + 0x10ec) = 2;
													__eflags = _t418 - 3;
													if(_t418 == 3) {
														L57:
														 *(_t674 + 0x10ec) = 1;
														L58:
														 *(_t674 + 0x10f0) = 0;
														__eflags = _t418 - 3;
														if(_t418 == 3) {
															__eflags = (_t655 & 0x0000f000) - 0xa000;
															if((_t655 & 0x0000f000) == 0xa000) {
																__eflags = 0;
																 *(_t674 + 0x10f0) = 1;
																 *((short*)(_t674 + 0x10f4)) = 0;
															}
														}
														__eflags =  *(_t683 + 0x77);
														if( *(_t683 + 0x77) != 0) {
															L64:
															_t419 = 0;
															goto L65;
														} else {
															__eflags =  *(_t674 + 0x1c) & 0x80000000;
															if(( *(_t674 + 0x1c) & 0x80000000) == 0) {
																goto L64;
															}
															_t419 = 1;
															L65:
															 *((char*)(_t674 + 0x10e8)) = _t419;
															_t422 =  *(_t674 + 8) >> 0x00000008 & 0x00000001;
															__eflags = _t422;
															 *(_t674 + 0x10e9) = _t422;
															if(_t422 == 0) {
																__eflags =  *(_t683 + 0x6c) - 0xffffffff;
																_t633 = 0;
																_t656 = 0;
																_t134 =  *(_t683 + 0x6c) == 0xffffffff;
																__eflags = _t134;
																_t423 = _t422 & 0xffffff00 | _t134;
																L71:
																 *(_t674 + 0x108a) = _t423;
																 *((intOrPtr*)(_t674 + 0x1048)) = 0 +  *((intOrPtr*)(_t674 + 0x14));
																asm("adc edi, ecx");
																 *((intOrPtr*)(_t674 + 0x104c)) = _t656;
																asm("adc edx, ecx");
																 *(_t674 + 0x1050) = 0 +  *(_t683 + 0x6c);
																__eflags =  *(_t674 + 0x108a);
																 *(_t674 + 0x1054) = _t633;
																if( *(_t674 + 0x108a) != 0) {
																	 *(_t674 + 0x1050) = 0x7fffffff;
																	 *(_t674 + 0x1054) = 0x7fffffff;
																}
																_t428 =  *(_t683 + 0x70);
																_t657 = 0x1fff;
																__eflags = _t428 - 0x1fff;
																if(_t428 < 0x1fff) {
																	_t657 = _t428;
																}
																E00A6BE3E(_t683 + 0x48, _t683 - 0x200c, _t657);
																_t431 = 0;
																 *((char*)(_t683 + _t657 - 0x200c)) = 0;
																__eflags =  *(_t683 + 0x77);
																if( *(_t683 + 0x77) == 0) {
																	 *(_t683 + 0x6c) = _t674 + 0x20;
																	_t434 = E00A6FC9F(_t683 - 0x200c, _t674 + 0x20, 0x800);
																	_t660 =  *((intOrPtr*)(_t674 + 0xc)) -  *(_t683 + 0x70) - 0x20;
																	__eflags =  *(_t674 + 8) & 0x00000400;
																	if(( *(_t674 + 8) & 0x00000400) != 0) {
																		_t660 = _t660 - 8;
																		__eflags = _t660;
																	}
																	__eflags = _t660;
																	if(_t660 <= 0) {
																		_t661 = _t674 + 0x20;
																	} else {
																		 *(_t683 + 0x70) = _t674 + 0x1020;
																		E00A61F56(_t674 + 0x1020, _t660);
																		_t467 = E00A6BE3E(_t683 + 0x48,  *(_t674 + 0x1020), _t660);
																		_t661 = _t674 + 0x20;
																		_t434 = E00A816E0(_t467, _t674 + 0x20, L"RR");
																		__eflags = _t434;
																		if(_t434 == 0) {
																			_t633 =  *( *(_t683 + 0x70));
																			 *(_t515 + 0x21c4) =  *(_t515 + 0x21c4) & 0x00000000;
																			_t472 = (((( *(_t633 + 0xb) & 0x000000ff) << 8) + ( *(_t633 + 0xa) & 0x000000ff) << 8) + ( *(_t633 + 9) & 0x000000ff) << 8) + ( *(_t633 + 8) & 0x000000ff);
																			 *(_t515 + 0x21c0) = _t472 << 9;
																			 *(_t515 + 0x21c4) = ( *(_t515 + 0x21c4) << 0x00000020 | _t472) << 9;
																			_t476 = E00A6E57D( *(_t515 + 0x21c0),  *(_t515 + 0x21c4),  *((intOrPtr*)( *_t515 + 0x10))(), _t633);
																			 *(_t515 + 0x21c8) = _t476;
																			 *(_t683 + 0x70) = _t476;
																			_t477 = E00A7C190(_t475, _t633, 0xc8, 0);
																			asm("adc edx, [ebx+0x21c4]");
																			_t434 = E00A6E57D(_t477 +  *(_t515 + 0x21c0), _t633, _t475, _t633);
																			_t608 =  *(_t683 + 0x70);
																			_t674 =  *(_t683 + 0x68);
																			_t661 =  *(_t683 + 0x6c);
																			__eflags = _t434 - _t608;
																			if(_t434 > _t608) {
																				_t434 = _t608 + 1;
																				 *(_t515 + 0x21c8) = _t608 + 1;
																			}
																		}
																	}
																	_t435 = E00A816E0(_t434, _t661, L"CMT");
																	__eflags = _t435;
																	if(_t435 == 0) {
																		 *((char*)(_t515 + 0x6cee)) = 1;
																	}
																} else {
																	__eflags =  *(_t674 + 8) & 0x00000200;
																	if(( *(_t674 + 8) & 0x00000200) == 0) {
																		_t661 = _t674 + 0x20;
																		__eflags = 0;
																		 *_t661 = 0;
																	} else {
																		E00A667C4(_t683 + 0x24);
																		_t484 = E00A81720(_t683 - 0x200c);
																		_t661 = _t674 + 0x20;
																		_t485 = _t484 + 1;
																		 *_t688 = 0x800;
																		_push(_t661);
																		_push( *(_t683 + 0x70) - _t485);
																		_t614 = _t683 - 0x200c;
																		_push(_t485 + _t614);
																		_push(_t614);
																		E00A667D5();
																		_t431 = 0;
																	}
																	__eflags =  *_t661 - _t431;
																	if( *_t661 == _t431) {
																		E00A6E5D3(_t683 - 0x200c, _t661, 0x800, 1);
																	}
																	E00A61FB5(_t515, _t633, _t674);
																}
																__eflags =  *(_t674 + 8) & 0x00000400;
																if(( *(_t674 + 8) & 0x00000400) != 0) {
																	E00A6BE3E(_t683 + 0x48, _t674 + 0x1091, 8);
																}
																E00A6F6CB( *(_t683 + 0x3c)); // executed
																__eflags =  *(_t674 + 8) & 0x00001000;
																if(( *(_t674 + 8) & 0x00001000) == 0) {
																	L108:
																	 *((intOrPtr*)(_t515 + 0x6ce0)) =  *((intOrPtr*)(_t515 + 0x6ce0)) +  *((intOrPtr*)(_t674 + 0x1048));
																	asm("adc [ebx+0x6ce4], eax");
																	 *((char*)(_t683 + 0x44)) =  *(_t674 + 0x10e2);
																	_t440 = E00A6BE8D(_t683 + 0x48,  *((intOrPtr*)(_t683 + 0x44)));
																	__eflags =  *_t674 - (_t440 & 0x0000ffff);
																	if( *_t674 != (_t440 & 0x0000ffff)) {
																		 *((char*)(_t515 + 0x6cfc)) = 1;
																		E00A66ACC(0xa9bbf8, 1);
																		__eflags =  *((char*)(_t683 + 0x76));
																		if( *((char*)(_t683 + 0x76)) == 0) {
																			E00A61F25(0x1a, _t515 + 0x1e, _t661);
																		}
																	}
																	goto L117;
																} else {
																	_t445 = E00A6BDA7(_t683 + 0x48);
																	 *((intOrPtr*)(_t683 + 0x28)) = _t515 + 0x32b0;
																	 *((intOrPtr*)(_t683 + 0x2c)) = _t515 + 0x32b8;
																	 *((intOrPtr*)(_t683 + 0x30)) = _t515 + 0x32c0;
																	__eflags = 0;
																	_t675 = 0;
																	 *(_t683 + 0x34) = 0;
																	_t450 = _t445 & 0x0000ffff;
																	 *(_t683 + 0x70) = 0;
																	 *(_t683 + 0x6c) = _t450;
																	do {
																		_t584 = 3;
																		_t518 = _t450 >> _t584 - _t675 << 2;
																		__eflags = _t518 & 0x00000008;
																		if((_t518 & 0x00000008) == 0) {
																			goto L106;
																		}
																		__eflags =  *(_t683 + 0x28 + _t675 * 4);
																		if( *(_t683 + 0x28 + _t675 * 4) == 0) {
																			goto L106;
																		}
																		__eflags = _t675;
																		if(_t675 != 0) {
																			E00A6F6CB(E00A6BDDC(_t683 + 0x48));
																		}
																		E00A6F4FA( *(_t683 + 0x28 + _t675 * 4), _t683);
																		__eflags = _t518 & 0x00000004;
																		if((_t518 & 0x00000004) != 0) {
																			_t236 = _t683 + 0x14;
																			 *_t236 =  *(_t683 + 0x14) + 1;
																			__eflags =  *_t236;
																		}
																		 *(_t683 + 0x18) =  *(_t683 + 0x18) & 0x00000000;
																		_t519 = _t518 & 0x00000003;
																		__eflags = _t519;
																		if(_t519 <= 0) {
																			L105:
																			E00A6F729( *(_t683 + 0x28 + _t675 * 4), _t633, _t683);
																			_t450 =  *(_t683 + 0x6c);
																		} else {
																			_t455 = 3;
																			_t457 = _t455 - _t519 << 3;
																			__eflags = _t457;
																			 *(_t683 + 0x3c) = _t457;
																			_t676 = _t457;
																			do {
																				_t460 = (E00A6BD8F(_t683 + 0x48) & 0x000000ff) << _t676;
																				_t676 = _t676 + 8;
																				 *(_t683 + 0x18) =  *(_t683 + 0x18) | _t460;
																				_t519 = _t519 - 1;
																				__eflags = _t519;
																			} while (_t519 != 0);
																			_t675 =  *(_t683 + 0x70);
																			goto L105;
																		}
																		L106:
																		_t675 = _t675 + 1;
																		 *(_t683 + 0x70) = _t675;
																		__eflags = _t675 - 4;
																	} while (_t675 < 4);
																	_t515 =  *((intOrPtr*)(_t683 + 0x44));
																	_t674 =  *(_t683 + 0x68);
																	goto L108;
																}
															}
															_t656 = E00A6BDDC(_t683 + 0x48);
															_t491 = E00A6BDDC(_t683 + 0x48);
															__eflags =  *(_t683 + 0x6c) - 0xffffffff;
															_t633 = _t491;
															if( *(_t683 + 0x6c) != 0xffffffff) {
																L69:
																_t423 = 0;
																goto L71;
															}
															__eflags = _t633 - 0xffffffff;
															if(_t633 != 0xffffffff) {
																goto L69;
															}
															_t423 = 1;
															goto L71;
														}
													}
													__eflags = _t418 - 5;
													if(_t418 == 5) {
														goto L57;
													}
													__eflags = _t418 - 6;
													if(_t418 < 6) {
														 *(_t674 + 0x10ec) = 0;
													}
													goto L58;
												} else {
													_t638 = ( *(_t674 + 0x19) & 0x000000ff) - 0xd;
													__eflags = _t638;
													if(_t638 == 0) {
														 *(_t674 + 0x108c) = 1;
														goto L53;
													}
													_t640 = _t638;
													__eflags = _t640;
													if(_t640 == 0) {
														 *(_t674 + 0x108c) = 2;
														goto L53;
													}
													_t641 = _t640 - 5;
													__eflags = _t641;
													if(_t641 == 0) {
														L50:
														 *(_t674 + 0x108c) = 3;
														goto L53;
													}
													__eflags = _t641 == 6;
													if(_t641 == 6) {
														goto L50;
													}
													 *(_t674 + 0x108c) = 4;
													goto L53;
												}
											}
											__eflags = _t634 & 0x00000010;
											if((_t634 & 0x00000010) == 0) {
												goto L40;
											}
											_t398 = 1;
											goto L41;
										}
									}
									__eflags = _t341 - 5;
									if(_t341 != 5) {
										goto L111;
									} else {
										_t620 = _t341;
										memcpy(_t515 + 0x4580, _t515 + 0x21e4, _t620 << 2);
										_t643 =  *(_t515 + 0x4588);
										 *(_t515 + 0x459c) =  *(_t515 + 0x4588) & 0x00000001;
										_t624 = _t643 >> 0x00000001 & 0x00000001;
										_t633 = _t643 >> 0x00000003 & 0x00000001;
										 *(_t515 + 0x459d) = _t624;
										 *(_t515 + 0x459e) = _t643 >> 0x00000002 & 0x00000001;
										 *(_t515 + 0x459f) = _t633;
										__eflags = _t624;
										if(_t624 != 0) {
											 *((intOrPtr*)(_t515 + 0x4594)) = E00A6BDDC(_t683 + 0x48);
										}
										__eflags =  *(_t515 + 0x459f);
										if( *(_t515 + 0x459f) != 0) {
											_t503 = E00A6BDA7(_t683 + 0x48) & 0x0000ffff;
											 *(_t515 + 0x4598) = _t503;
											 *(_t515 + 0x6d10) = _t503;
										}
										goto L117;
									}
								}
								__eflags =  *(_t515 + 0x21ec) & 0x00000002;
								if(( *(_t515 + 0x21ec) & 0x00000002) != 0) {
									goto L19;
								}
								goto L22;
							}
							L19:
							_push(6);
							goto L23;
						}
					}
					L8:
					E00A63C2E(_t515, _t633);
					goto L133;
				}
				_t633 =  *((intOrPtr*)(_t515 + 0x6cf8)) + _t647;
				asm("adc eax, ecx");
				_t692 =  *((intOrPtr*)(_t515 + 0x6cdc));
				if(_t692 < 0 || _t692 <= 0 &&  *((intOrPtr*)(_t515 + 0x6cd8)) <= _t633) {
					goto L6;
				} else {
					 *((char*)(_t683 + 0x76)) = 1;
					E00A63B17(_t515);
					_push(8);
					_push(_t683 + 0x38);
					if( *((intOrPtr*)( *_t515 + 8))() != 8) {
						goto L8;
					} else {
						_t682 = _t515 + 0x1024;
						E00A65F32(_t682, 0, 4,  *((intOrPtr*)(_t515 + 0x21bc)) + 0x4024, _t683 + 0x38, 0, 0, 0, 0);
						 *((intOrPtr*)(_t683 + 0x64)) = _t682;
						goto L7;
					}
				}
			}

0x00a6263e
0x00a6263f
0x00a62647
0x00a62651
0x00a62658
0x00a6265f
0x00a62662
0x00a6266b
0x00a6266e
0x00a62671
0x00a62678
0x00a626e0
0x00a626e0
0x00a626e3
0x00a626e7
0x00a626f0
0x00a6270c
0x00a62712
0x00a62721
0x00a62729
0x00a6272f
0x00a6273a
0x00a62745
0x00a62748
0x00a6274e
0x00a62754
0x00a62756
0x00a6305b
0x00a6305d
0x00000000
0x00a6275c
0x00a6275c
0x00a6275c
0x00a6275f
0x00a62794
0x00a62761
0x00a62761
0x00a62761
0x00a62764
0x00a62788
0x00a62766
0x00a62766
0x00a62766
0x00a62769
0x00a6277c
0x00a6276b
0x00a6276b
0x00a6276e
0x00a62770
0x00a62770
0x00a6276e
0x00a62769
0x00a62764
0x00a6279e
0x00a627a4
0x00a627aa
0x00a627ad
0x00a627b3
0x00a627b6
0x00a627c1
0x00a627c4
0x00a627c5
0x00a627c8
0x00a627d5
0x00a627e2
0x00a627e3
0x00a627e9
0x00a627ef
0x00a627f5
0x00a627fb
0x00a627fe
0x00a62eb5
0x00a62ebd
0x00a62ec4
0x00a62ecb
0x00a62ed8
0x00a62eea
0x00a62eef
0x00a62ef5
0x00a62f07
0x00a62f0d
0x00a62f1a
0x00a62f27
0x00a62f34
0x00a62f3a
0x00a62f3c
0x00a62f49
0x00a62f4b
0x00a62f4b
0x00a62f4c
0x00a62f4c
0x00a62f58
0x00a62f68
0x00a62f68
0x00a62f6b
0x00a62f71
0x00a62f77
0x00a62f79
0x00a62f7a
0x00a62f7f
0x00a62f87
0x00a62f8d
0x00a6303d
0x00a63043
0x00a63049
0x00a63064
0x00a63067
0x00a6306a
0x00a6306d
0x00a6307b
0x00a63086
0x00a63086
0x00a6304b
0x00000000
0x00000000
0x00a63053
0x00a63059
0x00000000
0x00000000
0x00000000
0x00a63059
0x00a62f93
0x00a62f99
0x00a62f9c
0x00000000
0x00000000
0x00a62fa2
0x00a62fa5
0x00000000
0x00000000
0x00a62fab
0x00a62fae
0x00a6300f
0x00a63016
0x00a6301d
0x00a63022
0x00a63026
0x00000000
0x00000000
0x00a6302f
0x00a63034
0x00000000
0x00a63034
0x00a62fb0
0x00a62fb7
0x00000000
0x00000000
0x00a62fbd
0x00a62fc3
0x00a62fc6
0x00a62fcd
0x00a62fd8
0x00a62fd8
0x00a62fdb
0x00a62fe1
0x00a62fe4
0x00a62fe8
0x00a62fea
0x00a62ff1
0x00a62ff5
0x00a62ff8
0x00a62ff8
0x00a62ff8
0x00a63000
0x00a63004
0x00a63009
0x00a6300d
0x00000000
0x00000000
0x00000000
0x00a6300d
0x00a62f3e
0x00a62f40
0x00a62f47
0x00000000
0x00000000
0x00000000
0x00a62f47
0x00a62804
0x00a62e8b
0x00a62e8b
0x00a62e95
0x00a62ea3
0x00a62ea9
0x00a62ea9
0x00000000
0x00a62e95
0x00a6280a
0x00a6280d
0x00a628a1
0x00a628a4
0x00a628aa
0x00a628ad
0x00a628b0
0x00a628b2
0x00a628b4
0x00a628b4
0x00a628be
0x00a628c1
0x00a628c8
0x00a628cf
0x00a628cf
0x00a628d1
0x00a628da
0x00a628df
0x00a628eb
0x00a628f8
0x00a62905
0x00a62909
0x00a6290f
0x00a6291c
0x00a6291c
0x00a6291c
0x00a6291e
0x00000000
0x00a62911
0x00a62911
0x00a62914
0x00000000
0x00000000
0x00a62916
0x00a62918
0x00a62920
0x00a62920
0x00a62924
0x00a6292a
0x00a62936
0x00a62936
0x00a62938
0x00a62938
0x00a62940
0x00a62945
0x00a62947
0x00a6294a
0x00a62950
0x00a62952
0x00a62965
0x00a62965
0x00a62954
0x00a62954
0x00a62954
0x00a62967
0x00a6297d
0x00a62983
0x00a62991
0x00a6299c
0x00a629a7
0x00a629aa
0x00a629bc
0x00a629ca
0x00a629d5
0x00a629e2
0x00a629f0
0x00a629fa
0x00a629fc
0x00a629ff
0x00a62a05
0x00a62a0b
0x00a62a54
0x00a62a54
0x00a62a57
0x00a62a61
0x00a62a63
0x00a62a75
0x00a62a75
0x00a62a7f
0x00a62a7f
0x00a62a85
0x00a62a87
0x00a62a8f
0x00a62a95
0x00a62a97
0x00a62a99
0x00a62aa3
0x00a62aa3
0x00a62a95
0x00a62aaa
0x00a62aad
0x00a62abd
0x00a62abd
0x00000000
0x00a62aaf
0x00a62aaf
0x00a62ab6
0x00000000
0x00000000
0x00a62aba
0x00a62abf
0x00a62abf
0x00a62acb
0x00a62acb
0x00a62acd
0x00a62ad3
0x00a62b01
0x00a62b05
0x00a62b07
0x00a62b09
0x00a62b09
0x00a62b09
0x00a62b0c
0x00a62b0c
0x00a62b17
0x00a62b1d
0x00a62b24
0x00a62b2a
0x00a62b2c
0x00a62b32
0x00a62b39
0x00a62b3f
0x00a62b46
0x00a62b4c
0x00a62b4c
0x00a62b52
0x00a62b55
0x00a62b5a
0x00a62b5c
0x00a62b5e
0x00a62b5e
0x00a62b6b
0x00a62b70
0x00a62b72
0x00a62b79
0x00a62b7c
0x00a62bfc
0x00a62c06
0x00a62c11
0x00a62c14
0x00a62c1b
0x00a62c1d
0x00a62c1d
0x00a62c1d
0x00a62c20
0x00a62c22
0x00a62d08
0x00a62c28
0x00a62c31
0x00a62c34
0x00a62c43
0x00a62c4d
0x00a62c51
0x00a62c58
0x00a62c5a
0x00a62c63
0x00a62c7f
0x00a62c8b
0x00a62c9a
0x00a62ca2
0x00a62cbf
0x00a62ccf
0x00a62cd5
0x00a62cd8
0x00a62ce3
0x00a62ceb
0x00a62cf0
0x00a62cf3
0x00a62cf6
0x00a62cf9
0x00a62cfb
0x00a62cfd
0x00a62d00
0x00a62d00
0x00a62cfb
0x00a62c5a
0x00a62d11
0x00a62d18
0x00a62d1a
0x00a62d1c
0x00a62d1c
0x00a62b7e
0x00a62b7e
0x00a62b85
0x00a62bc5
0x00a62bc8
0x00a62bca
0x00a62b87
0x00a62b8a
0x00a62b96
0x00a62b9e
0x00a62ba1
0x00a62ba2
0x00a62bab
0x00a62bac
0x00a62bad
0x00a62bb5
0x00a62bbb
0x00a62bbc
0x00a62bc1
0x00a62bc1
0x00a62bcd
0x00a62bd0
0x00a62be1
0x00a62be1
0x00a62be9
0x00a62be9
0x00a62d23
0x00a62d2a
0x00a62d38
0x00a62d38
0x00a62d46
0x00a62d4b
0x00a62d52
0x00a62e26
0x00a62e2f
0x00a62e3b
0x00a62e47
0x00a62e4d
0x00a62e55
0x00a62e57
0x00a62e64
0x00a62e6b
0x00a62e70
0x00a62e74
0x00a62e81
0x00a62e81
0x00a62e74
0x00000000
0x00a62d58
0x00a62d5b
0x00a62d69
0x00a62d72
0x00a62d7b
0x00a62d7e
0x00a62d80
0x00a62d82
0x00a62d85
0x00a62d87
0x00a62d8a
0x00a62d8d
0x00a62d8f
0x00a62d97
0x00a62d99
0x00a62d9c
0x00000000
0x00000000
0x00a62d9e
0x00a62da3
0x00000000
0x00000000
0x00a62da5
0x00a62da7
0x00a62db6
0x00a62db6
0x00a62dc3
0x00a62dc8
0x00a62dcb
0x00a62dcd
0x00a62dcd
0x00a62dcd
0x00a62dcd
0x00a62dd0
0x00a62dd4
0x00a62dd4
0x00a62dd7
0x00a62e03
0x00a62e0b
0x00a62e10
0x00a62dd9
0x00a62ddb
0x00a62dde
0x00a62dde
0x00a62de1
0x00a62de4
0x00a62de6
0x00a62df3
0x00a62df5
0x00a62df8
0x00a62dfb
0x00a62dfb
0x00a62dfb
0x00a62e00
0x00000000
0x00a62e00
0x00a62e13
0x00a62e13
0x00a62e14
0x00a62e17
0x00a62e17
0x00a62e20
0x00a62e23
0x00000000
0x00a62e23
0x00a62d52
0x00a62ae0
0x00a62ae2
0x00a62ae7
0x00a62aeb
0x00a62aed
0x00a62afb
0x00a62afd
0x00000000
0x00a62afd
0x00a62aef
0x00a62af2
0x00000000
0x00000000
0x00a62af6
0x00000000
0x00a62af7
0x00a62aad
0x00a62a65
0x00a62a67
0x00000000
0x00000000
0x00a62a69
0x00a62a6b
0x00a62a6d
0x00a62a6d
0x00000000
0x00a62a0d
0x00a62a11
0x00a62a11
0x00a62a14
0x00a62a4a
0x00000000
0x00a62a4a
0x00a62a17
0x00a62a17
0x00a62a1a
0x00a62a3e
0x00000000
0x00a62a3e
0x00a62a1c
0x00a62a1c
0x00a62a1f
0x00a62a32
0x00a62a32
0x00000000
0x00a62a32
0x00a62a21
0x00a62a24
0x00000000
0x00000000
0x00a62a26
0x00000000
0x00a62a26
0x00a62a0b
0x00a6292c
0x00a6292f
0x00000000
0x00000000
0x00a62933
0x00000000
0x00a62933
0x00a6290f
0x00a62813
0x00a62816
0x00000000
0x00a6281c
0x00a62823
0x00a6282a
0x00a62832
0x00a6283a
0x00a62849
0x00a62851
0x00a62854
0x00a6285a
0x00a62860
0x00a62866
0x00a62868
0x00a62872
0x00a62872
0x00a62878
0x00a6287f
0x00a6288d
0x00a62890
0x00a62896
0x00a62896
0x00000000
0x00a6287f
0x00a62816
0x00a627b8
0x00a627bf
0x00000000
0x00000000
0x00000000
0x00a627bf
0x00a627af
0x00a627af
0x00000000
0x00a627af
0x00a62756
0x00a626f2
0x00a626f4
0x00000000
0x00a626f4
0x00a62682
0x00a62684
0x00a62686
0x00a6268c
0x00000000
0x00a62698
0x00a6269a
0x00a6269e
0x00a626a8
0x00a626aa
0x00a626b3
0x00000000
0x00a626b5
0x00a626c5
0x00a626d6
0x00a626db
0x00000000
0x00a626db
0x00a626b3

APIs

__EH_prolog.LIBCMT ref: 00A62647
_strlen.LIBCMT ref: 00A62B96

Part of subcall function 00A6FC9F: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00A6ABFF,00000000,?,?), ref: 00A6FCBB

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A62CD8

Strings

CMT, xrefs: 00A62D0B

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: ByteCharH_prologMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 1706572503-2756464174
Opcode ID: a899b0c772e8965ea5fcd8a204cda58602c0c9afd36289b83facdabce1c66903
Instruction ID: 65fd248f749421dda1e2e39ce1a8567c3d2468af538bc1282ee02a6a3e6ae5ab
Opcode Fuzzy Hash: a899b0c772e8965ea5fcd8a204cda58602c0c9afd36289b83facdabce1c66903
Instruction Fuzzy Hash: DC62BE715046848FDF29DF28C985BE93BB1EF14300F18457EED9ACB286DB719989CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A67E20 Relevance: 3.9, APIs: 2, Instructions: 888
COMMONCrypto

Download Yara Rule

C-Code - Quality: 69%

			E00A67E20(intOrPtr __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t355;
				signed int _t359;
				signed int _t360;
				signed int _t365;
				signed int _t366;
				signed int _t371;
				signed int _t373;
				signed int _t377;
				signed int _t378;
				signed int _t383;
				signed int _t387;
				signed int _t388;
				signed int _t392;
				signed int _t400;
				signed int _t401;
				signed int _t405;
				signed int _t406;
				signed int _t415;
				char _t417;
				char _t419;
				signed int _t420;
				signed int _t421;
				signed int _t439;
				signed int _t441;
				signed int _t445;
				signed int _t457;
				intOrPtr _t460;
				char _t468;
				signed int _t469;
				void* _t480;
				void* _t485;
				void* _t486;
				signed int _t487;
				char _t496;
				signed int _t500;
				signed int _t501;
				signed int _t502;
				signed int _t505;
				signed int _t507;
				signed int _t514;
				signed int _t522;
				signed int _t523;
				signed int _t527;
				signed int _t528;
				signed char _t529;
				signed int _t532;
				void* _t536;
				signed int _t543;
				signed int _t553;
				intOrPtr _t555;
				signed int _t556;
				signed int _t565;
				void* _t568;
				signed int _t571;
				signed int _t578;
				signed int _t579;
				signed int _t581;
				signed int _t589;
				signed int _t591;
				void* _t592;
				void* _t601;
				signed int _t610;
				signed int _t611;
				void* _t619;
				void* _t620;
				signed int _t634;
				void* _t642;
				signed int _t643;
				void* _t646;
				void* _t647;
				void* _t649;
				signed int _t650;
				signed int _t651;
				signed int _t652;
				signed int _t655;
				intOrPtr _t657;
				intOrPtr _t664;
				signed int _t665;
				signed int _t670;
				void* _t672;
				signed int _t674;
				signed int _t675;
				void* _t678;
				signed int _t684;
				void* _t686;

				_t642 = __edx;
				_t555 = __ecx;
				E00A7C16C(E00A8ED17, _t678);
				E00A7C240();
				_t553 =  *(_t678 + 8);
				_t657 = _t555;
				_t556 = 0;
				 *((intOrPtr*)(_t678 - 0x1c)) = _t657;
				 *((intOrPtr*)(_t678 - 0x24)) = 0;
				_t684 =  *(_t553 + 0x32cc);
				if(_t684 <= 0 && (_t684 < 0 ||  *(_t553 + 0x32c8) < 0)) {
					 *(_t553 + 0x32c8) = _t556;
					 *(_t553 + 0x32cc) = _t556;
				}
				_t686 =  *(_t553 + 0x32d4) - _t556;
				if(_t686 <= 0 && (_t686 < 0 ||  *(_t553 + 0x32d0) < _t556)) {
					 *(_t553 + 0x32d0) = _t556;
					 *(_t553 + 0x32d4) = _t556;
				}
				_t355 =  *( *(_t657 + 8) + 0x72b2) & 0x0000ffff;
				 *(_t678 - 0x18) = _t355;
				if( *((intOrPtr*)(_t678 + 0xc)) != _t556) {
					L14:
					_t664 =  *((intOrPtr*)(_t553 + 0x21dc));
					__eflags = _t664 - 2;
					if(_t664 == 2) {
						_t643 =  *(_t657 + 8);
						 *(_t657 + 0x10f5) = _t556;
						__eflags =  *((intOrPtr*)(_t643 + 0x515c)) - _t556;
						if( *((intOrPtr*)(_t643 + 0x515c)) != _t556) {
							L29:
							_push(0x800);
							_t35 = _t678 - 0x519c; // -18844
							 *(_t678 - 0x11) = _t556;
							_push(5);
							_t37 = _t678 - 0x11; // 0x7ef
							_push(_t553 + 0x2280);
							_t359 = E00A65B14();
							__eflags = _t359;
							_t360 = _t359 & 0xffffff00 | _t359 != 0x00000000;
							 *(_t678 - 0xf) = _t360;
							__eflags = _t360;
							if(_t360 != 0) {
								__eflags =  *(_t678 - 0x11);
								if( *(_t678 - 0x11) == 0) {
									 *((char*)(_t657 + 0xf1)) = 0;
								}
							}
							E00A61F93(_t553);
							_t44 = _t678 - 0x2154; // -6484
							_push(_t553 + 0x22a0);
							E00A6A89F(_t643);
							_t365 =  *(_t657 + 8);
							__eflags =  *((char*)(_t365 + 0x5197));
							if( *((char*)(_t365 + 0x5197)) == 0) {
								_t48 = _t678 - 0x2154; // -6484
								E00A6AF69(_t48);
							}
							__eflags =  *((char*)(_t553 + 0x3363));
							 *((intOrPtr*)(_t678 - 0x20)) = 1;
							if( *((char*)(_t553 + 0x3363)) == 0) {
								_t366 = E00A6209F(_t553);
								__eflags = _t366;
								if(_t366 == 0) {
									_t529 =  *(_t657 + 8);
									__eflags = 1 -  *((intOrPtr*)(_t529 + 0x6284));
									asm("sbb al, al");
									_t65 = _t678 - 0xf;
									 *_t65 =  *(_t678 - 0xf) &  !_t529;
									__eflags =  *_t65;
								}
							} else {
								_t532 =  *( *(_t657 + 8) + 0x6284);
								__eflags = _t532 - 1;
								if(_t532 != 1) {
									__eflags =  *(_t678 - 0x11);
									if( *(_t678 - 0x11) == 0) {
										__eflags = _t532;
										_push(0);
										 *(_t678 - 0xf) =  *(_t678 - 0xf) & (_t532 & 0xffffff00 | _t532 == 0x00000000) - 0x00000001;
										_t58 = _t678 - 0x2154; // -6484
										_t536 = E00A6B17F(_t58);
										_t634 =  *(_t657 + 8);
										__eflags =  *((intOrPtr*)(_t634 + 0x6284)) - 1 - _t536;
										if( *((intOrPtr*)(_t634 + 0x6284)) - 1 != _t536) {
											 *(_t678 - 0xf) = 0;
										} else {
											_t61 = _t678 - 0x2154; // -6484
											_push(1);
											E00A6B17F(_t61);
										}
									}
								}
							}
							 *((char*)(_t657 + 0x5f)) =  *((intOrPtr*)(_t553 + 0x3309));
							 *((char*)(_t657 + 0x60)) = 0;
							asm("sbb eax, [ebx+0x32cc]");
							 *((intOrPtr*)( *_t553 + 0xc))( *((intOrPtr*)(_t553 + 0x6ce0)) -  *(_t553 + 0x32c8),  *((intOrPtr*)(_t553 + 0x6ce4)), 0);
							_t565 = 0;
							_t371 = 0;
							 *(_t678 + 0xf) = 0;
							 *(_t678 + 8) = 0;
							__eflags =  *(_t678 - 0xf);
							if( *(_t678 - 0xf) != 0) {
								L44:
								_t665 =  *(_t678 - 0x18);
								_t646 = 0x49;
								_t373 =  *((intOrPtr*)( *(_t657 + 8) + 0x51c1));
								__eflags = _t373;
								if(_t373 != 0) {
									__eflags = _t665 - _t646;
									if(_t665 != _t646) {
										_t565 = 1;
									}
								}
								__eflags = _t373;
								_t86 = _t678 - 0x2154; // -6484
								_t377 = E00A6FC9A(_t565, _t86, (_t373 & 0xffffff00 | _t373 == 0x00000000) & 0x000000ff, _t565,  *(_t678 + 8)); // executed
								__eflags = _t377;
								if(__eflags == 0) {
									L204:
									_t378 = 0;
									L24:
									L25:
									 *[fs:0x0] =  *((intOrPtr*)(_t678 - 0xc));
									return _t378;
								}
								_t88 = _t678 - 0x2154; // -6484
								E00A67B37(_t657, __eflags, _t553, _t88, _t657 + 0x10f6, 0x800);
								__eflags =  *(_t678 + 0xf);
								if( *(_t678 + 0xf) != 0) {
									L51:
									 *(_t678 + 0xb) = 0;
									L52:
									_t383 =  *(_t657 + 8);
									_t568 = 0x45;
									__eflags =  *((char*)(_t383 + 0x5153));
									_t647 = 0x58;
									if( *((char*)(_t383 + 0x5153)) != 0) {
										L54:
										__eflags = _t665 - _t568;
										if(_t665 == _t568) {
											L56:
											_t97 = _t678 - 0x319c; // -10652
											E00A66BA0(_t97);
											_push(0);
											_t98 = _t678 - 0x319c; // -10652
											_t387 = E00A69B66(_t97, _t647, _t657 + 0x10f6, _t98);
											__eflags = _t387;
											if(_t387 == 0) {
												_t388 =  *(_t657 + 8);
												__eflags =  *((char*)(_t388 + 0x5153));
												_t109 = _t678 + 0xb;
												 *_t109 =  *(_t678 + 0xb) & (_t388 & 0xffffff00 |  *((char*)(_t388 + 0x5153)) != 0x00000000) - 0x00000001;
												__eflags =  *_t109;
												L62:
												__eflags =  *((char*)(_t553 + 0x330b));
												if( *((char*)(_t553 + 0x330b)) == 0) {
													L67:
													_t117 = _t678 - 0x2154; // -6484
													_t392 = E00A67682(_t117, _t553, _t117);
													__eflags = _t392;
													if(_t392 != 0) {
														_t122 = _t678 - 0x130; // 0x6d0
														_t571 = 0x40;
														memcpy(_t122,  *(_t657 + 8) + 0x4024, _t571 << 2);
														asm("movsw");
														_t657 =  *((intOrPtr*)(_t678 - 0x1c));
														_t125 = _t678 - 0x2c; // 0x7d4
														 *(_t678 - 4) = 0;
														asm("sbb ecx, ecx");
														_t132 = _t678 - 0x130; // 0x6d0
														E00A6C16D(_t657 + 0x10, 0,  *((intOrPtr*)(_t553 + 0x330c)), _t132,  ~( *(_t553 + 0x3310) & 0x000000ff) & _t553 + 0x00003311, _t553 + 0x3321,  *((intOrPtr*)(_t553 + 0x335c)), _t553 + 0x333b, _t125);
														__eflags =  *((char*)(_t553 + 0x330b));
														if( *((char*)(_t553 + 0x330b)) != 0) {
															__eflags =  *((char*)(_t553 + 0x3331));
															if( *((char*)(_t553 + 0x3331)) != 0) {
																_t137 = _t678 - 0x2c; // 0x7d4
																_t514 = E00A7D710(_t553 + 0x3332, _t137, 8);
																__eflags = _t514;
																if(_t514 != 0) {
																	__eflags =  *((char*)(_t553 + 0x6cfc));
																	if( *((char*)(_t553 + 0x6cfc)) == 0) {
																		E00A61546(6, _t553 + 0x1e);
																		E00A66ACC(0xa9bbf8, 0xb);
																		 *(_t678 + 0xb) = 0;
																	}
																}
															}
														}
														_t142 = _t678 - 0x1154; // -2388
														_t578 = _t142;
														E00A68E1D(_t578);
														_t400 =  *(_t553 + 0x3370);
														__eflags = _t400;
														_t579 = _t578 & 0xffffff00 | _t400 != 0x00000000;
														 *(_t678 - 4) = 1;
														 *(_t678 - 0x13) = _t579;
														_t649 = 0x50;
														__eflags = _t579;
														if(_t579 == 0) {
															L84:
															_t401 = E00A6209F(_t553);
															__eflags = _t401;
															if(_t401 == 0) {
																_t581 =  *(_t678 + 0xb);
																__eflags = _t581;
																if(_t581 == 0) {
																	_t670 =  *(_t678 - 0x18);
																	goto L97;
																}
																_t171 = _t678 - 0x1154; // -2388
																_push(_t553);
																_t500 = E00A679C6(_t657);
																_t670 =  *(_t678 - 0x18);
																_t581 = _t500;
																 *(_t678 + 0xb) = _t581;
																goto L94;
															}
															__eflags =  *(_t678 + 0xb);
															if( *(_t678 + 0xb) != 0) {
																_t501 =  *(_t678 - 0x18);
																__eflags = _t501 - 0x50;
																if(_t501 != 0x50) {
																	_t619 = 0x49;
																	__eflags = _t501 - _t619;
																	if(_t501 != _t619) {
																		_t620 = 0x45;
																		__eflags = _t501 - _t620;
																		if(_t501 != _t620) {
																			_t502 =  *(_t657 + 8);
																			__eflags =  *((intOrPtr*)(_t502 + 0x5158)) - 1;
																			if( *((intOrPtr*)(_t502 + 0x5158)) != 1) {
																				 *(_t657 + 0xe4) =  *(_t657 + 0xe4) + 1;
																				_t169 = _t678 - 0x2154; // -6484
																				_push(_t553);
																				E00A67813(_t657, _t649);
																			}
																		}
																	}
																}
															}
															goto L100;
														} else {
															__eflags = _t400 - 5;
															if(_t400 == 5) {
																goto L84;
															}
															_t581 =  *(_t678 + 0xb);
															_t670 =  *(_t678 - 0x18);
															__eflags = _t581;
															if(_t581 == 0) {
																L97:
																__eflags =  *(_t553 + 0x6cec);
																if( *(_t553 + 0x6cec) == 0) {
																	__eflags = _t581;
																	if(_t581 == 0) {
																		L197:
																		_t340 = _t678 - 0x1154; // -2388, executed
																		E00A68E53(_t340); // executed
																		 *(_t678 - 4) =  *(_t678 - 4) | 0xffffffff;
																		_t343 = _t678 - 0x130; // 0x6d0
																		E00A6D9CE(_t343);
																		__eflags =  *(_t678 - 0xf);
																		_t371 =  *(_t678 + 0xb);
																		_t650 =  *(_t678 + 0xf);
																		if( *(_t678 - 0xf) != 0) {
																			_t347 = _t657 + 0xec;
																			 *_t347 =  *(_t657 + 0xec) + 1;
																			__eflags =  *_t347;
																		}
																		L199:
																		__eflags =  *((char*)(_t657 + 0x60));
																		if( *((char*)(_t657 + 0x60)) != 0) {
																			goto L204;
																		}
																		__eflags = _t371;
																		if(_t371 != 0) {
																			L23:
																			_t378 = 1;
																			goto L24;
																		}
																		__eflags =  *(_t553 + 0x6cec) - _t371;
																		if( *(_t553 + 0x6cec) != _t371) {
																			__eflags = _t650;
																			if(_t650 != 0) {
																				goto L23;
																			}
																			goto L204;
																		}
																		L202:
																		E00A61ED6(_t553);
																		goto L23;
																	}
																	L102:
																	_t405 =  *(_t657 + 8);
																	__eflags =  *((char*)(_t405 + 0x51c1));
																	if( *((char*)(_t405 + 0x51c1)) == 0) {
																		L104:
																		_t406 =  *(_t678 + 0xf);
																		__eflags = _t406;
																		if(_t406 != 0) {
																			L109:
																			 *((char*)(_t678 - 0xe)) = 1;
																			__eflags = _t406;
																			if(_t406 != 0) {
																				L111:
																				 *((intOrPtr*)(_t657 + 0xe8)) =  *((intOrPtr*)(_t657 + 0xe8)) + 1;
																				 *((intOrPtr*)(_t657 + 0x80)) = 0;
																				 *((intOrPtr*)(_t657 + 0x84)) = 0;
																				 *((intOrPtr*)(_t657 + 0x88)) = 0;
																				 *((intOrPtr*)(_t657 + 0x8c)) = 0;
																				E00A6A0C4(_t657 + 0xc8, _t649,  *((intOrPtr*)(_t553 + 0x32e0)),  *((intOrPtr*)( *(_t657 + 8) + 0x7298)));
																				E00A6A0C4(_t657 + 0xa0, _t649,  *((intOrPtr*)(_t553 + 0x32e0)),  *((intOrPtr*)( *(_t657 + 8) + 0x7298)));
																				_t672 = _t657 + 0x10;
																				 *(_t657 + 0x30) =  *(_t553 + 0x32c8);
																				_t215 = _t678 - 0x1154; // -2388
																				 *(_t657 + 0x34) =  *(_t553 + 0x32cc);
																				E00A6C1B5(_t672, _t553, _t215);
																				_t651 =  *((intOrPtr*)(_t678 - 0xe));
																				_t415 =  *(_t678 + 0xf);
																				 *((char*)(_t657 + 0x39)) = _t651;
																				 *((char*)(_t657 + 0x3a)) = _t415;
																				__eflags = _t651;
																				if(_t651 != 0) {
																					L124:
																					_t652 =  *(_t657 + 8);
																					__eflags =  *((char*)(_t652 + 0x5194));
																					 *((char*)(_t678 - 0x1141)) =  *((char*)(_t652 + 0x5194)) == 0;
																					__eflags =  *((char*)(_t678 - 0xe));
																					if( *((char*)(_t678 - 0xe)) != 0) {
																						L128:
																						_t589 = 0;
																						_t417 = 1;
																						__eflags = 1;
																						L129:
																						__eflags =  *(_t678 - 0x13);
																						 *((char*)(_t678 - 0x10)) = _t589;
																						 *((char*)(_t678 - 0x12)) = _t417;
																						 *((char*)(_t678 - 0xd)) = _t417;
																						if( *(_t678 - 0x13) == 0) {
																							__eflags =  *(_t553 + 0x3308);
																							if( *(_t553 + 0x3308) == 0) {
																								__eflags =  *((char*)(_t553 + 0x229a));
																								if(__eflags != 0) {
																									E00A71660(_t553,  *((intOrPtr*)(_t657 + 0xe0)), _t678,  *((intOrPtr*)(_t553 + 0x3364)),  *(_t553 + 0x3360) & 0x000000ff);
																									_t460 =  *((intOrPtr*)(_t657 + 0xe0));
																									 *(_t460 + 0x4c40) =  *(_t553 + 0x32d0);
																									 *(_t460 + 0x4c44) =  *(_t553 + 0x32d4);
																									 *((char*)(_t460 + 0x4c58)) = 0;
																									E00A712C1( *((intOrPtr*)(_t657 + 0xe0)),  *(_t553 + 0x2299) & 0x000000ff,  *(_t553 + 0x3360) & 0x000000ff); // executed
																								} else {
																									_push( *(_t553 + 0x32d4));
																									_push( *(_t553 + 0x32d0));
																									_push(_t672);
																									E00A68AD8(_t553, _t652, __eflags);
																								}
																							}
																							L160:
																							E00A61ED6(_t553);
																							__eflags =  *((char*)(_t553 + 0x3309));
																							if( *((char*)(_t553 + 0x3309)) != 0) {
																								L163:
																								_t419 = 0;
																								__eflags = 0;
																								_t591 = 0;
																								L164:
																								__eflags =  *(_t553 + 0x3360);
																								if( *(_t553 + 0x3360) != 0) {
																									__eflags =  *((char*)(_t553 + 0x229a));
																									if( *((char*)(_t553 + 0x229a)) == 0) {
																										L172:
																										__eflags =  *(_t678 + 0xf);
																										if( *(_t678 + 0xf) != 0) {
																											L182:
																											__eflags =  *((char*)(_t678 - 0xe));
																											if( *((char*)(_t678 - 0xe)) != 0) {
																												goto L197;
																											}
																											_t420 =  *(_t678 - 0x18);
																											_t592 = 0x58;
																											__eflags = _t420 - _t592;
																											if(_t420 == _t592) {
																												L185:
																												__eflags =  *(_t678 - 0x13);
																												if( *(_t678 - 0x13) == 0) {
																													L188:
																													__eflags =  *((char*)(_t678 - 0x24));
																													if( *((char*)(_t678 - 0x24)) == 0) {
																														L191:
																														_t421 =  *(_t657 + 8);
																														__eflags =  *((char*)(_t421 + 0x5150));
																														if( *((char*)(_t421 + 0x5150)) != 0) {
																															_t316 = _t553 + 0x229c;
																															 *_t316 =  *(_t553 + 0x229c) & 0xffffffdf;
																															__eflags =  *_t316;
																														}
																														asm("sbb eax, eax");
																														asm("sbb ecx, ecx");
																														asm("sbb eax, eax");
																														_t325 = _t678 - 0x1154; // -2388
																														E00A69430(_t325, _t553 + 0x32c0,  ~( *( *(_t657 + 8) + 0x628c)) & _t553 + 0x000032b0,  ~( *( *(_t657 + 8) + 0x6290)) & _t553 + 0x000032b8,  ~( *( *(_t657 + 8) + 0x6294)) & _t553 + 0x000032c0);
																														_t326 = _t678 - 0x1154; // -2388
																														E00A68EBF(_t326);
																														asm("sbb eax, eax");
																														asm("sbb eax, eax");
																														E00A6942D( ~( *( *((intOrPtr*)( *((intOrPtr*)(_t678 - 0x1c)) + 8)) + 0x628c)) & _t553 + 0x000032b0,  ~( *( *((intOrPtr*)( *((intOrPtr*)(_t678 - 0x1c)) + 8)) + 0x628c)) & _t553 + 0x000032b0,  ~( *( *((intOrPtr*)( *((intOrPtr*)(_t678 - 0x1c)) + 8)) + 0x6294)) & _t553 + 0x000032c0);
																														_t657 =  *((intOrPtr*)(_t678 - 0x1c));
																														_t439 =  *(_t657 + 8);
																														__eflags =  *((char*)(_t439 + 0x519c));
																														if( *((char*)(_t439 + 0x519c)) == 0) {
																															_t336 = _t678 - 0x1136; // -2358
																															_t441 = E00A69AE4(_t336,  *(_t553 + 0x229c)); // executed
																															__eflags = _t441;
																															if(_t441 == 0) {
																																_t337 = _t678 - 0x1136; // -2358
																																E00A61F25(0x10, _t553 + 0x1e, _t337);
																															}
																														}
																														 *(_t657 + 0x10f5) = 1;
																														goto L197;
																													}
																													_t445 =  *(_t657 + 8);
																													__eflags =  *((char*)(_t445 + 0x5194));
																													if( *((char*)(_t445 + 0x5194)) == 0) {
																														goto L197;
																													}
																													_t313 = _t678 - 0x1154; // -2388
																													E00A69588(_t313);
																													goto L191;
																												}
																												__eflags =  *(_t553 + 0x3370) - 5;
																												if( *(_t553 + 0x3370) != 5) {
																													goto L197;
																												}
																												__eflags =  *((char*)(_t678 - 0xd));
																												if( *((char*)(_t678 - 0xd)) == 0) {
																													goto L197;
																												}
																												goto L188;
																											}
																											_t601 = 0x45;
																											__eflags = _t420 - _t601;
																											if(_t420 != _t601) {
																												goto L197;
																											}
																											goto L185;
																										}
																										__eflags =  *((char*)(_t678 - 0x12));
																										if( *((char*)(_t678 - 0x12)) == 0) {
																											goto L182;
																										}
																										__eflags = _t591;
																										if(_t591 != 0) {
																											goto L182;
																										}
																										__eflags =  *((intOrPtr*)(_t553 + 0x330b)) - _t591;
																										if( *((intOrPtr*)(_t553 + 0x330b)) == _t591) {
																											L180:
																											_t302 = _t678 - 0x2154; // -6484
																											_push(_t553 + 0x1e);
																											_push(3);
																											L181:
																											E00A61F25();
																											 *((char*)(_t678 - 0x24)) = 1;
																											E00A66ACC(0xa9bbf8, 3);
																											goto L182;
																										}
																										__eflags =  *((intOrPtr*)(_t553 + 0x3331)) - _t591;
																										if( *((intOrPtr*)(_t553 + 0x3331)) == _t591) {
																											L178:
																											__eflags =  *((char*)(_t657 + 0xf3));
																											if( *((char*)(_t657 + 0xf3)) != 0) {
																												goto L180;
																											}
																											_t300 = _t678 - 0x2154; // -6484
																											_push(_t553 + 0x1e);
																											_push(4);
																											goto L181;
																										}
																										__eflags =  *((intOrPtr*)(_t553 + 0x6cfc)) - _t591;
																										if( *((intOrPtr*)(_t553 + 0x6cfc)) == _t591) {
																											goto L180;
																										}
																										goto L178;
																									}
																									__eflags =  *(_t553 + 0x32d4) - _t419;
																									if(__eflags < 0) {
																										goto L172;
																									}
																									if(__eflags > 0) {
																										L170:
																										__eflags = _t591;
																										if(_t591 != 0) {
																											 *((char*)(_t657 + 0xf3)) = 1;
																										}
																										goto L172;
																									}
																									__eflags =  *(_t553 + 0x32d0) - _t419;
																									if( *(_t553 + 0x32d0) <= _t419) {
																										goto L172;
																									}
																									goto L170;
																								}
																								 *((char*)(_t657 + 0xf3)) = _t419;
																								goto L172;
																							}
																							asm("sbb eax, eax");
																							_t457 = E00A6A092(_t657 + 0xc8, _t657, _t553 + 0x32e0,  ~( *(_t553 + 0x333a) & 0x000000ff) & _t553 + 0x0000333b);
																							__eflags = _t457;
																							if(_t457 == 0) {
																								goto L163;
																							}
																							_t591 = 1;
																							_t419 = 0;
																							goto L164;
																						}
																						_t674 =  *(_t553 + 0x3370);
																						__eflags = _t674 - 4;
																						if(__eflags == 0) {
																							L143:
																							_t254 = _t678 - 0x419c; // -14748
																							E00A67B37(_t657, __eflags, _t553, _t553 + 0x3374, _t254, 0x800);
																							_t589 =  *((intOrPtr*)(_t678 - 0x10));
																							__eflags = _t589;
																							if(_t589 == 0) {
																								L150:
																								_t468 =  *((intOrPtr*)(_t678 - 0xd));
																								L151:
																								__eflags =  *((intOrPtr*)(_t553 + 0x6ce8)) - 2;
																								if( *((intOrPtr*)(_t553 + 0x6ce8)) != 2) {
																									L138:
																									__eflags = _t589;
																									if(_t589 == 0) {
																										L154:
																										_t469 = 0;
																										__eflags = 0;
																										L155:
																										 *(_t657 + 0x10f5) = _t469;
																										goto L160;
																									}
																									L139:
																									__eflags = _t468;
																									if(_t468 == 0) {
																										goto L154;
																									}
																									_t469 = 1;
																									goto L155;
																								}
																								__eflags = _t589;
																								if(_t589 != 0) {
																									goto L139;
																								}
																								L137:
																								 *((char*)(_t678 - 0x12)) = 0;
																								goto L138;
																							}
																							__eflags =  *((short*)(_t678 - 0x419c));
																							if( *((short*)(_t678 - 0x419c)) == 0) {
																								goto L150;
																							}
																							_t258 = _t678 - 0x419c; // -14748
																							_push(0x800);
																							_push(_t657 + 0x10f6);
																							__eflags = _t674 - 4;
																							if(__eflags != 0) {
																								_push(_t553 + 0x1e);
																								_t261 = _t678 - 0x1154; // -2388
																								_t468 = E00A68A12(_t652, __eflags);
																							} else {
																								_t468 = E00A6708A(_t589, _t652, __eflags);
																							}
																							L148:
																							 *((char*)(_t678 - 0xd)) = _t468;
																							__eflags = _t468;
																							if(_t468 == 0) {
																								L136:
																								_t589 =  *((intOrPtr*)(_t678 - 0x10));
																								goto L137;
																							}
																							_t589 =  *((intOrPtr*)(_t678 - 0x10));
																							goto L151;
																						}
																						__eflags = _t674 - 5;
																						if(__eflags == 0) {
																							goto L143;
																						}
																						__eflags = _t674 - _t417;
																						if(_t674 == _t417) {
																							L141:
																							__eflags = _t589;
																							if(_t589 == 0) {
																								goto L150;
																							}
																							_push(_t657 + 0x10f6);
																							_t468 = E00A6729A(_t652, _t657 + 0x10, _t553);
																							goto L148;
																						}
																						__eflags = _t674 - 2;
																						if(_t674 == 2) {
																							goto L141;
																						}
																						__eflags = _t674 - 3;
																						if(_t674 == 3) {
																							goto L141;
																						}
																						E00A61F25(0x46, _t553 + 0x1e, _t657 + 0x10f6);
																						_t468 = 0;
																						__eflags = 0;
																						 *((char*)(_t678 - 0xd)) = 0;
																						goto L136;
																					}
																					__eflags = _t415;
																					if(_t415 != 0) {
																						goto L128;
																					}
																					_t480 = 0x50;
																					__eflags =  *(_t678 - 0x18) - _t480;
																					if( *(_t678 - 0x18) == _t480) {
																						goto L128;
																					}
																					_t417 = 1;
																					_t589 = 1;
																					goto L129;
																				}
																				__eflags =  *((intOrPtr*)(_t553 + 0x6cfc)) - _t651;
																				if( *((intOrPtr*)(_t553 + 0x6cfc)) != _t651) {
																					goto L124;
																				}
																				_t610 =  *(_t553 + 0x32c8);
																				_t675 =  *(_t553 + 0x32d4);
																				_t655 =  *(_t553 + 0x32d0);
																				_t611 = _t610 << 0xb;
																				__eflags = ( *(_t553 + 0x32cc) << 0x00000020 | _t610) << 0xb - _t675;
																				if(__eflags < 0) {
																					L123:
																					_t415 =  *(_t678 + 0xf);
																					_t672 = _t657 + 0x10;
																					goto L124;
																				}
																				if(__eflags > 0) {
																					L116:
																					__eflags = _t675;
																					if(__eflags < 0) {
																						L122:
																						_t233 = _t678 - 0x1154; // -2388
																						E00A69287(_t233,  *(_t553 + 0x32d0),  *(_t553 + 0x32d4));
																						goto L123;
																					}
																					if(__eflags > 0) {
																						L119:
																						_t485 = E00A690C9(_t553, _t655); // executed
																						__eflags = _t655 -  *(_t553 + 0x32cc);
																						if(__eflags < 0) {
																							goto L123;
																						}
																						if(__eflags > 0) {
																							goto L122;
																						}
																						__eflags = _t485 -  *(_t553 + 0x32c8);
																						if(_t485 <=  *(_t553 + 0x32c8)) {
																							goto L123;
																						}
																						goto L122;
																					}
																					__eflags = _t655 - 0x5f5e100;
																					if(_t655 < 0x5f5e100) {
																						goto L122;
																					}
																					goto L119;
																				}
																				__eflags = _t611 - _t655;
																				if(_t611 <= _t655) {
																					goto L123;
																				}
																				goto L116;
																			}
																			L110:
																			_t196 = _t657 + 0xe4;
																			 *_t196 =  *(_t657 + 0xe4) + 1;
																			__eflags =  *_t196;
																			goto L111;
																		}
																		 *((char*)(_t678 - 0xe)) = _t406;
																		_t486 = 0x50;
																		__eflags = _t670 - _t486;
																		if(_t670 != _t486) {
																			_t190 = _t678 - 0x1154; // -2388
																			_t487 = E00A69139(_t190);
																			__eflags = _t487;
																			if(_t487 != 0) {
																				E00A61F25(0x3a, _t553 + 0x1e, _t657 + 0x10f6);
																				E00A66B64(0xa9bbf8, _t678, _t553 + 0x1e, _t657 + 0x10f6);
																			}
																		}
																		goto L110;
																	}
																	 *(_t657 + 0x10f5) = 1;
																	__eflags =  *((char*)(_t405 + 0x51c1));
																	if( *((char*)(_t405 + 0x51c1)) != 0) {
																		_t406 =  *(_t678 + 0xf);
																		goto L109;
																	}
																	goto L104;
																}
																 *(_t678 + 0xf) = 1;
																 *(_t678 + 0xb) = 1;
																_t179 = _t678 - 0x2154; // -6484
																_t496 = E00A6FC9A(_t581, _t179, 0, 0, 1);
																__eflags = _t496;
																if(_t496 != 0) {
																	goto L102;
																}
																 *((char*)(_t678 - 0x20)) = _t496;
																L100:
																_t181 = _t678 - 0x1154; // -2388
																E00A68E53(_t181);
																_t182 = _t678 - 0x130; // 0x6d0
																E00A6D9CE(_t182);
																_t378 =  *((intOrPtr*)(_t678 - 0x20));
																goto L24;
															}
															__eflags = _t670 - _t649;
															if(_t670 == _t649) {
																L94:
																__eflags = _t581;
																if(_t581 != 0) {
																	goto L102;
																}
																goto L97;
															}
															_t505 =  *(_t657 + 8);
															__eflags =  *((char*)(_t505 + 0x51c1));
															if( *((char*)(_t505 + 0x51c1)) != 0) {
																goto L94;
															}
															 *((char*)(_t678 - 0xe)) = 0;
															_t507 = E00A69820(_t657 + 0x10f6);
															__eflags = _t507;
															if(_t507 == 0) {
																L82:
																__eflags =  *((char*)(_t678 - 0xe));
																if( *((char*)(_t678 - 0xe)) == 0) {
																	_t581 =  *(_t678 + 0xb);
																	goto L94;
																}
																L83:
																_t581 = 0;
																 *(_t678 + 0xb) = 0;
																goto L94;
															}
															__eflags =  *((char*)(_t678 - 0xe));
															if( *((char*)(_t678 - 0xe)) != 0) {
																goto L83;
															}
															__eflags = 0;
															_push(0);
															_push(_t553 + 0x32b0);
															_t157 = _t678 - 0xe; // 0x7f2
															E00A68B7D(0, _t649,  *(_t657 + 8), 0, _t657 + 0x10f6, 0x800, _t157,  *(_t553 + 0x32d0),  *(_t553 + 0x32d4));
															goto L82;
														}
													}
													E00A66ACC(0xa9bbf8, 2);
													E00A61ED6(_t553);
													__eflags =  *(_t553 + 0x6cec);
													_t378 = 0 |  *(_t553 + 0x6cec) == 0x00000000;
													goto L24;
												}
												_t112 = _t678 - 0x2154; // -6484
												_t522 = E00A67AE4(_t657, _t553, _t112);
												__eflags = _t522;
												if(_t522 != 0) {
													_t523 =  *(_t657 + 8);
													__eflags =  *(_t523 + 0x4124);
													if( *(_t523 + 0x4124) == 0) {
														E00A66ACC(0xa9bbf8, 1);
														 *(_t678 + 0xb) = 0;
													}
													goto L67;
												}
												 *((char*)(_t657 + 0x20f6)) = 1;
												goto L204;
											}
											_t101 = _t678 - 0x218c; // -6540
											_t527 = E00A6765B(_t101, _t553 + 0x32b0);
											__eflags = _t527;
											if(_t527 == 0) {
												goto L62;
											}
											__eflags =  *((char*)(_t678 - 0x2190));
											if( *((char*)(_t678 - 0x2190)) == 0) {
												L60:
												 *(_t678 + 0xb) = 0;
												goto L62;
											}
											_t103 = _t678 - 0x218c; // -6540
											_t528 = E00A6763D(_t103, _t657);
											__eflags = _t528;
											if(_t528 == 0) {
												goto L62;
											}
											goto L60;
										}
										__eflags = _t665 - _t647;
										if(_t665 != _t647) {
											goto L62;
										}
										goto L56;
									}
									__eflags =  *((char*)(_t383 + 0x5154));
									if( *((char*)(_t383 + 0x5154)) == 0) {
										goto L62;
									}
									goto L54;
								}
								__eflags =  *(_t657 + 0x10f6);
								if( *(_t657 + 0x10f6) == 0) {
									goto L51;
								}
								 *(_t678 + 0xb) = 1;
								__eflags =  *(_t553 + 0x3308);
								if( *(_t553 + 0x3308) == 0) {
									goto L52;
								}
								goto L51;
							}
							_t650 =  *(_t553 + 0x6cec);
							 *(_t678 + 0xf) = _t650;
							 *(_t678 + 8) = _t650;
							__eflags = _t650;
							if(_t650 == 0) {
								goto L199;
							}
							goto L44;
						}
						__eflags =  *(_t657 + 0xec) -  *((intOrPtr*)(_t643 + 0x92e8));
						if( *(_t657 + 0xec) <  *((intOrPtr*)(_t643 + 0x92e8))) {
							goto L29;
						}
						__eflags =  *((char*)(_t657 + 0xf1));
						if( *((char*)(_t657 + 0xf1)) != 0) {
							goto L204;
						}
						goto L29;
					}
					__eflags = _t664 - 3;
					if(_t664 != 3) {
						L18:
						__eflags = _t664 - 5;
						if(_t664 != 5) {
							goto L202;
						}
						__eflags =  *((char*)(_t553 + 0x459c));
						if( *((char*)(_t553 + 0x459c)) == 0) {
							goto L204;
						}
						_push( *(_t678 - 0x18));
						_push(0);
						_push(_t657 + 0x10);
						_push(_t553);
						_t543 = E00A76EFD(_t642);
						__eflags = _t543;
						if(_t543 != 0) {
							 *((intOrPtr*)( *_t553 + 0xc))( *((intOrPtr*)(_t553 + 0x6cd8)),  *((intOrPtr*)(_t553 + 0x6cdc)), 0);
							goto L23;
						} else {
							E00A66ACC(0xa9bbf8, 1);
							goto L204;
						}
					}
					__eflags =  *(_t657 + 0x10f5);
					if( *(_t657 + 0x10f5) == 0) {
						goto L202;
					} else {
						E00A6746C(_t553, _t678,  *(_t657 + 8), _t553, _t657 + 0x10f6);
						goto L18;
					}
				}
				if( *((intOrPtr*)(_t657 + 0x5f)) == _t556) {
					L12:
					_t378 = 0;
					goto L25;
				}
				_push(_t355);
				_push(_t556);
				_push(_t657 + 0x10);
				_push(_t553);
				if(E00A76EFD(_t642) != 0) {
					_t556 = 0;
					__eflags = 0;
					goto L14;
				} else {
					E00A66ACC(0xa9bbf8, 1);
					goto L12;
				}
			}

0x00a67e20
0x00a67e20
0x00a67e25
0x00a67e2f
0x00a67e35
0x00a67e39
0x00a67e3b
0x00a67e3d
0x00a67e40
0x00a67e43
0x00a67e49
0x00a67e55
0x00a67e5b
0x00a67e5b
0x00a67e61
0x00a67e67
0x00a67e73
0x00a67e79
0x00a67e79
0x00a67e82
0x00a67e89
0x00a67e8f
0x00a67ebb
0x00a67ebc
0x00a67ec2
0x00a67ec5
0x00a67f52
0x00a67f55
0x00a67f5b
0x00a67f61
0x00a67f7e
0x00a67f7e
0x00a67f83
0x00a67f89
0x00a67f8d
0x00a67f8f
0x00a67f9b
0x00a67f9c
0x00a67fa1
0x00a67fa3
0x00a67fa6
0x00a67fa9
0x00a67fab
0x00a67fad
0x00a67fb1
0x00a67fb3
0x00a67fb3
0x00a67fb1
0x00a67fbc
0x00a67fc1
0x00a67fce
0x00a67fcf
0x00a67fd4
0x00a67fd7
0x00a67fde
0x00a67fe0
0x00a67fe7
0x00a67fe7
0x00a67fef
0x00a67ff6
0x00a67ff9
0x00a6804e
0x00a68053
0x00a68055
0x00a68057
0x00a6805d
0x00a68063
0x00a68067
0x00a68067
0x00a68067
0x00a68067
0x00a67ffb
0x00a67ffe
0x00a68004
0x00a68006
0x00a68008
0x00a6800c
0x00a6800e
0x00a68010
0x00a68017
0x00a6801a
0x00a68021
0x00a68026
0x00a68030
0x00a68032
0x00a68046
0x00a68034
0x00a68036
0x00a6803d
0x00a6803f
0x00a6803f
0x00a68032
0x00a6800c
0x00a68006
0x00a68070
0x00a68075
0x00a6808d
0x00a68097
0x00a6809a
0x00a6809c
0x00a6809e
0x00a680a3
0x00a680a6
0x00a680a9
0x00a680bf
0x00a680c2
0x00a680c7
0x00a680c8
0x00a680ce
0x00a680d0
0x00a680d2
0x00a680d5
0x00a680d7
0x00a680d7
0x00a680d5
0x00a680dc
0x00a680e6
0x00a680ed
0x00a680f2
0x00a680f4
0x00a68a0b
0x00a68a0b
0x00a67f3f
0x00a67f40
0x00a67f45
0x00a67f4f
0x00a67f4f
0x00a68108
0x00a68110
0x00a68117
0x00a6811a
0x00a68131
0x00a68131
0x00a68134
0x00a68134
0x00a68139
0x00a6813c
0x00a68143
0x00a68144
0x00a6814f
0x00a6814f
0x00a68152
0x00a68159
0x00a68159
0x00a6815f
0x00a68164
0x00a68166
0x00a68174
0x00a68179
0x00a6817b
0x00a681b2
0x00a681b5
0x00a681c1
0x00a681c1
0x00a681c1
0x00a681c4
0x00a681c4
0x00a681d0
0x00a6820b
0x00a6820b
0x00a68215
0x00a6821a
0x00a6821c
0x00a68241
0x00a6824f
0x00a68250
0x00a68252
0x00a68254
0x00a68257
0x00a6827a
0x00a68283
0x00a68287
0x00a68299
0x00a6829e
0x00a682a5
0x00a682a7
0x00a682ae
0x00a682b2
0x00a682bd
0x00a682c5
0x00a682c7
0x00a682c9
0x00a682d0
0x00a682d8
0x00a682e4
0x00a682e9
0x00a682e9
0x00a682d0
0x00a682c7
0x00a682ae
0x00a682ed
0x00a682ed
0x00a682f3
0x00a682f8
0x00a682fe
0x00a68302
0x00a68305
0x00a68309
0x00a6830c
0x00a6830d
0x00a6830f
0x00a6839f
0x00a683a1
0x00a683a6
0x00a683a8
0x00a683fa
0x00a683fd
0x00a683ff
0x00a68423
0x00000000
0x00a68423
0x00a68401
0x00a6840a
0x00a6840b
0x00a68410
0x00a68413
0x00a68415
0x00000000
0x00a68415
0x00a683aa
0x00a683ae
0x00a683b4
0x00a683b7
0x00a683bb
0x00a683c3
0x00a683c4
0x00a683c7
0x00a683cf
0x00a683d0
0x00a683d3
0x00a683d5
0x00a683db
0x00a683e1
0x00a683e3
0x00a683e9
0x00a683f0
0x00a683f3
0x00a683f3
0x00a683e1
0x00a683d3
0x00a683c7
0x00a683bb
0x00000000
0x00a68315
0x00a68315
0x00a68318
0x00000000
0x00000000
0x00a6831e
0x00a68321
0x00a68324
0x00a68326
0x00a68426
0x00a68426
0x00a6842d
0x00a6846e
0x00a68470
0x00a689b5
0x00a689b5
0x00a689bb
0x00a689c0
0x00a689c4
0x00a689ca
0x00a689cf
0x00a689d3
0x00a689d6
0x00a689d9
0x00a689db
0x00a689db
0x00a689db
0x00a689db
0x00a689e1
0x00a689e1
0x00a689e5
0x00000000
0x00000000
0x00a689e7
0x00a689e9
0x00a67f3d
0x00a67f3d
0x00000000
0x00a67f3d
0x00a689ef
0x00a689f5
0x00a68a03
0x00a68a05
0x00000000
0x00000000
0x00000000
0x00a68a05
0x00a689f7
0x00a689f9
0x00000000
0x00a689f9
0x00a68476
0x00a68476
0x00a68479
0x00a68480
0x00a68492
0x00a68492
0x00a68495
0x00a68497
0x00a684dc
0x00a684dc
0x00a684e0
0x00a684e2
0x00a684ea
0x00a684ea
0x00a684fe
0x00a68504
0x00a6850a
0x00a68510
0x00a68521
0x00a68537
0x00a68542
0x00a6854b
0x00a6854e
0x00a68555
0x00a6855b
0x00a68560
0x00a68563
0x00a68566
0x00a68569
0x00a6856c
0x00a6856e
0x00a685e5
0x00a685e5
0x00a685e8
0x00a685ef
0x00a685f6
0x00a685fa
0x00a68610
0x00a68612
0x00a68614
0x00a68614
0x00a68615
0x00a68615
0x00a68619
0x00a6861c
0x00a6861f
0x00a68622
0x00a6872c
0x00a68733
0x00a68735
0x00a6873c
0x00a68766
0x00a6876b
0x00a6877d
0x00a68783
0x00a68789
0x00a687a6
0x00a6873e
0x00a6873e
0x00a68744
0x00a6874a
0x00a6874b
0x00a6874b
0x00a6873c
0x00a687ab
0x00a687ad
0x00a687b2
0x00a687b9
0x00a687eb
0x00a687eb
0x00a687eb
0x00a687ed
0x00a687ef
0x00a687ef
0x00a687f6
0x00a68800
0x00a68807
0x00a68826
0x00a68826
0x00a6882a
0x00a68888
0x00a68888
0x00a6888c
0x00000000
0x00000000
0x00a68892
0x00a68897
0x00a68898
0x00a6889b
0x00a688a9
0x00a688a9
0x00a688ad
0x00a688c6
0x00a688c6
0x00a688ca
0x00a688e7
0x00a688e7
0x00a688ea
0x00a688f1
0x00a688f3
0x00a688f3
0x00a688f3
0x00a688f3
0x00a68917
0x00a6891e
0x00a68931
0x00a68933
0x00a6893c
0x00a68941
0x00a68947
0x00a6895a
0x00a6896d
0x00a68972
0x00a68977
0x00a6897a
0x00a6897d
0x00a68984
0x00a6898c
0x00a68993
0x00a68998
0x00a6899a
0x00a6899c
0x00a689a9
0x00a689a9
0x00a6899a
0x00a689ae
0x00000000
0x00a689ae
0x00a688cc
0x00a688cf
0x00a688d6
0x00000000
0x00000000
0x00a688dc
0x00a688e2
0x00000000
0x00a688e2
0x00a688af
0x00a688b6
0x00000000
0x00000000
0x00a688bc
0x00a688c0
0x00000000
0x00000000
0x00000000
0x00a688c0
0x00a6889f
0x00a688a0
0x00a688a3
0x00000000
0x00000000
0x00000000
0x00a688a3
0x00a6882c
0x00a68830
0x00000000
0x00000000
0x00a68832
0x00a68834
0x00000000
0x00000000
0x00a68836
0x00a6883c
0x00a68866
0x00a68866
0x00a68870
0x00a68871
0x00a68873
0x00a68873
0x00a6887f
0x00a68883
0x00000000
0x00a68883
0x00a6883e
0x00a68844
0x00a6884e
0x00a6884e
0x00a68855
0x00000000
0x00000000
0x00a68857
0x00a68861
0x00a68862
0x00000000
0x00a68862
0x00a68846
0x00a6884c
0x00000000
0x00000000
0x00000000
0x00a6884c
0x00a68809
0x00a6880f
0x00000000
0x00000000
0x00a68811
0x00a6881b
0x00a6881b
0x00a6881d
0x00a6881f
0x00a6881f
0x00000000
0x00a6881d
0x00a68813
0x00a68819
0x00000000
0x00000000
0x00000000
0x00a68819
0x00a687f8
0x00000000
0x00a687f8
0x00a687ca
0x00a687dc
0x00a687e1
0x00a687e3
0x00000000
0x00000000
0x00a687e5
0x00a687e7
0x00000000
0x00a687e7
0x00a68628
0x00a6862e
0x00a68631
0x00a68698
0x00a6869d
0x00a686ae
0x00a686b3
0x00a686b6
0x00a686b8
0x00a68705
0x00a68705
0x00a68708
0x00a68708
0x00a6870f
0x00a68664
0x00a68664
0x00a68666
0x00a68722
0x00a68722
0x00a68722
0x00a68724
0x00a68724
0x00000000
0x00a68724
0x00a6866c
0x00a6866c
0x00a6866e
0x00000000
0x00000000
0x00a68676
0x00000000
0x00a68676
0x00a68715
0x00a68717
0x00000000
0x00000000
0x00a68660
0x00a68660
0x00000000
0x00a68660
0x00a686ba
0x00a686c2
0x00000000
0x00000000
0x00a686c4
0x00a686ca
0x00a686d6
0x00a686d7
0x00a686da
0x00a686e8
0x00a686e9
0x00a686f0
0x00a686dc
0x00a686dc
0x00a686dc
0x00a686f5
0x00a686f5
0x00a686f8
0x00a686fa
0x00a6865d
0x00a6865d
0x00000000
0x00a6865d
0x00a68700
0x00000000
0x00a68700
0x00a68633
0x00a68636
0x00000000
0x00000000
0x00a68638
0x00a6863a
0x00a6867c
0x00a6867c
0x00a6867e
0x00000000
0x00000000
0x00a6868a
0x00a68691
0x00000000
0x00a68691
0x00a6863c
0x00a6863f
0x00000000
0x00000000
0x00a68641
0x00a68644
0x00000000
0x00000000
0x00a68653
0x00a68658
0x00a68658
0x00a6865a
0x00000000
0x00a6865a
0x00a685fc
0x00a685fe
0x00000000
0x00000000
0x00a68602
0x00a68603
0x00a68607
0x00000000
0x00000000
0x00a6860b
0x00a6860c
0x00000000
0x00a6860c
0x00a68570
0x00a68576
0x00000000
0x00000000
0x00a68578
0x00a68584
0x00a6858a
0x00a68594
0x00a68597
0x00a68599
0x00a685df
0x00a685df
0x00a685e2
0x00000000
0x00a685e2
0x00a6859b
0x00a685a1
0x00a685a1
0x00a685a3
0x00a685c8
0x00a685ce
0x00a685da
0x00000000
0x00a685da
0x00a685a5
0x00a685af
0x00a685b1
0x00a685b6
0x00a685bc
0x00000000
0x00000000
0x00a685be
0x00000000
0x00000000
0x00a685c0
0x00a685c6
0x00000000
0x00000000
0x00000000
0x00a685c6
0x00a685a7
0x00a685ad
0x00000000
0x00000000
0x00000000
0x00a685ad
0x00a6859d
0x00a6859f
0x00000000
0x00000000
0x00000000
0x00a6859f
0x00a684e4
0x00a684e4
0x00a684e4
0x00a684e4
0x00000000
0x00a684e4
0x00a6849b
0x00a6849e
0x00a6849f
0x00a684a2
0x00a684a4
0x00a684aa
0x00a684af
0x00a684b1
0x00a684c0
0x00a684d2
0x00a684d2
0x00a684b1
0x00000000
0x00a684a2
0x00a68482
0x00a68489
0x00a68490
0x00a684d9
0x00000000
0x00a684d9
0x00000000
0x00a68490
0x00a68433
0x00a68436
0x00a6843d
0x00a68444
0x00a68449
0x00a6844b
0x00000000
0x00000000
0x00a6844d
0x00a68450
0x00a68450
0x00a68456
0x00a6845b
0x00a68461
0x00a68466
0x00000000
0x00a68466
0x00a6832c
0x00a6832f
0x00a6841d
0x00a6841d
0x00a6841f
0x00000000
0x00000000
0x00000000
0x00a68421
0x00a68335
0x00a68338
0x00a6833f
0x00000000
0x00000000
0x00a6834b
0x00a68350
0x00a68355
0x00a68357
0x00a6838e
0x00a6838e
0x00a68392
0x00a6841a
0x00000000
0x00a6841a
0x00a68398
0x00a68398
0x00a6839a
0x00000000
0x00a6839a
0x00a68359
0x00a6835d
0x00000000
0x00000000
0x00a6835f
0x00a68367
0x00a68368
0x00a6836f
0x00a68389
0x00000000
0x00a68389
0x00a6830f
0x00a68222
0x00a68229
0x00a68230
0x00a68236
0x00000000
0x00a68236
0x00a681d2
0x00a681dc
0x00a681e1
0x00a681e3
0x00a681f1
0x00a681fa
0x00a681fc
0x00a68202
0x00a68207
0x00a68207
0x00000000
0x00a681fc
0x00a681e5
0x00000000
0x00a681e5
0x00a68184
0x00a6818a
0x00a6818f
0x00a68191
0x00000000
0x00000000
0x00a68193
0x00a6819a
0x00a681ac
0x00a681ac
0x00000000
0x00a681ac
0x00a6819d
0x00a681a3
0x00a681a8
0x00a681aa
0x00000000
0x00000000
0x00000000
0x00a681aa
0x00a68154
0x00a68157
0x00000000
0x00000000
0x00000000
0x00a68157
0x00a68146
0x00a6814d
0x00000000
0x00000000
0x00000000
0x00a6814d
0x00a6811c
0x00a68123
0x00000000
0x00000000
0x00a68125
0x00a68129
0x00a6812f
0x00000000
0x00000000
0x00000000
0x00a6812f
0x00a680ab
0x00a680b1
0x00a680b4
0x00a680b7
0x00a680b9
0x00000000
0x00000000
0x00000000
0x00a680b9
0x00a67f69
0x00a67f6f
0x00000000
0x00000000
0x00a67f71
0x00a67f78
0x00000000
0x00000000
0x00000000
0x00a67f78
0x00a67ecb
0x00a67ece
0x00a67eed
0x00a67eed
0x00a67ef0
0x00000000
0x00000000
0x00a67ef6
0x00a67efd
0x00000000
0x00000000
0x00a67f09
0x00a67f0a
0x00a67f0c
0x00a67f0d
0x00a67f0e
0x00a67f13
0x00a67f15
0x00a67f3a
0x00000000
0x00a67f17
0x00a67f1e
0x00000000
0x00a67f1e
0x00a67f15
0x00a67ed0
0x00a67ed7
0x00000000
0x00a67edd
0x00a67ee8
0x00000000
0x00a67ee8
0x00a67ed7
0x00a67e94
0x00a67eb2
0x00a67eb2
0x00000000
0x00a67eb2
0x00a67e96
0x00a67e97
0x00a67e9b
0x00a67e9c
0x00a67ea4
0x00a67eb9
0x00a67eb9
0x00000000
0x00a67ea6
0x00a67ead
0x00000000
0x00a67ead

APIs

__EH_prolog.LIBCMT ref: 00A67E25
_memcmp.LIBVCRUNTIME ref: 00A682BD

Part of subcall function 00A67B37: CharUpperW.USER32(00000000,?,00000000,?,?,?,?,?,?,?,00000800,?,00A68115,?,-00001954,?), ref: 00A67BE9

Part of subcall function 00A6708A: CreateHardLinkW.KERNEL32(?,?,00000000,?,00000001,?,?,?,?,?), ref: 00A670B6

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: CharCreateH_prologHardLinkUpper_memcmp
String ID:
API String ID: 2475221875-0
Opcode ID: 4cae8b70307fda2cf18d9c9bd0465e619e3ac4ba073d3d4cc69f55babeab4121
Instruction ID: 1021ff6a9e4cf08c2d11393089242c928850ccb7f908cb404df16697aba0555d
Opcode Fuzzy Hash: 4cae8b70307fda2cf18d9c9bd0465e619e3ac4ba073d3d4cc69f55babeab4121
Instruction Fuzzy Hash: D2722970504285AEDF15DF64C994BFA7BBCAF01304F0842F9ED599B182DF399A89CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A7CEFE Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A7CEFE() {
				_Unknown_base(*)()* _t1;

				_t1 = SetUnhandledExceptionFilter(E00A7CF0A); // executed
				return _t1;
			}

0x00a7cf03
0x00a7cf09

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_0001CF0A,00A7C932), ref: 00A7CF03

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b28633c523d87046e9b4b104cd7c1b1d5991803eacb8acca380af0c3e82be54a
Instruction ID: 3f8d4883b5ef3d38cd1f5f7227684d62efa80fe8d936e67a79dd98521e39fef7
Opcode Fuzzy Hash: b28633c523d87046e9b4b104cd7c1b1d5991803eacb8acca380af0c3e82be54a
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00A78FAC Relevance: 95.2, APIs: 44, Strings: 10, Instructions: 713
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00A78FAC(void* __ecx, void* __edx, void* __eflags, void* __fp0) {
				long _t106;
				long _t107;
				struct HWND__* _t109;
				struct HWND__* _t113;
				void* _t117;
				int _t118;
				void* _t135;
				void* _t138;
				signed int _t150;
				struct HWND__* _t153;
				void* _t164;
				void* _t167;
				int _t170;
				void* _t183;
				void* _t190;
				void* _t191;
				long _t196;
				signed int _t200;
				void* _t223;
				signed int _t233;
				void* _t234;
				void* _t247;
				long _t248;
				long _t249;
				long _t250;
				signed int _t255;
				WCHAR* _t256;
				int _t260;
				void* _t262;
				void* _t267;
				void* _t271;
				signed short _t276;
				int _t278;
				struct HWND__* _t280;
				void* _t286;
				WCHAR* _t287;
				void* _t297;
				intOrPtr _t298;
				void* _t308;
				void* _t309;
				struct HWND__* _t311;
				signed int _t314;
				void* _t315;
				struct HWND__* _t317;
				void* _t319;
				long _t321;
				struct HWND__* _t324;
				void* _t325;
				void* _t326;
				void* _t328;
				void* _t330;
				void* _t332;
				void* _t337;

				_t337 = __fp0;
				_t308 = __edx;
				_t286 = __ecx;
				E00A7C16C(E00A8EF5B, _t330);
				E00A7C240();
				_t276 =  *(_t330 + 0x10);
				_t314 =  *(_t330 + 0xc);
				_t311 =  *(_t330 + 8);
				if(E00A61506(_t308, _t311, _t314, _t276,  *(_t330 + 0x14), L"STARTDLG", 0, 0) == 0) {
					_t315 = _t314 - 0x110;
					__eflags = _t315;
					if(_t315 == 0) {
						_t106 =  *0xab3e04;
						_t278 = 1;
						 *0xaa1720 = _t311;
						 *0xaa8744 = _t311;
						__eflags = _t106;
						if(_t106 != 0) {
							SendMessageW(_t311, 0x80, 1, _t106); // executed
						}
						_t107 =  *0xab4e10;
						__eflags = _t107;
						if(__eflags != 0) {
							SendDlgItemMessageW(_t311, 0x6c, 0x172, 0, _t107); // executed
						}
						E00A7ACC3(_t308, __eflags, _t337, _t311);
						_t109 = GetDlgItem(_t311, 0x68);
						 *(_t330 + 0x14) = _t109;
						SendMessageW(_t109, 0x435, 0, 0x400000);
						E00A781BC(_t330 - 0x1164, 0x800);
						_t113 = GetDlgItem(_t311, 0x66);
						__eflags =  *0xaa875a;
						_t317 = _t113;
						 *(_t330 + 0x10) = _t317;
						_t287 = 0xaa875a;
						if( *0xaa875a == 0) {
							_t287 = _t330 - 0x1164;
						}
						SetWindowTextW(_t317, _t287);
						E00A784FB(_t317); // executed
						_push(0xaa8734);
						_push(0xaa172c);
						_push(0xab3e10);
						_push(_t311);
						 *0xaa874d = 0; // executed
						E00A78986(_t287, _t308, __eflags); // executed
						__eflags =  *0xaa8734;
						if( *0xaa8734 > 0) {
							_push(7);
							_push( *0xaa172c);
							_push(_t311);
							E00A79E5A(_t308);
						}
						__eflags =  *0xab3e03;
						if( *0xab3e03 == 0) {
							SetDlgItemTextW(_t311, 0x6b, E00A6CD14(0xbf)); // executed
							SetDlgItemTextW(_t311, _t278, E00A6CD14(0xbe)); // executed
						}
						__eflags =  *0xaa8734;
						if( *0xaa8734 <= 0) {
							L99:
							__eflags =  *0xaa874d;
							if( *0xaa874d != 0) {
								L110:
								__eflags =  *0xaa8754 - 2;
								if( *0xaa8754 == 2) {
									EnableWindow(_t317, 0);
								}
								__eflags =  *0xaa8750;
								if( *0xaa8750 != 0) {
									E00A614C3(_t311, 0x67, 0);
									E00A614C3(_t311, 0x66, 0);
								}
								_t117 =  *0xaa8754;
								__eflags = _t117;
								if(_t117 != 0) {
									__eflags =  *0xaa1724;
									if( *0xaa1724 == 0) {
										_push(0);
										_push(_t278);
										_push(0x111);
										_push(_t311);
										__eflags = _t117 - _t278;
										if(_t117 != _t278) {
											 *0xa99abc();
										} else {
											SendMessageW(); // executed
										}
									}
								}
								__eflags =  *0xaa1726;
								if( *0xaa1726 != 0) {
									SetDlgItemTextW(_t311, _t278, E00A6CD14(0x90));
								}
								goto L121;
							}
							__eflags =  *0xab4e14;
							if( *0xab4e14 != 0) {
								goto L110;
							}
							__eflags =  *0xaa8754;
							if( *0xaa8754 != 0) {
								goto L110;
							}
							__eflags = 0;
							_t319 = 0xaa;
							 *((short*)(_t330 - 0x9688)) = 0;
							do {
								__eflags = _t319 - 0xaa;
								if(_t319 != 0xaa) {
									L105:
									__eflags = _t319 - 0xab;
									if(_t319 != 0xab) {
										L107:
										E00A82C19(_t330 - 0x9688, " ");
										E00A82C19(_t330 - 0x9688, E00A6CD14(_t319));
										goto L108;
									}
									__eflags =  *0xab3e03;
									if( *0xab3e03 != 0) {
										goto L108;
									}
									goto L107;
								}
								__eflags =  *0xab3e03;
								if( *0xab3e03 == 0) {
									goto L108;
								}
								goto L105;
								L108:
								_t319 = _t319 + 1;
								__eflags = _t319 - 0xb0;
							} while (__eflags <= 0);
							_push(0);
							E00A77CB5( *0xaa8738, __eflags,  *0xa9bbe0,  *(_t330 + 0x14), _t330 - 0x9688, 0);
							_t317 =  *(_t330 + 0x10);
							goto L110;
						} else {
							_push(0);
							_push( *0xaa172c);
							_push(_t311); // executed
							E00A79E5A(_t308); // executed
							_t135 =  *0xab4e14;
							__eflags = _t135;
							if(_t135 != 0) {
								__eflags =  *0xaa8754;
								if(__eflags == 0) {
									_push(0);
									E00A77CB5( *0xaa8738, __eflags,  *0xa9bbe0,  *(_t330 + 0x14), _t135, 0);
									L00A816D0( *0xab4e14);
								}
							}
							__eflags =  *0xaa8754 - _t278;
							if( *0xaa8754 == _t278) {
								L98:
								_push(_t278);
								_push( *0xaa172c);
								_push(_t311);
								E00A79E5A(_t308);
								goto L99;
							} else {
								 *0xa99ae0(_t311);
								__eflags =  *0xaa8754 - _t278;
								if( *0xaa8754 == _t278) {
									goto L98;
								}
								__eflags =  *0xaa8759;
								if( *0xaa8759 != 0) {
									goto L98;
								}
								_t138 = DialogBoxParamW( *0xa9bbe0, L"LICENSEDLG", 0, E00A78E44, 0);
								__eflags = _t138;
								if(_t138 == 0) {
									L24:
									 *0xaa1724 = _t278;
									L25:
									_push(_t278);
									L13:
									 *0xa99acc(_t311);
									L121:
									_t118 = _t278;
									L122:
									 *[fs:0x0] =  *((intOrPtr*)(_t330 - 0xc));
									return _t118;
								}
								goto L98;
							}
						}
					}
					__eflags = _t315 != 1;
					if(_t315 != 1) {
						L7:
						_t118 = 0;
						goto L122;
					}
					_t150 = (_t276 & 0x0000ffff) - 1;
					__eflags = _t150;
					if(_t150 == 0) {
						__eflags =  *0xab7e3c;
						if( *0xab7e3c == 0) {
							_t321 = 0x800;
							GetDlgItemTextW(_t311, 0x66, _t330 - 0x2164, 0x800);
							__eflags =  *0xaa1725;
							if( *0xaa1725 == 0) {
								__eflags =  *0xaa1726;
								if( *0xaa1726 == 0) {
									_t153 = GetDlgItem(_t311, 0x68);
									__eflags =  *0xaa8748;
									_t280 = _t153;
									if( *0xaa8748 == 0) {
										SendMessageW(_t280, 0xb1, 0, 0xffffffff);
										SendMessageW(_t280, 0xc2, 0, 0xa8f5dc);
										_t321 = 0x800;
									}
									SetFocus(_t280);
									__eflags =  *0xaa8750;
									if( *0xaa8750 == 0) {
										E00A6E847(_t330 - 0x1164, _t330 - 0x2164, _t321);
										E00A7AA9E(_t286, _t330 - 0x1164, _t321);
										E00A63CE2(_t330 - 0x4288, 0x880, E00A6CD14(0xb9), _t330 - 0x1164);
										_t332 = _t332 + 0x10;
										_t164 = _t330 - 0x4288;
									} else {
										_t164 = E00A6CD14(0xba);
									}
									E00A7AB1F(0, _t164);
									__eflags =  *0xaa8759;
									if( *0xaa8759 == 0) {
										E00A7B147(_t308, _t330 - 0x2164);
									}
									_push(0);
									_push(_t330 - 0x2164);
									 *(_t330 + 0x17) = 0;
									_t167 = E00A696EF(0, _t308, _t330);
									_t278 = 1;
									__eflags = _t167;
									if(_t167 != 0) {
										L39:
										_t309 = E00A78556(_t330 - 0x2164);
										 *((char*)(_t330 + 0x13)) = _t309;
										__eflags = _t309;
										if(_t309 != 0) {
											L42:
											_t170 =  *(_t330 + 0x17);
											L43:
											_t297 =  *0xaa8759;
											__eflags = _t297;
											if(_t297 != 0) {
												L49:
												__eflags =  *((char*)(_t330 + 0x13));
												if( *((char*)(_t330 + 0x13)) != 0) {
													 *0xaa1728 = _t278;
													E00A614E1(_t311, 0x67, 0);
													E00A614E1(_t311, 0x66, 0);
													SetDlgItemTextW(_t311, _t278, E00A6CD14(0xe6)); // executed
													E00A614E1(_t311, 0x69, _t278);
													SetDlgItemTextW(_t311, 0x65, 0xa8f5dc); // executed
													_t324 = GetDlgItem(_t311, 0x65);
													__eflags = _t324;
													if(_t324 != 0) {
														_t196 = GetWindowLongW(_t324, 0xfffffff0) | 0x00000080;
														__eflags = _t196;
														SetWindowLongW(_t324, 0xfffffff0, _t196);
													}
													_push(5);
													_push( *0xaa172c);
													_push(_t311);
													E00A79E5A(_t309);
													_push(2);
													_push( *0xaa172c);
													_push(_t311);
													E00A79E5A(_t309);
													_push(0xab3e10);
													_push(_t311);
													 *0xab7e3c = _t278; // executed
													E00A7B04A(_t297, _t309, __eflags); // executed
													_push(6);
													_push( *0xaa172c);
													 *0xab7e3c = 0;
													_push(_t311);
													E00A79E5A(_t309);
													__eflags =  *0xaa1724;
													if( *0xaa1724 == 0) {
														__eflags =  *0xaa8748;
														if( *0xaa8748 == 0) {
															__eflags =  *0xab5e28;
															if( *0xab5e28 == 0) {
																_push(4);
																_push( *0xaa172c);
																_push(_t311);
																E00A79E5A(_t309);
															}
														}
													}
													E00A614C3(_t311, _t278, _t278);
													 *0xaa1728 =  *0xaa1728 & 0x00000000;
													__eflags =  *0xaa1728;
													_t183 =  *0xaa1724; // 0x0
													L74:
													__eflags =  *0xaa8748;
													if( *0xaa8748 <= 0) {
														goto L25;
													}
													__eflags = _t183;
													if(_t183 != 0) {
														goto L25;
													}
													 *0xaa1725 = _t278;
													SetDlgItemTextW(_t311, _t278, E00A6CD14(0x90));
													_t298 =  *0xa9bbf8; // 0x3
													__eflags = _t298 - 9;
													if(_t298 != 9) {
														__eflags = _t298 - 3;
														_t190 = ((0 | _t298 != 0x00000003) - 0x00000001 & 0x0000000a) + 0x97;
														__eflags = _t190;
														 *(_t330 + 0x14) = _t190;
														_t325 = _t190;
													} else {
														_t325 = 0xa0;
													}
													_t191 = E00A6CD14(0x96);
													E00A781FE(_t311, E00A6CD14(_t325), _t191, 0x30); // executed
													goto L121;
												}
												__eflags = _t297;
												_t170 = (_t170 & 0xffffff00 | _t297 != 0x00000000) - 0x00000001 &  *(_t330 + 0x17);
												__eflags = _t170;
												L51:
												__eflags = _t170;
												_t200 = _t170 & 0xffffff00 | _t170 == 0x00000000;
												 *(_t330 + 0x17) = _t200;
												__eflags = _t200;
												if(_t200 != 0) {
													L66:
													_push(E00A6CD14(0x9a));
													E00A63CE2(_t330 - 0x5688, 0xa00, L"\"%s\"\n%s", _t330 - 0x2164);
													E00A66ACC(0xa9bbf8, _t278);
													E00A781FE(_t311, _t330 - 0x5688, E00A6CD14(0x96), 0x30);
													 *0xaa8748 =  *0xaa8748 + 1;
													L12:
													_push(0);
													goto L13;
												}
												GetModuleFileNameW(0, _t330 - 0x1164, 0x800);
												E00A6DA58(0xaaa75a, _t330 - 0x164, 0x80);
												_push(0xaa975a);
												_push(_t330 - 0x164);
												E00A63CE2(_t330 - 0x9ca0, 0x230c, L"-el -s2 \"-d%s\" \"-p%s\" \"-sp%s\"", _t330 - 0x2164);
												_t332 = _t332 + 0x18;
												 *((intOrPtr*)(_t330 - 0x48)) = 0x3c;
												 *((intOrPtr*)(_t330 - 0x44)) = 0x40;
												 *((intOrPtr*)(_t330 - 0x38)) = _t330 - 0x1164;
												 *((intOrPtr*)(_t330 - 0x34)) = _t330 - 0x9ca0;
												 *(_t330 - 0x40) = _t311;
												 *((intOrPtr*)(_t330 - 0x3c)) = L"runas";
												 *((intOrPtr*)(_t330 - 0x30)) = 0xa8f4f0;
												 *(_t330 - 0x2c) = _t278;
												 *((intOrPtr*)(_t330 - 0x28)) = 0;
												_t326 = CreateFileMappingW(0xffffffff, 0, 0x8000004, 0, 0x7002, L"winrarsfxmappingfile.tmp");
												 *(_t330 + 8) = _t326;
												__eflags = _t326;
												if(_t326 == 0) {
													 *(_t330 + 0x10) =  *(_t330 + 0x14);
												} else {
													 *0xaa1730 = 0;
													_t234 = GetCommandLineW();
													__eflags = _t234;
													if(_t234 != 0) {
														E00A6E847(0xaa1732, _t234, 0x2000);
													}
													E00A78CC9(0xaaa75a, 0xaa5732, 7);
													E00A78CC9(0xaaa75a, 0xaa6732, 2);
													E00A78CC9(0xaaa75a, 0xaa7732, 0x10);
													 *(_t330 + 0x10) = MapViewOfFile(_t326, 2, 0, 0, 0);
													E00A7EE90(_t239, 0xaa1730, 0x7002);
													_t332 = _t332 + 0xc;
												}
												_t223 =  *0xa99a88(_t330 - 0x48);
												E00A6DC0C(_t330 - 0x164, 0x80);
												E00A6DC0C(_t330 - 0x9ca0, 0x230c);
												__eflags = _t223;
												if(_t223 == 0) {
													_t328 =  *(_t330 + 0x10);
													 *(_t330 + 0x17) = _t278;
													goto L63;
												} else {
													 *0xa99ac0( *(_t330 - 0x10), 0x2710);
													_t73 = _t330 + 0xc;
													 *_t73 =  *(_t330 + 0xc) & 0x00000000;
													__eflags =  *_t73;
													_t328 =  *(_t330 + 0x10);
													while(1) {
														__eflags =  *_t328;
														if( *_t328 != 0) {
															break;
														}
														Sleep(0x64);
														_t233 =  *(_t330 + 0xc) + 1;
														 *(_t330 + 0xc) = _t233;
														__eflags = _t233 - 0x64;
														if(_t233 < 0x64) {
															continue;
														}
														break;
													}
													 *0xab5e28 =  *(_t330 - 0x10);
													L63:
													__eflags =  *(_t330 + 8);
													if( *(_t330 + 8) != 0) {
														UnmapViewOfFile(_t328);
														CloseHandle( *(_t330 + 8));
													}
													__eflags =  *(_t330 + 0x17);
													if( *(_t330 + 0x17) == 0) {
														goto L12;
													} else {
														goto L66;
													}
												}
											}
											__eflags = _t309;
											if(_t309 == 0) {
												goto L51;
											}
											E00A63CE2(_t330 - 0x1164, 0x800, L"__tmp_rar_sfx_access_check_%u", GetTickCount());
											_t332 = _t332 + 0x10;
											E00A68E1D(_t330 - 0x3188);
											 *(_t330 - 4) =  *(_t330 - 4) & 0x00000000;
											_push(0x11);
											_push(_t330 - 0x1164);
											_t247 = E00A68F0D(_t330 - 0x3188);
											 *((char*)(_t330 + 0x13)) = _t247;
											__eflags = _t247;
											if(_t247 == 0) {
												_t248 = GetLastError();
												__eflags = _t248 - 5;
												if(_t248 == 5) {
													 *(_t330 + 0x17) = _t278;
												}
											}
											_t39 = _t330 - 4;
											 *_t39 =  *(_t330 - 4) | 0xffffffff;
											__eflags =  *_t39;
											_t170 = E00A68E53(_t330 - 0x3188); // executed
											_t297 =  *0xaa8759;
											goto L49;
										}
										_t249 = GetLastError();
										_t309 =  *((intOrPtr*)(_t330 + 0x13));
										__eflags = _t249 - 5;
										if(_t249 != 5) {
											goto L42;
										}
										_t170 = _t278;
										 *(_t330 + 0x17) = _t170;
										goto L43;
									} else {
										_t250 = GetLastError();
										__eflags = _t250 - 5;
										if(_t250 == 5) {
											L38:
											 *(_t330 + 0x17) = _t278;
											goto L39;
										}
										__eflags = _t250 - 3;
										if(_t250 != 3) {
											goto L39;
										}
										goto L38;
									}
								}
								_t278 = 1;
								_t183 = 1;
								 *0xaa1724 = 1;
								goto L74;
							}
							_t278 = 1;
							__eflags =  *0xaa1726;
							if( *0xaa1726 == 0) {
								goto L25;
							}
							goto L24;
						} else {
							__eflags =  *0xab7e3d;
							_t255 = _t150 & 0xffffff00 |  *0xab7e3d == 0x00000000;
							__eflags = _t255;
							 *0xab7e3d = _t255;
							_t256 = E00A6CD14((0 | _t255 != 0x00000000) + 0xe6);
							_t278 = 1;
							SetDlgItemTextW(_t311, 1, _t256);
							while(1) {
								__eflags =  *0xab7e3d;
								if( *0xab7e3d == 0) {
									goto L121;
								}
								__eflags =  *0xaa1724;
								if( *0xaa1724 != 0) {
									goto L121;
								}
								_t260 = GetMessageW(_t330 - 0x64, 0, 0, 0);
								__eflags = _t260;
								if(_t260 == 0) {
									goto L121;
								} else {
									_t262 =  *0xa99af4(_t311, _t330 - 0x64);
									__eflags = _t262;
									if(_t262 == 0) {
										TranslateMessage(_t330 - 0x64);
										DispatchMessageW(_t330 - 0x64);
									}
									continue;
								}
							}
							goto L121;
						}
					}
					_t267 = _t150 - 1;
					__eflags = _t267;
					if(_t267 == 0) {
						_t278 = 1;
						__eflags =  *0xaa1728;
						 *0xaa1724 = 1;
						if( *0xaa1728 == 0) {
							goto L12;
						}
						__eflags =  *0xaa8748;
						if( *0xaa8748 != 0) {
							goto L121;
						}
						goto L12;
					}
					__eflags = _t267 == 0x65;
					if(_t267 == 0x65) {
						_t271 = E00A61446(_t311, E00A6CD14(0x64), _t330 - 0x1164);
						__eflags = _t271;
						if(_t271 != 0) {
							SetDlgItemTextW(_t311, 0x66, _t330 - 0x1164);
						}
						goto L1;
					}
					goto L7;
				}
				L1:
				_t118 = 1;
				goto L122;
			}

0x00a78fac
0x00a78fac
0x00a78fac
0x00a78fb1
0x00a78fbb
0x00a78fc1
0x00a78fc5
0x00a78fc9
0x00a78fe2
0x00a78fec
0x00a78fec
0x00a78ff2
0x00a7966e
0x00a79675
0x00a79676
0x00a7967c
0x00a79682
0x00a79684
0x00a7968e
0x00a7968e
0x00a79694
0x00a79699
0x00a7969b
0x00a796a8
0x00a796a8
0x00a796af
0x00a796bd
0x00a796cc
0x00a796cf
0x00a796e1
0x00a796e9
0x00a796eb
0x00a796f3
0x00a796f5
0x00a796f8
0x00a796fd
0x00a796ff
0x00a796ff
0x00a79707
0x00a7970e
0x00a79713
0x00a79718
0x00a7971d
0x00a79722
0x00a79723
0x00a7972a
0x00a7972f
0x00a79736
0x00a79738
0x00a7973a
0x00a79740
0x00a79741
0x00a79741
0x00a79746
0x00a7974d
0x00a7975d
0x00a79770
0x00a79770
0x00a79776
0x00a7977d
0x00a79817
0x00a79817
0x00a7981e
0x00a798c1
0x00a798c1
0x00a798c8
0x00a798cd
0x00a798cd
0x00a798d3
0x00a798da
0x00a798e1
0x00a798eb
0x00a798eb
0x00a798f0
0x00a798f5
0x00a798f7
0x00a798f9
0x00a79900
0x00a79902
0x00a79904
0x00a79905
0x00a7990a
0x00a7990b
0x00a7990d
0x00a79917
0x00a7990f
0x00a7990f
0x00a7990f
0x00a7990d
0x00a79900
0x00a7991d
0x00a79924
0x00a79933
0x00a79933
0x00000000
0x00a79924
0x00a79824
0x00a7982b
0x00000000
0x00000000
0x00a79831
0x00a79838
0x00000000
0x00000000
0x00a7983e
0x00a79840
0x00a79845
0x00a7984c
0x00a7984c
0x00a79852
0x00a7985d
0x00a7985d
0x00a79863
0x00a7986e
0x00a7987a
0x00a7988f
0x00000000
0x00a79895
0x00a79865
0x00a7986c
0x00000000
0x00000000
0x00000000
0x00a7986c
0x00a79854
0x00a7985b
0x00000000
0x00000000
0x00000000
0x00a79896
0x00a79896
0x00a79897
0x00a79897
0x00a798ab
0x00a798b9
0x00a798be
0x00000000
0x00a79783
0x00a79783
0x00a79785
0x00a7978b
0x00a7978c
0x00a79791
0x00a79796
0x00a79798
0x00a7979a
0x00a797a1
0x00a797a9
0x00a797b7
0x00a797c2
0x00a797c7
0x00a797a1
0x00a797c8
0x00a797ce
0x00a7980a
0x00a7980a
0x00a7980b
0x00a79811
0x00a79812
0x00000000
0x00a797d0
0x00a797d1
0x00a797d7
0x00a797dd
0x00000000
0x00000000
0x00a797df
0x00a797e6
0x00000000
0x00000000
0x00a797fc
0x00a79802
0x00a79804
0x00a7912b
0x00a7912b
0x00a79131
0x00a79131
0x00a79062
0x00a79063
0x00a79939
0x00a79939
0x00a7993b
0x00a79941
0x00a7994b
0x00a7994b
0x00000000
0x00a79804
0x00a797ce
0x00a7977d
0x00a78ff8
0x00a78ffb
0x00a7900f
0x00a7900f
0x00000000
0x00a7900f
0x00a79000
0x00a79000
0x00a79003
0x00a7906e
0x00a79075
0x00a79100
0x00a79110
0x00a79116
0x00a7911d
0x00a79137
0x00a7913e
0x00a79152
0x00a79158
0x00a7915f
0x00a79161
0x00a79173
0x00a79182
0x00a79184
0x00a79184
0x00a7918a
0x00a79190
0x00a79197
0x00a791b4
0x00a791c1
0x00a791e4
0x00a791e9
0x00a791ec
0x00a79199
0x00a7919e
0x00a7919e
0x00a791f5
0x00a791fa
0x00a79201
0x00a7920a
0x00a7920a
0x00a7920f
0x00a79219
0x00a7921a
0x00a7921d
0x00a7922a
0x00a7922b
0x00a7922d
0x00a79240
0x00a7924c
0x00a7924e
0x00a79251
0x00a79253
0x00a79266
0x00a79266
0x00a79269
0x00a79269
0x00a7926f
0x00a79271
0x00a792e0
0x00a792e0
0x00a792e4
0x00a79516
0x00a7951c
0x00a79526
0x00a7953e
0x00a79544
0x00a79551
0x00a7955c
0x00a7955e
0x00a79560
0x00a7956b
0x00a7956b
0x00a79574
0x00a79574
0x00a7957a
0x00a7957c
0x00a79582
0x00a79583
0x00a79588
0x00a7958a
0x00a79590
0x00a79591
0x00a79596
0x00a7959b
0x00a7959c
0x00a795a2
0x00a795a7
0x00a795a9
0x00a795af
0x00a795b6
0x00a795b7
0x00a795bc
0x00a795c3
0x00a795c5
0x00a795cc
0x00a795ce
0x00a795d5
0x00a795d7
0x00a795d9
0x00a795df
0x00a795e0
0x00a795e0
0x00a795d5
0x00a795cc
0x00a795e8
0x00a795ed
0x00a795ed
0x00a795f4
0x00a795f9
0x00a795f9
0x00a79600
0x00000000
0x00000000
0x00a79606
0x00a79608
0x00000000
0x00000000
0x00a79613
0x00a79621
0x00a79627
0x00a7962d
0x00a79630
0x00a7963b
0x00a79645
0x00a79645
0x00a7964a
0x00a7964d
0x00a79632
0x00a79632
0x00a79632
0x00a79656
0x00a79664
0x00000000
0x00a79664
0x00a792ea
0x00a792f1
0x00a792f1
0x00a792f4
0x00a792f4
0x00a792f6
0x00a792f9
0x00a792fc
0x00a792fe
0x00a794b6
0x00a794c0
0x00a794d9
0x00a794e7
0x00a79501
0x00a79506
0x00a79060
0x00a79060
0x00000000
0x00a79060
0x00a79312
0x00a79329
0x00a7932e
0x00a79339
0x00a79352
0x00a79357
0x00a7935a
0x00a79367
0x00a7936e
0x00a79377
0x00a7938f
0x00a79392
0x00a79399
0x00a793a0
0x00a793a3
0x00a793ac
0x00a793ae
0x00a793b1
0x00a793b3
0x00a79423
0x00a793b5
0x00a793b5
0x00a793bc
0x00a793c2
0x00a793c4
0x00a793d1
0x00a793d1
0x00a793dd
0x00a793e9
0x00a793f5
0x00a79413
0x00a79416
0x00a7941b
0x00a7941b
0x00a7942a
0x00a7943e
0x00a7944f
0x00a79454
0x00a79456
0x00a79490
0x00a79493
0x00000000
0x00a79458
0x00a79460
0x00a79466
0x00a79466
0x00a79466
0x00a7946a
0x00a7946d
0x00a7946d
0x00a79470
0x00000000
0x00000000
0x00a79474
0x00a7947d
0x00a7947e
0x00a79481
0x00a79484
0x00000000
0x00000000
0x00000000
0x00a79484
0x00a79489
0x00a79496
0x00a79496
0x00a7949a
0x00a7949d
0x00a794a6
0x00a794a6
0x00a794ac
0x00a794b0
0x00000000
0x00000000
0x00000000
0x00000000
0x00a794b0
0x00a79456
0x00a79273
0x00a79275
0x00000000
0x00000000
0x00a7928f
0x00a79294
0x00a7929d
0x00a792a2
0x00a792ac
0x00a792ae
0x00a792b5
0x00a792ba
0x00a792bd
0x00a792bf
0x00a792c1
0x00a792c3
0x00a792c6
0x00a792c8
0x00a792c8
0x00a792c6
0x00a792cb
0x00a792cb
0x00a792cb
0x00a792d5
0x00a792da
0x00000000
0x00a792da
0x00a79255
0x00a79257
0x00a7925a
0x00a7925d
0x00000000
0x00000000
0x00a7925f
0x00a79261
0x00000000
0x00a7922f
0x00a7922f
0x00a79231
0x00a79234
0x00a7923b
0x00a7923d
0x00000000
0x00a7923d
0x00a79236
0x00a79239
0x00000000
0x00000000
0x00000000
0x00a79239
0x00a7922d
0x00a79142
0x00a79143
0x00a79145
0x00000000
0x00a79145
0x00a79121
0x00a79122
0x00a79129
0x00000000
0x00000000
0x00000000
0x00a7907b
0x00a7907b
0x00a79082
0x00a79087
0x00a79089
0x00a79098
0x00a790a0
0x00a790a3
0x00a790f2
0x00a790f2
0x00a790f9
0x00a790fb
0x00a790fb
0x00a790ab
0x00a790b2
0x00000000
0x00000000
0x00a790c1
0x00a790c7
0x00a790c9
0x00000000
0x00a790cf
0x00a790d4
0x00a790da
0x00a790dc
0x00a790e2
0x00a790ec
0x00a790ec
0x00000000
0x00a790dc
0x00a790c9
0x00000000
0x00a790f2
0x00a79075
0x00a79005
0x00a79005
0x00a79008
0x00a79043
0x00a79044
0x00a7904b
0x00a79051
0x00000000
0x00000000
0x00a79053
0x00a7905a
0x00000000
0x00000000
0x00000000
0x00a7905a
0x00a7900a
0x00a7900d
0x00a79026
0x00a7902b
0x00a7902d
0x00a79039
0x00a79039
0x00000000
0x00a7902d
0x00000000
0x00a7900d
0x00a78fe4
0x00a78fe6
0x00000000

APIs

__EH_prolog.LIBCMT ref: 00A78FB1

Strings

@, xrefs: 00A79367
"%s"%s, xrefs: 00A794C8
PH]w, xrefs: 00A79110
<, xrefs: 00A7935A
STARTDLG, xrefs: 00A78FD0
-el -s2 "-d%s" "-p%s" "-sp%s", xrefs: 00A79341
winrarsfxmappingfile.tmp, xrefs: 00A7937C
@Mqt0Lqt, xrefs: 00A79222
__tmp_rar_sfx_access_check_%u, xrefs: 00A7927E
LICENSEDLG, xrefs: 00A797F1

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: H_prolog
String ID: "%s"%s$-el -s2 "-d%s" "-p%s" "-sp%s"$<$@$@Mqt0Lqt$LICENSEDLG$PH]w$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 3519838083-3743664477
Opcode ID: 97e8d09fae465db8db07dc1fdefd12b4de9fa7e1f8ad8f42da85dd62ad1b6875
Instruction ID: 7395ae3b312a397855b3127475267e1b368d019e70d3dda4438779ebd8f14860
Opcode Fuzzy Hash: 97e8d09fae465db8db07dc1fdefd12b4de9fa7e1f8ad8f42da85dd62ad1b6875
Instruction Fuzzy Hash: 8432D771A40315BEEB21EBA49D49FAB3BBCEB06740F10C05AF509A60D2CB794D46CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A79E5A Relevance: 52.9, APIs: 26, Strings: 4, Instructions: 435
windowfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 55%

			E00A79E5A(void* __edx) {
				intOrPtr _t221;
				void* _t226;
				intOrPtr _t284;
				void* _t297;
				WCHAR* _t299;
				void* _t302;
				WCHAR* _t303;
				void* _t308;

				_t297 = __edx;
				E00A7C16C(E00A8EF70, _t308);
				_t221 = 0x1bc80;
				E00A7C240();
				if( *((intOrPtr*)(_t308 + 0xc)) == 0) {
					L169:
					 *[fs:0x0] =  *((intOrPtr*)(_t308 - 0xc));
					return _t221;
				}
				_push(0x1000);
				_t2 = _t308 - 0xe; // -14
				_t3 = _t308 - 0xd; // -13
				_t4 = _t308 - 0x5c84; // -23684
				_t5 = _t308 - 0xfc8c; // -64652
				_push( *((intOrPtr*)(_t308 + 0xc)));
				_t221 = E00A78BD1();
				 *((intOrPtr*)(_t308 + 0xc)) = 0x1bc80;
				if(0x1bc80 != 0) {
					_t284 =  *((intOrPtr*)(_t308 + 0x10));
					do {
						_t9 = _t308 - 0x5c84; // -23684
						_t226 = _t9;
						_t10 = _t308 - 0x1bc8c; // -113804
						_t302 = _t10;
						_t299 = 6;
						goto L4;
						while(1) {
							L6:
							_t13 = _t308 - 0xfc8c; // -64652
							if(E00A700DF(_t13,  *((intOrPtr*)(0xa99168 + _t303 * 4))) == 0) {
								break;
							}
							_t303 =  &(_t303[0]);
							if(_t303 < 0xe) {
								continue;
							} else {
								goto L167;
							}
						}
						if(_t303 > 0xd) {
							goto L167;
						}
						switch( *((intOrPtr*)(_t303 * 4 +  &M00A7AA66))) {
							case 0:
								__eflags = _t284 - 2;
								if(_t284 != 2) {
									goto L167;
								}
								_t305 = 0x800;
								_t16 = _t308 - 0x7c84; // -31876
								E00A781BC(_t16, 0x800);
								_t17 = _t308 - 0xdc8c; // -56460
								_t18 = _t308 - 0x5c84; // -23684
								_t19 = _t308 - 0x7c84; // -31876
								_t238 = E00A6AF10(_t19, _t18, _t17, 0x800);
								_t20 = _t308 - 0x8c8c; // -35980
								E00A69B3D(_t238, _t284, _t20, 0x800);
								_t21 = _t308 - 0xdc8c; // -56460
								 *(_t308 - 4) = _t299;
								_t23 = _t308 - 0x8c8c; // -35980
								E00A69C77(_t23, _t21);
								_t24 = _t308 - 0x3c84; // -15492
								E00A66BA0(_t24);
								_push(_t299);
								_t25 = _t308 - 0x3c84; // -15492
								_t26 = _t308 - 0x8c8c; // -35980
								_t292 = _t26;
								_t244 = E00A69BCA(_t26, _t297, _t25);
								__eflags = _t244;
								if(_t244 == 0) {
									L28:
									 *(_t308 - 4) =  *(_t308 - 4) | 0xffffffff;
									_t57 = _t308 - 0x8c8c; // -35980
									E00A69B53(_t57);
									goto L167;
								} else {
									goto L15;
									L16:
									_t29 = _t308 - 0x103c; // -4156
									_t30 = _t308 - 0x7c84; // -31876
									E00A6AAAE(_t292, __eflags, _t30, _t29, _t305);
									_t31 = _t308 - 0x103c; // -4156
									E00A6A7A3(__eflags, _t31, _t305);
									_t32 = _t308 - 0x7c84; // -31876
									_t307 = E00A816B5(_t32);
									__eflags = _t307 - 4;
									if(_t307 < 4) {
										L18:
										_t34 = _t308 - 0x5c84; // -23684
										_t272 = E00A6AEEC(_t34);
										__eflags = _t272;
										if(_t272 != 0) {
											goto L28;
										}
										L19:
										_t35 = _t308 - 0x3c84; // -15492
										_t274 = E00A816B5(_t35);
										__eflags = 0;
										 *((short*)(_t308 + _t274 * 2 - 0x3c82)) = 0;
										_t39 = _t308 - 0x3c; // -60
										E00A7D1E0(_t299, _t39, _t299, 0x1e);
										_t310 = _t310 + 0x10;
										 *((intOrPtr*)(_t308 - 0x38)) = 3;
										_push(0x14);
										_pop(_t277);
										 *((short*)(_t308 - 0x2c)) = _t277;
										_t42 = _t308 - 0x3c84; // -15492
										 *((intOrPtr*)(_t308 - 0x34)) = _t42;
										_t44 = _t308 - 0x3c; // -60
										_push(_t44);
										 *0xa99a84();
										goto L20;
									}
									_t33 = _t308 - 0x103c; // -4156
									_t282 = E00A816B5(_t33);
									__eflags = _t307 - _t282;
									if(_t307 > _t282) {
										goto L19;
									}
									goto L18;
									L20:
									_t45 = _t308 - 0x3c84; // -15492
									_t249 = GetFileAttributesW(_t45);
									__eflags = _t249 - 0xffffffff;
									if(_t249 == 0xffffffff) {
										L27:
										_push(_t299);
										_t53 = _t308 - 0x3c84; // -15492
										_t54 = _t308 - 0x8c8c; // -35980
										_t292 = _t54;
										_t251 = E00A69BCA(_t54, _t297, _t53);
										__eflags = _t251;
										if(_t251 != 0) {
											_t305 = 0x800;
											L15:
											_t27 = _t308 - 0x3c84; // -15492
											SetFileAttributesW(_t27, _t299);
											__eflags =  *((char*)(_t308 - 0x2c78));
											if(__eflags == 0) {
												goto L20;
											}
											goto L16;
										}
										goto L28;
									}
									_t46 = _t308 - 0x3c84; // -15492
									_t253 = DeleteFileW(_t46);
									__eflags = _t253;
									if(_t253 != 0) {
										goto L27;
									} else {
										_t306 = _t299;
										_push(_t299);
										goto L24;
										L24:
										_t47 = _t308 - 0x3c84; // -15492
										_t48 = _t308 - 0x103c; // -4156
										E00A63CE2(_t48, 0x800, L"%s.%d.tmp", _t47);
										_t310 = _t310 + 0x14;
										_t49 = _t308 - 0x103c; // -4156
										_t258 = GetFileAttributesW(_t49);
										__eflags = _t258 - 0xffffffff;
										if(_t258 != 0xffffffff) {
											_t306 = _t306 + 1;
											__eflags = _t306;
											_push(_t306);
											goto L24;
										} else {
											_t50 = _t308 - 0x103c; // -4156
											_t51 = _t308 - 0x3c84; // -15492
											_t261 = MoveFileW(_t51, _t50);
											__eflags = _t261;
											if(_t261 != 0) {
												_t52 = _t308 - 0x103c; // -4156
												MoveFileExW(_t52, _t299, 4);
											}
											goto L27;
										}
									}
								}
							case 1:
								__eflags = __ebx;
								if(__ebx == 0) {
									__bh =  *((intOrPtr*)(__ebp - 0xd));
									__eflags = __bh;
									if(__eflags == 0) {
										_t62 = __ebp + 0xc; // 0xc
										__eax = _t62;
										_push(_t62);
										__esi = E00A78D29(__ecx, __edx, __eflags);
										__eax =  *0xab4e14;
									} else {
										_t61 = __ebp - 0x5c84; // -23684
										__esi = _t61;
									}
									__eflags = __bl;
									if(__bl == 0) {
										__edi = __eax;
									}
									__eax = E00A816B5(__esi);
									__eax = __eax + __edi;
									_push(__eax);
									_push( *0xab4e14);
									__eax = E00A816D5(__ecx, __edx);
									__esp = __esp + 0xc;
									__eflags = __eax;
									if(__eax != 0) {
										 *0xab4e14 = __eax;
										__eflags = __bl;
										if(__bl != 0) {
											__ecx = 0;
											__eflags = 0;
											 *__eax = __cx;
										}
										__eax = E00A82C19(__eax, __esi);
										_pop(__ecx);
										_pop(__ecx);
									}
									__eflags = __bh;
									if(__bh == 0) {
										__eax = L00A816D0(__esi);
									}
								}
								goto L167;
							case 2:
								__eflags = __ebx;
								if(__ebx == 0) {
									_t65 = __ebp - 0x5c84; // -23684
									_t65 = SetWindowTextW( *(__ebp + 8), _t65);
								}
								goto L167;
							case 3:
								__eflags = __ebx;
								if(__ebx != 0) {
									goto L167;
								}
								__eflags =  *0xaa875a - __di;
								if( *0xaa875a != __di) {
									goto L167;
								}
								__eax = 0;
								_t67 = __ebp - 0x5c84; // -23684
								__edi = _t67;
								_push(0x22);
								 *(__ebp - 0x103c) = __ax;
								_pop(__eax);
								__eflags =  *(__ebp - 0x5c84) - __ax;
								if( *(__ebp - 0x5c84) == __ax) {
									_t70 = __ebp - 0x5c82; // -23682
									__edi = _t70;
								}
								__eax = E00A816B5(__edi);
								__eflags = __eax - 0x800;
								if(__eax >= 0x800) {
									goto L167;
								} else {
									__eax =  *__edi & 0x0000ffff;
									_push(0x5c);
									_pop(__esi);
									__eflags = ( *__edi & 0x0000ffff) - 0x2e;
									if(( *__edi & 0x0000ffff) != 0x2e) {
										L54:
										__eflags = __ax - __si;
										if(__ax == __si) {
											L66:
											_t93 = __ebp - 0x103c; // -4156
											_t93 = E00A81693(_t93, __edi);
											__ebx = 0;
											__eflags = 0;
											L67:
											_pop(__ecx);
											_pop(__ecx);
											L68:
											_push(0x22);
											_pop(__eax);
											_t94 = __ebp - 0x103c; // -4156
											__eax = _t94;
											__eax = E00A7F64B(_t94, _t94);
											_pop(__ecx);
											_pop(__ecx);
											__eflags = __eax;
											if(__eax != 0) {
												__eflags =  *((intOrPtr*)(__eax + 2)) - __bx;
												if( *((intOrPtr*)(__eax + 2)) == __bx) {
													__ecx = 0;
													__eflags = 0;
													 *__eax = __cx;
												}
											}
											_t96 = __ebp - 0x103c; // -4156
											__eax = _t96;
											__edi = 0xab4e28;
											__eax = E00A81693(0xab4e28, _t96);
											_pop(__ecx);
											_pop(__ecx);
											_t97 = __ebp - 0x103c; // -4156
											_t97 = E00A78A7C(__edx, _t97, 0x800);
											__esi = GetDlgItem( *(__ebp + 8), 0x66);
											_t99 = __ebp - 0x103c; // -4156
											_t99 = SetWindowTextW(__esi, _t99); // executed
											__ebx =  *0xa99ab8;
											__eax = SendMessageW(__esi, 0x143, __ebx, 0xab4e28);
											_t100 = __ebp - 0x103c; // -4156
											__eax = _t100;
											__eax = E00A816E0(_t100, 0xab4e28, __eax);
											_pop(__ecx);
											_pop(__ecx);
											__eflags = __eax;
											if(__eax != 0) {
												_t101 = __ebp - 0x103c; // -4156
												__eax = SendMessageW(__esi, 0x143, 0, 0);
											}
											goto L167;
										}
										__eflags = __ax;
										if(__ax == 0) {
											L57:
											_t74 = __ebp - 0x18; // -24
											__eax = _t74;
											__ebx = 0;
											__eax = RegOpenKeyExW(0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion", 0, 1, _t74); // executed
											__eflags = __eax;
											if(__eax == 0) {
												_t75 = __ebp - 0x14; // -20
												__eax = _t75;
												 *(__ebp - 0x14) = 0x1000;
												_t77 = __ebp - 0x103c; // -4156
												__eax = _t77;
												_t78 = __ebp - 0x1c; // -28
												_t78 = RegQueryValueExW( *(__ebp - 0x18), L"ProgramFilesDir", 0, _t78, _t77, _t75); // executed
												__eax = RegCloseKey( *(__ebp - 0x18)); // executed
												__eax =  *(__ebp - 0x14);
												__ecx = 0x7ff;
												__eax =  *(__ebp - 0x14) >> 1;
												__eflags = __eax - 0x7ff;
												if(__eax >= 0x7ff) {
													__eax = 0x7ff;
												}
												__ecx = 0;
												__eflags = 0;
												 *(__ebp + __eax * 2 - 0x103c) = __cx;
											}
											__eflags =  *(__ebp - 0x103c) - __bx;
											if( *(__ebp - 0x103c) != __bx) {
												_t86 = __ebp - 0x103c; // -4156
												__eax = _t86;
												__eax = E00A816B5(_t86);
												__eflags =  *((intOrPtr*)(__ebp + __eax * 2 - 0x103e)) - __si;
												if( *((intOrPtr*)(__ebp + __eax * 2 - 0x103e)) != __si) {
													_t90 = __ebp - 0x103c; // -4156
													_t90 = E00A82C19(_t90, "\\");
													_pop(__ecx);
													_pop(__ecx);
												}
											}
											__esi = E00A816B5(__edi);
											_t91 = __ebp - 0x103c; // -4156
											__eax = _t91;
											__esi = __esi + E00A816B5(_t91);
											__eflags = __esi - 0x7ff;
											if(__esi >= 0x7ff) {
												goto L68;
											} else {
												_t92 = __ebp - 0x103c; // -4156
												_t92 = E00A82C19(_t92, __edi);
												goto L67;
											}
										}
										__eflags =  *((short*)(__edi + 2)) - 0x3a;
										if( *((short*)(__edi + 2)) == 0x3a) {
											goto L66;
										}
										goto L57;
									}
									__eflags =  *((intOrPtr*)(__edi + 2)) - __si;
									if( *((intOrPtr*)(__edi + 2)) != __si) {
										goto L54;
									}
									__edi = __edi + 4;
									__ebx = 0;
									__eflags =  *__edi - __bx;
									if( *__edi == __bx) {
										goto L167;
									} else {
										_t72 = __ebp - 0x103c; // -4156
										_t72 = E00A81693(_t72, __edi);
										goto L67;
									}
								}
							case 4:
								__eflags =  *0xaa8754 - 1;
								__eflags = __eax - 0xaa8754;
								 *__edi =  *__edi + __ecx;
								__eflags =  *(__edx + 6) & __bl;
								 *__eax =  *__eax + __al;
								__eflags =  *__eax;
							case 5:
								__eax =  *(__ebp - 0x5c84) & 0x0000ffff;
								__ecx = 0;
								__eax =  *(__ebp - 0x5c84) & 0x0000ffff;
								__eflags = __eax;
								if(__eax == 0) {
									L85:
									 *0xaa1727 = __cl;
									 *0xaa8732 = 1;
									goto L167;
								}
								__eax = __eax - 0x30;
								__eflags = __eax;
								if(__eax == 0) {
									 *0xaa1727 = __cl;
									L84:
									 *0xaa8732 = __cl;
									goto L167;
								}
								__eax = __eax - 1;
								__eflags = __eax;
								if(__eax == 0) {
									goto L85;
								}
								__eax = __eax - 1;
								__eflags = __eax;
								if(__eax != 0) {
									goto L167;
								}
								 *0xaa1727 = 1;
								goto L84;
							case 6:
								__eflags = __ebx - 4;
								if(__ebx != 4) {
									goto L95;
								}
								__eax = __ebp - 0x5c84;
								__eax = E00A816E0(__ebp - 0x5c84, __eax, L"<>");
								_pop(__ecx);
								_pop(__ecx);
								__eflags = __eax;
								if(__eax == 0) {
									goto L95;
								}
								_push(__edi);
								goto L94;
							case 7:
								__eflags = __ebx - 1;
								if(__eflags != 0) {
									L115:
									__eflags = __ebx - 7;
									if(__ebx == 7) {
										__eflags =  *0xaa8754;
										if( *0xaa8754 == 0) {
											 *0xaa8754 = 2;
										}
										 *0xaa8750 = 1;
									}
									goto L167;
								}
								__eax = __ebp - 0x7c84;
								__edi = 0x800;
								GetTempPathW(0x800, __ebp - 0x7c84) = __ebp - 0x7c84;
								E00A6A7A3(__eflags, __ebp - 0x7c84, 0x800) = 0;
								_push(0);
								_push( *0xa9914c);
								__esi = 0;
								__ebp - 0x7c84 = __ebp - 0x103c;
								__eax = E00A63CE2(__ebp - 0x103c, 0x800, L"%s%s%d", __ebp - 0x7c84);
								__edi = GetFileAttributesW;
								while(1) {
									__esp = __esp + 0x18;
									__eax = __ebp - 0x103c;
									__eax = GetFileAttributesW(__ebp - 0x103c);
									__eflags = __eax - 0xffffffff;
									if(__eax == 0xffffffff) {
										break;
									}
									__esi =  &(__esi->i);
									__eflags = __esi;
									__eax = __ebp - 0x7c84;
									_push(__esi);
									_push( *0xa9914c);
									__ebp - 0x103c = E00A63CE2(__ebp - 0x103c, 0x800, L"%s%s%d", __ebp - 0x7c84);
								}
								__ebp - 0x103c = SetDlgItemTextW( *(__ebp + 8), 0x66, __ebp - 0x103c);
								__eflags =  *(__ebp - 0x5c84);
								if( *(__ebp - 0x5c84) == 0) {
									goto L167;
								}
								__eflags =  *0xaa874f;
								if( *0xaa874f != 0) {
									goto L167;
								}
								__eax = 0;
								 *(__ebp - 0x143c) = __ax;
								__eax = __ebp - 0x5c84;
								_push(0x2c);
								_push(__ebp - 0x5c84);
								__eax = E00A7F472(__ecx);
								_pop(__ecx);
								_pop(__ecx);
								__eflags = __eax;
								if(__eax != 0) {
									L111:
									__eflags =  *(__ebp - 0x143c);
									if( *(__ebp - 0x143c) == 0) {
										__ebp - 0x1bc8c = __ebp - 0x5c84;
										E00A81693(__ebp - 0x5c84, __ebp - 0x1bc8c) = __ebp - 0x19c8c;
										__ebp - 0x143c = E00A81693(__ebp - 0x143c, __ebp - 0x19c8c);
									}
									__ebp - 0x5c84 = E00A786EA(__ebp - 0x5c84);
									__eax = 0;
									 *(__ebp - 0x4c84) = __ax;
									__ebp - 0x143c = __ebp - 0x5c84;
									__eax = E00A781FE( *(__ebp + 8), __ebp - 0x5c84, __ebp - 0x143c, 0x24);
									__eflags = __eax - 6;
									if(__eax == 6) {
										goto L167;
									} else {
										_push(1);
										_push( *(__ebp + 8));
										 *0xaa874e = 1;
										 *0xaa1724 = 1;
										__eax =  *0xa99acc();
										goto L115;
									}
								}
								__edi = 0;
								__esi = 0;
								__eflags =  *(__ebp - 0x5c84) - __si;
								if( *(__ebp - 0x5c84) == __si) {
									goto L111;
								}
								__eax = __ebp - 0x5c84;
								while(1) {
									__eflags =  *__eax - 0x40;
									if( *__eax == 0x40) {
										break;
									}
									__esi =  &(__esi->i);
									__eax = __ebp - 0x5c84;
									__eax =  &((__ebp - 0x5c84)[__esi]);
									__eflags =  *__eax - __di;
									if( *__eax != __di) {
										continue;
									}
									goto L111;
								}
								__ebp - 0x5c82 = __ebp - 0x5c82 + __esi * 2;
								__ebp - 0x143c = E00A81693(__ebp - 0x143c, __ebp - 0x143c);
								_pop(__ecx);
								__eax = 0;
								__eflags = 0;
								_pop(__ecx);
								 *(__ebp + __esi * 2 - 0x5c84) = __ax;
								goto L111;
							case 8:
								__eflags = __ebx - 3;
								if(__ebx == 3) {
									__eflags =  *(__ebp - 0x5c84) - __di;
									if(__eflags != 0) {
										__ebp - 0x5c84 = SetWindowTextW( *(__ebp + 8), __ebp - 0x5c84);
									}
									__eax = __ebp + 0xc;
									_push(__ebp + 0xc);
									 *0xab4e18 = E00A78D29(__ecx, __edx, __eflags);
								}
								 *0xab3e02 = 1;
								goto L167;
							case 9:
								__eflags = __ebx - 5;
								if(__ebx != 5) {
									L95:
									 *0xab3e03 = 1;
									goto L167;
								}
								_push(1);
								L94:
								__eax = __ebp - 0x5c84;
								_push(__ebp - 0x5c84);
								_push( *(__ebp + 8));
								__eax = E00A7ADB9();
								goto L95;
							case 0xa:
								__eflags = __ebx - 6;
								if(__ebx != 6) {
									goto L167;
								}
								__eax = 0;
								 *(__ebp - 0x2c3c) = __ax;
								__eax =  *(__ebp - 0x1bc8c) & 0x0000ffff;
								__eax = E00A830A4( *(__ebp - 0x1bc8c) & 0x0000ffff);
								_push(0x800);
								__eflags = __eax - 0x50;
								if(__eax == 0x50) {
									_push(0xaa6732);
									__eax = __ebp - 0x2c3c;
									_push(__ebp - 0x2c3c);
									__eax = E00A6E847();
									 *(__ebp - 0x14) = 2;
								} else {
									__eflags = __eax - 0x54;
									__eax = __ebp - 0x2c3c;
									if(__eflags == 0) {
										_push(0xaa5732);
										_push(__eax);
										__eax = E00A6E847();
										 *(__ebp - 0x14) = 7;
									} else {
										_push(0xaa7732);
										_push(__eax);
										__eax = E00A6E847();
										 *(__ebp - 0x14) = 0x10;
									}
								}
								__eax = 0;
								 *(__ebp - 0x9c8c) = __ax;
								 *(__ebp - 0x1c3c) = __ax;
								__ebp - 0x19c8c = __ebp - 0x6c84;
								__eax = E00A81693(__ebp - 0x6c84, __ebp - 0x19c8c);
								_pop(__ecx);
								_pop(__ecx);
								_push(0x22);
								_pop(__ebx);
								__eflags =  *(__ebp - 0x6c84) - __bx;
								if( *(__ebp - 0x6c84) != __bx) {
									__ebp - 0x6c84 = E00A69820(__ebp - 0x6c84);
									__eflags = __al;
									if(__al != 0) {
										goto L152;
									}
									__ebx = __edi;
									__esi = __ebp - 0x6c84;
									__eflags =  *(__ebp - 0x6c84) - __bx;
									if( *(__ebp - 0x6c84) == __bx) {
										goto L152;
									}
									_push(0x20);
									_pop(__ecx);
									do {
										__eax = __esi->i & 0x0000ffff;
										__eflags = __ax - __cx;
										if(__ax == __cx) {
											L140:
											__edi = __eax;
											__eax = 0;
											__esi->i = __ax;
											__ebp - 0x6c84 = E00A69820(__ebp - 0x6c84);
											__eflags = __al;
											if(__al == 0) {
												__esi->i = __di;
												L148:
												_push(0x20);
												_pop(__ecx);
												__edi = 0;
												__eflags = 0;
												goto L149;
											}
											_push(0x2f);
											_pop(__eax);
											__ebx = __esi;
											__eflags = __di - __ax;
											if(__di != __ax) {
												_push(0x20);
												_pop(__eax);
												do {
													__esi =  &(__esi->i);
													__eflags = __esi->i - __ax;
												} while (__esi->i == __ax);
												_push(__esi);
												__eax = __ebp - 0x1c3c;
												L146:
												_push(__eax);
												__eax = E00A81693();
												_pop(__ecx);
												_pop(__ecx);
												 *__ebx = __di;
												goto L148;
											}
											 *(__ebp - 0x1c3c) = __ax;
											__eax =  &(__esi->i);
											_push( &(__esi->i));
											__eax = __ebp - 0x1c3a;
											goto L146;
										}
										_push(0x2f);
										_pop(__edx);
										__eflags = __ax - __dx;
										if(__ax != __dx) {
											goto L149;
										}
										goto L140;
										L149:
										__esi =  &(__esi->i);
										__eflags = __esi->i - __di;
									} while (__esi->i != __di);
									__eflags = __ebx;
									if(__ebx != 0) {
										__eax = 0;
										__eflags = 0;
										 *__ebx = __ax;
									}
									goto L152;
								} else {
									__ebp - 0x19c8a = __ebp - 0x6c84;
									E00A81693(__ebp - 0x6c84, __ebp - 0x19c8a) = __ebp - 0x6c82;
									_push(__ebx);
									_push(__ebp - 0x6c82);
									__eax = E00A7F472(__ecx);
									__esp = __esp + 0x10;
									__eflags = __eax;
									if(__eax != 0) {
										__ecx = 0;
										 *__eax = __cx;
										__ebp - 0x1c3c = E00A81693(__ebp - 0x1c3c, __ebp - 0x1c3c);
										_pop(__ecx);
										_pop(__ecx);
									}
									L152:
									__eflags =  *(__ebp - 0x11c8c);
									__ebx = 0x800;
									if( *(__ebp - 0x11c8c) != 0) {
										_push(0x800);
										__eax = __ebp - 0x9c8c;
										_push(__ebp - 0x9c8c);
										__eax = __ebp - 0x11c8c;
										_push(__ebp - 0x11c8c);
										__eax = E00A6A7D3(__edx);
									}
									_push(__ebx);
									__eax = __ebp - 0xbc8c;
									_push(__ebp - 0xbc8c);
									__eax = __ebp - 0x6c84;
									_push(__ebp - 0x6c84);
									__eax = E00A6A7D3(__edx);
									__eflags =  *(__ebp - 0x2c3c);
									if(__eflags == 0) {
										__ebp - 0x2c3c = E00A78CC9(__ecx, __ebp - 0x2c3c,  *(__ebp - 0x14));
									}
									__ebp - 0x2c3c = E00A6A7A3(__eflags, __ebp - 0x2c3c, __ebx);
									__eflags =  *((short*)(__ebp - 0x17c8c));
									if(__eflags != 0) {
										__ebp - 0x17c8c = __ebp - 0x2c3c;
										E00A6E81B(__eflags, __ebp - 0x2c3c, __ebp - 0x17c8c, __ebx) = __ebp - 0x2c3c;
										__eax = E00A6A7A3(__eflags, __ebp - 0x2c3c, __ebx);
									}
									__ebp - 0x2c3c = __ebp - 0xcc8c;
									__eax = E00A81693(__ebp - 0xcc8c, __ebp - 0x2c3c);
									__eflags =  *(__ebp - 0x13c8c);
									__eax = __ebp - 0x13c8c;
									_pop(__ecx);
									_pop(__ecx);
									if(__eflags == 0) {
										__eax = __ebp - 0x19c8c;
									}
									__ebp - 0x2c3c = E00A6E81B(__eflags, __ebp - 0x2c3c, __ebp - 0x2c3c, __ebx);
									__eax = __ebp - 0x2c3c;
									__eflags = E00A6AA4A(__ebp - 0x2c3c);
									if(__eflags == 0) {
										L162:
										__ebp - 0x2c3c = E00A6E81B(__eflags, __ebp - 0x2c3c, L".lnk", __ebx);
										goto L163;
									} else {
										__eflags = __eax;
										if(__eflags == 0) {
											L163:
											_push(1);
											__eax = __ebp - 0x2c3c;
											_push(__ebp - 0x2c3c);
											E00A696EF(__ecx, __edx, __ebp) = __ebp - 0xbc8c;
											__ebp - 0xac8c = E00A81693(__ebp - 0xac8c, __ebp - 0xbc8c);
											_pop(__ecx);
											_pop(__ecx);
											__ebp - 0xac8c = E00A6B213(__eflags, __ebp - 0xac8c);
											__ecx =  *(__ebp - 0x1c3c) & 0x0000ffff;
											__eax = __ebp - 0x1c3c;
											__ecx =  ~( *(__ebp - 0x1c3c) & 0x0000ffff);
											__edx = __ebp - 0x9c8c;
											__esi = __ebp - 0xac8c;
											asm("sbb ecx, ecx");
											__ecx =  ~( *(__ebp - 0x1c3c) & 0x0000ffff) & __ebp - 0x00001c3c;
											 *(__ebp - 0x9c8c) & 0x0000ffff =  ~( *(__ebp - 0x9c8c) & 0x0000ffff);
											asm("sbb eax, eax");
											__eax =  ~( *(__ebp - 0x9c8c) & 0x0000ffff) & __ebp - 0x00009c8c;
											 *(__ebp - 0xac8c) & 0x0000ffff =  ~( *(__ebp - 0xac8c) & 0x0000ffff);
											__eax = __ebp - 0x15c8c;
											asm("sbb edx, edx");
											__edx =  ~( *(__ebp - 0xac8c) & 0x0000ffff) & __esi;
											E00A787D8(__ebp - 0x15c8c) = __ebp - 0x2c3c;
											__ebp - 0xbc8c = E00A7803D(__ecx, __edi, __ebp - 0xbc8c, __ebp - 0x2c3c,  ~( *(__ebp - 0xac8c) & 0x0000ffff) & __esi, __ebp - 0xbc8c,  ~( *(__ebp - 0x9c8c) & 0x0000ffff) & __ebp - 0x00009c8c,  ~( *(__ebp - 0x1c3c) & 0x0000ffff) & __ebp - 0x00001c3c);
											__eflags =  *(__ebp - 0xcc8c);
											if( *(__ebp - 0xcc8c) != 0) {
												_push(__edi);
												__eax = __ebp - 0xcc8c;
												_push(__ebp - 0xcc8c);
												_push(5);
												_push(0x1000);
												__eax =  *0xa99a90();
											}
											goto L167;
										}
										goto L162;
									}
								}
							case 0xb:
								__eflags = __ebx - 7;
								if(__ebx == 7) {
									 *0xaa8758 = 1;
								}
								goto L167;
							case 0xc:
								__eax =  *(__ebp - 0x5c84) & 0x0000ffff;
								__eax = E00A830A4( *(__ebp - 0x5c84) & 0x0000ffff);
								__eflags = __eax - 0x46;
								if(__eax == 0x46) {
									 *0xaa8733 = 1;
								} else {
									__eflags = __eax - 0x55;
									if(__eax == 0x55) {
										 *0xaa874c = 1;
									} else {
										__eax = 0;
										 *0xaa8733 = __al;
										 *0xaa874c = __al;
									}
								}
								goto L167;
							case 0xd:
								 *0xab4e1c = 1;
								asm("sbb al, 0x4e");
								asm("stosd");
								 *__ecx =  *__ecx + __al;
								goto L167;
						}
						L4:
						_t226 = E00A788BB(_t226, _t302);
						_t302 = _t302 + 0x2000;
						_t299 = _t299 - 1;
						if(_t299 != 0) {
							goto L4;
						} else {
							_t303 = _t299;
							goto L6;
						}
						L167:
						_push(0x1000);
						_t211 = _t308 - 0xe; // -14
						_t212 = _t308 - 0xd; // -13
						_t213 = _t308 - 0x5c84; // -23684
						_t214 = _t308 - 0xfc8c; // -64652
						_push( *((intOrPtr*)(_t308 + 0xc)));
						_t221 = E00A78BD1();
						_t284 =  *((intOrPtr*)(_t308 + 0x10));
						 *((intOrPtr*)(_t308 + 0xc)) = _t221;
					} while (_t221 != 0);
				}
			}

0x00a79e5a
0x00a79e5f
0x00a79e64
0x00a79e69
0x00a79e72
0x00a7aa54
0x00a7aa57
0x00a7aa61
0x00a7aa61
0x00a79e78
0x00a79e7d
0x00a79e81
0x00a79e85
0x00a79e8c
0x00a79e93
0x00a79e96
0x00a79e9d
0x00a79ea2
0x00a79ea9
0x00a79eae
0x00a79eb0
0x00a79eb0
0x00a79eb6
0x00a79eb6
0x00a79ebc
0x00a79ebc
0x00a79ed1
0x00a79ed1
0x00a79ed8
0x00a79ee6
0x00000000
0x00000000
0x00a79ee8
0x00a79eec
0x00000000
0x00a79eee
0x00000000
0x00a79eee
0x00a79eec
0x00a79ef6
0x00000000
0x00000000
0x00a79efc
0x00000000
0x00a79f03
0x00a79f06
0x00000000
0x00000000
0x00a79f0c
0x00a79f11
0x00a79f19
0x00a79f1f
0x00a79f26
0x00a79f2d
0x00a79f34
0x00a79f39
0x00a79f3f
0x00a79f44
0x00a79f4a
0x00a79f4e
0x00a79f54
0x00a79f59
0x00a79f5f
0x00a79f64
0x00a79f65
0x00a79f6c
0x00a79f6c
0x00a79f72
0x00a79f77
0x00a79f79
0x00a7a0de
0x00a7a0de
0x00a7a0e2
0x00a7a0e8
0x00000000
0x00a79f7f
0x00a79f85
0x00a79fa7
0x00a79fa8
0x00a79faf
0x00a79fb6
0x00a79fbc
0x00a79fc3
0x00a79fc8
0x00a79fd4
0x00a79fd7
0x00a79fda
0x00a79fed
0x00a79fed
0x00a79ff4
0x00a79ff9
0x00a79ffb
0x00000000
0x00000000
0x00a7a001
0x00a7a001
0x00a7a008
0x00a7a00d
0x00a7a012
0x00a7a01a
0x00a7a01e
0x00a7a023
0x00a7a026
0x00a7a02d
0x00a7a02f
0x00a7a030
0x00a7a034
0x00a7a03a
0x00a7a03d
0x00a7a040
0x00a7a041
0x00000000
0x00a7a041
0x00a79fdc
0x00a79fe3
0x00a79fe9
0x00a79feb
0x00000000
0x00000000
0x00000000
0x00a7a047
0x00a7a047
0x00a7a04e
0x00a7a050
0x00a7a053
0x00a7a0c3
0x00a7a0c3
0x00a7a0c4
0x00a7a0cb
0x00a7a0cb
0x00a7a0d1
0x00a7a0d6
0x00a7a0d8
0x00a79f87
0x00a79f8c
0x00a79f8d
0x00a79f94
0x00a79f9a
0x00a79fa1
0x00000000
0x00000000
0x00000000
0x00a79fa1
0x00000000
0x00a7a0d8
0x00a7a055
0x00a7a05c
0x00a7a062
0x00a7a064
0x00000000
0x00a7a066
0x00a7a066
0x00a7a068
0x00a7a069
0x00a7a06d
0x00a7a06d
0x00a7a079
0x00a7a085
0x00a7a08a
0x00a7a08d
0x00a7a094
0x00a7a096
0x00a7a099
0x00a7a06b
0x00a7a06b
0x00a7a06c
0x00000000
0x00a7a09b
0x00a7a09b
0x00a7a0a2
0x00a7a0a9
0x00a7a0af
0x00a7a0b1
0x00a7a0b6
0x00a7a0bd
0x00a7a0bd
0x00000000
0x00a7a0b1
0x00a7a099
0x00a7a064
0x00000000
0x00a7a0f2
0x00a7a0f4
0x00a7a11a
0x00a7a11d
0x00a7a11f
0x00a7a129
0x00a7a129
0x00a7a12c
0x00a7a132
0x00a7a134
0x00a7a121
0x00a7a121
0x00a7a121
0x00a7a121
0x00a7a139
0x00a7a13b
0x00a7a144
0x00a7a144
0x00a7a147
0x00a7a14c
0x00a7a155
0x00a7a156
0x00a7a15c
0x00a7a161
0x00a7a164
0x00a7a166
0x00a7a168
0x00a7a16d
0x00a7a16f
0x00a7a171
0x00a7a171
0x00a7a173
0x00a7a173
0x00a7a178
0x00a7a17d
0x00a7a17e
0x00a7a17e
0x00a7a17f
0x00a7a181
0x00a7a188
0x00a7a18d
0x00a7a181
0x00000000
0x00000000
0x00a7a193
0x00a7a195
0x00a7a19b
0x00a7a1a5
0x00a7a1a5
0x00000000
0x00000000
0x00a7a1b0
0x00a7a1b2
0x00000000
0x00000000
0x00a7a1b8
0x00a7a1bf
0x00000000
0x00000000
0x00a7a1c5
0x00a7a1c7
0x00a7a1c7
0x00a7a1cd
0x00a7a1cf
0x00a7a1d6
0x00a7a1d7
0x00a7a1de
0x00a7a1e0
0x00a7a1e0
0x00a7a1e0
0x00a7a1e7
0x00a7a1ed
0x00a7a1f2
0x00000000
0x00a7a1f8
0x00a7a1f8
0x00a7a1fb
0x00a7a1fd
0x00a7a1fe
0x00a7a201
0x00a7a229
0x00a7a229
0x00a7a22c
0x00a7a309
0x00a7a309
0x00a7a311
0x00a7a316
0x00a7a316
0x00a7a318
0x00a7a318
0x00a7a319
0x00a7a31a
0x00a7a31a
0x00a7a31c
0x00a7a31e
0x00a7a31e
0x00a7a325
0x00a7a32a
0x00a7a32b
0x00a7a32c
0x00a7a32e
0x00a7a330
0x00a7a334
0x00a7a336
0x00a7a336
0x00a7a338
0x00a7a338
0x00a7a334
0x00a7a33b
0x00a7a33b
0x00a7a341
0x00a7a348
0x00a7a34d
0x00a7a34e
0x00a7a354
0x00a7a35b
0x00a7a36b
0x00a7a36d
0x00a7a375
0x00a7a37d
0x00a7a389
0x00a7a38b
0x00a7a38b
0x00a7a393
0x00a7a398
0x00a7a399
0x00a7a39a
0x00a7a39c
0x00a7a3a2
0x00a7a3b2
0x00a7a3b2
0x00000000
0x00a7a39c
0x00a7a232
0x00a7a235
0x00a7a242
0x00a7a242
0x00a7a242
0x00a7a245
0x00a7a255
0x00a7a25b
0x00a7a25d
0x00a7a25f
0x00a7a25f
0x00a7a262
0x00a7a26a
0x00a7a26a
0x00a7a271
0x00a7a27e
0x00a7a287
0x00a7a28d
0x00a7a290
0x00a7a295
0x00a7a297
0x00a7a299
0x00a7a29b
0x00a7a29b
0x00a7a29d
0x00a7a29d
0x00a7a29f
0x00a7a29f
0x00a7a2a7
0x00a7a2ae
0x00a7a2b0
0x00a7a2b0
0x00a7a2b7
0x00a7a2bd
0x00a7a2c5
0x00a7a2c7
0x00a7a2d3
0x00a7a2d8
0x00a7a2d9
0x00a7a2d9
0x00a7a2c5
0x00a7a2e0
0x00a7a2e2
0x00a7a2e2
0x00a7a2ee
0x00a7a2f2
0x00a7a2f8
0x00000000
0x00a7a2fa
0x00a7a2fa
0x00a7a302
0x00000000
0x00a7a302
0x00a7a2f8
0x00a7a237
0x00a7a23c
0x00000000
0x00000000
0x00000000
0x00a7a23c
0x00a7a203
0x00a7a207
0x00000000
0x00000000
0x00a7a209
0x00a7a20c
0x00a7a20e
0x00a7a211
0x00000000
0x00a7a217
0x00a7a217
0x00a7a21f
0x00000000
0x00a7a21f
0x00a7a211
0x00000000
0x00a7a3b9
0x00a7a3ba
0x00a7a3bf
0x00a7a3c1
0x00a7a3c4
0x00a7a3c4
0x00000000
0x00a7a3fa
0x00a7a401
0x00a7a403
0x00a7a403
0x00a7a405
0x00a7a434
0x00a7a434
0x00a7a43a
0x00000000
0x00a7a43a
0x00a7a407
0x00a7a407
0x00a7a40a
0x00a7a423
0x00a7a429
0x00a7a429
0x00000000
0x00a7a429
0x00a7a40c
0x00a7a40c
0x00a7a40f
0x00000000
0x00000000
0x00a7a411
0x00a7a411
0x00a7a414
0x00000000
0x00000000
0x00a7a41a
0x00000000
0x00000000
0x00a7a487
0x00a7a48a
0x00000000
0x00000000
0x00a7a48c
0x00a7a498
0x00a7a49d
0x00a7a49e
0x00a7a49f
0x00a7a4a1
0x00000000
0x00000000
0x00a7a4a3
0x00000000
0x00000000
0x00a7a4cb
0x00a7a4ce
0x00a7a66e
0x00a7a66e
0x00a7a671
0x00a7a677
0x00a7a67e
0x00a7a680
0x00a7a680
0x00a7a68a
0x00a7a68a
0x00000000
0x00a7a671
0x00a7a4d4
0x00a7a4da
0x00a7a4e8
0x00a7a4f4
0x00a7a4f6
0x00a7a4f7
0x00a7a4fd
0x00a7a50b
0x00a7a513
0x00a7a518
0x00a7a545
0x00a7a545
0x00a7a548
0x00a7a54f
0x00a7a551
0x00a7a554
0x00000000
0x00000000
0x00a7a520
0x00a7a520
0x00a7a521
0x00a7a527
0x00a7a528
0x00a7a540
0x00a7a540
0x00a7a562
0x00a7a568
0x00a7a570
0x00000000
0x00000000
0x00a7a576
0x00a7a57d
0x00000000
0x00000000
0x00a7a583
0x00a7a585
0x00a7a58c
0x00a7a592
0x00a7a594
0x00a7a595
0x00a7a59a
0x00a7a59b
0x00a7a59c
0x00a7a59e
0x00a7a5ec
0x00a7a5ec
0x00a7a5f4
0x00a7a5fd
0x00a7a609
0x00a7a617
0x00a7a61c
0x00a7a626
0x00a7a62b
0x00a7a62d
0x00a7a63d
0x00a7a647
0x00a7a64c
0x00a7a64f
0x00000000
0x00a7a655
0x00a7a655
0x00a7a657
0x00a7a65a
0x00a7a661
0x00a7a668
0x00000000
0x00a7a668
0x00a7a64f
0x00a7a5a0
0x00a7a5a2
0x00a7a5a4
0x00a7a5ab
0x00000000
0x00000000
0x00a7a5ad
0x00a7a5b3
0x00a7a5b3
0x00a7a5b7
0x00000000
0x00000000
0x00a7a5b9
0x00a7a5ba
0x00a7a5c0
0x00a7a5c3
0x00a7a5c6
0x00000000
0x00000000
0x00000000
0x00a7a5c8
0x00a7a5d0
0x00a7a5db
0x00a7a5e0
0x00a7a5e1
0x00a7a5e1
0x00a7a5e3
0x00a7a5e4
0x00000000
0x00000000
0x00a7a696
0x00a7a699
0x00a7a69b
0x00a7a6a2
0x00a7a6ae
0x00a7a6ae
0x00a7a6b4
0x00a7a6b7
0x00a7a6bd
0x00a7a6bd
0x00a7a6c2
0x00000000
0x00000000
0x00a7a6ce
0x00a7a6d1
0x00a7a4b3
0x00a7a4b3
0x00000000
0x00a7a4b3
0x00a7a6d7
0x00a7a4a4
0x00a7a4a4
0x00a7a4aa
0x00a7a4ab
0x00a7a4ae
0x00000000
0x00000000
0x00a7a6de
0x00a7a6e1
0x00000000
0x00000000
0x00a7a6e7
0x00a7a6e9
0x00a7a6f0
0x00a7a6f8
0x00a7a6fe
0x00a7a703
0x00a7a706
0x00a7a73b
0x00a7a740
0x00a7a746
0x00a7a747
0x00a7a74c
0x00a7a708
0x00a7a708
0x00a7a70b
0x00a7a711
0x00a7a727
0x00a7a72c
0x00a7a72d
0x00a7a732
0x00a7a713
0x00a7a713
0x00a7a718
0x00a7a719
0x00a7a71e
0x00a7a71e
0x00a7a711
0x00a7a753
0x00a7a755
0x00a7a75c
0x00a7a76a
0x00a7a771
0x00a7a776
0x00a7a777
0x00a7a778
0x00a7a77a
0x00a7a77b
0x00a7a782
0x00a7a7d2
0x00a7a7d7
0x00a7a7d9
0x00000000
0x00000000
0x00a7a7df
0x00a7a7e1
0x00a7a7e7
0x00a7a7ee
0x00000000
0x00000000
0x00a7a7f0
0x00a7a7f2
0x00a7a7f3
0x00a7a7f3
0x00a7a7f6
0x00a7a7f9
0x00a7a803
0x00a7a803
0x00a7a805
0x00a7a807
0x00a7a811
0x00a7a816
0x00a7a818
0x00a7a856
0x00a7a859
0x00a7a859
0x00a7a85b
0x00a7a85c
0x00a7a85c
0x00000000
0x00a7a85c
0x00a7a81a
0x00a7a81c
0x00a7a81d
0x00a7a81f
0x00a7a822
0x00a7a837
0x00a7a839
0x00a7a83a
0x00a7a83a
0x00a7a83d
0x00a7a83d
0x00a7a842
0x00a7a843
0x00a7a849
0x00a7a849
0x00a7a84a
0x00a7a84f
0x00a7a850
0x00a7a851
0x00000000
0x00a7a851
0x00a7a824
0x00a7a82b
0x00a7a82e
0x00a7a82f
0x00000000
0x00a7a82f
0x00a7a7fb
0x00a7a7fd
0x00a7a7fe
0x00a7a801
0x00000000
0x00000000
0x00000000
0x00a7a85e
0x00a7a85e
0x00a7a861
0x00a7a861
0x00a7a866
0x00a7a868
0x00a7a86a
0x00a7a86a
0x00a7a86c
0x00a7a86c
0x00000000
0x00a7a784
0x00a7a78b
0x00a7a797
0x00a7a79d
0x00a7a79e
0x00a7a79f
0x00a7a7a4
0x00a7a7a7
0x00a7a7a9
0x00a7a7af
0x00a7a7b1
0x00a7a7bf
0x00a7a7c4
0x00a7a7c5
0x00a7a7c5
0x00a7a86f
0x00a7a86f
0x00a7a877
0x00a7a87c
0x00a7a87e
0x00a7a87f
0x00a7a885
0x00a7a886
0x00a7a88c
0x00a7a88d
0x00a7a88d
0x00a7a892
0x00a7a893
0x00a7a899
0x00a7a89a
0x00a7a8a0
0x00a7a8a1
0x00a7a8a6
0x00a7a8ae
0x00a7a8ba
0x00a7a8ba
0x00a7a8c7
0x00a7a8cc
0x00a7a8d4
0x00a7a8de
0x00a7a8eb
0x00a7a8f2
0x00a7a8f2
0x00a7a8fe
0x00a7a905
0x00a7a90a
0x00a7a912
0x00a7a918
0x00a7a919
0x00a7a91a
0x00a7a91c
0x00a7a91c
0x00a7a931
0x00a7a936
0x00a7a942
0x00a7a944
0x00a7a955
0x00a7a962
0x00000000
0x00a7a946
0x00a7a951
0x00a7a953
0x00a7a967
0x00a7a967
0x00a7a969
0x00a7a96f
0x00a7a975
0x00a7a983
0x00a7a988
0x00a7a989
0x00a7a991
0x00a7a996
0x00a7a99d
0x00a7a9a3
0x00a7a9a5
0x00a7a9ab
0x00a7a9b1
0x00a7a9b3
0x00a7a9bc
0x00a7a9bf
0x00a7a9c1
0x00a7a9ca
0x00a7a9cd
0x00a7a9d3
0x00a7a9d6
0x00a7a9df
0x00a7a9ee
0x00a7a9f3
0x00a7a9fb
0x00a7a9fd
0x00a7a9fe
0x00a7aa04
0x00a7aa05
0x00a7aa07
0x00a7aa0c
0x00a7aa0c
0x00000000
0x00a7a9fb
0x00000000
0x00a7a953
0x00a7a944
0x00000000
0x00a7aa14
0x00a7aa17
0x00a7aa19
0x00a7aa19
0x00000000
0x00000000
0x00a7a446
0x00a7a44e
0x00a7a454
0x00a7a457
0x00a7a47b
0x00a7a459
0x00a7a459
0x00a7a45c
0x00a7a46f
0x00a7a45e
0x00a7a45e
0x00a7a460
0x00a7a465
0x00a7a465
0x00a7a45c
0x00000000
0x00000000
0x00a7a4bf
0x00a7a4c1
0x00a7a4c3
0x00a7a4c4
0x00000000
0x00000000
0x00a79ebd
0x00a79ebf
0x00a79ec4
0x00a79eca
0x00a79ecd
0x00000000
0x00a79ecf
0x00a79ecf
0x00000000
0x00a79ecf
0x00a7aa20
0x00a7aa20
0x00a7aa25
0x00a7aa29
0x00a7aa2d
0x00a7aa34
0x00a7aa3b
0x00a7aa3e
0x00a7aa43
0x00a7aa46
0x00a7aa49
0x00a7aa53

APIs

__EH_prolog.LIBCMT ref: 00A79E5F

Part of subcall function 00A78BD1: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 00A78C99

SetFileAttributesW.KERNEL32(-00003C84,00000005,-00007C84,00000800,-0000FC8C,775DBB20,?,00000000,00A78F0E,?,00000003), ref: 00A79F94
_wcslen.LIBCMT ref: 00A79FCF
_wcslen.LIBCMT ref: 00A79FE3
_wcslen.LIBCMT ref: 00A7A008
GetFileAttributesW.KERNEL32(-00003C84), ref: 00A7A04E
DeleteFileW.KERNEL32(-00003C84), ref: 00A7A05C
_wcslen.LIBCMT ref: 00A7A13E
_wcslen.LIBCMT ref: 00A7A147
SetWindowTextW.USER32(?,-00005C84), ref: 00A7A1A5
_wcslen.LIBCMT ref: 00A7A1E7
_wcsrchr.LIBVCRUNTIME ref: 00A7A325
GetDlgItem.USER32(?,00000066), ref: 00A7A365
SetWindowTextW.USER32(00000000,-0000103C), ref: 00A7A375
SendMessageW.USER32(00000000,00000143,00000000,00AB4E28), ref: 00A7A389
SendMessageW.USER32(00000000,00000143,00000000,-0000103C), ref: 00A7A3B2

Strings

ProgramFilesDir, xrefs: 00A7A276
Software\Microsoft\Windows\CurrentVersion, xrefs: 00A7A24B
%s.%d.tmp, xrefs: 00A7A074
<br>, xrefs: 00A7A108

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: _wcslen$File$AttributesMessageSendTextWindow$DeleteEnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 1808871598-312220925
Opcode ID: f98bfcd9145d410748409d384641054e3ff57ba3973882251ce04216aee17700
Instruction ID: 2d547b328bf30ebf6f0e56e212b405590efeffd46a184f3cf28c8116797d0479
Opcode Fuzzy Hash: f98bfcd9145d410748409d384641054e3ff57ba3973882251ce04216aee17700
Instruction Fuzzy Hash: 0AE17372900219AAEF24EBA0DE45DEF73BCAB54350F00C1A6F549E7091EE749F85CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A6E9FD Relevance: 52.8, APIs: 23, Strings: 7, Instructions: 314
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 76%

			E00A6E9FD(void* __edx, char _a3, long _a4, CHAR* _a8, CHAR* _a12, CHAR* _a16, CHAR* _a20, CHAR* _a24, CHAR* _a28, CHAR* _a32, CHAR* _a36, CHAR* _a40, CHAR* _a44, CHAR* _a48, CHAR* _a52, CHAR* _a56, CHAR* _a60, CHAR* _a64, CHAR* _a68, CHAR* _a72, CHAR* _a76, CHAR* _a80, CHAR* _a84, CHAR* _a88, CHAR* _a92, CHAR* _a96, CHAR* _a100, CHAR* _a104, CHAR* _a108, CHAR* _a112, CHAR* _a116, CHAR* _a120, CHAR* _a124, CHAR* _a128, CHAR* _a132, CHAR* _a136, CHAR* _a140, CHAR* _a144, CHAR* _a148, CHAR* _a152, CHAR* _a156, CHAR* _a160, CHAR* _a164, CHAR* _a168, CHAR* _a172, CHAR* _a176, CHAR* _a180, CHAR* _a184, CHAR* _a188, CHAR* _a192, CHAR* _a196, CHAR* _a200, CHAR* _a204, CHAR* _a208, CHAR* _a212, CHAR* _a216, CHAR* _a220, CHAR* _a224, CHAR* _a228, CHAR* _a232, CHAR* _a236, CHAR* _a240, CHAR* _a244, char _a248, char _a252, short _a756, short _a760, char _a768, short _a772, char _a4848, char _a4852, void _a4860, char _a4864, short _a4868, char _a9152, char _a9160, void _a13260, signed char _a46032) {
				char _v1;
				long _v4;
				char* _t118;
				void* _t126;
				int _t130;
				long _t141;
				int _t167;
				_Unknown_base(*)()* _t176;
				_Unknown_base(*)()* _t177;
				signed char _t184;
				struct _SECURITY_ATTRIBUTES* _t197;
				long _t199;
				void* _t200;
				struct HINSTANCE__* _t203;
				signed int _t205;
				signed int _t207;
				void* _t208;
				signed int _t209;
				int _t210;
				void* _t212;

				E00A7C240();
				_push(_t209);
				_a3 = 0;
				_t203 = GetModuleHandleW(L"kernel32");
				if(_t203 == 0) {
					L5:
					_t118 =  *0xa99080; // 0xa8f790
					_t210 = _t209 | 0xffffffff;
					_t204 = 0x800;
					_a8 = L"version.dll";
					_a12 = L"DXGIDebug.dll";
					_a16 = L"sfc_os.dll";
					_a20 = L"SSPICLI.DLL";
					_a24 = L"rsaenh.dll";
					_a28 = L"UXTheme.dll";
					_a32 = L"dwmapi.dll";
					_a36 = L"cryptbase.dll";
					_a40 = L"lpk.dll";
					_a44 = L"usp10.dll";
					_a48 = L"clbcatq.dll";
					_a52 = L"comres.dll";
					_a56 = L"ws2_32.dll";
					_a60 = L"ws2help.dll";
					_a64 = L"psapi.dll";
					_a68 = L"ieframe.dll";
					_a72 = L"ntshrui.dll";
					_a76 = L"atl.dll";
					_a80 = L"setupapi.dll";
					_a84 = L"apphelp.dll";
					_a88 = L"userenv.dll";
					_a92 = L"netapi32.dll";
					_a96 = L"shdocvw.dll";
					_a100 = L"crypt32.dll";
					_a104 = L"msasn1.dll";
					_a108 = L"cryptui.dll";
					_a112 = L"wintrust.dll";
					_a116 = L"shell32.dll";
					_a120 = L"secur32.dll";
					_a124 = L"cabinet.dll";
					_a128 = L"oleaccrc.dll";
					_a132 = L"ntmarta.dll";
					_a136 = L"profapi.dll";
					_a140 = L"WindowsCodecs.dll";
					_a144 = L"srvcli.dll";
					_a148 = L"cscapi.dll";
					_a152 = L"slc.dll";
					_a156 = L"imageres.dll";
					_a160 = L"dnsapi.DLL";
					_a164 = L"iphlpapi.DLL";
					_a168 = L"WINNSI.DLL";
					_a172 = L"netutils.dll";
					_a176 = L"mpr.dll";
					_a180 = L"devrtl.dll";
					_a184 = L"propsys.dll";
					_a188 = L"mlang.dll";
					_a192 = L"samcli.dll";
					_a196 = L"samlib.dll";
					_a200 = L"wkscli.dll";
					_a204 = L"dfscli.dll";
					_a208 = L"browcli.dll";
					_a212 = L"rasadhlp.dll";
					_a216 = L"dhcpcsvc6.dll";
					_a220 = L"dhcpcsvc.dll";
					_a224 = L"XmlLite.dll";
					_a228 = L"linkinfo.dll";
					_a232 = L"cryptsp.dll";
					_a236 = L"RpcRtRemote.dll";
					_a240 = L"aclui.dll";
					_a244 = L"dsrole.dll";
					_a248 = L"peerdist.dll";
					if( *_t118 == 0x78) {
						L14:
						GetModuleFileNameW(0,  &_a772, _t204);
						E00A6E847( &_a9160, E00A6B1D0(_t225,  &_a772), _t204);
						_t197 = 0;
						_t205 = 0;
						do {
							if(E00A6A2FA() < 0x600) {
								_t126 = 0;
								__eflags = 0;
							} else {
								_t126 = E00A6E9B3( *((intOrPtr*)(_t212 + 0x18 + _t205 * 4))); // executed
							}
							if(_t126 == 0) {
								L20:
								_push(0x800);
								E00A6B23F(_t229,  &_a772,  *((intOrPtr*)(_t212 + 0x1c + _t205 * 4)));
								_t130 = GetFileAttributesW( &_a760); // executed
								if(_t130 != _t210) {
									_t197 =  *((intOrPtr*)(_t212 + 0x18 + _t205 * 4));
									L24:
									if(_v1 != 0) {
										L30:
										_t236 = _t197;
										if(_t197 == 0) {
											return _t130;
										}
										E00A6B213(_t236,  &_a768);
										if(E00A6A2FA() < 0x600) {
											_push( &_a9160);
											_push( &_a768);
											E00A63CE2( &_a4864, 0x864, L"Please remove %s from %s folder. It is unsecure to run %s until it is done.", _t197);
											_t212 = _t212 + 0x18;
											_t130 = AllocConsole();
											__eflags = _t130;
											if(_t130 != 0) {
												__imp__AttachConsole(GetCurrentProcessId());
												_t141 = E00A816B5( &_a4860);
												WriteConsoleW(GetStdHandle(0xfffffff4),  &_a4860, _t141,  &_v4, 0);
												Sleep(0x2710);
												_t130 = FreeConsole();
											}
										} else {
											E00A6E9B3(L"dwmapi.dll");
											E00A6E9B3(L"uxtheme.dll");
											_push( &_a9152);
											_push( &_a760);
											E00A63CE2( &_a4852, 0x864, E00A6CD14(0xf1), _t197);
											_t212 = _t212 + 0x18;
											_t130 = E00A781FE(0,  &_a4848, E00A6CD14(0xf0), 0x30);
										}
										ExitProcess(0);
									}
									_t207 = 0;
									while(1) {
										_push(0x800);
										E00A6B23F(0,  &_a768,  *((intOrPtr*)(_t212 + 0x3c + _t207 * 4)));
										_t130 = GetFileAttributesW( &_a756);
										if(_t130 != _t210) {
											break;
										}
										_t207 = _t207 + 1;
										if(_t207 < 0x35) {
											continue;
										}
										goto L30;
									}
									_t197 =  *((intOrPtr*)(_t212 + 0x38 + _t207 * 4));
									goto L30;
								}
							} else {
								_t130 = CompareStringW(0x400, 0x1001,  *(_t212 + 0x24 + _t205 * 4), _t210, L"DXGIDebug.dll", _t210); // executed
								_t229 = _t130 - 2;
								if(_t130 != 2) {
									goto L21;
								}
								goto L20;
							}
							L21:
							_t205 = _t205 + 1;
						} while (_t205 < 8);
						goto L24;
					}
					_t199 = E00A83EEA(_t185, _t118);
					if(_t199 == 0) {
						goto L14;
					}
					GetModuleFileNameW(0,  &_a4868, 0x800);
					_t208 = CreateFileW( &_a4868, 0x80000000, 1, 0, 3, 0, 0);
					if(_t208 == _t210 || SetFilePointer(_t208, _t199, 0, 0) != _t199) {
						L13:
						CloseHandle(_t208);
						_t204 = 0x800;
						goto L14;
					} else {
						_t167 = ReadFile(_t208,  &_a13260, 0x7ffe,  &_a4, 0);
						_t224 = _t167;
						if(_t167 == 0) {
							goto L13;
						}
						_push(0x104);
						 *((short*)(_t212 + 0x33e0 + (_a4 >> 1) * 2)) = 0;
						_push( &_a252);
						_push( &_a13260);
						while(1) {
							_t200 = E00A6E63C(_t224);
							_t225 = _t200;
							if(_t200 == 0) {
								goto L13;
							}
							E00A6E9B3( &_a252);
							_push(0x104);
							_push( &_a248);
							_push(_t200);
						}
						goto L13;
					}
				}
				_t176 = GetProcAddress(_t203, "SetDllDirectoryW");
				_t184 = _a46032;
				if(_t176 != 0) {
					asm("sbb ecx, ecx");
					_t185 =  ~(_t184 & 0x000000ff) & 0x00a8f5dc;
					 *_t176( ~(_t184 & 0x000000ff) & 0x00a8f5dc);
				}
				_t177 = GetProcAddress(_t203, "SetDefaultDllDirectories");
				if(_t177 != 0) {
					_t185 = ((_t184 == 0x00000000) - 0x00000001 & 0xfffff800) + 0x1000;
					 *_t177(((_t184 == 0x00000000) - 0x00000001 & 0xfffff800) + 0x1000);
					_v1 = 1;
				}
				goto L5;
			}

0x00a6ea02
0x00a6ea08
0x00a6ea10
0x00a6ea1b
0x00a6ea1f
0x00a6ea72
0x00a6ea72
0x00a6ea77
0x00a6ea80
0x00a6ea85
0x00a6ea8d
0x00a6ea98
0x00a6eaa0
0x00a6eaa8
0x00a6eab0
0x00a6eab8
0x00a6eac0
0x00a6eac8
0x00a6ead0
0x00a6ead8
0x00a6eae0
0x00a6eae8
0x00a6eaf0
0x00a6eaf8
0x00a6eb00
0x00a6eb08
0x00a6eb10
0x00a6eb18
0x00a6eb20
0x00a6eb28
0x00a6eb30
0x00a6eb38
0x00a6eb40
0x00a6eb48
0x00a6eb50
0x00a6eb58
0x00a6eb63
0x00a6eb6e
0x00a6eb79
0x00a6eb84
0x00a6eb8f
0x00a6eb9a
0x00a6eba5
0x00a6ebb0
0x00a6ebbb
0x00a6ebc6
0x00a6ebd1
0x00a6ebdc
0x00a6ebe7
0x00a6ebf2
0x00a6ebfd
0x00a6ec08
0x00a6ec13
0x00a6ec1e
0x00a6ec29
0x00a6ec34
0x00a6ec3f
0x00a6ec4a
0x00a6ec55
0x00a6ec60
0x00a6ec6b
0x00a6ec76
0x00a6ec81
0x00a6ec8c
0x00a6ec97
0x00a6eca2
0x00a6ecad
0x00a6ecb8
0x00a6ecc3
0x00a6ecce
0x00a6ecd9
0x00a6eda7
0x00a6edb2
0x00a6edcb
0x00a6edd6
0x00a6edd8
0x00a6edda
0x00a6ede4
0x00a6edf1
0x00a6edf1
0x00a6ede6
0x00a6edea
0x00a6edea
0x00a6edf5
0x00a6ee17
0x00a6ee17
0x00a6ee28
0x00a6ee35
0x00a6ee39
0x00a6ee43
0x00a6ee47
0x00a6ee4c
0x00a6ee80
0x00a6ee80
0x00a6ee82
0x00a6ef99
0x00a6ef99
0x00a6ee90
0x00a6ee9f
0x00a6ef0e
0x00a6ef16
0x00a6ef2a
0x00a6ef2f
0x00a6ef32
0x00a6ef38
0x00a6ef3a
0x00a6ef43
0x00a6ef58
0x00a6ef70
0x00a6ef7b
0x00a6ef81
0x00a6ef81
0x00a6eea1
0x00a6eea6
0x00a6eeb0
0x00a6eebc
0x00a6eec4
0x00a6eede
0x00a6eee3
0x00a6eefd
0x00a6eefd
0x00a6ef89
0x00a6ef89
0x00a6ee4e
0x00a6ee50
0x00a6ee50
0x00a6ee61
0x00a6ee6e
0x00a6ee72
0x00000000
0x00000000
0x00a6ee74
0x00a6ee78
0x00000000
0x00000000
0x00000000
0x00a6ee7a
0x00a6ee7c
0x00000000
0x00a6ee7c
0x00a6edf7
0x00a6ee0c
0x00a6ee12
0x00a6ee15
0x00000000
0x00000000
0x00000000
0x00a6ee15
0x00a6ee3b
0x00a6ee3b
0x00a6ee3c
0x00000000
0x00a6ee41
0x00a6ece5
0x00a6ecea
0x00000000
0x00000000
0x00a6ecfb
0x00a6ed19
0x00a6ed1d
0x00a6ed9b
0x00a6ed9c
0x00a6eda2
0x00000000
0x00a6ed2f
0x00a6ed44
0x00a6ed4a
0x00a6ed4c
0x00000000
0x00000000
0x00a6ed56
0x00a6ed5b
0x00a6ed6a
0x00a6ed72
0x00a6ed90
0x00a6ed95
0x00a6ed97
0x00a6ed99
0x00000000
0x00000000
0x00a6ed7d
0x00a6ed82
0x00a6ed8e
0x00a6ed8f
0x00a6ed8f
0x00000000
0x00a6ed90
0x00a6ed1d
0x00a6ea2d
0x00a6ea2f
0x00a6ea38
0x00a6ea3f
0x00a6ea41
0x00a6ea48
0x00a6ea48
0x00a6ea50
0x00a6ea54
0x00a6ea64
0x00a6ea6b
0x00a6ea6d
0x00a6ea6d
0x00000000

APIs

GetModuleHandleW.KERNEL32 ref: 00A6EA15
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00A6EA2D
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00A6EA50
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00A6ECFB
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00A6ED13
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00A6ED25
ReadFile.KERNEL32(00000000,?,00007FFE,00A8F7E0,00000000), ref: 00A6ED44
CloseHandle.KERNEL32(00000000), ref: 00A6ED9C
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00A6EDB2
CompareStringW.KERNEL32(00000400,00001001,00A8F82C,?,DXGIDebug.dll,?,?,00000000,?,00000800), ref: 00A6EE0C
GetFileAttributesW.KERNELBASE(?,?,00A8F7F8,00000800,?,00000000,?,00000800), ref: 00A6EE35
GetFileAttributesW.KERNEL32(?,?,00A8F8B8,00000800), ref: 00A6EE6E

Part of subcall function 00A6E9B3: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00A6E9CE
Part of subcall function 00A6E9B3: LoadLibraryW.KERNELBASE(?,?,00A6DAA4,Crypt32.dll,?,00A6DB27,?,00A6DB0A,?,?,?,?), ref: 00A6E9F0

_swprintf.LIBCMT ref: 00A6EEDE
_swprintf.LIBCMT ref: 00A6EF2A

Part of subcall function 00A63CE2: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00A63CF5

AllocConsole.KERNEL32 ref: 00A6EF32
GetCurrentProcessId.KERNEL32 ref: 00A6EF3C
AttachConsole.KERNEL32(00000000), ref: 00A6EF43
_wcslen.LIBCMT ref: 00A6EF58
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00A6EF69
WriteConsoleW.KERNEL32(00000000), ref: 00A6EF70
Sleep.KERNEL32(00002710), ref: 00A6EF7B
FreeConsole.KERNEL32 ref: 00A6EF81
ExitProcess.KERNEL32 ref: 00A6EF89

Strings

DXGIDebug.dll, xrefs: 00A6EA8D, 00A6EDF8
SetDllDirectoryW, xrefs: 00A6EA27
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00A6EF18
kernel32, xrefs: 00A6EA0B
uxtheme.dll, xrefs: 00A6EEAB
SetDefaultDllDirectories, xrefs: 00A6EA4A
dwmapi.dll, xrefs: 00A6EAB8, 00A6EEA1

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l_wcslen
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
API String ID: 1207345701-3298887752
Opcode ID: 4bd3ee389346b6238f5fbdc797759b9b0e5a367b1b8665a1f081662fbc18f1ad
Instruction ID: da45f902b56377a713a71e45cbbf1eae585eac33b14b1e6e61469f468a3d6be8
Opcode Fuzzy Hash: 4bd3ee389346b6238f5fbdc797759b9b0e5a367b1b8665a1f081662fbc18f1ad
Instruction Fuzzy Hash: 69D14CB1108386AFD730EFA0C849B9FBBF8FB85744F10492DE589DA191D7B08549CB66

Uniqueness

Uniqueness Score: -1.00%

Function 00A6CA9B Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 209
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowRect.USER32(?,?), ref: 00A6CAD2
GetClientRect.USER32(?,?), ref: 00A6CADE
GetWindowLongW.USER32(?,000000F0), ref: 00A6CB8D
GetWindowRect.USER32(?,?), ref: 00A6CBBA
GetWindowTextW.USER32(?,?,00000400), ref: 00A6CBD9
SetWindowTextW.USER32(?,?), ref: 00A6CC00
GetSystemMetrics.USER32(00000008), ref: 00A6CC08
GetWindow.USER32(?,00000005), ref: 00A6CC13
GetWindowTextW.USER32(00000000,?,00000400), ref: 00A6CC3E
SetWindowTextW.USER32(00000000,00000000), ref: 00A6CC6B
GetWindowRect.USER32(00000000,?), ref: 00A6CC7E
GetWindow.USER32(00000000,00000002), ref: 00A6CCF0

Strings

d, xrefs: 00A6CAFE

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: Window$RectText$ClientLongMetricsSystem
String ID: d
API String ID: 701536498-2564639436
Opcode ID: 8bdcf90218408cb77aee0dc0ecb520574e74e75aba830e58a75b3450d59541d8
Instruction ID: 9f19fa1209ba73eeea64a01c70b5b7e2796667120882edeb6a080c3fa166cad6
Opcode Fuzzy Hash: 8bdcf90218408cb77aee0dc0ecb520574e74e75aba830e58a75b3450d59541d8
Instruction Fuzzy Hash: 76716A72209300AFD710DF68DD89A6FBBF9FBC9714F00491DF98592290DA74E90ACB52

Uniqueness

Uniqueness Score: -1.00%

Function 00A7AB1F Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 96
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00A7AB1F(intOrPtr _a4, long _a8) {
				char _v67;
				intOrPtr _v72;
				signed int _v84;
				int _v88;
				void* _v92;
				intOrPtr _t39;
				struct HWND__* _t44;

				_t44 = GetDlgItem( *0xaa8744, 0x68);
				if( *0xaa874d == 0) {
					E00A7732A( *0xaa8738);
					ShowWindow(_t44, 5); // executed
					SendMessageW(_t44, 0xb1, 0, 0xffffffff);
					SendMessageW(_t44, 0xc2, 0, 0xa8f5dc);
					 *0xaa874d = 1;
				}
				SendMessageW(_t44, 0xb1, 0x5f5e100, 0x5f5e100);
				_v92 = 0x5c;
				SendMessageW(_t44, 0x43a, 0,  &_v92);
				_v67 = 0;
				_t39 = _a4;
				_v88 = 1;
				if(_t39 != 0) {
					_v72 = 0xa0;
					_v88 = 0x40000001;
					_v84 = _v84 & 0xbfffffff | 1;
				}
				SendMessageW(_t44, 0x444, 1,  &_v92);
				SendMessageW(_t44, 0xc2, 0, _a8); // executed
				SendMessageW(_t44, 0xb1, 0x5f5e100, 0x5f5e100);
				if(_t39 != 0) {
					_v84 = _v84 & 0xfffffffe | 0x40000000;
					SendMessageW(_t44, 0x444, 1,  &_v92);
				}
				return SendMessageW(_t44, 0xc2, 0, L"\r\n");
			}

0x00a7ab3c
0x00a7ab49
0x00a7ab51
0x00a7ab59
0x00a7ab68
0x00a7ab72
0x00a7ab74
0x00a7ab74
0x00a7ab88
0x00a7ab8e
0x00a7ab9e
0x00a7aba2
0x00a7aba6
0x00a7abab
0x00a7abb1
0x00a7abbc
0x00a7abc6
0x00a7abce
0x00a7abce
0x00a7abde
0x00a7abe8
0x00a7abf7
0x00a7abfb
0x00a7ac09
0x00a7ac1a
0x00a7ac1a
0x00a7ac2e

APIs

GetDlgItem.USER32(00000068,00AB5E38), ref: 00A7AB2E
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,?,00A78826,00000001,?,?,00A78F9B,00A90338,00AB5E38,00AB5E38), ref: 00A7AB59
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00A7AB68
SendMessageW.USER32(00000000,000000C2,00000000,00A8F5DC), ref: 00A7AB72
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00A7AB88
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00A7AB9E
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00A7ABDE
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00A7ABE8
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00A7ABF7
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00A7AC1A
SendMessageW.USER32(00000000,000000C2,00000000,00A902C0), ref: 00A7AC25

Strings

\, xrefs: 00A7AB8E

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: MessageSend$ItemShowWindow
String ID: \
API String ID: 1207805008-2967466578
Opcode ID: ec9477a2246dd6bd40853b4400a3021553b1304974fc6d9768805a1dfe12903d
Instruction ID: b12dc116c25f88ae1424ae0d2073df90766e6b6c23491e89a723443250e80ecd
Opcode Fuzzy Hash: ec9477a2246dd6bd40853b4400a3021553b1304974fc6d9768805a1dfe12903d
Instruction Fuzzy Hash: D02101712457447AE311EB28DC41FAF7F9CEFD2754F000619FA909A1D0CBA95E098AAB

Uniqueness

Uniqueness Score: -1.00%

Function 00A6C69C Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 256
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E00A6C69C(intOrPtr* __ecx, void* __edx) {
				void* __esi;
				void* _t79;
				WCHAR* _t80;
				void* _t85;
				intOrPtr _t88;
				unsigned int _t89;
				void* _t96;
				void* _t98;
				signed int _t99;
				void* _t100;
				void* _t101;
				void* _t102;
				void* _t105;
				intOrPtr _t109;
				signed int _t114;
				void* _t117;
				void* _t119;
				void* _t122;
				signed int _t126;
				intOrPtr* _t128;
				signed int _t146;
				signed int _t147;
				intOrPtr _t150;
				void* _t158;
				intOrPtr _t162;
				signed int _t164;
				signed int _t166;
				intOrPtr _t167;
				signed int _t168;
				signed int _t169;
				intOrPtr* _t171;
				void* _t173;
				void* _t175;

				_t158 = __edx;
				_t128 = __ecx;
				E00A7C16C(E00A8EDFC, _t173);
				E00A7C240();
				_t164 = 0x5c;
				_push(_t164);
				_push( *((intOrPtr*)(_t173 + 8)));
				_t171 = _t128;
				 *(_t173 - 0x24) = _t164;
				_t79 = E00A7F472(_t128);
				_t126 = 0;
				_t80 = _t173 - 0x4048;
				if(_t79 != 0) {
					L3:
					E00A81693(_t80,  *((intOrPtr*)(_t173 + 8)));
					E00A68E1D(_t173 - 0x1048);
					_push(4);
					 *(_t173 - 4) = _t126;
					_push(_t173 - 0x4048);
					if(E00A6915C(_t173 - 0x1048, _t171) != 0) {
						_t166 = _t164 | 0xffffffff;
						 *(_t173 + 0xb) = _t126;
						 *(_t173 - 0x10) = _t166;
						 *(_t173 - 0x1c) = _t126;
						L5:
						while(_t166 == 0xffffffff) {
							 *((intOrPtr*)(_t173 - 0x14)) = E00A69509();
							_t109 = E00A6932B(_t158, _t173 - 0x3048, 0x2000);
							 *((intOrPtr*)(_t173 - 0x18)) = _t109;
							_t169 = _t126;
							_t18 = _t109 - 0x10; // -16
							_t150 = _t18;
							 *((intOrPtr*)(_t173 - 0x20)) = _t150;
							if(_t150 < 0) {
								L22:
								_t110 =  *((intOrPtr*)(_t173 - 0x14));
								_t166 =  *(_t173 - 0x10);
								goto L23;
							} else {
								L7:
								while(1) {
									if( *((char*)(_t173 + _t169 - 0x3048)) != 0x2a ||  *((char*)(_t173 + _t169 - 0x3047)) != 0x2a) {
										L11:
										_t158 = 0x2a;
										if( *((intOrPtr*)(_t173 + _t169 - 0x3048)) != _t158) {
											L15:
											if( *((char*)(_t173 + _t169 - 0x3048)) != 0x52 ||  *((char*)(_t173 + _t169 - 0x3047)) != 0x61) {
												L18:
												_t169 = _t169 + 1;
												if(_t169 >  *((intOrPtr*)(_t173 - 0x20))) {
													goto L22;
												} else {
													_t109 =  *((intOrPtr*)(_t173 - 0x18));
													continue;
												}
											} else {
												_t117 = E00A82C70(_t173 - 0x3046 + _t169, 0xa8f5a8, 4);
												_t175 = _t175 + 0xc;
												if(_t117 != 0) {
													goto L18;
												}
											}
										} else {
											_t155 = _t173 - 0x3044 + _t169;
											if( *((intOrPtr*)(_t173 - 0x3044 + _t169 - 2)) != _t158 || _t169 > _t109 + 0xffffffe0) {
												goto L15;
											} else {
												_t119 = E00A82B57(_t155, L"*messages***", 0xb);
												_t175 = _t175 + 0xc;
												if(_t119 == 0) {
													 *(_t173 + 0xb) = 1;
													goto L21;
												} else {
													goto L15;
												}
											}
										}
									} else {
										_t122 = E00A82C70(_t173 - 0x3046 + _t169, "*messages***", 0xb);
										_t175 = _t175 + 0xc;
										if(_t122 == 0) {
											L21:
											_t110 =  *((intOrPtr*)(_t173 - 0x14));
											_t166 = _t169 +  *((intOrPtr*)(_t173 - 0x14));
											 *(_t173 - 0x10) = _t166;
											L23:
											E00A693FE(_t173 - 0x1048, _t173, _t110 +  *((intOrPtr*)(_t173 - 0x18)) + 0xfffffff0, _t126, _t126);
											_t114 =  *(_t173 - 0x1c) + 1;
											 *(_t173 - 0x1c) = _t114;
											if(_t114 < 0x100) {
												goto L5;
											} else {
												if(_t166 != 0xffffffff) {
													goto L25;
												}
											}
										} else {
											_t109 =  *((intOrPtr*)(_t173 - 0x18));
											goto L11;
										}
									}
									goto L53;
								}
							}
							goto L53;
						}
						L25:
						asm("cdq");
						E00A693FE(_t173 - 0x1048, _t173, _t166, _t158, _t126);
						_push(0x80002);
						_t88 = E00A82C59(_t173 - 0x1048);
						 *_t171 = _t88;
						if(_t88 != 0) {
							_t89 = E00A6932B(_t158, _t88, 0x80000);
							_t140 =  *(_t173 + 0xb);
							 *(_t171 + 4) = _t89;
							if( *(_t173 + 0xb) == 0) {
								_push(2 + _t89 * 2);
								_t167 = E00A82C59(_t140);
								if(_t167 != 0) {
									 *( *_t171 +  *(_t171 + 4)) = _t126;
									E00A6FC9F( *_t171, _t167,  *(_t171 + 4) + 1);
									L00A816D0( *_t171);
									 *_t171 = _t167;
									goto L30;
								}
							} else {
								 *(_t171 + 4) = _t89 >> 1;
								L30:
								_t146 = 0x40000;
								if( *(_t171 + 4) <= 0x40000) {
									_t146 =  *(_t171 + 4);
								}
								 *((short*)( *_t171 + _t146 * 2)) = 0;
								_t147 = _t126;
								if( *(_t171 + 4) > _t126) {
									_t96 = 0xd;
									while(1) {
										_t162 =  *_t171;
										_t168 =  *(_t162 + _t126 * 2) & 0x0000ffff;
										_t126 = _t126 + 1;
										if(_t168 == 0) {
											goto L52;
										}
										if(_t168 !=  *(_t173 - 0x24)) {
											if(_t168 == _t96) {
												L49:
												_t168 = 0xc;
											} else {
												_t105 = 0xa;
												if(_t168 == _t105) {
													goto L49;
												}
											}
											goto L50;
										} else {
											_t98 = ( *(_t162 + _t126 * 2) & 0x0000ffff) - 0x22;
											if(_t98 == 0) {
												_push(0x22);
												goto L46;
											} else {
												_t100 = _t98 - 0x3a;
												if(_t100 == 0) {
													_push(0x5c);
													goto L46;
												} else {
													_t101 = _t100 - 0x12;
													if(_t101 == 0) {
														_push(0xa);
														goto L46;
													} else {
														_t102 = _t101 - 4;
														if(_t102 == 0) {
															_push(0xd);
															goto L46;
														} else {
															if(_t102 != 0) {
																L50:
																 *(_t162 + _t147 * 2) = _t168;
															} else {
																_push(9);
																L46:
																_pop(_t99);
																 *(_t162 + _t147 * 2) = _t99;
																_t126 = _t126 + 1;
															}
														}
													}
												}
											}
										}
										_t147 = _t147 + 1;
										_t96 = 0xd;
										if(_t126 <  *(_t171 + 4)) {
											continue;
										}
										goto L52;
									}
								}
								L52:
								 *((short*)( *_t171 + _t147 * 2)) = 0;
								 *(_t171 + 4) = _t147;
							}
						}
					}
					L53:
					_t85 = E00A68E53(_t173 - 0x1048); // executed
				} else {
					GetModuleFileNameW(0, _t80, 0x800);
					_t85 = E00A7F64B(_t173 - 0x4048, _t164);
					if(_t85 != 0) {
						_t80 = _t85 + 2;
						goto L3;
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t173 - 0xc));
				return _t85;
			}

0x00a6c69c
0x00a6c69c
0x00a6c6a1
0x00a6c6ab
0x00a6c6b5
0x00a6c6b6
0x00a6c6b7
0x00a6c6ba
0x00a6c6bc
0x00a6c6bf
0x00a6c6c5
0x00a6c6ca
0x00a6c6d0
0x00a6c6f9
0x00a6c6fd
0x00a6c70a
0x00a6c70f
0x00a6c717
0x00a6c71a
0x00a6c728
0x00a6c72e
0x00a6c731
0x00a6c734
0x00a6c737
0x00000000
0x00a6c73a
0x00a6c74e
0x00a6c763
0x00a6c768
0x00a6c76b
0x00a6c76d
0x00a6c76d
0x00a6c770
0x00a6c775
0x00a6c834
0x00a6c834
0x00a6c837
0x00000000
0x00000000
0x00000000
0x00a6c77b
0x00a6c783
0x00a6c7ae
0x00a6c7b0
0x00a6c7b9
0x00a6c7e4
0x00a6c7ec
0x00a6c818
0x00a6c818
0x00a6c81c
0x00000000
0x00a6c81e
0x00a6c81e
0x00000000
0x00a6c81e
0x00a6c7f8
0x00a6c808
0x00a6c80d
0x00a6c812
0x00000000
0x00000000
0x00a6c812
0x00a6c7bb
0x00a6c7c1
0x00a6c7c7
0x00000000
0x00a6c7d0
0x00a6c7d8
0x00a6c7dd
0x00a6c7e2
0x00a6c826
0x00000000
0x00000000
0x00000000
0x00000000
0x00a6c7e2
0x00a6c7c7
0x00a6c78f
0x00a6c79f
0x00a6c7a4
0x00a6c7a9
0x00a6c82a
0x00a6c82a
0x00a6c82d
0x00a6c82f
0x00a6c83a
0x00a6c84b
0x00a6c853
0x00a6c854
0x00a6c85c
0x00000000
0x00a6c862
0x00a6c865
0x00000000
0x00000000
0x00a6c865
0x00a6c7ab
0x00a6c7ab
0x00000000
0x00a6c7ab
0x00a6c7a9
0x00000000
0x00a6c783
0x00a6c77b
0x00000000
0x00a6c775
0x00a6c86b
0x00a6c874
0x00a6c877
0x00a6c87c
0x00a6c881
0x00a6c886
0x00a6c88b
0x00a6c89d
0x00a6c8a2
0x00a6c8a5
0x00a6c8aa
0x00a6c8ba
0x00a6c8c0
0x00a6c8c5
0x00a6c8d0
0x00a6c8db
0x00a6c8e2
0x00a6c8e8
0x00000000
0x00a6c8e8
0x00a6c8ac
0x00a6c8ae
0x00a6c8ea
0x00a6c8ea
0x00a6c8f2
0x00a6c8f4
0x00a6c8f4
0x00a6c8fb
0x00a6c8ff
0x00a6c904
0x00a6c908
0x00a6c909
0x00a6c909
0x00a6c90b
0x00a6c90f
0x00a6c913
0x00000000
0x00000000
0x00a6c919
0x00a6c956
0x00a6c960
0x00a6c962
0x00a6c958
0x00a6c95a
0x00a6c95e
0x00000000
0x00000000
0x00a6c95e
0x00000000
0x00a6c91b
0x00a6c91f
0x00a6c922
0x00a6c949
0x00000000
0x00a6c924
0x00a6c924
0x00a6c927
0x00a6c945
0x00000000
0x00a6c929
0x00a6c929
0x00a6c92c
0x00a6c941
0x00000000
0x00a6c92e
0x00a6c92e
0x00a6c931
0x00a6c93d
0x00000000
0x00a6c933
0x00a6c937
0x00a6c963
0x00a6c963
0x00a6c939
0x00a6c939
0x00a6c94b
0x00a6c94b
0x00a6c94c
0x00a6c950
0x00a6c950
0x00a6c937
0x00a6c931
0x00a6c92c
0x00a6c927
0x00a6c922
0x00a6c967
0x00a6c96a
0x00a6c96e
0x00000000
0x00000000
0x00000000
0x00a6c96e
0x00a6c909
0x00a6c970
0x00a6c974
0x00a6c978
0x00a6c978
0x00a6c8aa
0x00a6c88b
0x00a6c97b
0x00a6c981
0x00a6c6d2
0x00a6c6d9
0x00a6c6e7
0x00a6c6f0
0x00a6c6f6
0x00000000
0x00a6c6f6
0x00a6c6f0
0x00a6c98c
0x00a6c996

APIs

__EH_prolog.LIBCMT ref: 00A6C6A1
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,00A6C683,?), ref: 00A6C6D9
_wcsrchr.LIBVCRUNTIME ref: 00A6C6E7

Part of subcall function 00A6FC9F: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00A6ABFF,00000000,?,?), ref: 00A6FCBB

Strings

a, xrefs: 00A6C7EE
*messages***, xrefs: 00A6C799
R, xrefs: 00A6C7E4
*messages***, xrefs: 00A6C7D2

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: ByteCharFileH_prologModuleMultiNameWide_wcsrchr
String ID: *messages***$*messages***$R$a
API String ID: 2549165012-2900423073
Opcode ID: 741d30f24ac4f2b5c3c4965f2246c1b6ffeb47173390a51b51c21ea3109b42ee
Instruction ID: c76ba1d001294552cbf243fbbd91e5218e48dcbaba595eed76c690a61263abfe
Opcode Fuzzy Hash: 741d30f24ac4f2b5c3c4965f2246c1b6ffeb47173390a51b51c21ea3109b42ee
Instruction Fuzzy Hash: 1F913AB2A002059BDB34DFA8CC91BFE77B4EF41720F10846AE199E72D1DB709A85CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A6F4FA Relevance: 10.6, APIs: 7, Instructions: 123
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00A6F4FA(long* __ecx, signed int* _a4) {
				struct _SYSTEMTIME _v16;
				struct _SYSTEMTIME _v32;
				struct _SYSTEMTIME _v48;
				void* _v52;
				struct _FILETIME _v56;
				struct _FILETIME _v64;
				struct _FILETIME _v72;
				struct _FILETIME _v80;
				signed int _t93;
				signed int _t96;
				void* _t100;
				intOrPtr* _t103;
				void* _t105;
				signed int* _t107;

				_v72.dwLowDateTime =  *__ecx;
				_v72.dwHighDateTime = __ecx[1];
				if(E00A6A2FA() >= 0x600) {
					FileTimeToSystemTime( &_v72,  &_v32);
					SystemTimeToTzSpecificLocalTime(0,  &_v32,  &_v16); // executed
					SystemTimeToFileTime( &_v16,  &_v80);
					SystemTimeToFileTime( &_v32,  &_v64);
					asm("sbb ecx, [esp+0x24]");
					asm("adc ecx, [esp+0x1c]");
					asm("sbb ecx, ebx");
					asm("adc ecx, ebx");
					_v80.dwLowDateTime = 0 - _v64.dwLowDateTime + _v80.dwLowDateTime + _v72.dwLowDateTime;
					asm("adc ecx, ebx");
				} else {
					FileTimeToLocalFileTime( &_v72,  &_v80);
				}
				FileTimeToSystemTime( &_v80,  &_v48);
				_t107 = _a4;
				_t105 = 1;
				_t96 = _v48.wDay & 0x0000ffff;
				_t93 = _v48.wMonth & 0x0000ffff;
				_t102 = _v48.wYear & 0x0000ffff;
				_t107[3] = _v48.wHour & 0x0000ffff;
				_t107[4] = _v48.wMinute & 0x0000ffff;
				_t107[5] = _v48.wSecond & 0x0000ffff;
				_t107[7] = _v48.wDayOfWeek & 0x0000ffff;
				 *_t107 = _v48.wYear & 0x0000ffff;
				_t107[1] = _t93;
				_t107[2] = _t96;
				_t107[8] = _t96 - 1;
				if(_t93 > 1) {
					_t103 = 0xa99084;
					_t100 = 4;
					while(_t100 <= 0x30) {
						_t100 = _t100 + 4;
						_t107[8] = _t107[8] +  *_t103;
						_t103 = _t103 + 4;
						_t105 = _t105 + 1;
						if(_t105 < _t93) {
							continue;
						}
						break;
					}
					_t102 = _v48.wYear & 0x0000ffff;
				}
				if(_t93 > 2 && E00A6F66B(_t102) != 0) {
					_t107[8] = _t107[8] + 1;
				}
				_v48.wMilliseconds = 0;
				SystemTimeToFileTime( &_v48,  &_v56);
				_t107[6] = 0 - _v56.dwLowDateTime + _v80.dwLowDateTime;
				return _v80.dwHighDateTime;
			}

0x00a6f506
0x00a6f50a
0x00a6f526
0x00a6f544
0x00a6f551
0x00a6f561
0x00a6f56d
0x00a6f577
0x00a6f57d
0x00a6f585
0x00a6f58b
0x00a6f591
0x00a6f595
0x00a6f528
0x00a6f532
0x00a6f532
0x00a6f5aa
0x00a6f5ac
0x00a6f5b7
0x00a6f5b8
0x00a6f5bd
0x00a6f5c2
0x00a6f5c7
0x00a6f5cf
0x00a6f5d7
0x00a6f5df
0x00a6f5e5
0x00a6f5e7
0x00a6f5ea
0x00a6f5ed
0x00a6f5f2
0x00a6f5f6
0x00a6f5fb
0x00a6f5fc
0x00a6f603
0x00a6f606
0x00a6f609
0x00a6f60c
0x00a6f60f
0x00000000
0x00000000
0x00000000
0x00a6f60f
0x00a6f611
0x00a6f611
0x00a6f619
0x00a6f625
0x00a6f625
0x00a6f62a
0x00a6f639
0x00a6f64e
0x00a6f657

APIs

Part of subcall function 00A6A2FA: GetVersionExW.KERNEL32(?), ref: 00A6A31F

FileTimeToLocalFileTime.KERNEL32(?,?,?,00000000,?), ref: 00A6F532
FileTimeToSystemTime.KERNEL32(?,?,?,00000000,?), ref: 00A6F544
SystemTimeToTzSpecificLocalTime.KERNELBASE(00000000,?,?), ref: 00A6F551
SystemTimeToFileTime.KERNEL32(?,?), ref: 00A6F561
SystemTimeToFileTime.KERNEL32(?,?), ref: 00A6F56D
FileTimeToSystemTime.KERNEL32(?,?), ref: 00A6F5AA
SystemTimeToFileTime.KERNEL32(?,?), ref: 00A6F639

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: dae7d4225c435092079b206cbd6b33c27ebffd4356b7a2703f35eacfc9c6138a
Instruction ID: 6f7a44d274118de067550f0cedefc5ca12f89036cba472b8a95293be979ac4c0
Opcode Fuzzy Hash: dae7d4225c435092079b206cbd6b33c27ebffd4356b7a2703f35eacfc9c6138a
Instruction Fuzzy Hash: 5D41F2B25083459FC714CFA9D98096BF7F8FF88704F544A2EF996C2210E735E9498B62

Uniqueness

Uniqueness Score: -1.00%

Function 00A86B97 Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E00A86B97(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8, signed int _a12, char* _a16, int _a20, intOrPtr _a24, short* _a28, int _a32, intOrPtr _a36) {
				signed int _v8;
				int _v12;
				void* _v24;
				signed int _t49;
				signed int _t54;
				int _t58;
				signed int _t60;
				short* _t62;
				signed int _t66;
				short* _t70;
				int _t71;
				int _t78;
				short* _t81;
				signed int _t87;
				signed int _t90;
				void* _t95;
				void* _t96;
				int _t98;
				short* _t101;
				int _t103;
				signed int _t106;
				short* _t107;
				void* _t110;

				_push(__ecx);
				_push(__ecx);
				_t49 =  *0xa991b8; // 0x3197ea2d
				_v8 = _t49 ^ _t106;
				_push(__esi);
				_t103 = _a20;
				if(_t103 > 0) {
					_t78 = E00A8B13C(_a16, _t103);
					_t110 = _t78 - _t103;
					_t4 = _t78 + 1; // 0x1
					_t103 = _t4;
					if(_t110 >= 0) {
						_t103 = _t78;
					}
				}
				_t98 = _a32;
				if(_t98 == 0) {
					_t98 =  *( *_a4 + 8);
					_a32 = _t98;
				}
				_t54 = MultiByteToWideChar(_t98, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t103, 0, 0);
				_v12 = _t54;
				if(_t54 == 0) {
					L38:
					return E00A7CABF(_v8 ^ _t106);
				} else {
					_t95 = _t54 + _t54;
					_t85 = _t95 + 8;
					asm("sbb eax, eax");
					if((_t95 + 0x00000008 & _t54) == 0) {
						_t81 = 0;
						__eflags = 0;
						L14:
						if(_t81 == 0) {
							L36:
							_t105 = 0;
							L37:
							E00A86DFF(_t81);
							goto L38;
						}
						_t58 = MultiByteToWideChar(_t98, 1, _a16, _t103, _t81, _v12);
						_t121 = _t58;
						if(_t58 == 0) {
							goto L36;
						}
						_t100 = _v12;
						_t60 = E00A871F2(_t85, _t103, _t121, _a8, _a12, _t81, _v12, 0, 0, 0, 0, 0); // executed
						_t105 = _t60;
						if(_t105 == 0) {
							goto L36;
						}
						if((_a12 & 0x00000400) == 0) {
							_t96 = _t105 + _t105;
							_t87 = _t96 + 8;
							__eflags = _t96 - _t87;
							asm("sbb eax, eax");
							__eflags = _t87 & _t60;
							if((_t87 & _t60) == 0) {
								_t101 = 0;
								__eflags = 0;
								L30:
								__eflags = _t101;
								if(__eflags == 0) {
									L35:
									E00A86DFF(_t101);
									goto L36;
								}
								_t62 = E00A871F2(_t87, _t105, __eflags, _a8, _a12, _t81, _v12, _t101, _t105, 0, 0, 0);
								__eflags = _t62;
								if(_t62 == 0) {
									goto L35;
								}
								_push(0);
								_push(0);
								__eflags = _a28;
								if(_a28 != 0) {
									_push(_a28);
									_push(_a24);
								} else {
									_push(0);
									_push(0);
								}
								_t105 = WideCharToMultiByte(_a32, 0, _t101, _t105, ??, ??, ??, ??);
								__eflags = _t105;
								if(_t105 != 0) {
									E00A86DFF(_t101);
									goto L37;
								} else {
									goto L35;
								}
							}
							_t90 = _t96 + 8;
							__eflags = _t96 - _t90;
							asm("sbb eax, eax");
							_t66 = _t60 & _t90;
							_t87 = _t96 + 8;
							__eflags = _t66 - 0x400;
							if(_t66 > 0x400) {
								__eflags = _t96 - _t87;
								asm("sbb eax, eax");
								_t101 = E00A851E6(_t87, _t66 & _t87);
								_pop(_t87);
								__eflags = _t101;
								if(_t101 == 0) {
									goto L35;
								}
								 *_t101 = 0xdddd;
								L28:
								_t101 =  &(_t101[4]);
								goto L30;
							}
							__eflags = _t96 - _t87;
							asm("sbb eax, eax");
							E00A8E900();
							_t101 = _t107;
							__eflags = _t101;
							if(_t101 == 0) {
								goto L35;
							}
							 *_t101 = 0xcccc;
							goto L28;
						}
						_t70 = _a28;
						if(_t70 == 0) {
							goto L37;
						}
						_t125 = _t105 - _t70;
						if(_t105 > _t70) {
							goto L36;
						}
						_t71 = E00A871F2(0, _t105, _t125, _a8, _a12, _t81, _t100, _a24, _t70, 0, 0, 0);
						_t105 = _t71;
						if(_t71 != 0) {
							goto L37;
						}
						goto L36;
					}
					asm("sbb eax, eax");
					_t72 = _t54 & _t95 + 0x00000008;
					_t85 = _t95 + 8;
					if((_t54 & _t95 + 0x00000008) > 0x400) {
						__eflags = _t95 - _t85;
						asm("sbb eax, eax");
						_t81 = E00A851E6(_t85, _t72 & _t85);
						_pop(_t85);
						__eflags = _t81;
						if(__eflags == 0) {
							goto L36;
						}
						 *_t81 = 0xdddd;
						L12:
						_t81 =  &(_t81[4]);
						goto L14;
					}
					asm("sbb eax, eax");
					E00A8E900();
					_t81 = _t107;
					if(_t81 == 0) {
						goto L36;
					}
					 *_t81 = 0xcccc;
					goto L12;
				}
			}

0x00a86b9c
0x00a86b9d
0x00a86b9e
0x00a86ba5
0x00a86ba9
0x00a86baa
0x00a86bb0
0x00a86bb6
0x00a86bbc
0x00a86bbf
0x00a86bbf
0x00a86bc2
0x00a86bc4
0x00a86bc4
0x00a86bc2
0x00a86bc6
0x00a86bcb
0x00a86bd2
0x00a86bd5
0x00a86bd5
0x00a86bf1
0x00a86bf7
0x00a86bfc
0x00a86d8f
0x00a86da2
0x00a86c02
0x00a86c02
0x00a86c05
0x00a86c0a
0x00a86c0e
0x00a86c62
0x00a86c62
0x00a86c64
0x00a86c66
0x00a86d84
0x00a86d84
0x00a86d86
0x00a86d87
0x00000000
0x00a86d8d
0x00a86c77
0x00a86c7d
0x00a86c7f
0x00000000
0x00000000
0x00a86c85
0x00a86c97
0x00a86c9c
0x00a86ca0
0x00000000
0x00000000
0x00a86cad
0x00a86ce7
0x00a86cea
0x00a86ced
0x00a86cef
0x00a86cf1
0x00a86cf3
0x00a86d3f
0x00a86d3f
0x00a86d41
0x00a86d41
0x00a86d43
0x00a86d7d
0x00a86d7e
0x00000000
0x00a86d83
0x00a86d57
0x00a86d5c
0x00a86d5e
0x00000000
0x00000000
0x00a86d62
0x00a86d63
0x00a86d64
0x00a86d67
0x00a86da3
0x00a86da6
0x00a86d69
0x00a86d69
0x00a86d6a
0x00a86d6a
0x00a86d77
0x00a86d79
0x00a86d7b
0x00a86dac
0x00000000
0x00000000
0x00000000
0x00000000
0x00a86d7b
0x00a86cf5
0x00a86cf8
0x00a86cfa
0x00a86cfc
0x00a86cfe
0x00a86d01
0x00a86d06
0x00a86d21
0x00a86d23
0x00a86d2d
0x00a86d2f
0x00a86d30
0x00a86d32
0x00000000
0x00000000
0x00a86d34
0x00a86d3a
0x00a86d3a
0x00000000
0x00a86d3a
0x00a86d08
0x00a86d0a
0x00a86d0e
0x00a86d13
0x00a86d15
0x00a86d17
0x00000000
0x00000000
0x00a86d19
0x00000000
0x00a86d19
0x00a86caf
0x00a86cb4
0x00000000
0x00000000
0x00a86cba
0x00a86cbc
0x00000000
0x00000000
0x00a86cd3
0x00a86cd8
0x00a86cdc
0x00000000
0x00000000
0x00000000
0x00a86ce2
0x00a86c15
0x00a86c17
0x00a86c19
0x00a86c21
0x00a86c40
0x00a86c42
0x00a86c4c
0x00a86c4e
0x00a86c4f
0x00a86c51
0x00000000
0x00000000
0x00a86c57
0x00a86c5d
0x00a86c5d
0x00000000
0x00a86c5d
0x00a86c25
0x00a86c29
0x00a86c2e
0x00a86c32
0x00000000
0x00000000
0x00a86c38
0x00000000
0x00a86c38

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00A825B2,00A825B2,?,?,?,00A86DE8,00000001,00000001,EFE85006), ref: 00A86BF1
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00A86DE8,00000001,00000001,EFE85006,?,?,?), ref: 00A86C77
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,EFE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00A86D71
__freea.LIBCMT ref: 00A86D7E

Part of subcall function 00A851E6: RtlAllocateHeap.NTDLL(00000000,?,?,?,00A8199A,?,0000015D,?,?,?,?,00A82519,000000FF,00000000,?,?), ref: 00A85218

__freea.LIBCMT ref: 00A86D87
__freea.LIBCMT ref: 00A86DAC

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 9c8d03530fdf8141bf7d5bf63d3acbed29e2abdff85c8faeb6ea6eac48ca100e
Instruction ID: d8bcd977458dc479dd80ca16c8996eefe0bedf15ad1772a8d16d5826cfcccdc4
Opcode Fuzzy Hash: 9c8d03530fdf8141bf7d5bf63d3acbed29e2abdff85c8faeb6ea6eac48ca100e
Instruction Fuzzy Hash: E151D072700616AFEB25AF64CD49EBF77AAEB44750F294A28FD04D6150EB34DC50C760

Uniqueness

Uniqueness Score: -1.00%

Function 00A6F729 Relevance: 9.1, APIs: 6, Instructions: 96
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E00A6F729(long* __ecx, void* __edx, intOrPtr* _a4) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				struct _FILETIME _v28;
				struct _SYSTEMTIME _v44;
				struct _SYSTEMTIME _v60;
				struct _SYSTEMTIME _v76;
				int _t50;
				long _t52;
				int _t66;
				signed int _t71;
				long _t78;
				long* _t79;
				intOrPtr* _t80;

				_t80 = _a4;
				_t79 = __ecx;
				_v44.wYear =  *_t80;
				_t3 = _t80 + 4; // 0x8b550004
				_v44.wMonth =  *_t3;
				_t5 = _t80 + 8; // 0x48ec83ec
				_v44.wDay =  *_t5;
				_t7 = _t80 + 0xc; // 0x758b5653
				_v44.wHour =  *_t7;
				_t9 = _t80 + 0x10; // 0xf81d8b08
				_v44.wMinute =  *_t9;
				_t11 = _t80 + 0x14; // 0x5700a8f0
				_v44.wSecond =  *_t11;
				_v44.wMilliseconds = 0;
				_v44.wDayOfWeek = 0;
				_t50 = SystemTimeToFileTime( &_v44,  &_v12);
				if(_t50 == 0) {
					 *_t79 = 0;
					_t79[1] = 0;
					return _t50;
				}
				_t18 = _t80 + 0x18; // 0x8b66f98b
				_t52 = _v12.dwLowDateTime +  *_t18;
				_v12.dwLowDateTime = _t52;
				_t20 = _t80 + 0x18; // 0x8b66f98b
				if(_t52 <  *_t20) {
					_v12.dwHighDateTime = _v12.dwHighDateTime + 1;
				}
				if(E00A6A2FA() >= 0x600) {
					FileTimeToSystemTime( &_v12,  &_v60);
					__imp__TzSpecificLocalTimeToSystemTime(0,  &_v60,  &_v76); // executed
					SystemTimeToFileTime( &_v76,  &_v20);
					SystemTimeToFileTime( &_v60,  &_v28);
					_t71 = _v20.dwHighDateTime;
					asm("sbb ecx, [ebp-0x14]");
					asm("adc ecx, [ebp-0x4]");
					asm("sbb ecx, esi");
					asm("adc ecx, esi");
					_t78 = 0 - _v28.dwLowDateTime + _v20.dwLowDateTime + _v12.dwLowDateTime;
					asm("adc ecx, esi");
					_t66 = _t71 >> 0x1f;
				} else {
					_t66 = LocalFileTimeToFileTime( &_v12,  &_v20);
					_t71 = _v20.dwHighDateTime;
					_t78 = _v20.dwLowDateTime;
				}
				 *_t79 = _t78;
				_t79[1] = _t71;
				return _t66;
			}

0x00a6f731
0x00a6f73b
0x00a6f740
0x00a6f744
0x00a6f748
0x00a6f74c
0x00a6f750
0x00a6f754
0x00a6f758
0x00a6f75c
0x00a6f760
0x00a6f764
0x00a6f768
0x00a6f76e
0x00a6f772
0x00a6f77e
0x00a6f782
0x00a6f81a
0x00a6f81c
0x00000000
0x00a6f81c
0x00a6f78b
0x00a6f78b
0x00a6f78e
0x00a6f791
0x00a6f794
0x00a6f796
0x00a6f796
0x00a6f7a3
0x00a6f7c3
0x00a6f7d4
0x00a6f7e2
0x00a6f7ec
0x00a6f7ee
0x00a6f7f5
0x00a6f7fa
0x00a6f800
0x00a6f805
0x00a6f807
0x00a6f80a
0x00a6f80e
0x00a6f7a5
0x00a6f7ad
0x00a6f7b3
0x00a6f7b6
0x00a6f7b6
0x00a6f811
0x00a6f813
0x00000000

APIs

SystemTimeToFileTime.KERNEL32(?,00A6F723), ref: 00A6F77E
LocalFileTimeToFileTime.KERNEL32(00A6F723,?), ref: 00A6F7AD
FileTimeToSystemTime.KERNEL32(00A6F723,?), ref: 00A6F7C3
TzSpecificLocalTimeToSystemTime.KERNELBASE(00000000,?,?), ref: 00A6F7D4
SystemTimeToFileTime.KERNEL32(?,?), ref: 00A6F7E2
SystemTimeToFileTime.KERNEL32(?,?), ref: 00A6F7EC

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: Time$File$System$Local$Specific
String ID:
API String ID: 3144155402-0
Opcode ID: 55166365fc412eb313f05218f2bdcaefea6c008b9618fb5157376230d8ae60f2
Instruction ID: a1765bd97fd2642730283b399d925a7f7a5f8ae43106c2ad7220f1a40787c960
Opcode Fuzzy Hash: 55166365fc412eb313f05218f2bdcaefea6c008b9618fb5157376230d8ae60f2
Instruction Fuzzy Hash: BE31DC7990021ADFCB14DFE4D8849EEF7B8FF58700B14456AE955E3610E730A945CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00A6915C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 99
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E00A6915C(void* __ecx, void* __esi, long _a4, short _a8, WCHAR* _a4108, signed char _a4112) {
				long _v0;
				long _t36;
				void* _t37;
				long _t46;
				signed char _t48;
				long _t51;
				signed int _t52;
				struct _SECURITY_ATTRIBUTES* _t55;
				void* _t59;
				void* _t61;
				long _t65;
				void* _t68;

				_t61 = __esi;
				E00A7C240();
				_t48 = _a4112;
				_t59 = __ecx;
				 *((intOrPtr*)(__ecx + 0x1020)) = 0;
				if( *((intOrPtr*)(__ecx + 0x1c)) != 0) {
					L2:
					_t55 = 1;
					L3:
					_push(_t61);
					asm("sbb esi, esi");
					_t65 = ( ~(_t48 >> 0x00000001 & 1) & 0xc0000000) + 0x80000000;
					if((_t48 & 0x00000001) != 0) {
						_t65 = _t65 | 0x40000000;
					}
					_t51 =  !(_t48 >> 3) & 0x00000001;
					if(_t55 != 0) {
						_t51 = _t51 | 0x00000002;
					}
					_t36 = (0 |  *((intOrPtr*)(_t59 + 0x15)) != 0x00000000) - 0x00000001 & 0x08000000;
					_a4 = _t36;
					_t37 = CreateFileW(_a4108, _t65, _t51, 0, 3, _t36, 0); // executed
					_t68 = _t37;
					if(_t68 != 0xffffffff) {
						L14:
						 *((char*)(_t59 + 0x12)) = 0;
						_t52 = _t51 & 0xffffff00 | _t68 != 0xffffffff;
						 *((intOrPtr*)(_t59 + 0xc)) = 0;
						 *((char*)(_t59 + 0x10)) = 0;
						if(_t52 != 0) {
							 *(_t59 + 4) = _t68;
							E00A6E847(_t59 + 0x1e, _a4108, 0x800);
						}
						return _t52;
					} else {
						_v0 = GetLastError();
						if(E00A6AC19(0, _a4108,  &_a8, 0x800) == 0) {
							L12:
							if(_v0 == 2) {
								 *((intOrPtr*)(_t59 + 0x1020)) = 1;
							}
							goto L14;
						}
						_t68 = CreateFileW( &_a8, _t65, _t51, 0, 3, _a4, 0);
						_t46 = GetLastError();
						if(_t46 == 2) {
							_v0 = _t46;
						}
						if(_t68 != 0xffffffff) {
							goto L14;
						} else {
							goto L12;
						}
					}
				}
				_t55 = 0;
				if((_t48 & 0x00000004) == 0) {
					goto L3;
				}
				goto L2;
			}

0x00a6915c
0x00a69161
0x00a69167
0x00a69172
0x00a69174
0x00a6917d
0x00a69186
0x00a69186
0x00a69188
0x00a6918c
0x00a69194
0x00a6919c
0x00a691a5
0x00a691a7
0x00a691a7
0x00a691b2
0x00a691b7
0x00a691b9
0x00a691b9
0x00a691c6
0x00a691d8
0x00a691dc
0x00a691e2
0x00a691e7
0x00a6924b
0x00a69250
0x00a69253
0x00a69256
0x00a69259
0x00a6925f
0x00a69270
0x00a69274
0x00a69274
0x00a69284
0x00a691e9
0x00a691ef
0x00a6920b
0x00a6923a
0x00a6923f
0x00a69241
0x00a69241
0x00000000
0x00a6923f
0x00a69224
0x00a69226
0x00a6922f
0x00a69231
0x00a69231
0x00a69238
0x00000000
0x00000000
0x00000000
0x00000000
0x00a69238
0x00a691e7
0x00a6917f
0x00a69184
0x00000000
0x00000000
0x00000000

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,-00000001,00000000,?,?,?,00000000,00A67240,?,00000005,?,00000011), ref: 00A691DC
GetLastError.KERNEL32(?,00000000,00A67240,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00A691E9
CreateFileW.KERNEL32(?,?,?,00000000,00000003,?,00000000,?,?,00000800,?,00000000,00A67240,?,00000005,?), ref: 00A6921E
GetLastError.KERNEL32(?,00000000,00A67240,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00A69226

Strings

@Mqt0Lqt, xrefs: 00A691E9, 00A69226

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: CreateErrorFileLast
String ID: @Mqt0Lqt
API String ID: 1214770103-1302913217
Opcode ID: cbdb4557e599942a2858be8a2c609a2d0cc919690cfb3f2134e964091f2e32a8
Instruction ID: 9b645297da316c3aef52c1bd6faf25e4f009f58344df552b5333da99aede118c
Opcode Fuzzy Hash: cbdb4557e599942a2858be8a2c609a2d0cc919690cfb3f2134e964091f2e32a8
Instruction Fuzzy Hash: EA3144718403567FE7209B748C09BEBBBF8FB46314F204629F990872C1E37598899BE0

Uniqueness

Uniqueness Score: -1.00%

Function 00A69032 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E00A69032(void* __ecx, void* _a4, long _a8) {
				long _v8;
				int _t14;
				signed int _t15;
				void* _t25;

				_push(__ecx);
				_t25 = __ecx;
				if( *((intOrPtr*)(__ecx + 0xc)) == 1) {
					 *(_t25 + 4) = GetStdHandle(0xfffffff6);
				}
				_t14 = ReadFile( *(_t25 + 4), _a4, _a8,  &_v8, 0); // executed
				if(_t14 != 0) {
					_t15 = _v8;
				} else {
					_t16 = E00A69139(_t25);
					if(_t16 == 0) {
						L7:
						if( *((intOrPtr*)(_t25 + 0xc)) != 1) {
							L10:
							if( *((intOrPtr*)(_t25 + 0xc)) != 0 || _a8 <= 0x8000) {
								L14:
								_t15 = _t16 | 0xffffffff;
							} else {
								_t16 = GetLastError();
								if(_t16 != 0x21) {
									goto L14;
								} else {
									_push(0x8000);
									goto L6;
								}
							}
						} else {
							_t16 = GetLastError();
							if(_t16 != 0x6d) {
								goto L10;
							} else {
								_t15 = 0;
							}
						}
					} else {
						_t16 = 0x4e20;
						if(_a8 <= 0x4e20) {
							goto L7;
						} else {
							_push(0x4e20);
							L6:
							_push(_a4);
							_t15 = E00A69032(_t25);
						}
					}
				}
				return _t15;
			}

0x00a69035
0x00a69038
0x00a6903e
0x00a69048
0x00a69048
0x00a6905a
0x00a69062
0x00a690be
0x00a69064
0x00a69066
0x00a6906d
0x00a69086
0x00a6908a
0x00a6909b
0x00a6909f
0x00a690b9
0x00a690b9
0x00a690ab
0x00a690ab
0x00a690b4
0x00000000
0x00a690b6
0x00a690b6
0x00000000
0x00a690b6
0x00a690b4
0x00a6908c
0x00a6908c
0x00a69095
0x00000000
0x00a69097
0x00a69097
0x00a69097
0x00a69095
0x00a6906f
0x00a6906f
0x00a69077
0x00000000
0x00a69079
0x00a69079
0x00a6907a
0x00a6907a
0x00a6907f
0x00a6907f
0x00a69077
0x00a6906d
0x00a690c6

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00A69042
ReadFile.KERNELBASE(?,?,00000001,?,00000000), ref: 00A6905A
GetLastError.KERNEL32 ref: 00A6908C
GetLastError.KERNEL32 ref: 00A690AB

Strings

@Mqt0Lqt, xrefs: 00A6908C, 00A690AB

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID: @Mqt0Lqt
API String ID: 2244327787-1302913217
Opcode ID: 970c9e2ff1ec6062b588af0f809e8bdbfd9921f32dfbcc787d786089f1d2f208
Instruction ID: 70d46f1298608105df02b944aa74f82868387b70131a8536d888e148168a6b0d
Opcode Fuzzy Hash: 970c9e2ff1ec6062b588af0f809e8bdbfd9921f32dfbcc787d786089f1d2f208
Instruction Fuzzy Hash: 24118B70A00205EFCF309FA1C904A7B77BCEB15375F12C62AF926C6294DB368D408B92

Uniqueness

Uniqueness Score: -1.00%

Function 00A86FBA Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E00A86FBA(signed int _a4) {
				signed int _t9;
				void* _t10;
				void* _t13;
				signed int _t15;
				WCHAR* _t22;
				signed int _t24;
				signed int* _t25;
				void* _t27;

				_t9 = _a4;
				_t25 = 0xab8770 + _t9 * 4;
				_t24 =  *_t25;
				if(_t24 == 0) {
					_t22 =  *(0xa92290 + _t9 * 4);
					_t10 = LoadLibraryExW(_t22, 0, 0x800); // executed
					_t27 = _t10;
					if(_t27 != 0) {
						L8:
						 *_t25 = _t27;
						if( *_t25 != 0) {
							FreeLibrary(_t27);
						}
						_t13 = _t27;
						L11:
						return _t13;
					}
					_t15 = GetLastError();
					if(_t15 != 0x57) {
						_t27 = 0;
					} else {
						_t15 = LoadLibraryExW(_t22, _t27, _t27);
						_t27 = _t15;
					}
					if(_t27 != 0) {
						goto L8;
					} else {
						 *_t25 = _t15 | 0xffffffff;
						_t13 = 0;
						goto L11;
					}
				}
				_t4 = _t24 + 1; // 0x3197ea2e
				asm("sbb eax, eax");
				return  ~_t4 & _t24;
			}

0x00a86fbf
0x00a86fc3
0x00a86fca
0x00a86fce
0x00a86fdc
0x00a86fec
0x00a86ff2
0x00a86ff6
0x00a8701f
0x00a87021
0x00a87025
0x00a87028
0x00a87028
0x00a8702e
0x00a87030
0x00000000
0x00a87031
0x00a86ff8
0x00a87001
0x00a87010
0x00a87003
0x00a87006
0x00a8700c
0x00a8700c
0x00a87014
0x00000000
0x00a87016
0x00a87019
0x00a8701b
0x00000000
0x00a8701b
0x00a87014
0x00a86fd0
0x00a86fd5
0x00000000

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,00A81803,00000000,00000000,?,00A86F61,00A81803,00000000,00000000,00000000,?,00A8715E,00000006,FlsSetValue), ref: 00A86FEC
GetLastError.KERNEL32(?,00A86F61,00A81803,00000000,00000000,00000000,?,00A8715E,00000006,FlsSetValue,00A92748,00A92750,00000000,00000364,?,00A85BDA), ref: 00A86FF8
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00A86F61,00A81803,00000000,00000000,00000000,?,00A8715E,00000006,FlsSetValue,00A92748,00A92750,00000000), ref: 00A87006

Strings

@Mqt0Lqt, xrefs: 00A86FF8

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: @Mqt0Lqt
API String ID: 3177248105-1302913217
Opcode ID: c2f96254573a872be4e6374149d571237a78db94bf861ab474558cbe9b9a3924
Instruction ID: b3418e9495fc48b047923071f72b1f15942acd84e24d8813fb6e86c24bf4e8d3
Opcode Fuzzy Hash: c2f96254573a872be4e6374149d571237a78db94bf861ab474558cbe9b9a3924
Instruction Fuzzy Hash: 4B01FC366552239FC7219BA89C44A5A7B78AF04BA17300630FA0AD7241DB20DC02C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 00A784FB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00A784FB(long _a4) {
				short _v164;
				long _t5;
				long _t6;
				WCHAR* _t9;
				long _t11;

				_t11 = _a4;
				_t5 = GetClassNameW(_t11,  &_v164, 0x50);
				if(_t5 != 0) {
					_t9 = L"EDIT";
					_t5 = E00A700DF( &_v164, _t9);
					if(_t5 != 0) {
						_t5 = FindWindowExW(_t11, 0, _t9, 0); // executed
						_t11 = _t5;
					}
				}
				if(_t11 != 0) {
					_t6 = SHAutoComplete(_t11, 0x10); // executed
					return _t6;
				}
				return _t5;
			}

0x00a7850b
0x00a78512
0x00a7851a
0x00a7851d
0x00a7852a
0x00a78531
0x00a78539
0x00a7853f
0x00a7853f
0x00a78541
0x00a78544
0x00a78549
0x00000000
0x00a78549
0x00a78553

APIs

GetClassNameW.USER32(?,?,00000050), ref: 00A78512
SHAutoComplete.SHLWAPI(?,00000010), ref: 00A78549

Part of subcall function 00A700DF: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,00A6A645,?,?,?,00A6A5F2,?,-00000002,?,00000000,?), ref: 00A700F5

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00A78539

Strings

EDIT, xrefs: 00A7851D, 00A78528, 00A78535
plt, xrefs: 00A78549

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT$plt
API String ID: 4243998846-3533433962
Opcode ID: eae32d72b0ed787e97919ea6b01e025f27fc1b4cab9cd7813ceed1f60186220e
Instruction ID: e0f469e60fe76f0cf53e3138f10b9b916014d58870de14eec9686f5af479429a
Opcode Fuzzy Hash: eae32d72b0ed787e97919ea6b01e025f27fc1b4cab9cd7813ceed1f60186220e
Instruction Fuzzy Hash: 03F0E9327812287BDB2097585C09FEB766CDF46F40F448056BD08A3080DB64AD03C5F5

Uniqueness

Uniqueness Score: -1.00%

Function 00A6F07B Relevance: 7.5, APIs: 5, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E00A6F07B(void* __ecx) {
				intOrPtr _v16;
				void* __ebp;
				int _t16;
				void** _t21;
				long* _t25;
				void* _t28;
				void* _t30;
				intOrPtr _t31;

				_t22 = __ecx;
				_push(0xffffffff);
				_push(E00A8EB81);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t31;
				_t28 = __ecx;
				E00A6F473(__ecx);
				_t25 = 0;
				 *((char*)(__ecx + 0x194)) = 1;
				ReleaseSemaphore( *(__ecx + 0x198), 0x20, 0);
				if( *((intOrPtr*)(_t28 + 0x84)) > 0) {
					_t21 = _t28 + 4;
					do {
						E00A6F171(_t22, _t30,  *_t21);
						CloseHandle( *_t21);
						_t25 = _t25 + 1;
						_t21 =  &(_t21[1]);
					} while (_t25 <  *((intOrPtr*)(_t28 + 0x84)));
				}
				DeleteCriticalSection(_t28 + 0x1a0);
				FindCloseChangeNotification( *(_t28 + 0x198)); // executed
				_t16 = CloseHandle( *(_t28 + 0x19c));
				 *[fs:0x0] = _v16;
				return _t16;
			}

0x00a6f07b
0x00a6f084
0x00a6f086
0x00a6f08b
0x00a6f08c
0x00a6f096
0x00a6f098
0x00a6f09d
0x00a6f09f
0x00a6f0af
0x00a6f0bb
0x00a6f0bd
0x00a6f0c0
0x00a6f0c2
0x00a6f0c9
0x00a6f0cf
0x00a6f0d0
0x00a6f0d3
0x00a6f0c0
0x00a6f0e2
0x00a6f0ee
0x00a6f0fa
0x00a6f105
0x00a6f110

APIs

Part of subcall function 00A6F473: ResetEvent.KERNEL32(?,?,00A6F09D,0111A6E8,?,00AA14A0,00000000,00A8EB81,000000FF,000001B8,00A6F339,?,?,?,?,00A69FBE), ref: 00A6F493
Part of subcall function 00A6F473: ReleaseSemaphore.KERNEL32(?,?,00000000,?,?,?,?,00A69FBE,?,?,?,?,00A8EB81,000000FF), ref: 00A6F4A7

ReleaseSemaphore.KERNEL32(?,00000020,00000000), ref: 00A6F0AF
CloseHandle.KERNEL32(?,?), ref: 00A6F0C9
DeleteCriticalSection.KERNEL32(?), ref: 00A6F0E2
FindCloseChangeNotification.KERNELBASE(?), ref: 00A6F0EE
CloseHandle.KERNEL32(?), ref: 00A6F0FA

Part of subcall function 00A6F171: WaitForSingleObject.KERNEL32(?,000000FF,00A6F4B8,?,?,?,?,?,00A69FBE,?,?,?,?,00A8EB81,000000FF), ref: 00A6F177
Part of subcall function 00A6F171: GetLastError.KERNEL32(?,?,?,?,?,00A69FBE,?,?,?,?,00A8EB81,000000FF), ref: 00A6F183

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: Close$HandleReleaseSemaphore$ChangeCriticalDeleteErrorEventFindLastNotificationObjectResetSectionSingleWait
String ID:
API String ID: 565839277-0
Opcode ID: bc2b9760a4f9e0670e52fb70aaf5c8181f9548de441a318696e008eabf043c1a
Instruction ID: a082be88167ce949f271cf0c794abd84bca04c5d744dc5a13343a741e944fc98
Opcode Fuzzy Hash: bc2b9760a4f9e0670e52fb70aaf5c8181f9548de441a318696e008eabf043c1a
Instruction Fuzzy Hash: DA01B132000740EFCB21EB68ED89F86BBFAFB46750F004539F2AA82561DB712811CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A698A7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A698A7(void* __ecx, void* __edx, void* __eflags, WCHAR* _a4, char _a8, intOrPtr _a12) {
				short _v4100;
				signed int _t8;
				long _t10;
				void* _t11;
				int _t18;
				void* _t20;
				WCHAR* _t22;

				_t20 = __edx;
				E00A7C240();
				_t22 = _a4;
				_t8 =  *(E00A6B1B4(__eflags, _t22)) & 0x0000ffff;
				if(_t8 == 0x2e || _t8 == 0x20) {
					L3:
					if(E00A69820(_t22) != 0 || E00A6AC19(_t20, _t22,  &_v4100, 0x800) == 0 || CreateDirectoryW( &_v4100, 0) == 0) {
						_t10 = GetLastError();
						__eflags = _t10 - 2;
						if(_t10 == 2) {
							L12:
							_t11 = 2;
						} else {
							__eflags = _t10 - 3;
							if(_t10 == 3) {
								goto L12;
							} else {
								_t11 = 1;
							}
						}
					} else {
						goto L6;
					}
				} else {
					_t18 = CreateDirectoryW(_t22, 0); // executed
					if(_t18 != 0) {
						L6:
						if(_a8 != 0) {
							E00A69AE4(_t22, _a12); // executed
						}
						_t11 = 0;
					} else {
						goto L3;
					}
				}
				return _t11;
			}

0x00a698a7
0x00a698af
0x00a698b5
0x00a698be
0x00a698c4
0x00a698d8
0x00a698e0
0x00a6991e
0x00a69924
0x00a69927
0x00a69933
0x00a69935
0x00a69929
0x00a69929
0x00a6992c
0x00000000
0x00a6992e
0x00a69930
0x00a69930
0x00a6992c
0x00000000
0x00000000
0x00000000
0x00a698cb
0x00a698ce
0x00a698d6
0x00a6990b
0x00a6990f
0x00a69915
0x00a69915
0x00a6991a
0x00000000
0x00000000
0x00000000
0x00a698d6
0x00a6993a

APIs

Part of subcall function 00A6B1B4: _wcslen.LIBCMT ref: 00A6B1BA

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,00A697B3,?,00000001,00000000,?,?), ref: 00A698CE
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,00A697B3,?,00000001,00000000,?,?), ref: 00A69901
GetLastError.KERNEL32(?,?,?,?,00A697B3,?,00000001,00000000,?,?), ref: 00A6991E

Strings

@Mqt0Lqt, xrefs: 00A6991E

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_wcslen
String ID: @Mqt0Lqt
API String ID: 2260680371-1302913217
Opcode ID: 0a84f7f4f63c70377f074a8be6316d15d286a973edad6afe1fb670aeaa70d841
Instruction ID: dda481fdc8a9206e4acf8a731c68dd7fba1b1f920b9e8ef6cb916aae4168876c
Opcode Fuzzy Hash: 0a84f7f4f63c70377f074a8be6316d15d286a973edad6afe1fb670aeaa70d841
Instruction Fuzzy Hash: BB01B1331002156ADB31AFB54C06BFF33BCAF16781F140459F945D61A2D7708E85D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00A7B1D7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00A7B1D7(void* __eflags, WCHAR* _a4) {
				char _v8196;
				int _t7;
				WCHAR* _t12;
				void* _t14;

				_t14 = __eflags;
				E00A7C240();
				SetEnvironmentVariableW(L"sfxcmd", _a4);
				_t7 = E00A6E63C(_t14, _a4,  &_v8196, 0x1000);
				_t12 = _t7;
				if(_t12 != 0) {
					_push( *_t12 & 0x0000ffff);
					while(E00A6E733() != 0) {
						_t12 =  &(_t12[1]);
						__eflags = _t12;
						_push( *_t12 & 0x0000ffff);
					}
					_t7 = SetEnvironmentVariableW(L"sfxpar", _t12); // executed
				}
				return _t7;
			}

0x00a7b1d7
0x00a7b1df
0x00a7b1ed
0x00a7b202
0x00a7b207
0x00a7b20b
0x00a7b210
0x00a7b21a
0x00a7b213
0x00a7b213
0x00a7b219
0x00a7b219
0x00a7b229
0x00a7b229
0x00a7b233

APIs

SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 00A7B1ED
SetEnvironmentVariableW.KERNELBASE(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00A7B229

Strings

sfxcmd, xrefs: 00A7B1E8
sfxpar, xrefs: 00A7B224

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: 02fd75df69b5b8f2f77f7925089fd73e9cf388b3e4dadfb65201c2de78a68a76
Instruction ID: 18fb46cd1091912bb05e20cf46412240610156defdf545267209908bc84aedb4
Opcode Fuzzy Hash: 02fd75df69b5b8f2f77f7925089fd73e9cf388b3e4dadfb65201c2de78a68a76
Instruction Fuzzy Hash: FDF0A7B1951228BADB206FD5DC09FFA77A9BF24B41F048125FD4896152D7608C40C7F0

Uniqueness

Uniqueness Score: -1.00%

Function 00A61DF9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00A61DF9(intOrPtr __ecx, void* __edx, void* __edi, void* __esi) {
				void* _t34;
				intOrPtr _t41;
				intOrPtr _t51;
				void* _t62;
				unsigned int _t64;
				signed int _t66;
				intOrPtr* _t68;
				void* _t70;

				_t62 = __edx;
				_t51 = __ecx;
				E00A7C16C(E00A8ED46, _t70);
				_t49 = 0;
				 *((intOrPtr*)(_t70 - 0x10)) = _t51;
				 *((intOrPtr*)(_t70 - 0x20)) = 0;
				 *(_t70 - 0x1c) = 0;
				 *((intOrPtr*)(_t70 - 0x18)) = 0;
				 *((intOrPtr*)(_t70 - 0x14)) = 0;
				_push(0);
				 *((intOrPtr*)(_t70 - 4)) = 0;
				_push(_t70 - 0x20);
				_t34 = E00A63878(_t51, _t62); // executed
				if(_t34 != 0) {
					_t64 =  *(_t70 - 0x1c);
					E00A6183E(_t70 - 0x20, _t62, 1);
					_t68 =  *((intOrPtr*)(_t70 + 8));
					 *((char*)( *(_t70 - 0x1c) +  *((intOrPtr*)(_t70 - 0x20)) - 1)) = 0;
					E00A61927(_t68, _t64 + 1);
					_t41 =  *((intOrPtr*)(_t70 - 0x10));
					if( *((intOrPtr*)(_t41 + 0x6ce8)) != 3) {
						if(( *(_t41 + 0x45dc) & 0x00000001) == 0) {
							E00A6FC9F( *((intOrPtr*)(_t70 - 0x20)),  *_t68,  *((intOrPtr*)(_t68 + 4)));
						} else {
							_t66 = _t64 >> 1;
							E00A6FD1A( *((intOrPtr*)(_t70 - 0x20)),  *_t68, _t66);
							 *((short*)( *_t68 + _t66 * 2)) = 0;
						}
					} else {
						_push( *((intOrPtr*)(_t68 + 4)));
						_push( *_t68);
						_push( *((intOrPtr*)(_t70 - 0x20)));
						E00A6FD55();
					}
					E00A61927(_t68, E00A816B5( *_t68));
					_t49 = 1;
				}
				if( *((intOrPtr*)(_t70 - 0x20)) != 0) {
					L00A816D0( *((intOrPtr*)(_t70 - 0x20)));
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t70 - 0xc));
				return _t49;
			}

0x00a61df9
0x00a61df9
0x00a61dfe
0x00a61e07
0x00a61e0b
0x00a61e0e
0x00a61e11
0x00a61e14
0x00a61e17
0x00a61e1a
0x00a61e1e
0x00a61e21
0x00a61e24
0x00a61e2b
0x00a61e33
0x00a61e3b
0x00a61e46
0x00a61e49
0x00a61e53
0x00a61e58
0x00a61e62
0x00a61e7a
0x00a61e9b
0x00a61e7c
0x00a61e7c
0x00a61e84
0x00a61e8d
0x00a61e8d
0x00a61e64
0x00a61e64
0x00a61e67
0x00a61e69
0x00a61e6c
0x00a61e6c
0x00a61eab
0x00a61eb1
0x00a61eb3
0x00a61eb8
0x00a61ebd
0x00a61ec2
0x00a61ec9
0x00a61ed3

APIs

__EH_prolog.LIBCMT ref: 00A61DFE

Part of subcall function 00A63878: __EH_prolog.LIBCMT ref: 00A6387D

_wcslen.LIBCMT ref: 00A61EA2

Strings

CMT, xrefs: 00A61E31

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: H_prolog$_wcslen
String ID: CMT
API String ID: 2838827086-2756464174
Opcode ID: 0d9227cf5f488462384996120a4f046db34fac93b1257a0cd85dfbe3725b9eda
Instruction ID: 474b04e68ff6484c8921c0f51812abb9c4de6e38807e46cc9fea8a26d6ac1326
Opcode Fuzzy Hash: 0d9227cf5f488462384996120a4f046db34fac93b1257a0cd85dfbe3725b9eda
Instruction Fuzzy Hash: D2214872900218AFCF15EF98D9519EEFBB6FF08304F14406EE845A7261CB369951CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00A69509 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00A69509() {
				long _v4;
				void* __ecx;
				void* __ebp;
				long _t12;
				signed int _t14;
				signed int _t21;
				signed int _t22;
				void* _t23;
				long _t32;
				void* _t34;

				_t34 = _t23;
				_t22 = _t21 | 0xffffffff;
				if( *(_t34 + 4) != _t22) {
					L3:
					_v4 = _v4 & 0x00000000;
					_t12 = SetFilePointer( *(_t34 + 4), 0,  &_v4, 1); // executed
					_t32 = _t12;
					if(_t32 != _t22 || GetLastError() == 0) {
						L7:
						asm("cdq");
						_t14 = 0 + _t32;
						asm("adc edx, 0x0");
						goto L8;
					} else {
						if( *((char*)(_t34 + 0x14)) == 0) {
							_t14 = _t22;
							L8:
							return _t14;
						}
						E00A66AAB(0xa9bbf8, 0xa9bbf8, _t34 + 0x1e);
						goto L7;
					}
				}
				if( *((char*)(_t34 + 0x14)) == 0) {
					return _t22;
				}
				E00A66AAB(0xa9bbf8, 0xa9bbf8, _t34 + 0x1e);
				goto L3;
			}

0x00a6950d
0x00a6950f
0x00a6951a
0x00a6952d
0x00a6952d
0x00a6953f
0x00a69545
0x00a69549
0x00a69566
0x00a6956c
0x00a69571
0x00a69573
0x00000000
0x00a69555
0x00a69559
0x00a69582
0x00a69576
0x00000000
0x00a69576
0x00a69561
0x00000000
0x00a69561
0x00a69549
0x00a69520
0x00000000
0x00a6957e
0x00a69528
0x00000000

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,00000001), ref: 00A6953F
GetLastError.KERNEL32 ref: 00A6954B

Strings

@Mqt0Lqt, xrefs: 00A6954B

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: @Mqt0Lqt
API String ID: 2976181284-1302913217
Opcode ID: 1c03bdf58a2dde03b9f5337dd4341d04eace152006d8f40d795bddd0aecaeb16
Instruction ID: 05dbb31dc442b5d02c7c7dc643c1490f42729d850bb69c8d205fc323e1db127b
Opcode Fuzzy Hash: 1c03bdf58a2dde03b9f5337dd4341d04eace152006d8f40d795bddd0aecaeb16
Instruction Fuzzy Hash: 3D01CCB0B013046FEB219B29DD84B6BB6FD9B84364F14863EB143C6680DA70E90CC721

Uniqueness

Uniqueness Score: -1.00%

Function 00A692B5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00A692B5(intOrPtr* __ecx, long _a4, long _a8, long _a12) {
				void* __ebp;
				long _t14;
				void* _t17;
				intOrPtr* _t19;
				long _t21;
				intOrPtr* _t22;
				void* _t23;
				long _t25;
				long _t28;
				long _t31;

				_t19 = __ecx;
				if( *((intOrPtr*)(__ecx + 4)) == 0xffffffff) {
					L13:
					return 1;
				}
				_t28 = _a4;
				_t25 = _a8;
				_t31 = _t25;
				if(_t31 > 0 || _t31 >= 0 && _t28 >= 0) {
					_t21 = _a12;
				} else {
					_t21 = _a12;
					if(_t21 != 0) {
						_t22 = _t19;
						if(_t21 != 1) {
							_t17 = E00A690C9(_t22, _t23);
						} else {
							_t17 =  *((intOrPtr*)( *_t19 + 0x10))();
						}
						_t28 = _t28 + _t17;
						asm("adc edi, edx");
						_t21 = 0;
					}
				}
				_a12 = _t25;
				_t14 = SetFilePointer( *(_t19 + 4), _t28,  &_a12, _t21); // executed
				if(_t14 != 0xffffffff || GetLastError() == 0) {
					goto L13;
				} else {
					return 0;
				}
			}

0x00a692b9
0x00a692bf
0x00a69324
0x00000000
0x00a69324
0x00a692c2
0x00a692c6
0x00a692c9
0x00a692cb
0x00a692f5
0x00a692d3
0x00a692d3
0x00a692d8
0x00a692dd
0x00a692df
0x00a692e8
0x00a692e1
0x00a692e3
0x00a692e3
0x00a692ed
0x00a692ef
0x00a692f1
0x00a692f1
0x00a692d8
0x00a692fa
0x00a69309
0x00a69314
0x00000000
0x00a69320
0x00000000
0x00a69320

APIs

SetFilePointer.KERNELBASE(000000FF,?,?,?), ref: 00A69309
GetLastError.KERNEL32 ref: 00A69316

Part of subcall function 00A690C9: __EH_prolog.LIBCMT ref: 00A690CE

Strings

@Mqt0Lqt, xrefs: 00A69316

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: ErrorFileH_prologLastPointer
String ID: @Mqt0Lqt
API String ID: 4236474358-1302913217
Opcode ID: 06c1ac0f0b4d3efd0b116abda72265675e04ff4138d06ef477c7042c7eb89bfa
Instruction ID: c0b7dc4bc31fadb6ea50a5e5c7ef24cb39c02e7dc815b5678e633de8c538fe54
Opcode Fuzzy Hash: 06c1ac0f0b4d3efd0b116abda72265675e04ff4138d06ef477c7042c7eb89bfa
Instruction Fuzzy Hash: A7017132600215EB8B188F6A8C949FB77BDBF95721B54422DE836DF291D770D8019B60

Uniqueness

Uniqueness Score: -1.00%

Function 00A78569 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23comCOMMON

Download Yara Rule

APIs

Part of subcall function 00A6E9B3: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00A6E9CE
Part of subcall function 00A6E9B3: LoadLibraryW.KERNELBASE(?,?,00A6DAA4,Crypt32.dll,?,00A6DB27,?,00A6DB0A,?,?,?,?), ref: 00A6E9F0

OleInitialize.OLE32(00000000), ref: 00A7857F
SHGetMalloc.SHELL32(00AA1718), ref: 00A785A2

Strings

riched20.dll, xrefs: 00A7856F

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: DirectoryInitializeLibraryLoadMallocSystem
String ID: riched20.dll
API String ID: 1045004029-3360196438
Opcode ID: 5aa7187f9e2dc996e02fe035decdfc30d2b4b0d92dd96830e18424d985ce0322
Instruction ID: 86c2b2e8ec577f51b090d310855e8576be3d7be43398da0f656dcf953b65add9
Opcode Fuzzy Hash: 5aa7187f9e2dc996e02fe035decdfc30d2b4b0d92dd96830e18424d985ce0322
Instruction Fuzzy Hash: E1E048717402197BDB10DFE8DD0EA5ABBFCEF08755F000559F94493650DEB555018B91

Uniqueness

Uniqueness Score: -1.00%

Function 00A81390 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00A81390(void* __eflags, intOrPtr _a4) {
				intOrPtr* _t2;
				void* _t4;
				intOrPtr* _t6;

				_t2 = E00A81169(4, "FlsAlloc", 0xa90a88, "FlsAlloc"); // executed
				_t6 = _t2;
				if(_t6 == 0) {
					return TlsAlloc();
				}
				L00A7CB5A(); // executed
				_t4 =  *_t6(_a4); // executed
				return _t4;
			}

0x00a813a5
0x00a813aa
0x00a813b1
0x00a813c4
0x00a813c4
0x00a813b8
0x00a813bd
0x00a813c1

APIs

try_get_function.LIBVCRUNTIME ref: 00A813A5
FlsAlloc.KERNELBASE(00000000), ref: 00A813BD

Strings

FlsAlloc, xrefs: 00A81394, 00A8139E

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: Alloctry_get_function
String ID: FlsAlloc
API String ID: 591514613-671089009
Opcode ID: 3300c549f91f4ad79b0ee30e1b672a362f269fd2a68c9f08bb58513cc8170621
Instruction ID: 91b806a806e40cdd1cc11240e5dc4748c413d5c84760ea0f3799489087252fdd
Opcode Fuzzy Hash: 3300c549f91f4ad79b0ee30e1b672a362f269fd2a68c9f08bb58513cc8170621
Instruction Fuzzy Hash: 0AD05B32B813297FC95072D57C07EA97688D700FF1F444562FF0D655419551581153D9

Uniqueness

Uniqueness Score: -1.00%

Function 00A695E6 Relevance: 4.6, APIs: 3, Instructions: 97
fileCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E00A695E6(intOrPtr* __ecx, void* __edx, void* _a4, long _a8) {
				void* __ebp;
				int _t25;
				long _t35;
				void* _t39;
				void* _t45;
				void* _t55;
				intOrPtr* _t56;
				void* _t59;
				intOrPtr _t60;
				long _t61;

				_t55 = __edx;
				_t61 = _a8;
				_t56 = __ecx;
				if(_t61 != 0) {
					if( *((intOrPtr*)(__ecx + 0xc)) == 1) {
						 *(_t56 + 4) = GetStdHandle(0xfffffff5);
					}
					while(1) {
						_a8 = _a8 & 0x00000000;
						_t45 = 0;
						if( *((intOrPtr*)(_t56 + 0xc)) == 0) {
							goto L12;
						}
						_t59 = 0;
						if(_t61 == 0) {
							L14:
							if( *((char*)(_t56 + 0x14)) == 0 ||  *((intOrPtr*)(_t56 + 0xc)) != 0) {
								L21:
								 *((char*)(_t56 + 8)) = 1;
								return _t45;
							} else {
								if(E00A6696B(0xa9bbf8, _t56 + 0x1e, 0) == 0) {
									E00A66B64(0xa9bbf8, _t61, 0, _t56 + 0x1e);
									goto L21;
								}
								if(_a8 < _t61 && _a8 > 0) {
									_t60 =  *_t56;
									_t39 =  *((intOrPtr*)(_t60 + 0x10))(0);
									asm("sbb edx, 0x0");
									 *((intOrPtr*)(_t60 + 0xc))(_t39 - _a8, _t55);
								}
								continue;
							}
						} else {
							goto L7;
						}
						while(1) {
							L7:
							_t35 = _t61 - _t59;
							if(_t35 >= 0x4000) {
								_t35 = 0x4000;
							}
							_t10 = WriteFile( *(_t56 + 4), _a4 + _t59, _t35,  &_a8, 0) - 1; // -1
							asm("sbb bl, bl");
							_t45 =  ~_t10 + 1;
							if(_t45 == 0) {
								goto L14;
							}
							_t59 = _t59 + 0x4000;
							if(_t59 < _t61) {
								continue;
							}
							L13:
							if(_t45 != 0) {
								goto L21;
							}
							goto L14;
						}
						goto L14;
						L12:
						_t25 = WriteFile( *(_t56 + 4), _a4, _t61,  &_a8, 0); // executed
						asm("sbb al, al");
						_t45 =  ~(_t25 - 1) + 1;
						goto L13;
					}
				}
				return 1;
			}

0x00a695e6
0x00a695e7
0x00a695ec
0x00a695f0
0x00a695fd
0x00a69607
0x00a69607
0x00a6960c
0x00a6960c
0x00a69611
0x00a69617
0x00000000
0x00000000
0x00a69619
0x00a6961d
0x00a69681
0x00a69685
0x00a696e2
0x00a696e5
0x00000000
0x00a6968d
0x00a6969f
0x00a696dd
0x00000000
0x00a696dd
0x00a696a5
0x00a696b6
0x00a696bc
0x00a696c5
0x00a696ca
0x00a696ca
0x00000000
0x00a696a5
0x00000000
0x00000000
0x00000000
0x00a6961f
0x00a6961f
0x00a69621
0x00a69628
0x00a6962a
0x00a6962a
0x00a69647
0x00a6964c
0x00a6964e
0x00a69651
0x00000000
0x00000000
0x00a69653
0x00a6965b
0x00000000
0x00000000
0x00a6967d
0x00a6967f
0x00000000
0x00000000
0x00000000
0x00a6967f
0x00000000
0x00a6965f
0x00a6966e
0x00a69677
0x00a6967b
0x00000000
0x00a6967b
0x00a6960c
0x00000000

APIs

GetStdHandle.KERNEL32(000000F5,?,?,00A6C428,00000001,?,?,?,00000000,00A73940,?,?,?,?,?,00A732AC), ref: 00A69601
WriteFile.KERNEL32(?,00000000,?,00A73605,00000000,?,?,00000000,00A73940,?,?,?,?,?,00A732AC,?), ref: 00A69641
WriteFile.KERNELBASE(?,00000000,?,00A73605,00000000,?,00000001,?,?,00A6C428,00000001,?,?,?,00000000,00A73940), ref: 00A6966E

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 5d4324770558234c28f232c93437e68516716cff9389c37677eba8d5ab955d5e
Instruction ID: d654bde3497a3debc0da5e6fc2c1063587a7edd73e96219cbd99e5f1d6955b81
Opcode Fuzzy Hash: 5d4324770558234c28f232c93437e68516716cff9389c37677eba8d5ab955d5e
Instruction Fuzzy Hash: A831D1B9548306AFDB209F24D948BA7B7BCFB50315F14811AF56593180CB74E859CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A63878 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 176
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00A63878(void* __ecx, signed int __edx) {
				void* __ebx;
				void* __edi;
				char _t74;
				signed int _t77;
				intOrPtr _t87;
				signed int _t92;
				void* _t114;
				char _t115;
				void* _t117;
				void* _t129;
				signed int _t143;
				signed int _t147;
				void* _t150;
				void* _t152;

				_t142 = __edx;
				_t117 = __ecx;
				E00A7C16C(E00A8EBDC, _t152);
				E00A7C240();
				_t150 = _t117;
				if( *((char*)(_t150 + 0x6cfc)) == 0) {
					__eflags =  *((char*)(_t150 + 0x45da)) - 5;
					if( *((char*)(_t150 + 0x45da)) > 5) {
						L26:
						E00A61546(0x1c, _t150 + 0x1e);
						goto L27;
					}
					__eflags =  *((intOrPtr*)(_t150 + 0x6ce8)) - 3;
					__eflags = ( *(_t150 + 0x45d9) & 0x000000ff) - (( *((intOrPtr*)(_t150 + 0x6ce8)) != 0x00000003) - 0x00000001 & 0x00000015) + 0x1d;
					if(( *(_t150 + 0x45d9) & 0x000000ff) > (( *((intOrPtr*)(_t150 + 0x6ce8)) != 0x00000003) - 0x00000001 & 0x00000015) + 0x1d) {
						goto L26;
					}
					_t77 =  *(_t150 + 0x5608) |  *(_t150 + 0x560c);
					__eflags = _t77;
					if(_t77 != 0) {
						L7:
						_t114 = _t150 + 0x20e8;
						E00A6C103(_t77, _t114);
						_push(_t114);
						E00A701AD(_t152 - 0xe6ec, _t142, __eflags); // executed
						_t115 = 0;
						 *((intOrPtr*)(_t152 - 4)) = 0;
						E00A71660(0, _t152 - 0xe6ec, _t152,  *((intOrPtr*)(_t150 + 0x56a4)), 0);
						_t147 =  *(_t152 + 8);
						__eflags =  *(_t152 + 0xc);
						if( *(_t152 + 0xc) != 0) {
							L15:
							__eflags =  *((intOrPtr*)(_t150 + 0x564b)) - _t115;
							if( *((intOrPtr*)(_t150 + 0x564b)) == _t115) {
								L18:
								E00A6A0C4(_t150 + 0x21a0, _t142,  *((intOrPtr*)(_t150 + 0x5620)), 1);
								 *(_t150 + 0x2108) =  *(_t150 + 0x5608);
								 *(_t150 + 0x210c) =  *(_t150 + 0x560c);
								 *((char*)(_t150 + 0x2110)) = _t115;
								E00A6C1B5(_t150 + 0x20e8, _t150,  *(_t152 + 0xc));
								_t129 = _t150 + 0x20e8;
								 *((char*)(_t150 + 0x2137)) =  *((intOrPtr*)(_t150 + 0x5649));
								 *((intOrPtr*)(_t129 + 0x38)) = _t150 + 0x45c0;
								 *((intOrPtr*)(_t129 + 0x3c)) = _t115;
								_t87 =  *((intOrPtr*)(_t150 + 0x5610));
								_t143 =  *(_t150 + 0x5614);
								 *((intOrPtr*)(_t152 - 0x9aac)) = _t87;
								 *(_t152 - 0x9aa8) = _t143;
								 *((char*)(_t152 - 0x9a94)) = _t115;
								__eflags =  *((intOrPtr*)(_t150 + 0x45da)) - _t115;
								if(__eflags != 0) {
									E00A712C1(_t152 - 0xe6ec,  *(_t150 + 0x45d9) & 0x000000ff, _t115);
								} else {
									_push(_t143);
									_push(_t87);
									_push(_t129);
									E00A68AD8(_t115, _t143, __eflags);
								}
								asm("sbb edx, edx");
								_t142 =  ~( *(_t150 + 0x567a) & 0x000000ff) & _t150 + 0x0000567b;
								_t92 = E00A6A092(_t150 + 0x21a0, _t147, _t150 + 0x5620,  ~( *(_t150 + 0x567a) & 0x000000ff) & _t150 + 0x0000567b);
								__eflags = _t92;
								if(_t92 != 0) {
									_t115 = 1;
								} else {
									E00A61F25(0x1d, _t150 + 0x1e, _t150 + 0x45e0);
									E00A66ACC(0xa9bbf8, 3);
									__eflags = _t147;
									if(_t147 != 0) {
										E00A65BD9(_t147);
									}
								}
								L25:
								E00A70373(_t152 - 0xe6ec, _t142); // executed
								_t74 = _t115;
								goto L28;
							}
							_t142 =  *(_t150 + 0x21bc);
							__eflags =  *((intOrPtr*)(_t142 + 0x4124)) - _t115;
							if( *((intOrPtr*)(_t142 + 0x4124)) == _t115) {
								goto L25;
							}
							asm("sbb ecx, ecx");
							_t137 =  ~( *(_t150 + 0x5650) & 0x000000ff) & _t150 + 0x00005651;
							__eflags =  ~( *(_t150 + 0x5650) & 0x000000ff) & _t150 + 0x00005651;
							E00A6C16D(_t150 + 0x20e8, _t115,  *((intOrPtr*)(_t150 + 0x564c)), _t142 + 0x4024, _t137, _t150 + 0x5661,  *((intOrPtr*)(_t150 + 0x569c)), _t150 + 0x567b, _t150 + 0x5672);
							goto L18;
						}
						__eflags =  *(_t150 + 0x5614);
						if(__eflags < 0) {
							L12:
							__eflags = _t147;
							if(_t147 != 0) {
								E00A61F56(_t147,  *((intOrPtr*)(_t150 + 0x5610)));
								E00A6C1D2(_t150 + 0x20e8,  *_t147,  *((intOrPtr*)(_t150 + 0x5610)));
							} else {
								 *((char*)(_t150 + 0x2111)) = 1;
							}
							goto L15;
						}
						if(__eflags > 0) {
							L11:
							E00A61546(0x1c, _t150 + 0x1e);
							goto L25;
						}
						__eflags =  *((intOrPtr*)(_t150 + 0x5610)) - 0x1000000;
						if( *((intOrPtr*)(_t150 + 0x5610)) <= 0x1000000) {
							goto L12;
						}
						goto L11;
					}
					__eflags =  *((intOrPtr*)(_t150 + 0x5649)) - _t77;
					if( *((intOrPtr*)(_t150 + 0x5649)) != _t77) {
						goto L7;
					} else {
						_t74 = 1;
						goto L28;
					}
				} else {
					E00A61546(0x1b, _t150 + 0x1e);
					E00A66ACC(0xa9bbf8, 3);
					L27:
					_t74 = 0;
					L28:
					 *[fs:0x0] =  *((intOrPtr*)(_t152 - 0xc));
					return _t74;
				}
			}

0x00a63878
0x00a63878
0x00a6387d
0x00a63887
0x00a6388d
0x00a63896
0x00a638b4
0x00a638bb
0x00a63af9
0x00a63aff
0x00000000
0x00a63aff
0x00a638ca
0x00a638db
0x00a638dd
0x00000000
0x00000000
0x00a638e9
0x00a638e9
0x00a638ef
0x00a63900
0x00a63901
0x00a6390a
0x00a6390f
0x00a63916
0x00a6391b
0x00a6392a
0x00a6392d
0x00a63932
0x00a63935
0x00a63938
0x00a6398d
0x00a6398d
0x00a63993
0x00a639ef
0x00a639fd
0x00a63a11
0x00a63a1e
0x00a63a24
0x00a63a2a
0x00a63a35
0x00a63a3b
0x00a63a47
0x00a63a4a
0x00a63a4d
0x00a63a53
0x00a63a59
0x00a63a5f
0x00a63a65
0x00a63a6b
0x00a63a71
0x00a63a8c
0x00a63a73
0x00a63a73
0x00a63a74
0x00a63a75
0x00a63a76
0x00a63a76
0x00a63aa6
0x00a63aa8
0x00a63ab2
0x00a63ab7
0x00a63ab9
0x00a63ae6
0x00a63abb
0x00a63ac8
0x00a63ad4
0x00a63ad9
0x00a63adb
0x00a63adf
0x00a63adf
0x00a63adb
0x00a63ae8
0x00a63aee
0x00a63af4
0x00000000
0x00a63af6
0x00a63995
0x00a6399b
0x00a639a1
0x00000000
0x00000000
0x00a639ca
0x00a639d3
0x00a639d3
0x00a639ea
0x00000000
0x00a639ea
0x00a6393a
0x00a63940
0x00a63960
0x00a63960
0x00a63962
0x00a63975
0x00a63988
0x00a63964
0x00a63964
0x00a63964
0x00000000
0x00a63962
0x00a63942
0x00a63950
0x00a63956
0x00000000
0x00a63956
0x00a63944
0x00a6394e
0x00000000
0x00000000
0x00000000
0x00a6394e
0x00a638f1
0x00a638f7
0x00000000
0x00a638f9
0x00a638f9
0x00000000
0x00a638f9
0x00a63898
0x00a6389e
0x00a638aa
0x00a63b04
0x00a63b04
0x00a63b06
0x00a63b0a
0x00a63b14
0x00a63b14

APIs

__EH_prolog.LIBCMT ref: 00A6387D

Strings

CMT, xrefs: 00A6388C

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: H_prolog
String ID: CMT
API String ID: 3519838083-2756464174
Opcode ID: e7b658d44743e4c3d093ebb4e0ece77c5dab8a03041db3fec1dbd307a3eed80a
Instruction ID: 2dea4150f6bee62cc36c5a48bdb138c928124d04a8e26018a8749e1539b8e4c9
Opcode Fuzzy Hash: e7b658d44743e4c3d093ebb4e0ece77c5dab8a03041db3fec1dbd307a3eed80a
Instruction Fuzzy Hash: 1161CFB2104F44AADF21DF74CD91AE7B7F8AF14301F44891EE1AB87282DA726A45DF10

Uniqueness

Uniqueness Score: -1.00%

Function 00A87AAC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A87AAC(void* __ebx, signed int __edx, void* __edi, void* __esi, intOrPtr _a4) {
				signed int _v8;
				char _v264;
				char _v520;
				char _v776;
				char _v1800;
				char _v1814;
				struct _cpinfo _v1820;
				intOrPtr _v1824;
				signed int _v1828;
				signed int _t63;
				void* _t67;
				signed int _t68;
				intOrPtr _t69;
				void* _t72;
				char _t73;
				char _t74;
				signed char _t75;
				signed int _t76;
				signed char _t86;
				char _t87;
				char _t90;
				signed int _t93;
				signed int _t94;
				signed int _t95;
				void* _t96;
				char* _t97;
				intOrPtr _t101;
				signed int _t102;

				_t95 = __edx;
				_t63 =  *0xa991b8; // 0x3197ea2d
				_v8 = _t63 ^ _t102;
				_t101 = _a4;
				_t4 = _t101 + 4; // 0x5efc4d8b
				if(GetCPInfo( *_t4,  &_v1820) == 0) {
					_t47 = _t101 + 0x119; // 0xa880f7
					_t96 = _t47;
					_t90 = 0;
					_t67 = 0xffffff9f;
					_t68 = _t67 - _t96;
					__eflags = _t68;
					_v1828 = _t68;
					do {
						_t97 = _t96 + _t90;
						_t69 = _t68 + _t97;
						_v1824 = _t69;
						__eflags = _t69 + 0x20 - 0x19;
						if(_t69 + 0x20 > 0x19) {
							__eflags = _v1824 - 0x19;
							if(_v1824 > 0x19) {
								 *_t97 = 0;
							} else {
								_t72 = _t101 + _t90;
								_t57 = _t72 + 0x19;
								 *_t57 =  *(_t72 + 0x19) | 0x00000020;
								__eflags =  *_t57;
								_t59 = _t90 - 0x20; // -32
								_t73 = _t59;
								goto L24;
							}
						} else {
							 *(_t101 + _t90 + 0x19) =  *(_t101 + _t90 + 0x19) | 0x00000010;
							_t54 = _t90 + 0x20; // 0x20
							_t73 = _t54;
							L24:
							 *_t97 = _t73;
						}
						_t68 = _v1828;
						_t61 = _t101 + 0x119; // 0xa880f7
						_t96 = _t61;
						_t90 = _t90 + 1;
						__eflags = _t90 - 0x100;
					} while (_t90 < 0x100);
				} else {
					_t74 = 0;
					do {
						 *((char*)(_t102 + _t74 - 0x104)) = _t74;
						_t74 = _t74 + 1;
					} while (_t74 < 0x100);
					_t75 = _v1814;
					_t93 =  &_v1814;
					_v264 = 0x20;
					while(1) {
						_t108 = _t75;
						if(_t75 == 0) {
							break;
						}
						_t95 =  *(_t93 + 1) & 0x000000ff;
						_t76 = _t75 & 0x000000ff;
						while(1) {
							__eflags = _t76 - _t95;
							if(_t76 > _t95) {
								break;
							}
							__eflags = _t76 - 0x100;
							if(_t76 < 0x100) {
								 *((char*)(_t102 + _t76 - 0x104)) = 0x20;
								_t76 = _t76 + 1;
								__eflags = _t76;
								continue;
							}
							break;
						}
						_t93 = _t93 + 2;
						__eflags = _t93;
						_t75 =  *_t93;
					}
					_t13 = _t101 + 4; // 0x5efc4d8b
					E00A88B78(0, _t95, 0x100, _t101, _t108, 0, 1,  &_v264, 0x100,  &_v1800,  *_t13, 0);
					_t16 = _t101 + 4; // 0x5efc4d8b
					_t19 = _t101 + 0x21c; // 0x2ebf88b
					E00A86DB4(0x100, _t101, _t108, 0,  *_t19, 0x100,  &_v264, 0x100,  &_v520, 0x100,  *_t16, 0); // executed
					_t21 = _t101 + 4; // 0x5efc4d8b
					_t23 = _t101 + 0x21c; // 0x2ebf88b
					E00A86DB4(0x100, _t101, _t108, 0,  *_t23, 0x200,  &_v264, 0x100,  &_v776, 0x100,  *_t21, 0);
					_t94 = 0;
					do {
						_t86 =  *(_t102 + _t94 * 2 - 0x704) & 0x0000ffff;
						if((_t86 & 0x00000001) == 0) {
							__eflags = _t86 & 0x00000002;
							if((_t86 & 0x00000002) == 0) {
								 *((char*)(_t101 + _t94 + 0x119)) = 0;
							} else {
								_t37 = _t101 + _t94 + 0x19;
								 *_t37 =  *(_t101 + _t94 + 0x19) | 0x00000020;
								__eflags =  *_t37;
								_t87 =  *((intOrPtr*)(_t102 + _t94 - 0x304));
								goto L15;
							}
						} else {
							 *(_t101 + _t94 + 0x19) =  *(_t101 + _t94 + 0x19) | 0x00000010;
							_t87 =  *((intOrPtr*)(_t102 + _t94 - 0x204));
							L15:
							 *((char*)(_t101 + _t94 + 0x119)) = _t87;
						}
						_t94 = _t94 + 1;
					} while (_t94 < 0x100);
				}
				return E00A7CABF(_v8 ^ _t102);
			}

0x00a87aac
0x00a87ab7
0x00a87abe
0x00a87ac3
0x00a87ace
0x00a87ae0
0x00a87bd8
0x00a87bd8
0x00a87bde
0x00a87be0
0x00a87be1
0x00a87be1
0x00a87be3
0x00a87be9
0x00a87be9
0x00a87beb
0x00a87bed
0x00a87bf6
0x00a87bf9
0x00a87c05
0x00a87c0c
0x00a87c1c
0x00a87c0e
0x00a87c0e
0x00a87c11
0x00a87c11
0x00a87c11
0x00a87c15
0x00a87c15
0x00000000
0x00a87c15
0x00a87bfb
0x00a87bfb
0x00a87c00
0x00a87c00
0x00a87c18
0x00a87c18
0x00a87c18
0x00a87c1e
0x00a87c24
0x00a87c24
0x00a87c2a
0x00a87c2b
0x00a87c2b
0x00a87ae6
0x00a87ae6
0x00a87ae8
0x00a87ae8
0x00a87aef
0x00a87af0
0x00a87af4
0x00a87afa
0x00a87b00
0x00a87b28
0x00a87b28
0x00a87b2a
0x00000000
0x00000000
0x00a87b09
0x00a87b0d
0x00a87b1f
0x00a87b1f
0x00a87b21
0x00000000
0x00000000
0x00a87b12
0x00a87b14
0x00a87b16
0x00a87b1e
0x00a87b1e
0x00000000
0x00a87b1e
0x00000000
0x00a87b14
0x00a87b23
0x00a87b23
0x00a87b26
0x00a87b26
0x00a87b2d
0x00a87b42
0x00a87b48
0x00a87b5c
0x00a87b63
0x00a87b72
0x00a87b84
0x00a87b8b
0x00a87b93
0x00a87b95
0x00a87b95
0x00a87b9f
0x00a87baf
0x00a87bb1
0x00a87bc8
0x00a87bb3
0x00a87bb3
0x00a87bb3
0x00a87bb3
0x00a87bb8
0x00000000
0x00a87bb8
0x00a87ba1
0x00a87ba1
0x00a87ba6
0x00a87bbf
0x00a87bbf
0x00a87bbf
0x00a87bcf
0x00a87bd0
0x00a87bd4
0x00a87c3f

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 00A87AD1

Strings

, xrefs: 00A87B16

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: 3ea9c64d8eea9bd628f0ba5d17b3fd8a49a29427e121b23f163dfbe6cf45516d
Instruction ID: c669fb8f6861878723180bad53409c2664501565162bc5d29593c9393210054a
Opcode Fuzzy Hash: 3ea9c64d8eea9bd628f0ba5d17b3fd8a49a29427e121b23f163dfbe6cf45516d
Instruction Fuzzy Hash: 6541E7B150824C9EDB269F64CC88AFEBBBAEB55304F2404EDE58A87142D235DE45DF60

Uniqueness

Uniqueness Score: -1.00%

Function 00A619A6 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A619A6(intOrPtr* __ecx, intOrPtr __edx, void* __esi) {
				void* __edi;
				void* _t18;
				void* _t22;
				void* _t24;
				signed int _t26;
				void* _t27;
				void* _t33;
				signed int _t34;
				intOrPtr* _t36;
				intOrPtr* _t37;
				intOrPtr _t44;
				intOrPtr* _t47;
				void* _t51;
				void* _t52;

				_t44 = __edx;
				_t36 = __ecx;
				E00A7C16C(_t18, _t52);
				_t47 = _t36;
				if( *((char*)(_t47 + 0x6cee)) != 0) {
					 *((intOrPtr*)(_t52 - 0x1c)) = _t47;
					 *((intOrPtr*)(_t52 - 0x14)) =  *((intOrPtr*)( *_t47 + 0x10))(_t33);
					 *((intOrPtr*)(_t52 - 0x10)) = _t44;
					_t34 = 0;
					_t37 = _t47;
					 *((intOrPtr*)(_t52 - 4)) = 0;
					if( *((intOrPtr*)(_t47 + 0x2224)) == 0) {
						_t22 = E00A6205E(_t37);
						 *((intOrPtr*)( *_t47 + 0xc))(_t44, 0, __esi);
						_t24 = E00A63BD2(_t47, _t44, L"CMT");
						_t51 = _t22;
						if(_t24 != 0) {
							_t27 = E00A61DF9(_t47, _t44, _t47, _t51,  *((intOrPtr*)(_t52 + 8))); // executed
							if(_t27 != 0) {
								_t34 = 1;
							}
						}
					} else {
						 *((intOrPtr*)( *_t47 + 0xc))( *((intOrPtr*)(_t47 + 0x6cf8)) + 0x14, 0, 0);
						E00A637FD( *_t47);
						_t34 = 0 |  *((intOrPtr*)( *((intOrPtr*)(_t52 + 8)) + 4)) > 0x00000000;
					}
					E00A617E5(_t52 - 0x1c); // executed
					_t26 = _t34;
				} else {
					_t26 = 0;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t52 - 0xc));
				return _t26;
			}

0x00a619a6
0x00a619a6
0x00a619a6
0x00a619af
0x00a619b8
0x00a619c1
0x00a619c7
0x00a619ca
0x00a619cd
0x00a619cf
0x00a619d1
0x00a619da
0x00a61a03
0x00a61a0c
0x00a61a16
0x00a61a1b
0x00a61a1e
0x00a61a25
0x00a61a2c
0x00a61a2e
0x00a61a2e
0x00a61a2c
0x00a619dc
0x00a619ea
0x00a619ef
0x00a619fa
0x00a619fa
0x00a61a33
0x00a61a38
0x00a619ba
0x00a619ba
0x00a619ba
0x00a61a3f
0x00a61a49

APIs

__EH_prolog.LIBCMT ref: 00A619A6

Strings

CMT, xrefs: 00A61A0F

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: H_prolog
String ID: CMT
API String ID: 3519838083-2756464174
Opcode ID: 0afa52a7216ec43432f413315f5ba999fbdf11300952528b99a7cc4d9fcdf3e1
Instruction ID: 0b72c67345479048769b8a1164e790b9cce638651a662a12d870948797f04095
Opcode Fuzzy Hash: 0afa52a7216ec43432f413315f5ba999fbdf11300952528b99a7cc4d9fcdf3e1
Instruction Fuzzy Hash: E111EBB1A01105AFCB04EFA8C591A7EFBBAFF54340B088159E416D7341DB359952DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A871F2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E00A871F2(void* __ecx, void* __esi, void* __eflags, intOrPtr _a4, int _a8, short* _a12, int _a16, short* _a20, int _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				signed int _t18;
				intOrPtr* _t20;
				intOrPtr* _t31;
				signed int _t33;

				_t26 = __ecx;
				_push(__ecx);
				_t18 =  *0xa991b8; // 0x3197ea2d
				_v8 = _t18 ^ _t33;
				_push(__esi);
				_t20 = E00A86F1E(0x16, "LCMapStringEx", 0xa92774, "LCMapStringEx"); // executed
				_t31 = _t20;
				if(_t31 == 0) {
					LCMapStringW(E00A8727A(_t26, _t31, __eflags, _a4, 0), _a8, _a12, _a16, _a20, _a24);
				} else {
					 *0xa8f21c(_a4, _a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
					 *_t31();
				}
				return E00A7CABF(_v8 ^ _t33);
			}

0x00a871f2
0x00a871f7
0x00a871f8
0x00a871ff
0x00a87202
0x00a87214
0x00a87219
0x00a87220
0x00a87263
0x00a87222
0x00a8723f
0x00a87245
0x00a87245
0x00a87277

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,EFE85006,00000001,?,000000FF), ref: 00A87263

Strings

LCMapStringEx, xrefs: 00A87203, 00A8720D

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 96224f077709c129ff905ae32ce3c033b0014dc4b8d613d678acd37efc81066c
Instruction ID: 674e197ca9735f1eaae3520363b937cf584bc2737e8aa93d82cc87172e5957e7
Opcode Fuzzy Hash: 96224f077709c129ff905ae32ce3c033b0014dc4b8d613d678acd37efc81066c
Instruction Fuzzy Hash: A901E936640109BBCF12AF90DD05DDE7F66FF0C761F144559FE0465160DA72D931AB80

Uniqueness

Uniqueness Score: -1.00%

Function 00A87190 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00A87190(void* __ecx, void* __esi, void* __eflags, struct _CRITICAL_SECTION* _a4, long _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _t8;
				intOrPtr* _t10;
				intOrPtr* _t20;
				signed int _t22;

				_push(__ecx);
				_t8 =  *0xa991b8; // 0x3197ea2d
				_v8 = _t8 ^ _t22;
				_t10 = E00A86F1E(0x14, "InitializeCriticalSectionEx", 0xa9276c, 0xa92774); // executed
				_t20 = _t10;
				if(_t20 == 0) {
					InitializeCriticalSectionAndSpinCount(_a4, _a8);
				} else {
					 *0xa8f21c(_a4, _a8, _a12);
					 *_t20();
				}
				return E00A7CABF(_v8 ^ _t22);
			}

0x00a87195
0x00a87196
0x00a8719d
0x00a871b2
0x00a871b7
0x00a871be
0x00a871db
0x00a871c0
0x00a871cb
0x00a871d1
0x00a871d1
0x00a871ef

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00A86883), ref: 00A871DB

Strings

InitializeCriticalSectionEx, xrefs: 00A871AB

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: a2bcbae2d1acc1d913852cfc43625904a321cf71e2509d8a96208488f47d8079
Instruction ID: 91a623d86a971fc1908e582d0f3ee358be92837eeeb87f883b12231ebea86a29
Opcode Fuzzy Hash: a2bcbae2d1acc1d913852cfc43625904a321cf71e2509d8a96208488f47d8079
Instruction Fuzzy Hash: C9F0B435741209BFCF11BF90EC09D9E7FA1EF04760B504169FD096A261DA718D219B80

Uniqueness

Uniqueness Score: -1.00%

Function 00A87035 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30
memoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00A87035(void* __ecx, void* __esi, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				signed int _t4;
				intOrPtr* _t6;
				intOrPtr* _t16;
				signed int _t18;

				_push(__ecx);
				_t4 =  *0xa991b8; // 0x3197ea2d
				_v8 = _t4 ^ _t18;
				_t6 = E00A86F1E(3, "FlsAlloc", 0xa92730, 0xa92738); // executed
				_t16 = _t6;
				if(_t16 == 0) {
					TlsAlloc();
				} else {
					 *0xa8f21c(_a4);
					 *_t16();
				}
				return E00A7CABF(_v8 ^ _t18);
			}

0x00a8703a
0x00a8703b
0x00a87042
0x00a87057
0x00a8705c
0x00a87063
0x00a87074
0x00a87065
0x00a8706a
0x00a87070
0x00a87070
0x00a87088

APIs

TlsAlloc.KERNEL32 ref: 00A87074

Strings

FlsAlloc, xrefs: 00A87050

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: 41f3f20e660799125c59806cd9ee03482ffce49479cc04b09055e72f7f08c8d9
Instruction ID: e813a79528fe58e10e6b3894374f73c057c3522bb2ac07a5a8d2959d333d316c
Opcode Fuzzy Hash: 41f3f20e660799125c59806cd9ee03482ffce49479cc04b09055e72f7f08c8d9
Instruction Fuzzy Hash: ADE0EC307853197B9711FBD4BC05E6D77A5DB147A1B50015AF90567240DD715D0187C9

Uniqueness

Uniqueness Score: -1.00%

Function 00A87E01 Relevance: 3.2, APIs: 2, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E00A87E01(void* __ebx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				char _v22;
				struct _cpinfo _v28;
				signed int _v32;
				signed int _v36;
				signed int _t48;
				int _t51;
				signed int _t54;
				signed int _t55;
				short _t58;
				signed char _t62;
				signed int _t63;
				signed char* _t72;
				signed char* _t73;
				int _t78;
				signed int _t81;
				signed char* _t82;
				short* _t83;
				int _t87;
				signed char _t88;
				signed int _t89;
				signed int _t91;
				signed int _t92;
				int _t94;
				int _t95;
				intOrPtr _t98;
				signed int _t99;

				_t48 =  *0xa991b8; // 0x3197ea2d
				_v8 = _t48 ^ _t99;
				_t98 = _a8;
				_t78 = E00A879D4(__eflags, _a4);
				if(_t78 != 0) {
					_t94 = 0;
					__eflags = 0;
					_t81 = 0;
					_t51 = 0;
					_v32 = 0;
					while(1) {
						__eflags =  *((intOrPtr*)(_t51 + 0xa993b8)) - _t78;
						if( *((intOrPtr*)(_t51 + 0xa993b8)) == _t78) {
							break;
						}
						_t81 = _t81 + 1;
						_t51 = _t51 + 0x30;
						_v32 = _t81;
						__eflags = _t51 - 0xf0;
						if(_t51 < 0xf0) {
							continue;
						} else {
							__eflags = _t78 - 0xfde8;
							if(_t78 == 0xfde8) {
								L23:
							} else {
								__eflags = _t78 - 0xfde9;
								if(_t78 == 0xfde9) {
									goto L23;
								} else {
									_t51 = IsValidCodePage(_t78 & 0x0000ffff);
									__eflags = _t51;
									if(_t51 == 0) {
										goto L23;
									} else {
										_t51 = GetCPInfo(_t78,  &_v28);
										__eflags = _t51;
										if(_t51 == 0) {
											__eflags =  *0xab885c - _t94; // 0x0
											if(__eflags == 0) {
												goto L23;
											} else {
												E00A87A47(_t98);
												goto L37;
											}
										} else {
											E00A7D1E0(_t94, _t98 + 0x18, _t94, 0x101);
											 *(_t98 + 4) = _t78;
											 *(_t98 + 0x21c) = _t94;
											_t78 = 1;
											__eflags = _v28 - 1;
											if(_v28 <= 1) {
												 *(_t98 + 8) = _t94;
											} else {
												__eflags = _v22;
												_t72 =  &_v22;
												if(_v22 != 0) {
													while(1) {
														_t88 = _t72[1];
														__eflags = _t88;
														if(_t88 == 0) {
															goto L16;
														}
														_t91 = _t88 & 0x000000ff;
														_t89 =  *_t72 & 0x000000ff;
														while(1) {
															__eflags = _t89 - _t91;
															if(_t89 > _t91) {
																break;
															}
															 *(_t98 + _t89 + 0x19) =  *(_t98 + _t89 + 0x19) | 0x00000004;
															_t89 = _t89 + 1;
															__eflags = _t89;
														}
														_t72 =  &(_t72[2]);
														__eflags =  *_t72;
														if( *_t72 != 0) {
															continue;
														}
														goto L16;
													}
												}
												L16:
												_t73 = _t98 + 0x1a;
												_t87 = 0xfe;
												do {
													 *_t73 =  *_t73 | 0x00000008;
													_t73 =  &(_t73[1]);
													_t87 = _t87 - 1;
													__eflags = _t87;
												} while (_t87 != 0);
												 *(_t98 + 0x21c) = E00A87996( *(_t98 + 4));
												 *(_t98 + 8) = _t78;
											}
											_t95 = _t98 + 0xc;
											asm("stosd");
											asm("stosd");
											asm("stosd");
											L36:
											E00A87AAC(_t78, _t91, _t95, _t98, _t98); // executed
											L37:
											__eflags = 0;
										}
									}
								}
							}
						}
						goto L39;
					}
					E00A7D1E0(_t94, _t98 + 0x18, _t94, 0x101);
					_t54 = _v32 * 0x30;
					__eflags = _t54;
					_v36 = _t54;
					_t55 = _t54 + 0xa993c8;
					_v32 = _t55;
					do {
						__eflags =  *_t55;
						_t82 = _t55;
						if( *_t55 != 0) {
							while(1) {
								_t62 = _t82[1];
								__eflags = _t62;
								if(_t62 == 0) {
									break;
								}
								_t92 =  *_t82 & 0x000000ff;
								_t63 = _t62 & 0x000000ff;
								while(1) {
									__eflags = _t92 - _t63;
									if(_t92 > _t63) {
										break;
									}
									__eflags = _t92 - 0x100;
									if(_t92 < 0x100) {
										_t31 = _t94 + 0xa993b0; // 0x8040201
										 *(_t98 + _t92 + 0x19) =  *(_t98 + _t92 + 0x19) |  *_t31;
										_t92 = _t92 + 1;
										__eflags = _t92;
										_t63 = _t82[1] & 0x000000ff;
										continue;
									}
									break;
								}
								_t82 =  &(_t82[2]);
								__eflags =  *_t82;
								if( *_t82 != 0) {
									continue;
								}
								break;
							}
							_t55 = _v32;
						}
						_t94 = _t94 + 1;
						_t55 = _t55 + 8;
						_v32 = _t55;
						__eflags = _t94 - 4;
					} while (_t94 < 4);
					 *(_t98 + 4) = _t78;
					 *(_t98 + 8) = 1;
					 *(_t98 + 0x21c) = E00A87996(_t78);
					_t83 = _t98 + 0xc;
					_t91 = _v36 + 0xa993bc;
					_t95 = 6;
					do {
						_t58 =  *_t91;
						_t91 = _t91 + 2;
						 *_t83 = _t58;
						_t83 = _t83 + 2;
						_t95 = _t95 - 1;
						__eflags = _t95;
					} while (_t95 != 0);
					goto L36;
				} else {
					E00A87A47(_t98);
				}
				L39:
				return E00A7CABF(_v8 ^ _t99);
			}

0x00a87e09
0x00a87e10
0x00a87e18
0x00a87e20
0x00a87e25
0x00a87e36
0x00a87e36
0x00a87e38
0x00a87e3a
0x00a87e3c
0x00a87e3f
0x00a87e3f
0x00a87e45
0x00000000
0x00000000
0x00a87e4b
0x00a87e4c
0x00a87e4f
0x00a87e52
0x00a87e57
0x00000000
0x00a87e59
0x00a87e59
0x00a87e5f
0x00a87f2d
0x00a87e65
0x00a87e65
0x00a87e6b
0x00000000
0x00a87e71
0x00a87e75
0x00a87e7b
0x00a87e7d
0x00000000
0x00a87e83
0x00a87e88
0x00a87e8e
0x00a87e90
0x00a87f1a
0x00a87f20
0x00000000
0x00a87f22
0x00a87f23
0x00000000
0x00a87f23
0x00a87e96
0x00a87ea0
0x00a87ea5
0x00a87ead
0x00a87eb3
0x00a87eb4
0x00a87eb7
0x00a87f0a
0x00a87eb9
0x00a87eb9
0x00a87ebd
0x00a87ec0
0x00a87ec2
0x00a87ec2
0x00a87ec5
0x00a87ec7
0x00000000
0x00000000
0x00a87ec9
0x00a87ecc
0x00a87ed7
0x00a87ed7
0x00a87ed9
0x00000000
0x00000000
0x00a87ed1
0x00a87ed6
0x00a87ed6
0x00a87ed6
0x00a87edb
0x00a87ede
0x00a87ee1
0x00000000
0x00000000
0x00000000
0x00a87ee1
0x00a87ec2
0x00a87ee3
0x00a87ee3
0x00a87ee6
0x00a87eeb
0x00a87eeb
0x00a87eee
0x00a87eef
0x00a87eef
0x00a87eef
0x00a87eff
0x00a87f05
0x00a87f05
0x00a87f0f
0x00a87f12
0x00a87f13
0x00a87f14
0x00a87fd8
0x00a87fd9
0x00a87fde
0x00a87fdf
0x00a87fdf
0x00a87e90
0x00a87e7d
0x00a87e6b
0x00a87e5f
0x00000000
0x00a87fe1
0x00a87f3f
0x00a87f47
0x00a87f47
0x00a87f4b
0x00a87f4e
0x00a87f54
0x00a87f57
0x00a87f57
0x00a87f5a
0x00a87f5c
0x00a87f5e
0x00a87f5e
0x00a87f61
0x00a87f63
0x00000000
0x00000000
0x00a87f65
0x00a87f68
0x00a87f84
0x00a87f84
0x00a87f86
0x00000000
0x00000000
0x00a87f6d
0x00a87f73
0x00a87f75
0x00a87f7b
0x00a87f7f
0x00a87f7f
0x00a87f80
0x00000000
0x00a87f80
0x00000000
0x00a87f73
0x00a87f88
0x00a87f8b
0x00a87f8e
0x00000000
0x00000000
0x00000000
0x00a87f8e
0x00a87f90
0x00a87f90
0x00a87f93
0x00a87f94
0x00a87f97
0x00a87f9a
0x00a87f9a
0x00a87fa0
0x00a87fa3
0x00a87fb2
0x00a87fbb
0x00a87fc0
0x00a87fc6
0x00a87fc7
0x00a87fc7
0x00a87fca
0x00a87fcd
0x00a87fd0
0x00a87fd3
0x00a87fd3
0x00a87fd3
0x00000000
0x00a87e27
0x00a87e28
0x00a87e2e
0x00a87fe2
0x00a87ff1

APIs

Part of subcall function 00A879D4: GetOEMCP.KERNEL32(00000000,?,?,00A87C5D,?), ref: 00A879FF

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,00A87CA2,?,00000000), ref: 00A87E75
GetCPInfo.KERNEL32(00000000,00A87CA2,?,?,?,00A87CA2,?,00000000), ref: 00A87E88

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 3cab89c7fc6fee75c22e49c30defc3c1956641134278db59cf0ff2e00bf7e654
Instruction ID: a5b3536d5589df01e72f7cfe1f5f17d5fb5e1520d16892d0f0a555be968060ce
Opcode Fuzzy Hash: 3cab89c7fc6fee75c22e49c30defc3c1956641134278db59cf0ff2e00bf7e654
Instruction Fuzzy Hash: C2512371A0C2459FDB20EF76C8816BFBBF5AF41300F3844AED1968A251D675DD45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A71660 Relevance: 3.1, APIs: 2, Instructions: 119
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00A71660(void* __ebx, signed int* __ecx, void* __ebp, unsigned int _a4, signed int _a8) {
				signed int _v4;
				char* _v8;
				char _v12;
				signed int _v20;
				void* __edi;
				unsigned int _t52;
				signed int _t54;
				signed int _t63;
				unsigned int _t70;
				void* _t73;
				signed int* _t74;
				signed int _t76;
				signed int* _t88;
				void* _t90;
				signed int _t94;
				signed int* _t96;
				void* _t98;
				signed int _t99;
				void* _t101;
				void* _t102;

				_t98 = __ebp;
				_t74 = __ecx;
				_t102 = _t101 - 0xc;
				_t70 = _a4;
				_t88 = __ecx;
				if(_t70 == 0) {
					_t74 = 0xa9bbf8;
					E00A66A1C(0xa9bbf8);
				}
				_t52 = 0x40000;
				if(_t70 < 0x40000) {
					_t70 = 0x40000;
					_a4 = 0x40000;
				}
				if(_t70 <=  *(_t88 + 0xe6d8)) {
					L30:
					return _t52;
				} else {
					_t52 = _t70 >> 0x10;
					if(_t52 > 0x10000) {
						goto L30;
					} else {
						_t54 = 0;
						if(_a8 == 0 ||  *(_t88 + 0x4b34) == 0 &&  *((intOrPtr*)(_t88 + 0x4c38)) == 0) {
							_a8 = _t54;
							goto L12;
						} else {
							_a8 = 1;
							if( *((intOrPtr*)(_t88 + 0x4c38)) == _t54) {
								L12:
								_push(_t98);
								if( *((intOrPtr*)(_t88 + 0x4c38)) == _t54) {
									_t54 = E00A82C59(_t74); // executed
									_t99 = _t54;
									_t74 = _t70;
									if(_t99 != 0) {
										goto L20;
									} else {
										goto L15;
									}
								} else {
									_t99 = _t54;
									L15:
									if(_a8 != 0 || _t70 < 0x1000000) {
										goto L32;
									} else {
										_t64 =  *(_t88 + 0x4b34);
										if( *(_t88 + 0x4b34) != 0) {
											L00A816D0(_t64);
											 *(_t88 + 0x4b34) =  *(_t88 + 0x4b34) & 0x00000000;
										}
										E00A71581(_t70, _t88 + 0x4b38, _t99, _t70);
										 *((char*)(_t88 + 0x4c38)) = 1;
										L20:
										if( *((char*)(_t88 + 0x4c38)) == 0) {
											E00A7D1E0(_t88, _t99, 0, _t70);
											_t102 = _t102 + 0xc;
											if(_a8 != 0 &&  *(_t88 + 0xe6d8) >= 1) {
												_t76 = _t70 - 1;
												_a8 = _t76;
												_t73 = 1;
												do {
													_t94 =  *((intOrPtr*)(_t88 + 0x70)) - _t73;
													_t73 = _t73 + 1;
													 *((char*)((_t76 & _t94) + _t99)) =  *((intOrPtr*)(( *(_t88 + 0xe6d8) - 0x00000001 & _t94) +  *(_t88 + 0x4b34)));
													_t76 = _a8;
												} while (_t73 <=  *(_t88 + 0xe6d8));
												_t70 = _a4;
											}
											_t56 =  *(_t88 + 0x4b34);
											if( *(_t88 + 0x4b34) != 0) {
												L00A816D0(_t56);
											}
											 *(_t88 + 0x4b34) = _t99;
										}
										_t32 = _t70 - 1; // -1
										_t52 = _t32;
										 *(_t88 + 0xe6d8) = _t70;
										 *(_t88 + 0xe6dc) = _t52;
										goto L30;
									}
								}
							} else {
								_v4 = _t54;
								_v8 = "bad allocation";
								_v12 = 0xa908fc;
								_t54 = E00A7F404( &_v12, 0xa96c58);
								L32:
								_v4 = _t54;
								_v8 = "bad allocation";
								_v12 = 0xa908fc;
								E00A7F404( &_v12, 0xa96c58);
								asm("int3");
								_push(_t92);
								_t96 = _t74;
								_push(_t88);
								_t90 = 4;
								_t96[1] = _t96[1] & 0x00000000;
								 *_t96 =  *_t96 & 0x00000000;
								_t96[2] = _t96[2] | 0xffffffff;
								_t96[6] = _v20;
								do {
									_t63 = E00A713F7(_t96[6]);
									_t96[1] = _t96[1] << 0x00000008 | _t63;
									_t90 = _t90 - 1;
								} while (_t90 != 0);
								return _t63;
							}
						}
					}
				}
			}

0x00a71660
0x00a71660
0x00a71660
0x00a71664
0x00a71669
0x00a7166d
0x00a7166f
0x00a71674
0x00a71674
0x00a71679
0x00a71680
0x00a71682
0x00a71684
0x00a71684
0x00a7168e
0x00a717b3
0x00a717b8
0x00a71694
0x00a71696
0x00a7169e
0x00000000
0x00a716a4
0x00a716a4
0x00a716aa
0x00a716ce
0x00000000
0x00a716bc
0x00a716bc
0x00a716c7
0x00a716d2
0x00a716d2
0x00a716d9
0x00a716e0
0x00a716e5
0x00a716e7
0x00a716ea
0x00000000
0x00000000
0x00000000
0x00000000
0x00a716db
0x00a716db
0x00a716ec
0x00a716f1
0x00000000
0x00a71703
0x00a71703
0x00a7170b
0x00a7170e
0x00a71713
0x00a7171a
0x00a71722
0x00a71727
0x00a7172e
0x00a71735
0x00a7173b
0x00a71740
0x00a71748
0x00a71753
0x00a71758
0x00a7175c
0x00a7175e
0x00a71767
0x00a71774
0x00a71778
0x00a7177b
0x00a7177f
0x00a71787
0x00a7178b
0x00a7178c
0x00a71794
0x00a71797
0x00a7179c
0x00a7179d
0x00a7179d
0x00a717a3
0x00a717a3
0x00a717a6
0x00a717ac
0x00000000
0x00a717b2
0x00a716f1
0x00a716c9
0x00a717bb
0x00a717c9
0x00a717d1
0x00a717d9
0x00a717de
0x00a717de
0x00a717ec
0x00a717f4
0x00a717fc
0x00a71801
0x00a71806
0x00a71807
0x00a71809
0x00a7180c
0x00a7180d
0x00a71811
0x00a71814
0x00a71818
0x00a7181b
0x00a7181e
0x00a7182b
0x00a7182e
0x00a7182e
0x00a71835
0x00a71835
0x00a716c7
0x00a716aa
0x00a7169e

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00A717D9
__CxxThrowException@8.LIBVCRUNTIME ref: 00A717FC

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: abf268ad1f425ab0be9ffdcaa1ebdc61cfe480a34a2a2c7aa4ed741054351b7e
Instruction ID: 28f84f7936e5973474bedcb8ec17f9a865331b5c2249deae2b6f2f2ec5269615
Opcode Fuzzy Hash: abf268ad1f425ab0be9ffdcaa1ebdc61cfe480a34a2a2c7aa4ed741054351b7e
Instruction Fuzzy Hash: 1D41E5B07093456FD718EF79D9C4756FBE4BB54304F04CA2EE19C57202D7719A888BA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A61595 Relevance: 3.1, APIs: 2, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00A61595(intOrPtr* __ecx, void* __edx, void* __edi, void* __eflags) {
				void* __esi;
				void* _t56;
				signed int _t62;
				signed int _t63;
				char _t64;
				intOrPtr _t74;
				intOrPtr* _t78;
				void* _t86;
				void* _t87;
				intOrPtr* _t89;
				void* _t91;
				void* _t96;

				_t96 = __eflags;
				_t87 = __edi;
				_t86 = __edx;
				_t78 = __ecx;
				E00A7C16C(_t56, _t91);
				_push(_t78);
				_t89 = _t78;
				 *((intOrPtr*)(_t91 - 0x10)) = _t89;
				E00A68E1D(_t78);
				 *_t89 = 0xa8f294;
				 *((intOrPtr*)(_t91 - 4)) = 0;
				E00A65D5F(_t89 + 0x1024, _t86, _t96);
				 *((char*)(_t91 - 4)) = 1;
				E00A6C004(_t89 + 0x20e8, _t86, _t96);
				 *((intOrPtr*)(_t89 + 0x21d0)) = 0;
				 *((intOrPtr*)(_t89 + 0x21d4)) = 0;
				E00A6172E();
				_t62 = E00A6172E();
				 *((char*)(_t91 - 4)) = 4;
				_t63 = _t62 & 0xffffff00 |  *((intOrPtr*)(_t91 + 8)) == 0x00000000;
				 *((intOrPtr*)(_t89 + 0x21bc)) = 0;
				 *(_t89 + 0x21b8) = _t63;
				_t98 = _t63;
				if(_t63 == 0) {
					_t64 =  *((intOrPtr*)(_t91 + 8));
				} else {
					_t74 = E00A7C12B(_t86, _t89, _t98, 0x72a8);
					 *((intOrPtr*)(_t91 + 8)) = _t74;
					 *((char*)(_t91 - 4)) = 5;
					if(_t74 == 0) {
						_t64 = 0;
					} else {
						_t64 = E00A6A687(_t74); // executed
					}
				}
				 *((intOrPtr*)(_t89 + 0x21bc)) = _t64;
				 *(_t89 + 0x21c0) =  *(_t89 + 0x21c0) | 0xffffffff;
				 *(_t89 + 0x21c4) =  *(_t89 + 0x21c4) | 0xffffffff;
				 *(_t89 + 0x21c8) =  *(_t89 + 0x21c8) | 0xffffffff;
				 *((char*)(_t89 + 0x1c)) =  *((intOrPtr*)(_t64 + 0x5195));
				 *((intOrPtr*)(_t89 + 0x6ce8)) = 2;
				 *((intOrPtr*)(_t89 + 0x6cec)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cf0)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cf8)) = 0;
				 *((intOrPtr*)(_t89 + 0x21d0)) = 0;
				 *((intOrPtr*)(_t89 + 0x21d4)) = 0;
				 *((char*)(_t89 + 0x6cf4)) = 0;
				 *((short*)(_t89 + 0x6cfc)) = 0;
				 *((intOrPtr*)(_t89 + 0x21d8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cd8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cdc)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ce0)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ce4)) = 0;
				E00A7D1E0(_t87, _t89 + 0x2208, 0, 0x40);
				E00A7D1E0(_t87, _t89 + 0x2248, 0, 0x34);
				E00A7D1E0(_t87, _t89 + 0x4580, 0, 0x20);
				 *((intOrPtr*)(_t89 + 0x6d10)) = 0;
				 *((intOrPtr*)(_t89 + 0x6d18)) = 0;
				 *((intOrPtr*)(_t89 + 0x6d1c)) = 0;
				 *((intOrPtr*)(_t89 + 0x6d20)) = 0;
				 *((intOrPtr*)(_t89 + 0x6d24)) = 0;
				 *((intOrPtr*)(_t89 + 0x6d28)) = 0;
				 *((intOrPtr*)(_t89 + 0x6d2c)) = 0;
				 *((short*)(_t89 + 0x6d32)) = 0;
				 *((char*)(_t89 + 0x6d0e)) = 0;
				 *((char*)(_t89 + 0x6d30)) = 0;
				 *((char*)(_t89 + 0x21e0)) = 0;
				 *[fs:0x0] =  *((intOrPtr*)(_t91 - 0xc));
				return _t89;
			}

0x00a61595
0x00a61595
0x00a61595
0x00a61595
0x00a61595
0x00a6159a
0x00a6159d
0x00a6159f
0x00a615a2
0x00a615a9
0x00a615b5
0x00a615b8
0x00a615c3
0x00a615c7
0x00a615d2
0x00a615d8
0x00a615de
0x00a615e9
0x00a615f1
0x00a615f5
0x00a615f8
0x00a615fe
0x00a61604
0x00a61606
0x00a6162b
0x00a61608
0x00a6160d
0x00a61613
0x00a61616
0x00a6161c
0x00a61627
0x00a6161e
0x00a61620
0x00a61620
0x00a6161c
0x00a6162e
0x00a6163a
0x00a61641
0x00a61648
0x00a61651
0x00a6165c
0x00a61666
0x00a6166c
0x00a61672
0x00a61678
0x00a6167e
0x00a61684
0x00a6168a
0x00a61691
0x00a61697
0x00a6169d
0x00a616a3
0x00a616a9
0x00a616af
0x00a616be
0x00a616cd
0x00a616d8
0x00a616e0
0x00a616e6
0x00a616ec
0x00a616f2
0x00a616f8
0x00a616fe
0x00a61704
0x00a6170d
0x00a61713
0x00a61719
0x00a61721
0x00a6172b

APIs

__EH_prolog.LIBCMT ref: 00A61595

Part of subcall function 00A65D5F: __EH_prolog.LIBCMT ref: 00A65D64

Part of subcall function 00A6C004: __EH_prolog.LIBCMT ref: 00A6C009
Part of subcall function 00A6C004: new.LIBCMT ref: 00A6C04C
Part of subcall function 00A6C004: new.LIBCMT ref: 00A6C070

new.LIBCMT ref: 00A6160D

Part of subcall function 00A6A687: __EH_prolog.LIBCMT ref: 00A6A68C

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: d065245bc6546915a5f5b7c5a76d4e4a397c8aa33cc79b2974fbfba8b1023f67
Instruction ID: c4661780d66da9f582c516d92bef5a421fe9fed2ebb22025794543fb24004c6d
Opcode Fuzzy Hash: d065245bc6546915a5f5b7c5a76d4e4a397c8aa33cc79b2974fbfba8b1023f67
Instruction Fuzzy Hash: 834136B4900B409ED320DF798995AD6FFF5BF18300F544A2ED5EE87282CB366654CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00A61590 Relevance: 3.1, APIs: 2, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00A61590(intOrPtr* __ecx, void* __edx, void* __edi, void* __eflags) {
				void* __esi;
				signed int _t62;
				signed int _t63;
				char _t64;
				intOrPtr _t74;
				intOrPtr* _t78;
				void* _t86;
				void* _t87;
				intOrPtr* _t89;
				void* _t91;
				void* _t96;

				_t96 = __eflags;
				_t87 = __edi;
				_t86 = __edx;
				_t78 = __ecx;
				E00A7C16C(E00A8EB77, _t91);
				_push(_t78);
				_t89 = _t78;
				 *((intOrPtr*)(_t91 - 0x10)) = _t89;
				E00A68E1D(_t78);
				 *_t89 = 0xa8f294;
				 *((intOrPtr*)(_t91 - 4)) = 0;
				E00A65D5F(_t89 + 0x1024, _t86, _t96);
				 *((char*)(_t91 - 4)) = 1;
				E00A6C004(_t89 + 0x20e8, _t86, _t96);
				 *((intOrPtr*)(_t89 + 0x21d0)) = 0;
				 *((intOrPtr*)(_t89 + 0x21d4)) = 0;
				E00A6172E();
				_t62 = E00A6172E();
				 *((char*)(_t91 - 4)) = 4;
				_t63 = _t62 & 0xffffff00 |  *((intOrPtr*)(_t91 + 8)) == 0x00000000;
				 *((intOrPtr*)(_t89 + 0x21bc)) = 0;
				 *(_t89 + 0x21b8) = _t63;
				_t98 = _t63;
				if(_t63 == 0) {
					_t64 =  *((intOrPtr*)(_t91 + 8));
				} else {
					_t74 = E00A7C12B(_t86, _t89, _t98, 0x72a8);
					 *((intOrPtr*)(_t91 + 8)) = _t74;
					 *((char*)(_t91 - 4)) = 5;
					if(_t74 == 0) {
						_t64 = 0;
					} else {
						_t64 = E00A6A687(_t74); // executed
					}
				}
				 *((intOrPtr*)(_t89 + 0x21bc)) = _t64;
				 *(_t89 + 0x21c0) =  *(_t89 + 0x21c0) | 0xffffffff;
				 *(_t89 + 0x21c4) =  *(_t89 + 0x21c4) | 0xffffffff;
				 *(_t89 + 0x21c8) =  *(_t89 + 0x21c8) | 0xffffffff;
				 *((char*)(_t89 + 0x1c)) =  *((intOrPtr*)(_t64 + 0x5195));
				 *((intOrPtr*)(_t89 + 0x6ce8)) = 2;
				 *((intOrPtr*)(_t89 + 0x6cec)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cf0)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cf8)) = 0;
				 *((intOrPtr*)(_t89 + 0x21d0)) = 0;
				 *((intOrPtr*)(_t89 + 0x21d4)) = 0;
				 *((char*)(_t89 + 0x6cf4)) = 0;
				 *((short*)(_t89 + 0x6cfc)) = 0;
				 *((intOrPtr*)(_t89 + 0x21d8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cd8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cdc)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ce0)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ce4)) = 0;
				E00A7D1E0(_t87, _t89 + 0x2208, 0, 0x40);
				E00A7D1E0(_t87, _t89 + 0x2248, 0, 0x34);
				E00A7D1E0(_t87, _t89 + 0x4580, 0, 0x20);
				 *((intOrPtr*)(_t89 + 0x6d10)) = 0;
				 *((intOrPtr*)(_t89 + 0x6d18)) = 0;
				 *((intOrPtr*)(_t89 + 0x6d1c)) = 0;
				 *((intOrPtr*)(_t89 + 0x6d20)) = 0;
				 *((intOrPtr*)(_t89 + 0x6d24)) = 0;
				 *((intOrPtr*)(_t89 + 0x6d28)) = 0;
				 *((intOrPtr*)(_t89 + 0x6d2c)) = 0;
				 *((short*)(_t89 + 0x6d32)) = 0;
				 *((char*)(_t89 + 0x6d0e)) = 0;
				 *((char*)(_t89 + 0x6d30)) = 0;
				 *((char*)(_t89 + 0x21e0)) = 0;
				 *[fs:0x0] =  *((intOrPtr*)(_t91 - 0xc));
				return _t89;
			}

0x00a61590
0x00a61590
0x00a61590
0x00a61590
0x00a61595
0x00a6159a
0x00a6159d
0x00a6159f
0x00a615a2
0x00a615a9
0x00a615b5
0x00a615b8
0x00a615c3
0x00a615c7
0x00a615d2
0x00a615d8
0x00a615de
0x00a615e9
0x00a615f1
0x00a615f5
0x00a615f8
0x00a615fe
0x00a61604
0x00a61606
0x00a6162b
0x00a61608
0x00a6160d
0x00a61613
0x00a61616
0x00a6161c
0x00a61627
0x00a6161e
0x00a61620
0x00a61620
0x00a6161c
0x00a6162e
0x00a6163a
0x00a61641
0x00a61648
0x00a61651
0x00a6165c
0x00a61666
0x00a6166c
0x00a61672
0x00a61678
0x00a6167e
0x00a61684
0x00a6168a
0x00a61691
0x00a61697
0x00a6169d
0x00a616a3
0x00a616a9
0x00a616af
0x00a616be
0x00a616cd
0x00a616d8
0x00a616e0
0x00a616e6
0x00a616ec
0x00a616f2
0x00a616f8
0x00a616fe
0x00a61704
0x00a6170d
0x00a61713
0x00a61719
0x00a61721
0x00a6172b

APIs

__EH_prolog.LIBCMT ref: 00A61595

Part of subcall function 00A65D5F: __EH_prolog.LIBCMT ref: 00A65D64

Part of subcall function 00A6C004: __EH_prolog.LIBCMT ref: 00A6C009
Part of subcall function 00A6C004: new.LIBCMT ref: 00A6C04C
Part of subcall function 00A6C004: new.LIBCMT ref: 00A6C070

new.LIBCMT ref: 00A6160D

Part of subcall function 00A6A687: __EH_prolog.LIBCMT ref: 00A6A68C

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: bffe523d2a21e4c0a890492794aa0217f54754f588a8281d1d152a1eabbab5c1
Instruction ID: 8968ca310740dcbd67d051c4b4d430d0f35406ada4e53817951be7d7cf17fae6
Opcode Fuzzy Hash: bffe523d2a21e4c0a890492794aa0217f54754f588a8281d1d152a1eabbab5c1
Instruction Fuzzy Hash: DA4124B0901B409ED320DF798985AD6FBF5BF28300F548A2ED5EE87282CB366654CB15

Uniqueness

Uniqueness Score: -1.00%

Function 00A87C40 Relevance: 3.1, APIs: 2, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E00A87C40(signed int __ebx, void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, char _a8) {
				char _v8;
				char _v16;
				void* __edi;
				void* __esi;
				void* __ebp;
				char _t31;
				signed int _t36;
				char _t40;
				intOrPtr _t44;
				char _t45;
				signed int _t51;
				void* _t64;
				void* _t70;
				signed int _t75;
				void* _t81;

				_t81 = __eflags;
				_v8 = E00A85B08(__ebx, __ecx, __edx);
				E00A87D5F(__ebx, __ecx, __edx, _t81);
				_t31 = E00A879D4(_t81, _a4);
				_v16 = _t31;
				_t57 =  *(_v8 + 0x48);
				if(_t31 ==  *((intOrPtr*)( *(_v8 + 0x48) + 4))) {
					return 0;
				}
				_push(__ebx);
				_t70 = E00A851E6(_t57, 0x220);
				_t51 = __ebx | 0xffffffff;
				__eflags = _t70;
				if(__eflags == 0) {
					L5:
					_t75 = _t51;
					goto L6;
				} else {
					_t70 = memcpy(_t70,  *(_v8 + 0x48), 0x88 << 2);
					 *_t70 =  *_t70 & 0x00000000; // executed
					_t36 = E00A87E01(_t51, _t70,  *(_v8 + 0x48), __eflags, _v16, _t70); // executed
					_t75 = _t36;
					__eflags = _t75 - _t51;
					if(_t75 != _t51) {
						__eflags = _a8;
						if(_a8 == 0) {
							E00A84FF9();
						}
						asm("lock xadd [eax], ebx");
						__eflags = _t51 == 1;
						if(_t51 == 1) {
							_t45 = _v8;
							__eflags =  *((intOrPtr*)(_t45 + 0x48)) - 0xa996b0;
							if( *((intOrPtr*)(_t45 + 0x48)) != 0xa996b0) {
								E00A851AC( *((intOrPtr*)(_t45 + 0x48)));
							}
						}
						 *_t70 = 1;
						_t64 = _t70;
						_t70 = 0;
						 *(_v8 + 0x48) = _t64;
						_t40 = _v8;
						__eflags =  *(_t40 + 0x350) & 0x00000002;
						if(( *(_t40 + 0x350) & 0x00000002) == 0) {
							__eflags =  *0xa99930 & 0x00000001;
							if(( *0xa99930 & 0x00000001) == 0) {
								_v16 =  &_v8;
								E00A878AA(5,  &_v16);
								__eflags = _a8;
								if(_a8 != 0) {
									_t44 =  *0xa998d0; // 0x10e68c8
									 *0xa993a4 = _t44;
								}
							}
						}
						L6:
						E00A851AC(_t70);
						return _t75;
					} else {
						 *((intOrPtr*)(E00A85628())) = 0x16;
						goto L5;
					}
				}
			}

0x00a87c40
0x00a87c4d
0x00a87c50
0x00a87c58
0x00a87c61
0x00a87c64
0x00a87c6a
0x00000000
0x00a87c6c
0x00a87c70
0x00a87c7d
0x00a87c7f
0x00a87c83
0x00a87c85
0x00a87cb5
0x00a87cb5
0x00000000
0x00a87c87
0x00a87c94
0x00a87c9a
0x00a87c9d
0x00a87ca2
0x00a87ca6
0x00a87ca8
0x00a87cc7
0x00a87ccb
0x00a87ccd
0x00a87ccd
0x00a87cd8
0x00a87cdc
0x00a87cdd
0x00a87cdf
0x00a87ce2
0x00a87ce9
0x00a87cee
0x00a87cf3
0x00a87ce9
0x00a87cf4
0x00a87cfa
0x00a87cff
0x00a87d01
0x00a87d04
0x00a87d07
0x00a87d0e
0x00a87d10
0x00a87d17
0x00a87d1c
0x00a87d25
0x00a87d2a
0x00a87d30
0x00a87d32
0x00a87d37
0x00a87d37
0x00a87d30
0x00a87d17
0x00a87cb7
0x00a87cb8
0x00000000
0x00a87caa
0x00a87caf
0x00000000
0x00a87caf
0x00a87ca8

APIs

Part of subcall function 00A85B08: GetLastError.KERNEL32(?,?,00A81C64,?,00000000,?,00A81803,00000200,00000000,?), ref: 00A85B0C
Part of subcall function 00A85B08: _free.LIBCMT ref: 00A85B3F
Part of subcall function 00A85B08: SetLastError.KERNEL32(00000000,00000000,?), ref: 00A85B80
Part of subcall function 00A85B08: _abort.LIBCMT ref: 00A85B86

Part of subcall function 00A87D5F: _abort.LIBCMT ref: 00A87D91
Part of subcall function 00A87D5F: _free.LIBCMT ref: 00A87DC5

Part of subcall function 00A879D4: GetOEMCP.KERNEL32(00000000,?,?,00A87C5D,?), ref: 00A879FF

_free.LIBCMT ref: 00A87CB8
_free.LIBCMT ref: 00A87CEE

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: 453b640fe9acfd7d177fac880fc5c0203b30368f9f81a63b0758a97ce3d304ca
Instruction ID: 8cfeacc3b45e4132214f0b4b110062172eb58460efc52a19bddc515ae6ec703f
Opcode Fuzzy Hash: 453b640fe9acfd7d177fac880fc5c0203b30368f9f81a63b0758a97ce3d304ca
Instruction Fuzzy Hash: B8317E71908204AFDB11FFA9D545BADBBF4AF41324F25419AF9049B2A1EB72DE40CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A68F0D Relevance: 3.1, APIs: 2, Instructions: 85
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A68F0D(void* __ecx, short _a4, WCHAR* _a4104, signed char _a4108) {
				long _v0;
				signed char _t35;
				signed int _t39;
				void* _t48;
				void* _t50;
				long _t56;
				signed char _t59;
				struct _SECURITY_ATTRIBUTES* _t60;
				void* _t62;
				long _t65;

				E00A7C240();
				_t62 = __ecx;
				_t59 = _a4108;
				_t35 = _t59 >> 0x00000001 & 0x00000001;
				if((_t59 & 0x00000010) != 0 ||  *((char*)(__ecx + 0x1c)) != 0) {
					_t60 = 1;
				} else {
					_t60 = 0;
				}
				 *(_t62 + 0x18) = _t59;
				_t56 = ((0 | _t35 == 0x00000000) - 0x00000001 & 0x80000000) + 0xc0000000;
				_v0 = 0 | _t60 != 0x00000000;
				_t39 =  *(E00A6B1B4(_t60, _a4104)) & 0x0000ffff;
				if(_t39 == 0x2e || _t39 == 0x20) {
					_t15 = _t62 + 4;
					 *_t15 =  *(_t62 + 4) | 0xffffffff;
					__eflags =  *_t15;
					_t65 = _v0;
				} else {
					_t65 = _v0;
					_t50 = CreateFileW(_a4104, _t56, _t65, 0, 2, 0, 0); // executed
					 *(_t62 + 4) = _t50;
				}
				if( *(_t62 + 4) == 0xffffffff && E00A6AC19(_t60, _a4104,  &_a4, 0x800) != 0) {
					_t48 = CreateFileW( &_a4, _t56, _t65, 0, 2, 0, 0); // executed
					 *(_t62 + 4) = _t48;
				}
				 *(_t62 + 0xc) =  *(_t62 + 0xc) & 0x00000000;
				 *((char*)(_t62 + 0x12)) = 1;
				 *((char*)(_t62 + 0x10)) = 0;
				E00A6E847(_t62 + 0x1e, _a4104, 0x800);
				return 0 |  *(_t62 + 4) != 0xffffffff;
			}

0x00a68f12
0x00a68f1a
0x00a68f1c
0x00a68f27
0x00a68f2c
0x00a68f38
0x00a68f34
0x00a68f34
0x00a68f34
0x00a68f43
0x00a68f54
0x00a68f5f
0x00a68f68
0x00a68f6e
0x00a68f94
0x00a68f94
0x00a68f94
0x00a68f98
0x00a68f75
0x00a68f75
0x00a68f89
0x00a68f8f
0x00a68f8f
0x00a68fa0
0x00a68fca
0x00a68fd0
0x00a68fd0
0x00a68fd3
0x00a68fe6
0x00a68feb
0x00a68fef
0x00a69006

APIs

CreateFileW.KERNELBASE(?,-C0000001,?,00000000,00000002,00000000,00000000,?,?,?,00000000,00A695A5,?,?,00A671FC,?), ref: 00A68F89
CreateFileW.KERNELBASE(?,-C0000001,?,00000000,00000002,00000000,00000000,?,?,00000800,?,?,?,00000000,00A695A5,?), ref: 00A68FCA

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b12389aeb5d49fd98621b1fabe96c13228cb7d1e2bac90140d72a91fe1a6af45
Instruction ID: eaeb8c129e12b5760dd059169d279bd6d4d141d7e6c62cb9484e28022f5ea5ea
Opcode Fuzzy Hash: b12389aeb5d49fd98621b1fabe96c13228cb7d1e2bac90140d72a91fe1a6af45
Instruction Fuzzy Hash: 2121DD70040741AFE7308B248C85BA7BBFDEB09324F008A29FAE5C21D1D77999889B61

Uniqueness

Uniqueness Score: -1.00%

Function 00A69430 Relevance: 3.1, APIs: 2, Instructions: 82
timeCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00A69430(void* __ecx, void* __esi, signed char _a4, signed int* _a8, signed int* _a12) {
				void* _v8;
				void* _v16;
				void* _v24;
				signed char _v25;
				int _t34;
				signed char _t49;
				signed int* _t51;
				signed char _t57;
				void* _t58;
				void* _t59;
				signed int* _t60;
				signed int* _t62;

				_t59 = __esi;
				_t58 = __ecx;
				if( *(__ecx + 0x18) != 0x100 && ( *(__ecx + 0x18) & 0x00000002) == 0) {
					FlushFileBuffers( *(__ecx + 4));
				}
				_t51 = _a4;
				_t49 = 1;
				if(_t51 == 0 || ( *_t51 | _t51[1]) == 0) {
					_t57 = 0;
				} else {
					_t57 = 1;
				}
				_push(_t59);
				_t60 = _a8;
				_v25 = _t57;
				if(_t60 == 0) {
					L9:
					_a4 = 0;
				} else {
					_a4 = _t49;
					if(( *_t60 | _t60[1]) == 0) {
						goto L9;
					}
				}
				_t62 = _a12;
				if(_t62 == 0 || ( *_t62 | _a4) == 0) {
					_t49 = 0;
				}
				if(_t57 != 0) {
					E00A6F65A(_t51,  &_v24);
				}
				if(_a4 != 0) {
					E00A6F65A(_t60,  &_v8);
				}
				if(_t49 != 0) {
					E00A6F65A(_t62,  &_v16);
				}
				asm("sbb eax, eax");
				asm("sbb eax, eax");
				asm("sbb eax, eax");
				_t34 = SetFileTime( *(_t58 + 4),  ~(_a4 & 0x000000ff) &  &_v8,  ~(_t49 & 0x000000ff) &  &_v16,  ~(_v25 & 0x000000ff) &  &_v24); // executed
				return _t34;
			}

0x00a69430
0x00a69436
0x00a6943f
0x00a6944a
0x00a6944a
0x00a69450
0x00a69456
0x00a69459
0x00a69466
0x00a69462
0x00a69462
0x00a69462
0x00a69468
0x00a69469
0x00a6946d
0x00a69473
0x00a69480
0x00a69480
0x00a69475
0x00a6947a
0x00a6947e
0x00000000
0x00000000
0x00a6947e
0x00a69485
0x00a6948b
0x00a69495
0x00a69495
0x00a69499
0x00a694a0
0x00a694a0
0x00a694aa
0x00a694b3
0x00a694b3
0x00a694bb
0x00a694c4
0x00a694c4
0x00a694d4
0x00a694e2
0x00a694f2
0x00a694fa
0x00a69506

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,?,00A66F58,?,?,?), ref: 00A6944A
SetFileTime.KERNELBASE(?,?,?,?), ref: 00A694FA

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: ad9bc57f1f7057a1dea77d01d9f27f6cee9e14b1bb05419b2eafe89fe6c8dbb1
Instruction ID: 4bdc0bad6c2a28bc0490f24123c2b685fb81279127552f0a0392c27235cbe780
Opcode Fuzzy Hash: ad9bc57f1f7057a1dea77d01d9f27f6cee9e14b1bb05419b2eafe89fe6c8dbb1
Instruction Fuzzy Hash: 8421B131158286AFD710DF64C989AABBBF8AB55708F04091CF895C7141DB39E94EC761

Uniqueness

Uniqueness Score: -1.00%

Function 00A86F1E Relevance: 3.1, APIs: 2, Instructions: 65
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E00A86F1E(signed int _a4, CHAR* _a8, intOrPtr* _a12, intOrPtr _a16) {
				struct HINSTANCE__* _t13;
				signed int* _t20;
				signed int _t27;
				signed int _t28;
				signed int _t29;
				signed int _t33;
				intOrPtr* _t34;

				_t20 = 0xab87c0 + _a4 * 4;
				_t27 =  *0xa991b8; // 0x3197ea2d
				_t29 = _t28 | 0xffffffff;
				_t33 = _t27 ^  *_t20;
				asm("ror esi, cl");
				if(_t33 == _t29) {
					L14:
					return 0;
				}
				if(_t33 == 0) {
					_t34 = _a12;
					if(_t34 == _a16) {
						L7:
						_t13 = 0;
						L8:
						if(_t13 == 0) {
							L13:
							_push(0x20);
							asm("ror edi, cl");
							 *_t20 = _t29 ^ _t27;
							goto L14;
						}
						_t33 = GetProcAddress(_t13, _a8);
						if(_t33 == 0) {
							_t27 =  *0xa991b8; // 0x3197ea2d
							goto L13;
						}
						 *_t20 = E00A7C410(_t33);
						goto L2;
					} else {
						goto L4;
					}
					while(1) {
						L4:
						_t13 = E00A86FBA( *_t34); // executed
						if(_t13 != 0) {
							break;
						}
						_t34 = _t34 + 4;
						if(_t34 != _a16) {
							continue;
						}
						_t27 =  *0xa991b8; // 0x3197ea2d
						goto L7;
					}
					_t27 =  *0xa991b8; // 0x3197ea2d
					goto L8;
				}
				L2:
				return _t33;
			}

0x00a86f29
0x00a86f32
0x00a86f38
0x00a86f42
0x00a86f44
0x00a86f48
0x00a86fb3
0x00000000
0x00a86fb3
0x00a86f4c
0x00a86f52
0x00a86f58
0x00a86f74
0x00a86f74
0x00a86f76
0x00a86f78
0x00a86fa3
0x00a86fa5
0x00a86fad
0x00a86fb1
0x00000000
0x00a86fb1
0x00a86f84
0x00a86f88
0x00a86f9d
0x00000000
0x00a86f9d
0x00a86f91
0x00000000
0x00000000
0x00000000
0x00000000
0x00a86f5a
0x00a86f5a
0x00a86f5c
0x00a86f64
0x00000000
0x00000000
0x00a86f66
0x00a86f6c
0x00000000
0x00000000
0x00a86f6e
0x00000000
0x00a86f6e
0x00a86f95
0x00000000
0x00a86f95
0x00a86f4e
0x00000000

APIs

GetProcAddress.KERNEL32(00000000,00000000), ref: 00A86F7E
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 00A86F8B

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: AddressProc__crt_fast_encode_pointer
String ID:
API String ID: 2279764990-0
Opcode ID: e05a01de2f5ae19d3c9ce106b01add55ac640ebe09f33706fa914385b93189b5
Instruction ID: 567868cd0c36598e1c155c4b63b0ba9ea2271c720f83fb4023ff65873f3aefd8
Opcode Fuzzy Hash: e05a01de2f5ae19d3c9ce106b01add55ac640ebe09f33706fa914385b93189b5
Instruction Fuzzy Hash: 9911EC336005225FBB21EF6CFC4499B73A5AB847647264365FE19EB254DA30EC4187D0

Uniqueness

Uniqueness Score: -1.00%

Function 00A852D4 Relevance: 3.0, APIs: 2, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 96%

			E00A852D4(void* __ecx, void* __edx, void* _a4, long _a8) {
				void* __esi;
				void* _t4;
				long _t7;
				void* _t9;
				void* _t13;
				void* _t14;
				long _t16;

				_t13 = __edx;
				_t10 = __ecx;
				_t14 = _a4;
				if(_t14 != 0) {
					_t16 = _a8;
					__eflags = _t16;
					if(_t16 != 0) {
						__eflags = _t16 - 0xffffffe0;
						if(_t16 <= 0xffffffe0) {
							while(1) {
								_t4 = HeapReAlloc( *0xab887c, 0, _t14, _t16);
								__eflags = _t4;
								if(_t4 != 0) {
									break;
								}
								__eflags = E00A850B8();
								if(__eflags == 0) {
									goto L5;
								}
								_t7 = E00A83F28(_t10, _t13, _t16, __eflags, _t16);
								_pop(_t10);
								__eflags = _t7;
								if(_t7 == 0) {
									goto L5;
								}
							}
							L7:
							return _t4;
						}
						L5:
						 *((intOrPtr*)(E00A85628())) = 0xc;
						L6:
						_t4 = 0;
						__eflags = 0;
						goto L7;
					}
					E00A851AC(_t14);
					goto L6;
				}
				_t9 = E00A851E6(__ecx, _a8); // executed
				return _t9;
			}

0x00a852d4
0x00a852d4
0x00a852da
0x00a852df
0x00a852ed
0x00a852f0
0x00a852f2
0x00a852fd
0x00a85300
0x00a85327
0x00a85331
0x00a85337
0x00a85339
0x00000000
0x00000000
0x00a85318
0x00a8531a
0x00000000
0x00000000
0x00a8531d
0x00a85322
0x00a85323
0x00a85325
0x00000000
0x00000000
0x00a85325
0x00a8530f
0x00000000
0x00a8530f
0x00a85302
0x00a85307
0x00a8530d
0x00a8530d
0x00a8530d
0x00000000
0x00a8530d
0x00a852f5
0x00000000
0x00a852fa
0x00a852e4
0x00000000

APIs

_free.LIBCMT ref: 00A852F5

Part of subcall function 00A851E6: RtlAllocateHeap.NTDLL(00000000,?,?,?,00A8199A,?,0000015D,?,?,?,?,00A82519,000000FF,00000000,?,?), ref: 00A85218

HeapReAlloc.KERNEL32(00000000,?,00200000,?,?,00A9BBF8,00A61896,?,?,?,?,00000000,?,00A6158A,?,?), ref: 00A85331

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: 440ff8f62c1de961578aebb4a8c302c78a9d8e0ff2bdb0e62c37e2b34b480028
Instruction ID: 3e97183746eb77f9067588b56513a45f3b53ea21ddef510f0ca263300f4c6dc5
Opcode Fuzzy Hash: 440ff8f62c1de961578aebb4a8c302c78a9d8e0ff2bdb0e62c37e2b34b480028
Instruction Fuzzy Hash: C7F0C232E01E05AADB313B76AD05B6B2BACDF81BA0B604125FC14AE191EE60DC0087A1

Uniqueness

Uniqueness Score: -1.00%

Function 00A6CD14 Relevance: 3.0, APIs: 2, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E00A6CD14(int _a4) {
				signed int _t3;
				int _t10;
				signed int _t14;
				signed int _t15;
				WCHAR* _t17;

				_t3 =  *0xa9dc18; // 0x1
				asm("sbb esi, esi");
				_t15 = _t14 & _t3 + 0x00000001;
				 *0xa9dc18 = _t15;
				_t17 = (_t15 << 0xa) + 0xa9bc18;
				 *_t17 = 0;
				if(E00A6C999(0xa9bbe4) != 0) {
					L2:
					LoadStringW( *0xa9bbe0, _a4, _t17, 0x200);
				} else {
					_t10 = LoadStringW( *0xa9bbdc, _a4, _t17, 0x200); // executed
					if(_t10 == 0) {
						goto L2;
					}
				}
				E00A6C4F4(0xa9bbe4, _t17, _t17, 0x200, 0, 0);
				return _t17;
			}

0x00a6cd14
0x00a6cd27
0x00a6cd29
0x00a6cd2d
0x00a6cd36
0x00a6cd3c
0x00a6cd4b
0x00a6cd63
0x00a6cd6f
0x00a6cd4d
0x00a6cd59
0x00a6cd61
0x00000000
0x00000000
0x00a6cd61
0x00a6cd7e
0x00a6cd88

APIs

LoadStringW.USER32(?,?,00000200,?), ref: 00A6CD59
LoadStringW.USER32(?,?,00000200,?), ref: 00A6CD6F

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: ef5824e22575718473d6be9ea0f7761ecb24fe440a9c90fefed453963b4b940d
Instruction ID: 482d49f2aa975b4e525aeb4efe259942960af3ae63831c7ae100a351f5364ce4
Opcode Fuzzy Hash: ef5824e22575718473d6be9ea0f7761ecb24fe440a9c90fefed453963b4b940d
Instruction Fuzzy Hash: 28F0C272710224BBDF21DBA4BE84F6B7EADDF097E1F01002AF984A60A1DE214C41C7E4

Uniqueness

Uniqueness Score: -1.00%

Function 00A6F350 Relevance: 3.0, APIs: 2, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A6F350(void* __ecx) {
				long _v8;
				long _v12;
				int _t8;
				void* _t14;
				signed int _t15;
				signed int _t17;

				_t8 = GetProcessAffinityMask(GetCurrentProcess(),  &_v8,  &_v12); // executed
				if(_t8 == 0) {
					return _t8 + 1;
				}
				_t14 = 0;
				_t17 = _v8;
				_t15 = 1;
				do {
					if((_t17 & _t15) != 0) {
						_t14 = _t14 + 1;
					}
					_t15 = _t15 + _t15;
				} while (_t15 != 0);
				if(_t14 >= 1) {
					return _t14;
				}
				return 1;
			}

0x00a6f364
0x00a6f36c
0x00000000
0x00a6f36e
0x00a6f373
0x00a6f377
0x00a6f37a
0x00a6f37c
0x00a6f37e
0x00a6f380
0x00a6f380
0x00a6f381
0x00a6f381
0x00a6f388
0x00000000
0x00a6f38a
0x00a6f38f

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 00A6F35D
GetProcessAffinityMask.KERNEL32(00000000), ref: 00A6F364

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 74e7d06fcdb98b02dd25e744a81bc3518888398e17708b89abd45eb7f70dd026
Instruction ID: 60ad92209fe9097514d33d28c33f58294af84f3708f214eaf847e9653aceafea
Opcode Fuzzy Hash: 74e7d06fcdb98b02dd25e744a81bc3518888398e17708b89abd45eb7f70dd026
Instruction Fuzzy Hash: EDE09277F0010A6F4F1997A9AC048FB73FDDA482407200179A837D7300F934DD0257A4

Uniqueness

Uniqueness Score: -1.00%

Function 00A69AE4 Relevance: 3.0, APIs: 2, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00A69AE4(WCHAR* _a4, long _a8) {
				short _v4100;
				int _t12;
				signed int _t18;
				signed int _t19;
				void* _t21;

				E00A7C240();
				_push(_t18);
				_t12 = SetFileAttributesW(_a4, _a8); // executed
				_t19 = _t18 & 0xffffff00 | _t12 != 0x00000000;
				if(_t19 == 0 && E00A6AC19(_t21, _a4,  &_v4100, 0x800) != 0) {
					_t19 = _t19 & 0xffffff00 | SetFileAttributesW( &_v4100, _a8) != 0x00000000;
				}
				return _t19;
			}

0x00a69aec
0x00a69af1
0x00a69af8
0x00a69b00
0x00a69b05
0x00a69b31
0x00a69b31
0x00a69b3a

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00A6991A,?,?,?,00A697B3,?,00000001,00000000,?,?), ref: 00A69AF8
SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00A6991A,?,?,?,00A697B3,?,00000001,00000000,?,?), ref: 00A69B29

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 366d2994029484ce182a0eb79d5892e30dd3ebefbb9d99d86314939c8e7db113
Instruction ID: f5239374bc37862242d75e317cbbaa411c448ad8312b413428b913a88948cf2f
Opcode Fuzzy Hash: 366d2994029484ce182a0eb79d5892e30dd3ebefbb9d99d86314939c8e7db113
Instruction Fuzzy Hash: 08F0A03124110A6FDF11AFA0DC00BEA377DFB08385F048061B98896061DB72DDA99B50

Uniqueness

Uniqueness Score: -1.00%

Function 00A7B4CE Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00A7B4FC
SetDlgItemTextW.USER32(00000065,?), ref: 00A7B513

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: ItemText_swprintf
String ID:
API String ID: 3011073432-0
Opcode ID: 6029ab71c50073c8f9a3ca47abd141f47bd8c93c2209ad2c4812f87a555ac342
Instruction ID: 8845c07d983d3befdf39f98cbc6270fc5bb54386a05aab9496434173fafcc69e
Opcode Fuzzy Hash: 6029ab71c50073c8f9a3ca47abd141f47bd8c93c2209ad2c4812f87a555ac342
Instruction Fuzzy Hash: A7F0EC725503487BEB11FBA0CD06FA9376CE705781F148055B605520A3DA755A1187B5

Uniqueness

Uniqueness Score: -1.00%

Function 00A697CD Relevance: 3.0, APIs: 2, Instructions: 28
fileCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00A697CD(WCHAR* _a4) {
				short _v4100;
				int _t10;
				signed int _t16;
				signed int _t17;
				void* _t19;

				E00A7C240();
				_push(_t16);
				_t10 = DeleteFileW(_a4); // executed
				_t17 = _t16 & 0xffffff00 | _t10 != 0x00000000;
				if(_t17 == 0 && E00A6AC19(_t19, _a4,  &_v4100, 0x800) != 0) {
					_t17 = _t17 & 0xffffff00 | DeleteFileW( &_v4100) != 0x00000000;
				}
				return _t17;
			}

0x00a697d5
0x00a697da
0x00a697de
0x00a697e6
0x00a697eb
0x00a69814
0x00a69814
0x00a6981d

APIs

DeleteFileW.KERNELBASE(?,?,?,00A69030,?,?,00A68E88), ref: 00A697DE
DeleteFileW.KERNEL32(?,?,?,00000800,?,?,00A69030,?,?,00A68E88), ref: 00A6980C

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 607b1696cd9b402895001b8a785e03a18486175c7e61a68ae5fa76c0b8dc3409
Instruction ID: 03620fa54ace03c5e6f3a56ce755b2dbcc340d0fd8bdd28269c197532adb5907
Opcode Fuzzy Hash: 607b1696cd9b402895001b8a785e03a18486175c7e61a68ae5fa76c0b8dc3409
Instruction Fuzzy Hash: 8AE09B3164020A5FDB119FA1DC01BE977BCAB05781F448075B988D7052DB31DD959AA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A69834 Relevance: 3.0, APIs: 2, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A69834(WCHAR* _a4) {
				short _v4100;
				long _t6;
				long _t11;
				void* _t12;
				long _t14;

				E00A7C240();
				_t6 = GetFileAttributesW(_a4); // executed
				_t14 = _t6;
				if(_t14 == 0xffffffff && E00A6AC19(_t12, _a4,  &_v4100, 0x800) != 0) {
					_t11 = GetFileAttributesW( &_v4100); // executed
					_t14 = _t11;
				}
				return _t14;
			}

0x00a6983c
0x00a69845
0x00a6984b
0x00a69850
0x00a69871
0x00a69877
0x00a69877
0x00a6987f

APIs

GetFileAttributesW.KERNELBASE(?,?,?,00A69829,?,00A670A1,?,?,?,?), ref: 00A69845
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,00A69829,?,00A670A1,?,?,?,?), ref: 00A69871

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 6db3a4c1943320fd745a9b7b31c7152b93ef412394ff7e4fd0ea5e7bdb164b30
Instruction ID: 925114788c324e5a9c430cbb5132c898a8110df9e8e69c9be6212e1c2510d55e
Opcode Fuzzy Hash: 6db3a4c1943320fd745a9b7b31c7152b93ef412394ff7e4fd0ea5e7bdb164b30
Instruction Fuzzy Hash: D8E092315001286FCB11ABA8DC04BE977BCAB0D3F1F0042B1FD59E7291D6719D889BD0

Uniqueness

Uniqueness Score: -1.00%

Function 00A6E9B3 Relevance: 3.0, APIs: 2, Instructions: 25
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A6E9B3(intOrPtr _a4) {
				short _v4100;
				struct HINSTANCE__* _t7;

				E00A7C240();
				_t7 = GetSystemDirectoryW( &_v4100, 0x800);
				if(_t7 != 0) {
					E00A6AF10( &_v4100, _a4,  &_v4100, 0x800);
					_t7 = LoadLibraryW( &_v4100); // executed
				}
				return _t7;
			}

0x00a6e9bb
0x00a6e9ce
0x00a6e9d6
0x00a6e9e4
0x00a6e9f0
0x00a6e9f0
0x00a6e9fa

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00A6E9CE
LoadLibraryW.KERNELBASE(?,?,00A6DAA4,Crypt32.dll,?,00A6DB27,?,00A6DB0A,?,?,?,?), ref: 00A6E9F0

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 0f09a5dc4cbea3f72466bbafd8dea26bad30eddf6cb139cd5e8495aaebdbf9f4
Instruction ID: 65b6e94ee315ea0c7b94ff3a759d9c617d7960c7fd7bdf159bac0459bd2fc1e3
Opcode Fuzzy Hash: 0f09a5dc4cbea3f72466bbafd8dea26bad30eddf6cb139cd5e8495aaebdbf9f4
Instruction Fuzzy Hash: EDE012769101296BDB11EBE49C04FD6B77CEF083D1F0440A6B948D2005EA74DE90CBF1

Uniqueness

Uniqueness Score: -1.00%

Function 00A80165 Relevance: 3.0, APIs: 2, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00A80165(void* __ecx, void* __eflags) {
				intOrPtr _t1;
				void* _t2;
				void* _t9;

				_t1 = E00A81390(__eflags, E00A800A9); // executed
				 *0xa99210 = _t1;
				if(_t1 != 0xffffffff) {
					_t2 = E00A8143E(__eflags, _t1, 0xab81e4);
					_pop(_t9);
					__eflags = _t2;
					if(_t2 != 0) {
						return 1;
					} else {
						E00A80198(_t9);
						goto L1;
					}
				} else {
					L1:
					return 0;
				}
			}

0x00a8016a
0x00a8016f
0x00a80178
0x00a80183
0x00a80189
0x00a8018a
0x00a8018c
0x00a80197
0x00a8018e
0x00a8018e
0x00000000
0x00a8018e
0x00a8017a
0x00a8017a
0x00a8017c
0x00a8017c

APIs

Part of subcall function 00A81390: try_get_function.LIBVCRUNTIME ref: 00A813A5
Part of subcall function 00A81390: FlsAlloc.KERNELBASE(00000000), ref: 00A813BD

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00A80183
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00A8018E

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: AllocValue___vcrt____vcrt_uninitialize_ptdtry_get_function
String ID:
API String ID: 2703957606-0
Opcode ID: ff942d0c71cdd2ea517f1fe467f9e4215bf7237eb31ef30bc63797287b9cd77c
Instruction ID: 00ee010cb539da6cfc65f859fff1ec15db2e47a048871e4d05f70a6632216ad5
Opcode Fuzzy Hash: ff942d0c71cdd2ea517f1fe467f9e4215bf7237eb31ef30bc63797287b9cd77c
Instruction Fuzzy Hash: D5D0A9642493002819D433B82A0AD9E2BACA8027B07E04B4AE0309A4D2EE54800B6321

Uniqueness

Uniqueness Score: -1.00%

Function 00A614E1 Relevance: 3.0, APIs: 2, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00A614E1(struct HWND__* _a4, int _a8, signed char _a12) {
				int _t8;

				asm("sbb eax, eax");
				_t8 = ShowWindow(GetDlgItem(_a4, _a8),  ~(_a12 & 0x000000ff) & 0x00000009); // executed
				return _t8;
			}

0x00a614e8
0x00a614fd
0x00a61503

APIs

GetDlgItem.USER32(?,?), ref: 00A614F6
ShowWindow.USER32(00000000), ref: 00A614FD

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: 64998c6201957d3ea136b7db5df7bbedbdd434b5ae0bf8714d3668023501f1b6
Instruction ID: 51b59304d28f1a47f29a92e905ac6f63098668ffd7ccc24d34aab52c9e8f8315
Opcode Fuzzy Hash: 64998c6201957d3ea136b7db5df7bbedbdd434b5ae0bf8714d3668023501f1b6
Instruction Fuzzy Hash: CEC01236158100BECB014BB4EC09C2FBBA8AB95211F10C909B0A5C1060C63DC410DB11

Uniqueness

Uniqueness Score: -1.00%

Function 00A6F2DA Relevance: 2.5, APIs: 2, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00A6F2DA(intOrPtr _a4) {
				void* _t2;
				intOrPtr _t4;
				intOrPtr _t16;
				intOrPtr _t18;

				_t18 = _a4;
				if(_t18 == 0) {
					return _t2;
				}
				EnterCriticalSection(0xaa14a0);
				_t16 =  *0xaa14b8; // 0x111a6e8
				if(_t18 != _t16) {
					L7:
					E00A6F07B(_t18);
					_push(0x1b8);
					_t4 = E00A7C15E(_t18);
					L8:
					LeaveCriticalSection(0xaa14a0);
					return _t4;
				}
				_t4 =  *0xaa14bc; // 0x0
				if(_t4 != 0) {
					_t4 = _t4 - 1;
					 *0xaa14bc = _t4;
					if(_t4 == 0 && _t16 != 0) {
						E00A6F07B(_t16); // executed
						_push(0x1b8);
						_t4 = E00A7C15E(_t16);
						_t16 =  *0xaa14b8; // 0x111a6e8
					}
				}
				if(_t18 == _t16) {
					goto L8;
				} else {
					goto L7;
				}
			}

0x00a6f2db
0x00a6f2e1
0x00a6f34d
0x00a6f34d
0x00a6f2ec
0x00a6f2f2
0x00a6f2ff
0x00a6f332
0x00a6f334
0x00a6f339
0x00a6f33b
0x00a6f342
0x00a6f343
0x00000000
0x00a6f34b
0x00a6f301
0x00a6f308
0x00a6f30a
0x00a6f30d
0x00a6f312
0x00a6f31a
0x00a6f31f
0x00a6f321
0x00a6f326
0x00a6f32d
0x00a6f312
0x00a6f330
0x00000000
0x00000000
0x00000000
0x00000000

APIs

EnterCriticalSection.KERNEL32(00AA14A0,?,?,?,?,00A69FBE,?,?,?,?,00A8EB81,000000FF), ref: 00A6F2EC
LeaveCriticalSection.KERNEL32(00AA14A0,?,?,?,?,00A69FBE,?,?,?,?,00A8EB81,000000FF), ref: 00A6F343

Part of subcall function 00A6F07B: ReleaseSemaphore.KERNEL32(?,00000020,00000000), ref: 00A6F0AF
Part of subcall function 00A6F07B: CloseHandle.KERNEL32(?,?), ref: 00A6F0C9
Part of subcall function 00A6F07B: DeleteCriticalSection.KERNEL32(?), ref: 00A6F0E2
Part of subcall function 00A6F07B: FindCloseChangeNotification.KERNELBASE(?), ref: 00A6F0EE
Part of subcall function 00A6F07B: CloseHandle.KERNEL32(?), ref: 00A6F0FA

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: CloseCriticalSection$Handle$ChangeDeleteEnterFindLeaveNotificationReleaseSemaphore
String ID:
API String ID: 2851692498-0
Opcode ID: 3342b307b0c6ef4667cef5f49d8b57f58a0a7178c52330932b8b6c9bbe580084
Instruction ID: 1044042c8c80a8d43cbd67075349d119b13e7f4164e16e14697c76905c66ee8f
Opcode Fuzzy Hash: 3342b307b0c6ef4667cef5f49d8b57f58a0a7178c52330932b8b6c9bbe580084
Instruction Fuzzy Hash: 15F0FC775083126FC321A738BDC186F777CDB85770716423AF8259B386EB29AC4246A0

Uniqueness

Uniqueness Score: -1.00%

Function 00A61A4C Relevance: 1.8, APIs: 1, Instructions: 264
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E00A61A4C(intOrPtr* __ecx, char* __edx) {
				intOrPtr _t95;
				intOrPtr _t98;
				char* _t99;
				intOrPtr _t100;
				intOrPtr _t102;
				intOrPtr _t112;
				signed int _t119;
				char _t121;
				intOrPtr _t133;
				intOrPtr _t134;
				intOrPtr _t136;
				void* _t140;
				void* _t141;
				char _t145;
				intOrPtr* _t148;
				signed int _t154;
				char* _t175;
				intOrPtr* _t178;
				intOrPtr _t182;
				intOrPtr _t183;
				char* _t185;
				intOrPtr _t186;
				void* _t187;

				_t175 = __edx;
				_t148 = __ecx;
				E00A7C16C(E00A8EB9B, _t187);
				_t178 = _t148;
				_t145 = 0;
				_push(7);
				_t181 = _t178 + 0x21f8;
				_push(_t178 + 0x21f8);
				 *((char*)(_t178 + 0x6cf4)) = 0;
				 *((char*)(_t178 + 0x6cfc)) = 0;
				if( *((intOrPtr*)( *_t178 + 8))() == 7) {
					 *((intOrPtr*)(_t178 + 0x6cf8)) = 0;
					_t95 = E00A61DA3(_t181, 7);
					if(_t95 == 0) {
						E00A61571(_t187 - 0x28, 0x200000);
						 *(_t187 - 4) = 0;
						_t98 =  *((intOrPtr*)( *_t178 + 0x10))();
						_t182 =  *((intOrPtr*)(_t187 - 0x28));
						 *((intOrPtr*)(_t187 - 0x18)) = _t98;
						_t99 =  *((intOrPtr*)( *_t178 + 8))(_t182,  *((intOrPtr*)(_t187 - 0x24)) + 0xfffffff0);
						_t175 = _t99;
						_t154 = 0;
						 *((intOrPtr*)(_t187 - 0x10)) = _t175;
						 *((intOrPtr*)(_t187 - 0x14)) = 0;
						if(_t175 <= 0) {
							L22:
							if( *((intOrPtr*)(_t178 + 0x6cf8)) != _t145) {
								 *(_t187 - 4) =  *(_t187 - 4) | 0xffffffff;
								if(_t182 != 0) {
									L00A816D0(_t182); // executed
								}
								goto L27;
							}
							if(_t182 != 0) {
								L00A816D0(_t182);
							}
							goto L1;
						} else {
							goto L6;
						}
						do {
							L6:
							_t175 = _t182 + _t154;
							if( *_t175 != 0x52) {
								goto L17;
							}
							_t133 = E00A61DA3(_t175, _t99 - _t154);
							_t154 =  *((intOrPtr*)(_t187 - 0x14));
							if(_t133 == 0) {
								L16:
								_t99 =  *((intOrPtr*)(_t187 - 0x10));
								goto L17;
							}
							_t175 =  *((intOrPtr*)(_t187 - 0x18));
							 *((intOrPtr*)(_t178 + 0x6ce8)) = _t133;
							if(_t133 != 1 || _t154 <= 0 || _t175 >= 0x1c ||  *((intOrPtr*)(_t187 - 0x10)) <= 0x1f) {
								L19:
								_t134 = _t154 + _t175;
								_t175 =  *_t178;
								 *((intOrPtr*)(_t178 + 0x6cf8)) = _t134;
								 *((intOrPtr*)(_t175 + 0xc))(_t134, _t145, _t145);
								_t136 =  *((intOrPtr*)(_t178 + 0x6ce8));
								if(_t136 == 2 || _t136 == 3) {
									 *((intOrPtr*)( *_t178 + 8))(_t178 + 0x21f8, 7);
								}
								goto L22;
							} else {
								_t140 = _t182 - _t175;
								if( *((char*)(_t140 + 0x1c)) != 0x52 ||  *((char*)(_t140 + 0x1d)) != 0x53 ||  *((char*)(_t140 + 0x1e)) != 0x46 ||  *((char*)(_t140 + 0x1f)) != 0x58) {
									goto L16;
								} else {
									goto L19;
								}
							}
							L17:
							_t154 = _t154 + 1;
							 *((intOrPtr*)(_t187 - 0x14)) = _t154;
						} while (_t154 < _t99);
						goto L22;
					} else {
						 *((intOrPtr*)(_t178 + 0x6ce8)) = _t95;
						if(_t95 == 1) {
							_t186 =  *_t178;
							_t141 =  *((intOrPtr*)(_t186 + 0x10))(0);
							asm("sbb edx, ebx");
							 *((intOrPtr*)(_t186 + 0xc))(_t141 - 7, _t175);
						}
						L27:
						_t100 =  *((intOrPtr*)(_t178 + 0x6ce8));
						if(_t100 != 4) {
							if(_t100 != 3) {
								 *((intOrPtr*)(_t178 + 0x2200)) = 7;
								L37:
								while(E00A637FD(_t175) != 0) {
									_t102 =  *((intOrPtr*)(_t178 + 0x21dc));
									if(_t102 == 1 ||  *((char*)(_t178 + 0x21e0)) != 0 && _t102 == 4) {
										break;
									} else {
										E00A61ED6(_t178);
										continue;
									}
								}
								if( *((char*)(_t178 + 0x6cfd)) == 0 ||  *((char*)(_t187 + 8)) != 0) {
									E00A61ED6(_t178);
									if( *((char*)(_t178 + 0x6cfc)) == 0) {
										L42:
										 *((char*)(_t178 + 0x6cee)) =  *((intOrPtr*)(_t178 + 0x2224));
										if( *((char*)(_t178 + 0x21e0)) == 0 ||  *((char*)(_t178 + 0x6cf4)) == 0) {
											 *((intOrPtr*)(_t187 - 0x28)) = _t178;
											 *((intOrPtr*)(_t187 - 0x20)) =  *((intOrPtr*)( *_t178 + 0x10))();
											 *((intOrPtr*)(_t187 - 0x1c)) = _t175;
											_t183 =  *((intOrPtr*)(_t178 + 0x6cd8));
											 *((intOrPtr*)(_t187 + 8)) =  *((intOrPtr*)(_t178 + 0x6cdc));
											 *((intOrPtr*)(_t187 - 0x18)) =  *((intOrPtr*)(_t178 + 0x6ce0));
											 *((intOrPtr*)(_t187 - 0x14)) =  *((intOrPtr*)(_t178 + 0x6ce4));
											 *(_t187 - 4) = 1;
											 *((intOrPtr*)(_t187 - 0x10)) =  *((intOrPtr*)(_t178 + 0x21dc));
											while(E00A637FD(_t175) != 0) {
												_t112 =  *((intOrPtr*)(_t178 + 0x21dc));
												if(_t112 != 3) {
													if(_t112 == 2) {
														if( *((char*)(_t178 + 0x6ced)) != 0 &&  *((char*)(_t178 + 0x3308)) == 0) {
															_t145 = 1;
														}
														 *((char*)(_t178 + 0x6cf1)) = _t145;
														L60:
														 *((intOrPtr*)(_t178 + 0x6cdc)) =  *((intOrPtr*)(_t187 + 8));
														 *((intOrPtr*)(_t178 + 0x6ce0)) =  *((intOrPtr*)(_t187 - 0x18));
														 *((intOrPtr*)(_t178 + 0x6ce4)) =  *((intOrPtr*)(_t187 - 0x14));
														 *((intOrPtr*)(_t178 + 0x6cd8)) = _t183;
														 *((intOrPtr*)(_t178 + 0x21dc)) =  *((intOrPtr*)(_t187 - 0x10));
														E00A617E5(_t187 - 0x28); // executed
														goto L61;
													}
													if(_t112 == 5) {
														goto L60;
													}
													L53:
													E00A61ED6(_t178);
													continue;
												}
												if( *((char*)(_t178 + 0x6ced)) == 0 ||  *((char*)(_t178 + 0x5648)) != 0) {
													_t121 = _t145;
												} else {
													_t121 = 1;
												}
												 *((char*)(_t178 + 0x6cf1)) = _t121;
												goto L53;
											}
											goto L60;
										} else {
											L61:
											if( *((char*)(_t178 + 0x6ced)) == 0 ||  *((char*)(_t178 + 0x6cf1)) != 0) {
												E00A81693(_t178 + 0x6d32, _t178 + 0x1e);
											}
											_t119 = 1;
											L65:
											 *[fs:0x0] =  *((intOrPtr*)(_t187 - 0xc));
											return _t119;
										}
									}
									E00A61546(0x19, _t178 + 0x1e);
									if( *((char*)(_t187 + 8)) == 0) {
										goto L1;
									}
									goto L42;
								} else {
									goto L1;
								}
							}
							_t185 = _t178 + 0x21ff;
							 *((intOrPtr*)( *_t178 + 8))(_t185, 1);
							if( *_t185 != 0) {
								goto L1;
							}
							 *((intOrPtr*)(_t178 + 0x2200)) = 8;
							goto L37;
						}
						E00A61546(0x3b, _t178 + 0x1e);
						goto L1;
					}
				}
				L1:
				_t119 = 0;
				goto L65;
			}

0x00a61a4c
0x00a61a4c
0x00a61a51
0x00a61a5c
0x00a61a5e
0x00a61a60
0x00a61a64
0x00a61a6a
0x00a61a6b
0x00a61a71
0x00a61a7d
0x00a61a89
0x00a61a8f
0x00a61a96
0x00a61ac8
0x00a61ad1
0x00a61ad4
0x00a61adf
0x00a61ae6
0x00a61ae9
0x00a61aec
0x00a61aee
0x00a61af0
0x00a61af3
0x00a61af8
0x00a61b8f
0x00a61b95
0x00a61bab
0x00a61bb1
0x00a61bb4
0x00a61bb9
0x00000000
0x00a61bb1
0x00a61b99
0x00a61ba0
0x00a61ba5
0x00000000
0x00000000
0x00000000
0x00000000
0x00a61afe
0x00a61afe
0x00a61afe
0x00a61b04
0x00000000
0x00000000
0x00a61b0a
0x00a61b0f
0x00a61b14
0x00a61b4f
0x00a61b4f
0x00000000
0x00a61b4f
0x00a61b16
0x00a61b19
0x00a61b22
0x00a61b5c
0x00a61b5c
0x00a61b5f
0x00a61b66
0x00a61b6c
0x00a61b6f
0x00a61b78
0x00a61b8c
0x00a61b8c
0x00000000
0x00a61b33
0x00a61b35
0x00a61b3b
0x00000000
0x00000000
0x00000000
0x00000000
0x00a61b3b
0x00a61b52
0x00a61b52
0x00a61b53
0x00a61b56
0x00000000
0x00a61a98
0x00a61a98
0x00a61aa1
0x00a61aa7
0x00a61aac
0x00a61ab4
0x00a61ab8
0x00a61ab8
0x00a61bba
0x00a61bba
0x00a61bc3
0x00a61bd8
0x00a61bff
0x00000000
0x00a61c2b
0x00a61c0b
0x00a61c14
0x00000000
0x00a61c24
0x00a61c26
0x00000000
0x00a61c26
0x00a61c14
0x00a61c3d
0x00a61c4b
0x00a61c57
0x00a61c6e
0x00a61c7b
0x00a61c81
0x00a61c94
0x00a61c9a
0x00a61c9d
0x00a61ca6
0x00a61cac
0x00a61cb5
0x00a61cbe
0x00a61cc7
0x00a61cce
0x00a61d10
0x00a61cd3
0x00a61cdc
0x00a61d02
0x00a61d24
0x00a61d31
0x00a61d31
0x00a61d32
0x00a61d38
0x00a61d3e
0x00a61d47
0x00a61d50
0x00a61d59
0x00a61d5f
0x00a61d65
0x00000000
0x00a61d65
0x00a61d07
0x00000000
0x00000000
0x00a61d09
0x00a61d0b
0x00000000
0x00a61d0b
0x00a61ce5
0x00a61cf5
0x00a61cf0
0x00a61cf2
0x00a61cf2
0x00a61cf7
0x00000000
0x00a61cf7
0x00000000
0x00a61d6a
0x00a61d6a
0x00a61d71
0x00a61d87
0x00a61d8d
0x00a61d8e
0x00a61d90
0x00a61d96
0x00a61da0
0x00a61da0
0x00a61c81
0x00a61c5f
0x00a61c68
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00a61c3d
0x00a61bdc
0x00a61be7
0x00a61bed
0x00000000
0x00000000
0x00a61bf3
0x00000000
0x00a61bf3
0x00a61bcb
0x00000000
0x00a61bcb
0x00a61a96
0x00a61a7f
0x00a61a7f
0x00000000

APIs

__EH_prolog.LIBCMT ref: 00A61A51

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: f00ecfec118c3200594e643c891ba460f39e66740befd4090b8f18c84b8e1a0e
Instruction ID: aa39036345da182f8a9a8bdfde1a75f0946701f18f89e9fac9179dcb8ae1180f
Opcode Fuzzy Hash: f00ecfec118c3200594e643c891ba460f39e66740befd4090b8f18c84b8e1a0e
Instruction Fuzzy Hash: 6CA1A170A00646AFEB19DF78C484ABDFFB6FF15304F1C466AD46597281DB31A9A0CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A67C39 Relevance: 1.6, APIs: 1, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00A67C39(void* __ebx, intOrPtr __ecx, char* __edx, void* __edi, void* __eflags) {
				void* __esi;
				void* _t47;
				signed int _t50;
				signed int _t51;
				void* _t53;
				signed int _t55;
				signed int _t60;
				intOrPtr _t72;
				signed int _t79;
				char* _t89;
				void* _t90;
				void* _t92;
				intOrPtr _t94;
				void* _t96;
				void* _t99;

				_t99 = __eflags;
				_t91 = __edi;
				_t89 = __edx;
				_t72 = __ecx;
				E00A7C16C(E00A8ECF7, _t96);
				E00A7C240();
				_t94 = _t72;
				_t1 = _t96 - 0x9d90; // -38288
				E00A61590(_t1, _t89, __edi, _t99,  *(_t94 + 8));
				 *(_t96 - 4) =  *(_t96 - 4) & 0x00000000;
				_t6 = _t96 - 0x9d90; // -38288
				if(E00A695C0(_t6, _t94 + 0xf4) != 0) {
					_t7 = _t96 - 0x9d90; // -38288, executed
					_t47 = E00A61A4C(_t7, _t89, 1); // executed
					if(_t47 != 0) {
						__eflags =  *((char*)(_t96 - 0x3093));
						if( *((char*)(_t96 - 0x3093)) == 0) {
							_push(__edi);
							_t92 = 0;
							__eflags =  *(_t96 - 0x30a3);
							if( *(_t96 - 0x30a3) != 0) {
								_t10 = _t96 - 0x9d72; // -38258
								_t11 = _t96 - 0x1010; // -2064
								_t60 = E00A81693(_t11, _t10);
								__eflags =  *(_t96 - 0x309e);
								while(1) {
									_t17 = _t96 - 0x1010; // -2064
									E00A6B046(_t89, _t17, 0x800, (_t60 & 0xffffff00 | __eflags == 0x00000000) & 0x000000ff);
									_t18 = _t96 - 0x2058; // -6232
									E00A66BA0(_t18);
									_push(0);
									_t19 = _t96 - 0x2058; // -6232
									_t20 = _t96 - 0x1010; // -2064
									_t60 = E00A69B66(_t18, _t89, _t20, _t19);
									__eflags = _t60;
									if(_t60 == 0) {
										break;
									}
									_t92 = _t92 +  *((intOrPtr*)(_t96 - 0x1058));
									asm("adc ebx, [ebp-0x1054]");
									__eflags =  *(_t96 - 0x309e);
								}
								 *((intOrPtr*)(_t94 + 0x98)) =  *((intOrPtr*)(_t94 + 0x98)) + _t92;
								asm("adc [esi+0x9c], ebx");
							}
							_t23 = _t96 - 0x9d90; // -38288
							E00A67DCE(_t94, _t89, _t96, _t23);
							_t50 =  *(_t94 + 8);
							_t90 = 0x49;
							_pop(_t91);
							_t79 =  *(_t50 + 0x72b2) & 0x0000ffff;
							__eflags = _t79 - 0x54;
							if(_t79 == 0x54) {
								L11:
								 *((char*)(_t50 + 0x51c1)) = 1;
							} else {
								__eflags = _t79 - _t90;
								if(_t79 == _t90) {
									goto L11;
								}
							}
							_t51 =  *(_t94 + 8);
							__eflags =  *((intOrPtr*)(_t51 + 0x72b2)) - _t90;
							if( *((intOrPtr*)(_t51 + 0x72b2)) != _t90) {
								__eflags =  *((char*)(_t51 + 0x51c1));
								_t32 =  *((char*)(_t51 + 0x51c1)) == 0;
								__eflags =  *((char*)(_t51 + 0x51c1)) == 0;
								_t51 = E00A6FC7E((_t51 & 0xffffff00 | _t32) & 0x000000ff, (_t51 & 0xffffff00 | _t32) & 0x000000ff, _t94 + 0xf4);
							}
							E00A80F99(_t51);
							do {
								_t53 = E00A637FD(_t90);
								_t35 = _t96 - 0xd; // 0x7f3
								_t36 = _t96 - 0x9d90; // -38288
								_t55 = E00A67E20(_t94, _t90, _t36, _t53, _t35); // executed
								__eflags = _t55;
							} while (_t55 != 0);
						}
					} else {
						E00A66ACC(0xa9bbf8, 1);
					}
				}
				_t37 = _t96 - 0x9d90; // -38288
				E00A61774(_t37, _t91, _t94);
				 *[fs:0x0] =  *((intOrPtr*)(_t96 - 0xc));
				return 0;
			}

0x00a67c39
0x00a67c39
0x00a67c39
0x00a67c39
0x00a67c3e
0x00a67c48
0x00a67c4e
0x00a67c50
0x00a67c59
0x00a67c5e
0x00a67c69
0x00a67c76
0x00a67c7e
0x00a67c84
0x00a67c8b
0x00a67c9e
0x00a67ca5
0x00a67cac
0x00a67caf
0x00a67cb1
0x00a67cb7
0x00a67cb9
0x00a67cc0
0x00a67cc7
0x00a67ccc
0x00a67ce9
0x00a67cf5
0x00a67cfc
0x00a67d01
0x00a67d07
0x00a67d0c
0x00a67d0e
0x00a67d15
0x00a67d1c
0x00a67d21
0x00a67d23
0x00000000
0x00000000
0x00a67cd6
0x00a67cdc
0x00a67ce2
0x00a67ce2
0x00a67d25
0x00a67d2b
0x00a67d2b
0x00a67d31
0x00a67d3a
0x00a67d3f
0x00a67d44
0x00a67d45
0x00a67d46
0x00a67d4e
0x00a67d51
0x00a67d58
0x00a67d58
0x00a67d53
0x00a67d53
0x00a67d56
0x00000000
0x00000000
0x00a67d56
0x00a67d5f
0x00a67d62
0x00a67d69
0x00a67d6b
0x00a67d79
0x00a67d79
0x00a67d80
0x00a67d80
0x00a67d8b
0x00a67d90
0x00a67d96
0x00a67d9b
0x00a67da0
0x00a67da9
0x00a67dae
0x00a67dae
0x00a67d90
0x00a67c8d
0x00a67c94
0x00a67c94
0x00a67c8b
0x00a67db2
0x00a67db8
0x00a67dc3
0x00a67dcd

APIs

__EH_prolog.LIBCMT ref: 00A67C3E

Part of subcall function 00A61590: __EH_prolog.LIBCMT ref: 00A61595
Part of subcall function 00A61590: new.LIBCMT ref: 00A6160D

Part of subcall function 00A61A4C: __EH_prolog.LIBCMT ref: 00A61A51

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 12adc144dcbc48145c9849da8cf09f780bb53a0cd1b0071d04c7d68b2d929804
Instruction ID: 3174b8423ca921dcc56f8a4eed6adebcf3f24bf9608ee467a37012e09d9919d5
Opcode Fuzzy Hash: 12adc144dcbc48145c9849da8cf09f780bb53a0cd1b0071d04c7d68b2d929804
Instruction Fuzzy Hash: F74181728642549EDB24EB60DD51BFEB7B8AF10304F0404EAE54E92082EB756EC8CF20

Uniqueness

Uniqueness Score: -1.00%

Function 00A72A41 Relevance: 1.6, APIs: 1, Instructions: 109
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A72A41(intOrPtr __ecx, void* __eflags) {
				intOrPtr _t31;
				unsigned int _t32;
				signed int _t33;
				char _t36;
				unsigned int _t41;
				unsigned int _t48;
				signed int _t52;
				intOrPtr _t53;
				intOrPtr _t55;
				signed int _t66;
				signed int _t73;
				signed int _t76;
				signed int _t78;
				signed int _t80;
				intOrPtr* _t82;
				void* _t87;
				void* _t91;

				_t55 = __ecx;
				E00A7C16C(E00A8EF17, _t91);
				_t31 = _t55;
				_t82 = _t31 + 4;
				 *((intOrPtr*)(_t91 - 0x14)) = _t31;
				_t32 = E00A69E9F(_t82);
				_t76 =  *(_t82 + 4) + 8;
				_t33 = _t32 >> 8;
				 *(_t91 - 0x1c) = _t33;
				_t52 = 7;
				 *_t82 =  *_t82 + (_t76 >> 3);
				_t77 = _t76 & _t52;
				 *(_t82 + 4) = _t76 & _t52;
				_t87 = (_t33 & _t52) + 1;
				if(_t87 != _t52) {
					if(_t87 == 8) {
						_t87 = E00A69E9F(_t82);
						_t80 =  *(_t82 + 4) + 0x10;
						 *_t82 =  *_t82 + (_t80 >> 3);
						_t77 = _t80 & _t52;
						 *(_t82 + 4) = _t80 & _t52;
					}
				} else {
					_t48 = E00A69E9F(_t82);
					_t73 =  *(_t82 + 4) + 8;
					_t87 = (_t48 >> 8) + _t52;
					 *_t82 =  *_t82 + (_t73 >> 3);
					 *(_t82 + 4) = _t73 & _t52;
				}
				E00A61571(_t91 - 0x2c, _t87);
				_t53 =  *((intOrPtr*)(_t91 - 0x2c));
				 *((intOrPtr*)(_t91 - 0x18)) = 0;
				 *((intOrPtr*)(_t91 - 4)) = 0;
				 *(_t91 - 0x10) = 0;
				if(_t87 <= 0) {
					L9:
					_t36 = E00A706C5( *((intOrPtr*)(_t91 - 0x14)), _t77,  *(_t91 - 0x1c), _t53, _t87); // executed
					 *((char*)(_t91 - 0x18)) = _t36;
					goto L10;
				} else {
					do {
						_t63 =  *((intOrPtr*)(_t91 - 0x14));
						if( *_t82 >=  *((intOrPtr*)( *((intOrPtr*)(_t91 - 0x14)) + 0x78)) - 1 && E00A730D0(_t63) == 0) {
							_t17 = _t87 - 1; // -1
							if( *(_t91 - 0x10) < _t17) {
								L10:
								if(_t53 != 0) {
									L00A816D0(_t53);
								}
								 *[fs:0x0] =  *((intOrPtr*)(_t91 - 0xc));
								return  *((intOrPtr*)(_t91 - 0x18));
							}
						}
						_t41 = E00A69E9F(_t82);
						_t78 =  *(_t91 - 0x10);
						 *((char*)(_t53 + _t78)) = _t41 >> 8;
						_t66 =  *(_t82 + 4) + 8;
						 *_t82 =  *_t82 + (_t66 >> 3);
						_t77 = _t78 + 1;
						 *(_t82 + 4) = _t66 & 0x00000007;
						 *(_t91 - 0x10) = _t77;
					} while (_t77 < _t87);
					goto L9;
				}
			}

0x00a72a41
0x00a72a46
0x00a72a4e
0x00a72a53
0x00a72a56
0x00a72a5b
0x00a72a63
0x00a72a66
0x00a72a6b
0x00a72a70
0x00a72a76
0x00a72a78
0x00a72a7c
0x00a72a7f
0x00a72a82
0x00a72aa9
0x00a72ab5
0x00a72ab7
0x00a72abf
0x00a72ac1
0x00a72ac3
0x00a72ac3
0x00a72a84
0x00a72a86
0x00a72a90
0x00a72a98
0x00a72a9d
0x00a72aa1
0x00a72aa1
0x00a72aca
0x00a72acf
0x00a72ad4
0x00a72ad7
0x00a72ada
0x00a72adf
0x00a72b28
0x00a72b30
0x00a72b35
0x00000000
0x00a72ae1
0x00a72ae1
0x00a72ae1
0x00a72aea
0x00a72af5
0x00a72afb
0x00a72b38
0x00a72b3a
0x00a72b3d
0x00a72b42
0x00a72b4c
0x00a72b56
0x00a72b56
0x00a72afb
0x00a72aff
0x00a72b04
0x00a72b0a
0x00a72b10
0x00a72b1b
0x00a72b1d
0x00a72b1e
0x00a72b21
0x00a72b24
0x00000000
0x00a72ae1

APIs

__EH_prolog.LIBCMT ref: 00A72A46

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: f4238c7b75a447c1b658f175fd48a20161ba11ff1fa8909c3e221b41fc870704
Instruction ID: 8fc103454760ec0919f2b8aaf5b615b696514eff4ae2a0f1bb4a42c8a7f4f0c2
Opcode Fuzzy Hash: f4238c7b75a447c1b658f175fd48a20161ba11ff1fa8909c3e221b41fc870704
Instruction Fuzzy Hash: AD317CB2E0061A8BCB14DF58CA916BEF7B1FB85300B14C629D819A7341D7389D12CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A78986 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00A78986(void* __ecx, void* __edx, void* __eflags) {
				void* __edi;
				void* __esi;
				void* _t31;
				void* _t32;
				intOrPtr _t35;
				void* _t41;
				void* _t51;
				void* _t52;
				short _t54;
				void* _t56;
				intOrPtr _t58;
				void* _t61;

				_t61 = __eflags;
				_t51 = __edx;
				_t41 = __ecx;
				E00A7C16C(E00A8EF46, _t56);
				_push(_t41);
				E00A7C240();
				_push(_t54);
				_push(_t52);
				 *((intOrPtr*)(_t56 - 0x10)) = _t58;
				 *((intOrPtr*)(_t56 - 4)) = 0;
				E00A61590(_t56 - 0x7d58, _t51, _t52, _t61, 0); // executed
				 *((char*)(_t56 - 4)) = 1;
				E00A61EEA(_t56 - 0x7d58, _t51, _t56, _t61,  *((intOrPtr*)(_t56 + 0xc)));
				 *((intOrPtr*)(_t56 - 0x20)) = 0;
				 *((intOrPtr*)(_t56 - 0x1c)) = 0;
				 *((intOrPtr*)(_t56 - 0x18)) = 0;
				 *((intOrPtr*)(_t56 - 0x14)) = 0;
				 *((char*)(_t56 - 4)) = 2;
				_push(_t56 - 0x20);
				_t44 = _t56 - 0x7d58;
				_t31 = E00A619A1(_t56 - 0x7d58, _t51, _t54); // executed
				if(_t31 != 0) {
					_t54 =  *((intOrPtr*)(_t56 - 0x1c));
					_t52 = _t54 + _t54;
					_push(_t52 + 2);
					_t35 = E00A82C59(_t44);
					 *((intOrPtr*)( *((intOrPtr*)(_t56 + 0x10)))) = _t35;
					if(_t35 != 0) {
						__eflags = 0;
						 *((short*)(_t52 + _t35)) = 0;
						E00A7EE90(_t35,  *((intOrPtr*)(_t56 - 0x20)), _t52);
					} else {
						_t54 = 0;
					}
					 *((intOrPtr*)( *((intOrPtr*)(_t56 + 0x14)))) = _t54;
				}
				if( *((intOrPtr*)(_t56 - 0x20)) != 0) {
					L00A816D0( *((intOrPtr*)(_t56 - 0x20)));
				}
				_t32 = E00A61774(_t56 - 0x7d58, _t52, _t54); // executed
				 *[fs:0x0] =  *((intOrPtr*)(_t56 - 0xc));
				return _t32;
			}

0x00a78986
0x00a78986
0x00a78986
0x00a7898b
0x00a78990
0x00a78996
0x00a7899c
0x00a7899d
0x00a789a0
0x00a789aa
0x00a789ad
0x00a789bb
0x00a789bf
0x00a789c4
0x00a789c7
0x00a789ca
0x00a789cd
0x00a789d3
0x00a789d7
0x00a789d8
0x00a789de
0x00a789e5
0x00a789e7
0x00a789ea
0x00a789f0
0x00a789f1
0x00a789fa
0x00a789fe
0x00a78a04
0x00a78a07
0x00a78a0f
0x00a78a00
0x00a78a00
0x00a78a00
0x00a78a1a
0x00a78a1a
0x00a78a20
0x00a78a25
0x00a78a2a
0x00a78a31
0x00a78a3b
0x00a78a46

APIs

__EH_prolog.LIBCMT ref: 00A7898B

Part of subcall function 00A61590: __EH_prolog.LIBCMT ref: 00A61595
Part of subcall function 00A61590: new.LIBCMT ref: 00A6160D

Part of subcall function 00A619A1: __EH_prolog.LIBCMT ref: 00A619A6

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 7c358bb6de978c3a78037758f21b7e9d5453268fd5e0cd2ac24e9c1b65b97045
Instruction ID: e878ed7245977c32ec2aa53726081ca8161617351968c6288ac962a5be0a006b
Opcode Fuzzy Hash: 7c358bb6de978c3a78037758f21b7e9d5453268fd5e0cd2ac24e9c1b65b97045
Instruction Fuzzy Hash: AA215B71C00259DBCF11EF98C955AEEBBB8FF48354F0484AEE409B3251EB396A45DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A88669 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00A88669(void* __edx, void* __esi, void* __eflags) {
				intOrPtr _v12;
				void* __ecx;
				char _t16;
				void* _t17;
				void* _t26;
				void* _t28;
				void* _t31;
				char _t32;
				void* _t34;
				intOrPtr* _t36;

				_push(_t26);
				_push(_t26);
				_t16 = E00A85277(_t26, 0x40, 0x30); // executed
				_t32 = _t16;
				_v12 = _t32;
				_t28 = _t31;
				if(_t32 != 0) {
					_t2 = _t32 + 0xc00; // 0xc00
					_t17 = _t2;
					__eflags = _t32 - _t17;
					if(__eflags != 0) {
						_t3 = _t32 + 0x20; // 0x20
						_t36 = _t3;
						_t34 = _t17;
						do {
							_t4 = _t36 - 0x20; // 0x0
							E00A87190(_t28, _t36, __eflags, _t4, 0xfa0, 0);
							 *(_t36 - 8) =  *(_t36 - 8) | 0xffffffff;
							 *_t36 = 0;
							_t36 = _t36 + 0x30;
							 *((intOrPtr*)(_t36 - 0x2c)) = 0;
							 *((intOrPtr*)(_t36 - 0x28)) = 0xa0a0000;
							 *((char*)(_t36 - 0x24)) = 0xa;
							 *(_t36 - 0x23) =  *(_t36 - 0x23) & 0x000000f8;
							 *((char*)(_t36 - 0x22)) = 0;
							__eflags = _t36 - 0x20 - _t34;
						} while (__eflags != 0);
						_t32 = _v12;
					}
				} else {
					_t32 = 0;
				}
				E00A851AC(0);
				return _t32;
			}

0x00a8866e
0x00a8866f
0x00a88676
0x00a8867b
0x00a8867f
0x00a88683
0x00a88686
0x00a8868c
0x00a8868c
0x00a88692
0x00a88694
0x00a88697
0x00a88697
0x00a8869a
0x00a8869c
0x00a886a2
0x00a886a6
0x00a886ab
0x00a886af
0x00a886b1
0x00a886b4
0x00a886ba
0x00a886c1
0x00a886c5
0x00a886c9
0x00a886cc
0x00a886cc
0x00a886d0
0x00a886d3
0x00a88688
0x00a88688
0x00a88688
0x00a886d5
0x00a886e2

APIs

Part of subcall function 00A85277: RtlAllocateHeap.NTDLL(00000008,00000000,00000000,?,00A85B36,00000001,00000364,?,00A81803,00000200,00000000,?), ref: 00A852B8

_free.LIBCMT ref: 00A886D5

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 0477f7fc32923c24a1a9a9d91c0e761e79207e45a7b89eda4191799c0a0715eb
Instruction ID: a915ce29c943020499db18533cc96902dd5b7fad107239fe00e32b4a7e3304a9
Opcode Fuzzy Hash: 0477f7fc32923c24a1a9a9d91c0e761e79207e45a7b89eda4191799c0a0715eb
Instruction Fuzzy Hash: AA01F5B2600305ABE721EF69D885E5AFBE9EB95370F65062DE594832C0FE30AC05C774

Uniqueness

Uniqueness Score: -1.00%

Function 00A61000 Relevance: 1.5, APIs: 1, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A61000(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed short _t13;
				intOrPtr _t17;
				intOrPtr _t19;
				signed short _t20;
				signed short _t26;

				_t17 = _a8;
				_t19 = _a4;
				_t25 = _t17;
				if(_t17 == 0) {
					_t17 = _t19 + 0x20;
				}
				 *((intOrPtr*)(_t19 + 0x30)) = _a12;
				 *((intOrPtr*)(_t19 + 0x34)) = _a16;
				_t13 = E00A8128A(_t25, _t17, E00A61123, _t19, _t19 + 0x18); // executed
				_t20 = _t13;
				_t26 = _t20;
				if(_t26 == 0) {
					E00A6105D(__eflags, _t19, 2,  *(_t19 + 4),  *( *(_t19 + 4)) & 0x0000ffff);
				} else {
					if(_t26 > 0) {
						_t20 = _t20 & 0x0000ffff | 0x80070000;
					}
				}
				return _t20;
			}

0x00a61003
0x00a61008
0x00a6100b
0x00a6100d
0x00a6100f
0x00a6100f
0x00a61015
0x00a6101b
0x00a61029
0x00a6102e
0x00a61033
0x00a61035
0x00a6104f
0x00a61037
0x00a61037
0x00a6103c
0x00a6103c
0x00a61037
0x00a6105c

APIs

___vcrt_EventRegister.LIBVCRUNTIME ref: 00A61029

Part of subcall function 00A6105D: ___vcrt_EventSetInformation.LIBVCRUNTIME ref: 00A61072

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: Event___vcrt_$InformationRegister
String ID:
API String ID: 1509250826-0
Opcode ID: 3834aa296ab1805e1172aeadeb26626e0adce6e7190d08b1d39dadddb4d80db8
Instruction ID: 85bbb32fd1a310d45eefe26dca490c4a33b90eb35b61b0ccd96d2896aa9e86fa
Opcode Fuzzy Hash: 3834aa296ab1805e1172aeadeb26626e0adce6e7190d08b1d39dadddb4d80db8
Instruction Fuzzy Hash: 53F0C272600255BBCB14DF59C941DB6BBB8FB45710B45411AFD08C7640E335ECA1D7E0

Uniqueness

Uniqueness Score: -1.00%

Function 00A85277 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E00A85277(void* __ecx, signed int _a4, signed int _a8) {
				void* __esi;
				void* _t8;
				void* _t12;
				signed int _t13;
				void* _t15;
				signed int _t16;
				signed int _t18;
				long _t19;

				_t15 = __ecx;
				_t18 = _a4;
				if(_t18 == 0) {
					L2:
					_t19 = _t18 * _a8;
					if(_t19 == 0) {
						_t19 = _t19 + 1;
					}
					while(1) {
						_t8 = RtlAllocateHeap( *0xab887c, 8, _t19); // executed
						if(_t8 != 0) {
							break;
						}
						__eflags = E00A850B8();
						if(__eflags == 0) {
							L8:
							 *((intOrPtr*)(E00A85628())) = 0xc;
							__eflags = 0;
							return 0;
						}
						_t12 = E00A83F28(_t15, _t16, _t19, __eflags, _t19);
						_pop(_t15);
						__eflags = _t12;
						if(_t12 == 0) {
							goto L8;
						}
					}
					return _t8;
				}
				_t13 = 0xffffffe0;
				_t16 = _t13 % _t18;
				if(_t13 / _t18 < _a8) {
					goto L8;
				}
				goto L2;
			}

0x00a85277
0x00a8527d
0x00a85282
0x00a85290
0x00a85290
0x00a85296
0x00a85298
0x00a85298
0x00a852af
0x00a852b8
0x00a852c0
0x00000000
0x00000000
0x00a852a0
0x00a852a2
0x00a852c4
0x00a852c9
0x00a852cf
0x00000000
0x00a852cf
0x00a852a5
0x00a852aa
0x00a852ab
0x00a852ad
0x00000000
0x00000000
0x00a852ad
0x00000000
0x00a852af
0x00a85288
0x00a85289
0x00a8528e
0x00000000
0x00000000
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,00000000,00000000,?,00A85B36,00000001,00000364,?,00A81803,00000200,00000000,?), ref: 00A852B8

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 01481bd157705608a00a292a6a4462613937471b9a759f4d6e743032c9e44110
Instruction ID: a29275d2419b6f09d0e7243054d52c61d525a405ce5f56b5c17042baf31cdaa0
Opcode Fuzzy Hash: 01481bd157705608a00a292a6a4462613937471b9a759f4d6e743032c9e44110
Instruction Fuzzy Hash: 46F0B435D05A246BEB217B729C05A9B3768AF427B1B148121FC04AB1D1EE30DC0087E0

Uniqueness

Uniqueness Score: -1.00%

Function 00A690C9 Relevance: 1.5, APIs: 1, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A690C9(intOrPtr* __ecx, intOrPtr __edx) {
				void* _t17;
				intOrPtr* _t20;
				intOrPtr _t26;
				void* _t28;
				void* _t31;
				intOrPtr* _t32;
				void* _t35;

				_t26 = __edx;
				_t20 = __ecx;
				E00A7C16C(E00A8ED6D, _t35);
				_t32 = _t20;
				 *((intOrPtr*)(_t35 - 0x1c)) = _t32;
				 *((intOrPtr*)(_t35 - 0x14)) =  *((intOrPtr*)( *_t32 + 0x10))(_t28, _t31);
				 *((intOrPtr*)(_t35 - 0x10)) = _t26;
				 *((intOrPtr*)(_t35 - 4)) = 0;
				 *((intOrPtr*)( *_t32 + 0xc))(0, 0, 2);
				_t17 =  *((intOrPtr*)( *_t32 + 0x10))();
				E00A617E5(_t35 - 0x1c); // executed
				 *[fs:0x0] =  *((intOrPtr*)(_t35 - 0xc));
				return _t17;
			}

0x00a690c9
0x00a690c9
0x00a690ce
0x00a690d7
0x00a690da
0x00a690e2
0x00a690e5
0x00a690ef
0x00a690f5
0x00a690fc
0x00a69106
0x00a69113
0x00a6911e

APIs

__EH_prolog.LIBCMT ref: 00A690CE

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: f1b6d39a7347164a225056358ae87a7c8777c26cf3c77e3c93e8fff7c03a5e99
Instruction ID: c25f886c75c77dc16d8244f69147025be2e7ecfe467b57574c5e391e0a0f6c35
Opcode Fuzzy Hash: f1b6d39a7347164a225056358ae87a7c8777c26cf3c77e3c93e8fff7c03a5e99
Instruction Fuzzy Hash: FEF04975E001149FDB18EF5CD40996DF7F4EF88710B0085AFE815E3351EAB09D018B90

Uniqueness

Uniqueness Score: -1.00%

Function 00A658B6 Relevance: 1.5, APIs: 1, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00A658B6(intOrPtr __ecx, void* __eflags) {
				intOrPtr _t25;
				intOrPtr _t34;
				void* _t36;

				_t25 = __ecx;
				E00A7C16C(E00A8EC34, _t36);
				_push(_t25);
				_t34 = _t25;
				 *((intOrPtr*)(_t36 - 0x10)) = _t34;
				E00A6A687(_t25); // executed
				_t2 = _t36 - 4;
				 *(_t36 - 4) =  *(_t36 - 4) & 0x00000000;
				E00A6E874();
				 *(_t36 - 4) = 1;
				E00A6E874();
				 *(_t36 - 4) = 2;
				E00A6E874();
				 *(_t36 - 4) = 3;
				E00A6E874();
				 *(_t36 - 4) = 4;
				E00A6E874();
				 *(_t36 - 4) = 5;
				E00A65AA7(_t34,  *_t2);
				 *[fs:0x0] =  *((intOrPtr*)(_t36 - 0xc));
				return _t34;
			}

0x00a658b6
0x00a658bb
0x00a658c0
0x00a658c2
0x00a658c4
0x00a658c7
0x00a658cc
0x00a658cc
0x00a658d6
0x00a658e1
0x00a658e5
0x00a658f0
0x00a658f4
0x00a658ff
0x00a65903
0x00a6590e
0x00a65912
0x00a65919
0x00a6591d
0x00a65928
0x00a65932

APIs

__EH_prolog.LIBCMT ref: 00A658BB

Part of subcall function 00A6A687: __EH_prolog.LIBCMT ref: 00A6A68C

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2974c7e90c82999c44e36caff5dbbed87b2aabc0c961da071803ccf4dc648d97
Instruction ID: 663b33b2b8af936d3bcd063d5c2f55bc076ee2820c225b90de362e78978c3a6d
Opcode Fuzzy Hash: 2974c7e90c82999c44e36caff5dbbed87b2aabc0c961da071803ccf4dc648d97
Instruction Fuzzy Hash: 2F01AF34A05684DADB06F7A8C2157EEBBB4AF65300F00428DA45A53283CFB41B08CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 00A851E6 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 94%

			E00A851E6(void* __ecx, long _a4) {
				void* __esi;
				void* _t4;
				void* _t6;
				void* _t7;
				void* _t8;
				long _t9;

				_t7 = __ecx;
				_t9 = _a4;
				if(_t9 > 0xffffffe0) {
					L7:
					 *((intOrPtr*)(E00A85628())) = 0xc;
					__eflags = 0;
					return 0;
				}
				if(_t9 == 0) {
					_t9 = _t9 + 1;
				}
				while(1) {
					_t4 = RtlAllocateHeap( *0xab887c, 0, _t9); // executed
					if(_t4 != 0) {
						break;
					}
					__eflags = E00A850B8();
					if(__eflags == 0) {
						goto L7;
					}
					_t6 = E00A83F28(_t7, _t8, _t9, __eflags, _t9);
					_pop(_t7);
					__eflags = _t6;
					if(_t6 == 0) {
						goto L7;
					}
				}
				return _t4;
			}

0x00a851e6
0x00a851ec
0x00a851f2
0x00a85224
0x00a85229
0x00a8522f
0x00000000
0x00a8522f
0x00a851f6
0x00a851f8
0x00a851f8
0x00a8520f
0x00a85218
0x00a85220
0x00000000
0x00000000
0x00a85200
0x00a85202
0x00000000
0x00000000
0x00a85205
0x00a8520a
0x00a8520b
0x00a8520d
0x00000000
0x00000000
0x00a8520d
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00A8199A,?,0000015D,?,?,?,?,00A82519,000000FF,00000000,?,?), ref: 00A85218

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8f9f1aeee224b2c0883f544de71e1d30b5863fe6c13abb3ece6941cb1b9e3aa4
Instruction ID: 447a881ac853d01cf2a5393386fd38a06f4d7b12ccc12bf4b54a5ab08360b555
Opcode Fuzzy Hash: 8f9f1aeee224b2c0883f544de71e1d30b5863fe6c13abb3ece6941cb1b9e3aa4
Instruction Fuzzy Hash: 1EE06539D42A215BDB2137B5AC047DA76A8DF427A0F554121AC559A0A1FE20CC0187E1

Uniqueness

Uniqueness Score: -1.00%

Function 00A68EBF Relevance: 1.5, APIs: 1, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00A68EBF(void* __ecx) {
				void* _t16;
				void* _t21;
				void* _t22;

				_t21 = __ecx;
				_t16 = 1;
				if( *(__ecx + 4) != 0xffffffff) {
					if( *((char*)(__ecx + 0x10)) == 0 &&  *((intOrPtr*)(__ecx + 0xc)) == 0) {
						_t5 = FindCloseChangeNotification( *(__ecx + 4)) - 1; // -1
						asm("sbb bl, bl");
						_t16 =  ~_t5 + 1;
					}
					 *(_t21 + 4) =  *(_t21 + 4) | 0xffffffff;
				}
				 *(_t21 + 0xc) =  *(_t21 + 0xc) & 0x00000000;
				if(_t16 == 0 &&  *((intOrPtr*)(_t21 + 0x14)) != _t16) {
					E00A66991(0xa9bbf8, _t22, _t21 + 0x1e);
				}
				return _t16;
			}

0x00a68ec1
0x00a68ec3
0x00a68ec9
0x00a68ecf
0x00a68ee0
0x00a68ee5
0x00a68ee7
0x00a68ee7
0x00a68ee9
0x00a68ee9
0x00a68eed
0x00a68ef3
0x00a68f03
0x00a68f03
0x00a68f0c

APIs

FindCloseChangeNotification.KERNELBASE(000000FF,?,?,00A68E8F), ref: 00A68EDA

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 09457f052616796f3aff76ee5f3d556cf0cd1ed17549b1b60802b220d22c79d7
Instruction ID: 88e1198e095157cd9be163969bf0845aabc2f71f775d8df457c420cdad6ac384
Opcode Fuzzy Hash: 09457f052616796f3aff76ee5f3d556cf0cd1ed17549b1b60802b220d22c79d7
Instruction Fuzzy Hash: D8F0E270192B018FDB30DB24DA58792B3FC9B12735F048B1EC0F6438D09B39A849CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00A69B66 Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00A69B66(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				void* _t12;
				intOrPtr _t20;

				_t20 = _a8;
				 *((char*)(_t20 + 0x1044)) = 0;
				if(E00A6AEEC(_a4) == 0) {
					_t12 = E00A69C91(__edx, 0xffffffff, _a4, _t20);
					if(_t12 == 0xffffffff) {
						goto L1;
					}
					FindClose(_t12); // executed
					 *(_t20 + 0x1040) =  *(_t20 + 0x1040) & 0x00000000;
					 *((char*)(_t20 + 0x100c)) = E00A69882( *((intOrPtr*)(_t20 + 0x1008)));
					 *((char*)(_t20 + 0x100d)) = E00A6989A( *((intOrPtr*)(_t20 + 0x1008)));
					return 1;
				}
				L1:
				return 0;
			}

0x00a69b67
0x00a69b6f
0x00a69b7d
0x00a69b8a
0x00a69b92
0x00000000
0x00000000
0x00a69b95
0x00a69ba1
0x00a69bb3
0x00a69bbe
0x00000000
0x00a69bc4
0x00a69b7f
0x00000000

APIs

FindClose.KERNELBASE(00000000,000000FF,?,?,?,?,00A671C2,?,?,00000000,?,0000003A,00000802), ref: 00A69B95

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 42f62f0b2375c36b0ccdafe1629635fe49f7f98c4cb0761b835d9374b7421892
Instruction ID: 9e17349cd417518c8e73883a1fe841b7249c5fa593307ae0b3262dcd09f8e72d
Opcode Fuzzy Hash: 42f62f0b2375c36b0ccdafe1629635fe49f7f98c4cb0761b835d9374b7421892
Instruction Fuzzy Hash: F5F08231408790EECA625BB85905BCB7BF86F5A371F04CA49F1FD52192C27560959B32

Uniqueness

Uniqueness Score: -1.00%

Function 00A69139 Relevance: 1.5, APIs: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A69139(void* __ecx) {
				long _t3;

				if( *(__ecx + 4) != 0xffffffff) {
					_t3 = GetFileType( *(__ecx + 4)); // executed
					if(_t3 == 2 || _t3 == 3) {
						return 1;
					} else {
						return 0;
					}
				} else {
					return 0;
				}
			}

0x00a6913d
0x00a69145
0x00a6914e
0x00a6915b
0x00a69155
0x00a69157
0x00a69157
0x00a6913f
0x00a69141
0x00a69141

APIs

GetFileType.KERNELBASE(000000FF,00A6906B), ref: 00A69145

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 1b68bed08b91eae7865a7c4ce3fd3c94dbc53e0d66686691c92916efb698d671
Instruction ID: 7d264d94ffc81c7175e89d698b894997f24f5c61103ba492105a49d5fd86280d
Opcode Fuzzy Hash: 1b68bed08b91eae7865a7c4ce3fd3c94dbc53e0d66686691c92916efb698d671
Instruction Fuzzy Hash: 9BD012710211825A9EB147344D0D09766769B433A6B388BE4E129C40A1D732C847F500

Uniqueness

Uniqueness Score: -1.00%

Function 00A781FE Relevance: 1.5, APIs: 1, Instructions: 13
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A781FE(struct HWND__* _a4, WCHAR* _a8, WCHAR* _a12, int _a16) {
				int _t5;
				int _t6;

				_t5 = _a16;
				if( *0xa9bbf4 != 0) {
					_t5 = _t5 | 0x00180000;
				}
				_t6 = MessageBoxW(_a4, _a8, _a12, _t5); // executed
				return _t6;
			}

0x00a78208
0x00a7820b
0x00a7820d
0x00a7820d
0x00a7821c
0x00a78223

APIs

MessageBoxW.USER32(00000096,00000000,?,00A6FAF5), ref: 00A7821C

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: b89af3bc0c1d68410e4fb5b55ab4948044473c3571879b94a4749940979a1015
Instruction ID: 2af386a199374794b575bd726f19b3a452e72d8cff60085b07e3cc10d20b6138
Opcode Fuzzy Hash: b89af3bc0c1d68410e4fb5b55ab4948044473c3571879b94a4749940979a1015
Instruction Fuzzy Hash: 33D0A93210110CBFEF02DF84EE04FEA3F69EB04310F008005F92880421CB72A831ABA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A7B374 Relevance: 1.5, APIs: 1, Instructions: 11
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A7B374(void* __edx, intOrPtr _a20, intOrPtr _a28) {

				SendDlgItemMessageW( *0xaa8744, 0x6a, 0x402, E00A7B236(_a20, _a28), 0); // executed
				return E00A78E03();
			}

0x00a7b391
0x00a7b39c

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,?,?), ref: 00A7B391

Part of subcall function 00A78E03: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00A78E14
Part of subcall function 00A78E03: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00A78E25
Part of subcall function 00A78E03: TranslateMessage.USER32(?), ref: 00A78E2F
Part of subcall function 00A78E03: DispatchMessageW.USER32(?), ref: 00A78E39

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: Message$DispatchItemPeekSendTranslate
String ID:
API String ID: 4142818094-0
Opcode ID: 85ebe97341747bbd7058b831e46d9d93d9719bcd585199e411e834741bcc4730
Instruction ID: 2154d098d350fa4e409c6bb83ea0f14c126195f26db15294746d1fc5a3ddf3b2
Opcode Fuzzy Hash: 85ebe97341747bbd7058b831e46d9d93d9719bcd585199e411e834741bcc4730
Instruction Fuzzy Hash: 46C012702443007AE7126B50DE07F1A3555FB50B00F10C4147245740F28F7548229A15

Uniqueness

Uniqueness Score: -1.00%

Function 00A7BBA0 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00A7BBA0() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E00A7BEA6(_t3, _t4, _t8, _t9, _t10, 0xa97414, 0xa99b84); // executed
				goto __eax;
			}

0x00a7bb7b
0x00a7bb83
0x00a7bb8a

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A7BB83

Part of subcall function 00A7BEA6: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A7BF23
Part of subcall function 00A7BEA6: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A7BF34

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b8cdec9c7980acbd4e89240c7fb925165e8cd22d7fbe8078ae03adea3f02913a
Instruction ID: 8f7068c0ba185dfe9e52eab51d82d4e16695ace30fa4538388451a7a13ee4d48
Opcode Fuzzy Hash: b8cdec9c7980acbd4e89240c7fb925165e8cd22d7fbe8078ae03adea3f02913a
Instruction Fuzzy Hash: EDB012D13BC001FD3B18610D2E82E3B069CC0E9B20330C83FF408C8242D6400C010032

Uniqueness

Uniqueness Score: -1.00%

Function 00A7BB2B Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00A7BB2B() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E00A7BEA6(_t3, _t4, _t8, _t9, _t10, 0xa973f4, 0xa99a7c); // executed
				goto __eax;
			}

0x00a7bb1a
0x00a7bb22
0x00a7bb29

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A7BB22

Part of subcall function 00A7BEA6: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A7BF23
Part of subcall function 00A7BEA6: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A7BF34

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f0b244ece3c53f2223de469ec378fda0426b8ff32c00fed75fecea401590ed74
Instruction ID: e9e2fd83587d75edb0b392e88626ddd4696005244e62070f0d8eb6cc44bb715c
Opcode Fuzzy Hash: f0b244ece3c53f2223de469ec378fda0426b8ff32c00fed75fecea401590ed74
Instruction Fuzzy Hash: 05B012D137C001FD3A0451095D03E3B01ACC1C4B50330C55EFC09C8340D5401C451031

Uniqueness

Uniqueness Score: -1.00%

Function 00A7BB35 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00A7BB35() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E00A7BEA6(_t3, _t4, _t8, _t9, _t10, 0xa973f4, 0xa99a80); // executed
				goto __eax;
			}

0x00a7bb1a
0x00a7bb22
0x00a7bb29

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A7BB22

Part of subcall function 00A7BEA6: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A7BF23
Part of subcall function 00A7BEA6: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A7BF34

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fd7219ae8bf2b5e3b16c9f254b56da0ef676ef9e18f6e291254f686dd852bca1
Instruction ID: cc1c69e5830d08579865495b3ac6407bc9ec0d62300fdb4ba0c88bca00015db4
Opcode Fuzzy Hash: fd7219ae8bf2b5e3b16c9f254b56da0ef676ef9e18f6e291254f686dd852bca1
Instruction Fuzzy Hash: C6B012E137C011FE3604514A1D02E7B019CD1C0B50330C45EF809CC240D5401C451032

Uniqueness

Uniqueness Score: -1.00%

Function 00A7BB10 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00A7BB10() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E00A7BEA6(_t3, _t4, _t8, _t9, _t10, 0xa973f4, 0xa99a94); // executed
				goto __eax;
			}

0x00a7bb1a
0x00a7bb22
0x00a7bb29

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A7BB22

Part of subcall function 00A7BEA6: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A7BF23
Part of subcall function 00A7BEA6: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A7BF34

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 864352427202c4fe750247e384469e9d450b4e1a9edcb06d7352677324e450a3
Instruction ID: 4f593c46db4d3f4c059ee4b2068a456ce0adfe4ac07d1616e84884e907996cab
Opcode Fuzzy Hash: 864352427202c4fe750247e384469e9d450b4e1a9edcb06d7352677324e450a3
Instruction Fuzzy Hash: B7B012D137C012FD370411051E02D3B019CE1D4B51330C46EF805C815195401C461031

Uniqueness

Uniqueness Score: -1.00%

Function 00A7B7BC Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00A7B7BC() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E00A7BEA6(_t3, _t4, _t8, _t9, _t10, 0xa97334, 0xa99a3c); // executed
				goto __eax;
			}

0x00a7b7c6
0x00a7b7ce
0x00a7b7d5

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A7B7CE

Part of subcall function 00A7BEA6: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A7BF23
Part of subcall function 00A7BEA6: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A7BF34

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3859a3c8baac57ccd15359fbe637b1f67917563da9bb6213feae107080644ef6
Instruction ID: f9c9f09df67fff46ea1b9d008d5443d6586cd7e9f5f18fae1bff06d46c8c2e22
Opcode Fuzzy Hash: 3859a3c8baac57ccd15359fbe637b1f67917563da9bb6213feae107080644ef6
Instruction Fuzzy Hash: 1AB012D237F001FD3E2812041DC3D3B016CC4C0F50330C49EFC04C8140AD404C011031

Uniqueness

Uniqueness Score: -1.00%

Function 00A7BBAF Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E00A7BBAF() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0xa97414); // executed
				E00A7BEA6(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x00a7bb7e
0x00a7bb83
0x00a7bb8a

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A7BB83

Part of subcall function 00A7BEA6: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A7BF23
Part of subcall function 00A7BEA6: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A7BF34

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a4c913efe7f83d734bb9a148825202197e4ffb2cba87086c2e3200e193e91397
Instruction ID: b3b780aa46fd64188cc22c25b78b79287041c789335c9a48482622d75b624a0e
Opcode Fuzzy Hash: a4c913efe7f83d734bb9a148825202197e4ffb2cba87086c2e3200e193e91397
Instruction Fuzzy Hash: E3A001E62BD102FD3A2862556E96E7B166CD4E6B61330CD6AF91AC8286AA8018451471

Uniqueness

Uniqueness Score: -1.00%

Function 00A7BB91 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E00A7BB91() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0xa97414); // executed
				E00A7BEA6(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x00a7bb7e
0x00a7bb83
0x00a7bb8a

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A7BB83

Part of subcall function 00A7BEA6: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A7BF23
Part of subcall function 00A7BEA6: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A7BF34

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7a062fd2fa45e2e2aefb0cfa8d93f32232b9b739a8dc4292850411a32a28d41a
Instruction ID: b3b780aa46fd64188cc22c25b78b79287041c789335c9a48482622d75b624a0e
Opcode Fuzzy Hash: 7a062fd2fa45e2e2aefb0cfa8d93f32232b9b739a8dc4292850411a32a28d41a
Instruction Fuzzy Hash: E3A001E62BD102FD3A2862556E96E7B166CD4E6B61330CD6AF91AC8286AA8018451471

Uniqueness

Uniqueness Score: -1.00%

Function 00A7BB9B Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E00A7BB9B() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0xa97414); // executed
				E00A7BEA6(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x00a7bb7e
0x00a7bb83
0x00a7bb8a

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A7BB83

Part of subcall function 00A7BEA6: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A7BF23
Part of subcall function 00A7BEA6: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A7BF34

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2e467c56159118f7d9f90ac73a4db36412913b1e97d0911a128b7cc58fb1cd1c
Instruction ID: b3b780aa46fd64188cc22c25b78b79287041c789335c9a48482622d75b624a0e
Opcode Fuzzy Hash: 2e467c56159118f7d9f90ac73a4db36412913b1e97d0911a128b7cc58fb1cd1c
Instruction Fuzzy Hash: E3A001E62BD102FD3A2862556E96E7B166CD4E6B61330CD6AF91AC8286AA8018451471

Uniqueness

Uniqueness Score: -1.00%

Function 00A7BB62 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E00A7BB62() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0xa973f4); // executed
				E00A7BEA6(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x00a7bb1d
0x00a7bb22
0x00a7bb29

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A7BB22

Part of subcall function 00A7BEA6: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A7BF23
Part of subcall function 00A7BEA6: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A7BF34

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4f53a519ff49e49b9955e0c9b88bee46555040bde3649c612a40dad8589f6da4
Instruction ID: 899ee4d70282ea9261d990477a54feec189163697c3af01db1d9eb216da1c59f
Opcode Fuzzy Hash: 4f53a519ff49e49b9955e0c9b88bee46555040bde3649c612a40dad8589f6da4
Instruction Fuzzy Hash: 48A022E23BC003FC320822022E03E3F022CC0C0FA0330CC0EFC0ACC280AA802C882030

Uniqueness

Uniqueness Score: -1.00%

Function 00A7BB6C Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E00A7BB6C() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0xa973f4); // executed
				E00A7BEA6(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x00a7bb1d
0x00a7bb22
0x00a7bb29

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A7BB22

Part of subcall function 00A7BEA6: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A7BF23
Part of subcall function 00A7BEA6: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A7BF34

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 576440bfb4a57be28d5878d9a9b41dbc5c9eeaffd0ec8e695b8d304ab6e12727
Instruction ID: 899ee4d70282ea9261d990477a54feec189163697c3af01db1d9eb216da1c59f
Opcode Fuzzy Hash: 576440bfb4a57be28d5878d9a9b41dbc5c9eeaffd0ec8e695b8d304ab6e12727
Instruction Fuzzy Hash: 48A022E23BC003FC320822022E03E3F022CC0C0FA0330CC0EFC0ACC280AA802C882030

Uniqueness

Uniqueness Score: -1.00%

Function 00A7BB76 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E00A7BB76() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0xa97414); // executed
				E00A7BEA6(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x00a7bb7e
0x00a7bb83
0x00a7bb8a

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A7BB83

Part of subcall function 00A7BEA6: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A7BF23
Part of subcall function 00A7BEA6: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A7BF34

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0fde91485e5f5156017373bd3b71d22c93194ac6b6404f1c645ac2d3591fcabb
Instruction ID: b8c5d9363b6582a05b49c01684b91e6d0001764bae77712404b0a98e73178a8d
Opcode Fuzzy Hash: 0fde91485e5f5156017373bd3b71d22c93194ac6b6404f1c645ac2d3591fcabb
Instruction Fuzzy Hash: 52A001E62B9102BD3A2862656EE6E7B166CD4E2B21330CD6AF919D8286AA8018451471

Uniqueness

Uniqueness Score: -1.00%

Function 00A7BB44 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E00A7BB44() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0xa973f4); // executed
				E00A7BEA6(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x00a7bb1d
0x00a7bb22
0x00a7bb29

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A7BB22

Part of subcall function 00A7BEA6: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A7BF23
Part of subcall function 00A7BEA6: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A7BF34

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 02881244bd8c7404d4c60d4029387d5be4066efe07641e350c4eee25ee772e9d
Instruction ID: 899ee4d70282ea9261d990477a54feec189163697c3af01db1d9eb216da1c59f
Opcode Fuzzy Hash: 02881244bd8c7404d4c60d4029387d5be4066efe07641e350c4eee25ee772e9d
Instruction Fuzzy Hash: 48A022E23BC003FC320822022E03E3F022CC0C0FA0330CC0EFC0ACC280AA802C882030

Uniqueness

Uniqueness Score: -1.00%

Function 00A7BB4E Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E00A7BB4E() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0xa973f4); // executed
				E00A7BEA6(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x00a7bb1d
0x00a7bb22
0x00a7bb29

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A7BB22

Part of subcall function 00A7BEA6: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A7BF23
Part of subcall function 00A7BEA6: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A7BF34

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 505b7b2434397865399128cf87830a8d6d0321c9ceb9b2b971742a0f9189f88c
Instruction ID: 899ee4d70282ea9261d990477a54feec189163697c3af01db1d9eb216da1c59f
Opcode Fuzzy Hash: 505b7b2434397865399128cf87830a8d6d0321c9ceb9b2b971742a0f9189f88c
Instruction Fuzzy Hash: 48A022E23BC003FC320822022E03E3F022CC0C0FA0330CC0EFC0ACC280AA802C882030

Uniqueness

Uniqueness Score: -1.00%

Function 00A7BB58 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E00A7BB58() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0xa973f4); // executed
				E00A7BEA6(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x00a7bb1d
0x00a7bb22
0x00a7bb29

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A7BB22

Part of subcall function 00A7BEA6: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A7BF23
Part of subcall function 00A7BEA6: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A7BF34

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 87a64d79460e3a8997571a050d06948c2c23cb01443b7cfeebd048f725e0d507
Instruction ID: 899ee4d70282ea9261d990477a54feec189163697c3af01db1d9eb216da1c59f
Opcode Fuzzy Hash: 87a64d79460e3a8997571a050d06948c2c23cb01443b7cfeebd048f725e0d507
Instruction Fuzzy Hash: 48A022E23BC003FC320822022E03E3F022CC0C0FA0330CC0EFC0ACC280AA802C882030

Uniqueness

Uniqueness Score: -1.00%

Function 00A69588 Relevance: 1.5, APIs: 1, Instructions: 7
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00A69588(void* __ecx) {
				int _t2;

				_t2 = SetEndOfFile( *(__ecx + 4)); // executed
				asm("sbb eax, eax");
				return  ~(_t2 - 1) + 1;
			}

0x00a6958b
0x00a69594
0x00a69597

APIs

SetEndOfFile.KERNELBASE(?,00A688E7,?,?,-00000954), ref: 00A6958B

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 7e02b3a3053059995e30b5cefba811bd16ae824b53011b0bc42ae5aada42abdb
Instruction ID: 2213d9b7e3539e7e2dfe180b05244503a925b068e9bdbd04906e666fd3b450e6
Opcode Fuzzy Hash: 7e02b3a3053059995e30b5cefba811bd16ae824b53011b0bc42ae5aada42abdb
Instruction Fuzzy Hash: CAB011300E000A8E8E002B30CC088203A20EA2230A300C2B0A002C80A2EB22C003AB00

Uniqueness

Uniqueness Score: -1.00%

Function 00A78556 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00A78556(WCHAR* _a4) {
				signed int _t2;

				_t2 = SetCurrentDirectoryW(_a4); // executed
				asm("sbb eax, eax");
				return  ~( ~_t2);
			}

0x00a7855a
0x00a78562
0x00a78566

APIs

SetCurrentDirectoryW.KERNELBASE(?,00A7878E,00A8F4F4,00000000,?,00000006,?,00000800), ref: 00A7855A

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: ad7322929636f7c946a0391acae7dc7b920578dc128454e51019a93697e00991
Instruction ID: 10f60e1f709c2d7f770a5bc098a937e1c5d4bc9b8c752db4f6ee5ad467c396f4
Opcode Fuzzy Hash: ad7322929636f7c946a0391acae7dc7b920578dc128454e51019a93697e00991
Instruction Fuzzy Hash: 3DA012301940078E8A008B70CC0D81575506760B02B0097307143C10A0CB304410A600

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00A7994E Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 289
timewindowfileCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E00A7994E(void* __ecx, void* __edx, void* __eflags, char _a4, short _a8, char _a12, short _a108, short _a112, char _a192, char _a212, struct _WIN32_FIND_DATAW _a288, signed char _a304, signed char _a308, struct _FILETIME _a332, intOrPtr _a340, intOrPtr _a344, short _a884, short _a896, short _a900, int _a1904, char _a1924, int _a1928, short _a2596, short _a2616, char _a2628, char _a2640, struct HWND__* _a6740, intOrPtr _a6744, signed short _a6748, intOrPtr _a6752) {
				struct _FILETIME _v0;
				struct _SYSTEMTIME _v12;
				struct _SYSTEMTIME _v16;
				struct _FILETIME _v24;
				void* _t73;
				void* _t136;
				long _t137;
				void* _t141;
				void* _t142;
				void* _t143;
				void* _t144;
				void* _t145;
				signed short _t148;
				signed int _t153;
				signed int _t157;
				struct HWND__* _t159;
				intOrPtr _t162;
				void* _t163;
				int _t166;
				int _t169;
				void* _t173;
				void* _t177;
				void* _t179;

				E00A7C240();
				_t148 = _a6748;
				_t162 = _a6744;
				_t159 = _a6740;
				if(E00A61506(__edx, _t159, _t162, _t148, _a6752, L"REPLACEFILEDLG", 0, 0) == 0) {
					_t163 = _t162 - 0x110;
					if(_t163 == 0) {
						SetFocus(GetDlgItem(_t159, 0x6c));
						E00A6E847( &_a2640, _a6752, 0x800);
						E00A6B29F( &_a2628,  &_a2628, 0x800);
						SetDlgItemTextW(_t159, 0x65,  &_a2616);
						 *0xa99a8c( &_a2616, 0,  &_a1924, 0x2b4, 0x100);
						SendDlgItemMessageW(_t159, 0x66, 0x170, _a1904, 0);
						_t173 = FindFirstFileW( &_a2596,  &_a288);
						if(_t173 != 0xffffffff) {
							FileTimeToLocalFileTime( &_a332,  &(_v24.dwHighDateTime));
							FileTimeToSystemTime( &(_v24.dwHighDateTime),  &_v12);
							_push(0x32);
							_push( &_a12);
							_push(0);
							_push( &_v12);
							_t166 = 2;
							GetTimeFormatW(0x400, 0x800, ??, ??, ??, ??);
							GetDateFormatW(0x400, 0,  &_v12, 0,  &_a112, 0x32);
							_push( &_a12);
							_push( &_a112);
							E00A63CE2( &_a900, 0x200, L"%s %s %s", E00A6CD14(0x99));
							_t179 = _t177 + 0x18;
							SetDlgItemTextW(_t159, 0x6a,  &_a900);
							FindClose(_t173);
							if((_a308 & 0x00000010) == 0) {
								_push(0x32);
								_push( &_a212);
								_push(0);
								_pop(0);
								asm("adc eax, ebp");
								_push(_a340);
								_push(0 + _a344);
								E00A78830();
								_push(E00A6CD14(0x98));
								E00A63CE2( &_a884, 0x200, L"%s %s",  &_a192);
								_t179 = _t179 + 0x14;
								SetDlgItemTextW(_t159, 0x68,  &_a884);
							}
							SendDlgItemMessageW(_t159, 0x67, 0x170, _a1928, 0);
							E00A6F65A( *0xaaa85c,  &_a4);
							FileTimeToLocalFileTime( &_v0,  &_v24);
							FileTimeToSystemTime( &_v24,  &_v16);
							GetTimeFormatW(0x400, _t166,  &_v16, 0,  &_a8, 0x32);
							GetDateFormatW(0x400, 0,  &_v16, 0,  &_a108, 0x32);
							_push( &_a8);
							_push( &_a108);
							E00A63CE2( &_a896, 0x200, L"%s %s %s", E00A6CD14(0x99));
							_t177 = _t179 + 0x18;
							SetDlgItemTextW(_t159, 0x6b,  &_a896);
							_t153 =  *0xab3e0c;
							_t157 =  *0xab3e08;
							if((_a304 & 0x00000010) == 0 || (_t157 | _t153) != 0) {
								E00A78830(_t157, _t153,  &_a212, 0x32);
								_push(E00A6CD14(0x98));
								E00A63CE2( &_a884, 0x200, L"%s %s",  &_a192);
								_t177 = _t177 + 0x14;
								SetDlgItemTextW(_t159, 0x69,  &_a884);
							}
						}
						L27:
						_t73 = 0;
						L28:
						return _t73;
					}
					if(_t163 != 1) {
						goto L27;
					}
					_t169 = 2;
					_t136 = (_t148 & 0x0000ffff) - _t169;
					if(_t136 == 0) {
						L11:
						_push(6);
						L12:
						_pop(_t169);
						L13:
						_t137 = SendDlgItemMessageW(_t159, 0x66, 0x171, 0, 0);
						if(_t137 != 0) {
							 *0xa99af0(_t137);
						}
						 *0xa99acc(_t159, _t169);
						goto L1;
					}
					_t141 = _t136 - 0x6a;
					if(_t141 == 0) {
						_t169 = 0;
						goto L13;
					}
					_t142 = _t141 - 1;
					if(_t142 == 0) {
						_t169 = 1;
						goto L13;
					}
					_t143 = _t142 - 1;
					if(_t143 == 0) {
						_push(4);
						goto L12;
					}
					_t144 = _t143 - 1;
					if(_t144 == 0) {
						goto L13;
					}
					_t145 = _t144 - 1;
					if(_t145 == 0) {
						_push(3);
						goto L12;
					}
					if(_t145 != 1) {
						goto L27;
					}
					goto L11;
				}
				L1:
				_t73 = 1;
				goto L28;
			}

0x00a79953
0x00a79959
0x00a79962
0x00a7996c
0x00a7998b
0x00a79995
0x00a7999b
0x00a79a15
0x00a79a30
0x00a79a3f
0x00a79a55
0x00a79a72
0x00a79a88
0x00a79aa4
0x00a79aa9
0x00a79abc
0x00a79acc
0x00a79ad2
0x00a79ad8
0x00a79ad9
0x00a79adf
0x00a79ae2
0x00a79ae9
0x00a79b07
0x00a79b11
0x00a79b19
0x00a79b37
0x00a79b3c
0x00a79b4a
0x00a79b4d
0x00a79b5b
0x00a79b5d
0x00a79b6f
0x00a79b77
0x00a79b79
0x00a79b7a
0x00a79b7c
0x00a79b7d
0x00a79b7e
0x00a79b8d
0x00a79ba8
0x00a79bad
0x00a79bbb
0x00a79bbb
0x00a79bd1
0x00a79be2
0x00a79bf1
0x00a79c01
0x00a79c1b
0x00a79c33
0x00a79c3d
0x00a79c45
0x00a79c64
0x00a79c69
0x00a79c77
0x00a79c81
0x00a79c87
0x00a79c8d
0x00a79ca1
0x00a79cb0
0x00a79cc7
0x00a79ccc
0x00a79cda
0x00a79cda
0x00a79c8d
0x00a79cdc
0x00a79cdc
0x00a79cde
0x00a79ce8
0x00a79ce8
0x00a799a0
0x00000000
0x00000000
0x00a799ab
0x00a799ac
0x00a799ae
0x00a799d2
0x00a799d2
0x00a799d4
0x00a799d4
0x00a799d5
0x00a799df
0x00a799e7
0x00a799ea
0x00a799ea
0x00a799f2
0x00000000
0x00a799f2
0x00a799b0
0x00a799b3
0x00a79a07
0x00000000
0x00a79a07
0x00a799b5
0x00a799b8
0x00a79a04
0x00000000
0x00a79a04
0x00a799ba
0x00a799bd
0x00a799fe
0x00000000
0x00a799fe
0x00a799bf
0x00a799c2
0x00000000
0x00000000
0x00a799c4
0x00a799c7
0x00a799fa
0x00000000
0x00a799fa
0x00a799cc
0x00000000
0x00000000
0x00000000
0x00a799cc
0x00a7998d
0x00a7998f
0x00000000

APIs

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 00A799DF
GetDlgItem.USER32(?,0000006C), ref: 00A79A0E
SetFocus.USER32(00000000), ref: 00A79A15
SetDlgItemTextW.USER32(?,00000065,?), ref: 00A79A55
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 00A79A88
FindFirstFileW.KERNEL32(?,?), ref: 00A79A9E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00A79ABC
FileTimeToSystemTime.KERNEL32(?,?), ref: 00A79ACC
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00A79AE9
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00A79B07

Part of subcall function 00A6CD14: LoadStringW.USER32(?,?,00000200,?), ref: 00A6CD59
Part of subcall function 00A6CD14: LoadStringW.USER32(?,?,00000200,?), ref: 00A6CD6F

_swprintf.LIBCMT ref: 00A79B37

Part of subcall function 00A63CE2: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00A63CF5

SetDlgItemTextW.USER32(?,0000006A,?), ref: 00A79B4A
FindClose.KERNEL32(00000000), ref: 00A79B4D
_swprintf.LIBCMT ref: 00A79BA8
SetDlgItemTextW.USER32(?,00000068,?), ref: 00A79BBB
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 00A79BD1
FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 00A79BF1
FileTimeToSystemTime.KERNEL32(?,?), ref: 00A79C01
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00A79C1B
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00A79C33
_swprintf.LIBCMT ref: 00A79C64
SetDlgItemTextW.USER32(?,0000006B,?), ref: 00A79C77
_swprintf.LIBCMT ref: 00A79CC7
SetDlgItemTextW.USER32(?,00000069,?), ref: 00A79CDA

Part of subcall function 00A78830: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00A78856
Part of subcall function 00A78830: GetNumberFormatW.KERNEL32 ref: 00A788A5

Strings

%s %s %s, xrefs: 00A79B25, 00A79C51
%s %s, xrefs: 00A79B96, 00A79CB9
REPLACEFILEDLG, xrefs: 00A79975

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: Time$Item$File$FormatText$_swprintf$MessageSend$DateFindLoadLocalStringSystem$CloseFirstFocusInfoLocaleNumber__vswprintf_c_l
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 2405521099-1840816070
Opcode ID: 65d56ce1799656c6ce78e51278504a1d83ac8429696786ba932d2322dd8e2b0e
Instruction ID: 5f7b6ee7de19f7b1ae40730f11a0eb68a7fc29bcfeb82e7a0bc317be72195519
Opcode Fuzzy Hash: 65d56ce1799656c6ce78e51278504a1d83ac8429696786ba932d2322dd8e2b0e
Instruction Fuzzy Hash: 9C91D472248349BFE621DBA4CD89FFB77ECEB49740F00882AF74DD6081D675A6058762

Uniqueness

Uniqueness Score: -1.00%

Function 00A66BC9 Relevance: 30.0, APIs: 12, Strings: 5, Instructions: 285
fileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00A66BC9(void* __edx) {
				void* __esi;
				signed int _t105;
				signed int _t107;
				intOrPtr _t110;
				signed int _t113;
				intOrPtr _t116;
				intOrPtr _t148;
				void* _t175;
				void* _t177;
				void* _t181;
				short _t182;
				intOrPtr _t186;
				void* _t187;
				intOrPtr _t193;
				void* _t194;
				intOrPtr _t211;
				void* _t212;
				void* _t216;
				void* _t217;
				short _t224;
				WCHAR* _t225;
				short _t226;
				void* _t228;
				void* _t230;
				void* _t231;

				_t212 = __edx;
				E00A7C16C(E00A8EC8B, _t228);
				E00A7C240();
				if( *0xa9bbda == 0) {
					E00A674D7(L"SeRestorePrivilege");
					E00A674D7(L"SeCreateSymbolicLinkPrivilege");
					 *0xa9bbda = 1;
				}
				_t190 = _t228 - 0x28;
				E00A61571(_t228 - 0x28, 0x1418);
				_t186 =  *((intOrPtr*)(_t228 + 0x10));
				 *(_t228 - 4) =  *(_t228 - 4) & 0x00000000;
				E00A6E847(_t228 - 0x1028, _t186 + 0x10f4, 0x800);
				 *((intOrPtr*)(_t228 - 0x10)) = E00A816B5(_t228 - 0x1028);
				_t220 = _t228 - 0x1028;
				_t216 = _t228 - 0x2028;
				_t105 = E00A82B57(_t228 - 0x1028, L"\\??\\", 4);
				_t231 = _t230 + 0x10;
				asm("sbb al, al");
				_t107 =  ~_t105 + 1;
				 *(_t228 - 0x14) = _t107;
				if(_t107 != 0) {
					_t220 = _t228 - 0x1020;
					_t181 = E00A82B57(_t228 - 0x1020, L"UNC\\", 4);
					_t231 = _t231 + 0xc;
					if(_t181 == 0) {
						_t182 = 0x5c;
						 *((short*)(_t228 - 0x2028)) = _t182;
						_t216 = _t228 - 0x2026;
						_t220 = _t228 - 0x101a;
					}
				}
				E00A81693(_t216, _t220);
				_t110 = E00A816B5(_t228 - 0x2028);
				_t217 =  *(_t228 - 0x28);
				 *((intOrPtr*)(_t228 + 0x10)) = _t110;
				if( *((char*)( *((intOrPtr*)(_t228 + 8)) + 0x518b)) != 0) {
					L9:
					_push(1);
					_push( *(_t228 + 0xc));
					E00A696EF(_t190, _t212, _t228);
					if( *((char*)(_t186 + 0x10e1)) != 0 ||  *((char*)(_t186 + 0x20f4)) != 0) {
						_t113 = CreateDirectoryW( *(_t228 + 0xc), 0);
						__eflags = _t113;
						if(_t113 == 0) {
							goto L25;
						}
						goto L14;
					} else {
						_t175 = CreateFileW( *(_t228 + 0xc), 0x40000000, 0, 0, 1, 0x80, 0);
						if(_t175 == 0xffffffff) {
							goto L25;
						}
						CloseHandle(_t175);
						L14:
						_t116 =  *((intOrPtr*)(_t186 + 0x10f0));
						if(_t116 != 3) {
							__eflags = _t116 - 2;
							if(_t116 == 2) {
								L18:
								_t193 =  *((intOrPtr*)(_t228 - 0x10));
								 *_t217 = 0xa000000c;
								_t224 = _t193 + _t193;
								 *((short*)(_t217 + 0xa)) = _t224;
								 *(_t217 + 4) = 0x10 + ( *((intOrPtr*)(_t228 + 0x10)) + _t193) * 2;
								 *((intOrPtr*)(_t217 + 6)) = 0;
								E00A81693(_t217 + 0x14, _t228 - 0x1028);
								_t58 = _t224 + 2; // 0x3
								 *((short*)(_t217 + 0xc)) = _t58;
								 *((short*)(_t217 + 0xe)) =  *((intOrPtr*)(_t228 + 0x10)) +  *((intOrPtr*)(_t228 + 0x10));
								E00A81693(_t217 + ( *((intOrPtr*)(_t228 - 0x10)) + 0xb) * 2, _t228 - 0x2028);
								__eflags =  *(_t228 - 0x14);
								_t68 =  *(_t228 - 0x14) == 0;
								__eflags = _t68;
								 *(_t217 + 0x10) = 0 | _t68;
								L19:
								_t225 =  *(_t228 + 0xc);
								_t194 = CreateFileW(_t225, 0xc0000000, 0, 0, 3, 0x2200000, 0);
								 *(_t228 + 0xc) = _t194;
								if(_t194 == 0xffffffff) {
									goto L25;
								}
								if(DeviceIoControl(_t194, 0x900a4, _t217, ( *(_t217 + 4) & 0x0000ffff) + 8, 0, 0, _t228 - 0x18, 0) != 0) {
									E00A68E1D(_t228 - 0x304c);
									 *(_t228 - 4) = 1;
									E00A68EBF(_t228 - 0x304c);
									_t214 =  *((intOrPtr*)(_t228 + 8));
									 *(_t228 - 0x3048) =  *(_t228 + 0xc);
									asm("sbb ecx, ecx");
									asm("sbb ecx, ecx");
									asm("sbb ecx, ecx");
									E00A69430(_t228 - 0x304c, _t225,  ~( *( *((intOrPtr*)(_t228 + 8)) + 0x628c)) & _t186 + 0x00001030,  ~( *( *((intOrPtr*)(_t228 + 8)) + 0x6290)) & _t186 + 0x00001038,  ~( *(_t214 + 0x6294)) & _t186 + 0x00001040);
									E00A68EBF(_t228 - 0x304c);
									_t148 =  *((intOrPtr*)(_t228 + 8));
									__eflags =  *((char*)(_t148 + 0x519c));
									if( *((char*)(_t148 + 0x519c)) == 0) {
										E00A69AE4(_t225,  *((intOrPtr*)(_t186 + 0x1c)));
									}
									E00A68E53(_t228 - 0x304c);
									_t187 = 1;
									goto L26;
								}
								CloseHandle( *(_t228 + 0xc));
								E00A61F25(0x14, 0, _t225);
								if(GetLastError() == 0x522) {
									_t154 = E00A63C8D(0x16);
								}
								E00A80F99(_t154);
								E00A66ACC(0xa9bbf8, 9);
								_push(_t225);
								if( *((char*)(_t186 + 0x10e1)) == 0) {
									DeleteFileW();
								} else {
									RemoveDirectoryW();
								}
								goto L25;
							}
							__eflags = _t116 - 1;
							if(_t116 != 1) {
								goto L25;
							}
							goto L18;
						}
						_t211 =  *((intOrPtr*)(_t228 - 0x10));
						 *_t217 = 0xa0000003;
						_t226 = _t211 + _t211;
						 *((short*)(_t217 + 0xa)) = _t226;
						 *(_t217 + 4) = 0xc + ( *((intOrPtr*)(_t228 + 0x10)) + _t211) * 2;
						 *((intOrPtr*)(_t217 + 6)) = 0;
						E00A81693(_t217 + 0x10, _t228 - 0x1028);
						_t40 = _t226 + 2; // 0x3
						 *((short*)(_t217 + 0xc)) = _t40;
						 *((short*)(_t217 + 0xe)) =  *((intOrPtr*)(_t228 + 0x10)) +  *((intOrPtr*)(_t228 + 0x10));
						E00A81693(_t217 + ( *((intOrPtr*)(_t228 - 0x10)) + 9) * 2, _t228 - 0x2028);
						goto L19;
					}
				} else {
					if( *(_t228 - 0x14) != 0) {
						L25:
						_t187 = 0;
						L26:
						if(_t217 != 0) {
							L00A816D0(_t217);
						}
						 *[fs:0x0] =  *((intOrPtr*)(_t228 - 0xc));
						return _t187;
					}
					_t227 = _t186 + 0x10f4;
					_t177 = E00A6ADF9(_t186 + 0x10f4);
					_t241 = _t177;
					if(_t177 != 0 || E00A67345(_t241, _t186 + 0x20, _t227) == 0) {
						goto L25;
					} else {
						goto L9;
					}
				}
			}

0x00a66bc9
0x00a66bce
0x00a66bd8
0x00a66be4
0x00a66beb
0x00a66bf5
0x00a66bfa
0x00a66bfa
0x00a66c09
0x00a66c0c
0x00a66c11
0x00a66c14
0x00a66c2b
0x00a66c3e
0x00a66c41
0x00a66c49
0x00a66c55
0x00a66c5a
0x00a66c5f
0x00a66c61
0x00a66c63
0x00a66c66
0x00a66c6a
0x00a66c78
0x00a66c7d
0x00a66c82
0x00a66c86
0x00a66c87
0x00a66c8e
0x00a66c94
0x00a66c94
0x00a66c82
0x00a66c9c
0x00a66ca8
0x00a66cad
0x00a66cb3
0x00a66cc0
0x00a66cf2
0x00a66cf5
0x00a66cf6
0x00a66cf9
0x00a66d05
0x00a66d40
0x00a66d46
0x00a66d48
0x00000000
0x00000000
0x00000000
0x00a66d10
0x00a66d23
0x00a66d2c
0x00000000
0x00000000
0x00a66d33
0x00a66d4e
0x00a66d4e
0x00a66d57
0x00a66db9
0x00a66dbc
0x00a66dc6
0x00a66dc6
0x00a66dce
0x00a66dd4
0x00a66dd7
0x00a66de2
0x00a66de8
0x00a66df6
0x00a66dfb
0x00a66dfe
0x00a66e07
0x00a66e1c
0x00a66e26
0x00a66e29
0x00a66e29
0x00a66e2c
0x00a66e2f
0x00a66e2f
0x00a66e4a
0x00a66e4c
0x00a66e52
0x00000000
0x00000000
0x00a66e74
0x00a66ef4
0x00a66eff
0x00a66f03
0x00a66f08
0x00a66f0e
0x00a66f22
0x00a66f35
0x00a66f48
0x00a66f53
0x00a66f5e
0x00a66f63
0x00a66f66
0x00a66f6d
0x00a66f73
0x00a66f73
0x00a66f7e
0x00a66f85
0x00000000
0x00a66f85
0x00a66e7a
0x00a66e85
0x00a66e95
0x00a66e99
0x00a66e99
0x00a66ea3
0x00a66eaf
0x00a66ebb
0x00a66ebc
0x00a66ee6
0x00a66ebe
0x00a66ebe
0x00a66ebe
0x00000000
0x00a66ebc
0x00a66dbe
0x00a66dc0
0x00000000
0x00000000
0x00000000
0x00a66dc0
0x00a66d59
0x00a66d61
0x00a66d67
0x00a66d6a
0x00a66d75
0x00a66d7b
0x00a66d89
0x00a66d8e
0x00a66d91
0x00a66d9a
0x00a66daf
0x00000000
0x00a66db4
0x00a66cc2
0x00a66cc6
0x00a66ec4
0x00a66ec4
0x00a66ec6
0x00a66ec8
0x00a66ecb
0x00a66ed0
0x00a66ed9
0x00a66ee3
0x00a66ee3
0x00a66ccc
0x00a66cd3
0x00a66cd8
0x00a66cda
0x00000000
0x00000000
0x00000000
0x00000000
0x00a66cda

APIs

__EH_prolog.LIBCMT ref: 00A66BCE
_wcslen.LIBCMT ref: 00A66C37
_wcslen.LIBCMT ref: 00A66CA8
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,00000001), ref: 00A66D23
CloseHandle.KERNEL32(00000000), ref: 00A66D33

Part of subcall function 00A674D7: GetCurrentProcess.KERNEL32(00000020,?), ref: 00A674E6
Part of subcall function 00A674D7: GetLastError.KERNEL32 ref: 00A6752C
Part of subcall function 00A674D7: CloseHandle.KERNEL32(?), ref: 00A6753B

CreateDirectoryW.KERNEL32(?,00000000,?,00000001), ref: 00A66D40
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00A66E44
DeviceIoControl.KERNEL32 ref: 00A66E6C
CloseHandle.KERNEL32(?), ref: 00A66E7A
GetLastError.KERNEL32 ref: 00A66E8A
RemoveDirectoryW.KERNEL32(?), ref: 00A66EBE
DeleteFileW.KERNEL32(?), ref: 00A66EE6

Strings

SeRestorePrivilege, xrefs: 00A66BE6
SeCreateSymbolicLinkPrivilege, xrefs: 00A66BF0
\??\, xrefs: 00A66C4F
@Mqt0Lqt, xrefs: 00A66E8A
UNC\, xrefs: 00A66C72

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: CloseCreateFileHandle$DirectoryErrorLast_wcslen$ControlCurrentDeleteDeviceH_prologProcessRemove
String ID: @Mqt0Lqt$SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 1889552639-759948138
Opcode ID: c311efb48df3fa43dc234582ab0237ebcf07a7e08cdbffb82520baf49e5f0011
Instruction ID: ed7ee219dc4718b1ec4401cfe4f5bea2b7d81d16c91ef33a004956e575032c1d
Opcode Fuzzy Hash: c311efb48df3fa43dc234582ab0237ebcf07a7e08cdbffb82520baf49e5f0011
Instruction Fuzzy Hash: 6FB1D375A00249AFDF11DFA4CD45BEA77B8FF04310F04416AF919D7182EB34AA99CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A89ADE Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 67%

			E00A89ADE(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, signed int _a4, signed int _a8, intOrPtr _a12, intOrPtr* _a16, signed int _a20, intOrPtr _a24) {
				signed int _v8;
				signed int _v32;
				signed int _v36;
				char _v460;
				signed int _v464;
				void _v468;
				signed int _v472;
				signed int _v932;
				signed int _v936;
				signed int _v1392;
				signed int _v1396;
				signed int _v1400;
				char _v1860;
				signed int _v1864;
				signed int _v1865;
				signed int _v1872;
				signed int _v1876;
				signed int _v1880;
				signed int _v1884;
				signed int _v1888;
				signed int _v1892;
				signed int _v1896;
				intOrPtr _v1900;
				signed int _v1904;
				signed int _v1908;
				signed int _v1912;
				signed int _v1916;
				signed int _v1920;
				signed int _v1924;
				signed int _v1928;
				char _v1936;
				char _v1944;
				char _v2404;
				signed int _v2408;
				signed int _t743;
				signed int _t753;
				signed int _t754;
				intOrPtr _t763;
				signed int _t764;
				intOrPtr _t767;
				intOrPtr _t770;
				intOrPtr _t772;
				intOrPtr _t773;
				void* _t774;
				signed int _t778;
				signed int _t779;
				signed int _t785;
				signed int _t791;
				intOrPtr _t793;
				void* _t794;
				signed int _t795;
				signed int _t796;
				signed int _t797;
				signed int _t806;
				signed int _t811;
				signed int _t812;
				signed int _t813;
				signed int _t816;
				signed int _t817;
				signed int _t818;
				signed int _t820;
				signed int _t821;
				signed int _t822;
				signed int _t823;
				signed int _t828;
				signed int _t829;
				signed int _t835;
				signed int _t836;
				signed int _t839;
				signed int _t844;
				signed int _t852;
				signed int* _t855;
				signed int _t859;
				signed int _t870;
				signed int _t871;
				signed int _t873;
				char* _t874;
				signed int _t877;
				signed int _t881;
				signed int _t882;
				signed int _t887;
				signed int _t889;
				signed int _t894;
				signed int _t903;
				signed int _t906;
				signed int _t908;
				signed int _t911;
				signed int _t912;
				signed int _t913;
				signed int _t916;
				signed int _t929;
				signed int _t930;
				signed int _t932;
				char* _t933;
				signed int _t936;
				signed int _t940;
				signed int _t941;
				signed int* _t943;
				signed int _t946;
				signed int _t948;
				signed int _t953;
				signed int _t961;
				signed int _t964;
				signed int _t968;
				signed int* _t975;
				intOrPtr _t977;
				void* _t978;
				intOrPtr* _t980;
				signed int* _t984;
				unsigned int _t995;
				signed int _t996;
				void* _t999;
				signed int _t1000;
				void* _t1002;
				signed int _t1003;
				signed int _t1004;
				signed int _t1005;
				signed int _t1015;
				signed int _t1020;
				signed int _t1023;
				unsigned int _t1026;
				signed int _t1027;
				void* _t1030;
				signed int _t1031;
				void* _t1033;
				signed int _t1034;
				signed int _t1035;
				signed int _t1036;
				signed int _t1041;
				signed int* _t1046;
				signed int _t1048;
				signed int _t1058;
				void _t1061;
				signed int _t1064;
				void* _t1067;
				void* _t1074;
				signed int _t1080;
				signed int _t1081;
				signed int _t1084;
				signed int _t1085;
				signed int _t1087;
				signed int _t1088;
				signed int _t1089;
				signed int _t1093;
				signed int _t1097;
				signed int _t1098;
				signed int _t1099;
				signed int _t1101;
				signed int _t1102;
				signed int _t1103;
				signed int _t1104;
				signed int _t1105;
				signed int _t1106;
				signed int _t1108;
				signed int _t1109;
				signed int _t1110;
				signed int _t1111;
				signed int _t1112;
				signed int _t1113;
				unsigned int _t1114;
				void* _t1117;
				intOrPtr _t1119;
				signed int _t1120;
				signed int _t1121;
				signed int _t1122;
				signed int* _t1126;
				void* _t1130;
				void* _t1131;
				signed int _t1132;
				signed int _t1133;
				signed int _t1134;
				signed int _t1137;
				signed int _t1138;
				signed int _t1143;
				void* _t1145;
				signed int _t1146;
				signed int _t1149;
				char _t1154;
				signed int _t1156;
				signed int _t1157;
				signed int _t1158;
				signed int _t1159;
				signed int _t1160;
				signed int _t1161;
				signed int _t1162;
				signed int _t1166;
				signed int _t1167;
				signed int _t1168;
				signed int _t1169;
				signed int _t1170;
				unsigned int _t1173;
				void* _t1177;
				void* _t1178;
				unsigned int _t1179;
				signed int _t1184;
				signed int _t1185;
				signed int _t1187;
				signed int _t1188;
				intOrPtr* _t1190;
				signed int _t1191;
				signed int _t1193;
				signed int _t1194;
				signed int _t1197;
				signed int _t1199;
				signed int _t1200;
				void* _t1201;
				signed int _t1202;
				signed int _t1203;
				signed int _t1204;
				void* _t1207;
				signed int _t1208;
				signed int _t1209;
				signed int _t1210;
				signed int _t1211;
				signed int _t1212;
				signed int* _t1215;
				signed int _t1216;
				signed int _t1217;
				signed int _t1218;
				signed int _t1219;
				intOrPtr* _t1221;
				intOrPtr* _t1222;
				signed int _t1224;
				signed int _t1226;
				signed int _t1229;
				signed int _t1235;
				signed int _t1239;
				signed int _t1240;
				signed int _t1245;
				signed int _t1248;
				signed int _t1249;
				signed int _t1250;
				signed int _t1251;
				signed int _t1252;
				signed int _t1253;
				signed int _t1255;
				signed int _t1256;
				signed int _t1257;
				signed int _t1258;
				signed int _t1260;
				signed int _t1261;
				signed int _t1262;
				signed int _t1263;
				signed int _t1264;
				signed int _t1266;
				signed int _t1267;
				signed int _t1269;
				signed int _t1271;
				signed int _t1273;
				signed int _t1276;
				signed int _t1278;
				signed int* _t1279;
				signed int* _t1282;
				signed int _t1291;

				_t1145 = __edx;
				_t1276 = _t1278;
				_t1279 = _t1278 - 0x964;
				_t743 =  *0xa991b8; // 0x3197ea2d
				_v8 = _t743 ^ _t1276;
				_t1058 = _a20;
				_push(__esi);
				_push(__edi);
				_t1190 = _a16;
				_v1924 = _t1190;
				_v1920 = _t1058;
				E00A89606( &_v1944, __eflags);
				_t1239 = _a8;
				_t748 = 0x2d;
				if((_t1239 & 0x80000000) == 0) {
					_t748 = 0x120;
				}
				 *_t1190 = _t748;
				 *((intOrPtr*)(_t1190 + 8)) = _t1058;
				_t1191 = _a4;
				if((_t1239 & 0x7ff00000) != 0) {
					L5:
					_t753 = E00A85CB1( &_a4);
					_pop(_t1073);
					__eflags = _t753;
					if(_t753 != 0) {
						_t1073 = _v1924;
						 *((intOrPtr*)(_v1924 + 4)) = 1;
					}
					_t754 = _t753 - 1;
					__eflags = _t754;
					if(_t754 == 0) {
						_push("1#INF");
						goto L308;
					} else {
						_t778 = _t754 - 1;
						__eflags = _t778;
						if(_t778 == 0) {
							_push("1#QNAN");
							goto L308;
						} else {
							_t779 = _t778 - 1;
							__eflags = _t779;
							if(_t779 == 0) {
								_push("1#SNAN");
								goto L308;
							} else {
								__eflags = _t779 == 1;
								if(_t779 == 1) {
									_push("1#IND");
									goto L308;
								} else {
									_v1928 = _v1928 & 0x00000000;
									_a4 = _t1191;
									_a8 = _t1239 & 0x7fffffff;
									_t1291 = _a4;
									asm("fst qword [ebp-0x768]");
									_t1193 = _v1896;
									_v1916 = _a12 + 1;
									_t1080 = _t1193 >> 0x14;
									_t785 = _t1080 & 0x000007ff;
									__eflags = _t785;
									if(_t785 != 0) {
										_t1146 = 0;
										_t785 = 0;
										__eflags = 0;
									} else {
										_t1146 = 1;
									}
									_t1194 = _t1193 & 0x000fffff;
									_t1061 = _v1900 + _t785;
									asm("adc edi, esi");
									__eflags = _t1146;
									_t1081 = _t1080 & 0x000007ff;
									_t1245 = _t1081 - 0x434 + (0 | _t1146 != 0x00000000) + 1;
									_v1872 = _t1245;
									E00A8BAC0(_t1081, _t1291);
									_push(_t1081);
									_push(_t1081);
									 *_t1279 = _t1291;
									_t791 = E00A8E930(E00A8BBD0(_t1194, _t1245), _t1291);
									_v1904 = _t791;
									__eflags = _t791 - 0x7fffffff;
									if(_t791 == 0x7fffffff) {
										L16:
										__eflags = 0;
										_v1904 = 0;
									} else {
										__eflags = _t791 - 0x80000000;
										if(_t791 == 0x80000000) {
											goto L16;
										}
									}
									_v468 = _t1061;
									__eflags = _t1194;
									_v464 = _t1194;
									_t1064 = (0 | _t1194 != 0x00000000) + 1;
									_v472 = _t1064;
									__eflags = _t1245;
									if(_t1245 < 0) {
										__eflags = _t1245 - 0xfffffc02;
										if(_t1245 == 0xfffffc02) {
											L101:
											_t793 =  *((intOrPtr*)(_t1276 + _t1064 * 4 - 0x1d4));
											_t195 =  &_v1896;
											 *_t195 = _v1896 & 0x00000000;
											__eflags =  *_t195;
											asm("bsr eax, eax");
											if( *_t195 == 0) {
												_t1084 = 0;
												__eflags = 0;
											} else {
												_t1084 = _t793 + 1;
											}
											_t794 = 0x20;
											_t795 = _t794 - _t1084;
											__eflags = _t795 - 1;
											_t796 = _t795 & 0xffffff00 | _t795 - 0x00000001 > 0x00000000;
											__eflags = _t1064 - 0x73;
											_v1865 = _t796;
											_t1085 = _t1084 & 0xffffff00 | _t1064 - 0x00000073 > 0x00000000;
											__eflags = _t1064 - 0x73;
											if(_t1064 != 0x73) {
												L107:
												_t797 = 0;
												__eflags = 0;
											} else {
												__eflags = _t796;
												if(_t796 == 0) {
													goto L107;
												} else {
													_t797 = 1;
												}
											}
											__eflags = _t1085;
											if(_t1085 != 0) {
												L126:
												_v1400 = _v1400 & 0x00000000;
												_t224 =  &_v472;
												 *_t224 = _v472 & 0x00000000;
												__eflags =  *_t224;
												E00A87FF2( &_v468, 0x1cc,  &_v1396, 0);
												_t1279 =  &(_t1279[4]);
											} else {
												__eflags = _t797;
												if(_t797 != 0) {
													goto L126;
												} else {
													_t1112 = 0x72;
													__eflags = _t1064 - _t1112;
													if(_t1064 < _t1112) {
														_t1112 = _t1064;
													}
													__eflags = _t1112 - 0xffffffff;
													if(_t1112 != 0xffffffff) {
														_t1263 = _t1112;
														_t1221 =  &_v468 + _t1112 * 4;
														_v1880 = _t1221;
														while(1) {
															__eflags = _t1263 - _t1064;
															if(_t1263 >= _t1064) {
																_t208 =  &_v1876;
																 *_t208 = _v1876 & 0x00000000;
																__eflags =  *_t208;
															} else {
																_v1876 =  *_t1221;
															}
															_t210 = _t1263 - 1; // 0x70
															__eflags = _t210 - _t1064;
															if(_t210 >= _t1064) {
																_t1173 = 0;
																__eflags = 0;
															} else {
																_t1173 =  *(_t1221 - 4);
															}
															_t1221 = _t1221 - 4;
															_t975 = _v1880;
															_t1263 = _t1263 - 1;
															 *_t975 = _t1173 >> 0x0000001f ^ _v1876 + _v1876;
															_v1880 = _t975 - 4;
															__eflags = _t1263 - 0xffffffff;
															if(_t1263 == 0xffffffff) {
																break;
															}
															_t1064 = _v472;
														}
														_t1245 = _v1872;
													}
													__eflags = _v1865;
													if(_v1865 == 0) {
														_v472 = _t1112;
													} else {
														_t218 = _t1112 + 1; // 0x73
														_v472 = _t218;
													}
												}
											}
											_t1197 = 1 - _t1245;
											E00A7D1E0(_t1197,  &_v1396, 0, 1);
											__eflags = 1;
											 *(_t1276 + 0xbad63d) = 1 << (_t1197 & 0x0000001f);
											_t806 = 0xbadbae;
										} else {
											_v1396 = _v1396 & 0x00000000;
											_t1113 = 2;
											_v1392 = 0x100000;
											_v1400 = _t1113;
											__eflags = _t1064 - _t1113;
											if(_t1064 == _t1113) {
												_t1177 = 0;
												__eflags = 0;
												while(1) {
													_t977 =  *((intOrPtr*)(_t1276 + _t1177 - 0x570));
													__eflags = _t977 -  *((intOrPtr*)(_t1276 + _t1177 - 0x1d0));
													if(_t977 !=  *((intOrPtr*)(_t1276 + _t1177 - 0x1d0))) {
														goto L101;
													}
													_t1177 = _t1177 + 4;
													__eflags = _t1177 - 8;
													if(_t1177 != 8) {
														continue;
													} else {
														_t166 =  &_v1896;
														 *_t166 = _v1896 & 0x00000000;
														__eflags =  *_t166;
														asm("bsr eax, edi");
														if( *_t166 == 0) {
															_t1178 = 0;
															__eflags = 0;
														} else {
															_t1178 = _t977 + 1;
														}
														_t978 = 0x20;
														_t1264 = _t1113;
														__eflags = _t978 - _t1178 - _t1113;
														_t980 =  &_v460;
														_v1880 = _t980;
														_t1222 = _t980;
														_t171 =  &_v1865;
														 *_t171 = _t978 - _t1178 - _t1113 > 0;
														__eflags =  *_t171;
														while(1) {
															__eflags = _t1264 - _t1064;
															if(_t1264 >= _t1064) {
																_t173 =  &_v1876;
																 *_t173 = _v1876 & 0x00000000;
																__eflags =  *_t173;
															} else {
																_v1876 =  *_t1222;
															}
															_t175 = _t1264 - 1; // 0x0
															__eflags = _t175 - _t1064;
															if(_t175 >= _t1064) {
																_t1179 = 0;
																__eflags = 0;
															} else {
																_t1179 =  *(_t1222 - 4);
															}
															_t1222 = _t1222 - 4;
															_t984 = _v1880;
															_t1264 = _t1264 - 1;
															 *_t984 = _t1179 >> 0x0000001e ^ _v1876 << 0x00000002;
															_v1880 = _t984 - 4;
															__eflags = _t1264 - 0xffffffff;
															if(_t1264 == 0xffffffff) {
																break;
															}
															_t1064 = _v472;
														}
														__eflags = _v1865;
														_t1114 = _t1113 - _v1872;
														_v472 = (0 | _v1865 != 0x00000000) + _t1113;
														_t1224 = _t1114 >> 5;
														_v1884 = _t1114;
														_t1266 = _t1224 << 2;
														E00A7D1E0(_t1224,  &_v1396, 0, _t1266);
														 *(_t1276 + _t1266 - 0x570) = 1 << (_v1884 & 0x0000001f);
														_t806 = _t1224 + 1;
													}
													goto L128;
												}
											}
											goto L101;
										}
										L128:
										_v1400 = _t806;
										_t1067 = 0x1cc;
										_v936 = _t806;
										__eflags = _t806 << 2;
										E00A87FF2( &_v932, 0x1cc,  &_v1396, _t806 << 2);
										_t1282 =  &(_t1279[7]);
									} else {
										_v1396 = _v1396 & 0x00000000;
										_t1267 = 2;
										_v1392 = 0x100000;
										_v1400 = _t1267;
										__eflags = _t1064 - _t1267;
										if(_t1064 != _t1267) {
											L53:
											_t995 = _v1872 + 1;
											_t996 = _t995 & 0x0000001f;
											_t1117 = 0x20;
											_v1876 = _t996;
											_t1226 = _t995 >> 5;
											_v1872 = _t1226;
											_v1908 = _t1117 - _t996;
											_t999 = E00A7C6A0(1, _t1117 - _t996, 0);
											_t1119 =  *((intOrPtr*)(_t1276 + _t1064 * 4 - 0x1d4));
											_t1000 = _t999 - 1;
											_t108 =  &_v1896;
											 *_t108 = _v1896 & 0x00000000;
											__eflags =  *_t108;
											asm("bsr ecx, ecx");
											_v1884 = _t1000;
											_v1912 =  !_t1000;
											if( *_t108 == 0) {
												_t1120 = 0;
												__eflags = 0;
											} else {
												_t1120 = _t1119 + 1;
											}
											_t1002 = 0x20;
											_t1003 = _t1002 - _t1120;
											_t1184 = _t1064 + _t1226;
											__eflags = _v1876 - _t1003;
											_v1892 = _t1184;
											_t1004 = _t1003 & 0xffffff00 | _v1876 - _t1003 > 0x00000000;
											__eflags = _t1184 - 0x73;
											_v1865 = _t1004;
											_t1121 = _t1120 & 0xffffff00 | _t1184 - 0x00000073 > 0x00000000;
											__eflags = _t1184 - 0x73;
											if(_t1184 != 0x73) {
												L59:
												_t1005 = 0;
												__eflags = 0;
											} else {
												__eflags = _t1004;
												if(_t1004 == 0) {
													goto L59;
												} else {
													_t1005 = 1;
												}
											}
											__eflags = _t1121;
											if(_t1121 != 0) {
												L81:
												__eflags = 0;
												_t1067 = 0x1cc;
												_v1400 = 0;
												_v472 = 0;
												E00A87FF2( &_v468, 0x1cc,  &_v1396, 0);
												_t1279 =  &(_t1279[4]);
											} else {
												__eflags = _t1005;
												if(_t1005 != 0) {
													goto L81;
												} else {
													_t1122 = 0x72;
													__eflags = _t1184 - _t1122;
													if(_t1184 >= _t1122) {
														_t1184 = _t1122;
														_v1892 = _t1122;
													}
													_t1015 = _t1184;
													_v1880 = _t1015;
													__eflags = _t1184 - 0xffffffff;
													if(_t1184 != 0xffffffff) {
														_t1185 = _v1872;
														_t1269 = _t1184 - _t1185;
														__eflags = _t1269;
														_t1126 =  &_v468 + _t1269 * 4;
														_v1888 = _t1126;
														while(1) {
															__eflags = _t1015 - _t1185;
															if(_t1015 < _t1185) {
																break;
															}
															__eflags = _t1269 - _t1064;
															if(_t1269 >= _t1064) {
																_t1229 = 0;
																__eflags = 0;
															} else {
																_t1229 =  *_t1126;
															}
															__eflags = _t1269 - 1 - _t1064;
															if(_t1269 - 1 >= _t1064) {
																_t1020 = 0;
																__eflags = 0;
															} else {
																_t1020 =  *(_t1126 - 4);
															}
															_t1023 = _v1880;
															_t1126 = _v1888 - 4;
															_v1888 = _t1126;
															 *(_t1276 + _t1023 * 4 - 0x1d0) = (_t1229 & _v1884) << _v1876 | (_t1020 & _v1912) >> _v1908;
															_t1015 = _t1023 - 1;
															_t1269 = _t1269 - 1;
															_v1880 = _t1015;
															__eflags = _t1015 - 0xffffffff;
															if(_t1015 != 0xffffffff) {
																_t1064 = _v472;
																continue;
															}
															break;
														}
														_t1184 = _v1892;
														_t1226 = _v1872;
														_t1267 = 2;
													}
													__eflags = _t1226;
													if(_t1226 != 0) {
														__eflags = 0;
														memset( &_v468, 0, _t1226 << 2);
														_t1279 =  &(_t1279[3]);
													}
													__eflags = _v1865;
													_t1067 = 0x1cc;
													if(_v1865 == 0) {
														_v472 = _t1184;
													} else {
														_v472 = _t1184 + 1;
													}
												}
											}
											_v1392 = _v1392 & 0x00000000;
											_v1396 = _t1267;
											_v1400 = 1;
											_v936 = 1;
											_push(4);
										} else {
											_t1130 = 0;
											__eflags = 0;
											while(1) {
												__eflags =  *((intOrPtr*)(_t1276 + _t1130 - 0x570)) -  *((intOrPtr*)(_t1276 + _t1130 - 0x1d0));
												if( *((intOrPtr*)(_t1276 + _t1130 - 0x570)) !=  *((intOrPtr*)(_t1276 + _t1130 - 0x1d0))) {
													goto L53;
												}
												_t1130 = _t1130 + 4;
												__eflags = _t1130 - 8;
												if(_t1130 != 8) {
													continue;
												} else {
													_t1026 = _v1872 + 2;
													_t1027 = _t1026 & 0x0000001f;
													_t1131 = 0x20;
													_t1132 = _t1131 - _t1027;
													_v1888 = _t1027;
													_t1271 = _t1026 >> 5;
													_v1876 = _t1271;
													_v1908 = _t1132;
													_t1030 = E00A7C6A0(1, _t1132, 0);
													_v1896 = _v1896 & 0x00000000;
													_t1031 = _t1030 - 1;
													__eflags = _t1031;
													asm("bsr ecx, edi");
													_v1884 = _t1031;
													_v1912 =  !_t1031;
													if(_t1031 == 0) {
														_t1133 = 0;
														__eflags = 0;
													} else {
														_t1133 = _t1132 + 1;
													}
													_t1033 = 0x20;
													_t1034 = _t1033 - _t1133;
													_t1187 = _t1271 + 2;
													__eflags = _v1888 - _t1034;
													_v1880 = _t1187;
													_t1035 = _t1034 & 0xffffff00 | _v1888 - _t1034 > 0x00000000;
													__eflags = _t1187 - 0x73;
													_v1865 = _t1035;
													_t1134 = _t1133 & 0xffffff00 | _t1187 - 0x00000073 > 0x00000000;
													__eflags = _t1187 - 0x73;
													if(_t1187 != 0x73) {
														L28:
														_t1036 = 0;
														__eflags = 0;
													} else {
														__eflags = _t1035;
														if(_t1035 == 0) {
															goto L28;
														} else {
															_t1036 = 1;
														}
													}
													__eflags = _t1134;
													if(_t1134 != 0) {
														L50:
														__eflags = 0;
														_t1067 = 0x1cc;
														_v1400 = 0;
														_v472 = 0;
														E00A87FF2( &_v468, 0x1cc,  &_v1396, 0);
														_t1279 =  &(_t1279[4]);
													} else {
														__eflags = _t1036;
														if(_t1036 != 0) {
															goto L50;
														} else {
															_t1137 = 0x72;
															__eflags = _t1187 - _t1137;
															if(_t1187 >= _t1137) {
																_t1187 = _t1137;
																_v1880 = _t1137;
															}
															_t1138 = _t1187;
															_v1892 = _t1138;
															__eflags = _t1187 - 0xffffffff;
															if(_t1187 != 0xffffffff) {
																_t1188 = _v1876;
																_t1273 = _t1187 - _t1188;
																__eflags = _t1273;
																_t1046 =  &_v468 + _t1273 * 4;
																_v1872 = _t1046;
																while(1) {
																	__eflags = _t1138 - _t1188;
																	if(_t1138 < _t1188) {
																		break;
																	}
																	__eflags = _t1273 - _t1064;
																	if(_t1273 >= _t1064) {
																		_t1235 = 0;
																		__eflags = 0;
																	} else {
																		_t1235 =  *_t1046;
																	}
																	__eflags = _t1273 - 1 - _t1064;
																	if(_t1273 - 1 >= _t1064) {
																		_t1048 = 0;
																		__eflags = 0;
																	} else {
																		_t1048 =  *(_v1872 - 4);
																	}
																	_t1143 = _v1892;
																	 *(_t1276 + _t1143 * 4 - 0x1d0) = (_t1048 & _v1912) >> _v1908 | (_t1235 & _v1884) << _v1888;
																	_t1138 = _t1143 - 1;
																	_t1273 = _t1273 - 1;
																	_t1046 = _v1872 - 4;
																	_v1892 = _t1138;
																	_v1872 = _t1046;
																	__eflags = _t1138 - 0xffffffff;
																	if(_t1138 != 0xffffffff) {
																		_t1064 = _v472;
																		continue;
																	}
																	break;
																}
																_t1187 = _v1880;
																_t1271 = _v1876;
															}
															__eflags = _t1271;
															if(_t1271 != 0) {
																__eflags = 0;
																memset( &_v468, 0, _t1271 << 2);
																_t1279 =  &(_t1279[3]);
															}
															__eflags = _v1865;
															_t1067 = 0x1cc;
															if(_v1865 == 0) {
																_v472 = _t1187;
															} else {
																_v472 = _t1187 + 1;
															}
														}
													}
													_v1392 = _v1392 & 0x00000000;
													_t1041 = 4;
													__eflags = 1;
													_v1396 = _t1041;
													_v1400 = 1;
													_v936 = 1;
													_push(_t1041);
												}
												goto L52;
											}
											goto L53;
										}
										L52:
										_push( &_v1396);
										_push(_t1067);
										_push( &_v932);
										E00A87FF2();
										_t1282 =  &(_t1279[4]);
									}
									_t811 = _v1904;
									_t1087 = 0xa;
									_v1912 = _t1087;
									__eflags = _t811;
									if(_t811 < 0) {
										_t812 =  ~_t811;
										_t813 = _t812 / _t1087;
										_v1880 = _t813;
										_t1088 = _t812 % _t1087;
										_v1884 = _t1088;
										__eflags = _t813;
										if(_t813 == 0) {
											L249:
											__eflags = _t1088;
											if(_t1088 != 0) {
												_t852 =  *(0xa9318c + _t1088 * 4);
												_v1896 = _t852;
												__eflags = _t852;
												if(_t852 == 0) {
													L260:
													__eflags = 0;
													_push(0);
													_v472 = 0;
													_v2408 = 0;
													goto L261;
												} else {
													__eflags = _t852 - 1;
													if(_t852 != 1) {
														_t1099 = _v472;
														__eflags = _t1099;
														if(_t1099 != 0) {
															_t1204 = 0;
															_t1253 = 0;
															__eflags = 0;
															do {
																_t1158 = _t852 *  *(_t1276 + _t1253 * 4 - 0x1d0) >> 0x20;
																 *(_t1276 + _t1253 * 4 - 0x1d0) = _t852 *  *(_t1276 + _t1253 * 4 - 0x1d0) + _t1204;
																_t852 = _v1896;
																asm("adc edx, 0x0");
																_t1253 = _t1253 + 1;
																_t1204 = _t1158;
																__eflags = _t1253 - _t1099;
															} while (_t1253 != _t1099);
															__eflags = _t1204;
															if(_t1204 != 0) {
																_t859 = _v472;
																__eflags = _t859 - 0x73;
																if(_t859 >= 0x73) {
																	goto L260;
																} else {
																	 *(_t1276 + _t859 * 4 - 0x1d0) = _t1204;
																	_v472 = _v472 + 1;
																}
															}
														}
													}
												}
											}
										} else {
											do {
												__eflags = _t813 - 0x26;
												if(_t813 > 0x26) {
													_t813 = 0x26;
												}
												_t1100 =  *(0xa930f6 + _t813 * 4) & 0x000000ff;
												_v1872 = _t813;
												_v1400 = ( *(0xa930f6 + _t813 * 4) & 0x000000ff) + ( *(0xa930f7 + _t813 * 4) & 0x000000ff);
												E00A7D1E0(_t1100 << 2,  &_v1396, 0, _t1100 << 2);
												_t870 = E00A7EE90( &(( &_v1396)[_t1100]), 0xa927f0 + ( *(0xa930f4 + _v1872 * 4) & 0x0000ffff) * 4, ( *(0xa930f7 + _t813 * 4) & 0x000000ff) << 2);
												_t1101 = _v1400;
												_t1282 =  &(_t1282[6]);
												_v1892 = _t1101;
												__eflags = _t1101 - 1;
												if(_t1101 > 1) {
													__eflags = _v472 - 1;
													if(_v472 > 1) {
														__eflags = _t1101 - _v472;
														_t1207 =  &_v1396;
														_t871 = _t870 & 0xffffff00 | _t1101 - _v472 > 0x00000000;
														__eflags = _t871;
														if(_t871 != 0) {
															_t1159 =  &_v468;
														} else {
															_t1207 =  &_v468;
															_t1159 =  &_v1396;
														}
														_v1908 = _t1159;
														__eflags = _t871;
														if(_t871 == 0) {
															_t1101 = _v472;
														}
														_v1876 = _t1101;
														__eflags = _t871;
														if(_t871 != 0) {
															_v1892 = _v472;
														}
														_t1160 = 0;
														_t1255 = 0;
														_v1864 = 0;
														__eflags = _t1101;
														if(_t1101 == 0) {
															L243:
															_v472 = _t1160;
															_t873 = _t1160 << 2;
															__eflags = _t873;
															_push(_t873);
															_t874 =  &_v1860;
															goto L244;
														} else {
															_t1208 = _t1207 -  &_v1860;
															__eflags = _t1208;
															_v1928 = _t1208;
															do {
																_t881 =  *(_t1276 + _t1208 + _t1255 * 4 - 0x740);
																_v1896 = _t881;
																__eflags = _t881;
																if(_t881 != 0) {
																	_t882 = 0;
																	_t1209 = 0;
																	_t1102 = _t1255;
																	_v1888 = 0;
																	__eflags = _v1892;
																	if(_v1892 == 0) {
																		L240:
																		__eflags = _t1102 - 0x73;
																		if(_t1102 == 0x73) {
																			goto L258;
																		} else {
																			_t1208 = _v1928;
																			_t1101 = _v1876;
																			goto L242;
																		}
																	} else {
																		while(1) {
																			__eflags = _t1102 - 0x73;
																			if(_t1102 == 0x73) {
																				goto L235;
																			}
																			__eflags = _t1102 - _t1160;
																			if(_t1102 == _t1160) {
																				 *(_t1276 + _t1102 * 4 - 0x740) =  *(_t1276 + _t1102 * 4 - 0x740) & 0x00000000;
																				_t894 = _t882 + 1 + _t1255;
																				__eflags = _t894;
																				_v1864 = _t894;
																				_t882 = _v1888;
																			}
																			_t889 =  *(_v1908 + _t882 * 4);
																			asm("adc edx, 0x0");
																			 *(_t1276 + _t1102 * 4 - 0x740) =  *(_t1276 + _t1102 * 4 - 0x740) + _t889 * _v1896 + _t1209;
																			asm("adc edx, 0x0");
																			_t882 = _v1888 + 1;
																			_t1102 = _t1102 + 1;
																			_v1888 = _t882;
																			_t1209 = _t889 * _v1896 >> 0x20;
																			_t1160 = _v1864;
																			__eflags = _t882 - _v1892;
																			if(_t882 != _v1892) {
																				continue;
																			} else {
																				goto L235;
																			}
																			while(1) {
																				L235:
																				__eflags = _t1209;
																				if(_t1209 == 0) {
																					goto L240;
																				}
																				__eflags = _t1102 - 0x73;
																				if(_t1102 == 0x73) {
																					goto L258;
																				} else {
																					__eflags = _t1102 - _t1160;
																					if(_t1102 == _t1160) {
																						_t558 = _t1276 + _t1102 * 4 - 0x740;
																						 *_t558 =  *(_t1276 + _t1102 * 4 - 0x740) & 0x00000000;
																						__eflags =  *_t558;
																						_t564 = _t1102 + 1; // 0x1
																						_v1864 = _t564;
																					}
																					_t887 = _t1209;
																					_t1209 = 0;
																					 *(_t1276 + _t1102 * 4 - 0x740) =  *(_t1276 + _t1102 * 4 - 0x740) + _t887;
																					_t1160 = _v1864;
																					asm("adc edi, edi");
																					_t1102 = _t1102 + 1;
																					continue;
																				}
																				goto L246;
																			}
																			goto L240;
																		}
																		goto L235;
																	}
																} else {
																	__eflags = _t1255 - _t1160;
																	if(_t1255 == _t1160) {
																		 *(_t1276 + _t1255 * 4 - 0x740) =  *(_t1276 + _t1255 * 4 - 0x740) & _t881;
																		_t526 = _t1255 + 1; // 0x1
																		_t1160 = _t526;
																		_v1864 = _t1160;
																	}
																	goto L242;
																}
																goto L246;
																L242:
																_t1255 = _t1255 + 1;
																__eflags = _t1255 - _t1101;
															} while (_t1255 != _t1101);
															goto L243;
														}
													} else {
														_t1210 = _v468;
														_v472 = _t1101;
														E00A87FF2( &_v468, _t1067,  &_v1396, _t1101 << 2);
														_t1282 =  &(_t1282[4]);
														__eflags = _t1210;
														if(_t1210 == 0) {
															goto L203;
														} else {
															__eflags = _t1210 - 1;
															if(_t1210 == 1) {
																goto L245;
															} else {
																__eflags = _v472;
																if(_v472 == 0) {
																	goto L245;
																} else {
																	_t1103 = 0;
																	_v1896 = _v472;
																	_t1256 = 0;
																	__eflags = 0;
																	do {
																		_t903 = _t1210;
																		_t1161 = _t903 *  *(_t1276 + _t1256 * 4 - 0x1d0) >> 0x20;
																		 *(_t1276 + _t1256 * 4 - 0x1d0) = _t903 *  *(_t1276 + _t1256 * 4 - 0x1d0) + _t1103;
																		asm("adc edx, 0x0");
																		_t1256 = _t1256 + 1;
																		_t1103 = _t1161;
																		__eflags = _t1256 - _v1896;
																	} while (_t1256 != _v1896);
																	goto L208;
																}
															}
														}
													}
												} else {
													_t1211 = _v1396;
													__eflags = _t1211;
													if(_t1211 != 0) {
														__eflags = _t1211 - 1;
														if(_t1211 == 1) {
															goto L245;
														} else {
															__eflags = _v472;
															if(_v472 == 0) {
																goto L245;
															} else {
																_t1104 = 0;
																_v1896 = _v472;
																_t1257 = 0;
																__eflags = 0;
																do {
																	_t908 = _t1211;
																	_t1162 = _t908 *  *(_t1276 + _t1257 * 4 - 0x1d0) >> 0x20;
																	 *(_t1276 + _t1257 * 4 - 0x1d0) = _t908 *  *(_t1276 + _t1257 * 4 - 0x1d0) + _t1104;
																	asm("adc edx, 0x0");
																	_t1257 = _t1257 + 1;
																	_t1104 = _t1162;
																	__eflags = _t1257 - _v1896;
																} while (_t1257 != _v1896);
																L208:
																__eflags = _t1103;
																if(_t1103 == 0) {
																	goto L245;
																} else {
																	_t906 = _v472;
																	__eflags = _t906 - 0x73;
																	if(_t906 >= 0x73) {
																		L258:
																		_v2408 = 0;
																		_v472 = 0;
																		E00A87FF2( &_v468, _t1067,  &_v2404, 0);
																		_t1282 =  &(_t1282[4]);
																		_t877 = 0;
																	} else {
																		 *(_t1276 + _t906 * 4 - 0x1d0) = _t1103;
																		_v472 = _v472 + 1;
																		goto L245;
																	}
																}
															}
														}
													} else {
														L203:
														_v2408 = 0;
														_v472 = 0;
														_push(0);
														_t874 =  &_v2404;
														L244:
														_push(_t874);
														_push(_t1067);
														_push( &_v468);
														E00A87FF2();
														_t1282 =  &(_t1282[4]);
														L245:
														_t877 = 1;
													}
												}
												L246:
												__eflags = _t877;
												if(_t877 == 0) {
													_v2408 = _v2408 & 0x00000000;
													_v472 = _v472 & 0x00000000;
													_push(0);
													L261:
													_push( &_v2404);
													_t855 =  &_v468;
													goto L262;
												} else {
													goto L247;
												}
												goto L263;
												L247:
												_t813 = _v1880 - _v1872;
												__eflags = _t813;
												_v1880 = _t813;
											} while (_t813 != 0);
											_t1088 = _v1884;
											goto L249;
										}
									} else {
										_t911 = _t811 / _t1087;
										_v1908 = _t911;
										_t1105 = _t811 % _t1087;
										_v1896 = _t1105;
										__eflags = _t911;
										if(_t911 == 0) {
											L184:
											__eflags = _t1105;
											if(_t1105 != 0) {
												_t1212 =  *(0xa9318c + _t1105 * 4);
												__eflags = _t1212;
												if(_t1212 != 0) {
													__eflags = _t1212 - 1;
													if(_t1212 != 1) {
														_t912 = _v936;
														_v1896 = _t912;
														__eflags = _t912;
														if(_t912 != 0) {
															_t1258 = 0;
															_t1106 = 0;
															__eflags = 0;
															do {
																_t913 = _t1212;
																_t1166 = _t913 *  *(_t1276 + _t1106 * 4 - 0x3a0) >> 0x20;
																 *(_t1276 + _t1106 * 4 - 0x3a0) = _t913 *  *(_t1276 + _t1106 * 4 - 0x3a0) + _t1258;
																asm("adc edx, 0x0");
																_t1106 = _t1106 + 1;
																_t1258 = _t1166;
																__eflags = _t1106 - _v1896;
															} while (_t1106 != _v1896);
															__eflags = _t1258;
															if(_t1258 != 0) {
																_t916 = _v936;
																__eflags = _t916 - 0x73;
																if(_t916 >= 0x73) {
																	goto L186;
																} else {
																	 *(_t1276 + _t916 * 4 - 0x3a0) = _t1258;
																	_v936 = _v936 + 1;
																}
															}
														}
													}
												} else {
													L186:
													_v2408 = 0;
													_v936 = 0;
													_push(0);
													goto L190;
												}
											}
										} else {
											do {
												__eflags = _t911 - 0x26;
												if(_t911 > 0x26) {
													_t911 = 0x26;
												}
												_t1107 =  *(0xa930f6 + _t911 * 4) & 0x000000ff;
												_v1888 = _t911;
												_v1400 = ( *(0xa930f6 + _t911 * 4) & 0x000000ff) + ( *(0xa930f7 + _t911 * 4) & 0x000000ff);
												E00A7D1E0(_t1107 << 2,  &_v1396, 0, _t1107 << 2);
												_t929 = E00A7EE90( &(( &_v1396)[_t1107]), 0xa927f0 + ( *(0xa930f4 + _v1888 * 4) & 0x0000ffff) * 4, ( *(0xa930f7 + _t911 * 4) & 0x000000ff) << 2);
												_t1108 = _v1400;
												_t1282 =  &(_t1282[6]);
												_v1892 = _t1108;
												__eflags = _t1108 - 1;
												if(_t1108 > 1) {
													__eflags = _v936 - 1;
													if(_v936 > 1) {
														__eflags = _t1108 - _v936;
														_t1215 =  &_v1396;
														_t930 = _t929 & 0xffffff00 | _t1108 - _v936 > 0x00000000;
														__eflags = _t930;
														if(_t930 != 0) {
															_t1167 =  &_v932;
														} else {
															_t1215 =  &_v932;
															_t1167 =  &_v1396;
														}
														_v1876 = _t1167;
														__eflags = _t930;
														if(_t930 == 0) {
															_t1108 = _v936;
														}
														_v1880 = _t1108;
														__eflags = _t930;
														if(_t930 != 0) {
															_v1892 = _v936;
														}
														_t1168 = 0;
														_t1260 = 0;
														_v1864 = 0;
														__eflags = _t1108;
														if(_t1108 == 0) {
															L177:
															_v936 = _t1168;
															_t932 = _t1168 << 2;
															__eflags = _t932;
															goto L178;
														} else {
															_t1216 = _t1215 -  &_v1860;
															__eflags = _t1216;
															_v1928 = _t1216;
															do {
																_t940 =  *(_t1276 + _t1216 + _t1260 * 4 - 0x740);
																_v1884 = _t940;
																__eflags = _t940;
																if(_t940 != 0) {
																	_t941 = 0;
																	_t1217 = 0;
																	_t1109 = _t1260;
																	_v1872 = 0;
																	__eflags = _v1892;
																	if(_v1892 == 0) {
																		L174:
																		__eflags = _t1109 - 0x73;
																		if(_t1109 == 0x73) {
																			goto L187;
																		} else {
																			_t1216 = _v1928;
																			_t1108 = _v1880;
																			goto L176;
																		}
																	} else {
																		while(1) {
																			__eflags = _t1109 - 0x73;
																			if(_t1109 == 0x73) {
																				goto L169;
																			}
																			__eflags = _t1109 - _t1168;
																			if(_t1109 == _t1168) {
																				 *(_t1276 + _t1109 * 4 - 0x740) =  *(_t1276 + _t1109 * 4 - 0x740) & 0x00000000;
																				_t953 = _t941 + 1 + _t1260;
																				__eflags = _t953;
																				_v1864 = _t953;
																				_t941 = _v1872;
																			}
																			_t948 =  *(_v1876 + _t941 * 4);
																			asm("adc edx, 0x0");
																			 *(_t1276 + _t1109 * 4 - 0x740) =  *(_t1276 + _t1109 * 4 - 0x740) + _t948 * _v1884 + _t1217;
																			asm("adc edx, 0x0");
																			_t941 = _v1872 + 1;
																			_t1109 = _t1109 + 1;
																			_v1872 = _t941;
																			_t1217 = _t948 * _v1884 >> 0x20;
																			_t1168 = _v1864;
																			__eflags = _t941 - _v1892;
																			if(_t941 != _v1892) {
																				continue;
																			} else {
																				goto L169;
																			}
																			while(1) {
																				L169:
																				__eflags = _t1217;
																				if(_t1217 == 0) {
																					goto L174;
																				}
																				__eflags = _t1109 - 0x73;
																				if(_t1109 == 0x73) {
																					L187:
																					__eflags = 0;
																					_v2408 = 0;
																					_v936 = 0;
																					_push(0);
																					_t943 =  &_v2404;
																					goto L188;
																				} else {
																					__eflags = _t1109 - _t1168;
																					if(_t1109 == _t1168) {
																						_t370 = _t1276 + _t1109 * 4 - 0x740;
																						 *_t370 =  *(_t1276 + _t1109 * 4 - 0x740) & 0x00000000;
																						__eflags =  *_t370;
																						_t376 = _t1109 + 1; // 0x1
																						_v1864 = _t376;
																					}
																					_t946 = _t1217;
																					_t1217 = 0;
																					 *(_t1276 + _t1109 * 4 - 0x740) =  *(_t1276 + _t1109 * 4 - 0x740) + _t946;
																					_t1168 = _v1864;
																					asm("adc edi, edi");
																					_t1109 = _t1109 + 1;
																					continue;
																				}
																				goto L181;
																			}
																			goto L174;
																		}
																		goto L169;
																	}
																} else {
																	__eflags = _t1260 - _t1168;
																	if(_t1260 == _t1168) {
																		 *(_t1276 + _t1260 * 4 - 0x740) =  *(_t1276 + _t1260 * 4 - 0x740) & _t940;
																		_t338 = _t1260 + 1; // 0x1
																		_t1168 = _t338;
																		_v1864 = _t1168;
																	}
																	goto L176;
																}
																goto L181;
																L176:
																_t1260 = _t1260 + 1;
																__eflags = _t1260 - _t1108;
															} while (_t1260 != _t1108);
															goto L177;
														}
													} else {
														_t1218 = _v932;
														_v936 = _t1108;
														E00A87FF2( &_v932, _t1067,  &_v1396, _t1108 << 2);
														_t1282 =  &(_t1282[4]);
														__eflags = _t1218;
														if(_t1218 != 0) {
															__eflags = _t1218 - 1;
															if(_t1218 == 1) {
																goto L180;
															} else {
																__eflags = _v936;
																if(_v936 == 0) {
																	goto L180;
																} else {
																	_t1110 = 0;
																	_v1884 = _v936;
																	_t1261 = 0;
																	__eflags = 0;
																	do {
																		_t961 = _t1218;
																		_t1169 = _t961 *  *(_t1276 + _t1261 * 4 - 0x3a0) >> 0x20;
																		 *(_t1276 + _t1261 * 4 - 0x3a0) = _t961 *  *(_t1276 + _t1261 * 4 - 0x3a0) + _t1110;
																		asm("adc edx, 0x0");
																		_t1261 = _t1261 + 1;
																		_t1110 = _t1169;
																		__eflags = _t1261 - _v1884;
																	} while (_t1261 != _v1884);
																	goto L149;
																}
															}
														} else {
															_v1400 = 0;
															_v936 = 0;
															_push(0);
															_t933 =  &_v1396;
															goto L179;
														}
													}
												} else {
													_t1219 = _v1396;
													__eflags = _t1219;
													if(_t1219 != 0) {
														__eflags = _t1219 - 1;
														if(_t1219 == 1) {
															goto L180;
														} else {
															__eflags = _v936;
															if(_v936 == 0) {
																goto L180;
															} else {
																_t1111 = 0;
																_v1884 = _v936;
																_t1262 = 0;
																__eflags = 0;
																do {
																	_t968 = _t1219;
																	_t1170 = _t968 *  *(_t1276 + _t1262 * 4 - 0x3a0) >> 0x20;
																	 *(_t1276 + _t1262 * 4 - 0x3a0) = _t968 *  *(_t1276 + _t1262 * 4 - 0x3a0) + _t1111;
																	asm("adc edx, 0x0");
																	_t1262 = _t1262 + 1;
																	_t1111 = _t1170;
																	__eflags = _t1262 - _v1884;
																} while (_t1262 != _v1884);
																L149:
																__eflags = _t1110;
																if(_t1110 == 0) {
																	goto L180;
																} else {
																	_t964 = _v936;
																	__eflags = _t964 - 0x73;
																	if(_t964 < 0x73) {
																		 *(_t1276 + _t964 * 4 - 0x3a0) = _t1110;
																		_v936 = _v936 + 1;
																		goto L180;
																	} else {
																		_v1400 = 0;
																		_v936 = 0;
																		_push(0);
																		_t943 =  &_v1396;
																		L188:
																		_push(_t943);
																		_push(_t1067);
																		_push( &_v932);
																		E00A87FF2();
																		_t1282 =  &(_t1282[4]);
																		_t936 = 0;
																	}
																}
															}
														}
													} else {
														_t932 = 0;
														_v1864 = 0;
														_v936 = 0;
														L178:
														_push(_t932);
														_t933 =  &_v1860;
														L179:
														_push(_t933);
														_push(_t1067);
														_push( &_v932);
														E00A87FF2();
														_t1282 =  &(_t1282[4]);
														L180:
														_t936 = 1;
													}
												}
												L181:
												__eflags = _t936;
												if(_t936 == 0) {
													_v2408 = _v2408 & 0x00000000;
													_t404 =  &_v936;
													 *_t404 = _v936 & 0x00000000;
													__eflags =  *_t404;
													_push(0);
													L190:
													_push( &_v2404);
													_t855 =  &_v932;
													L262:
													_push(_t1067);
													_push(_t855);
													E00A87FF2();
													_t1282 =  &(_t1282[4]);
												} else {
													goto L182;
												}
												goto L263;
												L182:
												_t911 = _v1908 - _v1888;
												__eflags = _t911;
												_v1908 = _t911;
											} while (_t911 != 0);
											_t1105 = _v1896;
											goto L184;
										}
									}
									L263:
									_t1199 = _v1920;
									_t1248 = _t1199;
									_t1089 = _v472;
									_v1872 = _t1248;
									__eflags = _t1089;
									if(_t1089 != 0) {
										_t1252 = 0;
										_t1203 = 0;
										__eflags = 0;
										do {
											_t844 =  *(_t1276 + _t1203 * 4 - 0x1d0);
											_t1156 = 0xa;
											_t1157 = _t844 * _t1156 >> 0x20;
											 *(_t1276 + _t1203 * 4 - 0x1d0) = _t844 * _t1156 + _t1252;
											asm("adc edx, 0x0");
											_t1203 = _t1203 + 1;
											_t1252 = _t1157;
											__eflags = _t1203 - _t1089;
										} while (_t1203 != _t1089);
										_v1896 = _t1252;
										__eflags = _t1252;
										_t1248 = _v1872;
										if(_t1252 != 0) {
											_t1098 = _v472;
											__eflags = _t1098 - 0x73;
											if(_t1098 >= 0x73) {
												__eflags = 0;
												_v2408 = 0;
												_v472 = 0;
												E00A87FF2( &_v468, _t1067,  &_v2404, 0);
												_t1282 =  &(_t1282[4]);
											} else {
												 *(_t1276 + _t1098 * 4 - 0x1d0) = _t1157;
												_v472 = _v472 + 1;
											}
										}
										_t1199 = _t1248;
									}
									_t816 = E00A89630( &_v472,  &_v936);
									_t1149 = 0xa;
									__eflags = _t816 - _t1149;
									if(_t816 != _t1149) {
										__eflags = _t816;
										if(_t816 != 0) {
											_t817 = _t816 + 0x30;
											__eflags = _t817;
											_t1248 = _t1199 + 1;
											 *_t1199 = _t817;
											_v1872 = _t1248;
											goto L282;
										} else {
											_t818 = _v1904 - 1;
										}
									} else {
										_v1904 = _v1904 + 1;
										_t1248 = _t1199 + 1;
										_t835 = _v936;
										 *_t1199 = 0x31;
										_v1872 = _t1248;
										__eflags = _t835;
										if(_t835 != 0) {
											_t1202 = 0;
											_t1251 = _t835;
											_t1097 = 0;
											__eflags = 0;
											do {
												_t836 =  *(_t1276 + _t1097 * 4 - 0x3a0);
												 *(_t1276 + _t1097 * 4 - 0x3a0) = _t836 * _t1149 + _t1202;
												asm("adc edx, 0x0");
												_t1097 = _t1097 + 1;
												_t1202 = _t836 * _t1149 >> 0x20;
												_t1149 = 0xa;
												__eflags = _t1097 - _t1251;
											} while (_t1097 != _t1251);
											_t1248 = _v1872;
											__eflags = _t1202;
											if(_t1202 != 0) {
												_t839 = _v936;
												__eflags = _t839 - 0x73;
												if(_t839 >= 0x73) {
													_v2408 = 0;
													_v936 = 0;
													E00A87FF2( &_v932, _t1067,  &_v2404, 0);
													_t1282 =  &(_t1282[4]);
												} else {
													 *(_t1276 + _t839 * 4 - 0x3a0) = _t1202;
													_v936 = _v936 + 1;
												}
											}
										}
										L282:
										_t818 = _v1904;
									}
									 *((intOrPtr*)(_v1924 + 4)) = _t818;
									_t1073 = _v1916;
									__eflags = _t818;
									if(_t818 >= 0) {
										__eflags = _t1073 - 0x7fffffff;
										if(_t1073 <= 0x7fffffff) {
											_t1073 = _t1073 + _t818;
											__eflags = _t1073;
										}
									}
									_t820 = _a24 - 1;
									__eflags = _t820 - _t1073;
									if(_t820 >= _t1073) {
										_t820 = _t1073;
									}
									_t821 = _t820 + _v1920;
									_v1916 = _t821;
									__eflags = _t1248 - _t821;
									if(__eflags != 0) {
										while(1) {
											_t822 = _v472;
											__eflags = _t822;
											if(__eflags == 0) {
												goto L303;
											}
											_t1200 = 0;
											_t1249 = _t822;
											_t1093 = 0;
											__eflags = 0;
											do {
												_t823 =  *(_t1276 + _t1093 * 4 - 0x1d0);
												 *(_t1276 + _t1093 * 4 - 0x1d0) = _t823 * 0x3b9aca00 + _t1200;
												asm("adc edx, 0x0");
												_t1093 = _t1093 + 1;
												_t1200 = _t823 * 0x3b9aca00 >> 0x20;
												__eflags = _t1093 - _t1249;
											} while (_t1093 != _t1249);
											_t1250 = _v1872;
											__eflags = _t1200;
											if(_t1200 != 0) {
												_t829 = _v472;
												__eflags = _t829 - 0x73;
												if(_t829 >= 0x73) {
													__eflags = 0;
													_v2408 = 0;
													_v472 = 0;
													E00A87FF2( &_v468, _t1067,  &_v2404, 0);
													_t1282 =  &(_t1282[4]);
												} else {
													 *(_t1276 + _t829 * 4 - 0x1d0) = _t1200;
													_v472 = _v472 + 1;
												}
											}
											_t828 = E00A89630( &_v472,  &_v936);
											_t1201 = 8;
											_t1073 = _v1916 - _t1250;
											__eflags = _t1073;
											do {
												_t708 = _t828 % _v1912;
												_t828 = _t828 / _v1912;
												_t1154 = _t708 + 0x30;
												__eflags = _t1073 - _t1201;
												if(_t1073 >= _t1201) {
													 *((char*)(_t1201 + _t1250)) = _t1154;
												}
												_t1201 = _t1201 - 1;
												__eflags = _t1201 - 0xffffffff;
											} while (_t1201 != 0xffffffff);
											__eflags = _t1073 - 9;
											if(_t1073 > 9) {
												_t1073 = 9;
											}
											_t1248 = _t1250 + _t1073;
											_v1872 = _t1248;
											__eflags = _t1248 - _v1916;
											if(__eflags != 0) {
												continue;
											}
											goto L303;
										}
									}
									L303:
									 *_t1248 = 0;
									goto L309;
								}
							}
						}
					}
				} else {
					_t1073 = _t1239 & 0x000fffff;
					if((_t1191 | _t1239 & 0x000fffff) != 0) {
						goto L5;
					} else {
						_push(0xa931b4);
						 *((intOrPtr*)(_v1924 + 4)) =  *(_v1924 + 4) & 0x00000000;
						L308:
						_push(_a24);
						_push(_t1058);
						if(E00A85152() != 0) {
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E00A85517();
							asm("int3");
							E00A7CB60(_t1145, 0xa97230, 0x10);
							_v32 = _v32 & 0x00000000;
							E00A86EBF(8);
							_pop(_t1074);
							_t721 =  &_v8;
							 *_t721 = _v8 & 0x00000000;
							__eflags =  *_t721;
							_t1240 = 3;
							while(1) {
								_v36 = _t1240;
								__eflags = _t1240 -  *0xab840c; // 0x200
								if(__eflags == 0) {
									break;
								}
								_t763 =  *0xab8410; // 0x10e9ae8
								_t764 =  *(_t763 + _t1240 * 4);
								__eflags = _t764;
								if(_t764 != 0) {
									__eflags =  *(_t764 + 0xc) >> 0x0000000d & 0x00000001;
									if(__eflags != 0) {
										_t773 =  *0xab8410; // 0x10e9ae8
										_push( *((intOrPtr*)(_t773 + _t1240 * 4)));
										_t774 = E00A8C683(_t1074, _t1145, __eflags);
										__eflags = _t774 - 0xffffffff;
										if(_t774 != 0xffffffff) {
											_t731 =  &_v32;
											 *_t731 = _v32 + 1;
											__eflags =  *_t731;
										}
									}
									_t767 =  *0xab8410; // 0x10e9ae8
									DeleteCriticalSection( *((intOrPtr*)(_t767 + _t1240 * 4)) + 0x20);
									_t770 =  *0xab8410; // 0x10e9ae8
									E00A851AC( *((intOrPtr*)(_t770 + _t1240 * 4)));
									_pop(_t1074);
									_t772 =  *0xab8410; // 0x10e9ae8
									_t737 = _t772 + _t1240 * 4;
									 *_t737 =  *(_t772 + _t1240 * 4) & 0x00000000;
									__eflags =  *_t737;
								}
								_t1240 = _t1240 + 1;
							}
							_v8 = 0xfffffffe;
							E00A8AF11();
							return E00A7CBA6(_t1145);
						} else {
							L309:
							_t1289 = _v1936;
							if(_v1936 != 0) {
								E00A8B9E5(_t1073, _t1289,  &_v1944);
							}
							return E00A7CABF(_v8 ^ _t1276);
						}
					}
				}
			}

0x00a89ade
0x00a89ae1
0x00a89ae3
0x00a89ae9
0x00a89af0
0x00a89af4
0x00a89afd
0x00a89afe
0x00a89aff
0x00a89b02
0x00a89b08
0x00a89b0e
0x00a89b13
0x00a89b22
0x00a89b24
0x00a89b26
0x00a89b26
0x00a89b2d
0x00a89b37
0x00a89b3c
0x00a89b3f
0x00a89b63
0x00a89b67
0x00a89b6c
0x00a89b6d
0x00a89b6f
0x00a89b71
0x00a89b77
0x00a89b77
0x00a89b7e
0x00a89b7e
0x00a89b81
0x00a8ae31
0x00000000
0x00a89b87
0x00a89b87
0x00a89b87
0x00a89b8a
0x00a8ae2a
0x00000000
0x00a89b90
0x00a89b90
0x00a89b90
0x00a89b93
0x00a8ae23
0x00000000
0x00a89b99
0x00a89b99
0x00a89b9c
0x00a8ae1c
0x00000000
0x00a89ba2
0x00a89bab
0x00a89bb3
0x00a89bb6
0x00a89bb9
0x00a89bbc
0x00a89bc2
0x00a89bca
0x00a89bd0
0x00a89bda
0x00a89bda
0x00a89bdd
0x00a89be5
0x00a89bec
0x00a89bec
0x00a89bdf
0x00a89bdf
0x00a89be1
0x00a89bf4
0x00a89bfa
0x00a89bfc
0x00a89c00
0x00a89c05
0x00a89c12
0x00a89c14
0x00a89c1a
0x00a89c1f
0x00a89c20
0x00a89c21
0x00a89c2b
0x00a89c30
0x00a89c36
0x00a89c3b
0x00a89c44
0x00a89c44
0x00a89c46
0x00a89c3d
0x00a89c3d
0x00a89c42
0x00000000
0x00000000
0x00a89c42
0x00a89c4c
0x00a89c54
0x00a89c56
0x00a89c5f
0x00a89c60
0x00a89c66
0x00a89c68
0x00a8a05b
0x00a8a061
0x00a8a180
0x00a8a180
0x00a8a187
0x00a8a187
0x00a8a187
0x00a8a18e
0x00a8a191
0x00a8a198
0x00a8a198
0x00a8a193
0x00a8a193
0x00a8a193
0x00a8a19c
0x00a8a19d
0x00a8a19f
0x00a8a1a2
0x00a8a1a5
0x00a8a1a8
0x00a8a1ae
0x00a8a1b1
0x00a8a1b4
0x00a8a1be
0x00a8a1be
0x00a8a1be
0x00a8a1b6
0x00a8a1b6
0x00a8a1b8
0x00000000
0x00a8a1ba
0x00a8a1ba
0x00a8a1ba
0x00a8a1b8
0x00a8a1c0
0x00a8a1c2
0x00a8a263
0x00a8a263
0x00a8a270
0x00a8a270
0x00a8a270
0x00a8a286
0x00a8a28b
0x00a8a1c8
0x00a8a1c8
0x00a8a1ca
0x00000000
0x00a8a1d0
0x00a8a1d2
0x00a8a1d3
0x00a8a1d5
0x00a8a1d7
0x00a8a1d7
0x00a8a1d9
0x00a8a1dc
0x00a8a1e4
0x00a8a1e6
0x00a8a1e9
0x00a8a1ef
0x00a8a1ef
0x00a8a1f1
0x00a8a1fd
0x00a8a1fd
0x00a8a1fd
0x00a8a1f3
0x00a8a1f5
0x00a8a1f5
0x00a8a204
0x00a8a207
0x00a8a209
0x00a8a210
0x00a8a210
0x00a8a20b
0x00a8a20b
0x00a8a20b
0x00a8a218
0x00a8a222
0x00a8a228
0x00a8a229
0x00a8a22e
0x00a8a234
0x00a8a237
0x00000000
0x00000000
0x00a8a239
0x00a8a239
0x00a8a241
0x00a8a241
0x00a8a247
0x00a8a24e
0x00a8a25b
0x00a8a250
0x00a8a250
0x00a8a253
0x00a8a253
0x00a8a24e
0x00a8a1ca
0x00a8a297
0x00a8a2a7
0x00a8a2b4
0x00a8a2b6
0x00a8a2bd
0x00a8a067
0x00a8a067
0x00a8a070
0x00a8a071
0x00a8a07b
0x00a8a081
0x00a8a083
0x00a8a089
0x00a8a089
0x00a8a08b
0x00a8a08b
0x00a8a092
0x00a8a099
0x00000000
0x00000000
0x00a8a09f
0x00a8a0a2
0x00a8a0a5
0x00000000
0x00a8a0a7
0x00a8a0a7
0x00a8a0a7
0x00a8a0a7
0x00a8a0ae
0x00a8a0b1
0x00a8a0b8
0x00a8a0b8
0x00a8a0b3
0x00a8a0b3
0x00a8a0b3
0x00a8a0bc
0x00a8a0bf
0x00a8a0c1
0x00a8a0c3
0x00a8a0c9
0x00a8a0cf
0x00a8a0d1
0x00a8a0d1
0x00a8a0d1
0x00a8a0d8
0x00a8a0d8
0x00a8a0da
0x00a8a0e6
0x00a8a0e6
0x00a8a0e6
0x00a8a0dc
0x00a8a0de
0x00a8a0de
0x00a8a0ed
0x00a8a0f0
0x00a8a0f2
0x00a8a0f9
0x00a8a0f9
0x00a8a0f4
0x00a8a0f4
0x00a8a0f4
0x00a8a101
0x00a8a10c
0x00a8a112
0x00a8a113
0x00a8a118
0x00a8a11e
0x00a8a121
0x00000000
0x00000000
0x00a8a123
0x00a8a123
0x00a8a12d
0x00a8a138
0x00a8a140
0x00a8a146
0x00a8a151
0x00a8a157
0x00a8a15e
0x00a8a171
0x00a8a178
0x00a8a178
0x00000000
0x00a8a0a5
0x00a8a08b
0x00000000
0x00a8a083
0x00a8a2c0
0x00a8a2c0
0x00a8a2c6
0x00a8a2cb
0x00a8a2d1
0x00a8a2e4
0x00a8a2e9
0x00a89c6e
0x00a89c6e
0x00a89c77
0x00a89c78
0x00a89c82
0x00a89c88
0x00a89c8a
0x00a89e90
0x00a89e98
0x00a89e9b
0x00a89ea0
0x00a89ea3
0x00a89eab
0x00a89eaf
0x00a89eb5
0x00a89ebb
0x00a89ec0
0x00a89ec7
0x00a89ec8
0x00a89ec8
0x00a89ec8
0x00a89ecf
0x00a89ed2
0x00a89eda
0x00a89ee0
0x00a89ee5
0x00a89ee5
0x00a89ee2
0x00a89ee2
0x00a89ee2
0x00a89ee9
0x00a89eea
0x00a89eec
0x00a89eef
0x00a89ef5
0x00a89efb
0x00a89efe
0x00a89f01
0x00a89f07
0x00a89f0a
0x00a89f0d
0x00a89f17
0x00a89f17
0x00a89f17
0x00a89f0f
0x00a89f0f
0x00a89f11
0x00000000
0x00a89f13
0x00a89f13
0x00a89f13
0x00a89f11
0x00a89f19
0x00a89f1b
0x00a8a00d
0x00a8a00d
0x00a8a00f
0x00a8a015
0x00a8a01b
0x00a8a030
0x00a8a035
0x00a89f21
0x00a89f21
0x00a89f23
0x00000000
0x00a89f29
0x00a89f2b
0x00a89f2c
0x00a89f2e
0x00a89f30
0x00a89f32
0x00a89f32
0x00a89f38
0x00a89f3a
0x00a89f40
0x00a89f43
0x00a89f51
0x00a89f57
0x00a89f57
0x00a89f59
0x00a89f5c
0x00a89f62
0x00a89f62
0x00a89f64
0x00000000
0x00000000
0x00a89f66
0x00a89f68
0x00a89f6e
0x00a89f6e
0x00a89f6a
0x00a89f6a
0x00a89f6a
0x00a89f73
0x00a89f75
0x00a89f7c
0x00a89f7c
0x00a89f77
0x00a89f77
0x00a89f77
0x00a89fa2
0x00a89fa8
0x00a89fab
0x00a89fb1
0x00a89fb8
0x00a89fb9
0x00a89fba
0x00a89fc0
0x00a89fc3
0x00a89fc5
0x00000000
0x00a89fc5
0x00000000
0x00a89fc3
0x00a89fcd
0x00a89fd3
0x00a89fdb
0x00a89fdb
0x00a89fdc
0x00a89fde
0x00a89fe2
0x00a89fea
0x00a89fea
0x00a89fea
0x00a89fec
0x00a89ff3
0x00a89ff8
0x00a8a005
0x00a89ffa
0x00a89ffd
0x00a89ffd
0x00a89ff8
0x00a89f23
0x00a8a038
0x00a8a042
0x00a8a048
0x00a8a04e
0x00a8a054
0x00a89c90
0x00a89c90
0x00a89c90
0x00a89c92
0x00a89c99
0x00a89ca0
0x00000000
0x00000000
0x00a89ca6
0x00a89ca9
0x00a89cac
0x00000000
0x00a89cae
0x00a89cb6
0x00a89cbb
0x00a89cc0
0x00a89cc1
0x00a89cc3
0x00a89ccb
0x00a89ccf
0x00a89cd5
0x00a89cdb
0x00a89ce0
0x00a89ce7
0x00a89ce7
0x00a89ce8
0x00a89ceb
0x00a89cf3
0x00a89cf9
0x00a89cfe
0x00a89cfe
0x00a89cfb
0x00a89cfb
0x00a89cfb
0x00a89d02
0x00a89d03
0x00a89d05
0x00a89d08
0x00a89d0e
0x00a89d14
0x00a89d17
0x00a89d1a
0x00a89d20
0x00a89d23
0x00a89d26
0x00a89d30
0x00a89d30
0x00a89d30
0x00a89d28
0x00a89d28
0x00a89d2a
0x00000000
0x00a89d2c
0x00a89d2c
0x00a89d2c
0x00a89d2a
0x00a89d32
0x00a89d34
0x00a89e29
0x00a89e29
0x00a89e2b
0x00a89e31
0x00a89e37
0x00a89e4c
0x00a89e51
0x00a89d3a
0x00a89d3a
0x00a89d3c
0x00000000
0x00a89d42
0x00a89d44
0x00a89d45
0x00a89d47
0x00a89d49
0x00a89d4b
0x00a89d4b
0x00a89d51
0x00a89d53
0x00a89d59
0x00a89d5c
0x00a89d6a
0x00a89d70
0x00a89d70
0x00a89d72
0x00a89d75
0x00a89d7b
0x00a89d7b
0x00a89d7d
0x00000000
0x00000000
0x00a89d7f
0x00a89d81
0x00a89d87
0x00a89d87
0x00a89d83
0x00a89d83
0x00a89d83
0x00a89d8c
0x00a89d8e
0x00a89d9b
0x00a89d9b
0x00a89d90
0x00a89d96
0x00a89d96
0x00a89db9
0x00a89dc1
0x00a89dc8
0x00a89dcf
0x00a89dd0
0x00a89dd3
0x00a89dd9
0x00a89ddf
0x00a89de2
0x00a89de4
0x00000000
0x00a89de4
0x00000000
0x00a89de2
0x00a89dec
0x00a89df2
0x00a89df2
0x00a89df8
0x00a89dfa
0x00a89e04
0x00a89e06
0x00a89e06
0x00a89e06
0x00a89e08
0x00a89e0f
0x00a89e14
0x00a89e21
0x00a89e16
0x00a89e19
0x00a89e19
0x00a89e14
0x00a89d3c
0x00a89e54
0x00a89e5f
0x00a89e60
0x00a89e61
0x00a89e67
0x00a89e6d
0x00a89e73
0x00a89e73
0x00000000
0x00a89cac
0x00000000
0x00a89c92
0x00a89e74
0x00a89e7a
0x00a89e81
0x00a89e82
0x00a89e83
0x00a89e88
0x00a89e88
0x00a8a2ec
0x00a8a2f6
0x00a8a2f7
0x00a8a2fd
0x00a8a2ff
0x00a8a768
0x00a8a76a
0x00a8a76c
0x00a8a772
0x00a8a774
0x00a8a77a
0x00a8a77c
0x00a8aace
0x00a8aace
0x00a8aad0
0x00a8aad6
0x00a8aadd
0x00a8aae3
0x00a8aae5
0x00a8ab83
0x00a8ab83
0x00a8ab85
0x00a8ab86
0x00a8ab8c
0x00000000
0x00a8aaeb
0x00a8aaeb
0x00a8aaee
0x00a8aaf4
0x00a8aafa
0x00a8aafc
0x00a8ab02
0x00a8ab04
0x00a8ab04
0x00a8ab06
0x00a8ab06
0x00a8ab0f
0x00a8ab16
0x00a8ab1c
0x00a8ab1f
0x00a8ab20
0x00a8ab22
0x00a8ab22
0x00a8ab26
0x00a8ab28
0x00a8ab2a
0x00a8ab30
0x00a8ab33
0x00000000
0x00a8ab35
0x00a8ab35
0x00a8ab3c
0x00a8ab3c
0x00a8ab33
0x00a8ab28
0x00a8aafc
0x00a8aaee
0x00a8aae5
0x00a8a782
0x00a8a782
0x00a8a782
0x00a8a785
0x00a8a789
0x00a8a789
0x00a8a78a
0x00a8a79c
0x00a8a7a9
0x00a8a7b8
0x00a8a7e2
0x00a8a7e7
0x00a8a7ed
0x00a8a7f0
0x00a8a7f6
0x00a8a7f9
0x00a8a892
0x00a8a899
0x00a8a917
0x00a8a91d
0x00a8a923
0x00a8a926
0x00a8a928
0x00a8a9b1
0x00a8a92e
0x00a8a92e
0x00a8a934
0x00a8a934
0x00a8a93a
0x00a8a940
0x00a8a942
0x00a8a944
0x00a8a944
0x00a8a94a
0x00a8a950
0x00a8a952
0x00a8a95a
0x00a8a95a
0x00a8a960
0x00a8a962
0x00a8a964
0x00a8a96a
0x00a8a96c
0x00a8aa83
0x00a8aa85
0x00a8aa8b
0x00a8aa8b
0x00a8aa8e
0x00a8aa8f
0x00000000
0x00a8a972
0x00a8a978
0x00a8a978
0x00a8a97a
0x00a8a980
0x00a8a983
0x00a8a98a
0x00a8a990
0x00a8a992
0x00a8a9b9
0x00a8a9bb
0x00a8a9bd
0x00a8a9bf
0x00a8a9c5
0x00a8a9cb
0x00a8aa65
0x00a8aa65
0x00a8aa68
0x00000000
0x00a8aa6e
0x00a8aa6e
0x00a8aa74
0x00000000
0x00a8aa74
0x00a8a9d1
0x00a8a9d1
0x00a8a9d1
0x00a8a9d4
0x00000000
0x00000000
0x00a8a9d6
0x00a8a9d8
0x00a8a9da
0x00a8a9e3
0x00a8a9e3
0x00a8a9e5
0x00a8a9eb
0x00a8a9eb
0x00a8a9f7
0x00a8aa02
0x00a8aa05
0x00a8aa12
0x00a8aa15
0x00a8aa16
0x00a8aa17
0x00a8aa1d
0x00a8aa1f
0x00a8aa25
0x00a8aa2b
0x00000000
0x00000000
0x00000000
0x00000000
0x00a8aa2d
0x00a8aa2d
0x00a8aa2d
0x00a8aa2f
0x00000000
0x00000000
0x00a8aa31
0x00a8aa34
0x00000000
0x00a8aa3a
0x00a8aa3a
0x00a8aa3c
0x00a8aa3e
0x00a8aa3e
0x00a8aa3e
0x00a8aa46
0x00a8aa49
0x00a8aa49
0x00a8aa4f
0x00a8aa51
0x00a8aa53
0x00a8aa5a
0x00a8aa60
0x00a8aa62
0x00000000
0x00a8aa62
0x00000000
0x00a8aa34
0x00000000
0x00a8aa2d
0x00000000
0x00a8a9d1
0x00a8a994
0x00a8a994
0x00a8a996
0x00a8a99c
0x00a8a9a3
0x00a8a9a3
0x00a8a9a6
0x00a8a9a6
0x00000000
0x00a8a996
0x00000000
0x00a8aa7a
0x00a8aa7a
0x00a8aa7b
0x00a8aa7b
0x00000000
0x00a8a980
0x00a8a89b
0x00a8a89b
0x00a8a8ad
0x00a8a8bc
0x00a8a8c1
0x00a8a8c4
0x00a8a8c6
0x00000000
0x00a8a8cc
0x00a8a8cc
0x00a8a8cf
0x00000000
0x00a8a8d5
0x00a8a8d5
0x00a8a8dc
0x00000000
0x00a8a8e2
0x00a8a8e8
0x00a8a8ea
0x00a8a8f0
0x00a8a8f0
0x00a8a8f2
0x00a8a8f2
0x00a8a8f4
0x00a8a8fd
0x00a8a904
0x00a8a907
0x00a8a908
0x00a8a90a
0x00a8a90a
0x00000000
0x00a8a912
0x00a8a8dc
0x00a8a8cf
0x00a8a8c6
0x00a8a7ff
0x00a8a7ff
0x00a8a805
0x00a8a807
0x00a8a823
0x00a8a826
0x00000000
0x00a8a82c
0x00a8a82c
0x00a8a833
0x00000000
0x00a8a839
0x00a8a83f
0x00a8a841
0x00a8a847
0x00a8a847
0x00a8a849
0x00a8a849
0x00a8a84b
0x00a8a854
0x00a8a85b
0x00a8a85e
0x00a8a85f
0x00a8a861
0x00a8a861
0x00a8a869
0x00a8a869
0x00a8a86b
0x00000000
0x00a8a871
0x00a8a871
0x00a8a877
0x00a8a87a
0x00a8ab44
0x00a8ab47
0x00a8ab4d
0x00a8ab62
0x00a8ab67
0x00a8ab6a
0x00a8a880
0x00a8a880
0x00a8a887
0x00000000
0x00a8a887
0x00a8a87a
0x00a8a86b
0x00a8a833
0x00a8a809
0x00a8a809
0x00a8a80b
0x00a8a811
0x00a8a817
0x00a8a818
0x00a8aa95
0x00a8aa95
0x00a8aa9c
0x00a8aa9d
0x00a8aa9e
0x00a8aaa3
0x00a8aaa6
0x00a8aaa6
0x00a8aaa6
0x00a8a807
0x00a8aaa8
0x00a8aaa8
0x00a8aaaa
0x00a8ab71
0x00a8ab78
0x00a8ab7f
0x00a8ab92
0x00a8ab98
0x00a8ab99
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00a8aab0
0x00a8aab6
0x00a8aab6
0x00a8aabc
0x00a8aabc
0x00a8aac8
0x00000000
0x00a8aac8
0x00a8a305
0x00a8a305
0x00a8a307
0x00a8a30d
0x00a8a30f
0x00a8a315
0x00a8a317
0x00a8a68e
0x00a8a68e
0x00a8a690
0x00a8a696
0x00a8a69d
0x00a8a69f
0x00a8a6fe
0x00a8a701
0x00a8a707
0x00a8a70d
0x00a8a713
0x00a8a715
0x00a8a71b
0x00a8a71d
0x00a8a71d
0x00a8a71f
0x00a8a71f
0x00a8a721
0x00a8a72a
0x00a8a731
0x00a8a734
0x00a8a735
0x00a8a737
0x00a8a737
0x00a8a73f
0x00a8a741
0x00a8a747
0x00a8a74d
0x00a8a750
0x00000000
0x00a8a756
0x00a8a756
0x00a8a75d
0x00a8a75d
0x00a8a750
0x00a8a741
0x00a8a715
0x00a8a6a1
0x00a8a6a1
0x00a8a6a3
0x00a8a6a9
0x00a8a6af
0x00000000
0x00a8a6af
0x00a8a69f
0x00a8a31d
0x00a8a31d
0x00a8a31d
0x00a8a320
0x00a8a324
0x00a8a324
0x00a8a325
0x00a8a337
0x00a8a344
0x00a8a353
0x00a8a37d
0x00a8a382
0x00a8a388
0x00a8a38b
0x00a8a391
0x00a8a394
0x00a8a410
0x00a8a417
0x00a8a4db
0x00a8a4e1
0x00a8a4e7
0x00a8a4ea
0x00a8a4ec
0x00a8a575
0x00a8a4f2
0x00a8a4f2
0x00a8a4f8
0x00a8a4f8
0x00a8a4fe
0x00a8a504
0x00a8a506
0x00a8a508
0x00a8a508
0x00a8a50e
0x00a8a514
0x00a8a516
0x00a8a51e
0x00a8a51e
0x00a8a524
0x00a8a526
0x00a8a528
0x00a8a52e
0x00a8a530
0x00a8a647
0x00a8a649
0x00a8a64f
0x00a8a64f
0x00000000
0x00a8a536
0x00a8a53c
0x00a8a53c
0x00a8a53e
0x00a8a544
0x00a8a547
0x00a8a54e
0x00a8a554
0x00a8a556
0x00a8a57d
0x00a8a57f
0x00a8a581
0x00a8a583
0x00a8a589
0x00a8a58f
0x00a8a629
0x00a8a629
0x00a8a62c
0x00000000
0x00a8a632
0x00a8a632
0x00a8a638
0x00000000
0x00a8a638
0x00a8a595
0x00a8a595
0x00a8a595
0x00a8a598
0x00000000
0x00000000
0x00a8a59a
0x00a8a59c
0x00a8a59e
0x00a8a5a7
0x00a8a5a7
0x00a8a5a9
0x00a8a5af
0x00a8a5af
0x00a8a5bb
0x00a8a5c6
0x00a8a5c9
0x00a8a5d6
0x00a8a5d9
0x00a8a5da
0x00a8a5db
0x00a8a5e1
0x00a8a5e3
0x00a8a5e9
0x00a8a5ef
0x00000000
0x00000000
0x00000000
0x00000000
0x00a8a5f1
0x00a8a5f1
0x00a8a5f1
0x00a8a5f3
0x00000000
0x00000000
0x00a8a5f5
0x00a8a5f8
0x00a8a6b2
0x00a8a6b2
0x00a8a6b4
0x00a8a6ba
0x00a8a6c0
0x00a8a6c1
0x00000000
0x00a8a5fe
0x00a8a5fe
0x00a8a600
0x00a8a602
0x00a8a602
0x00a8a602
0x00a8a60a
0x00a8a60d
0x00a8a60d
0x00a8a613
0x00a8a615
0x00a8a617
0x00a8a61e
0x00a8a624
0x00a8a626
0x00000000
0x00a8a626
0x00000000
0x00a8a5f8
0x00000000
0x00a8a5f1
0x00000000
0x00a8a595
0x00a8a558
0x00a8a558
0x00a8a55a
0x00a8a560
0x00a8a567
0x00a8a567
0x00a8a56a
0x00a8a56a
0x00000000
0x00a8a55a
0x00000000
0x00a8a63e
0x00a8a63e
0x00a8a63f
0x00a8a63f
0x00000000
0x00a8a544
0x00a8a41d
0x00a8a41d
0x00a8a42f
0x00a8a43e
0x00a8a443
0x00a8a446
0x00a8a448
0x00a8a464
0x00a8a467
0x00000000
0x00a8a46d
0x00a8a46d
0x00a8a474
0x00000000
0x00a8a47a
0x00a8a480
0x00a8a482
0x00a8a488
0x00a8a488
0x00a8a48a
0x00a8a48a
0x00a8a48c
0x00a8a495
0x00a8a49c
0x00a8a49f
0x00a8a4a0
0x00a8a4a2
0x00a8a4a2
0x00000000
0x00a8a48a
0x00a8a474
0x00a8a44a
0x00a8a44c
0x00a8a452
0x00a8a458
0x00a8a459
0x00000000
0x00a8a459
0x00a8a448
0x00a8a396
0x00a8a396
0x00a8a39c
0x00a8a39e
0x00a8a3b3
0x00a8a3b6
0x00000000
0x00a8a3bc
0x00a8a3bc
0x00a8a3c3
0x00000000
0x00a8a3c9
0x00a8a3cf
0x00a8a3d1
0x00a8a3d7
0x00a8a3d7
0x00a8a3d9
0x00a8a3d9
0x00a8a3db
0x00a8a3e4
0x00a8a3eb
0x00a8a3ee
0x00a8a3ef
0x00a8a3f1
0x00a8a3f1
0x00a8a4aa
0x00a8a4aa
0x00a8a4ac
0x00000000
0x00a8a4b2
0x00a8a4b2
0x00a8a4b8
0x00a8a4bb
0x00a8a3fe
0x00a8a405
0x00000000
0x00a8a4c1
0x00a8a4c3
0x00a8a4c9
0x00a8a4cf
0x00a8a4d0
0x00a8a6c7
0x00a8a6c7
0x00a8a6ce
0x00a8a6cf
0x00a8a6d0
0x00a8a6d5
0x00a8a6d8
0x00a8a6d8
0x00a8a4bb
0x00a8a4ac
0x00a8a3c3
0x00a8a3a0
0x00a8a3a0
0x00a8a3a2
0x00a8a3a8
0x00a8a652
0x00a8a652
0x00a8a653
0x00a8a659
0x00a8a659
0x00a8a660
0x00a8a661
0x00a8a662
0x00a8a667
0x00a8a66a
0x00a8a66a
0x00a8a66a
0x00a8a39e
0x00a8a66c
0x00a8a66c
0x00a8a66e
0x00a8a6dc
0x00a8a6e3
0x00a8a6e3
0x00a8a6e3
0x00a8a6ea
0x00a8a6ec
0x00a8a6f2
0x00a8a6f3
0x00a8ab9f
0x00a8ab9f
0x00a8aba0
0x00a8aba1
0x00a8aba6
0x00000000
0x00000000
0x00000000
0x00000000
0x00a8a670
0x00a8a676
0x00a8a676
0x00a8a67c
0x00a8a67c
0x00a8a688
0x00000000
0x00a8a688
0x00a8a317
0x00a8aba9
0x00a8aba9
0x00a8abaf
0x00a8abb1
0x00a8abb7
0x00a8abbd
0x00a8abbf
0x00a8abc1
0x00a8abc3
0x00a8abc3
0x00a8abc5
0x00a8abc5
0x00a8abce
0x00a8abcf
0x00a8abd3
0x00a8abda
0x00a8abdd
0x00a8abde
0x00a8abe0
0x00a8abe0
0x00a8abe4
0x00a8abea
0x00a8abec
0x00a8abf2
0x00a8abf4
0x00a8abfa
0x00a8abfd
0x00a8ac10
0x00a8ac13
0x00a8ac19
0x00a8ac2e
0x00a8ac33
0x00a8abff
0x00a8ac01
0x00a8ac08
0x00a8ac08
0x00a8abfd
0x00a8ac36
0x00a8ac36
0x00a8ac46
0x00a8ac4f
0x00a8ac50
0x00a8ac52
0x00a8ace9
0x00a8aceb
0x00a8acf6
0x00a8acf6
0x00a8acf8
0x00a8acfb
0x00a8acfd
0x00000000
0x00a8aced
0x00a8acf3
0x00a8acf3
0x00a8ac58
0x00a8ac58
0x00a8ac5e
0x00a8ac61
0x00a8ac67
0x00a8ac6a
0x00a8ac70
0x00a8ac72
0x00a8ac78
0x00a8ac7a
0x00a8ac7c
0x00a8ac7c
0x00a8ac7e
0x00a8ac7e
0x00a8ac8b
0x00a8ac92
0x00a8ac95
0x00a8ac96
0x00a8ac98
0x00a8ac99
0x00a8ac99
0x00a8ac9d
0x00a8aca3
0x00a8aca5
0x00a8aca7
0x00a8acad
0x00a8acb0
0x00a8acc4
0x00a8acca
0x00a8acdf
0x00a8ace4
0x00a8acb2
0x00a8acb2
0x00a8acb9
0x00a8acb9
0x00a8acb0
0x00a8aca5
0x00a8ad03
0x00a8ad03
0x00a8ad03
0x00a8ad0f
0x00a8ad12
0x00a8ad18
0x00a8ad1a
0x00a8ad1c
0x00a8ad22
0x00a8ad24
0x00a8ad24
0x00a8ad24
0x00a8ad22
0x00a8ad29
0x00a8ad2a
0x00a8ad2c
0x00a8ad2e
0x00a8ad2e
0x00a8ad30
0x00a8ad36
0x00a8ad3c
0x00a8ad3e
0x00a8ad44
0x00a8ad44
0x00a8ad4a
0x00a8ad4c
0x00000000
0x00000000
0x00a8ad52
0x00a8ad54
0x00a8ad56
0x00a8ad56
0x00a8ad58
0x00a8ad58
0x00a8ad68
0x00a8ad6f
0x00a8ad72
0x00a8ad73
0x00a8ad75
0x00a8ad75
0x00a8ad79
0x00a8ad7f
0x00a8ad81
0x00a8ad83
0x00a8ad89
0x00a8ad8c
0x00a8ad9d
0x00a8ada0
0x00a8ada6
0x00a8adbb
0x00a8adc0
0x00a8ad8e
0x00a8ad8e
0x00a8ad95
0x00a8ad95
0x00a8ad8c
0x00a8add1
0x00a8ade0
0x00a8ade1
0x00a8ade1
0x00a8ade3
0x00a8ade5
0x00a8ade5
0x00a8adeb
0x00a8adee
0x00a8adf0
0x00a8adf2
0x00a8adf2
0x00a8adf5
0x00a8adf6
0x00a8adf6
0x00a8adfb
0x00a8adfe
0x00a8ae02
0x00a8ae02
0x00a8ae03
0x00a8ae05
0x00a8ae0b
0x00a8ae11
0x00000000
0x00000000
0x00000000
0x00a8ae11
0x00a8ad44
0x00a8ae17
0x00a8ae17
0x00000000
0x00a8ae17
0x00a89b9c
0x00a89b93
0x00a89b8a
0x00a89b41
0x00a89b45
0x00a89b4d
0x00000000
0x00a89b4f
0x00a89b55
0x00a89b5a
0x00a8ae36
0x00a8ae36
0x00a8ae39
0x00a8ae44
0x00a8ae6f
0x00a8ae70
0x00a8ae71
0x00a8ae72
0x00a8ae73
0x00a8ae74
0x00a8ae79
0x00a8ae81
0x00a8ae86
0x00a8ae8c
0x00a8ae91
0x00a8ae92
0x00a8ae92
0x00a8ae92
0x00a8ae98
0x00a8ae99
0x00a8ae99
0x00a8ae9c
0x00a8aea2
0x00000000
0x00000000
0x00a8aea4
0x00a8aea9
0x00a8aeac
0x00a8aeae
0x00a8aeb6
0x00a8aeb8
0x00a8aeba
0x00a8aebf
0x00a8aec2
0x00a8aec8
0x00a8aecb
0x00a8aecd
0x00a8aecd
0x00a8aecd
0x00a8aecd
0x00a8aecb
0x00a8aed0
0x00a8aedc
0x00a8aee2
0x00a8aeea
0x00a8aeef
0x00a8aef0
0x00a8aef5
0x00a8aef5
0x00a8aef5
0x00a8aef5
0x00a8aef9
0x00a8aef9
0x00a8aefc
0x00a8af03
0x00a8af10
0x00a8ae46
0x00a8ae46
0x00a8ae46
0x00a8ae50
0x00a8ae59
0x00a8ae5e
0x00a8ae6c
0x00a8ae6c
0x00a8ae44
0x00a89b4d

APIs

__floor_pentium4.LIBCMT ref: 00A89C24

Strings

1#QNAN, xrefs: 00A8AE2A
1#INF, xrefs: 00A8AE31
1#IND, xrefs: 00A8AE1C
1#SNAN, xrefs: 00A8AE23

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: dbc284a65fab8b1aeb140274749c04ed03c302a1a48dc61cf2058aa58bab5a1a
Instruction ID: 1eef176d68c07e92e7cf260144330c0fd6bd3d634fad22e8d95faabc118dccfd
Opcode Fuzzy Hash: dbc284a65fab8b1aeb140274749c04ed03c302a1a48dc61cf2058aa58bab5a1a
Instruction Fuzzy Hash: 27C24B72E086288FEB25EF28DD447EAB7B5EB54305F1441EAD44DE7240E778AE818F41

Uniqueness

Uniqueness Score: -1.00%

Function 00A63087 Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 547
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E00A63087(intOrPtr* __ecx, void* __eflags) {
				void* __ebp;
				void* _t224;
				signed int _t227;
				void* _t233;
				unsigned int _t235;
				signed int _t238;
				signed int _t239;
				unsigned int _t240;
				void* _t241;
				char _t255;
				void* _t268;
				signed int _t274;
				void* _t275;
				intOrPtr _t276;
				signed char _t277;
				signed int _t282;
				char _t289;
				signed char _t291;
				signed int _t306;
				signed int _t316;
				signed int _t320;
				signed int _t337;
				signed char _t339;
				unsigned int _t343;
				void* _t361;
				intOrPtr* _t366;
				intOrPtr* _t368;
				signed int _t381;
				signed int _t390;
				char _t401;
				signed int _t402;
				signed int _t406;
				unsigned int _t410;
				unsigned int _t421;
				unsigned int _t424;
				signed int _t428;
				signed int _t436;
				signed int _t445;
				signed int _t451;
				signed int _t460;
				unsigned int _t461;
				signed char _t462;
				void* _t463;
				intOrPtr _t472;
				signed int _t474;
				void* _t475;
				void* _t478;
				unsigned int _t481;
				void* _t482;
				signed int _t492;
				unsigned int _t495;
				void* _t498;
				intOrPtr _t502;
				void* _t503;
				void* _t504;
				void* _t505;
				intOrPtr _t514;

				_t368 = __ecx;
				_t505 = _t504 - 0x5c;
				E00A7C16C(E00A8EBC7, _t503);
				E00A7C240();
				_t366 = _t368;
				E00A6BD64(_t503 + 0x34, _t366);
				 *((intOrPtr*)(_t503 + 0x20)) = 0;
				 *((intOrPtr*)(_t503 - 4)) = 0;
				if( *((intOrPtr*)(_t366 + 0x6cf4)) == 0) {
					L9:
					 *((char*)(_t503 + 0x5f)) = 0;
					L10:
					_t224 = E00A6BF68(_t460, 7);
					__eflags = _t224 - 7;
					if(_t224 >= 7) {
						 *(_t366 + 0x21f4) = 0;
						 *(_t366 + 0x21e4) = E00A6BDDC(_t503 + 0x34);
						_t492 = E00A6BF44(_t503 + 0x34, 4);
						_t227 = E00A6BEDC();
						__eflags = _t227 | _t460;
						if((_t227 | _t460) == 0) {
							L80:
							E00A61F70(_t366);
							L81:
							E00A6A6F4(_t503 + 0x34);
							 *[fs:0x0] =  *((intOrPtr*)(_t503 - 0xc));
							return  *((intOrPtr*)(_t503 + 0x20));
						}
						__eflags = _t492;
						if(_t492 == 0) {
							goto L80;
						}
						_t30 = _t492 + 4; // 0x4
						_t31 = _t492 - 3; // -3
						_t472 = _t30 + _t227;
						_t381 = _t31 + _t227;
						__eflags = _t381;
						if(_t381 < 0) {
							goto L80;
						}
						__eflags = _t472 - 7;
						if(_t472 < 7) {
							goto L80;
						}
						E00A6BF68(_t460, _t381);
						__eflags =  *((intOrPtr*)(_t503 + 0x48)) - _t472;
						if( *((intOrPtr*)(_t503 + 0x48)) < _t472) {
							goto L11;
						}
						_t233 = E00A6BEBC(_t503 + 0x34);
						 *(_t366 + 0x21e8) = E00A6BEDC();
						_t235 = E00A6BEDC();
						 *(_t366 + 0x21ec) = _t235;
						 *((intOrPtr*)(_t366 + 0x21f0)) = _t472;
						__eflags =  *(_t366 + 0x21e4) - _t233;
						 *(_t366 + 0x21f4) = _t235 >> 0x00000002 & 0x00000001;
						_t238 =  *(_t366 + 0x21e8);
						 *(_t366 + 0x21dc) = _t238;
						_t239 = _t238 & 0xffffff00 |  *(_t366 + 0x21e4) != _t233;
						 *(_t503 + 0x5e) = _t239;
						__eflags = _t239;
						if(_t239 == 0) {
							L20:
							_t240 = 0;
							__eflags =  *(_t366 + 0x21ec) & 0x00000001;
							 *(_t503 + 0x30) = 0;
							 *(_t503 + 0x2c) = 0;
							if(( *(_t366 + 0x21ec) & 0x00000001) == 0) {
								L24:
								__eflags =  *(_t366 + 0x21ec) & 0x00000002;
								_t495 = _t240;
								 *(_t503 + 0x24) = _t495;
								 *(_t503 + 0x58) = _t240;
								if(( *(_t366 + 0x21ec) & 0x00000002) != 0) {
									_t343 = E00A6BEDC();
									_t495 = _t343;
									 *(_t503 + 0x24) = _t343;
									 *(_t503 + 0x58) = _t460;
								}
								_t241 = E00A61974(_t366,  *((intOrPtr*)(_t366 + 0x21f0)));
								_t461 = 0;
								asm("adc ecx, [ebx+0x6cdc]");
								 *((intOrPtr*)(_t366 + 0x6ce0)) = _t241 +  *((intOrPtr*)(_t366 + 0x6cd8)) + _t495;
								asm("adc ecx, edi");
								_t474 =  *(_t366 + 0x21e8);
								 *(_t366 + 0x6ce4) = _t461;
								__eflags = _t474 - 1;
								if(__eflags == 0) {
									_t475 = _t366 + 0x2208;
									E00A6A2D1(_t475);
									_t390 = 5;
									memcpy(_t475, _t366 + 0x21e4, _t390 << 2);
									_t462 = E00A6BEDC();
									 *(_t366 + 0x6ced) = _t462 & 1;
									 *(_t366 + 0x6cec) = _t462 >> 0x00000002 & 1;
									 *(_t366 + 0x6cef) = _t462 >> 0x00000004 & 1;
									 *(_t366 + 0x6cf3) = _t462 >> 0x00000003 & 0x00000001;
									_t401 = 0;
									 *((char*)(_t366 + 0x6cf0)) = 0;
									_t255 = 1;
									 *((char*)(_t366 + 0x6cf2)) = 1;
									__eflags = _t462 & 0x00000002;
									if((_t462 & 0x00000002) == 0) {
										 *((intOrPtr*)(_t366 + 0x6d10)) = 0;
									} else {
										 *((intOrPtr*)(_t366 + 0x6d10)) = E00A6BEDC();
										_t401 = 0;
										_t255 = 1;
									}
									__eflags =  *(_t366 + 0x6ced);
									if( *(_t366 + 0x6ced) == 0) {
										L73:
										_t255 = _t401;
										goto L74;
									} else {
										__eflags =  *((intOrPtr*)(_t366 + 0x6d10)) - _t401;
										if( *((intOrPtr*)(_t366 + 0x6d10)) == _t401) {
											L74:
											_t402 =  *(_t503 + 0x30);
											 *((char*)(_t366 + 0x6cf1)) = _t255;
											__eflags = _t402 |  *(_t503 + 0x2c);
											if((_t402 |  *(_t503 + 0x2c)) != 0) {
												_push(_t366 + 0x2208);
												_push(_t402);
												_push(_t503 + 0x34);
												E00A620A6(_t366);
											}
											L76:
											__eflags =  *(_t366 + 0x6ce4) -  *((intOrPtr*)(_t366 + 0x6cdc));
											if(__eflags > 0) {
												L79:
												 *((intOrPtr*)(_t503 + 0x20)) =  *((intOrPtr*)(_t503 + 0x48));
												goto L81;
											}
											if(__eflags < 0) {
												goto L80;
											}
											__eflags =  *((intOrPtr*)(_t366 + 0x6ce0)) -  *((intOrPtr*)(_t366 + 0x6cd8));
											if( *((intOrPtr*)(_t366 + 0x6ce0)) <=  *((intOrPtr*)(_t366 + 0x6cd8))) {
												goto L80;
											}
											goto L79;
										}
										goto L73;
									}
								}
								if(__eflags <= 0) {
									goto L76;
								}
								__eflags = _t474 - 3;
								if(_t474 <= 3) {
									__eflags = _t474 - 2;
									_t478 = _t366 + 0x2280;
									if(_t474 != 2) {
										_t478 = _t366 + 0x45c0;
									}
									 *(_t503 + 0x28) = _t478;
									E00A6A238(_t478, _t461);
									_t406 = 5;
									_t268 = memcpy(_t478, _t366 + 0x21e4, _t406 << 2);
									_t498 =  *(_t503 + 0x28);
									__eflags =  *(_t366 + 0x21e8) - 2;
									 *((char*)(_t503 + 0x5f)) =  *(_t366 + 0x21e8) == 2;
									 *(_t498 + 0x1048) = _t268;
									 *((char*)(_t498 + 0x10e9)) = 1;
									 *(_t498 + 0x104c) =  *(_t503 + 0x58);
									 *(_t498 + 0x1084) = E00A6BEDC();
									 *(_t498 + 0x1050) = E00A6BEDC();
									_t274 =  *(_t498 + 0x1084) >> 0x00000003 & 0x00000001;
									__eflags = _t274;
									 *(_t498 + 0x1054) = _t461;
									 *(_t498 + 0x108a) = _t274;
									if(_t274 != 0) {
										 *(_t498 + 0x1050) = 0x7fffffff;
										 *(_t498 + 0x1054) = 0x7fffffff;
									}
									_t410 =  *(_t498 + 0x104c);
									_t481 =  *(_t498 + 0x1054);
									_t275 =  *(_t498 + 0x1048);
									_t463 =  *(_t498 + 0x1050);
									__eflags = _t410 - _t481;
									if(__eflags < 0) {
										L45:
										_t275 = _t463;
										_t410 = _t481;
										goto L46;
									} else {
										if(__eflags > 0) {
											L46:
											 *(_t498 + 0x105c) = _t410;
											 *(_t498 + 0x1058) = _t275;
											_t276 = E00A6BEDC();
											__eflags =  *(_t498 + 0x1084) & 0x00000002;
											 *((intOrPtr*)(_t498 + 0x1c)) = _t276;
											if(( *(_t498 + 0x1084) & 0x00000002) != 0) {
												E00A6F4CD(_t498 + 0x1030, E00A6BDDC(_t503 + 0x34), 0);
											}
											 *(_t498 + 0x1060) =  *(_t498 + 0x1060) & 0x00000000;
											__eflags =  *(_t498 + 0x1084) & 0x00000004;
											if(( *(_t498 + 0x1084) & 0x00000004) != 0) {
												 *(_t498 + 0x1060) = 2;
												 *((intOrPtr*)(_t498 + 0x1064)) = E00A6BDDC(_t503 + 0x34);
											}
											 *(_t498 + 0x10f0) =  *(_t498 + 0x10f0) & 0x00000000;
											_t277 = E00A6BEDC();
											 *(_t503 + 0x58) = _t277;
											 *(_t498 + 0x1a) = _t277 >> 0x00000007 & 0x00000007;
											 *((char*)(_t498 + 0x19)) = (_t277 & 0x0000003f) + 0x32;
											 *((char*)(_t498 + 0x18)) = E00A6BEDC();
											_t482 = E00A6BEDC();
											 *(_t498 + 0x10ec) = 2;
											_t282 =  *((intOrPtr*)(_t498 + 0x18));
											 *(_t498 + 0x10e8) =  *(_t366 + 0x21ec) >> 0x00000006 & 1;
											__eflags = _t282 - 1;
											if(_t282 != 1) {
												__eflags = _t282;
												if(_t282 == 0) {
													_t159 = _t498 + 0x10ec;
													 *_t159 =  *(_t498 + 0x10ec) & 0x00000000;
													__eflags =  *_t159;
												}
											} else {
												 *(_t498 + 0x10ec) = 1;
											}
											_t421 =  *(_t498 + 8);
											 *(_t498 + 0x1088) = _t421 >> 0x00000003 & 1;
											 *(_t498 + 0x10ea) = _t421 >> 0x00000005 & 1;
											__eflags =  *((char*)(_t503 + 0x5f));
											_t424 =  *(_t503 + 0x58);
											 *(_t498 + 0x1089) = _t421 >> 0x00000004 & 1;
											if( *((char*)(_t503 + 0x5f)) == 0) {
												L57:
												_t289 = 0;
												__eflags = 0;
												goto L58;
											} else {
												__eflags = _t424 & 0x00000040;
												if((_t424 & 0x00000040) == 0) {
													goto L57;
												}
												_t289 = 1;
												L58:
												 *((char*)(_t498 + 0x10e0)) = _t289;
												_t291 =  *(_t498 + 0x1084) & 1;
												 *(_t498 + 0x10e1) = _t291;
												_t467 = 0x20000 << (_t424 >> 0x0000000a & 0x0000000f);
												asm("sbb eax, eax");
												 *(_t498 + 0x10e4) =  !( ~(_t291 & 0x000000ff)) & 0x00020000 << (_t424 >> 0x0000000a & 0x0000000f);
												asm("sbb eax, eax");
												 *(_t498 + 0x108c) =  ~( *(_t498 + 0x108b) & 0x000000ff) & 0x00000005;
												__eflags = _t482 - 0x1fff;
												if(_t482 >= 0x1fff) {
													_t482 = 0x1fff;
												}
												E00A6BE3E(_t503 + 0x34, _t503 - 0x207c, _t482);
												 *((char*)(_t503 + _t482 - 0x207c)) = 0;
												_push(0x800);
												_t483 = _t498 + 0x20;
												_push(_t498 + 0x20);
												_push(_t503 - 0x207c);
												E00A6FD55();
												_t428 =  *(_t503 + 0x30);
												_t305 = _t428 |  *(_t503 + 0x2c);
												__eflags = _t428 |  *(_t503 + 0x2c);
												if((_t428 |  *(_t503 + 0x2c)) != 0) {
													_push(_t498);
													_push(_t428);
													_push(_t503 + 0x34);
													_t305 = E00A620A6(_t366);
												}
												__eflags =  *((char*)(_t503 + 0x5f));
												if( *((char*)(_t503 + 0x5f)) == 0) {
													_t306 = E00A816E0(_t305, _t483, L"CMT");
													__eflags = _t306;
													if(_t306 == 0) {
														 *((char*)(_t366 + 0x6cee)) = 1;
													}
												} else {
													E00A61FB5(_t366, _t467, _t498);
												}
												__eflags =  *(_t503 + 0x5e);
												if( *(_t503 + 0x5e) != 0) {
													E00A61F25(0x1a, _t366 + 0x1e, _t483);
												}
												goto L76;
											}
										}
										__eflags = _t275 - _t463;
										if(_t275 > _t463) {
											goto L46;
										}
										goto L45;
									}
								}
								__eflags = _t474 - 4;
								if(_t474 == 4) {
									_t436 = 5;
									memcpy(_t366 + 0x2248, _t366 + 0x21e4, _t436 << 2);
									_t316 = E00A6BEDC();
									__eflags = _t316;
									if(_t316 == 0) {
										 *(_t366 + 0x225c) = E00A6BEDC() & 0x00000001;
										_t320 = E00A6BD8F(_t503 + 0x34) & 0x000000ff;
										 *(_t366 + 0x2260) = _t320;
										__eflags = _t320 - 0x18;
										if(_t320 > 0x18) {
											goto L33;
										}
										E00A6BE3E(_t503 + 0x34, _t366 + 0x2264, 0x10);
										__eflags =  *(_t366 + 0x225c);
										if( *(_t366 + 0x225c) != 0) {
											E00A6BE3E(_t503 + 0x34, _t366 + 0x2274, 8);
											E00A6BE3E(_t503 + 0x34, _t503 + 0x58, 4);
											E00A6E222(_t503 - 0x7c);
											E00A6E268(_t503 - 0x7c, _t366 + 0x2274, 8);
											_push(_t503);
											E00A6E17B(_t503 - 0x7c);
											_t337 = E00A7D710(_t503 + 0x58, _t503, 4);
											asm("sbb al, al");
											_t339 =  ~_t337 + 1;
											__eflags = _t339;
											 *(_t366 + 0x225c) = _t339;
										}
										 *((char*)(_t366 + 0x6cf4)) = 1;
										goto L76;
									}
									L33:
									E00A63C6F(_t366, _t366 + 0x1e);
									goto L81;
								} else {
									__eflags = _t474 - 5;
									if(_t474 == 5) {
										_t445 = 5;
										memcpy(_t366 + 0x4580, _t366 + 0x21e4, _t445 << 2);
										 *(_t366 + 0x459c) = E00A6BEDC() & 0x00000001;
										 *((short*)(_t366 + 0x459e)) = 0;
										 *((char*)(_t366 + 0x459d)) = 0;
									}
									goto L76;
								}
							}
							_t451 = E00A6BEDC();
							 *(_t503 + 0x2c) = _t460;
							_t240 = 0;
							 *(_t503 + 0x30) = _t451;
							__eflags = _t460;
							if(__eflags < 0) {
								goto L24;
							}
							if(__eflags > 0) {
								goto L80;
							}
							__eflags = _t451 -  *((intOrPtr*)(_t366 + 0x21f0));
							if(_t451 >=  *((intOrPtr*)(_t366 + 0x21f0))) {
								goto L80;
							}
							goto L24;
						}
						E00A61F70(_t366);
						 *((char*)(_t366 + 0x6cfc)) = 1;
						E00A66ACC(0xa9bbf8, 3);
						__eflags =  *((char*)(_t503 + 0x5f));
						if( *((char*)(_t503 + 0x5f)) == 0) {
							goto L20;
						} else {
							E00A61F25(4, _t366 + 0x1e, _t366 + 0x1e);
							 *((char*)(_t366 + 0x6cfd)) = 1;
							goto L81;
						}
					}
					L11:
					E00A63C2E(_t366, _t460);
					goto L81;
				}
				_t460 =  *((intOrPtr*)(_t366 + 0x6cf8)) + 8;
				asm("adc eax, ecx");
				_t514 =  *((intOrPtr*)(_t366 + 0x6cdc));
				if(_t514 < 0 || _t514 <= 0 &&  *((intOrPtr*)(_t366 + 0x6cd8)) <= _t460) {
					goto L9;
				} else {
					 *((char*)(_t503 + 0x5f)) = 1;
					E00A63B17(_t366);
					_push(0x10);
					_push(_t503 + 0x10);
					if( *((intOrPtr*)( *_t366 + 8))() != 0x10) {
						goto L11;
					}
					_t502 = _t366 + 0x1024;
					E00A65F32(_t502, 0, 5,  *((intOrPtr*)(_t366 + 0x21bc)) + 0x4024, _t366 + 0x2264, _t503 + 0x10,  *(_t366 + 0x2260), 0, _t503 + 0x54);
					if( *(_t366 + 0x225c) == 0) {
						L8:
						 *((intOrPtr*)(_t503 + 0x50)) = _t502;
						goto L10;
					}
					_t361 = E00A7D710(_t503 + 0x54, _t366 + 0x2274, 8);
					_t505 = _t505 + 0xc;
					if(_t361 == 0) {
						goto L8;
					} else {
						E00A61546(6, _t366 + 0x1e);
						 *((char*)(_t366 + 0x6cfd)) = 1;
						E00A66ACC(0xa9bbf8, 0xb);
						goto L81;
					}
				}
			}

0x00a63087
0x00a63088
0x00a63090
0x00a6309a
0x00a630a1
0x00a630a8
0x00a630af
0x00a630b2
0x00a630bb
0x00a63187
0x00a63187
0x00a6318a
0x00a6318f
0x00a63194
0x00a63197
0x00a631a8
0x00a631b9
0x00a631c7
0x00a631c9
0x00a631d0
0x00a631d2
0x00a637d9
0x00a637db
0x00a637e0
0x00a637e3
0x00a637f1
0x00a637fc
0x00a637fc
0x00a631d8
0x00a631da
0x00000000
0x00000000
0x00a631e0
0x00a631e3
0x00a631e6
0x00a631e8
0x00a631e8
0x00a631ea
0x00000000
0x00000000
0x00a631f0
0x00a631f3
0x00000000
0x00000000
0x00a631fd
0x00a63202
0x00a63205
0x00000000
0x00000000
0x00a6320a
0x00a6321c
0x00a63222
0x00a63227
0x00a63232
0x00a63238
0x00a6323e
0x00a63244
0x00a6324a
0x00a63250
0x00a63253
0x00a63256
0x00a63258
0x00a63292
0x00a63292
0x00a63294
0x00a6329b
0x00a6329e
0x00a632a1
0x00a632cb
0x00a632cb
0x00a632d2
0x00a632d6
0x00a632d9
0x00a632dc
0x00a632e1
0x00a632e6
0x00a632e8
0x00a632ed
0x00a632ed
0x00a632f8
0x00a63305
0x00a63308
0x00a63310
0x00a63316
0x00a63318
0x00a63320
0x00a63327
0x00a63329
0x00a636f6
0x00a636fe
0x00a63705
0x00a6370c
0x00a63716
0x00a6371f
0x00a6372c
0x00a63740
0x00a63746
0x00a6374c
0x00a63750
0x00a63756
0x00a63757
0x00a6375d
0x00a63760
0x00a63777
0x00a63762
0x00a6376a
0x00a63770
0x00a63774
0x00a63774
0x00a6377d
0x00a63784
0x00a6378e
0x00a6378e
0x00000000
0x00a63786
0x00a63786
0x00a6378c
0x00a63790
0x00a63790
0x00a63793
0x00a6379b
0x00a6379e
0x00a637a6
0x00a637a7
0x00a637ad
0x00a637ae
0x00a637ae
0x00a637b3
0x00a637b9
0x00a637bf
0x00a637d1
0x00a637d4
0x00000000
0x00a637d4
0x00a637c1
0x00000000
0x00000000
0x00a637c9
0x00a637cf
0x00000000
0x00000000
0x00000000
0x00a637cf
0x00000000
0x00a6378c
0x00a63784
0x00a6332f
0x00000000
0x00000000
0x00a63335
0x00a63338
0x00a63459
0x00a6345c
0x00a63462
0x00a63464
0x00a63464
0x00a6346d
0x00a63470
0x00a63480
0x00a63481
0x00a63483
0x00a63489
0x00a63490
0x00a63494
0x00a6349d
0x00a634a4
0x00a634b2
0x00a634bd
0x00a634cc
0x00a634cc
0x00a634ce
0x00a634d4
0x00a634da
0x00a634e1
0x00a634e7
0x00a634e7
0x00a634ed
0x00a634f3
0x00a634f9
0x00a634ff
0x00a63505
0x00a63507
0x00a6350f
0x00a6350f
0x00a63511
0x00000000
0x00a63509
0x00a63509
0x00a63513
0x00a63513
0x00a6351c
0x00a63522
0x00a63527
0x00a6352e
0x00a63531
0x00a63544
0x00a63544
0x00a63549
0x00a63550
0x00a63557
0x00a6355c
0x00a6356b
0x00a6356b
0x00a63571
0x00a6357b
0x00a63582
0x00a6358f
0x00a63595
0x00a635a0
0x00a635b4
0x00a635b6
0x00a635c0
0x00a635c5
0x00a635cb
0x00a635cd
0x00a635d7
0x00a635d9
0x00a635db
0x00a635db
0x00a635db
0x00a635db
0x00a635cf
0x00a635cf
0x00a635cf
0x00a635e2
0x00a635ec
0x00a635fe
0x00a63604
0x00a63608
0x00a6360b
0x00a63611
0x00a6361c
0x00a6361c
0x00a6361c
0x00000000
0x00a63613
0x00a63613
0x00a63616
0x00000000
0x00000000
0x00a63618
0x00a6361e
0x00a6361e
0x00a6362a
0x00a6362f
0x00a63640
0x00a63644
0x00a6364a
0x00a63659
0x00a6365e
0x00a63669
0x00a6366b
0x00a6366d
0x00a6366d
0x00a6367a
0x00a6367f
0x00a6368d
0x00a63692
0x00a63695
0x00a63696
0x00a63697
0x00a6369c
0x00a636a1
0x00a636a1
0x00a636a4
0x00a636a6
0x00a636a7
0x00a636ad
0x00a636ae
0x00a636ae
0x00a636b3
0x00a636b7
0x00a636c9
0x00a636d0
0x00a636d2
0x00a636d4
0x00a636d4
0x00a636b9
0x00a636bc
0x00a636bc
0x00a636db
0x00a636df
0x00a636ec
0x00a636ec
0x00000000
0x00a636df
0x00a63611
0x00a6350b
0x00a6350d
0x00000000
0x00000000
0x00000000
0x00a6350d
0x00a63507
0x00a6333e
0x00a63341
0x00a63383
0x00a63390
0x00a63395
0x00a6339a
0x00a6339c
0x00a633bb
0x00a633c6
0x00a633c9
0x00a633cf
0x00a633d2
0x00000000
0x00000000
0x00a633e0
0x00a633e5
0x00a633ec
0x00a633fa
0x00a63408
0x00a63411
0x00a6341d
0x00a63425
0x00a6342a
0x00a63439
0x00a63443
0x00a63445
0x00a63445
0x00a63447
0x00a63447
0x00a6344d
0x00000000
0x00a6344d
0x00a6339e
0x00a633a4
0x00000000
0x00a63343
0x00a63343
0x00a63346
0x00a6334e
0x00a6335b
0x00a63369
0x00a6336f
0x00a63376
0x00a63376
0x00000000
0x00a63346
0x00a63341
0x00a632ab
0x00a632ad
0x00a632b0
0x00a632b2
0x00a632b5
0x00a632b7
0x00000000
0x00000000
0x00a632b9
0x00000000
0x00000000
0x00a632bf
0x00a632c5
0x00000000
0x00000000
0x00000000
0x00a632c5
0x00a6325c
0x00a63268
0x00a6326f
0x00a63274
0x00a63278
0x00000000
0x00a6327a
0x00a63281
0x00a63286
0x00000000
0x00a63286
0x00a63278
0x00a63199
0x00a6319b
0x00000000
0x00a6319b
0x00a630c9
0x00a630cc
0x00a630ce
0x00a630d4
0x00000000
0x00a630e8
0x00a630ea
0x00a630ee
0x00a630f8
0x00a630fa
0x00a63103
0x00000000
0x00000000
0x00a63127
0x00a63138
0x00a63144
0x00a63182
0x00a63182
0x00000000
0x00a63182
0x00a63153
0x00a63158
0x00a6315d
0x00000000
0x00a6315f
0x00a63165
0x00a63171
0x00a63178
0x00000000
0x00a63178
0x00a6315d

APIs

__EH_prolog.LIBCMT ref: 00A63090
_memcmp.LIBVCRUNTIME ref: 00A63153
_memcmp.LIBVCRUNTIME ref: 00A63439

Strings

CMT, xrefs: 00A636C3

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: _memcmp$H_prolog
String ID: CMT
API String ID: 212800410-2756464174
Opcode ID: 8391fd024488f74ad590226f10dc7af92f69b5d5abe442436ee5dc656d9defb6
Instruction ID: 4f4cf58aaaea34cd453d3784d604973701a6840f3ba547b9184cfb28dc5a1227
Opcode Fuzzy Hash: 8391fd024488f74ad590226f10dc7af92f69b5d5abe442436ee5dc656d9defb6
Instruction Fuzzy Hash: F222A3B26012849FDF14DF74C995AE937F5AF15300F08447EED8ACB286DB719A89CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A706C5 Relevance: 4.9, APIs: 3, Instructions: 420
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E00A706C5(void* __ecx, signed int __edx) {
				void* __edi;
				void* __esi;
				signed int _t203;
				void* _t204;
				signed int _t207;
				signed int _t208;
				signed int _t213;
				signed int _t218;
				signed int _t219;
				intOrPtr _t220;
				signed int _t221;
				signed char _t229;
				signed int _t259;
				signed int _t267;
				unsigned int _t269;
				signed int _t273;
				void* _t278;
				signed int _t284;
				signed int _t286;
				signed int _t288;
				intOrPtr* _t299;
				signed int _t300;
				signed char _t302;
				signed int _t303;
				void* _t304;
				signed int _t309;
				signed int _t319;
				signed char _t320;
				signed int _t325;
				signed char _t340;
				signed char _t343;
				signed int* _t345;
				signed int _t357;
				signed int* _t362;
				signed int _t363;
				signed int* _t364;
				signed char _t365;
				signed int _t366;
				signed int _t367;
				void* _t370;
				intOrPtr* _t372;
				signed int _t373;
				signed int _t374;
				intOrPtr* _t376;
				signed int _t377;
				void* _t378;
				void* _t380;
				void* _t381;
				void* _t382;
				void* _t384;

				_t355 = __edx;
				_t304 = __ecx;
				E00A7C16C(E00A8EED0, _t378);
				_t381 = _t380 - 0x30;
				_t199 =  *(_t378 + 0x10);
				_t370 = _t304;
				_t299 = _t370 + 0xe694;
				 *((intOrPtr*)(_t378 - 0x20)) = _t299;
				 *((intOrPtr*)(_t299 + 4)) = 0;
				 *_t299 = 0;
				if( *(_t378 + 0x10) > 0x8000) {
					_t199 = 0x8000;
				}
				E00A7EE90( *((intOrPtr*)(_t370 + 0xe6a0)),  *(_t378 + 0xc), _t199);
				_t382 = _t381 + 0xc;
				 *((intOrPtr*)(_t378 - 0x10)) = _t370 + 0xe65c;
				E00A6BB18(_t370 + 0xe65c);
				_t387 =  *(_t378 + 8) & 0x00000080;
				if(( *(_t378 + 8) & 0x00000080) == 0) {
					_t300 =  *(_t370 + 0xe6d4);
					goto L7;
				} else {
					_t300 = E00A6BC7E(_t387, _t299);
					 *(_t378 - 0x18) = _t300;
					if(_t300 != 0) {
						_t300 = _t300 - 1;
						L7:
						 *(_t378 - 0x18) = _t300;
						L8:
						_t203 =  *(_t370 + 0xe6a8);
						if(_t300 > _t203 || _t300 >  *((intOrPtr*)(_t370 + 0xe6c8))) {
							L18:
							_t204 = 0;
							goto L19;
						} else {
							 *(_t370 + 0xe6d4) = _t300;
							 *((char*)(_t378 + 0x13)) = _t300 == _t203;
							_t362 = E00A7C12B(_t355, _t370, _t300 - _t203, 0x70);
							 *(_t378 - 0x14) = _t362;
							if(_t362 == 0) {
								_t309 = 0;
								__eflags = 0;
								_t362 = 0;
								 *(_t378 - 0x14) = 0;
							} else {
								E00A702EC();
								_t309 = 0;
							}
							if( *((char*)(_t378 + 0x13)) == 0) {
								_t207 =  *( *((intOrPtr*)(_t370 + 0xe6a4)) + _t300 * 4);
								_t362[4] = _t300;
								 *(_t378 + 0xc) = _t207;
								_t46 = _t207 + 8;
								 *_t46 =  *(_t207 + 8) + 1;
								__eflags =  *_t46;
								goto L25;
							} else {
								if(_t300 <= 0x2000) {
									E00A7056B(_t370 + 0xe6a4, _t355, 1);
									_t288 = E00A7C12B(_t355, _t370, __eflags, 0x70);
									 *(_t378 + 0xc) = _t288;
									__eflags = _t288;
									if(_t288 == 0) {
										_t28 = _t378 + 0xc;
										 *_t28 =  *(_t378 + 0xc) & 0x00000000;
										__eflags =  *_t28;
									} else {
										E00A702EC();
									}
									_t355 =  *(_t378 + 0xc);
									 *( *((intOrPtr*)(_t370 + 0xe6a4)) +  *(_t370 + 0xe6a8) * 4 - 4) =  *(_t378 + 0xc);
									_t362[4] =  *(_t370 + 0xe6a8) - 1;
									E00A721C7(_t370 + 0xe6c4,  *(_t378 + 0xc), 0);
									_t309 = 0;
									 *( *(_t378 + 0xc) + 8) = 0;
									L25:
									__eflags =  *(_t370 + 0xe6b8);
									_t208 = _t309;
									 *(_t378 - 0x1c) = _t309;
									 *(_t378 - 0x24) = _t309;
									if( *(_t370 + 0xe6b8) <= 0) {
										L33:
										__eflags =  *(_t370 + 0xe6b8) - 0x2000;
										if( *(_t370 + 0xe6b8) > 0x2000) {
											L16:
											_t23 =  &(_t362[5]); // 0x14
											E00A7045E(_t23, _t370);
											_push(0x70);
											E00A7C15E(_t362);
											L17:
											goto L18;
										}
										E00A7056B(_t370 + 0xe6b4, _t355, 1);
										_t213 = 1;
										L36:
										 *( *(_t370 + 0xe6b4) + ( *(_t370 + 0xe6b8) - _t213) * 4) = _t362;
										_t362[2] =  *( *(_t378 + 0xc) + 8);
										_t218 = E00A6BC7E(__eflags, _t370 + 0xe694);
										__eflags =  *(_t378 + 8) & 0x00000040;
										_t356 = _t218;
										 *(_t378 - 0x24) = _t218;
										if(( *(_t378 + 8) & 0x00000040) != 0) {
											_t356 = _t356 + 0x102;
											__eflags = _t356;
											 *(_t378 - 0x24) = _t356;
										}
										__eflags =  *(_t378 + 8) & 0x00000020;
										 *_t362 =  *((intOrPtr*)(_t370 + 0x70)) + _t356 &  *(_t370 + 0xe6dc);
										if(__eflags == 0) {
											__eflags = _t300 -  *((intOrPtr*)(_t370 + 0xe6c8));
											if(_t300 >=  *((intOrPtr*)(_t370 + 0xe6c8))) {
												_t219 = 0;
												__eflags = 0;
											} else {
												_t219 =  *( *((intOrPtr*)(_t370 + 0xe6c4)) + _t300 * 4);
											}
											_t362[1] = _t219;
										} else {
											_t284 = E00A6BC7E(__eflags, _t370 + 0xe694);
											_t356 =  *(_t378 - 0x24);
											_t362[1] = _t284;
											 *( *((intOrPtr*)(_t370 + 0xe6c4)) + _t300 * 4) = _t284;
										}
										_t220 =  *((intOrPtr*)(_t370 + 0x74));
										__eflags = _t220 -  *((intOrPtr*)(_t370 + 0x70));
										if(_t220 ==  *((intOrPtr*)(_t370 + 0x70))) {
											L47:
											_t302 = 0;
											__eflags = 0;
											_t221 = 0;
											goto L48;
										} else {
											__eflags = (_t220 -  *((intOrPtr*)(_t370 + 0x70)) &  *(_t370 + 0xe6dc)) - _t356;
											if((_t220 -  *((intOrPtr*)(_t370 + 0x70)) &  *(_t370 + 0xe6dc)) > _t356) {
												goto L47;
											}
											_t221 = 1;
											_t302 = 0;
											L48:
											_t362[3] = _t221;
											_t104 =  &(_t362[0x13]); // 0x4c
											 *(_t378 - 0x18) = _t104;
											E00A7D1E0(_t362, _t104, _t302, 0x1c);
											_t372 =  *((intOrPtr*)(_t378 - 0x20));
											_t384 = _t382 + 0xc;
											__eflags =  *(_t378 + 8) & 0x00000010;
											_t362[0x16] = 0x3c000;
											_t362[0x17] = _t362[1];
											_t362[0x18] = _t362[2];
											 *(_t378 - 0x28) = 7;
											if(( *(_t378 + 8) & 0x00000010) == 0) {
												L54:
												__eflags =  *((char*)(_t378 + 0x13));
												if(__eflags == 0) {
													L62:
													_t319 =  *(_t378 + 0xc);
													_t362[9] =  *(_t319 + 0x14);
													_t362[0xa] =  *(_t319 + 0x28);
													_t320 =  *(_t319 + 0x40);
													 *(_t378 + 0x10) = _t320;
													__eflags = _t320 - 1 - 0x1ffe;
													if(_t320 - 1 <= 0x1ffe) {
														_t154 =  &(_t362[0xf]); // 0x3c
														E00A6183E(_t154, _t356, _t320);
														E00A7EE90(_t362[0xf],  *((intOrPtr*)( *(_t378 + 0xc) + 0x3c)),  *(_t378 + 0x10));
														_t384 = _t384 + 0xc;
													}
													__eflags = _t362[0xc] - 0x40;
													if(_t362[0xc] < 0x40) {
														_t160 =  &(_t362[0xb]); // 0x2c
														E00A65BD9(_t160);
														_t161 =  &(_t362[0xb]); // 0x2c
														E00A6183E(_t161, _t356, 0x40);
													}
													_t162 =  &(_t362[0xb]); // 0x2c
													_t229 = _t162;
													_t373 =  *_t229;
													_t363 = _t373;
													 *(_t378 + 0xc) = _t373;
													_t374 =  *(_t378 - 0x18);
													 *(_t378 + 0x10) = _t229;
													do {
														E00A6BD20(_t363,  *_t374);
														_t363 = _t363 + 4;
														_t374 = _t374 + 4;
														_t168 = _t378 - 0x28;
														 *_t168 =  *(_t378 - 0x28) - 1;
														__eflags =  *_t168;
													} while ( *_t168 != 0);
													_t364 =  *(_t378 - 0x14);
													_t375 =  *(_t378 + 0xc);
													E00A6BD20( *(_t378 + 0xc) + 0x1c, _t364[1]);
													E00A6BD20( *(_t378 + 0xc) + 0x20, _t302);
													E00A6BD20( *(_t378 + 0xc) + 0x2c, _t364[2]);
													E00A7D1E0(_t364, _t375 + 0x30, _t302, 0x10);
													__eflags =  *(_t378 + 8) & 0x00000008;
													if(( *(_t378 + 8) & 0x00000008) == 0) {
														L80:
														_t204 = 1;
														L19:
														 *[fs:0x0] =  *((intOrPtr*)(_t378 - 0xc));
														return _t204;
													}
													_t376 =  *((intOrPtr*)(_t378 - 0x20));
													__eflags =  *_t376 + 3 - 0x8000;
													if(__eflags >= 0) {
														goto L18;
													}
													_t325 = E00A6BC7E(__eflags, _t376);
													 *(_t378 + 8) = _t325;
													__eflags = _t325 - 0x1fc0;
													if(_t325 > 0x1fc0) {
														goto L18;
													}
													_t186 = _t325 + 0x40; // 0x40
													__eflags = _t364[0xc] - _t186;
													if(_t364[0xc] >= _t186) {
														_t365 =  *(_t378 + 0x10);
													} else {
														_t365 =  *(_t378 + 0x10);
														E00A6183E(_t365, _t356, _t325 - _t364[0xc] + 0x40);
														_t325 =  *(_t378 + 8);
													}
													 *(_t378 + 0x10) =  *_t365 + 0x40;
													__eflags = _t325;
													if(_t325 == 0) {
														goto L80;
													} else {
														_t366 =  *(_t378 + 8);
														while(1) {
															__eflags =  *_t376 + 3 - 0x8000;
															if( *_t376 + 3 >= 0x8000) {
																goto L18;
															}
															 *((char*)(_t302 +  *(_t378 + 0x10))) = E00A69E9A(_t376) >> 8;
															E00A69E83(_t376, 8);
															_t302 = _t302 + 1;
															__eflags = _t302 - _t366;
															if(_t302 < _t366) {
																continue;
															}
															goto L80;
														}
														goto L18;
													}
												}
												_t259 = E00A6BC7E(__eflags, _t372);
												 *(_t378 - 0x1c) = _t259;
												__eflags = _t259 - 0x10000;
												if(_t259 >= 0x10000) {
													goto L18;
												}
												__eflags = _t259;
												if(_t259 == 0) {
													goto L18;
												}
												_t130 = _t378 - 0x3c; // -59
												E00A61571(_t130, _t259);
												__eflags =  *(_t378 - 0x1c);
												 *(_t378 - 4) = _t302;
												 *(_t378 + 0x10) = _t302;
												if( *(_t378 - 0x1c) <= 0) {
													L60:
													_t377 =  *(_t378 - 0x3c);
													_push( *(_t378 + 0xc) + 0x14);
													E00A6BB72( *((intOrPtr*)(_t378 - 0x10)), _t356, _t377,  *(_t378 - 0x1c));
													 *(_t378 - 4) =  *(_t378 - 4) | 0xffffffff;
													__eflags = _t377;
													if(_t377 != 0) {
														L00A816D0(_t377);
													}
													goto L62;
												} else {
													goto L58;
												}
												while(1) {
													L58:
													__eflags =  *_t372 + 3 - 0x8000;
													if( *_t372 + 3 >= 0x8000) {
														break;
													}
													_t269 = E00A69E9A(_t372);
													_t356 =  *(_t378 + 0x10);
													 *((char*)( *(_t378 - 0x3c) +  *(_t378 + 0x10))) = _t269 >> 8;
													E00A69E83(_t372, 8);
													_t340 =  *(_t378 + 0x10) + 1;
													 *(_t378 + 0x10) = _t340;
													__eflags = _t340 -  *(_t378 - 0x1c);
													if(_t340 <  *(_t378 - 0x1c)) {
														continue;
													}
													goto L60;
												}
												_t267 =  *(_t378 - 0x3c);
												__eflags = _t267;
												if(_t267 == 0) {
													goto L18;
												}
												L00A816D0(_t267);
												goto L17;
											}
											_t273 = E00A69E9A(_t372) >> 9;
											__eflags = _t273;
											 *(_t378 - 0x2c) = _t273;
											E00A69E83(_t372, 7);
											_t357 =  *(_t378 - 0x18);
											_t343 = _t302;
											_t367 =  *(_t378 - 0x2c);
											 *(_t378 - 0x24) = _t343;
											 *(_t378 - 0x1c) = _t357;
											do {
												__eflags = _t367 & 1 << _t343;
												if(__eflags != 0) {
													_t278 = E00A6BC7E(__eflags, _t372);
													_t357 =  *(_t378 - 0x1c);
													_t343 =  *(_t378 - 0x24);
													 *_t357 = _t278;
												}
												_t343 = _t343 + 1;
												_t357 = _t357 + 4;
												 *(_t378 - 0x24) = _t343;
												 *(_t378 - 0x1c) = _t357;
												__eflags = _t343 - 7;
											} while (_t343 < 7);
											_t362 =  *(_t378 - 0x14);
											goto L54;
										}
									}
									_t345 = _t370 + 0xe6b4;
									__eflags = 0;
									_t303 = _t208;
									do {
										 *((intOrPtr*)( *_t345 + (_t208 - _t303) * 4)) =  *((intOrPtr*)( *_t345 + _t208 * 4));
										_t345 = _t370 + 0xe6b4;
										_t355 =  *_t345;
										_t286 =  *(_t378 - 0x24);
										__eflags =  *(_t355 + _t286 * 4);
										if( *(_t355 + _t286 * 4) == 0) {
											_t303 = _t303 + 1;
											__eflags = _t303;
										}
										__eflags = _t303;
										if(_t303 > 0) {
											 *(_t355 + _t286 * 4) = 0;
										}
										_t208 = _t286 + 1;
										 *(_t378 - 0x24) = _t208;
										__eflags = _t208 -  *(_t370 + 0xe6b8);
									} while (_t208 <  *(_t370 + 0xe6b8));
									_t362 =  *(_t378 - 0x14);
									__eflags = _t303;
									 *(_t378 - 0x1c) = _t303;
									_t300 =  *(_t378 - 0x18);
									if(__eflags != 0) {
										_t213 =  *(_t378 - 0x1c);
										goto L36;
									}
									goto L33;
								}
								if(_t362 == 0) {
									goto L18;
								}
								goto L16;
							}
						}
					}
					E00A71838(_t370, 0);
					goto L8;
				}
			}

0x00a706c5
0x00a706c5
0x00a706ca
0x00a706cf
0x00a706d2
0x00a706d7
0x00a706e1
0x00a706e7
0x00a706ea
0x00a706ed
0x00a706f1
0x00a706f3
0x00a706f3
0x00a706ff
0x00a7070a
0x00a7070f
0x00a70712
0x00a70717
0x00a7071b
0x00a70739
0x00000000
0x00a7071d
0x00a70723
0x00a70725
0x00a7072a
0x00a70736
0x00a7073f
0x00a7073f
0x00a70742
0x00a70742
0x00a7074a
0x00a707ac
0x00a707ac
0x00000000
0x00a70754
0x00a70756
0x00a7075e
0x00a70767
0x00a70769
0x00a7076f
0x00a7077d
0x00a7077d
0x00a7077f
0x00a70781
0x00a70771
0x00a70774
0x00a70779
0x00a70779
0x00a70788
0x00a70825
0x00a70828
0x00a7082b
0x00a7082e
0x00a7082e
0x00a7082e
0x00000000
0x00a7078e
0x00a70794
0x00a707c9
0x00a707d0
0x00a707d5
0x00a707d9
0x00a707db
0x00a707e7
0x00a707e7
0x00a707e7
0x00a707dd
0x00a707e0
0x00a707e0
0x00a707f7
0x00a707fc
0x00a7080d
0x00a70810
0x00a70818
0x00a7081a
0x00a70831
0x00a70831
0x00a70838
0x00a7083a
0x00a7083d
0x00a70840
0x00a70889
0x00a70889
0x00a70893
0x00a7079a
0x00a7079a
0x00a7079d
0x00a707a2
0x00a707a5
0x00a707ab
0x00000000
0x00a707ab
0x00a708a1
0x00a708a8
0x00a708ae
0x00a708bc
0x00a708c5
0x00a708cf
0x00a708d4
0x00a708d8
0x00a708da
0x00a708dd
0x00a708df
0x00a708df
0x00a708e5
0x00a708e5
0x00a708f3
0x00a708f7
0x00a708f9
0x00a70918
0x00a7091e
0x00a7092b
0x00a7092b
0x00a70920
0x00a70926
0x00a70926
0x00a7092d
0x00a708fb
0x00a70902
0x00a70907
0x00a7090a
0x00a70913
0x00a70913
0x00a70930
0x00a70933
0x00a70936
0x00a7094c
0x00a7094c
0x00a7094c
0x00a7094e
0x00000000
0x00a70938
0x00a70941
0x00a70943
0x00000000
0x00000000
0x00a70947
0x00a70948
0x00a70950
0x00a70952
0x00a70955
0x00a7095a
0x00a7095d
0x00a70962
0x00a70965
0x00a70968
0x00a7096c
0x00a70976
0x00a7097c
0x00a7097f
0x00a70986
0x00a709d5
0x00a709d5
0x00a709d9
0x00a70a6d
0x00a70a6d
0x00a70a73
0x00a70a79
0x00a70a7c
0x00a70a7f
0x00a70a85
0x00a70a8a
0x00a70a8d
0x00a70a90
0x00a70aa1
0x00a70aa6
0x00a70aa6
0x00a70aa9
0x00a70aad
0x00a70aaf
0x00a70ab2
0x00a70ab9
0x00a70abc
0x00a70abc
0x00a70ac1
0x00a70ac1
0x00a70ac4
0x00a70ac6
0x00a70ac8
0x00a70acb
0x00a70ace
0x00a70ad1
0x00a70ad7
0x00a70adc
0x00a70adf
0x00a70ae2
0x00a70ae2
0x00a70ae2
0x00a70ae2
0x00a70ae8
0x00a70aeb
0x00a70af8
0x00a70b05
0x00a70b14
0x00a70b20
0x00a70b28
0x00a70b2c
0x00a70bd2
0x00a70bd2
0x00a707ae
0x00a707b4
0x00a707be
0x00a707be
0x00a70b32
0x00a70b3a
0x00a70b3f
0x00000000
0x00000000
0x00a70b4b
0x00a70b4d
0x00a70b50
0x00a70b56
0x00000000
0x00000000
0x00a70b5c
0x00a70b5f
0x00a70b62
0x00a70b92
0x00a70b64
0x00a70b69
0x00a70b72
0x00a70b77
0x00a70b77
0x00a70b9a
0x00a70b9d
0x00a70b9f
0x00000000
0x00a70ba1
0x00a70ba1
0x00a70ba4
0x00a70ba9
0x00a70bae
0x00000000
0x00000000
0x00a70bc3
0x00a70bc8
0x00a70bcd
0x00a70bce
0x00a70bd0
0x00000000
0x00000000
0x00000000
0x00a70bd0
0x00000000
0x00a70ba4
0x00a70b9f
0x00a709e0
0x00a709e5
0x00a709e8
0x00a709ed
0x00000000
0x00000000
0x00a709f3
0x00a709f5
0x00000000
0x00000000
0x00a709fc
0x00a709ff
0x00a70a04
0x00a70a08
0x00a70a0b
0x00a70a0e
0x00a70a48
0x00a70a4b
0x00a70a54
0x00a70a59
0x00a70a5e
0x00a70a62
0x00a70a64
0x00a70a67
0x00a70a6c
0x00000000
0x00000000
0x00000000
0x00000000
0x00a70a10
0x00a70a10
0x00a70a15
0x00a70a1a
0x00000000
0x00000000
0x00a70a22
0x00a70a2a
0x00a70a32
0x00a70a37
0x00a70a3f
0x00a70a40
0x00a70a43
0x00a70a46
0x00000000
0x00000000
0x00000000
0x00a70a46
0x00a70b7c
0x00a70b7f
0x00a70b81
0x00000000
0x00000000
0x00a70b88
0x00000000
0x00a70b88
0x00a7098f
0x00a7098f
0x00a70996
0x00a70999
0x00a7099e
0x00a709a1
0x00a709a3
0x00a709a6
0x00a709a9
0x00a709ac
0x00a709b1
0x00a709b3
0x00a709b6
0x00a709bb
0x00a709be
0x00a709c1
0x00a709c1
0x00a709c3
0x00a709c4
0x00a709c7
0x00a709ca
0x00a709cd
0x00a709cd
0x00a709d2
0x00000000
0x00a709d2
0x00a70936
0x00a70842
0x00a70848
0x00a7084a
0x00a7084c
0x00a70855
0x00a70858
0x00a7085e
0x00a70860
0x00a70863
0x00a70866
0x00a70868
0x00a70868
0x00a70868
0x00a70869
0x00a7086b
0x00a7086d
0x00a7086d
0x00a70870
0x00a70871
0x00a70874
0x00a70874
0x00a7087c
0x00a7087f
0x00a70881
0x00a70884
0x00a70887
0x00a708ab
0x00000000
0x00a708ab
0x00000000
0x00a70887
0x00a70798
0x00000000
0x00000000
0x00000000
0x00a70798
0x00a70788
0x00a7074a
0x00a7072f
0x00000000
0x00a7072f

APIs

__EH_prolog.LIBCMT ref: 00A706CA
new.LIBCMT ref: 00A70762
new.LIBCMT ref: 00A707D0

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 79df969527530a3d357e8fa04269cfb3d2f328eac6f06199312735b82f72c1f2
Instruction ID: bcb15aec49868a54843b412622d1d889b5cd4c26d17d4f2fad0121403681f589
Opcode Fuzzy Hash: 79df969527530a3d357e8fa04269cfb3d2f328eac6f06199312735b82f72c1f2
Instruction Fuzzy Hash: 16F19D71A00649DFDB18DF68C981AAEB7F5FF58340F14C82DE95AA7381DB31A941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A8533D Relevance: 4.6, APIs: 3, Instructions: 78
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 86%

			E00A8533D(intOrPtr __ebx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				intOrPtr _v808;
				char _v812;
				signed int _t40;
				char* _t47;
				intOrPtr _t49;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t66;
				intOrPtr _t67;
				int _t68;
				intOrPtr _t69;
				signed int _t70;

				_t69 = __esi;
				_t67 = __edi;
				_t66 = __edx;
				_t61 = __ebx;
				_t40 =  *0xa991b8; // 0x3197ea2d
				_t41 = _t40 ^ _t70;
				_v8 = _t40 ^ _t70;
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E00A7CF4B(_t41);
					_pop(_t62);
				}
				E00A7D1E0(_t67,  &_v804, 0, 0x50);
				E00A7D1E0(_t67,  &_v724, 0, 0x2cc);
				_v812 =  &_v804;
				_t47 =  &_v724;
				_v808 = _t47;
				_v548 = _t47;
				_v552 = _t62;
				_v556 = _t66;
				_v560 = _t61;
				_v564 = _t69;
				_v568 = _t67;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_v540 = _v0;
				_t25 =  &_v0; // 0x1b
				_t49 = _t25;
				_v528 = _t49;
				_v724 = 0x10001;
				_v544 =  *((intOrPtr*)(_t49 - 4));
				_v804 = _a8;
				_v800 = _a12;
				_v792 = _v0;
				_t68 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				_t36 =  &_v812; // -785
				if(UnhandledExceptionFilter(_t36) == 0 && _t68 == 0 && _a4 != 0xffffffff) {
					_push(_a4);
					E00A7CF4B(_t57);
				}
				return E00A7CABF(_v8 ^ _t70);
			}

0x00a8533d
0x00a8533d
0x00a8533d
0x00a8533d
0x00a85348
0x00a8534d
0x00a8534f
0x00a85357
0x00a85359
0x00a8535c
0x00a85361
0x00a85361
0x00a8536d
0x00a85380
0x00a8538e
0x00a85394
0x00a8539a
0x00a853a0
0x00a853a6
0x00a853ac
0x00a853b2
0x00a853b8
0x00a853be
0x00a853c4
0x00a853cb
0x00a853d2
0x00a853d9
0x00a853e0
0x00a853e7
0x00a853ee
0x00a853ef
0x00a853f8
0x00a853fe
0x00a853fe
0x00a85401
0x00a85407
0x00a85414
0x00a8541d
0x00a85426
0x00a8542f
0x00a8543d
0x00a8543f
0x00a85445
0x00a85454
0x00a85460
0x00a85463
0x00a85468
0x00a85477

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00A85435
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00A8543F
UnhandledExceptionFilter.KERNEL32(-00000311,?,?,?,?,?,00000000), ref: 00A8544C

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 25db3feff83b8caa2839a05aec13e2da1d5a8b7a7d5a4c03dc30a4e14c9b9961
Instruction ID: 2d4cc19de9f5c1babbf2f41404923ce63a23ea5fd6188c309086358624cd55d6
Opcode Fuzzy Hash: 25db3feff83b8caa2839a05aec13e2da1d5a8b7a7d5a4c03dc30a4e14c9b9961
Instruction Fuzzy Hash: E531D47490121DABCB61DF68DD8978CBBB9BF08311F5082EAE81CA7251E7709F818F44

Uniqueness

Uniqueness Score: -1.00%

Function 00A84299 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00A84299(int _a4) {
				void* _t14;
				void* _t16;

				if(E00A872FC(_t14, _t16) != 0 && ( *( *[fs:0x30] + 0x68) >> 0x00000008 & 0x00000001) == 0) {
					TerminateProcess(GetCurrentProcess(), _a4);
				}
				E00A842DA(_t14, _t16, _a4);
				ExitProcess(_a4);
			}

0x00a842a5
0x00a842c1
0x00a842c1
0x00a842ca
0x00a842d3

APIs

GetCurrentProcess.KERNEL32(?,?,00A8426F,?,00A97048,0000000C,00A84382,?,00000002,00000000), ref: 00A842BA
TerminateProcess.KERNEL32(00000000,?,00A8426F,?,00A97048,0000000C,00A84382,?,00000002,00000000), ref: 00A842C1
ExitProcess.KERNEL32 ref: 00A842D3

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 487d108b63d3bde97d255fb1faaff00132f7fecbe741e074e5c60bc8412d0f45
Instruction ID: 825ff0199e8b969897abce25dcf49f3c6094fa52497a543cf2292f73e6f880a8
Opcode Fuzzy Hash: 487d108b63d3bde97d255fb1faaff00132f7fecbe741e074e5c60bc8412d0f45
Instruction Fuzzy Hash: 1BE0B63110864AAFCF11BFA4DE09A983F79FB88351F500524F9098A522EB35ED92DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00A87561 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00A87561(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				signed int _v12;
				intOrPtr* _v32;
				CHAR* _v36;
				signed int _v48;
				char _v286;
				signed int _v287;
				struct _WIN32_FIND_DATAA _v332;
				intOrPtr* _v336;
				signed int _v340;
				signed int _v344;
				intOrPtr _v372;
				signed int _t35;
				signed int _t40;
				signed int _t43;
				intOrPtr _t45;
				signed char _t47;
				intOrPtr* _t55;
				union _FINDEX_INFO_LEVELS _t57;
				signed int _t62;
				signed int _t65;
				void* _t72;
				void* _t74;
				signed int _t75;
				void* _t78;
				CHAR* _t79;
				intOrPtr* _t83;
				intOrPtr _t85;
				void* _t87;
				intOrPtr* _t88;
				signed int _t92;
				signed int _t96;
				void* _t101;
				intOrPtr _t102;
				signed int _t105;
				union _FINDEX_INFO_LEVELS _t106;
				void* _t111;
				intOrPtr _t112;
				void* _t113;
				signed int _t118;
				void* _t119;
				signed int _t120;
				void* _t121;
				void* _t122;

				_push(__ecx);
				_t83 = _a4;
				_t2 = _t83 + 1; // 0x1
				_t101 = _t2;
				do {
					_t35 =  *_t83;
					_t83 = _t83 + 1;
				} while (_t35 != 0);
				_push(__edi);
				_t105 = _a12;
				_t85 = _t83 - _t101 + 1;
				_v8 = _t85;
				if(_t85 <= (_t35 | 0xffffffff) - _t105) {
					_push(__ebx);
					_push(__esi);
					_t5 = _t105 + 1; // 0x1
					_t78 = _t5 + _t85;
					_t111 = E00A85277(_t85, _t78, 1);
					_pop(_t87);
					__eflags = _t105;
					if(_t105 == 0) {
						L6:
						_push(_v8);
						_t78 = _t78 - _t105;
						_t40 = E00A8B76B(_t87, _t111 + _t105, _t78, _a4);
						_t120 = _t119 + 0x10;
						__eflags = _t40;
						if(__eflags != 0) {
							goto L9;
						} else {
							_t72 = E00A877A0(_a16, _t101, __eflags, _t111);
							E00A851AC(0);
							_t74 = _t72;
							goto L8;
						}
					} else {
						_push(_t105);
						_t75 = E00A8B76B(_t87, _t111, _t78, _a8);
						_t120 = _t119 + 0x10;
						__eflags = _t75;
						if(_t75 != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E00A85517();
							asm("int3");
							_t118 = _t120;
							_t121 = _t120 - 0x150;
							_t43 =  *0xa991b8; // 0x3197ea2d
							_v48 = _t43 ^ _t118;
							_t88 = _v32;
							_push(_t78);
							_t79 = _v36;
							_push(_t111);
							_t112 = _v332.cAlternateFileName;
							_push(_t105);
							_v372 = _t112;
							while(1) {
								__eflags = _t88 - _t79;
								if(_t88 == _t79) {
									break;
								}
								_t45 =  *_t88;
								__eflags = _t45 - 0x2f;
								if(_t45 != 0x2f) {
									__eflags = _t45 - 0x5c;
									if(_t45 != 0x5c) {
										__eflags = _t45 - 0x3a;
										if(_t45 != 0x3a) {
											_t88 = E00A8B7C0(_t79, _t88);
											continue;
										}
									}
								}
								break;
							}
							_t102 =  *_t88;
							__eflags = _t102 - 0x3a;
							if(_t102 != 0x3a) {
								L19:
								_t106 = 0;
								__eflags = _t102 - 0x2f;
								if(_t102 == 0x2f) {
									L23:
									_t47 = 1;
									__eflags = 1;
								} else {
									__eflags = _t102 - 0x5c;
									if(_t102 == 0x5c) {
										goto L23;
									} else {
										__eflags = _t102 - 0x3a;
										if(_t102 == 0x3a) {
											goto L23;
										} else {
											_t47 = 0;
										}
									}
								}
								_t90 = _t88 - _t79 + 1;
								asm("sbb eax, eax");
								_v340 =  ~(_t47 & 0x000000ff) & _t88 - _t79 + 0x00000001;
								E00A7D1E0(_t106,  &_v332, _t106, 0x140);
								_t122 = _t121 + 0xc;
								_t113 = FindFirstFileExA(_t79, _t106,  &_v332, _t106, _t106, _t106);
								_t55 = _v336;
								__eflags = _t113 - 0xffffffff;
								if(_t113 != 0xffffffff) {
									_t92 =  *((intOrPtr*)(_t55 + 4)) -  *_t55;
									__eflags = _t92;
									_t93 = _t92 >> 2;
									_v344 = _t92 >> 2;
									do {
										__eflags = _v332.cFileName - 0x2e;
										if(_v332.cFileName != 0x2e) {
											L36:
											_push(_t55);
											_t57 = E00A87561(_t79, _t93, _t106, _t113,  &(_v332.cFileName), _t79, _v340);
											_t122 = _t122 + 0x10;
											__eflags = _t57;
											if(_t57 != 0) {
												goto L26;
											} else {
												goto L37;
											}
										} else {
											_t93 = _v287;
											__eflags = _t93;
											if(_t93 == 0) {
												goto L37;
											} else {
												__eflags = _t93 - 0x2e;
												if(_t93 != 0x2e) {
													goto L36;
												} else {
													__eflags = _v286;
													if(_v286 == 0) {
														goto L37;
													} else {
														goto L36;
													}
												}
											}
										}
										goto L40;
										L37:
										_t62 = FindNextFileA(_t113,  &_v332);
										__eflags = _t62;
										_t55 = _v336;
									} while (_t62 != 0);
									_t103 =  *_t55;
									_t96 = _v344;
									_t65 =  *((intOrPtr*)(_t55 + 4)) -  *_t55 >> 2;
									__eflags = _t96 - _t65;
									if(_t96 != _t65) {
										E00A8B320(_t79, _t106, _t113, _t103 + _t96 * 4, _t65 - _t96, 4, E00A873B9);
									}
								} else {
									_push(_t55);
									_t57 = E00A87561(_t79, _t90, _t106, _t113, _t79, _t106, _t106);
									L26:
									_t106 = _t57;
								}
								__eflags = _t113 - 0xffffffff;
								if(_t113 != 0xffffffff) {
									FindClose(_t113);
								}
							} else {
								__eflags = _t88 -  &(_t79[1]);
								if(_t88 ==  &(_t79[1])) {
									goto L19;
								} else {
									_push(_t112);
									E00A87561(_t79, _t88, 0, _t112, _t79, 0, 0);
								}
							}
							__eflags = _v12 ^ _t118;
							return E00A7CABF(_v12 ^ _t118);
						} else {
							goto L6;
						}
					}
				} else {
					_t74 = 0xc;
					L8:
					return _t74;
				}
				L40:
			}

0x00a87566
0x00a87567
0x00a8756a
0x00a8756a
0x00a8756d
0x00a8756d
0x00a8756f
0x00a87570
0x00a87579
0x00a8757a
0x00a8757d
0x00a87580
0x00a87585
0x00a8758c
0x00a8758d
0x00a8758e
0x00a87591
0x00a8759b
0x00a8759e
0x00a8759f
0x00a875a1
0x00a875b5
0x00a875b5
0x00a875b8
0x00a875c2
0x00a875c7
0x00a875ca
0x00a875cc
0x00000000
0x00a875ce
0x00a875d2
0x00a875db
0x00a875e1
0x00000000
0x00a875e4
0x00a875a3
0x00a875a3
0x00a875a9
0x00a875ae
0x00a875b1
0x00a875b3
0x00a875ea
0x00a875ec
0x00a875ed
0x00a875ee
0x00a875ef
0x00a875f0
0x00a875f1
0x00a875f6
0x00a875fa
0x00a875fc
0x00a87602
0x00a87609
0x00a8760c
0x00a8760f
0x00a87610
0x00a87613
0x00a87614
0x00a87617
0x00a87618
0x00a87639
0x00a87639
0x00a8763b
0x00000000
0x00000000
0x00a87620
0x00a87622
0x00a87624
0x00a87626
0x00a87628
0x00a8762a
0x00a8762c
0x00a87637
0x00000000
0x00a87637
0x00a8762c
0x00a87628
0x00000000
0x00a87624
0x00a8763d
0x00a8763f
0x00a87642
0x00a8765b
0x00a8765b
0x00a8765d
0x00a87660
0x00a87670
0x00a87672
0x00a87672
0x00a87662
0x00a87662
0x00a87665
0x00000000
0x00a87667
0x00a87667
0x00a8766a
0x00000000
0x00a8766c
0x00a8766c
0x00a8766c
0x00a8766a
0x00a87665
0x00a87678
0x00a87680
0x00a87684
0x00a87692
0x00a87697
0x00a876ac
0x00a876ae
0x00a876b4
0x00a876b7
0x00a876e9
0x00a876e9
0x00a876eb
0x00a876ee
0x00a876f4
0x00a876f4
0x00a876fb
0x00a87715
0x00a87715
0x00a87724
0x00a87729
0x00a8772c
0x00a8772e
0x00000000
0x00000000
0x00000000
0x00000000
0x00a876fd
0x00a876fd
0x00a87703
0x00a87705
0x00000000
0x00a87707
0x00a87707
0x00a8770a
0x00000000
0x00a8770c
0x00a8770c
0x00a87713
0x00000000
0x00000000
0x00000000
0x00000000
0x00a87713
0x00a8770a
0x00a87705
0x00000000
0x00a87730
0x00a87738
0x00a8773e
0x00a87740
0x00a87740
0x00a87748
0x00a8774d
0x00a87755
0x00a87758
0x00a8775a
0x00a8776e
0x00a87773
0x00a876b9
0x00a876b9
0x00a876bd
0x00a876c5
0x00a876c5
0x00a876c5
0x00a876c7
0x00a876ca
0x00a876cd
0x00a876cd
0x00a87644
0x00a87647
0x00a87649
0x00000000
0x00a8764b
0x00a8764b
0x00a87651
0x00a87656
0x00a87649
0x00a876da
0x00a876e5
0x00000000
0x00000000
0x00000000
0x00a875b3
0x00a87587
0x00a87589
0x00a875e5
0x00a875e9
0x00a875e9
0x00000000

Strings

., xrefs: 00A876F4

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 8a3701e323867a3a4b91b0b45b2025b73fb38efc6c071915e0ff44fd6dc5e93b
Instruction ID: 088f2a4d64812b4dd07d3fd95d933477b3f4a8d6aeee684db218376032812c65
Opcode Fuzzy Hash: 8a3701e323867a3a4b91b0b45b2025b73fb38efc6c071915e0ff44fd6dc5e93b
Instruction Fuzzy Hash: DD31D271904249ABCB28EF78CC85EFE7BBDDB85314F2402A9E91997251E630DE458B60

Uniqueness

Uniqueness Score: -1.00%

Function 00A89630 Relevance: 3.5, APIs: 2, Instructions: 464
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 90%

			E00A89630(signed int* _a4, signed int* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int* _v80;
				char _v540;
				signed int _v544;
				signed int _t197;
				signed int _t198;
				signed int* _t200;
				signed int _t201;
				signed int _t204;
				signed int _t206;
				signed int _t208;
				signed int _t209;
				signed int _t213;
				signed int _t219;
				intOrPtr _t225;
				void* _t228;
				signed int _t230;
				signed int _t247;
				signed int _t250;
				void* _t253;
				signed int _t256;
				signed int* _t262;
				signed int _t263;
				signed int _t264;
				void* _t265;
				intOrPtr* _t266;
				signed int _t267;
				signed int _t269;
				signed int _t270;
				signed int _t271;
				signed int _t272;
				signed int* _t274;
				signed int* _t278;
				signed int _t279;
				signed int _t280;
				intOrPtr _t282;
				void* _t286;
				signed char _t292;
				signed int _t295;
				signed int _t303;
				signed int _t306;
				signed int _t307;
				signed int _t309;
				signed int _t311;
				signed int _t313;
				intOrPtr* _t314;
				signed int _t318;
				signed int _t322;
				signed int* _t328;
				signed int _t330;
				signed int _t331;
				signed int _t333;
				void* _t334;
				signed int _t336;
				signed int _t338;
				signed int _t341;
				signed int _t342;
				signed int* _t344;
				signed int _t349;
				signed int _t351;
				void* _t355;
				signed int _t359;
				signed int _t360;
				signed int _t362;
				signed int* _t368;
				signed int* _t369;
				signed int* _t370;
				signed int* _t373;

				_t262 = _a4;
				_t197 =  *_t262;
				if(_t197 != 0) {
					_t328 = _a8;
					_t267 =  *_t328;
					__eflags = _t267;
					if(_t267 != 0) {
						_t3 = _t197 - 1; // -1
						_t349 = _t3;
						_t4 = _t267 - 1; // -1
						_t198 = _t4;
						_v16 = _t349;
						__eflags = _t198;
						if(_t198 != 0) {
							__eflags = _t198 - _t349;
							if(_t198 > _t349) {
								L23:
								__eflags = 0;
								return 0;
							} else {
								_t46 = _t198 + 1; // 0x0
								_t306 = _t349 - _t198;
								_v60 = _t46;
								_t269 = _t349;
								__eflags = _t349 - _t306;
								if(_t349 < _t306) {
									L21:
									_t306 = _t306 + 1;
									__eflags = _t306;
								} else {
									_t368 =  &(_t262[_t349 + 1]);
									_t341 =  &(( &(_t328[_t269 - _t306]))[1]);
									__eflags = _t341;
									while(1) {
										__eflags =  *_t341 -  *_t368;
										if( *_t341 !=  *_t368) {
											break;
										}
										_t269 = _t269 - 1;
										_t341 = _t341 - 4;
										_t368 = _t368 - 4;
										__eflags = _t269 - _t306;
										if(_t269 >= _t306) {
											continue;
										} else {
											goto L21;
										}
										goto L22;
									}
									_t369 = _a8;
									_t54 = (_t269 - _t306) * 4; // 0xfc23b5a
									__eflags =  *((intOrPtr*)(_t369 + _t54 + 4)) -  *((intOrPtr*)(_t262 + 4 + _t269 * 4));
									if( *((intOrPtr*)(_t369 + _t54 + 4)) <  *((intOrPtr*)(_t262 + 4 + _t269 * 4))) {
										goto L21;
									}
								}
								L22:
								__eflags = _t306;
								if(__eflags != 0) {
									_t330 = _v60;
									_t200 = _a8;
									_t351 =  *(_t200 + _t330 * 4);
									_t64 = _t330 * 4; // 0xffffe9e5
									_t201 =  *((intOrPtr*)(_t200 + _t64 - 4));
									_v36 = _t201;
									asm("bsr eax, esi");
									_v56 = _t351;
									if(__eflags == 0) {
										_t270 = 0x20;
									} else {
										_t270 = 0x1f - _t201;
									}
									_v40 = _t270;
									_v64 = 0x20 - _t270;
									__eflags = _t270;
									if(_t270 != 0) {
										_t292 = _v40;
										_v36 = _v36 << _t292;
										_v56 = _t351 << _t292 | _v36 >> _v64;
										__eflags = _t330 - 2;
										if(_t330 > 2) {
											_t79 = _t330 * 4; // 0xe850ffff
											_t81 =  &_v36;
											 *_t81 = _v36 |  *(_a8 + _t79 - 8) >> _v64;
											__eflags =  *_t81;
										}
									}
									_v76 = 0;
									_t307 = _t306 + 0xffffffff;
									__eflags = _t307;
									_v32 = _t307;
									if(_t307 < 0) {
										_t331 = 0;
										__eflags = 0;
									} else {
										_t85 =  &(_t262[1]); // 0x4
										_v20 =  &(_t85[_t307]);
										_t206 = _t307 + _t330;
										_t90 = _t262 - 4; // -4
										_v12 = _t206;
										_t278 = _t90 + _t206 * 4;
										_v80 = _t278;
										do {
											__eflags = _t206 - _v16;
											if(_t206 > _v16) {
												_t207 = 0;
												__eflags = 0;
											} else {
												_t207 = _t278[2];
											}
											__eflags = _v40;
											_t311 = _t278[1];
											_t279 =  *_t278;
											_v52 = _t207;
											_v44 = 0;
											_v8 = _t207;
											_v24 = _t279;
											if(_v40 > 0) {
												_t318 = _v8;
												_t336 = _t279 >> _v64;
												_t230 = E00A7C6A0(_t311, _v40, _t318);
												_t279 = _v40;
												_t207 = _t318;
												_t311 = _t336 | _t230;
												_t359 = _v24 << _t279;
												__eflags = _v12 - 3;
												_v8 = _t318;
												_v24 = _t359;
												if(_v12 >= 3) {
													_t279 = _v64;
													_t360 = _t359 |  *(_t262 + (_v60 + _v32) * 4 - 8) >> _t279;
													__eflags = _t360;
													_t207 = _v8;
													_v24 = _t360;
												}
											}
											_t208 = E00A8E800(_t311, _t207, _v56, 0);
											_v44 = _t262;
											_t263 = _t208;
											_v44 = 0;
											_t209 = _t311;
											_v8 = _t263;
											_v28 = _t209;
											_t333 = _t279;
											_v72 = _t263;
											_v68 = _t209;
											__eflags = _t209;
											if(_t209 != 0) {
												L40:
												_t264 = _t263 + 1;
												asm("adc eax, 0xffffffff");
												_t333 = _t333 + E00A7C6C0(_t264, _t209, _v56, 0);
												asm("adc esi, edx");
												_t263 = _t264 | 0xffffffff;
												_t209 = 0;
												__eflags = 0;
												_v44 = 0;
												_v8 = _t263;
												_v72 = _t263;
												_v28 = 0;
												_v68 = 0;
											} else {
												__eflags = _t263 - 0xffffffff;
												if(_t263 > 0xffffffff) {
													goto L40;
												}
											}
											__eflags = 0;
											if(0 <= 0) {
												if(0 < 0) {
													goto L44;
												} else {
													__eflags = _t333 - 0xffffffff;
													if(_t333 <= 0xffffffff) {
														while(1) {
															L44:
															_v8 = _v24;
															_t228 = E00A7C6C0(_v36, 0, _t263, _t209);
															__eflags = _t311 - _t333;
															if(__eflags < 0) {
																break;
															}
															if(__eflags > 0) {
																L47:
																_t209 = _v28;
																_t263 = _t263 + 0xffffffff;
																_v72 = _t263;
																asm("adc eax, 0xffffffff");
																_t333 = _t333 + _v56;
																__eflags = _t333;
																_v28 = _t209;
																asm("adc dword [ebp-0x28], 0x0");
																_v68 = _t209;
																if(_t333 == 0) {
																	__eflags = _t333 - 0xffffffff;
																	if(_t333 <= 0xffffffff) {
																		continue;
																	} else {
																	}
																}
															} else {
																__eflags = _t228 - _v8;
																if(_t228 <= _v8) {
																	break;
																} else {
																	goto L47;
																}
															}
															L51:
															_v8 = _t263;
															goto L52;
														}
														_t209 = _v28;
														goto L51;
													}
												}
											}
											L52:
											__eflags = _t209;
											if(_t209 != 0) {
												L54:
												_t280 = _v60;
												_t334 = 0;
												_t355 = 0;
												__eflags = _t280;
												if(_t280 != 0) {
													_t266 = _v20;
													_t219 =  &(_a8[1]);
													__eflags = _t219;
													_v24 = _t219;
													_v16 = _t280;
													do {
														_v44 =  *_t219;
														_t225 =  *_t266;
														_t286 = _t334 + _v72 * _v44;
														asm("adc esi, edx");
														_t334 = _t355;
														_t355 = 0;
														__eflags = _t225 - _t286;
														if(_t225 < _t286) {
															_t334 = _t334 + 1;
															asm("adc esi, esi");
														}
														 *_t266 = _t225 - _t286;
														_t266 = _t266 + 4;
														_t219 = _v24 + 4;
														_t164 =  &_v16;
														 *_t164 = _v16 - 1;
														__eflags =  *_t164;
														_v24 = _t219;
													} while ( *_t164 != 0);
													_t263 = _v8;
													_t280 = _v60;
												}
												__eflags = 0 - _t355;
												if(__eflags <= 0) {
													if(__eflags < 0) {
														L63:
														__eflags = _t280;
														if(_t280 != 0) {
															_t338 = _t280;
															_t314 = _v20;
															_t362 =  &(_a8[1]);
															__eflags = _t362;
															_t265 = 0;
															do {
																_t282 =  *_t314;
																_t172 = _t362 + 4; // 0xa6a5959
																_t362 = _t172;
																_t314 = _t314 + 4;
																asm("adc eax, eax");
																 *((intOrPtr*)(_t314 - 4)) = _t282 +  *((intOrPtr*)(_t362 - 4)) + _t265;
																asm("adc eax, 0x0");
																_t265 = 0;
																_t338 = _t338 - 1;
																__eflags = _t338;
															} while (_t338 != 0);
															_t263 = _v8;
														}
														_t263 = _t263 + 0xffffffff;
														asm("adc dword [ebp-0x18], 0xffffffff");
													} else {
														__eflags = _v52 - _t334;
														if(_v52 < _t334) {
															goto L63;
														}
													}
												}
												_t213 = _v12 - 1;
												__eflags = _t213;
												_v16 = _t213;
											} else {
												__eflags = _t263;
												if(_t263 != 0) {
													goto L54;
												}
											}
											_t331 = 0 + _t263;
											asm("adc esi, 0x0");
											_v20 = _v20 - 4;
											_t313 = _v32 - 1;
											_t262 = _a4;
											_t278 = _v80 - 4;
											_t206 = _v12 - 1;
											_v76 = _t331;
											_v32 = _t313;
											_v80 = _t278;
											_v12 = _t206;
											__eflags = _t313;
										} while (_t313 >= 0);
									}
									_t309 = _v16 + 1;
									_t204 = _t309;
									__eflags = _t204 -  *_t262;
									if(_t204 <  *_t262) {
										_t191 = _t204 + 1; // 0xa8ac4d
										_t274 =  &(_t262[_t191]);
										do {
											 *_t274 = 0;
											_t194 =  &(_t274[1]); // 0x91850fc2
											_t274 = _t194;
											_t204 = _t204 + 1;
											__eflags = _t204 -  *_t262;
										} while (_t204 <  *_t262);
									}
									 *_t262 = _t309;
									__eflags = _t309;
									if(_t309 != 0) {
										while(1) {
											_t271 =  *_t262;
											__eflags = _t262[_t271];
											if(_t262[_t271] != 0) {
												goto L78;
											}
											_t272 = _t271 + 0xffffffff;
											__eflags = _t272;
											 *_t262 = _t272;
											if(_t272 != 0) {
												continue;
											}
											goto L78;
										}
									}
									L78:
									return _t331;
								} else {
									goto L23;
								}
							}
						} else {
							_t6 =  &(_t328[1]); // 0xfc23b5a
							_t295 =  *_t6;
							_v44 = _t295;
							__eflags = _t295 - 1;
							if(_t295 != 1) {
								__eflags = _t349;
								if(_t349 != 0) {
									_t342 = 0;
									_v12 = 0;
									_v8 = 0;
									_v20 = 0;
									__eflags = _t349 - 0xffffffff;
									if(_t349 != 0xffffffff) {
										_t250 = _v16 + 1;
										__eflags = _t250;
										_v32 = _t250;
										_t373 =  &(_t262[_t349 + 1]);
										do {
											_t253 = E00A8E800( *_t373, _t342, _t295, 0);
											_v68 = _t303;
											_t373 = _t373 - 4;
											_v20 = _t262;
											_t342 = _t295;
											_t303 = 0 + _t253;
											asm("adc ecx, 0x0");
											_v12 = _t303;
											_t34 =  &_v32;
											 *_t34 = _v32 - 1;
											__eflags =  *_t34;
											_v8 = _v12;
											_t295 = _v44;
										} while ( *_t34 != 0);
										_t262 = _a4;
									}
									_v544 = 0;
									_t41 =  &(_t262[1]); // 0x4
									_t370 = _t41;
									 *_t262 = 0;
									E00A87FF2(_t370, 0x1cc,  &_v540, 0);
									_t247 = _v20;
									__eflags = 0 - _t247;
									 *_t370 = _t342;
									_t262[2] = _t247;
									asm("sbb ecx, ecx");
									__eflags =  ~0x00000000;
									 *_t262 = 0xbadbae;
									return _v12;
								} else {
									_t14 =  &(_t262[1]); // 0x4
									_t344 = _t14;
									_v544 = 0;
									 *_t262 = 0;
									E00A87FF2(_t344, 0x1cc,  &_v540, 0);
									_t256 = _t262[1];
									_t322 = _t256 % _v44;
									__eflags = 0 - _t322;
									 *_t344 = _t322;
									asm("sbb ecx, ecx");
									__eflags = 0;
									 *_t262 =  ~0x00000000;
									return _t256 / _v44;
								}
							} else {
								_t9 =  &(_t262[1]); // 0x4
								_v544 = _t198;
								 *_t262 = _t198;
								E00A87FF2(_t9, 0x1cc,  &_v540, _t198);
								__eflags = 0;
								return _t262[1];
							}
						}
					} else {
						__eflags = 0;
						return 0;
					}
				} else {
					return _t197;
				}
			}

0x00a8963c
0x00a8963f
0x00a89643
0x00a8964d
0x00a89650
0x00a89652
0x00a89654
0x00a89661
0x00a89661
0x00a89664
0x00a89664
0x00a89667
0x00a8966a
0x00a8966c
0x00a8979f
0x00a897a1
0x00a897ea
0x00a897ee
0x00a897f4
0x00a897a3
0x00a897a5
0x00a897a8
0x00a897aa
0x00a897ad
0x00a897af
0x00a897b1
0x00a897e5
0x00a897e5
0x00a897e5
0x00a897b3
0x00a897b8
0x00a897be
0x00a897be
0x00a897c1
0x00a897c3
0x00a897c5
0x00000000
0x00000000
0x00a897c7
0x00a897c8
0x00a897cb
0x00a897ce
0x00a897d0
0x00000000
0x00a897d2
0x00000000
0x00a897d2
0x00000000
0x00a897d0
0x00a897d4
0x00a897db
0x00a897df
0x00a897e3
0x00000000
0x00000000
0x00a897e3
0x00a897e6
0x00a897e6
0x00a897e8
0x00a897f5
0x00a897f8
0x00a897fb
0x00a897fe
0x00a897fe
0x00a89802
0x00a89805
0x00a89808
0x00a8980b
0x00a89816
0x00a8980d
0x00a89812
0x00a89812
0x00a89820
0x00a89825
0x00a89828
0x00a8982a
0x00a89834
0x00a89837
0x00a8983e
0x00a89841
0x00a89844
0x00a8984c
0x00a89852
0x00a89852
0x00a89852
0x00a89852
0x00a89844
0x00a89857
0x00a8985e
0x00a8985e
0x00a89861
0x00a89864
0x00a89a96
0x00a89a96
0x00a8986a
0x00a8986a
0x00a89870
0x00a89873
0x00a89876
0x00a89879
0x00a8987c
0x00a8987f
0x00a89882
0x00a89882
0x00a89885
0x00a8988c
0x00a8988c
0x00a89887
0x00a89887
0x00a89887
0x00a8988e
0x00a89892
0x00a89895
0x00a89897
0x00a8989a
0x00a898a1
0x00a898a4
0x00a898a7
0x00a898b2
0x00a898b5
0x00a898ba
0x00a898bf
0x00a898c6
0x00a898cb
0x00a898cd
0x00a898cf
0x00a898d3
0x00a898d6
0x00a898d9
0x00a898e1
0x00a898ea
0x00a898ea
0x00a898ec
0x00a898ef
0x00a898ef
0x00a898d9
0x00a898f9
0x00a898fe
0x00a89903
0x00a89905
0x00a89908
0x00a8990a
0x00a8990d
0x00a89910
0x00a89912
0x00a89915
0x00a89918
0x00a8991a
0x00a89921
0x00a89926
0x00a89929
0x00a89933
0x00a89935
0x00a89937
0x00a8993a
0x00a8993a
0x00a8993c
0x00a8993f
0x00a89942
0x00a89945
0x00a89948
0x00a8991c
0x00a8991c
0x00a8991f
0x00000000
0x00000000
0x00a8991f
0x00a8994b
0x00a8994d
0x00a8994f
0x00000000
0x00a89951
0x00a89951
0x00a89954
0x00a89956
0x00a89956
0x00a89964
0x00a89967
0x00a8996c
0x00a8996e
0x00000000
0x00000000
0x00a89970
0x00a89977
0x00a89977
0x00a8997a
0x00a8997d
0x00a89980
0x00a89983
0x00a89983
0x00a89986
0x00a89989
0x00a8998d
0x00a89990
0x00a89992
0x00a89995
0x00000000
0x00000000
0x00a89997
0x00a89995
0x00a89972
0x00a89972
0x00a89975
0x00000000
0x00000000
0x00000000
0x00000000
0x00a89975
0x00a8999c
0x00a8999c
0x00000000
0x00a8999c
0x00a89999
0x00000000
0x00a89999
0x00a89954
0x00a8994f
0x00a8999f
0x00a8999f
0x00a899a1
0x00a899ab
0x00a899ab
0x00a899ae
0x00a899b0
0x00a899b2
0x00a899b4
0x00a899b9
0x00a899bc
0x00a899bc
0x00a899bf
0x00a899c2
0x00a899c5
0x00a899c7
0x00a899dc
0x00a899de
0x00a899e0
0x00a899e2
0x00a899e4
0x00a899e6
0x00a899e8
0x00a899ea
0x00a899ed
0x00a899ed
0x00a899f1
0x00a899f3
0x00a899f9
0x00a899fc
0x00a899fc
0x00a899fc
0x00a89a00
0x00a89a00
0x00a89a05
0x00a89a08
0x00a89a08
0x00a89a0d
0x00a89a0f
0x00a89a11
0x00a89a18
0x00a89a18
0x00a89a1a
0x00a89a1f
0x00a89a21
0x00a89a24
0x00a89a24
0x00a89a27
0x00a89a30
0x00a89a30
0x00a89a32
0x00a89a32
0x00a89a37
0x00a89a3d
0x00a89a41
0x00a89a44
0x00a89a47
0x00a89a49
0x00a89a49
0x00a89a49
0x00a89a4e
0x00a89a4e
0x00a89a51
0x00a89a54
0x00a89a13
0x00a89a13
0x00a89a16
0x00000000
0x00000000
0x00a89a16
0x00a89a11
0x00a89a5b
0x00a89a5b
0x00a89a5c
0x00a899a3
0x00a899a3
0x00a899a5
0x00000000
0x00000000
0x00a899a5
0x00a89a6c
0x00a89a71
0x00a89a74
0x00a89a78
0x00a89a79
0x00a89a7c
0x00a89a7f
0x00a89a80
0x00a89a83
0x00a89a86
0x00a89a89
0x00a89a8c
0x00a89a8c
0x00a89a94
0x00a89a9b
0x00a89a9c
0x00a89a9e
0x00a89aa0
0x00a89aa2
0x00a89aa5
0x00a89ab0
0x00a89ab0
0x00a89ab6
0x00a89ab6
0x00a89ab9
0x00a89aba
0x00a89aba
0x00a89ab0
0x00a89abe
0x00a89ac0
0x00a89ac2
0x00a89ac4
0x00a89ac4
0x00a89ac6
0x00a89aca
0x00000000
0x00000000
0x00a89acc
0x00a89acc
0x00a89acf
0x00a89ad1
0x00000000
0x00000000
0x00000000
0x00a89ad1
0x00a89ac4
0x00a89ad3
0x00a89add
0x00000000
0x00000000
0x00000000
0x00a897e8
0x00a89672
0x00a89672
0x00a89672
0x00a89675
0x00a89678
0x00a8967b
0x00a896ac
0x00a896ae
0x00a896f9
0x00a896fb
0x00a89702
0x00a89709
0x00a8970c
0x00a8970f
0x00a89715
0x00a89715
0x00a89716
0x00a89719
0x00a89720
0x00a89729
0x00a8972e
0x00a89731
0x00a89736
0x00a89739
0x00a8973b
0x00a89740
0x00a89743
0x00a89746
0x00a89746
0x00a89746
0x00a8974a
0x00a8974d
0x00a8974d
0x00a89752
0x00a89752
0x00a8975d
0x00a89768
0x00a89768
0x00a8976b
0x00a89777
0x00a8977c
0x00a89787
0x00a89789
0x00a8978b
0x00a89791
0x00a89796
0x00a89798
0x00a8979e
0x00a896b0
0x00a896bc
0x00a896bc
0x00a896bf
0x00a896cf
0x00a896d5
0x00a896dc
0x00a896de
0x00a896e6
0x00a896e8
0x00a896ea
0x00a896ef
0x00a896f2
0x00a896f8
0x00a896f8
0x00a8967d
0x00a89680
0x00a89684
0x00a8968a
0x00a89699
0x00a896a3
0x00a896ab
0x00a896ab
0x00a8967b
0x00a89656
0x00a89659
0x00a8965f
0x00a8965f
0x00a89645
0x00a8964b
0x00a8964b

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f2f477c779f4b8d0f3ff13c95348de62827b760202d440d10669c9d8274b83c
Instruction ID: 641f836c0c846a0a8e2dca20ae1f2dce0ecd6516f19fdef3fc36970cf89aaf20
Opcode Fuzzy Hash: 9f2f477c779f4b8d0f3ff13c95348de62827b760202d440d10669c9d8274b83c
Instruction Fuzzy Hash: 82020B71E002199BDF18DFA9C9806AEFBF5EF88314F298169D919E7284D731A941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A78830 Relevance: 3.0, APIs: 2, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A78830(intOrPtr _a4, intOrPtr _a8, short* _a12, int _a16) {
				short _v104;
				short _v304;
				short* _t23;
				int _t24;

				if( *0xa99160 == 0) {
					GetLocaleInfoW(0x400, 0xf,  &_v304, 0x64);
					 *0xab5e2c = _v304;
					 *0xab5e2e = 0;
					 *0xa99160 = 0xab5e2c;
				}
				E00A6E767(_a4, _a8,  &_v104, 0x32);
				_t23 = _a12;
				_t24 = _a16;
				 *_t23 = 0;
				GetNumberFormatW(0x400, 0,  &_v104, 0xa99150, _t23, _t24);
				 *((short*)(_t23 + _t24 * 2 - 2)) = 0;
				return 0;
			}

0x00a78848
0x00a78856
0x00a78863
0x00a7886b
0x00a78871
0x00a78871
0x00a78887
0x00a7888c
0x00a78891
0x00a7889b
0x00a788a5
0x00a788ad
0x00a788b8

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00A78856
GetNumberFormatW.KERNEL32 ref: 00A788A5

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: ce35112bbb640e4bc1fa5aa635207c6d8b5dbcdbc8ab5f366170ed640c561997
Instruction ID: db406cb8971d3b9a03ac2905733efc0130c3c332a8f32cec71269ae4bf6ce119
Opcode Fuzzy Hash: ce35112bbb640e4bc1fa5aa635207c6d8b5dbcdbc8ab5f366170ed640c561997
Instruction Fuzzy Hash: 8D014C39600209BADB10DFB5DC09F9B77BCFF09710F104526FA0897261D3719915CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00A8E064 Relevance: 1.8, APIs: 1, Instructions: 269
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 100%

			E00A8E064(long _a4, signed int* _a8, signed char _a12, signed int _a16, intOrPtr* _a20, unsigned int* _a24, intOrPtr _a28) {
				signed int _t172;
				signed int _t175;
				signed int _t178;
				signed int* _t179;
				signed int _t195;
				signed int _t199;
				signed int _t202;
				void* _t203;
				void* _t206;
				signed int _t209;
				void* _t210;
				signed int _t225;
				unsigned int* _t240;
				signed char _t242;
				signed int* _t250;
				unsigned int* _t256;
				signed int* _t257;
				signed char _t259;
				long _t262;
				signed int* _t265;

				 *(_a4 + 4) = 0;
				_t262 = 0xc000000d;
				 *(_a4 + 8) = 0;
				 *(_a4 + 0xc) = 0;
				_t242 = _a12;
				if((_t242 & 0x00000010) != 0) {
					_t262 = 0xc000008f;
					 *(_a4 + 4) =  *(_a4 + 4) | 1;
				}
				if((_t242 & 0x00000002) != 0) {
					_t262 = 0xc0000093;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000002;
				}
				if((_t242 & 0x00000001) != 0) {
					_t262 = 0xc0000091;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000004;
				}
				if((_t242 & 0x00000004) != 0) {
					_t262 = 0xc000008e;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
				}
				if((_t242 & 0x00000008) != 0) {
					_t262 = 0xc0000090;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000010;
				}
				_t265 = _a8;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 << 4) ^  *(_a4 + 8)) & 0x00000010;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 +  *_t265) ^  *(_a4 + 8)) & 0x00000008;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 1) ^  *(_a4 + 8)) & 0x00000004;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 3) ^  *(_a4 + 8)) & 0x00000002;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 5) ^  *(_a4 + 8)) & 1;
				_t259 = E00A8B9B6(_a4);
				if((_t259 & 0x00000001) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000010;
				}
				if((_t259 & 0x00000004) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000008;
				}
				if((_t259 & 0x00000008) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000004;
				}
				if((_t259 & 0x00000010) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000002;
				}
				if((_t259 & 0x00000020) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 1;
				}
				_t172 =  *_t265 & 0x00000c00;
				if(_t172 == 0) {
					 *_a4 =  *_a4 & 0xfffffffc;
				} else {
					if(_t172 == 0x400) {
						_t257 = _a4;
						_t225 =  *_t257 & 0xfffffffd | 1;
						L26:
						 *_t257 = _t225;
						L29:
						_t175 =  *_t265 & 0x00000300;
						if(_t175 == 0) {
							_t250 = _a4;
							_t178 =  *_t250 & 0xffffffeb | 0x00000008;
							L35:
							 *_t250 = _t178;
							L36:
							_t179 = _a4;
							_t254 = (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *_t179 =  *_t179 ^ (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *(_a4 + 0x20) =  *(_a4 + 0x20) | 1;
							if(_a28 == 0) {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe3 | 0x00000002;
								 *((long long*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t254 = _a4;
								_t240 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe3 | 0x00000002;
								 *(_a4 + 0x50) =  *_t240;
							} else {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe1;
								 *((intOrPtr*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t240 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe1;
								 *(_a4 + 0x50) =  *_t240;
							}
							E00A8B91C(_t254);
							RaiseException(_t262, 0, 1,  &_a4);
							_t256 = _a4;
							if((_t256[2] & 0x00000010) != 0) {
								 *_t265 =  *_t265 & 0xfffffffe;
							}
							if((_t256[2] & 0x00000008) != 0) {
								 *_t265 =  *_t265 & 0xfffffffb;
							}
							if((_t256[2] & 0x00000004) != 0) {
								 *_t265 =  *_t265 & 0xfffffff7;
							}
							if((_t256[2] & 0x00000002) != 0) {
								 *_t265 =  *_t265 & 0xffffffef;
							}
							if((_t256[2] & 0x00000001) != 0) {
								 *_t265 =  *_t265 & 0xffffffdf;
							}
							_t195 =  *_t256 & 0x00000003;
							if(_t195 == 0) {
								 *_t265 =  *_t265 & 0xfffff3ff;
							} else {
								_t206 = _t195 - 1;
								if(_t206 == 0) {
									_t209 =  *_t265 & 0xfffff7ff | 0x00000400;
									L55:
									 *_t265 = _t209;
									L58:
									_t199 =  *_t256 >> 0x00000002 & 0x00000007;
									if(_t199 == 0) {
										_t202 =  *_t265 & 0xfffff3ff | 0x00000300;
										L64:
										 *_t265 = _t202;
										L65:
										if(_a28 == 0) {
											 *_t240 = _t256[0x14];
										} else {
											 *_t240 = _t256[0x14];
										}
										return _t202;
									}
									_t203 = _t199 - 1;
									if(_t203 == 0) {
										_t202 =  *_t265 & 0xfffff3ff | 0x00000200;
										goto L64;
									}
									_t202 = _t203 - 1;
									if(_t202 == 0) {
										 *_t265 =  *_t265 & 0xfffff3ff;
									}
									goto L65;
								}
								_t210 = _t206 - 1;
								if(_t210 == 0) {
									_t209 =  *_t265 & 0xfffffbff | 0x00000800;
									goto L55;
								}
								if(_t210 == 1) {
									 *_t265 =  *_t265 | 0x00000c00;
								}
							}
							goto L58;
						}
						if(_t175 == 0x200) {
							_t250 = _a4;
							_t178 =  *_t250 & 0xffffffe7 | 0x00000004;
							goto L35;
						}
						if(_t175 == 0x300) {
							 *_a4 =  *_a4 & 0xffffffe3;
						}
						goto L36;
					}
					if(_t172 == 0x800) {
						_t257 = _a4;
						_t225 =  *_t257 & 0xfffffffe | 0x00000002;
						goto L26;
					}
					if(_t172 == 0xc00) {
						 *_a4 =  *_a4 | 0x00000003;
					}
				}
			}

0x00a8e072
0x00a8e079
0x00a8e07e
0x00a8e084
0x00a8e087
0x00a8e08d
0x00a8e092
0x00a8e097
0x00a8e097
0x00a8e09d
0x00a8e0a2
0x00a8e0a7
0x00a8e0a7
0x00a8e0ae
0x00a8e0b3
0x00a8e0b8
0x00a8e0b8
0x00a8e0bf
0x00a8e0c4
0x00a8e0c9
0x00a8e0c9
0x00a8e0d0
0x00a8e0d5
0x00a8e0da
0x00a8e0da
0x00a8e0e2
0x00a8e0f2
0x00a8e104
0x00a8e116
0x00a8e129
0x00a8e13b
0x00a8e143
0x00a8e148
0x00a8e14d
0x00a8e14d
0x00a8e154
0x00a8e159
0x00a8e159
0x00a8e160
0x00a8e165
0x00a8e165
0x00a8e16c
0x00a8e171
0x00a8e171
0x00a8e178
0x00a8e17d
0x00a8e17d
0x00a8e187
0x00a8e189
0x00a8e1c3
0x00a8e18b
0x00a8e190
0x00a8e1b4
0x00a8e1bc
0x00a8e1b0
0x00a8e1b0
0x00a8e1c6
0x00a8e1cd
0x00a8e1cf
0x00a8e1f1
0x00a8e1f9
0x00a8e1fc
0x00a8e1fc
0x00a8e1fe
0x00a8e1fe
0x00a8e209
0x00a8e20f
0x00a8e214
0x00a8e21b
0x00a8e255
0x00a8e260
0x00a8e266
0x00a8e269
0x00a8e26c
0x00a8e278
0x00a8e280
0x00a8e21d
0x00a8e220
0x00a8e22c
0x00a8e232
0x00a8e238
0x00a8e23b
0x00a8e244
0x00a8e244
0x00a8e283
0x00a8e291
0x00a8e297
0x00a8e29e
0x00a8e2a0
0x00a8e2a0
0x00a8e2a7
0x00a8e2a9
0x00a8e2a9
0x00a8e2b0
0x00a8e2b2
0x00a8e2b2
0x00a8e2b9
0x00a8e2bb
0x00a8e2bb
0x00a8e2c2
0x00a8e2c4
0x00a8e2c4
0x00a8e2d1
0x00a8e2d4
0x00a8e30b
0x00a8e2d6
0x00a8e2d6
0x00a8e2d9
0x00a8e304
0x00a8e2f9
0x00a8e2f9
0x00a8e30d
0x00a8e315
0x00a8e318
0x00a8e337
0x00a8e33c
0x00a8e33c
0x00a8e33e
0x00a8e343
0x00a8e34f
0x00a8e345
0x00a8e348
0x00a8e348
0x00a8e354
0x00a8e354
0x00a8e31a
0x00a8e31d
0x00a8e32c
0x00000000
0x00a8e32c
0x00a8e31f
0x00a8e322
0x00a8e324
0x00a8e324
0x00000000
0x00a8e322
0x00a8e2db
0x00a8e2de
0x00a8e2f4
0x00000000
0x00a8e2f4
0x00a8e2e3
0x00a8e2e5
0x00a8e2e5
0x00a8e2e3
0x00000000
0x00a8e2d4
0x00a8e1d6
0x00a8e1e4
0x00a8e1ec
0x00000000
0x00a8e1ec
0x00a8e1da
0x00a8e1df
0x00a8e1df
0x00000000
0x00a8e1da
0x00a8e197
0x00a8e1a5
0x00a8e1ad
0x00000000
0x00a8e1ad
0x00a8e19b
0x00a8e1a0
0x00a8e1a0
0x00a8e19b

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00A8E05F,?,?,00000008,?,?,00A8DCFF,00000000), ref: 00A8E291

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: afd341e44b538eb0eedba28400a22c3c8286538ec3831ff90edd490907186c5a
Instruction ID: bc8a4d76d44f0489ab31d193af93861dd4f8bc08c9ee1014819478fc3918d78a
Opcode Fuzzy Hash: afd341e44b538eb0eedba28400a22c3c8286538ec3831ff90edd490907186c5a
Instruction Fuzzy Hash: C5B14931610608DFDB15DF28C48ABA57BF1FF45364F298698E899CF2A1C335E992CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00A63D4C Relevance: 1.6, Strings: 1, Instructions: 332
COMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E00A63D4C() {
				void* _t230;
				signed int* _t231;
				intOrPtr _t240;
				signed int _t245;
				intOrPtr _t246;
				signed int _t257;
				intOrPtr _t258;
				signed int _t269;
				intOrPtr _t270;
				signed int _t275;
				signed int _t280;
				signed int _t285;
				signed int _t290;
				signed int _t295;
				intOrPtr _t296;
				signed int _t301;
				intOrPtr _t302;
				signed int _t307;
				intOrPtr _t308;
				signed int _t313;
				intOrPtr _t314;
				signed int _t319;
				signed int _t324;
				signed int _t329;
				signed int _t333;
				signed int _t334;
				signed int _t336;
				signed int _t337;
				signed int _t338;
				signed int _t340;
				signed int _t341;
				signed int _t342;
				signed int _t348;
				signed int _t350;
				signed int _t351;
				signed int _t353;
				signed int _t355;
				signed int _t356;
				signed int _t358;
				signed int _t360;
				signed int _t362;
				signed int _t363;
				signed int _t365;
				signed int _t366;
				signed int _t368;
				signed int _t369;
				signed int _t371;
				signed int _t372;
				signed int _t374;
				signed int _t375;
				intOrPtr _t376;
				intOrPtr _t377;
				signed int _t379;
				signed int _t381;
				intOrPtr _t383;
				signed int _t385;
				signed int _t386;
				signed int _t388;
				signed int _t389;
				signed int _t390;
				signed int _t391;
				signed int _t392;
				signed int _t393;
				signed int _t394;
				signed int _t395;
				intOrPtr _t396;
				signed int _t398;
				intOrPtr _t399;
				signed int _t407;
				signed int _t409;
				signed int _t411;
				signed int _t412;
				signed int _t414;
				signed int _t418;
				signed int _t420;
				signed int _t422;
				signed int _t423;
				signed int _t425;
				signed int _t427;
				signed int _t429;
				intOrPtr _t431;
				signed int _t433;
				intOrPtr _t434;
				void* _t435;
				void* _t436;
				void* _t437;

				_t377 =  *((intOrPtr*)(_t435 + 0xc0));
				_t342 = 0x10;
				 *((intOrPtr*)(_t435 + 0x18)) = 0x3c6ef372;
				memcpy(_t435 + 0x8c,  *(_t435 + 0xd0), _t342 << 2);
				_t436 = _t435 + 0xc;
				_push(8);
				_t230 = memcpy(_t436 + 0x4c,  *(_t377 + 0xf4), 0 << 2);
				_t437 = _t436 + 0xc;
				_t418 =  *_t230 ^ 0x510e527f;
				_t231 =  *(_t377 + 0xfc);
				_t407 =  *(_t230 + 4) ^ 0x9b05688c;
				_t334 =  *(_t437 + 0x64);
				 *(_t437 + 0x28) = 0x6a09e667;
				 *(_t437 + 0x30) = 0xbb67ae85;
				_t379 =  *_t231 ^ 0x1f83d9ab;
				_t348 =  *(_t437 + 0x5c);
				 *(_t437 + 0x44) = _t231[1] ^ 0x5be0cd19;
				 *(_t437 + 0x3c) =  *(_t437 + 0x68);
				 *(_t437 + 0x1c) =  *(_t437 + 0x60);
				 *(_t437 + 0x2c) =  *(_t437 + 0x58);
				 *(_t437 + 0x38) =  *(_t437 + 0x54);
				 *(_t437 + 0x20) =  *(_t437 + 0x50);
				 *((intOrPtr*)(_t437 + 0x10)) = 0;
				 *((intOrPtr*)(_t437 + 0x48)) = 0;
				_t427 =  *(_t437 + 0x44);
				 *(_t437 + 0x14) =  *(_t437 + 0x4c);
				_t240 =  *((intOrPtr*)(_t437 + 0x10));
				 *(_t437 + 0x24) = 0xa54ff53a;
				 *(_t437 + 0x40) = _t334;
				 *(_t437 + 0x34) = _t348;
				do {
					_t37 = _t240 + 0xa8f328; // 0x3020100
					_t350 =  *(_t437 + 0x14) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t37 & 0x000000ff) * 4)) + _t348;
					 *(_t437 + 0x14) = _t350;
					_t351 = _t350 ^ _t418;
					asm("ror ecx, 0x10");
					_t245 =  *(_t437 + 0x28) + _t351;
					_t420 =  *(_t437 + 0x34) ^ _t245;
					 *(_t437 + 0x28) = _t245;
					_t246 =  *((intOrPtr*)(_t437 + 0x10));
					asm("ror esi, 0xc");
					 *(_t437 + 0x34) = _t420;
					_t48 = _t246 + 0xa8f329; // 0x4030201
					_t422 =  *(_t437 + 0x14) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t48 & 0x000000ff) * 4)) + _t420;
					 *(_t437 + 0x14) = _t422;
					_t423 = _t422 ^ _t351;
					asm("ror esi, 0x8");
					_t353 =  *(_t437 + 0x28) + _t423;
					 *(_t437 + 0x28) = _t353;
					asm("ror eax, 0x7");
					 *(_t437 + 0x34) =  *(_t437 + 0x34) ^ _t353;
					_t60 =  *((intOrPtr*)(_t437 + 0x10)) + 0xa8f32a; // 0x5040302
					_t355 =  *(_t437 + 0x20) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t60 & 0x000000ff) * 4)) +  *(_t437 + 0x1c);
					 *(_t437 + 0x20) = _t355;
					_t356 = _t355 ^ _t407;
					asm("ror ecx, 0x10");
					_t257 =  *(_t437 + 0x30) + _t356;
					_t409 =  *(_t437 + 0x1c) ^ _t257;
					 *(_t437 + 0x30) = _t257;
					_t258 =  *((intOrPtr*)(_t437 + 0x10));
					asm("ror edi, 0xc");
					 *(_t437 + 0x1c) = _t409;
					_t71 = _t258 + 0xa8f32b; // 0x6050403
					_t411 =  *(_t437 + 0x20) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t71 & 0x000000ff) * 4)) + _t409;
					 *(_t437 + 0x20) = _t411;
					_t412 = _t411 ^ _t356;
					asm("ror edi, 0x8");
					_t358 =  *(_t437 + 0x30) + _t412;
					 *(_t437 + 0x30) = _t358;
					asm("ror eax, 0x7");
					 *(_t437 + 0x1c) =  *(_t437 + 0x1c) ^ _t358;
					_t82 =  *((intOrPtr*)(_t437 + 0x10)) + 0xa8f32c; // 0x7060504
					_t336 =  *(_t437 + 0x38) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t82 & 0x000000ff) * 4)) + _t334;
					_t360 = _t336 ^ _t379;
					asm("ror ecx, 0x10");
					_t269 =  *(_t437 + 0x18) + _t360;
					_t381 =  *(_t437 + 0x40) ^ _t269;
					 *(_t437 + 0x18) = _t269;
					_t270 =  *((intOrPtr*)(_t437 + 0x10));
					asm("ror edx, 0xc");
					_t91 = _t270 + 0xa8f32d; // 0x8070605
					_t337 = _t336 +  *((intOrPtr*)(_t437 + 0x8c + ( *_t91 & 0x000000ff) * 4)) + _t381;
					 *(_t437 + 0x38) = _t337;
					_t338 = _t337 ^ _t360;
					asm("ror ebx, 0x8");
					_t275 =  *(_t437 + 0x18) + _t338;
					 *(_t437 + 0x18) = _t275;
					asm("ror edx, 0x7");
					 *(_t437 + 0x40) = _t381 ^ _t275;
					_t383 =  *((intOrPtr*)(_t437 + 0x10));
					_t101 = _t383 + 0xa8f32e; // 0x9080706
					_t362 =  *(_t437 + 0x2c) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t101 & 0x000000ff) * 4)) +  *(_t437 + 0x3c);
					 *(_t437 + 0x2c) = _t362;
					_t363 = _t362 ^ _t427;
					asm("ror ecx, 0x10");
					_t280 =  *(_t437 + 0x24) + _t363;
					_t429 =  *(_t437 + 0x3c) ^ _t280;
					 *(_t437 + 0x24) = _t280;
					_t110 = _t383 + 0xa8f32f; // 0xa090807
					asm("ror ebp, 0xc");
					_t385 =  *(_t437 + 0x2c) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t110 & 0x000000ff) * 4)) + _t429;
					 *(_t437 + 0x2c) = _t385;
					_t386 = _t385 ^ _t363;
					asm("ror edx, 0x8");
					_t285 =  *(_t437 + 0x24) + _t386;
					 *(_t437 + 0x24) = _t285;
					asm("ror ebp, 0x7");
					 *(_t437 + 0x3c) = _t429 ^ _t285;
					_t431 =  *((intOrPtr*)(_t437 + 0x10));
					_t121 = _t431 + 0xa8f330; // 0xb0a0908
					_t365 =  *(_t437 + 0x14) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t121 & 0x000000ff) * 4)) +  *(_t437 + 0x1c);
					 *(_t437 + 0x14) = _t365;
					_t366 = _t365 ^ _t386;
					asm("ror ecx, 0x10");
					_t290 =  *(_t437 + 0x18) + _t366;
					_t388 =  *(_t437 + 0x1c) ^ _t290;
					 *(_t437 + 0x18) = _t290;
					_t130 = _t431 + 0xa8f331; // 0xc0b0a09
					asm("ror edx, 0xc");
					_t433 =  *(_t437 + 0x14) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t130 & 0x000000ff) * 4)) + _t388;
					 *(_t437 + 0x14) = _t433;
					 *(_t437 + 0x4c) = _t433;
					_t427 = _t433 ^ _t366;
					asm("ror ebp, 0x8");
					_t295 =  *(_t437 + 0x18) + _t427;
					_t389 = _t388 ^ _t295;
					 *(_t437 + 0x18) = _t295;
					 *(_t437 + 0x74) = _t295;
					_t296 =  *((intOrPtr*)(_t437 + 0x10));
					asm("ror edx, 0x7");
					 *(_t437 + 0x1c) = _t389;
					 *(_t437 + 0x60) = _t389;
					_t144 = _t296 + 0xa8f332; // 0xd0c0b0a
					_t390 =  *(_t437 + 0x40);
					_t368 =  *(_t437 + 0x20) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t144 & 0x000000ff) * 4)) + _t390;
					 *(_t437 + 0x20) = _t368;
					_t369 = _t368 ^ _t423;
					asm("ror ecx, 0x10");
					_t301 =  *(_t437 + 0x24) + _t369;
					_t391 = _t390 ^ _t301;
					 *(_t437 + 0x24) = _t301;
					_t302 =  *((intOrPtr*)(_t437 + 0x10));
					asm("ror edx, 0xc");
					_t154 = _t302 + 0xa8f333; // 0xe0d0c0b
					_t425 =  *(_t437 + 0x20) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t154 & 0x000000ff) * 4)) + _t391;
					 *(_t437 + 0x20) = _t425;
					 *(_t437 + 0x50) = _t425;
					_t418 = _t425 ^ _t369;
					asm("ror esi, 0x8");
					_t307 =  *(_t437 + 0x24) + _t418;
					_t392 = _t391 ^ _t307;
					 *(_t437 + 0x24) = _t307;
					 *(_t437 + 0x78) = _t307;
					_t308 =  *((intOrPtr*)(_t437 + 0x10));
					asm("ror edx, 0x7");
					 *(_t437 + 0x40) = _t392;
					 *(_t437 + 0x64) = _t392;
					_t167 = _t308 + 0xa8f334; // 0xf0e0d0c
					_t393 =  *(_t437 + 0x3c);
					_t371 =  *(_t437 + 0x38) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t167 & 0x000000ff) * 4)) + _t393;
					 *(_t437 + 0x38) = _t371;
					_t372 = _t371 ^ _t412;
					asm("ror ecx, 0x10");
					_t313 =  *(_t437 + 0x28) + _t372;
					_t394 = _t393 ^ _t313;
					 *(_t437 + 0x28) = _t313;
					_t314 =  *((intOrPtr*)(_t437 + 0x10));
					asm("ror edx, 0xc");
					_t177 = _t314 + 0xa8f335; // 0xe0f0e0d
					_t414 =  *(_t437 + 0x38) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t177 & 0x000000ff) * 4)) + _t394;
					 *(_t437 + 0x38) = _t414;
					 *(_t437 + 0x54) = _t414;
					_t407 = _t414 ^ _t372;
					asm("ror edi, 0x8");
					_t319 =  *(_t437 + 0x28) + _t407;
					_t395 = _t394 ^ _t319;
					 *(_t437 + 0x28) = _t319;
					asm("ror edx, 0x7");
					 *(_t437 + 0x3c) = _t395;
					 *(_t437 + 0x68) = _t395;
					_t396 =  *((intOrPtr*)(_t437 + 0x10));
					 *(_t437 + 0x6c) = _t319;
					_t190 = _t396 + 0xa8f336; // 0xa0e0f0e
					_t374 =  *(_t437 + 0x2c) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t190 & 0x000000ff) * 4)) +  *(_t437 + 0x34);
					 *(_t437 + 0x2c) = _t374;
					_t375 = _t374 ^ _t338;
					asm("ror ecx, 0x10");
					_t324 =  *(_t437 + 0x30) + _t375;
					_t340 =  *(_t437 + 0x34) ^ _t324;
					 *(_t437 + 0x30) = _t324;
					_t199 = _t396 + 0xa8f337; // 0x40a0e0f
					asm("ror ebx, 0xc");
					_t398 =  *(_t437 + 0x2c) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t199 & 0x000000ff) * 4)) + _t340;
					 *(_t437 + 0x2c) = _t398;
					 *(_t437 + 0x58) = _t398;
					_t379 = _t398 ^ _t375;
					asm("ror edx, 0x8");
					_t329 =  *(_t437 + 0x30) + _t379;
					_t341 = _t340 ^ _t329;
					 *(_t437 + 0x30) = _t329;
					 *(_t437 + 0x70) = _t329;
					asm("ror ebx, 0x7");
					_t240 =  *((intOrPtr*)(_t437 + 0x10)) + 0x10;
					 *(_t437 + 0x34) = _t341;
					_t348 =  *(_t437 + 0x34);
					 *(_t437 + 0x5c) = _t341;
					_t334 =  *(_t437 + 0x40);
					 *((intOrPtr*)(_t437 + 0x10)) = _t240;
				} while (_t240 <= 0x90);
				 *(_t437 + 0x84) = _t379;
				_t399 =  *((intOrPtr*)(_t437 + 0xd0));
				 *(_t437 + 0x88) = _t427;
				_t434 =  *((intOrPtr*)(_t437 + 0x48));
				 *(_t437 + 0x7c) = _t418;
				 *(_t437 + 0x80) = _t407;
				do {
					_t376 =  *((intOrPtr*)(_t399 + 0xf4));
					_t333 =  *(_t437 + _t434 + 0x6c) ^  *(_t376 + _t434) ^  *(_t437 + _t434 + 0x4c);
					 *(_t376 + _t434) = _t333;
					_t434 = _t434 + 4;
				} while (_t434 < 0x20);
				return _t333;
			}

0x00a63d52
0x00a63d6c
0x00a63d74
0x00a63d7c
0x00a63d7c
0x00a63d88
0x00a63d8b
0x00a63d8b
0x00a63d97
0x00a63d9d
0x00a63da3
0x00a63da9
0x00a63dad
0x00a63db6
0x00a63dbf
0x00a63dc5
0x00a63dce
0x00a63dd8
0x00a63de0
0x00a63de8
0x00a63df0
0x00a63df8
0x00a63e00
0x00a63e04
0x00a63e08
0x00a63e0c
0x00a63e10
0x00a63e14
0x00a63e1c
0x00a63e20
0x00a63e24
0x00a63e24
0x00a63e38
0x00a63e3e
0x00a63e42
0x00a63e48
0x00a63e4b
0x00a63e4d
0x00a63e4f
0x00a63e53
0x00a63e57
0x00a63e5a
0x00a63e5e
0x00a63e72
0x00a63e78
0x00a63e7c
0x00a63e82
0x00a63e85
0x00a63e89
0x00a63e8d
0x00a63e90
0x00a63e9c
0x00a63eae
0x00a63eb4
0x00a63eb8
0x00a63ebe
0x00a63ec1
0x00a63ec3
0x00a63ec5
0x00a63ec9
0x00a63ecd
0x00a63ed0
0x00a63ed4
0x00a63ee8
0x00a63eee
0x00a63ef2
0x00a63ef8
0x00a63efb
0x00a63eff
0x00a63f03
0x00a63f06
0x00a63f0e
0x00a63f22
0x00a63f2a
0x00a63f30
0x00a63f33
0x00a63f35
0x00a63f37
0x00a63f3b
0x00a63f3f
0x00a63f42
0x00a63f52
0x00a63f58
0x00a63f5c
0x00a63f62
0x00a63f65
0x00a63f69
0x00a63f6d
0x00a63f70
0x00a63f74
0x00a63f78
0x00a63f8a
0x00a63f90
0x00a63f94
0x00a63f9a
0x00a63f9d
0x00a63f9f
0x00a63fa1
0x00a63fa5
0x00a63fb0
0x00a63fbc
0x00a63fc2
0x00a63fc6
0x00a63fcc
0x00a63fcf
0x00a63fd3
0x00a63fd7
0x00a63fda
0x00a63fde
0x00a63fe2
0x00a63ff4
0x00a63ffa
0x00a63ffe
0x00a64004
0x00a64007
0x00a64009
0x00a6400b
0x00a6400f
0x00a6401a
0x00a64026
0x00a6402c
0x00a64030
0x00a64034
0x00a6403a
0x00a6403d
0x00a6403f
0x00a64041
0x00a64045
0x00a64049
0x00a6404d
0x00a64050
0x00a64054
0x00a64058
0x00a6405f
0x00a6406c
0x00a6406e
0x00a64072
0x00a6407c
0x00a6407f
0x00a64081
0x00a64083
0x00a64087
0x00a6408b
0x00a6408e
0x00a6409e
0x00a640a4
0x00a640a8
0x00a640ac
0x00a640b2
0x00a640b5
0x00a640b7
0x00a640b9
0x00a640bd
0x00a640c1
0x00a640c5
0x00a640c8
0x00a640cc
0x00a640d0
0x00a640d7
0x00a640e4
0x00a640ea
0x00a640ee
0x00a640f4
0x00a640f7
0x00a640f9
0x00a640fb
0x00a640ff
0x00a64103
0x00a64106
0x00a64116
0x00a6411c
0x00a64120
0x00a64124
0x00a6412a
0x00a6412d
0x00a6412f
0x00a64131
0x00a64135
0x00a64138
0x00a6413c
0x00a64140
0x00a64144
0x00a64148
0x00a6415a
0x00a64160
0x00a64164
0x00a6416a
0x00a6416d
0x00a6416f
0x00a64171
0x00a64175
0x00a64180
0x00a6418c
0x00a6418e
0x00a64192
0x00a64196
0x00a64198
0x00a6419f
0x00a641a1
0x00a641a3
0x00a641a7
0x00a641af
0x00a641b2
0x00a641b5
0x00a641b9
0x00a641bd
0x00a641c1
0x00a641c5
0x00a641c9
0x00a641d4
0x00a641db
0x00a641e2
0x00a641e9
0x00a641ed
0x00a641f1
0x00a641f8
0x00a641f8
0x00a64205
0x00a64209
0x00a6420c
0x00a6420f
0x00a6421e

Strings

gj, xrefs: 00A63D8F

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 0f7e9c75edd95503b943a0677dd169e562925793a2c6dc94a04763284299a794
Instruction ID: d110ccf7f963b035f784e4ebab3b11c69c9813e5ee203f0e27c087914f7e78e5
Opcode Fuzzy Hash: 0f7e9c75edd95503b943a0677dd169e562925793a2c6dc94a04763284299a794
Instruction Fuzzy Hash: 12F1D2B1A083418FD788CF29D880A1AFBE1BFC8208F55992EF8D8D7711D634E9558F56

Uniqueness

Uniqueness Score: -1.00%

Function 00A6A2FA Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A6A2FA() {
				struct _OSVERSIONINFOW _v280;
				signed int _t6;
				intOrPtr _t12;
				intOrPtr _t13;

				_t12 =  *0xa99020; // 0x2
				if(_t12 != 0xffffffff) {
					_t6 =  *0xa9bc08; // 0xa
					_t13 =  *0xa9bc0c; // 0x0
				} else {
					_v280.dwOSVersionInfoSize = 0x114;
					GetVersionExW( &_v280);
					_t12 = _v280.dwPlatformId;
					_t6 = _v280.dwMajorVersion;
					_t13 = _v280.dwMinorVersion;
					 *0xa99020 = _t12;
					 *0xa9bc08 = _t6;
					 *0xa9bc0c = _t13;
				}
				if(_t12 != 2) {
					return 0x501;
				} else {
					return (_t6 << 8) + _t13;
				}
			}

0x00a6a2fd
0x00a6a30c
0x00a6a34a
0x00a6a34f
0x00a6a30e
0x00a6a314
0x00a6a31f
0x00a6a325
0x00a6a32b
0x00a6a331
0x00a6a337
0x00a6a33d
0x00a6a342
0x00a6a342
0x00a6a358
0x00000000
0x00a6a35a
0x00000000
0x00a6a35d

APIs

GetVersionExW.KERNEL32(?), ref: 00A6A31F

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: f32ec16818dc1c419e77d357dd53a1bca75675f4627eae1b5b4e6d5808e5632f
Instruction ID: 0f57d15915083cef1b7a5fdd06f71cad99930f84fd20514804c80f444ec3d099
Opcode Fuzzy Hash: f32ec16818dc1c419e77d357dd53a1bca75675f4627eae1b5b4e6d5808e5632f
Instruction Fuzzy Hash: C6F030B4E002088FCB18CF58ED416E973B5F758710F2082AAD91967350DF74AD81CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00A8822F Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A8822F() {
				signed int _t3;

				_t3 = GetProcessHeap();
				 *0xab887c = _t3;
				return _t3 & 0xffffff00 | _t3 != 0x00000000;
			}

0x00a8822f
0x00a88237
0x00a8823f

APIs

GetProcessHeap.KERNEL32 ref: 00A8822F

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 48ec4135edcad59d1e55d3f51f966b18756465d8139915c867fa648f363d42f9
Instruction ID: c1172ddebff41fc6e2fe3e6eb3b274c060a0ff4eb73b10283b0a80d28a00def3
Opcode Fuzzy Hash: 48ec4135edcad59d1e55d3f51f966b18756465d8139915c867fa648f363d42f9
Instruction Fuzzy Hash: 57A00174601202CF9740CFBAAA092093AEEAA4A6D57558269A515C6272EA288552AF05

Uniqueness

Uniqueness Score: -1.00%

Function 00A74658 Relevance: .8, Instructions: 823
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E00A74658(intOrPtr __ecx) {
				signed int _t316;
				signed int _t317;
				signed int _t318;
				signed int _t320;
				signed int _t321;
				signed int _t322;
				signed int _t323;
				signed int _t324;
				signed int _t326;
				signed int _t327;
				void* _t329;
				intOrPtr _t334;
				signed int _t344;
				char _t353;
				unsigned int _t356;
				void* _t364;
				intOrPtr _t369;
				signed int _t372;
				char _t381;
				signed int _t383;
				intOrPtr _t384;
				signed int _t386;
				signed int _t387;
				signed int _t388;
				signed int _t389;
				signed int _t391;
				signed int _t392;
				void* _t397;
				intOrPtr _t402;
				char _t419;
				unsigned int _t420;
				signed int _t424;
				signed int _t425;
				signed int _t426;
				signed int _t429;
				signed int _t430;
				signed int _t431;
				unsigned int _t434;
				unsigned int _t441;
				signed int _t455;
				void* _t458;
				signed int _t460;
				signed int _t461;
				signed int _t464;
				signed int _t466;
				intOrPtr* _t467;
				signed int _t469;
				signed int _t472;
				signed int _t473;
				signed int _t474;
				signed int _t478;
				signed int _t479;
				signed int _t480;
				signed int _t482;
				void* _t483;
				intOrPtr _t485;
				unsigned int _t488;
				void* _t490;
				signed int* _t493;
				unsigned int _t496;
				void* _t498;
				signed int _t501;
				signed int _t508;
				void* _t511;
				signed int _t514;
				signed int _t515;
				intOrPtr* _t517;
				void* _t518;
				signed int _t521;
				signed int _t523;
				signed int _t526;
				unsigned int _t533;
				void* _t535;
				intOrPtr* _t538;
				signed int _t540;
				intOrPtr _t541;
				void* _t543;
				signed int _t546;
				signed int _t549;
				signed int _t551;
				void* _t553;
				intOrPtr* _t556;
				void* _t557;
				signed int _t560;
				void* _t563;
				signed int _t566;
				intOrPtr* _t569;
				void* _t570;
				signed int _t573;
				void* _t576;
				signed int _t579;
				signed int _t580;
				intOrPtr* _t585;
				void* _t586;
				signed int _t589;
				signed int* _t595;
				unsigned int _t597;
				signed int _t600;
				signed int _t601;
				unsigned int _t603;
				signed int _t606;
				signed int _t607;
				void* _t609;
				signed int _t610;
				signed int _t611;
				void* _t613;
				unsigned int _t615;
				signed int _t618;
				intOrPtr _t619;
				signed int _t622;
				unsigned int _t624;
				signed int _t627;
				signed int _t628;
				signed int _t629;
				signed int _t630;
				signed int _t631;
				signed int _t632;
				signed int _t633;
				unsigned int _t637;
				intOrPtr* _t638;
				signed int _t639;
				void* _t643;
				intOrPtr _t644;
				signed int _t645;
				signed int _t646;
				intOrPtr* _t648;
				signed int _t649;
				signed int _t650;
				char* _t651;
				signed int _t652;
				signed int _t653;
				signed int _t657;
				signed int _t659;
				intOrPtr* _t660;
				void* _t661;
				void* _t667;

				_t644 = __ecx;
				 *((intOrPtr*)(_t661 + 0xc)) = __ecx;
				 *((char*)(__ecx + 0x4c58)) = 1;
				if( *((char*)(__ecx + 0x4c48)) != 0) {
					L4:
					while(1) {
						L5:
						_t648 = _t644 + 4;
						while(1) {
							L6:
							_t595 = _t644 + 0x70;
							while(1) {
								L7:
								 *_t595 =  *_t595 &  *(_t644 + 0xe6dc);
								if( *_t648 <  *((intOrPtr*)(_t644 + 0x7c))) {
									goto L18;
								} else {
									_t638 = _t644 + 0x80;
									goto L9;
								}
								while(1) {
									L9:
									_t667 =  *_t648 -  *((intOrPtr*)(_t644 + 0x88)) - 1 +  *_t638;
									if(_t667 <= 0 && (_t667 != 0 ||  *((intOrPtr*)(_t644 + 8)) <  *((intOrPtr*)(_t644 + 0x84)))) {
										break;
									}
									if( *((char*)(_t644 + 0x90)) != 0) {
										L104:
										_t384 = E00A73638(_t644);
										L105:
										return _t384;
									}
									_push(_t638);
									_push(_t648);
									_t384 = E00A72207(_t644);
									if(_t384 == 0) {
										goto L105;
									}
									_push(_t644 + 0x94);
									_push(_t638);
									_push(_t648);
									_t384 = E00A72795(_t644);
									if(_t384 != 0) {
										continue;
									} else {
										goto L105;
									}
								}
								_t455 = E00A7314C(_t644);
								__eflags = _t455;
								if(_t455 == 0) {
									goto L104;
								} else {
									_t595 = _t644 + 0x70;
								}
								L18:
								_t485 =  *((intOrPtr*)(_t644 + 0x4b30));
								__eflags = (_t485 -  *_t595 &  *(_t644 + 0xe6dc)) - 0x1004;
								if((_t485 -  *_t595 &  *(_t644 + 0xe6dc)) >= 0x1004) {
									L24:
									_t316 = E00A69E9F(_t648);
									_t317 =  *(_t644 + 0x118);
									_t597 = _t316 & 0x0000fffe;
									__eflags = _t597 -  *((intOrPtr*)(_t644 + 0x98 + _t317 * 4));
									if(_t597 >=  *((intOrPtr*)(_t644 + 0x98 + _t317 * 4))) {
										_t631 = 0xf;
										_t318 = _t317 + 1;
										__eflags = _t318 - _t631;
										if(_t318 >= _t631) {
											L32:
											_t488 =  *(_t648 + 4) + _t631;
											 *(_t648 + 4) = _t488 & 0x00000007;
											_t320 = _t488 >> 3;
											 *_t648 =  *_t648 + _t320;
											_t490 = 0x10;
											_t600 = (_t597 -  *((intOrPtr*)(_t644 + 0x94 + _t631 * 4)) >> _t490 - _t631) +  *((intOrPtr*)(_t644 + 0xd8 + _t631 * 4));
											__eflags = _t600 -  *((intOrPtr*)(_t644 + 0x94));
											asm("sbb eax, eax");
											_t321 = _t320 & _t600;
											__eflags = _t321;
											_t460 =  *(_t644 + 0xd1c + _t321 * 2) & 0x0000ffff;
											goto L33;
										} else {
											_t585 = _t644 + (_t318 + 0x26) * 4;
											while(1) {
												__eflags = _t597 -  *_t585;
												if(_t597 <  *_t585) {
													_t631 = _t318;
													goto L32;
												}
												_t318 = _t318 + 1;
												_t585 = _t585 + 4;
												__eflags = _t318 - 0xf;
												if(_t318 < 0xf) {
													continue;
												} else {
													goto L32;
												}
											}
											goto L32;
										}
									} else {
										_t586 = 0x10;
										_t630 = _t597 >> _t586 - _t317;
										_t589 = ( *(_t630 + _t644 + 0x11c) & 0x000000ff) +  *(_t648 + 4);
										 *_t648 =  *_t648 + (_t589 >> 3);
										 *(_t648 + 4) = _t589 & 0x00000007;
										_t460 =  *(_t644 + 0x51c + _t630 * 2) & 0x0000ffff;
										L33:
										__eflags = _t460 - 0x100;
										if(_t460 >= 0x100) {
											__eflags = _t460 - 0x106;
											if(_t460 < 0x106) {
												__eflags = _t460 - 0x100;
												if(_t460 != 0x100) {
													__eflags = _t460 - 0x101;
													if(_t460 != 0x101) {
														_t461 = _t460 + 0xfffffefe;
														__eflags = _t461;
														_t493 = _t644 + (_t461 + 0x15) * 4;
														_t601 =  *_t493;
														 *(_t661 + 0x28) = _t601;
														if(_t461 == 0) {
															L136:
															 *(_t644 + 0x54) = _t601;
															_t322 = E00A69E9F(_t648);
															_t323 =  *(_t644 + 0x2ddc);
															_t603 = _t322 & 0x0000fffe;
															__eflags = _t603 -  *((intOrPtr*)(_t644 + 0x2d5c + _t323 * 4));
															if(_t603 >=  *((intOrPtr*)(_t644 + 0x2d5c + _t323 * 4))) {
																_t632 = 0xf;
																_t324 = _t323 + 1;
																__eflags = _t324 - _t632;
																if(_t324 >= _t632) {
																	L144:
																	_t496 =  *(_t648 + 4) + _t632;
																	 *(_t648 + 4) = _t496 & 0x00000007;
																	_t326 = _t496 >> 3;
																	 *_t648 =  *_t648 + _t326;
																	_t498 = 0x10;
																	_t606 = (_t603 -  *((intOrPtr*)(_t644 + 0x2d58 + _t632 * 4)) >> _t498 - _t632) +  *((intOrPtr*)(_t644 + 0x2d9c + _t632 * 4));
																	__eflags = _t606 -  *((intOrPtr*)(_t644 + 0x2d58));
																	asm("sbb eax, eax");
																	_t327 = _t326 & _t606;
																	__eflags = _t327;
																	_t633 =  *(_t644 + 0x39e0 + _t327 * 2) & 0x0000ffff;
																	L145:
																	__eflags = _t633 - 8;
																	if(_t633 >= 8) {
																		_t464 = (_t633 >> 2) - 1;
																		_t637 = ((_t633 & 0x00000003 | 0x00000004) << _t464) + 2;
																		__eflags = _t464;
																		if(_t464 != 0) {
																			_t356 = E00A69E9F(_t648);
																			_t511 = 0x10;
																			_t637 = _t637 + (_t356 >> _t511 - _t464);
																			_t514 =  *(_t648 + 4) + _t464;
																			 *_t648 =  *_t648 + (_t514 >> 3);
																			_t515 = _t514 & 0x00000007;
																			__eflags = _t515;
																			 *(_t648 + 4) = _t515;
																		}
																	} else {
																		_t637 = _t633 + 2;
																	}
																	__eflags =  *((char*)(_t644 + 0x4c38));
																	_t607 =  *(_t661 + 0x28);
																	 *(_t644 + 0x68) = _t637;
																	if( *((char*)(_t644 + 0x4c38)) == 0) {
																		_t501 =  *(_t644 + 0x70);
																		_t466 = _t501 - _t607;
																		_t329 =  *((intOrPtr*)(_t644 + 0xe6d8)) + 0xffffefff;
																		__eflags = _t466 - _t329;
																		if(_t466 >= _t329) {
																			L162:
																			__eflags = _t637;
																			if(_t637 == 0) {
																				L6:
																				_t595 = _t644 + 0x70;
																				continue;
																			}
																			_t649 =  *(_t644 + 0xe6dc);
																			do {
																				_t650 = _t649 & _t466;
																				_t466 = _t466 + 1;
																				 *((char*)( *((intOrPtr*)(_t644 + 0x4b34)) +  *(_t644 + 0x70))) =  *((intOrPtr*)( *((intOrPtr*)(_t644 + 0x4b34)) + _t650));
																				_t595 = _t644 + 0x70;
																				_t649 =  *(_t644 + 0xe6dc);
																				 *_t595 =  *_t595 + 0x00000001 & _t649;
																				_t637 = _t637 - 1;
																				__eflags = _t637;
																			} while (_t637 != 0);
																			goto L165;
																		}
																		__eflags = _t501 - _t329;
																		if(_t501 >= _t329) {
																			goto L162;
																		}
																		_t334 =  *((intOrPtr*)(_t644 + 0x4b34));
																		_t467 = _t466 + _t334;
																		_t651 = _t334 + _t501;
																		 *(_t644 + 0x70) = _t501 + _t637;
																		__eflags = _t607 - _t637;
																		if(_t607 >= _t637) {
																			__eflags = _t637 - 8;
																			if(_t637 < 8) {
																				goto L122;
																			}
																			_t344 = _t637 >> 3;
																			__eflags = _t344;
																			 *(_t661 + 0x28) = _t344;
																			_t645 = _t344;
																			do {
																				E00A7EE90(_t651, _t467, 8);
																				_t661 = _t661 + 0xc;
																				_t467 = _t467 + 8;
																				_t651 = _t651 + 8;
																				_t637 = _t637 - 8;
																				_t645 = _t645 - 1;
																				__eflags = _t645;
																			} while (_t645 != 0);
																			goto L121;
																		}
																		_t609 = 8;
																		__eflags = _t637 - _t609;
																		if(_t637 < _t609) {
																			goto L122;
																		}
																		_t508 = _t637 >> 3;
																		__eflags = _t508;
																		do {
																			_t637 = _t637 - _t609;
																			 *_t651 =  *_t467;
																			 *((char*)(_t651 + 1)) =  *((intOrPtr*)(_t467 + 1));
																			 *((char*)(_t651 + 2)) =  *((intOrPtr*)(_t467 + 2));
																			 *((char*)(_t651 + 3)) =  *((intOrPtr*)(_t467 + 3));
																			 *((char*)(_t651 + 4)) =  *((intOrPtr*)(_t467 + 4));
																			 *((char*)(_t651 + 5)) =  *((intOrPtr*)(_t467 + 5));
																			 *((char*)(_t651 + 6)) =  *((intOrPtr*)(_t467 + 6));
																			_t353 =  *((intOrPtr*)(_t467 + 7));
																			_t467 = _t467 + _t609;
																			 *((char*)(_t651 + 7)) = _t353;
																			_t651 = _t651 + _t609;
																			_t508 = _t508 - 1;
																			__eflags = _t508;
																		} while (_t508 != 0);
																		goto L122;
																	} else {
																		_push( *(_t644 + 0xe6dc));
																		_push(_t644 + 0x70);
																		_push(_t607);
																		L76:
																		_push(_t637);
																		E00A70EE1();
																		goto L6;
																		do {
																			while(1) {
																				L6:
																				_t595 = _t644 + 0x70;
																				do {
																					goto L9;
																				} while (_t637 == 0);
																				__eflags =  *((char*)(_t644 + 0x4c38));
																				if( *((char*)(_t644 + 0x4c38)) == 0) {
																					_t523 =  *(_t644 + 0x70);
																					_t611 =  *(_t644 + 0x54);
																					_t364 =  *((intOrPtr*)(_t644 + 0xe6d8)) + 0xffffefff;
																					_t469 = _t523 - _t611;
																					__eflags = _t469 - _t364;
																					if(_t469 >= _t364) {
																						L130:
																						__eflags = _t637;
																						if(_t637 == 0) {
																							while(1) {
																								L6:
																								_t595 = _t644 + 0x70;
																								L7:
																								 *_t595 =  *_t595 &  *(_t644 + 0xe6dc);
																								if( *_t648 <  *((intOrPtr*)(_t644 + 0x7c))) {
																									goto L18;
																								} else {
																									_t638 = _t644 + 0x80;
																									goto L9;
																								}
																							}
																						}
																						_t652 =  *(_t644 + 0xe6dc);
																						do {
																							_t653 = _t652 & _t469;
																							_t469 = _t469 + 1;
																							 *((char*)( *((intOrPtr*)(_t644 + 0x4b34)) +  *(_t644 + 0x70))) =  *((intOrPtr*)( *((intOrPtr*)(_t644 + 0x4b34)) + _t653));
																							_t595 = _t644 + 0x70;
																							_t652 =  *(_t644 + 0xe6dc);
																							 *_t595 =  *_t595 + 0x00000001 & _t652;
																							_t637 = _t637 - 1;
																							__eflags = _t637;
																						} while (_t637 != 0);
																						L165:
																						_t648 = _t644 + 4;
																						goto L7;
																					}
																					__eflags = _t523 - _t364;
																					if(_t523 >= _t364) {
																						goto L130;
																					}
																					_t369 =  *((intOrPtr*)(_t644 + 0x4b34));
																					_t467 = _t469 + _t369;
																					_t651 = _t369 + _t523;
																					 *(_t644 + 0x70) = _t523 + _t637;
																					__eflags = _t611 - _t637;
																					if(_t611 >= _t637) {
																						__eflags = _t637 - 8;
																						if(_t637 < 8) {
																							L122:
																							_t595 = _t644 + 0x70;
																							__eflags = _t637;
																							if(_t637 == 0) {
																								goto L165;
																							}
																							_t595 = _t644 + 0x70;
																							 *_t651 =  *_t467;
																							__eflags = _t637 - 1;
																							if(_t637 <= 1) {
																								goto L165;
																							}
																							_t595 = _t644 + 0x70;
																							 *((char*)(_t651 + 1)) =  *((intOrPtr*)(_t467 + 1));
																							__eflags = _t637 - 2;
																							if(_t637 <= 2) {
																								goto L165;
																							}
																							_t595 = _t644 + 0x70;
																							 *((char*)(_t651 + 2)) =  *((intOrPtr*)(_t467 + 2));
																							__eflags = _t637 - 3;
																							if(_t637 <= 3) {
																								goto L165;
																							}
																							_t595 = _t644 + 0x70;
																							 *((char*)(_t651 + 3)) =  *((intOrPtr*)(_t467 + 3));
																							__eflags = _t637 - 4;
																							if(_t637 <= 4) {
																								goto L165;
																							}
																							_t595 = _t644 + 0x70;
																							 *((char*)(_t651 + 4)) =  *((intOrPtr*)(_t467 + 4));
																							__eflags = _t637 - 5;
																							if(_t637 <= 5) {
																								goto L165;
																							}
																							_t595 = _t644 + 0x70;
																							 *((char*)(_t651 + 5)) =  *((intOrPtr*)(_t467 + 5));
																							__eflags = _t637 - 6;
																							if(_t637 <= 6) {
																								goto L165;
																							}
																							 *((char*)(_t651 + 6)) =  *((intOrPtr*)(_t467 + 6));
																							while(1) {
																								L5:
																								_t648 = _t644 + 4;
																								while(1) {
																									L6:
																									_t595 = _t644 + 0x70;
																									goto L7;
																								}
																							}
																						}
																						_t372 = _t637 >> 3;
																						__eflags = _t372;
																						 *(_t661 + 0x28) = _t372;
																						_t646 = _t372;
																						do {
																							E00A7EE90(_t651, _t467, 8);
																							_t661 = _t661 + 0xc;
																							_t467 = _t467 + 8;
																							_t651 = _t651 + 8;
																							_t637 = _t637 - 8;
																							_t646 = _t646 - 1;
																							__eflags = _t646;
																						} while (_t646 != 0);
																						L121:
																						_t644 =  *((intOrPtr*)(_t661 + 0x10));
																						goto L122;
																					}
																					_t613 = 8;
																					__eflags = _t637 - _t613;
																					if(_t637 < _t613) {
																						goto L122;
																					}
																					_t526 = _t637 >> 3;
																					__eflags = _t526;
																					do {
																						_t637 = _t637 - _t613;
																						 *_t651 =  *_t467;
																						 *((char*)(_t651 + 1)) =  *((intOrPtr*)(_t467 + 1));
																						 *((char*)(_t651 + 2)) =  *((intOrPtr*)(_t467 + 2));
																						 *((char*)(_t651 + 3)) =  *((intOrPtr*)(_t467 + 3));
																						 *((char*)(_t651 + 4)) =  *((intOrPtr*)(_t467 + 4));
																						 *((char*)(_t651 + 5)) =  *((intOrPtr*)(_t467 + 5));
																						 *((char*)(_t651 + 6)) =  *((intOrPtr*)(_t467 + 6));
																						_t381 =  *((intOrPtr*)(_t467 + 7));
																						_t467 = _t467 + _t613;
																						 *((char*)(_t651 + 7)) = _t381;
																						_t651 = _t651 + _t613;
																						_t526 = _t526 - 1;
																						__eflags = _t526;
																					} while (_t526 != 0);
																					goto L122;
																				}
																				_push( *(_t644 + 0xe6dc));
																				_push(_t644 + 0x70);
																				_push( *(_t644 + 0x54));
																				goto L76;
																			}
																			L103:
																			_t386 = E00A7065B(_t644, _t661 + 0x14);
																			__eflags = _t386;
																		} while (_t386 != 0);
																		goto L104;
																	}
																}
																_t517 = _t644 + (_t324 + 0xb57) * 4;
																while(1) {
																	__eflags = _t603 -  *_t517;
																	if(_t603 <  *_t517) {
																		break;
																	}
																	_t324 = _t324 + 1;
																	_t517 = _t517 + 4;
																	__eflags = _t324 - 0xf;
																	if(_t324 < 0xf) {
																		continue;
																	}
																	goto L144;
																}
																_t632 = _t324;
																goto L144;
															}
															_t518 = 0x10;
															_t610 = _t603 >> _t518 - _t323;
															_t521 = ( *(_t610 + _t644 + 0x2de0) & 0x000000ff) +  *(_t648 + 4);
															 *_t648 =  *_t648 + (_t521 >> 3);
															 *(_t648 + 4) = _t521 & 0x00000007;
															_t633 =  *(_t644 + 0x31e0 + _t610 * 2) & 0x0000ffff;
															goto L145;
														} else {
															goto L135;
														}
														do {
															L135:
															 *_t493 =  *(_t493 - 4);
															_t493 = _t493 - 4;
															_t461 = _t461 - 1;
															__eflags = _t461;
														} while (_t461 != 0);
														goto L136;
													}
													_t637 =  *(_t644 + 0x68);
													_t595 = _t644 + 0x70;
													__eflags = _t637;
												}
												_push(_t661 + 0x14);
												_t383 = E00A72391(_t644, _t648);
												__eflags = _t383;
												if(_t383 == 0) {
													goto L104;
												}
												goto L103;
											}
											_t639 = _t460 - 0x106;
											__eflags = _t639 - 8;
											if(_t639 >= 8) {
												_t472 = (_t639 >> 2) - 1;
												_t637 = ((_t639 & 0x00000003 | 0x00000004) << _t472) + 2;
												__eflags = _t472;
												if(_t472 != 0) {
													_t441 = E00A69E9F(_t648);
													_t576 = 0x10;
													_t637 = _t637 + (_t441 >> _t576 - _t472);
													_t579 =  *(_t648 + 4) + _t472;
													 *_t648 =  *_t648 + (_t579 >> 3);
													_t580 = _t579 & 0x00000007;
													__eflags = _t580;
													 *(_t648 + 4) = _t580;
												}
											} else {
												_t637 = _t639 + 2;
											}
											_t387 = E00A69E9F(_t648);
											_t388 =  *(_t644 + 0x1004);
											_t615 = _t387 & 0x0000fffe;
											__eflags = _t615 -  *((intOrPtr*)(_t644 + 0xf84 + _t388 * 4));
											if(_t615 >=  *((intOrPtr*)(_t644 + 0xf84 + _t388 * 4))) {
												_t473 = 0xf;
												_t389 = _t388 + 1;
												__eflags = _t389 - _t473;
												if(_t389 >= _t473) {
													L50:
													_t533 =  *(_t648 + 4) + _t473;
													 *(_t648 + 4) = _t533 & 0x00000007;
													_t391 = _t533 >> 3;
													 *_t648 =  *_t648 + _t391;
													_t535 = 0x10;
													_t618 = (_t615 -  *((intOrPtr*)(_t644 + 0xf80 + _t473 * 4)) >> _t535 - _t473) +  *((intOrPtr*)(_t644 + 0xfc4 + _t473 * 4));
													__eflags = _t618 -  *((intOrPtr*)(_t644 + 0xf80));
													asm("sbb eax, eax");
													_t392 = _t391 & _t618;
													__eflags = _t392;
													_t474 =  *(_t644 + 0x1c08 + _t392 * 2) & 0x0000ffff;
													goto L51;
												}
												_t569 = _t644 + (_t389 + 0x3e1) * 4;
												while(1) {
													__eflags = _t615 -  *_t569;
													if(_t615 <  *_t569) {
														break;
													}
													_t389 = _t389 + 1;
													_t569 = _t569 + 4;
													__eflags = _t389 - 0xf;
													if(_t389 < 0xf) {
														continue;
													}
													goto L50;
												}
												_t473 = _t389;
												goto L50;
											} else {
												_t570 = 0x10;
												_t629 = _t615 >> _t570 - _t388;
												_t573 = ( *(_t629 + _t644 + 0x1008) & 0x000000ff) +  *(_t648 + 4);
												 *_t648 =  *_t648 + (_t573 >> 3);
												 *(_t648 + 4) = _t573 & 0x00000007;
												_t474 =  *(_t644 + 0x1408 + _t629 * 2) & 0x0000ffff;
												L51:
												__eflags = _t474 - 4;
												if(_t474 >= 4) {
													_t657 = (_t474 >> 1) - 1;
													_t478 = ((_t474 & 0x00000001 | 0x00000002) << _t657) + 1;
													__eflags = _t657;
													if(_t657 == 0) {
														_t648 = _t644 + 4;
														L70:
														__eflags = _t478 - 0x100;
														if(_t478 > 0x100) {
															_t637 = _t637 + 1;
															__eflags = _t478 - 0x2000;
															if(_t478 > 0x2000) {
																_t637 = _t637 + 1;
																__eflags = _t478 - 0x40000;
																if(_t478 > 0x40000) {
																	_t637 = _t637 + 1;
																	__eflags = _t637;
																}
															}
														}
														_t538 = _t644 + 0x70;
														 *(_t644 + 0x60) =  *(_t644 + 0x5c);
														 *(_t644 + 0x5c) =  *(_t644 + 0x58);
														 *(_t644 + 0x58) =  *(_t644 + 0x54);
														 *(_t644 + 0x54) = _t478;
														__eflags =  *((char*)(_t644 + 0x4c38));
														 *(_t644 + 0x68) = _t637;
														if( *((char*)(_t644 + 0x4c38)) == 0) {
															_t619 =  *_t538;
															_t659 = _t619 - _t478;
															_t397 =  *((intOrPtr*)(_t644 + 0xe6d8)) + 0xffffefff;
															__eflags = _t659 - _t397;
															if(_t659 >= _t397) {
																L96:
																__eflags = _t637;
																if(_t637 == 0) {
																	goto L5;
																}
																_t479 =  *(_t644 + 0xe6dc);
																while(1) {
																	_t480 = _t479 & _t659;
																	_t659 = _t659 + 1;
																	 *((char*)( *((intOrPtr*)(_t644 + 0x4b34)) +  *_t538)) =  *((intOrPtr*)(_t480 +  *((intOrPtr*)(_t644 + 0x4b34))));
																	_t595 = _t644 + 0x70;
																	_t479 =  *(_t644 + 0xe6dc);
																	 *_t595 =  *_t595 + 0x00000001 & _t479;
																	_t637 = _t637 - 1;
																	__eflags = _t637;
																	if(_t637 == 0) {
																		break;
																	}
																	_t538 = _t644 + 0x70;
																}
																goto L165;
															}
															__eflags = _t619 - _t397;
															if(_t619 >= _t397) {
																goto L96;
															}
															_t402 =  *((intOrPtr*)(_t644 + 0x4b34));
															_t660 = _t659 + _t402;
															_t540 = _t402 + _t619;
															 *(_t661 + 0x28) = _t540;
															_t595 = _t644 + 0x70;
															 *_t595 = _t619 + _t637;
															__eflags = _t478 - _t637;
															if(_t478 >= _t637) {
																__eflags = _t637 - 8;
																if(_t637 < 8) {
																	L88:
																	__eflags = _t637;
																	if(_t637 != 0) {
																		 *_t540 =  *_t660;
																		__eflags = _t637 - 1;
																		if(_t637 > 1) {
																			 *((char*)(_t540 + 1)) =  *((intOrPtr*)(_t660 + 1));
																			__eflags = _t637 - 2;
																			if(_t637 > 2) {
																				 *((char*)(_t540 + 2)) =  *((intOrPtr*)(_t660 + 2));
																				__eflags = _t637 - 3;
																				if(_t637 > 3) {
																					 *((char*)(_t540 + 3)) =  *((intOrPtr*)(_t660 + 3));
																					__eflags = _t637 - 4;
																					if(_t637 > 4) {
																						 *((char*)(_t540 + 4)) =  *((intOrPtr*)(_t660 + 4));
																						__eflags = _t637 - 5;
																						if(_t637 > 5) {
																							 *((char*)(_t540 + 5)) =  *((intOrPtr*)(_t660 + 5));
																							__eflags = _t637 - 6;
																							if(_t637 > 6) {
																								 *((char*)(_t540 + 6)) =  *((intOrPtr*)(_t660 + 6));
																							}
																						}
																					}
																				}
																			}
																		}
																	}
																	goto L165;
																}
																_t482 = _t637 >> 3;
																__eflags = _t482;
																do {
																	E00A7EE90(_t540, _t660, 8);
																	_t541 =  *((intOrPtr*)(_t661 + 0x34));
																	_t661 = _t661 + 0xc;
																	_t540 = _t541 + 8;
																	_t660 = _t660 + 8;
																	_t637 = _t637 - 8;
																	 *(_t661 + 0x28) = _t540;
																	_t482 = _t482 - 1;
																	__eflags = _t482;
																} while (_t482 != 0);
																L87:
																_t595 = _t644 + 0x70;
																goto L88;
															}
															__eflags = _t637 - 8;
															if(_t637 < 8) {
																goto L88;
															}
															_t622 = _t637 >> 3;
															__eflags = _t622;
															do {
																_t637 = _t637 - 8;
																 *_t540 =  *_t660;
																 *((char*)(_t540 + 1)) =  *((intOrPtr*)(_t660 + 1));
																 *((char*)(_t540 + 2)) =  *((intOrPtr*)(_t660 + 2));
																 *((char*)(_t540 + 3)) =  *((intOrPtr*)(_t660 + 3));
																 *((char*)(_t540 + 4)) =  *((intOrPtr*)(_t660 + 4));
																 *((char*)(_t540 + 5)) =  *((intOrPtr*)(_t660 + 5));
																 *((char*)(_t540 + 6)) =  *((intOrPtr*)(_t660 + 6));
																_t419 =  *((intOrPtr*)(_t660 + 7));
																_t660 = _t660 + 8;
																 *((char*)(_t540 + 7)) = _t419;
																_t540 = _t540 + 8;
																_t622 = _t622 - 1;
																__eflags = _t622;
															} while (_t622 != 0);
															goto L87;
														} else {
															_push( *(_t644 + 0xe6dc));
															_push(_t538);
															_push(_t478);
															goto L76;
														}
													}
													__eflags = _t657 - 4;
													if(__eflags < 0) {
														_t420 = E00A76B93(_t644 + 4);
														_t543 = 0x20;
														_t478 = _t478 + (_t420 >> _t543 - _t657);
														_t546 =  *((intOrPtr*)(_t644 + 8)) + _t657;
														_t648 = _t644 + 4;
														 *_t648 =  *_t648 + (_t546 >> 3);
														 *(_t648 + 4) = _t546 & 0x00000007;
														goto L70;
													}
													if(__eflags <= 0) {
														_t648 = _t644 + 4;
													} else {
														_t434 = E00A76B93(_t644 + 4);
														_t563 = 0x24;
														_t566 = _t657 - 4 +  *((intOrPtr*)(_t644 + 8));
														_t648 = _t644 + 4;
														_t478 = _t478 + (_t434 >> _t563 - _t657 << 4);
														 *_t648 =  *_t648 + (_t566 >> 3);
														 *(_t648 + 4) = _t566 & 0x00000007;
													}
													_t424 = E00A69E9F(_t648);
													_t425 =  *(_t644 + 0x1ef0);
													_t624 = _t424 & 0x0000fffe;
													__eflags = _t624 -  *((intOrPtr*)(_t644 + 0x1e70 + _t425 * 4));
													if(_t624 >=  *((intOrPtr*)(_t644 + 0x1e70 + _t425 * 4))) {
														_t549 = 0xf;
														_t426 = _t425 + 1;
														 *(_t661 + 0x28) = _t549;
														__eflags = _t426 - _t549;
														if(_t426 >= _t549) {
															L66:
															_t551 =  *(_t648 + 4) +  *(_t661 + 0x28);
															 *_t648 =  *_t648 + (_t551 >> 3);
															_t429 =  *(_t661 + 0x28);
															 *(_t648 + 4) = _t551 & 0x00000007;
															_t553 = 0x10;
															_t627 = (_t624 -  *((intOrPtr*)(_t644 + 0x1e6c + _t429 * 4)) >> _t553 - _t429) +  *((intOrPtr*)(_t644 + 0x1eb0 + _t429 * 4));
															__eflags = _t627 -  *((intOrPtr*)(_t644 + 0x1e6c));
															asm("sbb eax, eax");
															_t430 = _t429 & _t627;
															__eflags = _t430;
															_t431 =  *(_t644 + 0x2af4 + _t430 * 2) & 0x0000ffff;
															goto L67;
														}
														_t556 = _t644 + (_t426 + 0x79c) * 4;
														while(1) {
															__eflags = _t624 -  *_t556;
															if(_t624 <  *_t556) {
																break;
															}
															_t426 = _t426 + 1;
															_t556 = _t556 + 4;
															__eflags = _t426 - 0xf;
															if(_t426 < 0xf) {
																continue;
															}
															goto L66;
														}
														 *(_t661 + 0x28) = _t426;
														goto L66;
													} else {
														_t557 = 0x10;
														_t628 = _t624 >> _t557 - _t425;
														_t560 = ( *(_t628 + _t644 + 0x1ef4) & 0x000000ff) +  *(_t648 + 4);
														 *_t648 =  *_t648 + (_t560 >> 3);
														 *(_t648 + 4) = _t560 & 0x00000007;
														_t431 =  *(_t644 + 0x22f4 + _t628 * 2) & 0x0000ffff;
														L67:
														_t478 = _t478 + _t431;
														goto L70;
													}
												}
												_t478 = _t474 + 1;
												goto L70;
											}
										}
										__eflags =  *((char*)(_t644 + 0x4c38));
										if( *((char*)(_t644 + 0x4c38)) == 0) {
											_t595 = _t644 + 0x70;
											 *( *((intOrPtr*)(_t644 + 0x4b34)) +  *_t595) = _t460;
											 *_t595 =  *_t595 + 1;
											continue;
										} else {
											 *(_t644 + 0x70) =  *(_t644 + 0x70) + 1;
											 *(E00A7048A(_t644 + 0x4b38,  *(_t644 + 0x70))) = _t460;
											goto L6;
										}
									}
								}
								__eflags = _t485 -  *_t595;
								if(_t485 ==  *_t595) {
									goto L24;
								}
								E00A73638(_t644);
								_t384 =  *((intOrPtr*)(_t644 + 0x4c54));
								__eflags = _t384 -  *((intOrPtr*)(_t644 + 0x4c44));
								if(__eflags > 0) {
									goto L105;
								}
								if(__eflags < 0) {
									L23:
									__eflags =  *((char*)(_t644 + 0x4c48));
									if( *((char*)(_t644 + 0x4c48)) != 0) {
										 *((char*)(_t644 + 0x4c58)) = 0;
										goto L105;
									}
									goto L24;
								}
								_t384 =  *((intOrPtr*)(_t644 + 0x4c50));
								__eflags = _t384 -  *((intOrPtr*)(_t644 + 0x4c40));
								if(_t384 >  *((intOrPtr*)(_t644 + 0x4c40))) {
									goto L105;
								}
								goto L23;
							}
						}
					}
				}
				E00A7302D(__ecx,  *((intOrPtr*)(_t661 + 0x24)));
				_t458 = E00A7314C(_t644);
				if(_t458 == 0) {
					L106:
					return _t458;
				}
				_t643 = _t644 + 0x80;
				_push(_t643);
				_t483 = _t644 + 4;
				_push(_t483);
				_t458 = E00A72207(_t644);
				if(_t458 == 0) {
					goto L106;
				}
				_push(_t644 + 0x94);
				_push(_t643);
				_push(_t483);
				_t458 = E00A72795(_t644);
				if(_t458 == 0) {
					goto L106;
				}
				goto L4;
			}

0x00a7465d
0x00a74660
0x00a7466b
0x00a74672
0x00a746be
0x00a746bf
0x00a746bf
0x00a746bf
0x00a746c2
0x00a746c2
0x00a746c2
0x00a746c5
0x00a746c5
0x00a746cb
0x00a746d3
0x00000000
0x00a746d5
0x00a746d5
0x00000000
0x00a746d5
0x00a746db
0x00a746db
0x00a746e4
0x00a746e7
0x00000000
0x00000000
0x00a746fd
0x00a74c92
0x00a74c94
0x00a74c99
0x00000000
0x00a74c99
0x00a74703
0x00a74704
0x00a74707
0x00a7470e
0x00000000
0x00000000
0x00a7471c
0x00a7471d
0x00a7471e
0x00a7471f
0x00a74726
0x00000000
0x00a74728
0x00000000
0x00a74728
0x00a74726
0x00a7472f
0x00a74734
0x00a74736
0x00000000
0x00a7473c
0x00a7473c
0x00a7473c
0x00a7473f
0x00a7473f
0x00a7474f
0x00a74754
0x00a74794
0x00a74796
0x00a7479d
0x00a747a3
0x00a747a9
0x00a747b0
0x00a747de
0x00a747df
0x00a747e0
0x00a747e2
0x00a747fb
0x00a747fe
0x00a74805
0x00a74808
0x00a7480b
0x00a74817
0x00a7481c
0x00a74823
0x00a74829
0x00a7482b
0x00a7482b
0x00a7482d
0x00000000
0x00a747e4
0x00a747e7
0x00a747ea
0x00a747ea
0x00a747ec
0x00a747f9
0x00a747f9
0x00a747f9
0x00a747ee
0x00a747ef
0x00a747f2
0x00a747f5
0x00000000
0x00a747f7
0x00000000
0x00a747f7
0x00a747f5
0x00000000
0x00a747ea
0x00a747b2
0x00a747b4
0x00a747b7
0x00a747c1
0x00a747c9
0x00a747cf
0x00a747d2
0x00a74835
0x00a74835
0x00a7483b
0x00a74877
0x00a7487d
0x00a74c65
0x00a74c6b
0x00a74ca3
0x00a74ca9
0x00a74e43
0x00a74e43
0x00a74e4c
0x00a74e4f
0x00a74e51
0x00a74e55
0x00a74e64
0x00a74e66
0x00a74e69
0x00a74e70
0x00a74e76
0x00a74e7c
0x00a74e83
0x00a74eb1
0x00a74eb2
0x00a74eb3
0x00a74eb5
0x00a74ed1
0x00a74ed4
0x00a74edb
0x00a74ede
0x00a74ee1
0x00a74eed
0x00a74ef2
0x00a74ef9
0x00a74eff
0x00a74f01
0x00a74f01
0x00a74f03
0x00a74f0b
0x00a74f0b
0x00a74f0e
0x00a74f20
0x00a74f25
0x00a74f28
0x00a74f2a
0x00a74f2e
0x00a74f35
0x00a74f3d
0x00a74f3f
0x00a74f46
0x00a74f49
0x00a74f49
0x00a74f4c
0x00a74f4c
0x00a74f10
0x00a74f10
0x00a74f10
0x00a74f4f
0x00a74f56
0x00a74f5a
0x00a74f5d
0x00a74f6f
0x00a74f7a
0x00a74f7c
0x00a74f81
0x00a74f83
0x00a75028
0x00a75028
0x00a7502a
0x00a746c2
0x00a746c2
0x00000000
0x00a746c2
0x00a75030
0x00a75036
0x00a7503c
0x00a75041
0x00a75045
0x00a75048
0x00a7504d
0x00a75056
0x00a75058
0x00a75058
0x00a75058
0x00000000
0x00a75036
0x00a74f89
0x00a74f8b
0x00000000
0x00000000
0x00a74f91
0x00a74f97
0x00a74f99
0x00a74f9f
0x00a74fa2
0x00a74fa4
0x00a74ff5
0x00a74ff8
0x00000000
0x00000000
0x00a75000
0x00a75000
0x00a75003
0x00a75007
0x00a75009
0x00a7500d
0x00a75012
0x00a75015
0x00a75018
0x00a7501b
0x00a7501e
0x00a7501e
0x00a7501e
0x00000000
0x00a75023
0x00a74fa8
0x00a74fa9
0x00a74fab
0x00000000
0x00000000
0x00a74fb3
0x00a74fb3
0x00a74fb6
0x00a74fb8
0x00a74fba
0x00a74fc0
0x00a74fc6
0x00a74fcc
0x00a74fd2
0x00a74fd8
0x00a74fde
0x00a74fe1
0x00a74fe4
0x00a74fe6
0x00a74fe9
0x00a74feb
0x00a74feb
0x00a74feb
0x00000000
0x00a74f5f
0x00a74f5f
0x00a74f68
0x00a74f69
0x00a74af6
0x00a74af6
0x00a74afd
0x00a74b02
0x00a746c2
0x00a746c2
0x00a746c2
0x00a746c2
0x00a746c5
0x00000000
0x00000000
0x00a74cbd
0x00a74cc4
0x00a74cd8
0x00a74ce3
0x00a74ce6
0x00a74ceb
0x00a74ced
0x00a74cef
0x00a74e09
0x00a74e09
0x00a74e0b
0x00a746c2
0x00a746c2
0x00a746c2
0x00a746c5
0x00a746cb
0x00a746d3
0x00000000
0x00a746d5
0x00a746d5
0x00000000
0x00a746d5
0x00a746d3
0x00a746c2
0x00a74e11
0x00a74e17
0x00a74e1d
0x00a74e22
0x00a74e26
0x00a74e29
0x00a74e2e
0x00a74e37
0x00a74e39
0x00a74e39
0x00a74e39
0x00a7505d
0x00a7505d
0x00000000
0x00a7505d
0x00a74cf5
0x00a74cf7
0x00000000
0x00000000
0x00a74cfd
0x00a74d03
0x00a74d05
0x00a74d0b
0x00a74d0e
0x00a74d10
0x00a74d5a
0x00a74d5d
0x00a74d88
0x00a74d88
0x00a74d8b
0x00a74d8d
0x00000000
0x00000000
0x00a74d95
0x00a74d98
0x00a74d9b
0x00a74d9e
0x00000000
0x00000000
0x00a74da7
0x00a74daa
0x00a74dad
0x00a74db0
0x00000000
0x00000000
0x00a74db9
0x00a74dbc
0x00a74dbf
0x00a74dc2
0x00000000
0x00000000
0x00a74dcb
0x00a74dce
0x00a74dd1
0x00a74dd4
0x00000000
0x00000000
0x00a74ddd
0x00a74de0
0x00a74de3
0x00a74de6
0x00000000
0x00000000
0x00a74def
0x00a74df2
0x00a74df5
0x00a74df8
0x00000000
0x00000000
0x00a74e01
0x00a746bf
0x00a746bf
0x00a746bf
0x00a746c2
0x00a746c2
0x00a746c2
0x00000000
0x00a746c2
0x00a746c2
0x00a746bf
0x00a74d61
0x00a74d61
0x00a74d64
0x00a74d68
0x00a74d6a
0x00a74d6e
0x00a74d73
0x00a74d76
0x00a74d79
0x00a74d7c
0x00a74d7f
0x00a74d7f
0x00a74d7f
0x00a74d84
0x00a74d84
0x00000000
0x00a74d84
0x00a74d14
0x00a74d15
0x00a74d17
0x00000000
0x00000000
0x00a74d1b
0x00a74d1b
0x00a74d1e
0x00a74d20
0x00a74d22
0x00a74d28
0x00a74d2e
0x00a74d34
0x00a74d3a
0x00a74d40
0x00a74d46
0x00a74d49
0x00a74d4c
0x00a74d4e
0x00a74d51
0x00a74d53
0x00a74d53
0x00a74d53
0x00000000
0x00a74d58
0x00a74cc6
0x00a74ccf
0x00a74cd0
0x00000000
0x00a74cd0
0x00a74c7e
0x00a74c85
0x00a74c8a
0x00a74c8a
0x00000000
0x00a746c2
0x00a74f5d
0x00a74ebd
0x00a74ec0
0x00a74ec0
0x00a74ec2
0x00000000
0x00000000
0x00a74ec4
0x00a74ec5
0x00a74ec8
0x00a74ecb
0x00000000
0x00000000
0x00000000
0x00a74ecd
0x00a74ecf
0x00000000
0x00a74ecf
0x00a74e87
0x00a74e8a
0x00a74e94
0x00a74e9c
0x00a74ea2
0x00a74ea5
0x00000000
0x00000000
0x00000000
0x00000000
0x00a74e57
0x00a74e57
0x00a74e5a
0x00a74e5c
0x00a74e5f
0x00a74e5f
0x00a74e5f
0x00000000
0x00a74e57
0x00a74caf
0x00a74cb2
0x00a74cb5
0x00a74cb5
0x00a74c73
0x00a74c75
0x00a74c7a
0x00a74c7c
0x00000000
0x00000000
0x00000000
0x00a74c7c
0x00a74883
0x00a74889
0x00a7488c
0x00a7489e
0x00a748a3
0x00a748a6
0x00a748a8
0x00a748ac
0x00a748b3
0x00a748bb
0x00a748bd
0x00a748c4
0x00a748c7
0x00a748c7
0x00a748ca
0x00a748ca
0x00a7488e
0x00a7488e
0x00a7488e
0x00a748cf
0x00a748d6
0x00a748dc
0x00a748e2
0x00a748e9
0x00a74917
0x00a74918
0x00a74919
0x00a7491b
0x00a74937
0x00a7493a
0x00a74941
0x00a74944
0x00a74947
0x00a74953
0x00a74958
0x00a7495f
0x00a74965
0x00a74967
0x00a74967
0x00a74969
0x00000000
0x00a74969
0x00a74923
0x00a74926
0x00a74926
0x00a74928
0x00000000
0x00000000
0x00a7492a
0x00a7492b
0x00a7492e
0x00a74931
0x00000000
0x00000000
0x00000000
0x00a74933
0x00a74935
0x00000000
0x00a748eb
0x00a748ed
0x00a748f0
0x00a748fa
0x00a74902
0x00a74908
0x00a7490b
0x00a74971
0x00a74971
0x00a74974
0x00a74986
0x00a7498b
0x00a7498c
0x00a7498e
0x00a74aac
0x00a74aaf
0x00a74aaf
0x00a74ab5
0x00a74ab7
0x00a74ab8
0x00a74abe
0x00a74ac0
0x00a74ac1
0x00a74ac7
0x00a74ac9
0x00a74ac9
0x00a74ac9
0x00a74ac7
0x00a74abe
0x00a74acd
0x00a74ad0
0x00a74ad6
0x00a74adc
0x00a74adf
0x00a74ae2
0x00a74ae9
0x00a74aec
0x00a74b07
0x00a74b11
0x00a74b13
0x00a74b18
0x00a74b1a
0x00a74c27
0x00a74c27
0x00a74c29
0x00000000
0x00000000
0x00a74c2f
0x00a74c3a
0x00a74c40
0x00a74c44
0x00a74c48
0x00a74c4b
0x00a74c50
0x00a74c59
0x00a74c5b
0x00a74c5b
0x00a74c5e
0x00000000
0x00000000
0x00a74c37
0x00a74c37
0x00000000
0x00a74c60
0x00a74b20
0x00a74b22
0x00000000
0x00000000
0x00a74b28
0x00a74b2e
0x00a74b30
0x00a74b33
0x00a74b3a
0x00a74b3d
0x00a74b3f
0x00a74b41
0x00a74b8c
0x00a74b8f
0x00a74bbb
0x00a74bbb
0x00a74bbd
0x00a74bc6
0x00a74bc8
0x00a74bcb
0x00a74bd4
0x00a74bd7
0x00a74bda
0x00a74be3
0x00a74be6
0x00a74be9
0x00a74bf2
0x00a74bf5
0x00a74bf8
0x00a74c01
0x00a74c04
0x00a74c07
0x00a74c10
0x00a74c13
0x00a74c16
0x00a74c1f
0x00a74c1f
0x00a74c16
0x00a74c07
0x00a74bf8
0x00a74be9
0x00a74bda
0x00a74bcb
0x00000000
0x00a74bbd
0x00a74b93
0x00a74b93
0x00a74b96
0x00a74b9a
0x00a74b9f
0x00a74ba3
0x00a74ba6
0x00a74ba9
0x00a74bac
0x00a74baf
0x00a74bb3
0x00a74bb3
0x00a74bb3
0x00a74bb8
0x00a74bb8
0x00000000
0x00a74bb8
0x00a74b43
0x00a74b46
0x00000000
0x00000000
0x00a74b4a
0x00a74b4a
0x00a74b4d
0x00a74b50
0x00a74b53
0x00a74b58
0x00a74b5e
0x00a74b64
0x00a74b6a
0x00a74b70
0x00a74b76
0x00a74b79
0x00a74b7c
0x00a74b7f
0x00a74b82
0x00a74b85
0x00a74b85
0x00a74b85
0x00000000
0x00a74aee
0x00a74aee
0x00a74af4
0x00a74af5
0x00000000
0x00a74af5
0x00a74aec
0x00a74994
0x00a74997
0x00a74a86
0x00a74a8d
0x00a74a95
0x00a74a97
0x00a74a99
0x00a74aa1
0x00a74aa7
0x00000000
0x00a74aa7
0x00a7499d
0x00a749cc
0x00a7499f
0x00a749a2
0x00a749a9
0x00a749b1
0x00a749b4
0x00a749ba
0x00a749c1
0x00a749c7
0x00a749c7
0x00a749d1
0x00a749d8
0x00a749de
0x00a749e4
0x00a749eb
0x00a74a19
0x00a74a1a
0x00a74a1b
0x00a74a1f
0x00a74a21
0x00a74a3f
0x00a74a42
0x00a74a4e
0x00a74a51
0x00a74a55
0x00a74a5a
0x00a74a66
0x00a74a6d
0x00a74a73
0x00a74a75
0x00a74a75
0x00a74a77
0x00000000
0x00a74a77
0x00a74a29
0x00a74a2c
0x00a74a2c
0x00a74a2e
0x00000000
0x00000000
0x00a74a30
0x00a74a31
0x00a74a34
0x00a74a37
0x00000000
0x00000000
0x00000000
0x00a74a39
0x00a74a3b
0x00000000
0x00a749ed
0x00a749ef
0x00a749f2
0x00a749fc
0x00a74a04
0x00a74a0a
0x00a74a0d
0x00a74a7f
0x00a74a7f
0x00000000
0x00a74a7f
0x00a749eb
0x00a74976
0x00000000
0x00a74976
0x00a748e9
0x00a7483d
0x00a74844
0x00a74868
0x00a7486d
0x00a74870
0x00000000
0x00a74846
0x00a74853
0x00a7485b
0x00000000
0x00a7485b
0x00a74844
0x00a747b0
0x00a74756
0x00a74758
0x00000000
0x00000000
0x00a7475c
0x00a74761
0x00a74767
0x00a7476d
0x00000000
0x00000000
0x00a74773
0x00a74787
0x00a74787
0x00a7478e
0x00a75065
0x00000000
0x00a75065
0x00000000
0x00a7478e
0x00a74775
0x00a7477b
0x00a74781
0x00000000
0x00000000
0x00000000
0x00a74781
0x00a746c5
0x00a746c2
0x00a746bf
0x00a74678
0x00a7467f
0x00a74686
0x00a74ca0
0x00a74ca0
0x00a74ca0
0x00a7468c
0x00a74694
0x00a74695
0x00a74698
0x00a74699
0x00a746a0
0x00000000
0x00000000
0x00a746ae
0x00a746af
0x00a746b0
0x00a746b1
0x00a746b8
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7713ae665cea61a36f7a863b3ad73f3a9aaeb842feed59e6f7bcb8c34471d0ad
Instruction ID: 0fc23e4242cd8791374bf8720ec0922a604adfc884d0c7b3bbd9540776aae313
Opcode Fuzzy Hash: 7713ae665cea61a36f7a863b3ad73f3a9aaeb842feed59e6f7bcb8c34471d0ad
Instruction Fuzzy Hash: 7B620871604B849FCB25CF38CD90AAABBE1AF59304F18C96DD8AE4B346D735A946C710

Uniqueness

Uniqueness Score: -1.00%

Function 00A75AA1 Relevance: .8, Instructions: 808
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E00A75AA1(void* __ecx) {
				intOrPtr _t367;
				signed int _t371;
				signed int _t372;
				signed int _t373;
				signed int _t375;
				signed int _t376;
				signed int _t378;
				signed int _t379;
				signed int _t380;
				signed int _t382;
				signed int _t383;
				void* _t385;
				char _t386;
				intOrPtr _t392;
				signed int _t402;
				char _t411;
				unsigned int _t412;
				signed int _t419;
				void* _t421;
				intOrPtr _t426;
				signed int _t429;
				char _t438;
				signed int _t440;
				signed int _t442;
				signed int _t443;
				signed int _t444;
				signed int _t445;
				signed int _t448;
				signed int _t449;
				signed int _t452;
				void* _t457;
				intOrPtr _t462;
				char _t478;
				unsigned int _t479;
				signed int _t483;
				signed int _t484;
				signed int _t485;
				signed int _t488;
				signed int _t489;
				signed int _t490;
				unsigned int _t493;
				unsigned int _t500;
				void* _t513;
				intOrPtr _t514;
				signed int _t515;
				signed int _t516;
				signed int _t517;
				signed int _t518;
				signed int _t519;
				signed int _t520;
				signed int _t521;
				intOrPtr _t523;
				intOrPtr _t524;
				intOrPtr _t525;
				unsigned int _t528;
				void* _t530;
				signed int* _t533;
				unsigned int _t536;
				void* _t538;
				signed int _t542;
				intOrPtr _t543;
				void* _t545;
				signed int _t548;
				signed int _t549;
				intOrPtr* _t551;
				void* _t552;
				signed int _t555;
				intOrPtr _t558;
				signed int _t563;
				signed int _t565;
				void* _t567;
				signed int _t571;
				signed int _t573;
				intOrPtr _t574;
				void* _t576;
				signed int _t579;
				signed int _t580;
				signed int _t582;
				signed int _t584;
				void* _t586;
				intOrPtr* _t589;
				void* _t590;
				signed int _t593;
				void* _t596;
				signed int _t599;
				intOrPtr* _t602;
				void* _t603;
				signed int _t606;
				void* _t609;
				signed int _t612;
				intOrPtr* _t616;
				void* _t617;
				signed int _t620;
				signed int _t623;
				unsigned int _t625;
				signed int _t628;
				signed int _t629;
				signed int _t630;
				unsigned int _t632;
				signed int _t635;
				signed int _t636;
				signed int _t639;
				signed int _t640;
				signed int _t641;
				signed int _t644;
				unsigned int _t646;
				signed int _t649;
				signed int _t650;
				signed int _t652;
				intOrPtr* _t654;
				unsigned int _t656;
				signed int _t659;
				signed int _t660;
				signed int _t661;
				signed int _t663;
				signed int _t664;
				void* _t665;
				intOrPtr _t668;
				signed int _t669;
				signed int _t670;
				signed int _t671;
				signed int _t672;
				unsigned int _t676;
				intOrPtr _t678;
				signed int _t680;
				unsigned int _t684;
				intOrPtr* _t686;
				signed int _t689;
				signed int _t691;
				intOrPtr* _t692;
				signed int _t694;
				signed int _t698;
				signed int _t699;
				signed int _t703;
				signed int _t704;
				signed int _t705;
				signed int _t707;
				signed int _t709;
				void* _t710;

				_t514 =  *((intOrPtr*)(_t710 + 0x2c));
				_t665 = __ecx;
				if( *((char*)(_t514 + 0x2c)) != 0) {
					L3:
					_t523 =  *((intOrPtr*)(_t514 + 0x18));
					_t686 = _t514 + 4;
					__eflags =  *_t686 -  *((intOrPtr*)(_t514 + 0x24)) + _t523;
					if( *_t686 <=  *((intOrPtr*)(_t514 + 0x24)) + _t523) {
						_t367 =  *((intOrPtr*)(_t514 + 0x20)) - 1 + _t523;
						_t668 =  *((intOrPtr*)(_t514 + 0x4acc)) - 0x10;
						 *((intOrPtr*)(_t710 + 0x14)) = _t367;
						 *((intOrPtr*)(_t710 + 0x10)) = _t668;
						__eflags = _t367 - _t668;
						if(_t367 >= _t668) {
							 *((intOrPtr*)(_t710 + 0x1c)) = _t668;
						} else {
							 *((intOrPtr*)(_t710 + 0x1c)) = _t367;
						}
						while(1) {
							_t623 =  *(_t665 + 0xe6dc);
							 *(_t665 + 0x70) =  *(_t665 + 0x70) & _t623;
							_t524 =  *_t686;
							__eflags = _t524 -  *((intOrPtr*)(_t710 + 0x1c));
							if(_t524 <  *((intOrPtr*)(_t710 + 0x1c))) {
								goto L18;
							}
							L12:
							__eflags = _t524 - _t367;
							if(__eflags > 0) {
								L99:
								_t386 = 1;
								L100:
								goto L101;
							}
							if(__eflags != 0) {
								L15:
								__eflags = _t524 - _t678;
								if(_t524 < _t678) {
									L17:
									__eflags = _t524 -  *((intOrPtr*)(_t514 + 0x4acc));
									if(_t524 >=  *((intOrPtr*)(_t514 + 0x4acc))) {
										L158:
										 *((char*)(_t514 + 0x4ad3)) = 1;
										goto L99;
									}
									goto L18;
								}
								__eflags =  *((char*)(_t514 + 0x4ad2));
								if( *((char*)(_t514 + 0x4ad2)) == 0) {
									goto L158;
								}
								goto L17;
							}
							__eflags =  *(_t514 + 8) -  *((intOrPtr*)(_t514 + 0x1c));
							if( *(_t514 + 8) >=  *((intOrPtr*)(_t514 + 0x1c))) {
								goto L99;
							}
							goto L15;
							L18:
							_t525 =  *((intOrPtr*)(_t665 + 0x4b30));
							__eflags = (_t525 -  *(_t665 + 0x70) & _t623) - 0x1004;
							if((_t525 -  *(_t665 + 0x70) & _t623) >= 0x1004) {
								L23:
								_t371 = E00A69E9F(_t686);
								_t372 =  *(_t514 + 0xb4);
								_t625 = _t371 & 0x0000fffe;
								__eflags = _t625 -  *((intOrPtr*)(_t514 + 0x34 + _t372 * 4));
								if(_t625 >=  *((intOrPtr*)(_t514 + 0x34 + _t372 * 4))) {
									_t669 = 0xf;
									_t373 = _t372 + 1;
									__eflags = _t373 - _t669;
									if(_t373 >= _t669) {
										L31:
										_t528 =  *(_t686 + 4) + _t669;
										 *(_t686 + 4) = _t528 & 0x00000007;
										_t375 = _t528 >> 3;
										 *_t686 =  *_t686 + _t375;
										_t530 = 0x10;
										_t628 = (_t625 -  *((intOrPtr*)(_t514 + 0x30 + _t669 * 4)) >> _t530 - _t669) +  *((intOrPtr*)(_t514 + 0x74 + _t669 * 4));
										__eflags = _t628 -  *((intOrPtr*)(_t514 + 0x30));
										asm("sbb eax, eax");
										_t376 = _t375 & _t628;
										__eflags = _t376;
										_t629 =  *(_t514 + 0xcb8 + _t376 * 2) & 0x0000ffff;
										L32:
										__eflags = _t629 - 0x100;
										if(_t629 >= 0x100) {
											__eflags = _t629 - 0x106;
											if(_t629 < 0x106) {
												__eflags = _t629 - 0x100;
												if(_t629 != 0x100) {
													__eflags = _t629 - 0x101;
													if(_t629 != 0x101) {
														_t630 = _t629 + 0xfffffefe;
														__eflags = _t630;
														_t533 =  &((_t665 + 0x54)[_t630]);
														_t670 =  *_t533;
														 *(_t710 + 0x20) = _t670;
														if(_t630 == 0) {
															L130:
															 *(_t665 + 0x54) = _t670;
															_t378 = E00A69E9F(_t686);
															_t379 =  *(_t514 + 0x2d78);
															_t632 = _t378 & 0x0000fffe;
															__eflags = _t632 -  *((intOrPtr*)(_t514 + 0x2cf8 + _t379 * 4));
															if(_t632 >=  *((intOrPtr*)(_t514 + 0x2cf8 + _t379 * 4))) {
																_t671 = 0xf;
																_t380 = _t379 + 1;
																__eflags = _t380 - _t671;
																if(_t380 >= _t671) {
																	L138:
																	_t536 =  *(_t686 + 4) + _t671;
																	 *(_t686 + 4) = _t536 & 0x00000007;
																	_t382 = _t536 >> 3;
																	 *_t686 =  *_t686 + _t382;
																	_t538 = 0x10;
																	_t635 = (_t632 -  *((intOrPtr*)(_t514 + 0x2cf4 + _t671 * 4)) >> _t538 - _t671) +  *((intOrPtr*)(_t514 + 0x2d38 + _t671 * 4));
																	__eflags = _t635 -  *((intOrPtr*)(_t514 + 0x2cf4));
																	asm("sbb eax, eax");
																	_t383 = _t382 & _t635;
																	__eflags = _t383;
																	_t672 =  *(_t514 + 0x397c + _t383 * 2) & 0x0000ffff;
																	L139:
																	__eflags = _t672 - 8;
																	if(_t672 >= 8) {
																		_t689 = (_t672 >> 2) - 1;
																		_t676 = ((_t672 & 0x00000003 | 0x00000004) << _t689) + 2;
																		__eflags = _t689;
																		if(_t689 != 0) {
																			_t412 = E00A69E9F(_t514 + 4);
																			_t545 = 0x10;
																			_t676 = _t676 + (_t412 >> _t545 - _t689);
																			_t548 =  *(_t514 + 8) + _t689;
																			 *((intOrPtr*)(_t514 + 4)) =  *((intOrPtr*)(_t514 + 4)) + (_t548 >> 3);
																			_t549 = _t548 & 0x00000007;
																			__eflags = _t549;
																			 *(_t514 + 8) = _t549;
																		}
																	} else {
																		_t676 = _t672 + 2;
																	}
																	_t636 =  *(_t665 + 0x70);
																	_t691 = _t636 -  *(_t710 + 0x20);
																	_t385 =  *((intOrPtr*)(_t665 + 0xe6d8)) + 0xffffefff;
																	 *(_t665 + 0x68) = _t676;
																	__eflags = _t691 - _t385;
																	if(_t691 >= _t385) {
																		L154:
																		_t367 =  *((intOrPtr*)(_t710 + 0x14));
																		__eflags = _t676;
																		if(_t676 == 0) {
																			goto L9;
																		}
																		_t515 =  *(_t665 + 0xe6dc);
																		do {
																			_t516 = _t515 & _t691;
																			_t691 = _t691 + 1;
																			 *( *((intOrPtr*)(_t665 + 0x4b34)) +  *(_t665 + 0x70)) =  *((intOrPtr*)(_t516 +  *((intOrPtr*)(_t665 + 0x4b34))));
																			_t515 =  *(_t665 + 0xe6dc);
																			 *(_t665 + 0x70) =  *(_t665 + 0x70) + 0x00000001 & _t515;
																			_t676 = _t676 - 1;
																			__eflags = _t676;
																		} while (_t676 != 0);
																		L157:
																		_t514 =  *((intOrPtr*)(_t710 + 0x38));
																		_t686 = _t514 + 4;
																		L34:
																		_t678 =  *((intOrPtr*)(_t710 + 0x10));
																		goto L35;
																	} else {
																		__eflags = _t636 - _t385;
																		if(_t636 >= _t385) {
																			goto L154;
																		}
																		_t392 =  *((intOrPtr*)(_t665 + 0x4b34));
																		_t692 = _t691 + _t392;
																		_t542 = _t392 + _t636;
																		 *(_t710 + 0x18) = _t542;
																		 *(_t665 + 0x70) = _t636 + _t676;
																		__eflags =  *(_t710 + 0x20) - _t676;
																		if( *(_t710 + 0x20) >= _t676) {
																			__eflags = _t676 - 8;
																			if(_t676 < 8) {
																				L116:
																				_t367 =  *((intOrPtr*)(_t710 + 0x14));
																				__eflags = _t676;
																				if(_t676 == 0) {
																					L9:
																					_t686 = _t514 + 4;
																					L10:
																					while(1) {
																						_t623 =  *(_t665 + 0xe6dc);
																						 *(_t665 + 0x70) =  *(_t665 + 0x70) & _t623;
																						_t524 =  *_t686;
																						__eflags = _t524 -  *((intOrPtr*)(_t710 + 0x1c));
																						if(_t524 <  *((intOrPtr*)(_t710 + 0x1c))) {
																							goto L18;
																						}
																						goto L12;
																					}
																				}
																				 *_t542 =  *_t692;
																				_t367 =  *((intOrPtr*)(_t710 + 0x14));
																				__eflags = _t676 - 1;
																				if(_t676 <= 1) {
																					goto L9;
																				}
																				 *((char*)(_t542 + 1)) =  *((intOrPtr*)(_t692 + 1));
																				_t367 =  *((intOrPtr*)(_t710 + 0x14));
																				__eflags = _t676 - 2;
																				if(_t676 <= 2) {
																					goto L9;
																				}
																				 *((char*)(_t542 + 2)) =  *((intOrPtr*)(_t692 + 2));
																				_t367 =  *((intOrPtr*)(_t710 + 0x14));
																				__eflags = _t676 - 3;
																				if(_t676 <= 3) {
																					goto L9;
																				}
																				 *((char*)(_t542 + 3)) =  *((intOrPtr*)(_t692 + 3));
																				_t367 =  *((intOrPtr*)(_t710 + 0x14));
																				__eflags = _t676 - 4;
																				if(_t676 <= 4) {
																					goto L9;
																				}
																				 *((char*)(_t542 + 4)) =  *((intOrPtr*)(_t692 + 4));
																				_t367 =  *((intOrPtr*)(_t710 + 0x14));
																				__eflags = _t676 - 5;
																				if(_t676 <= 5) {
																					goto L9;
																				}
																				__eflags = _t676 - 6;
																				_t678 =  *((intOrPtr*)(_t710 + 0x10));
																				 *((char*)(_t542 + 5)) =  *((intOrPtr*)(_t692 + 5));
																				_t367 =  *((intOrPtr*)(_t710 + 0x14));
																				if(_t676 <= 6) {
																					_t686 = _t514 + 4;
																					while(1) {
																						_t623 =  *(_t665 + 0xe6dc);
																						 *(_t665 + 0x70) =  *(_t665 + 0x70) & _t623;
																						_t524 =  *_t686;
																						__eflags = _t524 -  *((intOrPtr*)(_t710 + 0x1c));
																						if(_t524 <  *((intOrPtr*)(_t710 + 0x1c))) {
																							goto L18;
																						}
																						goto L12;
																					}
																				}
																				 *((char*)(_t542 + 6)) =  *((intOrPtr*)(_t692 + 6));
																				L91:
																				_t686 = _t514 + 4;
																				L35:
																				_t367 =  *((intOrPtr*)(_t710 + 0x14));
																				do {
																					_t623 =  *(_t665 + 0xe6dc);
																					 *(_t665 + 0x70) =  *(_t665 + 0x70) & _t623;
																					_t524 =  *_t686;
																					__eflags = _t524 -  *((intOrPtr*)(_t710 + 0x1c));
																					if(_t524 <  *((intOrPtr*)(_t710 + 0x1c))) {
																						goto L18;
																					}
																					goto L12;
																					L89:
																					_t686 = _t514 + 4;
																					 *((char*)(_t652 + 5)) =  *((intOrPtr*)(_t573 + 5));
																					__eflags = _t684 - 6;
																					_t678 =  *((intOrPtr*)(_t710 + 0x10));
																					_t367 =  *((intOrPtr*)(_t710 + 0x14));
																				} while (_t684 <= 6);
																				 *((char*)(_t652 + 6)) =  *((intOrPtr*)(_t573 + 6));
																				goto L91;
																			}
																			_t402 = _t676 >> 3;
																			__eflags = _t402;
																			 *(_t710 + 0x20) = _t402;
																			_t517 = _t402;
																			do {
																				E00A7EE90(_t542, _t692, 8);
																				_t543 =  *((intOrPtr*)(_t710 + 0x24));
																				_t710 = _t710 + 0xc;
																				_t542 = _t543 + 8;
																				_t692 = _t692 + 8;
																				_t676 = _t676 - 8;
																				 *(_t710 + 0x18) = _t542;
																				_t517 = _t517 - 1;
																				__eflags = _t517;
																			} while (_t517 != 0);
																			L115:
																			_t514 =  *((intOrPtr*)(_t710 + 0x38));
																			goto L116;
																		}
																		__eflags = _t676 - 8;
																		if(_t676 < 8) {
																			goto L116;
																		}
																		_t639 = _t676 >> 3;
																		__eflags = _t639;
																		do {
																			_t676 = _t676 - 8;
																			 *_t542 =  *_t692;
																			 *((char*)(_t542 + 1)) =  *((intOrPtr*)(_t692 + 1));
																			 *((char*)(_t542 + 2)) =  *((intOrPtr*)(_t692 + 2));
																			 *((char*)(_t542 + 3)) =  *((intOrPtr*)(_t692 + 3));
																			 *((char*)(_t542 + 4)) =  *((intOrPtr*)(_t692 + 4));
																			 *((char*)(_t542 + 5)) =  *((intOrPtr*)(_t692 + 5));
																			 *((char*)(_t542 + 6)) =  *((intOrPtr*)(_t692 + 6));
																			_t411 =  *((intOrPtr*)(_t692 + 7));
																			_t692 = _t692 + 8;
																			 *((char*)(_t542 + 7)) = _t411;
																			_t542 = _t542 + 8;
																			_t639 = _t639 - 1;
																			__eflags = _t639;
																		} while (_t639 != 0);
																		goto L116;
																	}
																}
																_t551 = _t514 + (_t380 + 0xb3e) * 4;
																while(1) {
																	__eflags = _t632 -  *_t551;
																	if(_t632 <  *_t551) {
																		break;
																	}
																	_t380 = _t380 + 1;
																	_t551 = _t551 + 4;
																	__eflags = _t380 - 0xf;
																	if(_t380 < 0xf) {
																		continue;
																	}
																	goto L138;
																}
																_t671 = _t380;
																goto L138;
															}
															_t552 = 0x10;
															_t640 = _t632 >> _t552 - _t379;
															_t555 = ( *(_t640 + _t514 + 0x2d7c) & 0x000000ff) +  *(_t686 + 4);
															 *_t686 =  *_t686 + (_t555 >> 3);
															 *(_t686 + 4) = _t555 & 0x00000007;
															_t672 =  *(_t514 + 0x317c + _t640 * 2) & 0x0000ffff;
															goto L139;
														} else {
															goto L129;
														}
														do {
															L129:
															 *_t533 =  *(_t533 - 4);
															_t533 = _t533 - 4;
															_t630 = _t630 - 1;
															__eflags = _t630;
														} while (_t630 != 0);
														goto L130;
													}
													_t676 =  *(_t665 + 0x68);
													_t367 =  *((intOrPtr*)(_t710 + 0x14));
													__eflags = _t676;
													if(_t676 == 0) {
														goto L10;
													}
													_t419 =  *(_t665 + 0x54);
													_t641 =  *(_t665 + 0x70);
													_t694 = _t641 - _t419;
													 *(_t710 + 0x18) = _t419;
													_t421 =  *((intOrPtr*)(_t665 + 0xe6d8)) + 0xffffefff;
													__eflags = _t694 - _t421;
													if(_t694 >= _t421) {
														L124:
														_t367 =  *((intOrPtr*)(_t710 + 0x14));
														__eflags = _t676;
														if(_t676 == 0) {
															goto L9;
														}
														_t518 =  *(_t665 + 0xe6dc);
														do {
															_t519 = _t518 & _t694;
															_t694 = _t694 + 1;
															 *( *((intOrPtr*)(_t665 + 0x4b34)) +  *(_t665 + 0x70)) =  *((intOrPtr*)(_t519 +  *((intOrPtr*)(_t665 + 0x4b34))));
															_t518 =  *(_t665 + 0xe6dc);
															 *(_t665 + 0x70) =  *(_t665 + 0x70) + 0x00000001 & _t518;
															_t676 = _t676 - 1;
															__eflags = _t676;
														} while (_t676 != 0);
														goto L157;
													}
													__eflags = _t641 - _t421;
													if(_t641 >= _t421) {
														goto L124;
													}
													_t426 =  *((intOrPtr*)(_t665 + 0x4b34));
													_t692 = _t694 + _t426;
													_t542 = _t426 + _t641;
													 *(_t710 + 0x20) = _t542;
													 *(_t665 + 0x70) = _t641 + _t676;
													__eflags =  *(_t710 + 0x18) - _t676;
													if( *(_t710 + 0x18) >= _t676) {
														__eflags = _t676 - 8;
														if(_t676 < 8) {
															goto L116;
														}
														_t429 = _t676 >> 3;
														__eflags = _t429;
														_t520 = _t429;
														do {
															E00A7EE90(_t542, _t692, 8);
															_t558 =  *((intOrPtr*)(_t710 + 0x2c));
															_t710 = _t710 + 0xc;
															_t542 = _t558 + 8;
															_t692 = _t692 + 8;
															_t676 = _t676 - 8;
															 *(_t710 + 0x20) = _t542;
															_t520 = _t520 - 1;
															__eflags = _t520;
														} while (_t520 != 0);
														goto L115;
													}
													__eflags = _t676 - 8;
													if(_t676 < 8) {
														goto L116;
													}
													_t644 = _t676 >> 3;
													__eflags = _t644;
													do {
														_t676 = _t676 - 8;
														 *_t542 =  *_t692;
														 *((char*)(_t542 + 1)) =  *((intOrPtr*)(_t692 + 1));
														 *((char*)(_t542 + 2)) =  *((intOrPtr*)(_t692 + 2));
														 *((char*)(_t542 + 3)) =  *((intOrPtr*)(_t692 + 3));
														 *((char*)(_t542 + 4)) =  *((intOrPtr*)(_t692 + 4));
														 *((char*)(_t542 + 5)) =  *((intOrPtr*)(_t692 + 5));
														 *((char*)(_t542 + 6)) =  *((intOrPtr*)(_t692 + 6));
														_t438 =  *((intOrPtr*)(_t692 + 7));
														_t692 = _t692 + 8;
														 *((char*)(_t542 + 7)) = _t438;
														_t542 = _t542 + 8;
														_t644 = _t644 - 1;
														__eflags = _t644;
													} while (_t644 != 0);
													goto L116;
												}
												_push(_t710 + 0x24);
												_t440 = E00A72391(_t665, _t686);
												__eflags = _t440;
												if(_t440 == 0) {
													goto L99;
												}
												_t442 = E00A7065B(_t665, _t710 + 0x24);
												__eflags = _t442;
												if(_t442 != 0) {
													goto L34;
												}
												goto L99;
											}
											_t680 = _t629 - 0x106;
											__eflags = _t680 - 8;
											if(_t680 >= 8) {
												_t698 = (_t680 >> 2) - 1;
												_t684 = ((_t680 & 0x00000003 | 0x00000004) << _t698) + 2;
												__eflags = _t698;
												if(_t698 == 0) {
													_t686 = _t514 + 4;
												} else {
													_t500 = E00A69E9F(_t514 + 4);
													_t609 = 0x10;
													_t684 = _t684 + (_t500 >> _t609 - _t698);
													_t612 =  *(_t514 + 8) + _t698;
													_t686 = _t514 + 4;
													 *_t686 =  *_t686 + (_t612 >> 3);
													 *(_t686 + 4) = _t612 & 0x00000007;
												}
											} else {
												_t684 = _t680 + 2;
											}
											_t443 = E00A69E9F(_t686);
											_t444 =  *(_t514 + 0xfa0);
											_t646 = _t443 & 0x0000fffe;
											__eflags = _t646 -  *((intOrPtr*)(_t514 + 0xf20 + _t444 * 4));
											if(_t646 >=  *((intOrPtr*)(_t514 + 0xf20 + _t444 * 4))) {
												_t563 = 0xf;
												_t445 = _t444 + 1;
												 *(_t710 + 0x18) = _t563;
												__eflags = _t445 - _t563;
												if(_t445 >= _t563) {
													L50:
													_t565 =  *(_t686 + 4) +  *(_t710 + 0x18);
													 *_t686 =  *_t686 + (_t565 >> 3);
													_t448 =  *(_t710 + 0x18);
													 *(_t686 + 4) = _t565 & 0x00000007;
													_t567 = 0x10;
													_t649 = (_t646 -  *((intOrPtr*)(_t514 + 0xf1c + _t448 * 4)) >> _t567 - _t448) +  *((intOrPtr*)(_t514 + 0xf60 + _t448 * 4));
													__eflags = _t649 -  *((intOrPtr*)(_t514 + 0xf1c));
													asm("sbb eax, eax");
													_t449 = _t448 & _t649;
													__eflags = _t449;
													_t699 =  *(_t514 + 0x1ba4 + _t449 * 2) & 0x0000ffff;
													goto L51;
												}
												_t602 = _t514 + (_t445 + 0x3c8) * 4;
												while(1) {
													__eflags = _t646 -  *_t602;
													if(_t646 <  *_t602) {
														break;
													}
													_t445 = _t445 + 1;
													_t602 = _t602 + 4;
													__eflags = _t445 - 0xf;
													if(_t445 < 0xf) {
														continue;
													}
													goto L50;
												}
												 *(_t710 + 0x18) = _t445;
												goto L50;
											} else {
												_t603 = 0x10;
												_t663 = _t646 >> _t603 - _t444;
												_t606 = ( *(_t663 + _t514 + 0xfa4) & 0x000000ff) +  *(_t686 + 4);
												 *_t686 =  *_t686 + (_t606 >> 3);
												 *(_t686 + 4) = _t606 & 0x00000007;
												_t699 =  *(_t514 + 0x13a4 + _t663 * 2) & 0x0000ffff;
												L51:
												__eflags = _t699 - 4;
												if(_t699 >= 4) {
													_t452 = (_t699 >> 1) - 1;
													 *(_t710 + 0x18) = _t452;
													_t703 = ((_t699 & 0x00000001 | 0x00000002) << _t452) + 1;
													__eflags = _t452;
													if(_t452 == 0) {
														L69:
														__eflags = _t703 - 0x100;
														if(_t703 > 0x100) {
															_t684 = _t684 + 1;
															__eflags = _t703 - 0x2000;
															if(_t703 > 0x2000) {
																_t684 = _t684 + 1;
																__eflags = _t703 - 0x40000;
																if(_t703 > 0x40000) {
																	_t684 = _t684 + 1;
																	__eflags = _t684;
																}
															}
														}
														 *(_t665 + 0x60) =  *(_t665 + 0x5c);
														 *(_t665 + 0x5c) =  *(_t665 + 0x58);
														 *(_t665 + 0x58) =  *(_t665 + 0x54);
														 *(_t665 + 0x54) = _t703;
														_t650 =  *(_t665 + 0x70);
														_t571 = _t650 - _t703;
														_t457 =  *((intOrPtr*)(_t665 + 0xe6d8)) + 0xffffefff;
														 *(_t665 + 0x68) = _t684;
														 *(_t710 + 0x20) = _t571;
														__eflags = _t571 - _t457;
														if(_t571 >= _t457) {
															L92:
															_t367 =  *((intOrPtr*)(_t710 + 0x14));
															_t686 = _t514 + 4;
															__eflags = _t684;
															if(_t684 == 0) {
																goto L10;
															}
															_t704 =  *(_t665 + 0xe6dc);
															_t521 =  *(_t710 + 0x20);
															do {
																_t705 = _t704 & _t521;
																_t521 = _t521 + 1;
																 *( *((intOrPtr*)(_t665 + 0x4b34)) +  *(_t665 + 0x70)) =  *((intOrPtr*)( *((intOrPtr*)(_t665 + 0x4b34)) + _t705));
																_t704 =  *(_t665 + 0xe6dc);
																 *(_t665 + 0x70) =  *(_t665 + 0x70) + 0x00000001 & _t704;
																_t684 = _t684 - 1;
																__eflags = _t684;
															} while (_t684 != 0);
															goto L157;
														} else {
															__eflags = _t650 - _t457;
															if(_t650 >= _t457) {
																goto L92;
															}
															_t462 =  *((intOrPtr*)(_t665 + 0x4b34));
															_t573 = _t571 + _t462;
															 *(_t665 + 0x70) =  *(_t665 + 0x70) + _t684;
															_t652 = _t650 + _t462;
															 *(_t710 + 0x18) = _t573;
															 *(_t710 + 0x20) = _t652;
															__eflags = _t703 - _t684;
															if(_t703 >= _t684) {
																__eflags = _t684 - 8;
																if(_t684 < 8) {
																	L83:
																	_t367 =  *((intOrPtr*)(_t710 + 0x14));
																	_t686 = _t514 + 4;
																	__eflags = _t684;
																	if(_t684 == 0) {
																		goto L10;
																	}
																	_t686 = _t514 + 4;
																	 *_t652 =  *_t573;
																	_t367 =  *((intOrPtr*)(_t710 + 0x14));
																	__eflags = _t684 - 1;
																	if(_t684 <= 1) {
																		goto L10;
																	}
																	_t686 = _t514 + 4;
																	 *((char*)(_t652 + 1)) =  *((intOrPtr*)(_t573 + 1));
																	_t367 =  *((intOrPtr*)(_t710 + 0x14));
																	__eflags = _t684 - 2;
																	if(_t684 <= 2) {
																		goto L10;
																	}
																	_t686 = _t514 + 4;
																	 *((char*)(_t652 + 2)) =  *((intOrPtr*)(_t573 + 2));
																	_t367 =  *((intOrPtr*)(_t710 + 0x14));
																	__eflags = _t684 - 3;
																	if(_t684 <= 3) {
																		goto L10;
																	}
																	_t686 = _t514 + 4;
																	 *((char*)(_t652 + 3)) =  *((intOrPtr*)(_t573 + 3));
																	_t367 =  *((intOrPtr*)(_t710 + 0x14));
																	__eflags = _t684 - 4;
																	if(_t684 <= 4) {
																		goto L10;
																	}
																	_t686 = _t514 + 4;
																	 *((char*)(_t652 + 4)) =  *((intOrPtr*)(_t573 + 4));
																	_t367 =  *((intOrPtr*)(_t710 + 0x14));
																	__eflags = _t684 - 5;
																	if(_t684 <= 5) {
																		goto L10;
																	}
																	goto L89;
																}
																_t707 = _t684 >> 3;
																__eflags = _t707;
																do {
																	E00A7EE90(_t652, _t573, 8);
																	_t574 =  *((intOrPtr*)(_t710 + 0x24));
																	_t710 = _t710 + 0xc;
																	_t573 = _t574 + 8;
																	_t652 =  *(_t710 + 0x20) + 8;
																	 *(_t710 + 0x18) = _t573;
																	_t684 = _t684 - 8;
																	 *(_t710 + 0x20) = _t652;
																	_t707 = _t707 - 1;
																	__eflags = _t707;
																} while (_t707 != 0);
																goto L83;
															}
															__eflags = _t684 - 8;
															if(_t684 < 8) {
																goto L83;
															}
															_t709 = _t684 >> 3;
															__eflags = _t709;
															do {
																_t684 = _t684 - 8;
																 *_t652 =  *_t573;
																 *((char*)(_t652 + 1)) =  *((intOrPtr*)(_t573 + 1));
																 *((char*)(_t652 + 2)) =  *((intOrPtr*)(_t573 + 2));
																 *((char*)(_t652 + 3)) =  *((intOrPtr*)(_t573 + 3));
																 *((char*)(_t652 + 4)) =  *((intOrPtr*)(_t573 + 4));
																 *((char*)(_t652 + 5)) =  *((intOrPtr*)(_t573 + 5));
																 *((char*)(_t652 + 6)) =  *((intOrPtr*)(_t573 + 6));
																_t478 =  *((intOrPtr*)(_t573 + 7));
																_t573 = _t573 + 8;
																 *((char*)(_t652 + 7)) = _t478;
																_t652 = _t652 + 8;
																_t709 = _t709 - 1;
																__eflags = _t709;
															} while (_t709 != 0);
															goto L83;
														}
													}
													__eflags = _t452 - 4;
													if(__eflags < 0) {
														_t479 = E00A76B93(_t514 + 4);
														_t576 = 0x20;
														_t703 = _t703 + (_t479 >> _t576 -  *(_t710 + 0x18));
														_t579 =  *(_t514 + 8) +  *(_t710 + 0x18);
														 *((intOrPtr*)(_t514 + 4)) =  *((intOrPtr*)(_t514 + 4)) + (_t579 >> 3);
														_t580 = _t579 & 0x00000007;
														__eflags = _t580;
														 *(_t514 + 8) = _t580;
														goto L69;
													}
													if(__eflags <= 0) {
														_t654 = _t514 + 4;
													} else {
														_t493 = E00A76B93(_t514 + 4);
														_t661 =  *(_t710 + 0x18);
														_t596 = 0x24;
														_t599 =  *(_t514 + 8) + _t661 + 0xfffffffc;
														_t703 = _t703 + (_t493 >> _t596 - _t661 << 4);
														_t654 = _t514 + 4;
														 *_t654 =  *_t654 + (_t599 >> 3);
														 *(_t654 + 4) = _t599 & 0x00000007;
													}
													_t483 = E00A69E9F(_t654);
													_t484 =  *(_t514 + 0x1e8c);
													_t656 = _t483 & 0x0000fffe;
													__eflags = _t656 -  *((intOrPtr*)(_t514 + 0x1e0c + _t484 * 4));
													if(_t656 >=  *((intOrPtr*)(_t514 + 0x1e0c + _t484 * 4))) {
														_t582 = 0xf;
														_t485 = _t484 + 1;
														 *(_t710 + 0x18) = _t582;
														__eflags = _t485 - _t582;
														if(_t485 >= _t582) {
															L66:
															_t584 =  *(_t514 + 8) +  *(_t710 + 0x18);
															 *((intOrPtr*)(_t514 + 4)) =  *((intOrPtr*)(_t514 + 4)) + (_t584 >> 3);
															_t488 =  *(_t710 + 0x18);
															 *(_t514 + 8) = _t584 & 0x00000007;
															_t586 = 0x10;
															_t659 = (_t656 -  *((intOrPtr*)(_t514 + 0x1e08 + _t488 * 4)) >> _t586 - _t488) +  *((intOrPtr*)(_t514 + 0x1e4c + _t488 * 4));
															__eflags = _t659 -  *((intOrPtr*)(_t514 + 0x1e08));
															asm("sbb eax, eax");
															_t489 = _t488 & _t659;
															__eflags = _t489;
															_t490 =  *(_t514 + 0x2a90 + _t489 * 2) & 0x0000ffff;
															goto L67;
														}
														_t589 = _t514 + (_t485 + 0x783) * 4;
														while(1) {
															__eflags = _t656 -  *_t589;
															if(_t656 <  *_t589) {
																break;
															}
															_t485 = _t485 + 1;
															_t589 = _t589 + 4;
															__eflags = _t485 - 0xf;
															if(_t485 < 0xf) {
																continue;
															}
															goto L66;
														}
														 *(_t710 + 0x18) = _t485;
														goto L66;
													} else {
														_t590 = 0x10;
														_t660 = _t656 >> _t590 - _t484;
														_t593 = ( *(_t660 + _t514 + 0x1e90) & 0x000000ff) +  *(_t514 + 8);
														 *((intOrPtr*)(_t514 + 4)) =  *((intOrPtr*)(_t514 + 4)) + (_t593 >> 3);
														 *(_t514 + 8) = _t593 & 0x00000007;
														_t490 =  *(_t514 + 0x2290 + _t660 * 2) & 0x0000ffff;
														L67:
														_t703 = _t703 + _t490;
														goto L69;
													}
												}
												_t703 = _t699 + 1;
												goto L69;
											}
										}
										 *( *((intOrPtr*)(_t665 + 0x4b34)) +  *(_t665 + 0x70)) = _t629;
										_t65 = _t665 + 0x70;
										 *_t65 =  *(_t665 + 0x70) + 1;
										__eflags =  *_t65;
										goto L34;
									}
									_t616 = _t514 + (_t373 + 0xd) * 4;
									while(1) {
										__eflags = _t625 -  *_t616;
										if(_t625 <  *_t616) {
											break;
										}
										_t373 = _t373 + 1;
										_t616 = _t616 + 4;
										__eflags = _t373 - 0xf;
										if(_t373 < 0xf) {
											continue;
										}
										goto L31;
									}
									_t669 = _t373;
									goto L31;
								}
								_t617 = 0x10;
								_t664 = _t625 >> _t617 - _t372;
								_t620 = ( *(_t664 + _t514 + 0xb8) & 0x000000ff) +  *(_t686 + 4);
								 *_t686 =  *_t686 + (_t620 >> 3);
								 *(_t686 + 4) = _t620 & 0x00000007;
								_t629 =  *(_t514 + 0x4b8 + _t664 * 2) & 0x0000ffff;
								goto L32;
							}
							__eflags = _t525 -  *(_t665 + 0x70);
							if(_t525 ==  *(_t665 + 0x70)) {
								goto L23;
							}
							E00A73638(_t665);
							__eflags =  *((intOrPtr*)(_t665 + 0x4c54)) -  *((intOrPtr*)(_t665 + 0x4c44));
							if(__eflags > 0) {
								L159:
								_t386 = 0;
								goto L100;
							}
							if(__eflags < 0) {
								goto L23;
							}
							__eflags =  *((intOrPtr*)(_t665 + 0x4c50)) -  *((intOrPtr*)(_t665 + 0x4c40));
							if( *((intOrPtr*)(_t665 + 0x4c50)) >  *((intOrPtr*)(_t665 + 0x4c40))) {
								goto L159;
							}
							goto L23;
						}
					} else {
						 *((char*)(_t514 + 0x4ad0)) = 1;
						_t386 = 0;
						L101:
						return _t386;
					}
				} else {
					 *((char*)(_t514 + 0x2c)) = 1;
					_push(_t514 + 0x30);
					_push(_t514 + 0x18);
					_push(_t514 + 4);
					_t513 = E00A72795(__ecx);
					if(_t513 != 0) {
						goto L3;
					} else {
						 *((char*)(_t514 + 0x4ad0)) = 1;
						return _t513;
					}
				}
			}

0x00a75aa5
0x00a75aaa
0x00a75ab0
0x00a75ad7
0x00a75ada
0x00a75ae0
0x00a75ae3
0x00a75ae6
0x00a75b01
0x00a75b03
0x00a75b06
0x00a75b0a
0x00a75b0e
0x00a75b10
0x00a75b18
0x00a75b12
0x00a75b12
0x00a75b12
0x00a75b2a
0x00a75b2a
0x00a75b30
0x00a75b33
0x00a75b36
0x00a75b3a
0x00000000
0x00000000
0x00a75b3c
0x00a75b3c
0x00a75b3e
0x00a760bf
0x00a760bf
0x00a760c1
0x00000000
0x00a760c1
0x00a75b44
0x00a75b52
0x00a75b52
0x00a75b54
0x00a75b63
0x00a75b63
0x00a75b69
0x00a7648c
0x00a7648c
0x00000000
0x00a7648c
0x00000000
0x00a75b69
0x00a75b56
0x00a75b5d
0x00000000
0x00000000
0x00000000
0x00a75b5d
0x00a75b49
0x00a75b4c
0x00000000
0x00000000
0x00000000
0x00a75b6f
0x00a75b6f
0x00a75b7c
0x00a75b81
0x00a75bb5
0x00a75bb7
0x00a75bbe
0x00a75bc4
0x00a75bca
0x00a75bce
0x00a75bfc
0x00a75bfd
0x00a75bfe
0x00a75c00
0x00a75c19
0x00a75c1c
0x00a75c23
0x00a75c26
0x00a75c29
0x00a75c32
0x00a75c37
0x00a75c3b
0x00a75c3e
0x00a75c40
0x00a75c40
0x00a75c42
0x00a75c4a
0x00a75c4f
0x00a75c51
0x00a75c6f
0x00a75c75
0x00a76096
0x00a76098
0x00a760cb
0x00a760d1
0x00a7626e
0x00a7626e
0x00a76277
0x00a7627a
0x00a7627c
0x00a76280
0x00a7628f
0x00a76291
0x00a76294
0x00a7629b
0x00a762a1
0x00a762a7
0x00a762ae
0x00a762dc
0x00a762dd
0x00a762de
0x00a762e0
0x00a762fc
0x00a762ff
0x00a76306
0x00a76309
0x00a7630c
0x00a76318
0x00a7631d
0x00a76324
0x00a7632a
0x00a7632c
0x00a7632c
0x00a7632e
0x00a76336
0x00a76336
0x00a76339
0x00a7634b
0x00a76350
0x00a76353
0x00a76355
0x00a7635a
0x00a76361
0x00a76369
0x00a7636b
0x00a76372
0x00a76375
0x00a76375
0x00a76378
0x00a76378
0x00a7633b
0x00a7633b
0x00a7633b
0x00a7637b
0x00a76386
0x00a7638a
0x00a7638f
0x00a76392
0x00a76394
0x00a76448
0x00a76448
0x00a7644c
0x00a7644e
0x00000000
0x00000000
0x00a76454
0x00a7645a
0x00a76460
0x00a76465
0x00a76469
0x00a7646f
0x00a76478
0x00a7647b
0x00a7647b
0x00a7647b
0x00a76480
0x00a76480
0x00a76484
0x00a75c62
0x00a75c62
0x00000000
0x00a7639a
0x00a7639a
0x00a7639c
0x00000000
0x00000000
0x00a763a2
0x00a763a8
0x00a763aa
0x00a763b0
0x00a763b4
0x00a763b7
0x00a763bb
0x00a7640d
0x00a76410
0x00a761a5
0x00a761a5
0x00a761a9
0x00a761ab
0x00a75b23
0x00a75b23
0x00a75b26
0x00a75b2a
0x00a75b2a
0x00a75b30
0x00a75b33
0x00a75b36
0x00a75b3a
0x00000000
0x00000000
0x00000000
0x00a75b3a
0x00a75b2a
0x00a761b4
0x00a761b6
0x00a761ba
0x00a761bd
0x00000000
0x00000000
0x00a761c6
0x00a761c9
0x00a761cd
0x00a761d0
0x00000000
0x00000000
0x00a761d9
0x00a761dc
0x00a761e0
0x00a761e3
0x00000000
0x00000000
0x00a761ec
0x00a761ef
0x00a761f3
0x00a761f6
0x00000000
0x00000000
0x00a761ff
0x00a76202
0x00a76206
0x00a76209
0x00000000
0x00000000
0x00a76212
0x00a76215
0x00a76219
0x00a7621c
0x00a76220
0x00a75b1e
0x00a75b2a
0x00a75b2a
0x00a75b30
0x00a75b33
0x00a75b36
0x00a75b3a
0x00000000
0x00000000
0x00000000
0x00a75b3a
0x00a75b2a
0x00a76229
0x00a7604a
0x00a7604a
0x00a75c66
0x00a75c66
0x00a75b2a
0x00a75b2a
0x00a75b30
0x00a75b33
0x00a75b36
0x00a75b3a
0x00000000
0x00000000
0x00000000
0x00a7602a
0x00a7602d
0x00a76030
0x00a76033
0x00a76036
0x00a7603a
0x00a7603a
0x00a76047
0x00000000
0x00a76047
0x00a76418
0x00a76418
0x00a7641b
0x00a7641f
0x00a76421
0x00a76425
0x00a7642a
0x00a7642e
0x00a76431
0x00a76434
0x00a76437
0x00a7643a
0x00a7643e
0x00a7643e
0x00a7643e
0x00a761a1
0x00a761a1
0x00000000
0x00a761a1
0x00a763bd
0x00a763c0
0x00000000
0x00000000
0x00a763c8
0x00a763c8
0x00a763cb
0x00a763ce
0x00a763d1
0x00a763d6
0x00a763dc
0x00a763e2
0x00a763e8
0x00a763ee
0x00a763f4
0x00a763f7
0x00a763fa
0x00a763fd
0x00a76400
0x00a76403
0x00a76403
0x00a76403
0x00000000
0x00a76408
0x00a76394
0x00a762e8
0x00a762eb
0x00a762eb
0x00a762ed
0x00000000
0x00000000
0x00a762ef
0x00a762f0
0x00a762f3
0x00a762f6
0x00000000
0x00000000
0x00000000
0x00a762f8
0x00a762fa
0x00000000
0x00a762fa
0x00a762b2
0x00a762b5
0x00a762bf
0x00a762c7
0x00a762cd
0x00a762d0
0x00000000
0x00000000
0x00000000
0x00000000
0x00a76282
0x00a76282
0x00a76285
0x00a76287
0x00a7628a
0x00a7628a
0x00a7628a
0x00000000
0x00a76282
0x00a760d7
0x00a760da
0x00a760de
0x00a760e0
0x00000000
0x00000000
0x00a760e6
0x00a760e9
0x00a760ee
0x00a760f0
0x00a760fa
0x00a760ff
0x00a76101
0x00a76231
0x00a76231
0x00a76235
0x00a76237
0x00000000
0x00000000
0x00a7623d
0x00a76243
0x00a76249
0x00a7624e
0x00a76252
0x00a76258
0x00a76261
0x00a76264
0x00a76264
0x00a76264
0x00000000
0x00a76269
0x00a76107
0x00a76109
0x00000000
0x00000000
0x00a7610f
0x00a76115
0x00a76117
0x00a7611d
0x00a76121
0x00a76124
0x00a76128
0x00a76173
0x00a76176
0x00000000
0x00000000
0x00a7617a
0x00a7617a
0x00a7617d
0x00a7617f
0x00a76183
0x00a76188
0x00a7618c
0x00a7618f
0x00a76192
0x00a76195
0x00a76198
0x00a7619c
0x00a7619c
0x00a7619c
0x00000000
0x00a7617f
0x00a7612a
0x00a7612d
0x00000000
0x00000000
0x00a76131
0x00a76131
0x00a76134
0x00a76137
0x00a7613a
0x00a7613f
0x00a76145
0x00a7614b
0x00a76151
0x00a76157
0x00a7615d
0x00a76160
0x00a76163
0x00a76166
0x00a76169
0x00a7616c
0x00a7616c
0x00a7616c
0x00000000
0x00a76171
0x00a760a0
0x00a760a2
0x00a760a7
0x00a760a9
0x00000000
0x00000000
0x00a760b2
0x00a760b7
0x00a760b9
0x00000000
0x00000000
0x00000000
0x00a760b9
0x00a75c7b
0x00a75c81
0x00a75c84
0x00a75c96
0x00a75c9b
0x00a75c9e
0x00a75ca0
0x00a75ccb
0x00a75ca2
0x00a75ca5
0x00a75cac
0x00a75cb4
0x00a75cb6
0x00a75cb8
0x00a75cc0
0x00a75cc6
0x00a75cc6
0x00a75c86
0x00a75c86
0x00a75c86
0x00a75cd0
0x00a75cd7
0x00a75cdd
0x00a75ce3
0x00a75cea
0x00a75d18
0x00a75d19
0x00a75d1a
0x00a75d1e
0x00a75d20
0x00a75d3e
0x00a75d41
0x00a75d4d
0x00a75d50
0x00a75d54
0x00a75d59
0x00a75d65
0x00a75d6c
0x00a75d72
0x00a75d74
0x00a75d74
0x00a75d76
0x00000000
0x00a75d76
0x00a75d28
0x00a75d2b
0x00a75d2b
0x00a75d2d
0x00000000
0x00000000
0x00a75d2f
0x00a75d30
0x00a75d33
0x00a75d36
0x00000000
0x00000000
0x00000000
0x00a75d38
0x00a75d3a
0x00000000
0x00a75cec
0x00a75cee
0x00a75cf1
0x00a75cfb
0x00a75d03
0x00a75d09
0x00a75d0c
0x00a75d7e
0x00a75d7e
0x00a75d81
0x00a75d93
0x00a75d96
0x00a75d9c
0x00a75d9d
0x00a75d9f
0x00a75ec1
0x00a75ec1
0x00a75ec7
0x00a75ec9
0x00a75eca
0x00a75ed0
0x00a75ed2
0x00a75ed3
0x00a75ed9
0x00a75edb
0x00a75edb
0x00a75edb
0x00a75ed9
0x00a75ed0
0x00a75edf
0x00a75ee5
0x00a75eeb
0x00a75eee
0x00a75ef1
0x00a75efc
0x00a75efe
0x00a75f03
0x00a75f06
0x00a75f0a
0x00a75f0c
0x00a76052
0x00a76052
0x00a76056
0x00a76059
0x00a7605b
0x00000000
0x00000000
0x00a76061
0x00a76067
0x00a7606b
0x00a76071
0x00a76076
0x00a7607a
0x00a76080
0x00a76089
0x00a7608c
0x00a7608c
0x00a7608c
0x00000000
0x00a75f12
0x00a75f12
0x00a75f14
0x00000000
0x00000000
0x00a75f1a
0x00a75f20
0x00a75f22
0x00a75f25
0x00a75f27
0x00a75f2b
0x00a75f2f
0x00a75f31
0x00a75f7b
0x00a75f7e
0x00a75faf
0x00a75faf
0x00a75fb3
0x00a75fb6
0x00a75fb8
0x00000000
0x00000000
0x00a75fc0
0x00a75fc3
0x00a75fc5
0x00a75fc9
0x00a75fcc
0x00000000
0x00000000
0x00a75fd5
0x00a75fd8
0x00a75fdb
0x00a75fdf
0x00a75fe2
0x00000000
0x00000000
0x00a75feb
0x00a75fee
0x00a75ff1
0x00a75ff5
0x00a75ff8
0x00000000
0x00000000
0x00a76001
0x00a76004
0x00a76007
0x00a7600b
0x00a7600e
0x00000000
0x00000000
0x00a76017
0x00a7601a
0x00a7601d
0x00a76021
0x00a76024
0x00000000
0x00000000
0x00000000
0x00a76024
0x00a75f82
0x00a75f82
0x00a75f85
0x00a75f89
0x00a75f8e
0x00a75f92
0x00a75f99
0x00a75f9c
0x00a75f9f
0x00a75fa3
0x00a75fa6
0x00a75faa
0x00a75faa
0x00a75faa
0x00000000
0x00a75f85
0x00a75f33
0x00a75f36
0x00000000
0x00000000
0x00a75f3a
0x00a75f3a
0x00a75f3d
0x00a75f3f
0x00a75f42
0x00a75f47
0x00a75f4d
0x00a75f53
0x00a75f59
0x00a75f5f
0x00a75f65
0x00a75f68
0x00a75f6b
0x00a75f6e
0x00a75f71
0x00a75f74
0x00a75f74
0x00a75f74
0x00000000
0x00a75f79
0x00a75f0c
0x00a75da5
0x00a75da8
0x00a75e9c
0x00a75ea3
0x00a75ead
0x00a75eaf
0x00a75eb8
0x00a75ebb
0x00a75ebb
0x00a75ebe
0x00000000
0x00a75ebe
0x00a75dae
0x00a75de2
0x00a75db0
0x00a75db3
0x00a75db8
0x00a75dbe
0x00a75dcc
0x00a75dce
0x00a75dd0
0x00a75dd8
0x00a75ddd
0x00a75ddd
0x00a75de7
0x00a75dee
0x00a75df4
0x00a75dfa
0x00a75e01
0x00a75e2f
0x00a75e30
0x00a75e31
0x00a75e35
0x00a75e37
0x00a75e55
0x00a75e58
0x00a75e64
0x00a75e67
0x00a75e6b
0x00a75e70
0x00a75e7c
0x00a75e83
0x00a75e89
0x00a75e8b
0x00a75e8b
0x00a75e8d
0x00000000
0x00a75e8d
0x00a75e3f
0x00a75e42
0x00a75e42
0x00a75e44
0x00000000
0x00000000
0x00a75e46
0x00a75e47
0x00a75e4a
0x00a75e4d
0x00000000
0x00000000
0x00000000
0x00a75e4f
0x00a75e51
0x00000000
0x00a75e03
0x00a75e05
0x00a75e08
0x00a75e12
0x00a75e1a
0x00a75e20
0x00a75e23
0x00a75e95
0x00a75e95
0x00000000
0x00a75e95
0x00a75e01
0x00a75d83
0x00000000
0x00a75d83
0x00a75cea
0x00a75c5c
0x00a75c5f
0x00a75c5f
0x00a75c5f
0x00000000
0x00a75c5f
0x00a75c05
0x00a75c08
0x00a75c08
0x00a75c0a
0x00000000
0x00000000
0x00a75c0c
0x00a75c0d
0x00a75c10
0x00a75c13
0x00000000
0x00000000
0x00000000
0x00a75c15
0x00a75c17
0x00000000
0x00a75c17
0x00a75bd2
0x00a75bd5
0x00a75bdf
0x00a75be7
0x00a75bed
0x00a75bf0
0x00000000
0x00a75bf0
0x00a75b83
0x00a75b86
0x00000000
0x00000000
0x00a75b8a
0x00a75b95
0x00a75b9b
0x00a76498
0x00a76498
0x00000000
0x00a76498
0x00a75ba1
0x00000000
0x00000000
0x00a75ba9
0x00a75baf
0x00000000
0x00000000
0x00000000
0x00a75baf
0x00a75ae8
0x00a75ae8
0x00a75aef
0x00a760c2
0x00000000
0x00a760c2
0x00a75ab2
0x00a75ab5
0x00a75ab9
0x00a75abd
0x00a75ac1
0x00a75ac2
0x00a75ac9
0x00000000
0x00a75acb
0x00a75acb
0x00000000
0x00a75acb
0x00a75ac9

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ec45c8ce625f47b5974667e5f04d8b3faea64dada4b885def48af86a64f9fef
Instruction ID: 56e804bd2f57d5e22863ff6ebd911c0b53565050233d67e0ab2d4dd562aec14c
Opcode Fuzzy Hash: 2ec45c8ce625f47b5974667e5f04d8b3faea64dada4b885def48af86a64f9fef
Instruction Fuzzy Hash: 0662E571A086458FCB19CF38C9806A8BBA1BF55304F18C6ADE89D8F347D771E946CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00A75490 Relevance: .5, Instructions: 490
COMMONCrypto

Download Yara Rule

C-Code - Quality: 88%

			E00A75490(intOrPtr __ecx) {
				void* __ebp;
				intOrPtr _t198;
				signed int _t200;
				signed int _t202;
				signed int _t203;
				signed int _t204;
				signed int _t206;
				signed int _t207;
				signed int _t209;
				signed int _t211;
				signed int _t212;
				signed int _t213;
				signed int _t215;
				signed int _t216;
				signed int _t219;
				unsigned int _t220;
				signed int _t230;
				signed int _t234;
				signed int _t235;
				signed int _t236;
				signed int _t237;
				signed int _t239;
				signed int _t240;
				signed int _t243;
				signed int _t244;
				unsigned int _t245;
				signed int _t249;
				signed int _t250;
				signed int _t251;
				signed int _t254;
				signed int _t255;
				signed int _t256;
				unsigned int _t259;
				unsigned int _t266;
				signed int _t271;
				signed short _t272;
				signed int _t276;
				void* _t283;
				intOrPtr _t285;
				signed int _t286;
				signed int _t287;
				signed int _t288;
				signed int _t292;
				signed int _t295;
				signed int _t296;
				signed int _t297;
				intOrPtr _t301;
				signed int _t302;
				intOrPtr _t305;
				intOrPtr _t306;
				signed int _t307;
				unsigned int _t310;
				void* _t312;
				signed int _t314;
				unsigned int _t317;
				void* _t319;
				signed int _t321;
				void* _t324;
				signed int _t327;
				signed int _t328;
				intOrPtr* _t330;
				void* _t331;
				signed int _t334;
				signed int* _t338;
				unsigned int _t342;
				void* _t344;
				void* _t348;
				signed int _t351;
				signed int _t352;
				signed int _t354;
				signed int _t356;
				void* _t358;
				intOrPtr* _t361;
				void* _t362;
				signed int _t365;
				void* _t368;
				signed int _t371;
				signed int _t372;
				intOrPtr* _t374;
				void* _t375;
				signed int _t378;
				void* _t381;
				signed int _t384;
				signed int _t385;
				intOrPtr* _t387;
				void* _t388;
				signed int _t391;
				intOrPtr _t397;
				unsigned int _t399;
				signed int _t402;
				unsigned int _t404;
				signed int _t407;
				signed int _t408;
				signed int _t409;
				unsigned int _t411;
				signed int _t414;
				unsigned int _t416;
				signed int _t419;
				signed int _t420;
				signed int _t421;
				signed int _t422;
				void* _t423;
				signed int _t424;
				intOrPtr* _t426;
				signed int _t428;
				signed int* _t431;
				signed int _t433;
				signed int _t437;
				void* _t438;

				_t428 =  *(_t438 + 0x2c);
				 *((intOrPtr*)(_t438 + 0x14)) = __ecx;
				if( *((char*)(_t428 + 0x2c)) != 0) {
					L3:
					_t305 =  *((intOrPtr*)(_t428 + 0x18));
					_t426 = _t428 + 4;
					__eflags =  *_t426 -  *((intOrPtr*)(_t428 + 0x24)) + _t305;
					if( *_t426 <=  *((intOrPtr*)(_t428 + 0x24)) + _t305) {
						 *(_t428 + 0x4ad8) =  *(_t428 + 0x4ad8) & 0x00000000;
						_t198 =  *((intOrPtr*)(_t428 + 0x20)) - 1 + _t305;
						_t397 =  *((intOrPtr*)(_t428 + 0x4acc)) - 0x10;
						 *((intOrPtr*)(_t438 + 0xc)) = _t198;
						 *((intOrPtr*)(_t438 + 8)) = _t397;
						__eflags = _t198 - _t397;
						if(_t198 >= _t397) {
							_t285 = _t397;
							 *((intOrPtr*)(_t438 + 0x34)) = _t397;
						} else {
							_t285 = _t198;
							 *((intOrPtr*)(_t438 + 0x34)) = _t285;
						}
						while(1) {
							_t306 =  *_t426;
							__eflags = _t306 - _t285;
							if(_t306 < _t285) {
								goto L16;
							}
							__eflags = _t306 - _t198;
							if(__eflags > 0) {
								L91:
								goto L92;
							}
							if(__eflags != 0) {
								L13:
								__eflags = _t306 - _t397;
								if(_t306 < _t397) {
									L15:
									__eflags = _t306 -  *((intOrPtr*)(_t428 + 0x4acc));
									if(_t306 >=  *((intOrPtr*)(_t428 + 0x4acc))) {
										L90:
										 *((char*)(_t428 + 0x4ad3)) = 1;
										goto L91;
									}
									goto L16;
								}
								__eflags =  *((char*)(_t428 + 0x4ad2));
								if( *((char*)(_t428 + 0x4ad2)) == 0) {
									goto L90;
								}
								goto L15;
							}
							_t198 =  *((intOrPtr*)(_t428 + 8));
							__eflags = _t198 -  *((intOrPtr*)(_t428 + 0x1c));
							if(_t198 >=  *((intOrPtr*)(_t428 + 0x1c))) {
								goto L91;
							}
							goto L13;
							L16:
							_t307 =  *(_t428 + 0x4adc);
							__eflags =  *(_t428 + 0x4ad8) - _t307 - 8;
							if( *(_t428 + 0x4ad8) > _t307 - 8) {
								_t276 = _t307 + _t307;
								 *(_t428 + 0x4adc) = _t276;
								_push(_t276 * 0xc);
								_push( *(_t428 + 0x4ad4));
								_t302 = E00A816D5(_t307, _t397);
								__eflags = _t302;
								if(_t302 == 0) {
									E00A66A1C(0xa9bbf8);
								}
								 *(_t428 + 0x4ad4) = _t302;
							}
							_t200 =  *(_t428 + 0x4ad8);
							_t431 = _t200 * 0xc +  *(_t428 + 0x4ad4);
							 *(_t438 + 0x1c) = _t431;
							 *(_t428 + 0x4ad8) = _t200 + 1;
							_t202 = E00A69E9F(_t426);
							_t203 =  *(_t428 + 0xb4);
							_t399 = _t202 & 0x0000fffe;
							__eflags = _t399 -  *((intOrPtr*)(_t428 + 0x34 + _t203 * 4));
							if(_t399 >=  *((intOrPtr*)(_t428 + 0x34 + _t203 * 4))) {
								_t286 = 0xf;
								_t204 = _t203 + 1;
								__eflags = _t204 - _t286;
								if(_t204 >= _t286) {
									L28:
									_t310 =  *(_t426 + 4) + _t286;
									 *(_t426 + 4) = _t310 & 0x00000007;
									_t206 = _t310 >> 3;
									 *_t426 =  *_t426 + _t206;
									_t312 = 0x10;
									_t402 = (_t399 -  *((intOrPtr*)(_t428 + 0x30 + _t286 * 4)) >> _t312 - _t286) +  *((intOrPtr*)(_t428 + 0x74 + _t286 * 4));
									__eflags = _t402 -  *((intOrPtr*)(_t428 + 0x30));
									asm("sbb eax, eax");
									_t207 = _t206 & _t402;
									__eflags = _t207;
									_t314 =  *(_t428 + 0xcb8 + _t207 * 2) & 0x0000ffff;
									goto L29;
								}
								_t387 = _t428 + 0x34 + _t204 * 4;
								while(1) {
									__eflags = _t399 -  *_t387;
									if(_t399 <  *_t387) {
										break;
									}
									_t204 = _t204 + 1;
									_t387 = _t387 + 4;
									__eflags = _t204 - 0xf;
									if(_t204 < 0xf) {
										continue;
									}
									goto L28;
								}
								_t286 = _t204;
								goto L28;
							} else {
								_t388 = 0x10;
								_t424 = _t399 >> _t388 - _t203;
								_t391 = ( *(_t424 + _t428 + 0xb8) & 0x000000ff) +  *(_t426 + 4);
								 *_t426 =  *_t426 + (_t391 >> 3);
								 *(_t426 + 4) = _t391 & 0x00000007;
								_t314 =  *(_t428 + 0x4b8 + _t424 * 2) & 0x0000ffff;
								L29:
								__eflags = _t314 - 0x100;
								if(_t314 >= 0x100) {
									__eflags = _t314 - 0x106;
									if(_t314 < 0x106) {
										__eflags = _t314 - 0x100;
										if(_t314 != 0x100) {
											__eflags = _t314 - 0x101;
											if(_t314 != 0x101) {
												_t209 = 3;
												 *_t431 = _t209;
												_t431[2] = _t314 - 0x102;
												_t211 = E00A69E9F(_t426);
												_t212 =  *(_t428 + 0x2d78);
												_t404 = _t211 & 0x0000fffe;
												__eflags = _t404 -  *((intOrPtr*)(_t428 + 0x2cf8 + _t212 * 4));
												if(_t404 >=  *((intOrPtr*)(_t428 + 0x2cf8 + _t212 * 4))) {
													_t287 = 0xf;
													_t213 = _t212 + 1;
													__eflags = _t213 - _t287;
													if(_t213 >= _t287) {
														L84:
														_t317 =  *(_t426 + 4) + _t287;
														 *(_t426 + 4) = _t317 & 0x00000007;
														_t215 = _t317 >> 3;
														 *_t426 =  *_t426 + _t215;
														_t319 = 0x10;
														_t407 = (_t404 -  *((intOrPtr*)(_t428 + 0x2cf4 + _t287 * 4)) >> _t319 - _t287) +  *((intOrPtr*)(_t428 + 0x2d38 + _t287 * 4));
														__eflags = _t407 -  *((intOrPtr*)(_t428 + 0x2cf4));
														asm("sbb eax, eax");
														_t216 = _t215 & _t407;
														__eflags = _t216;
														_t288 =  *(_t428 + 0x397c + _t216 * 2) & 0x0000ffff;
														L85:
														__eflags = _t288 - 8;
														if(_t288 >= 8) {
															_t321 = 3;
															_t219 = (_t288 >> 2) - 1;
															 *(_t438 + 0x1c) = _t219;
															_t292 = ((_t288 & _t321 | 0x00000004) << _t219) + 2;
															__eflags = _t219;
															if(_t219 != 0) {
																_t220 = E00A69E9F(_t426);
																_t324 = 0x10;
																_t292 = _t292 + (_t220 >> _t324 -  *(_t438 + 0x1c));
																_t327 =  *(_t426 + 4) +  *(_t438 + 0x1c);
																 *_t426 =  *_t426 + (_t327 >> 3);
																_t328 = _t327 & 0x00000007;
																__eflags = _t328;
																 *(_t426 + 4) = _t328;
															}
														} else {
															_t292 = _t288 + 2;
														}
														_t431[1] = _t292;
														L34:
														_t397 =  *((intOrPtr*)(_t438 + 0x10));
														_t198 =  *((intOrPtr*)(_t438 + 0x14));
														_t285 =  *((intOrPtr*)(_t438 + 0x38));
														continue;
													}
													_t330 = _t428 + 0x2cf8 + _t213 * 4;
													while(1) {
														__eflags = _t404 -  *_t330;
														if(_t404 <  *_t330) {
															break;
														}
														_t213 = _t213 + 1;
														_t330 = _t330 + 4;
														__eflags = _t213 - 0xf;
														if(_t213 < 0xf) {
															continue;
														}
														goto L84;
													}
													_t287 = _t213;
													goto L84;
												}
												_t331 = 0x10;
												_t408 = _t404 >> _t331 - _t212;
												_t334 = ( *(_t408 + _t428 + 0x2d7c) & 0x000000ff) +  *(_t426 + 4);
												 *_t426 =  *_t426 + (_t334 >> 3);
												 *(_t426 + 4) = _t334 & 0x00000007;
												_t288 =  *(_t428 + 0x317c + _t408 * 2) & 0x0000ffff;
												goto L85;
											}
											 *_t431 = 2;
											goto L34;
										}
										_push(_t438 + 0x24);
										E00A72391( *((intOrPtr*)(_t438 + 0x20)), _t426);
										_t431[1] =  *(_t438 + 0x24) & 0x000000ff;
										_t431[2] =  *(_t438 + 0x28);
										_t409 = 4;
										 *_t431 = _t409;
										_t230 =  *(_t428 + 0x4ad8);
										_t338 = _t230 * 0xc +  *(_t428 + 0x4ad4);
										 *(_t428 + 0x4ad8) = _t230 + 1;
										_t338[1] =  *(_t438 + 0x30) & 0x000000ff;
										 *_t338 = _t409;
										_t338[2] =  *(_t438 + 0x2c);
										goto L34;
									}
									_t433 = _t314 - 0x106;
									__eflags = _t433 - 8;
									if(_t433 >= 8) {
										_t234 = 3;
										_t295 = (_t433 >> 2) - 1;
										_t437 = ((_t433 & _t234 | 0x00000004) << _t295) + 2;
										__eflags = _t295;
										if(_t295 != 0) {
											_t266 = E00A69E9F(_t426);
											_t381 = 0x10;
											_t437 = _t437 + (_t266 >> _t381 - _t295);
											_t384 =  *(_t426 + 4) + _t295;
											 *_t426 =  *_t426 + (_t384 >> 3);
											_t385 = _t384 & 0x00000007;
											__eflags = _t385;
											 *(_t426 + 4) = _t385;
										}
									} else {
										_t437 = _t433 + 2;
									}
									_t235 = E00A69E9F(_t426);
									_t236 =  *(_t428 + 0xfa0);
									_t411 = _t235 & 0x0000fffe;
									__eflags = _t411 -  *((intOrPtr*)(_t428 + 0xf20 + _t236 * 4));
									if(_t411 >=  *((intOrPtr*)(_t428 + 0xf20 + _t236 * 4))) {
										_t296 = 0xf;
										_t237 = _t236 + 1;
										__eflags = _t237 - _t296;
										if(_t237 >= _t296) {
											L49:
											_t342 =  *(_t426 + 4) + _t296;
											 *(_t426 + 4) = _t342 & 0x00000007;
											_t239 = _t342 >> 3;
											 *_t426 =  *_t426 + _t239;
											_t344 = 0x10;
											_t414 = (_t411 -  *((intOrPtr*)(_t428 + 0xf1c + _t296 * 4)) >> _t344 - _t296) +  *((intOrPtr*)(_t428 + 0xf60 + _t296 * 4));
											__eflags = _t414 -  *((intOrPtr*)(_t428 + 0xf1c));
											asm("sbb eax, eax");
											_t240 = _t239 & _t414;
											__eflags = _t240;
											_t297 =  *(_t428 + 0x1ba4 + _t240 * 2) & 0x0000ffff;
											goto L50;
										}
										_t374 = _t428 + 0xf20 + _t237 * 4;
										while(1) {
											__eflags = _t411 -  *_t374;
											if(_t411 <  *_t374) {
												break;
											}
											_t237 = _t237 + 1;
											_t374 = _t374 + 4;
											__eflags = _t237 - 0xf;
											if(_t237 < 0xf) {
												continue;
											}
											goto L49;
										}
										_t296 = _t237;
										goto L49;
									} else {
										_t375 = 0x10;
										_t422 = _t411 >> _t375 - _t236;
										_t378 = ( *(_t422 + _t428 + 0xfa4) & 0x000000ff) +  *(_t426 + 4);
										 *_t426 =  *_t426 + (_t378 >> 3);
										 *(_t426 + 4) = _t378 & 0x00000007;
										_t297 =  *(_t428 + 0x13a4 + _t422 * 2) & 0x0000ffff;
										L50:
										__eflags = _t297 - 4;
										if(_t297 >= 4) {
											_t243 = (_t297 >> 1) - 1;
											 *(_t438 + 0x18) = _t243;
											_t301 = ((_t297 & 0x00000001 | 0x00000002) << _t243) + 1;
											__eflags = _t243;
											if(_t243 == 0) {
												L67:
												__eflags = _t301 - 0x100;
												if(_t301 > 0x100) {
													_t437 = _t437 + 1;
													__eflags = _t301 - 0x2000;
													if(_t301 > 0x2000) {
														_t437 = _t437 + 1;
														__eflags = _t301 - 0x40000;
														if(_t301 > 0x40000) {
															_t437 = _t437 + 1;
															__eflags = _t437;
														}
													}
												}
												_t244 =  *(_t438 + 0x1c);
												 *_t244 = 1;
												 *(_t244 + 4) = _t437;
												 *((intOrPtr*)(_t244 + 8)) = _t301;
												goto L34;
											}
											__eflags = _t243 - 4;
											if(__eflags < 0) {
												_t245 = E00A76B93(_t426);
												_t348 = 0x20;
												_t301 = _t301 + (_t245 >> _t348 -  *(_t438 + 0x18));
												_t351 =  *(_t426 + 4) +  *(_t438 + 0x18);
												 *_t426 =  *_t426 + (_t351 >> 3);
												_t352 = _t351 & 0x00000007;
												__eflags = _t352;
												 *(_t426 + 4) = _t352;
												goto L67;
											}
											if(__eflags > 0) {
												_t259 = E00A76B93(_t426);
												_t421 =  *(_t438 + 0x18);
												_t368 = 0x24;
												_t371 = _t421 - 4 +  *(_t426 + 4);
												_t301 = _t301 + (_t259 >> _t368 - _t421 << 4);
												 *_t426 =  *_t426 + (_t371 >> 3);
												_t372 = _t371 & 0x00000007;
												__eflags = _t372;
												 *(_t426 + 4) = _t372;
											}
											_t249 = E00A69E9F(_t426);
											_t250 =  *(_t428 + 0x1e8c);
											_t416 = _t249 & 0x0000fffe;
											__eflags = _t416 -  *((intOrPtr*)(_t428 + 0x1e0c + _t250 * 4));
											if(_t416 >=  *((intOrPtr*)(_t428 + 0x1e0c + _t250 * 4))) {
												_t354 = 0xf;
												_t251 = _t250 + 1;
												 *(_t438 + 0x18) = _t354;
												__eflags = _t251 - _t354;
												if(_t251 >= _t354) {
													L64:
													_t356 =  *(_t426 + 4) +  *(_t438 + 0x18);
													 *_t426 =  *_t426 + (_t356 >> 3);
													_t254 =  *(_t438 + 0x18);
													 *(_t426 + 4) = _t356 & 0x00000007;
													_t358 = 0x10;
													_t419 = (_t416 -  *((intOrPtr*)(_t428 + 0x1e08 + _t254 * 4)) >> _t358 - _t254) +  *((intOrPtr*)(_t428 + 0x1e4c + _t254 * 4));
													__eflags = _t419 -  *((intOrPtr*)(_t428 + 0x1e08));
													asm("sbb eax, eax");
													_t255 = _t254 & _t419;
													__eflags = _t255;
													_t256 =  *(_t428 + 0x2a90 + _t255 * 2) & 0x0000ffff;
													goto L65;
												}
												_t361 = _t428 + 0x1e0c + _t251 * 4;
												while(1) {
													__eflags = _t416 -  *_t361;
													if(_t416 <  *_t361) {
														break;
													}
													_t251 = _t251 + 1;
													_t361 = _t361 + 4;
													__eflags = _t251 - 0xf;
													if(_t251 < 0xf) {
														continue;
													}
													goto L64;
												}
												 *(_t438 + 0x18) = _t251;
												goto L64;
											} else {
												_t362 = 0x10;
												_t420 = _t416 >> _t362 - _t250;
												_t365 = ( *(_t420 + _t428 + 0x1e90) & 0x000000ff) +  *(_t426 + 4);
												 *_t426 =  *_t426 + (_t365 >> 3);
												 *(_t426 + 4) = _t365 & 0x00000007;
												_t256 =  *(_t428 + 0x2290 + _t420 * 2) & 0x0000ffff;
												L65:
												_t301 = _t301 + _t256;
												goto L67;
											}
										}
										_t301 = _t297 + 1;
										goto L67;
									}
								}
								__eflags =  *(_t428 + 0x4ad8) - 1;
								if( *(_t428 + 0x4ad8) <= 1) {
									L35:
									 *_t431 =  *_t431 & 0x00000000;
									_t431[2] = _t314;
									_t431[1] = 0;
									goto L34;
								}
								__eflags =  *(_t431 - 0xc);
								if( *(_t431 - 0xc) != 0) {
									goto L35;
								}
								_t271 =  *(_t431 - 8) & 0x0000ffff;
								_t423 = 3;
								__eflags = _t271 - _t423;
								if(_t271 >= _t423) {
									goto L35;
								}
								_t272 = _t271 + 1;
								 *(_t431 - 8) = _t272;
								 *((_t272 & 0x0000ffff) + _t431 - 4) = _t314;
								_t68 = _t428 + 0x4ad8;
								 *_t68 =  *(_t428 + 0x4ad8) - 1;
								__eflags =  *_t68;
								goto L34;
							}
						}
					} else {
						 *((char*)(_t428 + 0x4ad0)) = 1;
						L92:
						return _t198;
					}
				} else {
					 *((char*)(_t428 + 0x2c)) = 1;
					_push(_t428 + 0x30);
					_push(_t428 + 0x18);
					_push(_t428 + 4);
					_t283 = E00A72795(__ecx);
					if(_t283 != 0) {
						goto L3;
					} else {
						 *((char*)(_t428 + 0x4ad0)) = 1;
						return _t283;
					}
				}
			}

0x00a75494
0x00a75498
0x00a754a0
0x00a754c7
0x00a754ca
0x00a754d0
0x00a754d3
0x00a754d5
0x00a754ed
0x00a754f4
0x00a754f6
0x00a754f9
0x00a754fd
0x00a75502
0x00a75504
0x00a7550e
0x00a75510
0x00a75506
0x00a75506
0x00a75508
0x00a75508
0x00a75515
0x00a75515
0x00a75517
0x00a75519
0x00000000
0x00000000
0x00a7551b
0x00a7551d
0x00a75a68
0x00000000
0x00a75a69
0x00a75523
0x00a75531
0x00a75531
0x00a75533
0x00a75542
0x00a75542
0x00a75548
0x00a75a61
0x00a75a61
0x00000000
0x00a75a61
0x00000000
0x00a75548
0x00a75535
0x00a7553c
0x00000000
0x00000000
0x00000000
0x00a7553c
0x00a75525
0x00a75528
0x00a7552b
0x00000000
0x00000000
0x00000000
0x00a7554e
0x00a7554e
0x00a75557
0x00a7555d
0x00a7555f
0x00a75562
0x00a7556b
0x00a7556c
0x00a75577
0x00a7557b
0x00a7557d
0x00a75584
0x00a75584
0x00a75589
0x00a75589
0x00a7558f
0x00a7559a
0x00a755a1
0x00a755a5
0x00a755ab
0x00a755b2
0x00a755b8
0x00a755be
0x00a755c2
0x00a755ef
0x00a755f0
0x00a755f1
0x00a755f3
0x00a7560c
0x00a7560f
0x00a75616
0x00a75619
0x00a7561c
0x00a75624
0x00a75629
0x00a7562d
0x00a75630
0x00a75632
0x00a75632
0x00a75634
0x00000000
0x00a75634
0x00a755f8
0x00a755fb
0x00a755fb
0x00a755fd
0x00000000
0x00000000
0x00a755ff
0x00a75600
0x00a75603
0x00a75606
0x00000000
0x00000000
0x00000000
0x00a75608
0x00a7560a
0x00000000
0x00a755c4
0x00a755c6
0x00a755c9
0x00a755d3
0x00a755db
0x00a755e0
0x00a755e3
0x00a7563c
0x00a75641
0x00a75643
0x00a75692
0x00a75698
0x00a758f0
0x00a758f2
0x00a75946
0x00a7594c
0x00a7595c
0x00a7595d
0x00a75968
0x00a7596b
0x00a75972
0x00a75978
0x00a7597e
0x00a75985
0x00a759b2
0x00a759b3
0x00a759b4
0x00a759b6
0x00a759d2
0x00a759d5
0x00a759dc
0x00a759df
0x00a759e2
0x00a759ed
0x00a759f2
0x00a759f9
0x00a759ff
0x00a75a01
0x00a75a01
0x00a75a03
0x00a75a0b
0x00a75a0b
0x00a75a0e
0x00a75a1c
0x00a75a1f
0x00a75a23
0x00a75a2b
0x00a75a2e
0x00a75a30
0x00a75a34
0x00a75a3b
0x00a75a45
0x00a75a47
0x00a75a50
0x00a75a52
0x00a75a52
0x00a75a55
0x00a75a55
0x00a75a10
0x00a75a10
0x00a75a10
0x00a75a58
0x00a75672
0x00a75672
0x00a75676
0x00a7567a
0x00000000
0x00a7567a
0x00a759be
0x00a759c1
0x00a759c1
0x00a759c3
0x00000000
0x00000000
0x00a759c5
0x00a759c6
0x00a759c9
0x00a759cc
0x00000000
0x00000000
0x00000000
0x00a759ce
0x00a759d0
0x00000000
0x00a759d0
0x00a75989
0x00a7598c
0x00a75996
0x00a7599e
0x00a759a3
0x00a759a6
0x00000000
0x00a759a6
0x00a7594e
0x00000000
0x00a7594e
0x00a758fc
0x00a758fe
0x00a75908
0x00a75910
0x00a75915
0x00a75916
0x00a75919
0x00a75922
0x00a75929
0x00a75934
0x00a7593c
0x00a7593e
0x00000000
0x00a7593e
0x00a7569e
0x00a756a4
0x00a756a7
0x00a756b5
0x00a756b8
0x00a756c0
0x00a756c3
0x00a756c5
0x00a756c9
0x00a756d0
0x00a756d8
0x00a756da
0x00a756e1
0x00a756e3
0x00a756e3
0x00a756e6
0x00a756e6
0x00a756a9
0x00a756a9
0x00a756a9
0x00a756eb
0x00a756f2
0x00a756f8
0x00a756fe
0x00a75705
0x00a75732
0x00a75733
0x00a75734
0x00a75736
0x00a75752
0x00a75755
0x00a7575c
0x00a7575f
0x00a75762
0x00a7576d
0x00a75772
0x00a75779
0x00a7577f
0x00a75781
0x00a75781
0x00a75783
0x00000000
0x00a75783
0x00a7573e
0x00a75741
0x00a75741
0x00a75743
0x00000000
0x00000000
0x00a75745
0x00a75746
0x00a75749
0x00a7574c
0x00000000
0x00000000
0x00000000
0x00a7574e
0x00a75750
0x00000000
0x00a75707
0x00a75709
0x00a7570c
0x00a75716
0x00a7571e
0x00a75723
0x00a75726
0x00a7578b
0x00a7578b
0x00a7578e
0x00a757a0
0x00a757a3
0x00a757a9
0x00a757aa
0x00a757ac
0x00a758bf
0x00a758bf
0x00a758c5
0x00a758c7
0x00a758c8
0x00a758ce
0x00a758d0
0x00a758d1
0x00a758d7
0x00a758d9
0x00a758d9
0x00a758d9
0x00a758d7
0x00a758ce
0x00a758da
0x00a758de
0x00a758e4
0x00a758e8
0x00000000
0x00a758e8
0x00a757b2
0x00a757b5
0x00a7589b
0x00a758a2
0x00a758ac
0x00a758ae
0x00a758b7
0x00a758b9
0x00a758b9
0x00a758bc
0x00000000
0x00a758bc
0x00a757bb
0x00a757bf
0x00a757c4
0x00a757ca
0x00a757d2
0x00a757d8
0x00a757df
0x00a757e1
0x00a757e1
0x00a757e4
0x00a757e4
0x00a757e9
0x00a757f0
0x00a757f6
0x00a757fc
0x00a75803
0x00a75830
0x00a75831
0x00a75832
0x00a75836
0x00a75838
0x00a75856
0x00a75859
0x00a75865
0x00a75867
0x00a7586b
0x00a75870
0x00a7587c
0x00a75883
0x00a75889
0x00a7588b
0x00a7588b
0x00a7588d
0x00000000
0x00a7588d
0x00a75840
0x00a75843
0x00a75843
0x00a75845
0x00000000
0x00000000
0x00a75847
0x00a75848
0x00a7584b
0x00a7584e
0x00000000
0x00000000
0x00000000
0x00a75850
0x00a75852
0x00000000
0x00a75805
0x00a75807
0x00a7580a
0x00a75814
0x00a7581c
0x00a75821
0x00a75824
0x00a75895
0x00a75895
0x00000000
0x00a75895
0x00a75803
0x00a75790
0x00000000
0x00a75790
0x00a75705
0x00a75645
0x00a7564c
0x00a75683
0x00a75683
0x00a75689
0x00a7568c
0x00000000
0x00a7568c
0x00a7564e
0x00a75652
0x00000000
0x00000000
0x00a75654
0x00a7565a
0x00a7565b
0x00a7565e
0x00000000
0x00000000
0x00a75660
0x00a75661
0x00a75668
0x00a7566c
0x00a7566c
0x00a7566c
0x00000000
0x00a7566c
0x00a755c2
0x00a754d7
0x00a754d7
0x00a75a6a
0x00000000
0x00a75a6a
0x00a754a2
0x00a754a5
0x00a754a9
0x00a754ad
0x00a754b1
0x00a754b2
0x00a754b9
0x00000000
0x00a754bb
0x00a754bb
0x00000000
0x00a754bb
0x00a754b9

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a9602b562f5421ee3f427b8eb9d56e40b06bd76a914309d44dd409ee21144e6
Instruction ID: f8ee56233b0cbe31b33d86ad5308844da40ea609d47a498a3bb70013386281f9
Opcode Fuzzy Hash: 0a9602b562f5421ee3f427b8eb9d56e40b06bd76a914309d44dd409ee21144e6
Instruction Fuzzy Hash: 4002D4B1A00B068BC728CF38C9906B9B7E1FF54304F14C92EE59BC7A80D7B4A895DB45

Uniqueness

Uniqueness Score: -1.00%

Function 00A6B4F7 Relevance: .5, Instructions: 460
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E00A6B4F7(void* __ecx) {
				void* __edi;
				signed int _t205;
				signed int _t215;
				signed int _t222;
				void* _t228;
				signed int _t231;
				signed char* _t234;
				signed int _t266;
				signed int _t267;
				void* _t268;
				void* _t269;
				void* _t270;
				void* _t271;
				void* _t272;
				intOrPtr _t275;
				signed int _t276;
				void* _t279;
				signed char* _t280;
				signed int _t281;
				signed int _t283;
				signed int _t284;
				signed int* _t286;
				void* _t287;
				signed char _t288;
				signed int _t292;
				signed char _t293;
				void* _t294;
				signed int _t295;
				signed int _t296;
				intOrPtr _t300;
				signed int _t301;
				signed int _t302;
				signed int _t308;
				signed int _t310;
				void* _t311;
				signed int _t312;
				signed int _t313;
				unsigned int _t316;
				signed int _t317;
				signed int _t319;
				void* _t320;
				signed int _t323;
				signed int _t324;
				signed char _t326;
				signed int _t327;
				signed char _t328;
				char _t329;
				signed char _t332;
				void* _t333;
				void* _t334;
				signed int _t337;
				signed int _t338;
				signed int _t339;
				signed int _t340;
				signed int _t341;
				signed char* _t342;
				signed int _t343;
				signed int _t345;
				signed int _t346;
				void* _t347;
				unsigned int _t348;
				signed int _t349;
				signed int _t354;
				void* _t360;
				void* _t361;
				void* _t362;
				signed int _t363;
				void* _t364;
				void* _t365;

				_t205 =  *(_t365 + 4);
				_t347 = __ecx;
				if(_t205 <= 0) {
					return _t205;
				}
				_push(_t276);
				if(_t205 <= 2) {
					_t312 =  *(__ecx + 0x24);
					_t286 =  *(__ecx + 0x10);
					_t348 =  *(__ecx + 0x2c);
					if(_t312 >= 0x3c000 || _t312 < 4) {
						L93:
						return _t205;
					} else {
						_t360 = _t312 - 4;
						_t332 = 0;
						_t279 = (_t276 & 0xffffff00 | _t205 == 0x00000002) + 0xe8;
						if(_t360 <= 0) {
							goto L93;
						} else {
							goto L84;
						}
						do {
							L84:
							_t205 =  *_t286;
							_t286 =  &(_t286[0]);
							_t333 = _t332 + 1;
							_t348 = _t348 + 1;
							if(_t205 == 0xe8 || _t205 == _t279) {
								_t313 =  *_t286;
								if(_t313 >= 0) {
									if(_t313 < 0x1000000) {
										 *_t286 = _t313 - _t348;
									}
								} else {
									_t205 = _t348 + _t313;
									if(_t205 >= 0) {
										_t205 = _t313 + 0x1000000;
										 *_t286 = _t205;
									}
								}
								_t286 =  &(_t286[1]);
								_t332 = _t333 + 4;
								_t348 = _t348 + 4;
							}
						} while (_t332 < _t360);
						goto L93;
					}
				}
				_t287 = 3;
				if(_t205 == _t287) {
					_t205 =  *(__ecx + 0x24);
					_t280 =  *(__ecx + 0x10);
					if(_t205 < 0x3c000 && _t205 >= 0x15) {
						_t334 = _t205 - 0x15;
						_t316 =  *(__ecx + 0x2c) >> 4;
						 *(_t365 + 0x28) = _t316;
						if(_t334 <= 0) {
							goto L93;
						}
						_t337 = (_t334 - 1 >> 4) + 1;
						 *(_t365 + 0x2c) = _t337;
						do {
							_t205 = ( *_t280 & 0x1f) - 0x10;
							if(_t205 < 0) {
								goto L79;
							}
							_t205 =  *((intOrPtr*)(_t205 + 0xa99070));
							if(_t205 == 0) {
								goto L79;
							}
							_t338 =  *(_t365 + 0x28);
							_t288 = 0;
							_t317 = _t205 & 0x000000ff;
							 *((intOrPtr*)(_t365 + 0x60)) = 0;
							 *(_t365 + 0x34) = _t317;
							_t361 = 0x12;
							do {
								_t205 = 1 << _t288;
								if((_t317 & 1) != 0) {
									_t189 = _t361 + 0x18; // 0x2a
									_t205 = E00A6BA6F(_t317, _t280, _t189, 4);
									if(_t205 == 5) {
										_t205 = E00A6BAC2(_t317, _t280, E00A6BA6F(_t317, _t280, _t361, 0x14) - _t338 & 0x000fffff, _t361, 0x14);
									}
									_t317 =  *(_t365 + 0x30);
									_t288 =  *(_t365 + 0x5c);
								}
								_t288 = _t288 + 1;
								_t361 = _t361 + 0x29;
								 *(_t365 + 0x5c) = _t288;
							} while (_t361 <= 0x64);
							_t337 =  *(_t365 + 0x2c);
							_t316 =  *(_t365 + 0x28);
							L79:
							_t280 =  &(_t280[0x10]);
							_t316 = _t316 + 1;
							_t337 = _t337 - 1;
							 *(_t365 + 0x28) = _t316;
							 *(_t365 + 0x2c) = _t337;
						} while (_t337 != 0);
					}
					goto L93;
				}
				if(_t205 == 4) {
					_t205 =  *(__ecx + 0x24);
					_t319 =  *(__ecx + 0x14) - _t287;
					_t292 =  *(__ecx + 0x10);
					_t339 =  *(__ecx + 0x18);
					 *(_t365 + 0x28) = _t205;
					 *(_t365 + 0x18) = _t319;
					 *(_t365 + 0x1c) = _t339;
					_t362 = _t292 + _t205;
					 *(_t365 + 0x5c) = _t292;
					 *(_t292 + 0x3c020) = _t205;
					if(_t205 < 0x1e000 && _t319 >= 0 && _t339 >= 0) {
						_t340 =  *(_t365 + 0x28);
						_t293 = 0;
						_t215 =  ~_t319;
						 *(_t365 + 0x28) = 0;
						 *(_t365 + 0x24) = _t215;
						_t320 = 3;
						do {
							_t281 = 0;
							if(_t293 >= _t340) {
								goto L61;
							}
							 *(_t365 + 0x10) = _t215;
							_t349 =  *(_t365 + 0x10);
							 *(_t365 + 0x38) = _t215 + _t362;
							_t342 =  *(_t365 + 0x38);
							_t295 = 3;
							_t323 =  *(_t365 + 0x18);
							 *(_t365 + 0x14) = (_t340 - _t293 - 1) / _t295 + 1;
							_t222 =  *(_t365 + 0x5c);
							_t296 =  *(_t365 + 0x14);
							do {
								if(_t349 >= 3) {
									_t223 =  *_t342 & 0x000000ff;
									_t297 =  *(_t342 - 3) & 0x000000ff;
									 *(_t365 + 0x30) =  *_t342 & 0x000000ff;
									 *(_t365 + 0x2c) =  *(_t342 - 3) & 0x000000ff;
									 *(_t365 + 0x3c) = E00A82C4A(_t323, _t223 - _t297 + _t281 - _t281);
									 *((intOrPtr*)(_t365 + 0x40)) = E00A82C4A(_t323, _t223 - _t297 + _t281 -  *(_t365 + 0x34));
									_t228 = E00A82C4A(_t323, _t223 - _t297 + _t281 -  *(_t365 + 0x34));
									_t300 =  *((intOrPtr*)(_t365 + 0x44));
									_t365 = _t365 + 0xc;
									_t324 =  *(_t365 + 0x34);
									if(_t300 > _t324 || _t300 > _t228) {
										_t296 =  *(_t365 + 0x14);
										_t349 =  *(_t365 + 0x10);
										_t323 =  *(_t365 + 0x18);
										_t222 =  *(_t365 + 0x5c);
										_t281 =  *(_t365 + 0x30);
										if(_t324 > _t228) {
											_t281 =  *(_t365 + 0x2c);
										}
									} else {
										_t323 =  *(_t365 + 0x18);
										_t222 =  *(_t365 + 0x5c);
										_t296 =  *(_t365 + 0x14);
										_t349 =  *(_t365 + 0x10);
									}
								}
								_t349 = _t349 + 3;
								_t281 = _t281 -  *_t222 & 0x000000ff;
								_t222 = _t222 + 1;
								_t342[_t323] = _t281;
								_t342 =  &(_t342[3]);
								_t296 = _t296 - 1;
								 *(_t365 + 0x5c) = _t222;
								 *(_t365 + 0x10) = _t349;
								 *(_t365 + 0x14) = _t296;
							} while (_t296 != 0);
							_t340 =  *(_t365 + 0x28);
							_t215 =  *(_t365 + 0x20);
							_t293 =  *(_t365 + 0x24);
							_t320 = 3;
							L61:
							_t293 = _t293 + 1;
							_t215 = _t215 + 1;
							 *(_t365 + 0x24) = _t293;
							 *(_t365 + 0x20) = _t215;
						} while (_t293 < _t320);
						_t294 = _t340 - 2;
						_t341 =  *(_t365 + 0x1c);
						while(_t341 < _t294) {
							_t205 =  *((intOrPtr*)(_t341 + _t362 + 1));
							 *((intOrPtr*)(_t341 + _t362)) =  *((intOrPtr*)(_t341 + _t362)) + _t205;
							 *((intOrPtr*)(_t341 + _t362 + 2)) =  *((intOrPtr*)(_t341 + _t362 + 2)) + _t205;
							_t341 = _t341 + _t320;
						}
					}
					goto L93;
				}
				if(_t205 == 5) {
					_t343 =  *(__ecx + 0x24);
					_t301 =  *(__ecx + 0x10);
					_t205 =  *(__ecx + 0x14);
					 *(_t365 + 0x38) = _t343;
					 *(_t365 + 0x30) = _t205;
					 *(_t365 + 0x2c) = _t301;
					 *(_t365 + 0x34) = _t301 + _t343;
					 *(_t301 + 0x3c020) = _t343;
					if(_t343 >= 0x1e000) {
						goto L93;
					}
					 *(_t365 + 0x28) =  *(_t365 + 0x28) & 0x00000000;
					if(_t205 <= 0) {
						goto L93;
					} else {
						goto L17;
					}
					do {
						L17:
						 *(_t365 + 0x1c) =  *(_t365 + 0x1c) & 0x00000000;
						 *(_t365 + 0x18) =  *(_t365 + 0x18) & 0x00000000;
						_t354 = 0;
						 *(_t365 + 0x14) =  *(_t365 + 0x14) & 0x00000000;
						_t283 = 0;
						 *(_t365 + 0x10) =  *(_t365 + 0x10) & 0x00000000;
						_t363 = 0;
						 *((intOrPtr*)(_t365 + 0x68)) = 0;
						E00A7D1E0(_t343, _t365 + 0x3c, 0, 0x1c);
						_t231 =  *(_t365 + 0x34);
						_t365 = _t365 + 0xc;
						 *(_t365 + 0x24) =  *(_t365 + 0x24) & 0;
						 *(_t365 + 0x20) = _t231;
						if(_t231 >= _t343) {
							goto L45;
						} else {
							goto L18;
						}
						do {
							L18:
							_t302 =  *(_t365 + 0x18);
							 *(_t365 + 0x10) = _t302 -  *(_t365 + 0x14);
							_t234 =  *(_t365 + 0x2c);
							 *(_t365 + 0x14) = _t302;
							_t326 =  *_t234 & 0x000000ff;
							 *(_t365 + 0x2c) =  &(_t234[1]);
							_t308 = ( *(_t365 + 0x10) * _t354 + _t363 *  *(_t365 + 0x10) + _t283 *  *(_t365 + 0x18) +  *(_t365 + 0x1c) * 0x00000008 >> 0x00000003 & 0x000000ff) - _t326;
							 *( *(_t365 + 0x20) +  *(_t365 + 0x34)) = _t308;
							_t357 = _t326 << 3;
							 *(_t365 + 0x1c) = _t308 -  *(_t365 + 0x1c);
							 *(_t365 + 0x20) = _t308;
							 *((intOrPtr*)(_t365 + 0x40)) =  *((intOrPtr*)(_t365 + 0x40)) + E00A82C4A(_t326, _t326 << 3);
							 *((intOrPtr*)(_t365 + 0x48)) =  *((intOrPtr*)(_t365 + 0x48)) + E00A82C4A(_t326, (_t326 << 3) -  *(_t365 + 0x18));
							 *((intOrPtr*)(_t365 + 0x50)) =  *((intOrPtr*)(_t365 + 0x50)) + E00A82C4A(_t326,  *(_t365 + 0x1c) + (_t326 << 3));
							 *((intOrPtr*)(_t365 + 0x58)) =  *((intOrPtr*)(_t365 + 0x58)) + E00A82C4A(_t326, (_t326 << 3) -  *(_t365 + 0x1c));
							 *((intOrPtr*)(_t365 + 0x60)) =  *((intOrPtr*)(_t365 + 0x60)) + E00A82C4A(_t326,  *(_t365 + 0x20) + _t357);
							 *((intOrPtr*)(_t365 + 0x68)) =  *((intOrPtr*)(_t365 + 0x68)) + E00A82C4A(_t326, _t357 -  *(_t365 + 0x10));
							 *((intOrPtr*)(_t365 + 0x70)) =  *((intOrPtr*)(_t365 + 0x70)) + E00A82C4A(_t326, _t357 +  *(_t365 + 0x10));
							_t365 = _t365 + 0x1c;
							if(( *(_t365 + 0x24) & 0x0000001f) != 0) {
								_t354 =  *(_t365 + 0x5c);
							} else {
								_t327 =  *(_t365 + 0x3c);
								_t267 = 0;
								 *(_t365 + 0x3c) =  *(_t365 + 0x3c) & 0;
								_t310 = 1;
								do {
									if( *(_t365 + 0x3c + _t310 * 4) < _t327) {
										_t327 =  *(_t365 + 0x3c + _t310 * 4);
										_t267 = _t310;
									}
									 *(_t365 + 0x3c + _t310 * 4) =  *(_t365 + 0x3c + _t310 * 4) & 0x00000000;
									_t310 = _t310 + 1;
								} while (_t310 < 7);
								_t354 =  *(_t365 + 0x5c);
								_t268 = _t267 - 1;
								if(_t268 == 0) {
									if(_t283 >= 0xfffffff0) {
										_t283 = _t283 - 1;
									}
									goto L43;
								}
								_t269 = _t268 - 1;
								if(_t269 == 0) {
									if(_t283 < 0x10) {
										_t283 = _t283 + 1;
									}
									goto L43;
								}
								_t270 = _t269 - 1;
								if(_t270 == 0) {
									if(_t363 >= 0xfffffff0) {
										_t363 = _t363 - 1;
									}
									goto L43;
								}
								_t271 = _t270 - 1;
								if(_t271 == 0) {
									if(_t363 < 0x10) {
										_t363 = _t363 + 1;
									}
									goto L43;
								}
								_t272 = _t271 - 1;
								if(_t272 == 0) {
									if(_t354 < 0xfffffff0) {
										goto L43;
									}
									_t354 = _t354 - 1;
									L31:
									 *(_t365 + 0x5c) = _t354;
									goto L43;
								}
								if(_t272 != 1 || _t354 >= 0x10) {
									goto L43;
								} else {
									_t354 = _t354 + 1;
									goto L31;
								}
							}
							L43:
							_t266 =  *(_t365 + 0x20) +  *(_t365 + 0x30);
							 *(_t365 + 0x24) =  *(_t365 + 0x24) + 1;
							_t343 =  *(_t365 + 0x38);
							 *(_t365 + 0x20) = _t266;
						} while (_t266 < _t343);
						_t231 =  *(_t365 + 0x28);
						L45:
						_t205 = _t231 + 1;
						 *(_t365 + 0x28) = _t205;
					} while (_t205 <  *(_t365 + 0x30));
					goto L93;
				}
				if(_t205 != 6) {
					goto L93;
				}
				_t345 =  *(__ecx + 0x24);
				_t364 = 0;
				_t284 =  *(__ecx + 0x14);
				 *(_t365 + 0x30) = _t345;
				 *(_t365 + 0x28) = _t345 + _t345;
				_t205 =  *(__ecx + 0x10);
				 *(_t205 + 0x3c020) = _t345;
				if(_t345 >= 0x1e000) {
					goto L93;
				}
				_t328 = 0;
				 *(_t365 + 0x24) = 0;
				if(_t284 > 0) {
					_t205 = _t345 + _t345;
					do {
						_t311 = _t328 + _t345;
						 *(_t365 + 0x5c) = 0;
						if(_t311 < _t205) {
							_t329 =  *(_t365 + 0x5c);
							_t346 =  *(_t365 + 0x28);
							goto L11;
							L11:
							_t275 =  *((intOrPtr*)(_t347 + 0x10));
							_t329 = _t329 -  *((intOrPtr*)(_t275 + _t364));
							_t364 = _t364 + 1;
							 *((char*)(_t275 + _t311)) = _t329;
							_t311 = _t311 + _t284;
							if(_t311 < _t346) {
								goto L11;
							} else {
								_t328 =  *(_t365 + 0x24);
								_t345 =  *(_t365 + 0x30);
								_t205 =  *(_t365 + 0x28);
								goto L13;
							}
						}
						L13:
						_t328 = _t328 + 1;
						 *(_t365 + 0x24) = _t328;
					} while (_t328 < _t284);
				}
			}

0x00a6b4f7
0x00a6b4ff
0x00a6b503
0x00a6ba6c
0x00a6ba6c
0x00a6b509
0x00a6b50f
0x00a6ba00
0x00a6ba03
0x00a6ba06
0x00a6ba0f
0x00a6ba65
0x00000000
0x00a6ba16
0x00a6ba19
0x00a6ba1f
0x00a6ba21
0x00a6ba26
0x00000000
0x00000000
0x00000000
0x00000000
0x00a6ba28
0x00a6ba28
0x00a6ba28
0x00a6ba2a
0x00a6ba2b
0x00a6ba2c
0x00a6ba2f
0x00a6ba35
0x00a6ba39
0x00a6ba52
0x00a6ba56
0x00a6ba56
0x00a6ba3b
0x00a6ba3b
0x00a6ba40
0x00a6ba42
0x00a6ba48
0x00a6ba48
0x00a6ba40
0x00a6ba58
0x00a6ba5b
0x00a6ba5e
0x00a6ba5e
0x00a6ba61
0x00000000
0x00a6ba28
0x00a6ba0f
0x00a6b517
0x00a6b51a
0x00a6b931
0x00a6b934
0x00a6b93c
0x00a6b94e
0x00a6b951
0x00a6b954
0x00a6b95a
0x00000000
0x00000000
0x00a6b964
0x00a6b965
0x00a6b969
0x00a6b96f
0x00a6b972
0x00000000
0x00000000
0x00a6b974
0x00a6b97c
0x00000000
0x00000000
0x00a6b97e
0x00a6b982
0x00a6b984
0x00a6b989
0x00a6b98d
0x00a6b991
0x00a6b992
0x00a6b995
0x00a6b999
0x00a6b99d
0x00a6b9a4
0x00a6b9ac
0x00a6b9c7
0x00a6b9c7
0x00a6b9cc
0x00a6b9d0
0x00a6b9d0
0x00a6b9d4
0x00a6b9d5
0x00a6b9d8
0x00a6b9dc
0x00a6b9e1
0x00a6b9e5
0x00a6b9e9
0x00a6b9e9
0x00a6b9ec
0x00a6b9ed
0x00a6b9f0
0x00a6b9f4
0x00a6b9f4
0x00a6b9fe
0x00000000
0x00a6b93c
0x00a6b523
0x00a6b7bd
0x00a6b7c0
0x00a6b7c2
0x00a6b7c5
0x00a6b7c8
0x00a6b7cc
0x00a6b7d0
0x00a6b7d4
0x00a6b7d7
0x00a6b7db
0x00a6b7e6
0x00a6b7fc
0x00a6b802
0x00a6b804
0x00a6b808
0x00a6b80c
0x00a6b810
0x00a6b811
0x00a6b811
0x00a6b815
0x00000000
0x00000000
0x00a6b81b
0x00a6b823
0x00a6b827
0x00a6b82f
0x00a6b836
0x00a6b839
0x00a6b83e
0x00a6b842
0x00a6b846
0x00a6b84a
0x00a6b84d
0x00a6b84f
0x00a6b852
0x00a6b85a
0x00a6b860
0x00a6b870
0x00a6b883
0x00a6b887
0x00a6b88c
0x00a6b890
0x00a6b893
0x00a6b899
0x00a6b8b1
0x00a6b8b7
0x00a6b8bb
0x00a6b8bf
0x00a6b8c3
0x00a6b8c7
0x00a6b8c9
0x00a6b8c9
0x00a6b89f
0x00a6b89f
0x00a6b8a3
0x00a6b8a7
0x00a6b8ab
0x00a6b8ab
0x00a6b899
0x00a6b8cf
0x00a6b8d2
0x00a6b8d5
0x00a6b8d6
0x00a6b8d9
0x00a6b8dc
0x00a6b8df
0x00a6b8e3
0x00a6b8e7
0x00a6b8e7
0x00a6b8f1
0x00a6b8f5
0x00a6b8f9
0x00a6b8ff
0x00a6b900
0x00a6b900
0x00a6b901
0x00a6b902
0x00a6b906
0x00a6b90a
0x00a6b912
0x00a6b915
0x00a6b928
0x00a6b91b
0x00a6b91f
0x00a6b922
0x00a6b926
0x00a6b926
0x00a6b92c
0x00000000
0x00a6b7e6
0x00a6b52c
0x00a6b5b2
0x00a6b5b5
0x00a6b5b8
0x00a6b5bb
0x00a6b5bf
0x00a6b5c3
0x00a6b5ca
0x00a6b5ce
0x00a6b5da
0x00000000
0x00000000
0x00a6b5e0
0x00a6b5e7
0x00000000
0x00000000
0x00000000
0x00000000
0x00a6b5ed
0x00a6b5ed
0x00a6b5ed
0x00a6b5f6
0x00a6b5fb
0x00a6b5fd
0x00a6b602
0x00a6b604
0x00a6b609
0x00a6b60f
0x00a6b613
0x00a6b618
0x00a6b61c
0x00a6b61f
0x00a6b623
0x00a6b629
0x00000000
0x00000000
0x00000000
0x00000000
0x00a6b62f
0x00a6b62f
0x00a6b62f
0x00a6b63d
0x00a6b641
0x00a6b645
0x00a6b652
0x00a6b656
0x00a6b67d
0x00a6b67f
0x00a6b68e
0x00a6b692
0x00a6b696
0x00a6b69f
0x00a6b6af
0x00a6b6bf
0x00a6b6cf
0x00a6b6df
0x00a6b6ed
0x00a6b6fa
0x00a6b6fe
0x00a6b706
0x00a6b782
0x00a6b708
0x00a6b708
0x00a6b70c
0x00a6b70e
0x00a6b714
0x00a6b715
0x00a6b719
0x00a6b71b
0x00a6b71f
0x00a6b71f
0x00a6b721
0x00a6b726
0x00a6b727
0x00a6b72c
0x00a6b730
0x00a6b733
0x00a6b77d
0x00a6b77f
0x00a6b77f
0x00000000
0x00a6b77d
0x00a6b735
0x00a6b738
0x00a6b775
0x00a6b777
0x00a6b777
0x00000000
0x00a6b775
0x00a6b73a
0x00a6b73d
0x00a6b76d
0x00a6b76f
0x00a6b76f
0x00000000
0x00a6b76d
0x00a6b73f
0x00a6b742
0x00a6b765
0x00a6b767
0x00a6b767
0x00000000
0x00a6b765
0x00a6b744
0x00a6b747
0x00a6b75d
0x00000000
0x00000000
0x00a6b75f
0x00a6b754
0x00a6b754
0x00000000
0x00a6b754
0x00a6b74c
0x00000000
0x00a6b753
0x00a6b753
0x00000000
0x00a6b753
0x00a6b74c
0x00a6b786
0x00a6b78a
0x00a6b78e
0x00a6b792
0x00a6b796
0x00a6b79a
0x00a6b7a2
0x00a6b7a6
0x00a6b7a6
0x00a6b7a7
0x00a6b7ab
0x00000000
0x00a6b7b5
0x00a6b535
0x00000000
0x00000000
0x00a6b53b
0x00a6b53e
0x00a6b540
0x00a6b543
0x00a6b54a
0x00a6b54e
0x00a6b551
0x00a6b55d
0x00000000
0x00000000
0x00a6b563
0x00a6b565
0x00a6b56b
0x00a6b571
0x00a6b574
0x00a6b574
0x00a6b577
0x00a6b57e
0x00a6b580
0x00a6b584
0x00a6b584
0x00a6b588
0x00a6b588
0x00a6b58b
0x00a6b58e
0x00a6b58f
0x00a6b592
0x00a6b596
0x00000000
0x00a6b598
0x00a6b598
0x00a6b59c
0x00a6b5a0
0x00000000
0x00a6b5a0
0x00a6b596
0x00a6b5a4
0x00a6b5a4
0x00a6b5a5
0x00a6b5a9
0x00a6b574

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64080cb6b5b993b05d92ebb834f8ca0b0f152fb2fc2b7b5596f52b621c66c2ed
Instruction ID: 694270c807f6ca2e44936681adc1e2a9019b9e3cf2c1e4561d9847da77937aa6
Opcode Fuzzy Hash: 64080cb6b5b993b05d92ebb834f8ca0b0f152fb2fc2b7b5596f52b621c66c2ed
Instruction Fuzzy Hash: 59028AB1A283418FC718CF68C58462ABBF1FFD8354F144A2EF595D7251E730EA858B62

Uniqueness

Uniqueness Score: -1.00%

Function 00A7E459 Relevance: .3, Instructions: 345
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00A7E459(void* __edx, void* __esi) {
				signed int _t192;
				signed char _t193;
				signed char _t194;
				signed char _t195;
				signed char _t196;
				signed char _t198;
				signed int _t241;
				void* _t287;
				void* _t292;
				void* _t294;
				void* _t296;
				void* _t298;
				void* _t300;
				void* _t302;
				void* _t304;
				void* _t306;
				void* _t308;
				void* _t310;
				void* _t312;
				void* _t314;
				void* _t316;
				void* _t318;
				void* _t320;
				void* _t322;
				void* _t324;
				void* _t326;
				void* _t327;

				_t327 = __esi;
				_t287 = __edx;
				if( *((intOrPtr*)(__esi - 0x1e)) ==  *((intOrPtr*)(__edx - 0x1e))) {
					_t241 = 0;
					L15:
					if(_t241 != 0) {
						goto L2;
					}
					_t193 =  *(_t327 - 0x1a);
					if(_t193 ==  *(_t287 - 0x1a)) {
						_t241 = 0;
						L26:
						if(_t241 != 0) {
							goto L2;
						}
						_t194 =  *(_t327 - 0x16);
						if(_t194 ==  *(_t287 - 0x16)) {
							_t241 = 0;
							L37:
							if(_t241 != 0) {
								goto L2;
							}
							_t195 =  *(_t327 - 0x12);
							if(_t195 ==  *(_t287 - 0x12)) {
								_t241 = 0;
								L48:
								if(_t241 != 0) {
									goto L2;
								}
								_t196 =  *(_t327 - 0xe);
								if(_t196 ==  *(_t287 - 0xe)) {
									_t241 = 0;
									L59:
									if(_t241 != 0) {
										goto L2;
									}
									if( *(_t327 - 0xa) ==  *(_t287 - 0xa)) {
										_t241 = 0;
										L70:
										if(_t241 != 0) {
											goto L2;
										}
										_t198 =  *(_t327 - 6);
										if(_t198 ==  *(_t287 - 6)) {
											_t241 = 0;
											L81:
											if(_t241 == 0 &&  *((intOrPtr*)(_t327 - 2)) ==  *((intOrPtr*)(_t287 - 2))) {
											}
											goto L2;
										}
										_t292 = (_t198 & 0x000000ff) - ( *(_t287 - 6) & 0x000000ff);
										if(_t292 == 0) {
											L74:
											_t294 = ( *(_t327 - 5) & 0x000000ff) - ( *(_t287 - 5) & 0x000000ff);
											if(_t294 == 0) {
												L76:
												_t296 = ( *(_t327 - 4) & 0x000000ff) - ( *(_t287 - 4) & 0x000000ff);
												if(_t296 == 0) {
													L78:
													_t241 = ( *(_t327 - 3) & 0x000000ff) - ( *(_t287 - 3) & 0x000000ff);
													if(_t241 != 0) {
														_t241 = (0 | _t241 > 0x00000000) * 2 - 1;
													}
													goto L81;
												}
												_t241 = (0 | _t296 > 0x00000000) * 2 - 1;
												if(_t241 != 0) {
													goto L2;
												}
												goto L78;
											}
											_t241 = (0 | _t294 > 0x00000000) * 2 - 1;
											if(_t241 != 0) {
												goto L2;
											}
											goto L76;
										}
										_t241 = (0 | _t292 > 0x00000000) * 2 - 1;
										if(_t241 != 0) {
											goto L2;
										}
										goto L74;
									}
									_t298 = ( *(_t327 - 0xa) & 0x000000ff) - ( *(_t287 - 0xa) & 0x000000ff);
									if(_t298 == 0) {
										L63:
										_t300 = ( *(_t327 - 9) & 0x000000ff) - ( *(_t287 - 9) & 0x000000ff);
										if(_t300 == 0) {
											L65:
											_t302 = ( *(_t327 - 8) & 0x000000ff) - ( *(_t287 - 8) & 0x000000ff);
											if(_t302 == 0) {
												L67:
												_t241 = ( *(_t327 - 7) & 0x000000ff) - ( *(_t287 - 7) & 0x000000ff);
												if(_t241 != 0) {
													_t241 = (0 | _t241 > 0x00000000) * 2 - 1;
												}
												goto L70;
											}
											_t241 = (0 | _t302 > 0x00000000) * 2 - 1;
											if(_t241 != 0) {
												goto L2;
											}
											goto L67;
										}
										_t241 = (0 | _t300 > 0x00000000) * 2 - 1;
										if(_t241 != 0) {
											goto L2;
										}
										goto L65;
									}
									_t241 = (0 | _t298 > 0x00000000) * 2 - 1;
									if(_t241 != 0) {
										goto L2;
									}
									goto L63;
								}
								_t304 = (_t196 & 0x000000ff) - ( *(_t287 - 0xe) & 0x000000ff);
								if(_t304 == 0) {
									L52:
									_t306 = ( *(_t327 - 0xd) & 0x000000ff) - ( *(_t287 - 0xd) & 0x000000ff);
									if(_t306 == 0) {
										L54:
										_t308 = ( *(_t327 - 0xc) & 0x000000ff) - ( *(_t287 - 0xc) & 0x000000ff);
										if(_t308 == 0) {
											L56:
											_t241 = ( *(_t327 - 0xb) & 0x000000ff) - ( *(_t287 - 0xb) & 0x000000ff);
											if(_t241 != 0) {
												_t241 = (0 | _t241 > 0x00000000) * 2 - 1;
											}
											goto L59;
										}
										_t241 = (0 | _t308 > 0x00000000) * 2 - 1;
										if(_t241 != 0) {
											goto L2;
										}
										goto L56;
									}
									_t241 = (0 | _t306 > 0x00000000) * 2 - 1;
									if(_t241 != 0) {
										goto L2;
									}
									goto L54;
								}
								_t241 = (0 | _t304 > 0x00000000) * 2 - 1;
								if(_t241 != 0) {
									goto L2;
								}
								goto L52;
							}
							_t310 = (_t195 & 0x000000ff) - ( *(_t287 - 0x12) & 0x000000ff);
							if(_t310 == 0) {
								L41:
								_t312 = ( *(_t327 - 0x11) & 0x000000ff) - ( *(_t287 - 0x11) & 0x000000ff);
								if(_t312 == 0) {
									L43:
									_t314 = ( *(_t327 - 0x10) & 0x000000ff) - ( *(_t287 - 0x10) & 0x000000ff);
									if(_t314 == 0) {
										L45:
										_t241 = ( *(_t327 - 0xf) & 0x000000ff) - ( *(_t287 - 0xf) & 0x000000ff);
										if(_t241 != 0) {
											_t241 = (0 | _t241 > 0x00000000) * 2 - 1;
										}
										goto L48;
									}
									_t241 = (0 | _t314 > 0x00000000) * 2 - 1;
									if(_t241 != 0) {
										goto L2;
									}
									goto L45;
								}
								_t241 = (0 | _t312 > 0x00000000) * 2 - 1;
								if(_t241 != 0) {
									goto L2;
								}
								goto L43;
							}
							_t241 = (0 | _t310 > 0x00000000) * 2 - 1;
							if(_t241 != 0) {
								goto L2;
							}
							goto L41;
						}
						_t316 = (_t194 & 0x000000ff) - ( *(_t287 - 0x16) & 0x000000ff);
						if(_t316 == 0) {
							L30:
							_t318 = ( *(_t327 - 0x15) & 0x000000ff) - ( *(_t287 - 0x15) & 0x000000ff);
							if(_t318 == 0) {
								L32:
								_t320 = ( *(_t327 - 0x14) & 0x000000ff) - ( *(_t287 - 0x14) & 0x000000ff);
								if(_t320 == 0) {
									L34:
									_t241 = ( *(_t327 - 0x13) & 0x000000ff) - ( *(_t287 - 0x13) & 0x000000ff);
									if(_t241 != 0) {
										_t241 = (0 | _t241 > 0x00000000) * 2 - 1;
									}
									goto L37;
								}
								_t241 = (0 | _t320 > 0x00000000) * 2 - 1;
								if(_t241 != 0) {
									goto L2;
								}
								goto L34;
							}
							_t241 = (0 | _t318 > 0x00000000) * 2 - 1;
							if(_t241 != 0) {
								goto L2;
							}
							goto L32;
						}
						_t241 = (0 | _t316 > 0x00000000) * 2 - 1;
						if(_t241 != 0) {
							goto L2;
						}
						goto L30;
					}
					_t322 = (_t193 & 0x000000ff) - ( *(_t287 - 0x1a) & 0x000000ff);
					if(_t322 == 0) {
						L19:
						_t324 = ( *(_t327 - 0x19) & 0x000000ff) - ( *(_t287 - 0x19) & 0x000000ff);
						if(_t324 == 0) {
							L21:
							_t326 = ( *(_t327 - 0x18) & 0x000000ff) - ( *(_t287 - 0x18) & 0x000000ff);
							if(_t326 == 0) {
								L23:
								_t241 = ( *(_t327 - 0x17) & 0x000000ff) - ( *(_t287 - 0x17) & 0x000000ff);
								if(_t241 != 0) {
									_t241 = (0 | _t241 > 0x00000000) * 2 - 1;
								}
								goto L26;
							}
							_t241 = (0 | _t326 > 0x00000000) * 2 - 1;
							if(_t241 != 0) {
								goto L2;
							}
							goto L23;
						}
						_t241 = (0 | _t324 > 0x00000000) * 2 - 1;
						if(_t241 != 0) {
							goto L2;
						}
						goto L21;
					}
					_t241 = (0 | _t322 > 0x00000000) * 2 - 1;
					if(_t241 != 0) {
						goto L2;
					}
					goto L19;
				} else {
					__edi = __al & 0x000000ff;
					__edi = (__al & 0x000000ff) - ( *(__edx - 0x1e) & 0x000000ff);
					if(__edi == 0) {
						L8:
						__edi =  *(__esi - 0x1d) & 0x000000ff;
						__edi = ( *(__esi - 0x1d) & 0x000000ff) - ( *(__edx - 0x1d) & 0x000000ff);
						if(__edi == 0) {
							L10:
							__edi =  *(__esi - 0x1c) & 0x000000ff;
							__edi = ( *(__esi - 0x1c) & 0x000000ff) - ( *(__edx - 0x1c) & 0x000000ff);
							if(__edi == 0) {
								L12:
								__ecx =  *(__esi - 0x1b) & 0x000000ff;
								__ecx = ( *(__esi - 0x1b) & 0x000000ff) - ( *(__edx - 0x1b) & 0x000000ff);
								if(__ecx != 0) {
									__ecx = (0 | __ecx > 0x00000000) * 2 - 1;
								}
								goto L15;
							}
							0 = 0 | __edi > 0x00000000;
							__ecx = (__edi > 0) * 2 != 1;
							if((__edi > 0) * 2 != 1) {
								L2:
								_t192 = _t241;
								return _t192;
							}
							goto L12;
						}
						0 = 0 | __edi > 0x00000000;
						__ecx = (__edi > 0) * 2 != 1;
						if((__edi > 0) * 2 != 1) {
							goto L2;
						}
						goto L10;
					}
					0 = 0 | __edi > 0x00000000;
					__ecx = (__edi > 0) * 2 != 1;
					if((__edi > 0) * 2 != 1) {
						goto L2;
					}
					goto L8;
				}
			}

0x00a7e459
0x00a7e459
0x00a7e45f
0x00a7e4e6
0x00a7e4e8
0x00a7e4ea
0x00000000
0x00000000
0x00a7e4f0
0x00a7e4f6
0x00a7e57d
0x00a7e57f
0x00a7e581
0x00000000
0x00000000
0x00a7e587
0x00a7e58d
0x00a7e614
0x00a7e616
0x00a7e618
0x00000000
0x00000000
0x00a7e61e
0x00a7e624
0x00a7e6ab
0x00a7e6ad
0x00a7e6af
0x00000000
0x00000000
0x00a7e6b5
0x00a7e6bb
0x00a7e742
0x00a7e744
0x00a7e746
0x00000000
0x00000000
0x00a7e752
0x00a7e7da
0x00a7e7dc
0x00a7e7de
0x00000000
0x00000000
0x00a7e7e4
0x00a7e7ea
0x00a7e871
0x00a7e873
0x00a7e875
0x00a7e875
0x00000000
0x00a7e875
0x00a7e7f7
0x00a7e7f9
0x00a7e811
0x00a7e819
0x00a7e81b
0x00a7e833
0x00a7e83b
0x00a7e83d
0x00a7e855
0x00a7e85d
0x00a7e85f
0x00a7e868
0x00a7e868
0x00000000
0x00a7e85f
0x00a7e846
0x00a7e84f
0x00000000
0x00000000
0x00000000
0x00a7e84f
0x00a7e824
0x00a7e82d
0x00000000
0x00000000
0x00000000
0x00a7e82d
0x00a7e802
0x00a7e80b
0x00000000
0x00000000
0x00000000
0x00a7e80b
0x00a7e760
0x00a7e762
0x00a7e77a
0x00a7e782
0x00a7e784
0x00a7e79c
0x00a7e7a4
0x00a7e7a6
0x00a7e7be
0x00a7e7c6
0x00a7e7c8
0x00a7e7d1
0x00a7e7d1
0x00000000
0x00a7e7c8
0x00a7e7af
0x00a7e7b8
0x00000000
0x00000000
0x00000000
0x00a7e7b8
0x00a7e78d
0x00a7e796
0x00000000
0x00000000
0x00000000
0x00a7e796
0x00a7e76b
0x00a7e774
0x00000000
0x00000000
0x00000000
0x00a7e774
0x00a7e6c8
0x00a7e6ca
0x00a7e6e2
0x00a7e6ea
0x00a7e6ec
0x00a7e704
0x00a7e70c
0x00a7e70e
0x00a7e726
0x00a7e72e
0x00a7e730
0x00a7e739
0x00a7e739
0x00000000
0x00a7e730
0x00a7e717
0x00a7e720
0x00000000
0x00000000
0x00000000
0x00a7e720
0x00a7e6f5
0x00a7e6fe
0x00000000
0x00000000
0x00000000
0x00a7e6fe
0x00a7e6d3
0x00a7e6dc
0x00000000
0x00000000
0x00000000
0x00a7e6dc
0x00a7e631
0x00a7e633
0x00a7e64b
0x00a7e653
0x00a7e655
0x00a7e66d
0x00a7e675
0x00a7e677
0x00a7e68f
0x00a7e697
0x00a7e699
0x00a7e6a2
0x00a7e6a2
0x00000000
0x00a7e699
0x00a7e680
0x00a7e689
0x00000000
0x00000000
0x00000000
0x00a7e689
0x00a7e65e
0x00a7e667
0x00000000
0x00000000
0x00000000
0x00a7e667
0x00a7e63c
0x00a7e645
0x00000000
0x00000000
0x00000000
0x00a7e645
0x00a7e59a
0x00a7e59c
0x00a7e5b4
0x00a7e5bc
0x00a7e5be
0x00a7e5d6
0x00a7e5de
0x00a7e5e0
0x00a7e5f8
0x00a7e600
0x00a7e602
0x00a7e60b
0x00a7e60b
0x00000000
0x00a7e602
0x00a7e5e9
0x00a7e5f2
0x00000000
0x00000000
0x00000000
0x00a7e5f2
0x00a7e5c7
0x00a7e5d0
0x00000000
0x00000000
0x00000000
0x00a7e5d0
0x00a7e5a5
0x00a7e5ae
0x00000000
0x00000000
0x00000000
0x00a7e5ae
0x00a7e503
0x00a7e505
0x00a7e51d
0x00a7e525
0x00a7e527
0x00a7e53f
0x00a7e547
0x00a7e549
0x00a7e561
0x00a7e569
0x00a7e56b
0x00a7e574
0x00a7e574
0x00000000
0x00a7e56b
0x00a7e552
0x00a7e55b
0x00000000
0x00000000
0x00000000
0x00a7e55b
0x00a7e530
0x00a7e539
0x00000000
0x00000000
0x00000000
0x00a7e539
0x00a7e50e
0x00a7e517
0x00000000
0x00000000
0x00000000
0x00a7e465
0x00a7e465
0x00a7e46c
0x00a7e46e
0x00a7e486
0x00a7e486
0x00a7e48e
0x00a7e490
0x00a7e4a8
0x00a7e4a8
0x00a7e4b0
0x00a7e4b2
0x00a7e4ca
0x00a7e4ca
0x00a7e4d2
0x00a7e4d4
0x00a7e4dd
0x00a7e4dd
0x00000000
0x00a7e4d4
0x00a7e4b8
0x00a7e4bb
0x00a7e4c4
0x00a7e01c
0x00a7e01c
0x00a7ee0d
0x00a7ee0d
0x00000000
0x00a7e4c4
0x00a7e496
0x00a7e499
0x00a7e4a2
0x00000000
0x00000000
0x00000000
0x00a7e4a2
0x00a7e474
0x00a7e477
0x00a7e480
0x00000000
0x00000000
0x00000000
0x00a7e480

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: d35ccd15d3199ccaa1e91b3498c638649676f7b702a4a24af6f4d97ef159ea6d
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 4AC1503620519349DF2DC739887413EBAA15AA67B131EC7EDD4BACF1D4EE20C525E620

Uniqueness

Uniqueness Score: -1.00%

Function 00A7E88E Relevance: .3, Instructions: 341
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00A7E88E(void* __edx, void* __esi) {
				signed int _t197;
				signed char _t198;
				signed char _t199;
				signed char _t200;
				signed char _t202;
				signed char _t203;
				signed int _t246;
				void* _t294;
				void* _t297;
				void* _t299;
				void* _t301;
				void* _t303;
				void* _t305;
				void* _t307;
				void* _t309;
				void* _t311;
				void* _t313;
				void* _t315;
				void* _t317;
				void* _t319;
				void* _t321;
				void* _t323;
				void* _t325;
				void* _t327;
				void* _t329;
				void* _t331;
				void* _t333;
				void* _t335;
				void* _t336;

				_t336 = __esi;
				_t294 = __edx;
				if( *((intOrPtr*)(__esi - 0x1f)) ==  *((intOrPtr*)(__edx - 0x1f))) {
					_t246 = 0;
					L14:
					if(_t246 != 0) {
						goto L1;
					}
					_t198 =  *(_t336 - 0x1b);
					if(_t198 ==  *(_t294 - 0x1b)) {
						_t246 = 0;
						L25:
						if(_t246 != 0) {
							goto L1;
						}
						_t199 =  *(_t336 - 0x17);
						if(_t199 ==  *(_t294 - 0x17)) {
							_t246 = 0;
							L36:
							if(_t246 != 0) {
								goto L1;
							}
							_t200 =  *(_t336 - 0x13);
							if(_t200 ==  *(_t294 - 0x13)) {
								_t246 = 0;
								L47:
								if(_t246 != 0) {
									goto L1;
								}
								if( *(_t336 - 0xf) ==  *(_t294 - 0xf)) {
									_t246 = 0;
									L58:
									if(_t246 != 0) {
										goto L1;
									}
									_t202 =  *(_t336 - 0xb);
									if(_t202 ==  *(_t294 - 0xb)) {
										_t246 = 0;
										L69:
										if(_t246 != 0) {
											goto L1;
										}
										_t203 =  *(_t336 - 7);
										if(_t203 ==  *(_t294 - 7)) {
											_t246 = 0;
											L80:
											if(_t246 != 0) {
												goto L1;
											}
											_t297 = ( *(_t336 - 3) & 0x000000ff) - ( *(_t294 - 3) & 0x000000ff);
											if(_t297 == 0) {
												L83:
												_t299 = ( *(_t336 - 2) & 0x000000ff) - ( *(_t294 - 2) & 0x000000ff);
												if(_t299 == 0) {
													L3:
													_t246 = ( *(_t336 - 1) & 0x000000ff) - ( *(_t294 - 1) & 0x000000ff);
													if(_t246 != 0) {
														_t246 = (0 | _t246 > 0x00000000) * 2 - 1;
													}
													goto L1;
												}
												_t246 = (0 | _t299 > 0x00000000) * 2 - 1;
												if(_t246 != 0) {
													goto L1;
												} else {
													goto L3;
												}
											}
											_t246 = (0 | _t297 > 0x00000000) * 2 - 1;
											if(_t246 != 0) {
												goto L1;
											}
											goto L83;
										}
										_t301 = (_t203 & 0x000000ff) - ( *(_t294 - 7) & 0x000000ff);
										if(_t301 == 0) {
											L73:
											_t303 = ( *(_t336 - 6) & 0x000000ff) - ( *(_t294 - 6) & 0x000000ff);
											if(_t303 == 0) {
												L75:
												_t305 = ( *(_t336 - 5) & 0x000000ff) - ( *(_t294 - 5) & 0x000000ff);
												if(_t305 == 0) {
													L77:
													_t246 = ( *(_t336 - 4) & 0x000000ff) - ( *(_t294 - 4) & 0x000000ff);
													if(_t246 != 0) {
														_t246 = (0 | _t246 > 0x00000000) * 2 - 1;
													}
													goto L80;
												}
												_t246 = (0 | _t305 > 0x00000000) * 2 - 1;
												if(_t246 != 0) {
													goto L1;
												}
												goto L77;
											}
											_t246 = (0 | _t303 > 0x00000000) * 2 - 1;
											if(_t246 != 0) {
												goto L1;
											}
											goto L75;
										}
										_t246 = (0 | _t301 > 0x00000000) * 2 - 1;
										if(_t246 != 0) {
											goto L1;
										}
										goto L73;
									}
									_t307 = (_t202 & 0x000000ff) - ( *(_t294 - 0xb) & 0x000000ff);
									if(_t307 == 0) {
										L62:
										_t309 = ( *(_t336 - 0xa) & 0x000000ff) - ( *(_t294 - 0xa) & 0x000000ff);
										if(_t309 == 0) {
											L64:
											_t311 = ( *(_t336 - 9) & 0x000000ff) - ( *(_t294 - 9) & 0x000000ff);
											if(_t311 == 0) {
												L66:
												_t246 = ( *(_t336 - 8) & 0x000000ff) - ( *(_t294 - 8) & 0x000000ff);
												if(_t246 != 0) {
													_t246 = (0 | _t246 > 0x00000000) * 2 - 1;
												}
												goto L69;
											}
											_t246 = (0 | _t311 > 0x00000000) * 2 - 1;
											if(_t246 != 0) {
												goto L1;
											}
											goto L66;
										}
										_t246 = (0 | _t309 > 0x00000000) * 2 - 1;
										if(_t246 != 0) {
											goto L1;
										}
										goto L64;
									}
									_t246 = (0 | _t307 > 0x00000000) * 2 - 1;
									if(_t246 != 0) {
										goto L1;
									}
									goto L62;
								}
								_t313 = ( *(_t336 - 0xf) & 0x000000ff) - ( *(_t294 - 0xf) & 0x000000ff);
								if(_t313 == 0) {
									L51:
									_t315 = ( *(_t336 - 0xe) & 0x000000ff) - ( *(_t294 - 0xe) & 0x000000ff);
									if(_t315 == 0) {
										L53:
										_t317 = ( *(_t336 - 0xd) & 0x000000ff) - ( *(_t294 - 0xd) & 0x000000ff);
										if(_t317 == 0) {
											L55:
											_t246 = ( *(_t336 - 0xc) & 0x000000ff) - ( *(_t294 - 0xc) & 0x000000ff);
											if(_t246 != 0) {
												_t246 = (0 | _t246 > 0x00000000) * 2 - 1;
											}
											goto L58;
										}
										_t246 = (0 | _t317 > 0x00000000) * 2 - 1;
										if(_t246 != 0) {
											goto L1;
										}
										goto L55;
									}
									_t246 = (0 | _t315 > 0x00000000) * 2 - 1;
									if(_t246 != 0) {
										goto L1;
									}
									goto L53;
								}
								_t246 = (0 | _t313 > 0x00000000) * 2 - 1;
								if(_t246 != 0) {
									goto L1;
								}
								goto L51;
							}
							_t319 = (_t200 & 0x000000ff) - ( *(_t294 - 0x13) & 0x000000ff);
							if(_t319 == 0) {
								L40:
								_t321 = ( *(_t336 - 0x12) & 0x000000ff) - ( *(_t294 - 0x12) & 0x000000ff);
								if(_t321 == 0) {
									L42:
									_t323 = ( *(_t336 - 0x11) & 0x000000ff) - ( *(_t294 - 0x11) & 0x000000ff);
									if(_t323 == 0) {
										L44:
										_t246 = ( *(_t336 - 0x10) & 0x000000ff) - ( *(_t294 - 0x10) & 0x000000ff);
										if(_t246 != 0) {
											_t246 = (0 | _t246 > 0x00000000) * 2 - 1;
										}
										goto L47;
									}
									_t246 = (0 | _t323 > 0x00000000) * 2 - 1;
									if(_t246 != 0) {
										goto L1;
									}
									goto L44;
								}
								_t246 = (0 | _t321 > 0x00000000) * 2 - 1;
								if(_t246 != 0) {
									goto L1;
								}
								goto L42;
							}
							_t246 = (0 | _t319 > 0x00000000) * 2 - 1;
							if(_t246 != 0) {
								goto L1;
							}
							goto L40;
						}
						_t325 = (_t199 & 0x000000ff) - ( *(_t294 - 0x17) & 0x000000ff);
						if(_t325 == 0) {
							L29:
							_t327 = ( *(_t336 - 0x16) & 0x000000ff) - ( *(_t294 - 0x16) & 0x000000ff);
							if(_t327 == 0) {
								L31:
								_t329 = ( *(_t336 - 0x15) & 0x000000ff) - ( *(_t294 - 0x15) & 0x000000ff);
								if(_t329 == 0) {
									L33:
									_t246 = ( *(_t336 - 0x14) & 0x000000ff) - ( *(_t294 - 0x14) & 0x000000ff);
									if(_t246 != 0) {
										_t246 = (0 | _t246 > 0x00000000) * 2 - 1;
									}
									goto L36;
								}
								_t246 = (0 | _t329 > 0x00000000) * 2 - 1;
								if(_t246 != 0) {
									goto L1;
								}
								goto L33;
							}
							_t246 = (0 | _t327 > 0x00000000) * 2 - 1;
							if(_t246 != 0) {
								goto L1;
							}
							goto L31;
						}
						_t246 = (0 | _t325 > 0x00000000) * 2 - 1;
						if(_t246 != 0) {
							goto L1;
						}
						goto L29;
					}
					_t331 = (_t198 & 0x000000ff) - ( *(_t294 - 0x1b) & 0x000000ff);
					if(_t331 == 0) {
						L18:
						_t333 = ( *(_t336 - 0x1a) & 0x000000ff) - ( *(_t294 - 0x1a) & 0x000000ff);
						if(_t333 == 0) {
							L20:
							_t335 = ( *(_t336 - 0x19) & 0x000000ff) - ( *(_t294 - 0x19) & 0x000000ff);
							if(_t335 == 0) {
								L22:
								_t246 = ( *(_t336 - 0x18) & 0x000000ff) - ( *(_t294 - 0x18) & 0x000000ff);
								if(_t246 != 0) {
									_t246 = (0 | _t246 > 0x00000000) * 2 - 1;
								}
								goto L25;
							}
							_t246 = (0 | _t335 > 0x00000000) * 2 - 1;
							if(_t246 != 0) {
								goto L1;
							}
							goto L22;
						}
						_t246 = (0 | _t333 > 0x00000000) * 2 - 1;
						if(_t246 != 0) {
							goto L1;
						}
						goto L20;
					}
					_t246 = (0 | _t331 > 0x00000000) * 2 - 1;
					if(_t246 != 0) {
						goto L1;
					}
					goto L18;
				} else {
					__edi =  *(__esi - 0x1f) & 0x000000ff;
					__edi = ( *(__esi - 0x1f) & 0x000000ff) - ( *(__edx - 0x1f) & 0x000000ff);
					if(__edi == 0) {
						L7:
						__edi =  *(__esi - 0x1e) & 0x000000ff;
						__edi = ( *(__esi - 0x1e) & 0x000000ff) - ( *(__edx - 0x1e) & 0x000000ff);
						if(__edi == 0) {
							L9:
							__edi =  *(__esi - 0x1d) & 0x000000ff;
							__edi = ( *(__esi - 0x1d) & 0x000000ff) - ( *(__edx - 0x1d) & 0x000000ff);
							if(__edi == 0) {
								L11:
								__ecx =  *(__esi - 0x1c) & 0x000000ff;
								__ecx = ( *(__esi - 0x1c) & 0x000000ff) - ( *(__edx - 0x1c) & 0x000000ff);
								if(__ecx != 0) {
									__ecx = (0 | __ecx > 0x00000000) * 2 - 1;
								}
								goto L14;
							}
							0 = 0 | __edi > 0x00000000;
							__ecx = (__edi > 0) * 2 != 1;
							if((__edi > 0) * 2 != 1) {
								goto L1;
							}
							goto L11;
						}
						0 = 0 | __edi > 0x00000000;
						__ecx = (__edi > 0) * 2 != 1;
						if((__edi > 0) * 2 != 1) {
							goto L1;
						}
						goto L9;
					}
					0 = 0 | __edi > 0x00000000;
					__ecx = (__edi > 0) * 2 != 1;
					if((__edi > 0) * 2 != 1) {
						goto L1;
					}
					goto L7;
				}
				L1:
				_t197 = _t246;
				return _t197;
			}

0x00a7e88e
0x00a7e88e
0x00a7e894
0x00a7e91c
0x00a7e91e
0x00a7e920
0x00000000
0x00000000
0x00a7e926
0x00a7e92c
0x00a7e9b3
0x00a7e9b5
0x00a7e9b7
0x00000000
0x00000000
0x00a7e9bd
0x00a7e9c3
0x00a7ea4a
0x00a7ea4c
0x00a7ea4e
0x00000000
0x00000000
0x00a7ea54
0x00a7ea5a
0x00a7eae1
0x00a7eae3
0x00a7eae5
0x00000000
0x00000000
0x00a7eaf1
0x00a7eb79
0x00a7eb7b
0x00a7eb7d
0x00000000
0x00000000
0x00a7eb83
0x00a7eb89
0x00a7ec10
0x00a7ec12
0x00a7ec14
0x00000000
0x00000000
0x00a7ec1a
0x00a7ec20
0x00a7eca7
0x00a7eca9
0x00a7ecab
0x00000000
0x00000000
0x00a7ecb9
0x00a7ecbb
0x00a7ecd3
0x00a7ecdb
0x00a7ecdd
0x00a7e436
0x00a7e43e
0x00a7e440
0x00a7e44d
0x00a7e44d
0x00000000
0x00a7e440
0x00a7ecea
0x00a7e430
0x00000000
0x00000000
0x00000000
0x00000000
0x00a7e430
0x00a7ecc4
0x00a7eccd
0x00000000
0x00000000
0x00000000
0x00a7eccd
0x00a7ec2d
0x00a7ec2f
0x00a7ec47
0x00a7ec4f
0x00a7ec51
0x00a7ec69
0x00a7ec71
0x00a7ec73
0x00a7ec8b
0x00a7ec93
0x00a7ec95
0x00a7ec9e
0x00a7ec9e
0x00000000
0x00a7ec95
0x00a7ec7c
0x00a7ec85
0x00000000
0x00000000
0x00000000
0x00a7ec85
0x00a7ec5a
0x00a7ec63
0x00000000
0x00000000
0x00000000
0x00a7ec63
0x00a7ec38
0x00a7ec41
0x00000000
0x00000000
0x00000000
0x00a7ec41
0x00a7eb96
0x00a7eb98
0x00a7ebb0
0x00a7ebb8
0x00a7ebba
0x00a7ebd2
0x00a7ebda
0x00a7ebdc
0x00a7ebf4
0x00a7ebfc
0x00a7ebfe
0x00a7ec07
0x00a7ec07
0x00000000
0x00a7ebfe
0x00a7ebe5
0x00a7ebee
0x00000000
0x00000000
0x00000000
0x00a7ebee
0x00a7ebc3
0x00a7ebcc
0x00000000
0x00000000
0x00000000
0x00a7ebcc
0x00a7eba1
0x00a7ebaa
0x00000000
0x00000000
0x00000000
0x00a7ebaa
0x00a7eaff
0x00a7eb01
0x00a7eb19
0x00a7eb21
0x00a7eb23
0x00a7eb3b
0x00a7eb43
0x00a7eb45
0x00a7eb5d
0x00a7eb65
0x00a7eb67
0x00a7eb70
0x00a7eb70
0x00000000
0x00a7eb67
0x00a7eb4e
0x00a7eb57
0x00000000
0x00000000
0x00000000
0x00a7eb57
0x00a7eb2c
0x00a7eb35
0x00000000
0x00000000
0x00000000
0x00a7eb35
0x00a7eb0a
0x00a7eb13
0x00000000
0x00000000
0x00000000
0x00a7eb13
0x00a7ea67
0x00a7ea69
0x00a7ea81
0x00a7ea89
0x00a7ea8b
0x00a7eaa3
0x00a7eaab
0x00a7eaad
0x00a7eac5
0x00a7eacd
0x00a7eacf
0x00a7ead8
0x00a7ead8
0x00000000
0x00a7eacf
0x00a7eab6
0x00a7eabf
0x00000000
0x00000000
0x00000000
0x00a7eabf
0x00a7ea94
0x00a7ea9d
0x00000000
0x00000000
0x00000000
0x00a7ea9d
0x00a7ea72
0x00a7ea7b
0x00000000
0x00000000
0x00000000
0x00a7ea7b
0x00a7e9d0
0x00a7e9d2
0x00a7e9ea
0x00a7e9f2
0x00a7e9f4
0x00a7ea0c
0x00a7ea14
0x00a7ea16
0x00a7ea2e
0x00a7ea36
0x00a7ea38
0x00a7ea41
0x00a7ea41
0x00000000
0x00a7ea38
0x00a7ea1f
0x00a7ea28
0x00000000
0x00000000
0x00000000
0x00a7ea28
0x00a7e9fd
0x00a7ea06
0x00000000
0x00000000
0x00000000
0x00a7ea06
0x00a7e9db
0x00a7e9e4
0x00000000
0x00000000
0x00000000
0x00a7e9e4
0x00a7e939
0x00a7e93b
0x00a7e953
0x00a7e95b
0x00a7e95d
0x00a7e975
0x00a7e97d
0x00a7e97f
0x00a7e997
0x00a7e99f
0x00a7e9a1
0x00a7e9aa
0x00a7e9aa
0x00000000
0x00a7e9a1
0x00a7e988
0x00a7e991
0x00000000
0x00000000
0x00000000
0x00a7e991
0x00a7e966
0x00a7e96f
0x00000000
0x00000000
0x00000000
0x00a7e96f
0x00a7e944
0x00a7e94d
0x00000000
0x00000000
0x00000000
0x00a7e89a
0x00a7e89e
0x00a7e8a2
0x00a7e8a4
0x00a7e8bc
0x00a7e8bc
0x00a7e8c4
0x00a7e8c6
0x00a7e8de
0x00a7e8de
0x00a7e8e6
0x00a7e8e8
0x00a7e900
0x00a7e900
0x00a7e908
0x00a7e90a
0x00a7e913
0x00a7e913
0x00000000
0x00a7e90a
0x00a7e8ee
0x00a7e8f1
0x00a7e8fa
0x00000000
0x00000000
0x00000000
0x00a7e8fa
0x00a7e8cc
0x00a7e8cf
0x00a7e8d8
0x00000000
0x00000000
0x00000000
0x00a7e8d8
0x00a7e8aa
0x00a7e8ad
0x00a7e8b6
0x00000000
0x00000000
0x00000000
0x00a7e8b6
0x00a7e01c
0x00a7e01c
0x00a7ee0d

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: bd17b0f297d2b23d7ddd1b6328dee49e1834388c96f15bfb26f31ad224ace791
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 09C15F372051934ADB6DC73A887403EBBA15AA67B131EC7EDD4BACF1D4EE20C525D620

Uniqueness

Uniqueness Score: -1.00%

Function 00A7E024 Relevance: .3, Instructions: 331
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00A7E024(void* __edx, void* __esi) {
				signed int _t184;
				signed char _t185;
				signed char _t186;
				signed char _t187;
				signed char _t188;
				signed char _t190;
				signed int _t231;
				void* _t275;
				void* _t278;
				void* _t280;
				void* _t282;
				void* _t284;
				void* _t286;
				void* _t288;
				void* _t290;
				void* _t292;
				void* _t294;
				void* _t296;
				void* _t298;
				void* _t300;
				void* _t302;
				void* _t304;
				void* _t306;
				void* _t308;
				void* _t310;
				void* _t312;
				void* _t313;

				_t313 = __esi;
				_t275 = __edx;
				if( *((intOrPtr*)(__esi - 0x1d)) ==  *((intOrPtr*)(__edx - 0x1d))) {
					_t231 = 0;
					L11:
					if(_t231 != 0) {
						goto L1;
					}
					_t185 =  *(_t313 - 0x19);
					if(_t185 ==  *(_t275 - 0x19)) {
						_t231 = 0;
						L22:
						if(_t231 != 0) {
							goto L1;
						}
						_t186 =  *(_t313 - 0x15);
						if(_t186 ==  *(_t275 - 0x15)) {
							_t231 = 0;
							L33:
							if(_t231 != 0) {
								goto L1;
							}
							_t187 =  *(_t313 - 0x11);
							if(_t187 ==  *(_t275 - 0x11)) {
								_t231 = 0;
								L44:
								if(_t231 != 0) {
									goto L1;
								}
								_t188 =  *(_t313 - 0xd);
								if(_t188 ==  *(_t275 - 0xd)) {
									_t231 = 0;
									L55:
									if(_t231 != 0) {
										goto L1;
									}
									if( *(_t313 - 9) ==  *(_t275 - 9)) {
										_t231 = 0;
										L66:
										if(_t231 != 0) {
											goto L1;
										}
										_t190 =  *(_t313 - 5);
										if(_t190 ==  *(_t275 - 5)) {
											_t231 = 0;
											L77:
											if(_t231 == 0) {
												_t231 = ( *(_t313 - 1) & 0x000000ff) - ( *(_t275 - 1) & 0x000000ff);
												if(_t231 != 0) {
													_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
												}
											}
											goto L1;
										}
										_t278 = (_t190 & 0x000000ff) - ( *(_t275 - 5) & 0x000000ff);
										if(_t278 == 0) {
											L70:
											_t280 = ( *(_t313 - 4) & 0x000000ff) - ( *(_t275 - 4) & 0x000000ff);
											if(_t280 == 0) {
												L72:
												_t282 = ( *(_t313 - 3) & 0x000000ff) - ( *(_t275 - 3) & 0x000000ff);
												if(_t282 == 0) {
													L74:
													_t231 = ( *(_t313 - 2) & 0x000000ff) - ( *(_t275 - 2) & 0x000000ff);
													if(_t231 != 0) {
														_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
													}
													goto L77;
												}
												_t231 = (0 | _t282 > 0x00000000) * 2 - 1;
												if(_t231 != 0) {
													goto L1;
												}
												goto L74;
											}
											_t231 = (0 | _t280 > 0x00000000) * 2 - 1;
											if(_t231 != 0) {
												goto L1;
											}
											goto L72;
										}
										_t231 = (0 | _t278 > 0x00000000) * 2 - 1;
										if(_t231 != 0) {
											goto L1;
										}
										goto L70;
									}
									_t284 = ( *(_t313 - 9) & 0x000000ff) - ( *(_t275 - 9) & 0x000000ff);
									if(_t284 == 0) {
										L59:
										_t286 = ( *(_t313 - 8) & 0x000000ff) - ( *(_t275 - 8) & 0x000000ff);
										if(_t286 == 0) {
											L61:
											_t288 = ( *(_t313 - 7) & 0x000000ff) - ( *(_t275 - 7) & 0x000000ff);
											if(_t288 == 0) {
												L63:
												_t231 = ( *(_t313 - 6) & 0x000000ff) - ( *(_t275 - 6) & 0x000000ff);
												if(_t231 != 0) {
													_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
												}
												goto L66;
											}
											_t231 = (0 | _t288 > 0x00000000) * 2 - 1;
											if(_t231 != 0) {
												goto L1;
											}
											goto L63;
										}
										_t231 = (0 | _t286 > 0x00000000) * 2 - 1;
										if(_t231 != 0) {
											goto L1;
										}
										goto L61;
									}
									_t231 = (0 | _t284 > 0x00000000) * 2 - 1;
									if(_t231 != 0) {
										goto L1;
									}
									goto L59;
								}
								_t290 = (_t188 & 0x000000ff) - ( *(_t275 - 0xd) & 0x000000ff);
								if(_t290 == 0) {
									L48:
									_t292 = ( *(_t313 - 0xc) & 0x000000ff) - ( *(_t275 - 0xc) & 0x000000ff);
									if(_t292 == 0) {
										L50:
										_t294 = ( *(_t313 - 0xb) & 0x000000ff) - ( *(_t275 - 0xb) & 0x000000ff);
										if(_t294 == 0) {
											L52:
											_t231 = ( *(_t313 - 0xa) & 0x000000ff) - ( *(_t275 - 0xa) & 0x000000ff);
											if(_t231 != 0) {
												_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
											}
											goto L55;
										}
										_t231 = (0 | _t294 > 0x00000000) * 2 - 1;
										if(_t231 != 0) {
											goto L1;
										}
										goto L52;
									}
									_t231 = (0 | _t292 > 0x00000000) * 2 - 1;
									if(_t231 != 0) {
										goto L1;
									}
									goto L50;
								}
								_t231 = (0 | _t290 > 0x00000000) * 2 - 1;
								if(_t231 != 0) {
									goto L1;
								}
								goto L48;
							}
							_t296 = (_t187 & 0x000000ff) - ( *(_t275 - 0x11) & 0x000000ff);
							if(_t296 == 0) {
								L37:
								_t298 = ( *(_t313 - 0x10) & 0x000000ff) - ( *(_t275 - 0x10) & 0x000000ff);
								if(_t298 == 0) {
									L39:
									_t300 = ( *(_t313 - 0xf) & 0x000000ff) - ( *(_t275 - 0xf) & 0x000000ff);
									if(_t300 == 0) {
										L41:
										_t231 = ( *(_t313 - 0xe) & 0x000000ff) - ( *(_t275 - 0xe) & 0x000000ff);
										if(_t231 != 0) {
											_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
										}
										goto L44;
									}
									_t231 = (0 | _t300 > 0x00000000) * 2 - 1;
									if(_t231 != 0) {
										goto L1;
									}
									goto L41;
								}
								_t231 = (0 | _t298 > 0x00000000) * 2 - 1;
								if(_t231 != 0) {
									goto L1;
								}
								goto L39;
							}
							_t231 = (0 | _t296 > 0x00000000) * 2 - 1;
							if(_t231 != 0) {
								goto L1;
							}
							goto L37;
						}
						_t302 = (_t186 & 0x000000ff) - ( *(_t275 - 0x15) & 0x000000ff);
						if(_t302 == 0) {
							L26:
							_t304 = ( *(_t313 - 0x14) & 0x000000ff) - ( *(_t275 - 0x14) & 0x000000ff);
							if(_t304 == 0) {
								L28:
								_t306 = ( *(_t313 - 0x13) & 0x000000ff) - ( *(_t275 - 0x13) & 0x000000ff);
								if(_t306 == 0) {
									L30:
									_t231 = ( *(_t313 - 0x12) & 0x000000ff) - ( *(_t275 - 0x12) & 0x000000ff);
									if(_t231 != 0) {
										_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
									}
									goto L33;
								}
								_t231 = (0 | _t306 > 0x00000000) * 2 - 1;
								if(_t231 != 0) {
									goto L1;
								}
								goto L30;
							}
							_t231 = (0 | _t304 > 0x00000000) * 2 - 1;
							if(_t231 != 0) {
								goto L1;
							}
							goto L28;
						}
						_t231 = (0 | _t302 > 0x00000000) * 2 - 1;
						if(_t231 != 0) {
							goto L1;
						}
						goto L26;
					}
					_t308 = (_t185 & 0x000000ff) - ( *(_t275 - 0x19) & 0x000000ff);
					if(_t308 == 0) {
						L15:
						_t310 = ( *(_t313 - 0x18) & 0x000000ff) - ( *(_t275 - 0x18) & 0x000000ff);
						if(_t310 == 0) {
							L17:
							_t312 = ( *(_t313 - 0x17) & 0x000000ff) - ( *(_t275 - 0x17) & 0x000000ff);
							if(_t312 == 0) {
								L19:
								_t231 = ( *(_t313 - 0x16) & 0x000000ff) - ( *(_t275 - 0x16) & 0x000000ff);
								if(_t231 != 0) {
									_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
								}
								goto L22;
							}
							_t231 = (0 | _t312 > 0x00000000) * 2 - 1;
							if(_t231 != 0) {
								goto L1;
							}
							goto L19;
						}
						_t231 = (0 | _t310 > 0x00000000) * 2 - 1;
						if(_t231 != 0) {
							goto L1;
						}
						goto L17;
					}
					_t231 = (0 | _t308 > 0x00000000) * 2 - 1;
					if(_t231 != 0) {
						goto L1;
					}
					goto L15;
				} else {
					__edi = __al & 0x000000ff;
					__edi = (__al & 0x000000ff) - ( *(__edx - 0x1d) & 0x000000ff);
					if(__edi == 0) {
						L4:
						__edi =  *(__esi - 0x1c) & 0x000000ff;
						__edi = ( *(__esi - 0x1c) & 0x000000ff) - ( *(__edx - 0x1c) & 0x000000ff);
						if(__edi == 0) {
							L6:
							__edi =  *(__esi - 0x1b) & 0x000000ff;
							__edi = ( *(__esi - 0x1b) & 0x000000ff) - ( *(__edx - 0x1b) & 0x000000ff);
							if(__edi == 0) {
								L8:
								__ecx =  *(__esi - 0x1a) & 0x000000ff;
								__ecx = ( *(__esi - 0x1a) & 0x000000ff) - ( *(__edx - 0x1a) & 0x000000ff);
								if(__ecx != 0) {
									__ecx = (0 | __ecx > 0x00000000) * 2 - 1;
								}
								goto L11;
							}
							0 = 0 | __edi > 0x00000000;
							__ecx = (__edi > 0) * 2 != 1;
							if((__edi > 0) * 2 != 1) {
								goto L1;
							}
							goto L8;
						}
						0 = 0 | __edi > 0x00000000;
						__ecx = (__edi > 0) * 2 != 1;
						if((__edi > 0) * 2 != 1) {
							goto L1;
						}
						goto L6;
					}
					0 = 0 | __edi > 0x00000000;
					__ecx = (__edi > 0) * 2 != 1;
					if((__edi > 0) * 2 != 1) {
						goto L1;
					}
					goto L4;
				}
				L1:
				_t184 = _t231;
				return _t184;
			}

0x00a7e024
0x00a7e024
0x00a7e02a
0x00a7e0a1
0x00a7e0a3
0x00a7e0a5
0x00000000
0x00000000
0x00a7e0ab
0x00a7e0b1
0x00a7e138
0x00a7e13a
0x00a7e13c
0x00000000
0x00000000
0x00a7e142
0x00a7e148
0x00a7e1cf
0x00a7e1d1
0x00a7e1d3
0x00000000
0x00000000
0x00a7e1d9
0x00a7e1df
0x00a7e266
0x00a7e268
0x00a7e26a
0x00000000
0x00000000
0x00a7e270
0x00a7e276
0x00a7e2fd
0x00a7e2ff
0x00a7e301
0x00000000
0x00000000
0x00a7e30d
0x00a7e395
0x00a7e397
0x00a7e399
0x00000000
0x00000000
0x00a7e39f
0x00a7e3a5
0x00a7e42c
0x00a7e42e
0x00a7e430
0x00a7e43e
0x00a7e440
0x00a7e44d
0x00a7e44d
0x00a7e440
0x00000000
0x00a7e430
0x00a7e3b2
0x00a7e3b4
0x00a7e3cc
0x00a7e3d4
0x00a7e3d6
0x00a7e3ee
0x00a7e3f6
0x00a7e3f8
0x00a7e410
0x00a7e418
0x00a7e41a
0x00a7e423
0x00a7e423
0x00000000
0x00a7e41a
0x00a7e401
0x00a7e40a
0x00000000
0x00000000
0x00000000
0x00a7e40a
0x00a7e3df
0x00a7e3e8
0x00000000
0x00000000
0x00000000
0x00a7e3e8
0x00a7e3bd
0x00a7e3c6
0x00000000
0x00000000
0x00000000
0x00a7e3c6
0x00a7e31b
0x00a7e31d
0x00a7e335
0x00a7e33d
0x00a7e33f
0x00a7e357
0x00a7e35f
0x00a7e361
0x00a7e379
0x00a7e381
0x00a7e383
0x00a7e38c
0x00a7e38c
0x00000000
0x00a7e383
0x00a7e36a
0x00a7e373
0x00000000
0x00000000
0x00000000
0x00a7e373
0x00a7e348
0x00a7e351
0x00000000
0x00000000
0x00000000
0x00a7e351
0x00a7e326
0x00a7e32f
0x00000000
0x00000000
0x00000000
0x00a7e32f
0x00a7e283
0x00a7e285
0x00a7e29d
0x00a7e2a5
0x00a7e2a7
0x00a7e2bf
0x00a7e2c7
0x00a7e2c9
0x00a7e2e1
0x00a7e2e9
0x00a7e2eb
0x00a7e2f4
0x00a7e2f4
0x00000000
0x00a7e2eb
0x00a7e2d2
0x00a7e2db
0x00000000
0x00000000
0x00000000
0x00a7e2db
0x00a7e2b0
0x00a7e2b9
0x00000000
0x00000000
0x00000000
0x00a7e2b9
0x00a7e28e
0x00a7e297
0x00000000
0x00000000
0x00000000
0x00a7e297
0x00a7e1ec
0x00a7e1ee
0x00a7e206
0x00a7e20e
0x00a7e210
0x00a7e228
0x00a7e230
0x00a7e232
0x00a7e24a
0x00a7e252
0x00a7e254
0x00a7e25d
0x00a7e25d
0x00000000
0x00a7e254
0x00a7e23b
0x00a7e244
0x00000000
0x00000000
0x00000000
0x00a7e244
0x00a7e219
0x00a7e222
0x00000000
0x00000000
0x00000000
0x00a7e222
0x00a7e1f7
0x00a7e200
0x00000000
0x00000000
0x00000000
0x00a7e200
0x00a7e155
0x00a7e157
0x00a7e16f
0x00a7e177
0x00a7e179
0x00a7e191
0x00a7e199
0x00a7e19b
0x00a7e1b3
0x00a7e1bb
0x00a7e1bd
0x00a7e1c6
0x00a7e1c6
0x00000000
0x00a7e1bd
0x00a7e1a4
0x00a7e1ad
0x00000000
0x00000000
0x00000000
0x00a7e1ad
0x00a7e182
0x00a7e18b
0x00000000
0x00000000
0x00000000
0x00a7e18b
0x00a7e160
0x00a7e169
0x00000000
0x00000000
0x00000000
0x00a7e169
0x00a7e0be
0x00a7e0c0
0x00a7e0d8
0x00a7e0e0
0x00a7e0e2
0x00a7e0fa
0x00a7e102
0x00a7e104
0x00a7e11c
0x00a7e124
0x00a7e126
0x00a7e12f
0x00a7e12f
0x00000000
0x00a7e126
0x00a7e10d
0x00a7e116
0x00000000
0x00000000
0x00000000
0x00a7e116
0x00a7e0eb
0x00a7e0f4
0x00000000
0x00000000
0x00000000
0x00a7e0f4
0x00a7e0c9
0x00a7e0d2
0x00000000
0x00000000
0x00000000
0x00a7e02c
0x00a7e02c
0x00a7e033
0x00a7e035
0x00a7e049
0x00a7e049
0x00a7e051
0x00a7e053
0x00a7e067
0x00a7e067
0x00a7e06f
0x00a7e071
0x00a7e085
0x00a7e085
0x00a7e08d
0x00a7e08f
0x00a7e098
0x00a7e098
0x00000000
0x00a7e08f
0x00a7e077
0x00a7e07a
0x00a7e083
0x00000000
0x00000000
0x00000000
0x00a7e083
0x00a7e059
0x00a7e05c
0x00a7e065
0x00000000
0x00000000
0x00000000
0x00a7e065
0x00a7e03b
0x00a7e03e
0x00a7e047
0x00000000
0x00000000
0x00000000
0x00a7e047
0x00a7e01c
0x00a7e01c
0x00a7ee0d

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: bd233ede05fcef801507606c8b64580c13577686dd976c43704eccb0da4b6df3
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: 11C183322451934ADF2DC7398C7403EBAA15AA67B131ED7EDD4BACF1C5EE20C525D620

Uniqueness

Uniqueness Score: -1.00%

Function 00A7DC0C Relevance: .3, Instructions: 323
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00A7DC0C(void* __edx, void* __esi) {
				signed char _t177;
				void* _t178;
				signed char _t179;
				signed char _t180;
				signed char _t181;
				signed char _t183;
				signed char _t184;
				void* _t228;
				void* _t278;
				void* _t281;
				void* _t283;
				void* _t285;
				void* _t287;
				void* _t289;
				void* _t291;
				void* _t293;
				void* _t295;
				void* _t297;
				void* _t299;
				void* _t301;
				void* _t303;
				void* _t305;
				void* _t307;
				void* _t309;
				void* _t311;
				void* _t313;
				void* _t315;
				void* _t317;
				void* _t319;
				void* _t321;
				void* _t322;

				_t322 = __esi;
				_t278 = __edx;
				_t177 =  *(__esi - 0x1c);
				if(_t177 ==  *(__edx - 0x1c)) {
					_t228 = 0;
					L10:
					if(_t228 != 0) {
						L78:
						_t178 = _t228;
						return _t178;
					}
					_t179 =  *(_t322 - 0x18);
					if(_t179 ==  *(_t278 - 0x18)) {
						_t228 = 0;
						L21:
						if(_t228 != 0) {
							goto L78;
						}
						_t180 =  *(_t322 - 0x14);
						if(_t180 ==  *(_t278 - 0x14)) {
							_t228 = 0;
							L32:
							if(_t228 != 0) {
								goto L78;
							}
							_t181 =  *(_t322 - 0x10);
							if(_t181 ==  *(_t278 - 0x10)) {
								_t228 = 0;
								L43:
								if(_t228 != 0) {
									goto L78;
								}
								if( *(_t322 - 0xc) ==  *(_t278 - 0xc)) {
									_t228 = 0;
									L54:
									if(_t228 != 0) {
										goto L78;
									}
									_t183 =  *(_t322 - 8);
									if(_t183 ==  *(_t278 - 8)) {
										_t228 = 0;
										L65:
										if(_t228 != 0) {
											goto L78;
										}
										_t184 =  *(_t322 - 4);
										if(_t184 ==  *(_t278 - 4)) {
											_t228 = 0;
											L76:
											if(_t228 == 0) {
												_t228 = 0;
											}
											goto L78;
										}
										_t281 = (_t184 & 0x000000ff) - ( *(_t278 - 4) & 0x000000ff);
										if(_t281 == 0) {
											L69:
											_t283 = ( *(_t322 - 3) & 0x000000ff) - ( *(_t278 - 3) & 0x000000ff);
											if(_t283 == 0) {
												L71:
												_t285 = ( *(_t322 - 2) & 0x000000ff) - ( *(_t278 - 2) & 0x000000ff);
												if(_t285 == 0) {
													L73:
													_t228 = ( *(_t322 - 1) & 0x000000ff) - ( *(_t278 - 1) & 0x000000ff);
													if(_t228 != 0) {
														_t228 = (0 | _t228 > 0x00000000) * 2 - 1;
													}
													goto L76;
												}
												_t228 = (0 | _t285 > 0x00000000) * 2 - 1;
												if(_t228 != 0) {
													goto L78;
												}
												goto L73;
											}
											_t228 = (0 | _t283 > 0x00000000) * 2 - 1;
											if(_t228 != 0) {
												goto L78;
											}
											goto L71;
										}
										_t228 = (0 | _t281 > 0x00000000) * 2 - 1;
										if(_t228 != 0) {
											goto L78;
										}
										goto L69;
									}
									_t287 = (_t183 & 0x000000ff) - ( *(_t278 - 8) & 0x000000ff);
									if(_t287 == 0) {
										L58:
										_t289 = ( *(_t322 - 7) & 0x000000ff) - ( *(_t278 - 7) & 0x000000ff);
										if(_t289 == 0) {
											L60:
											_t291 = ( *(_t322 - 6) & 0x000000ff) - ( *(_t278 - 6) & 0x000000ff);
											if(_t291 == 0) {
												L62:
												_t228 = ( *(_t322 - 5) & 0x000000ff) - ( *(_t278 - 5) & 0x000000ff);
												if(_t228 != 0) {
													_t228 = (0 | _t228 > 0x00000000) * 2 - 1;
												}
												goto L65;
											}
											_t228 = (0 | _t291 > 0x00000000) * 2 - 1;
											if(_t228 != 0) {
												goto L78;
											}
											goto L62;
										}
										_t228 = (0 | _t289 > 0x00000000) * 2 - 1;
										if(_t228 != 0) {
											goto L78;
										}
										goto L60;
									}
									_t228 = (0 | _t287 > 0x00000000) * 2 - 1;
									if(_t228 != 0) {
										goto L78;
									}
									goto L58;
								}
								_t293 = ( *(_t322 - 0xc) & 0x000000ff) - ( *(_t278 - 0xc) & 0x000000ff);
								if(_t293 == 0) {
									L47:
									_t295 = ( *(_t322 - 0xb) & 0x000000ff) - ( *(_t278 - 0xb) & 0x000000ff);
									if(_t295 == 0) {
										L49:
										_t297 = ( *(_t322 - 0xa) & 0x000000ff) - ( *(_t278 - 0xa) & 0x000000ff);
										if(_t297 == 0) {
											L51:
											_t228 = ( *(_t322 - 9) & 0x000000ff) - ( *(_t278 - 9) & 0x000000ff);
											if(_t228 != 0) {
												_t228 = (0 | _t228 > 0x00000000) * 2 - 1;
											}
											goto L54;
										}
										_t228 = (0 | _t297 > 0x00000000) * 2 - 1;
										if(_t228 != 0) {
											goto L78;
										}
										goto L51;
									}
									_t228 = (0 | _t295 > 0x00000000) * 2 - 1;
									if(_t228 != 0) {
										goto L78;
									}
									goto L49;
								}
								_t228 = (0 | _t293 > 0x00000000) * 2 - 1;
								if(_t228 != 0) {
									goto L78;
								}
								goto L47;
							}
							_t299 = (_t181 & 0x000000ff) - ( *(_t278 - 0x10) & 0x000000ff);
							if(_t299 == 0) {
								L36:
								_t301 = ( *(_t322 - 0xf) & 0x000000ff) - ( *(_t278 - 0xf) & 0x000000ff);
								if(_t301 == 0) {
									L38:
									_t303 = ( *(_t322 - 0xe) & 0x000000ff) - ( *(_t278 - 0xe) & 0x000000ff);
									if(_t303 == 0) {
										L40:
										_t228 = ( *(_t322 - 0xd) & 0x000000ff) - ( *(_t278 - 0xd) & 0x000000ff);
										if(_t228 != 0) {
											_t228 = (0 | _t228 > 0x00000000) * 2 - 1;
										}
										goto L43;
									}
									_t228 = (0 | _t303 > 0x00000000) * 2 - 1;
									if(_t228 != 0) {
										goto L78;
									}
									goto L40;
								}
								_t228 = (0 | _t301 > 0x00000000) * 2 - 1;
								if(_t228 != 0) {
									goto L78;
								}
								goto L38;
							}
							_t228 = (0 | _t299 > 0x00000000) * 2 - 1;
							if(_t228 != 0) {
								goto L78;
							}
							goto L36;
						}
						_t305 = (_t180 & 0x000000ff) - ( *(_t278 - 0x14) & 0x000000ff);
						if(_t305 == 0) {
							L25:
							_t307 = ( *(_t322 - 0x13) & 0x000000ff) - ( *(_t278 - 0x13) & 0x000000ff);
							if(_t307 == 0) {
								L27:
								_t309 = ( *(_t322 - 0x12) & 0x000000ff) - ( *(_t278 - 0x12) & 0x000000ff);
								if(_t309 == 0) {
									L29:
									_t228 = ( *(_t322 - 0x11) & 0x000000ff) - ( *(_t278 - 0x11) & 0x000000ff);
									if(_t228 != 0) {
										_t228 = (0 | _t228 > 0x00000000) * 2 - 1;
									}
									goto L32;
								}
								_t228 = (0 | _t309 > 0x00000000) * 2 - 1;
								if(_t228 != 0) {
									goto L78;
								}
								goto L29;
							}
							_t228 = (0 | _t307 > 0x00000000) * 2 - 1;
							if(_t228 != 0) {
								goto L78;
							}
							goto L27;
						}
						_t228 = (0 | _t305 > 0x00000000) * 2 - 1;
						if(_t228 != 0) {
							goto L78;
						}
						goto L25;
					}
					_t311 = (_t179 & 0x000000ff) - ( *(_t278 - 0x18) & 0x000000ff);
					if(_t311 == 0) {
						L14:
						_t313 = ( *(_t322 - 0x17) & 0x000000ff) - ( *(_t278 - 0x17) & 0x000000ff);
						if(_t313 == 0) {
							L16:
							_t315 = ( *(_t322 - 0x16) & 0x000000ff) - ( *(_t278 - 0x16) & 0x000000ff);
							if(_t315 == 0) {
								L18:
								_t228 = ( *(_t322 - 0x15) & 0x000000ff) - ( *(_t278 - 0x15) & 0x000000ff);
								if(_t228 != 0) {
									_t228 = (0 | _t228 > 0x00000000) * 2 - 1;
								}
								goto L21;
							}
							_t228 = (0 | _t315 > 0x00000000) * 2 - 1;
							if(_t228 != 0) {
								goto L78;
							}
							goto L18;
						}
						_t228 = (0 | _t313 > 0x00000000) * 2 - 1;
						if(_t228 != 0) {
							goto L78;
						}
						goto L16;
					}
					_t228 = (0 | _t311 > 0x00000000) * 2 - 1;
					if(_t228 != 0) {
						goto L78;
					}
					goto L14;
				}
				_t317 = (_t177 & 0x000000ff) - ( *(__edx - 0x1c) & 0x000000ff);
				if(_t317 == 0) {
					L3:
					_t319 = ( *(_t322 - 0x1b) & 0x000000ff) - ( *(_t278 - 0x1b) & 0x000000ff);
					if(_t319 == 0) {
						L5:
						_t321 = ( *(_t322 - 0x1a) & 0x000000ff) - ( *(_t278 - 0x1a) & 0x000000ff);
						if(_t321 == 0) {
							L7:
							_t228 = ( *(_t322 - 0x19) & 0x000000ff) - ( *(_t278 - 0x19) & 0x000000ff);
							if(_t228 != 0) {
								_t228 = (0 | _t228 > 0x00000000) * 2 - 1;
							}
							goto L10;
						}
						_t228 = (0 | _t321 > 0x00000000) * 2 - 1;
						if(_t228 != 0) {
							goto L78;
						}
						goto L7;
					}
					_t228 = (0 | _t319 > 0x00000000) * 2 - 1;
					if(_t228 != 0) {
						goto L78;
					}
					goto L5;
				}
				_t228 = (0 | _t317 > 0x00000000) * 2 - 1;
				if(_t228 != 0) {
					goto L78;
				}
				goto L3;
			}

0x00a7dc0c
0x00a7dc0c
0x00a7dc0c
0x00a7dc12
0x00a7dc99
0x00a7dc9b
0x00a7dc9d
0x00a7e01c
0x00a7e01c
0x00a7ee0d
0x00a7ee0d
0x00a7dca3
0x00a7dca9
0x00a7dd30
0x00a7dd32
0x00a7dd34
0x00000000
0x00000000
0x00a7dd3a
0x00a7dd40
0x00a7ddc7
0x00a7ddc9
0x00a7ddcb
0x00000000
0x00000000
0x00a7ddd1
0x00a7ddd7
0x00a7de5e
0x00a7de60
0x00a7de62
0x00000000
0x00000000
0x00a7de6e
0x00a7def6
0x00a7def8
0x00a7defa
0x00000000
0x00000000
0x00a7df00
0x00a7df06
0x00a7df8d
0x00a7df8f
0x00a7df91
0x00000000
0x00000000
0x00a7df97
0x00a7df9d
0x00a7e014
0x00a7e016
0x00a7e018
0x00a7e01a
0x00a7e01a
0x00000000
0x00a7e018
0x00a7dfa6
0x00a7dfa8
0x00a7dfbc
0x00a7dfc4
0x00a7dfc6
0x00a7dfda
0x00a7dfe2
0x00a7dfe4
0x00a7dff8
0x00a7e000
0x00a7e002
0x00a7e00b
0x00a7e00b
0x00000000
0x00a7e002
0x00a7dfed
0x00a7dff6
0x00000000
0x00000000
0x00000000
0x00a7dff6
0x00a7dfcf
0x00a7dfd8
0x00000000
0x00000000
0x00000000
0x00a7dfd8
0x00a7dfb1
0x00a7dfba
0x00000000
0x00000000
0x00000000
0x00a7dfba
0x00a7df13
0x00a7df15
0x00a7df2d
0x00a7df35
0x00a7df37
0x00a7df4f
0x00a7df57
0x00a7df59
0x00a7df71
0x00a7df79
0x00a7df7b
0x00a7df84
0x00a7df84
0x00000000
0x00a7df7b
0x00a7df62
0x00a7df6b
0x00000000
0x00000000
0x00000000
0x00a7df6b
0x00a7df40
0x00a7df49
0x00000000
0x00000000
0x00000000
0x00a7df49
0x00a7df1e
0x00a7df27
0x00000000
0x00000000
0x00000000
0x00a7df27
0x00a7de7c
0x00a7de7e
0x00a7de96
0x00a7de9e
0x00a7dea0
0x00a7deb8
0x00a7dec0
0x00a7dec2
0x00a7deda
0x00a7dee2
0x00a7dee4
0x00a7deed
0x00a7deed
0x00000000
0x00a7dee4
0x00a7decb
0x00a7ded4
0x00000000
0x00000000
0x00000000
0x00a7ded4
0x00a7dea9
0x00a7deb2
0x00000000
0x00000000
0x00000000
0x00a7deb2
0x00a7de87
0x00a7de90
0x00000000
0x00000000
0x00000000
0x00a7de90
0x00a7dde4
0x00a7dde6
0x00a7ddfe
0x00a7de06
0x00a7de08
0x00a7de20
0x00a7de28
0x00a7de2a
0x00a7de42
0x00a7de4a
0x00a7de4c
0x00a7de55
0x00a7de55
0x00000000
0x00a7de4c
0x00a7de33
0x00a7de3c
0x00000000
0x00000000
0x00000000
0x00a7de3c
0x00a7de11
0x00a7de1a
0x00000000
0x00000000
0x00000000
0x00a7de1a
0x00a7ddef
0x00a7ddf8
0x00000000
0x00000000
0x00000000
0x00a7ddf8
0x00a7dd4d
0x00a7dd4f
0x00a7dd67
0x00a7dd6f
0x00a7dd71
0x00a7dd89
0x00a7dd91
0x00a7dd93
0x00a7ddab
0x00a7ddb3
0x00a7ddb5
0x00a7ddbe
0x00a7ddbe
0x00000000
0x00a7ddb5
0x00a7dd9c
0x00a7dda5
0x00000000
0x00000000
0x00000000
0x00a7dda5
0x00a7dd7a
0x00a7dd83
0x00000000
0x00000000
0x00000000
0x00a7dd83
0x00a7dd58
0x00a7dd61
0x00000000
0x00000000
0x00000000
0x00a7dd61
0x00a7dcb6
0x00a7dcb8
0x00a7dcd0
0x00a7dcd8
0x00a7dcda
0x00a7dcf2
0x00a7dcfa
0x00a7dcfc
0x00a7dd14
0x00a7dd1c
0x00a7dd1e
0x00a7dd27
0x00a7dd27
0x00000000
0x00a7dd1e
0x00a7dd05
0x00a7dd0e
0x00000000
0x00000000
0x00000000
0x00a7dd0e
0x00a7dce3
0x00a7dcec
0x00000000
0x00000000
0x00000000
0x00a7dcec
0x00a7dcc1
0x00a7dcca
0x00000000
0x00000000
0x00000000
0x00a7dcca
0x00a7dc1f
0x00a7dc21
0x00a7dc39
0x00a7dc41
0x00a7dc43
0x00a7dc5b
0x00a7dc63
0x00a7dc65
0x00a7dc7d
0x00a7dc85
0x00a7dc87
0x00a7dc90
0x00a7dc90
0x00000000
0x00a7dc87
0x00a7dc6e
0x00a7dc77
0x00000000
0x00000000
0x00000000
0x00a7dc77
0x00a7dc4c
0x00a7dc55
0x00000000
0x00000000
0x00000000
0x00a7dc55
0x00a7dc2a
0x00a7dc33
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 599e3a794dbc3fb7de09ff7a903d8c984b086b851609ca17ea2b153011ea44fb
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 84C16F322050934ADF2E8739887413EBAB15EA27B131EC7ADD4BBCF1C5EE20D525D620

Uniqueness

Uniqueness Score: -1.00%

Function 00A75071 Relevance: .3, Instructions: 320
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E00A75071(intOrPtr __ecx, void* __edx, void* __eflags) {
				void* __ebp;
				signed int _t158;
				intOrPtr _t161;
				signed int _t167;
				signed int _t168;
				signed int _t172;
				signed int _t175;
				void* _t178;
				void* _t185;
				signed int _t190;
				signed int _t191;
				signed int _t192;
				signed int _t194;
				signed int _t205;
				signed int _t209;
				intOrPtr _t210;
				intOrPtr _t213;
				signed int _t216;
				signed int _t220;
				signed int _t222;
				signed int _t223;
				intOrPtr* _t229;
				void* _t235;
				signed int _t237;
				signed int _t238;
				intOrPtr _t242;
				intOrPtr _t244;
				signed int _t254;
				intOrPtr* _t256;
				signed int _t257;
				signed int _t260;
				intOrPtr* _t264;
				intOrPtr _t265;
				void* _t266;
				signed int _t267;
				void* _t269;
				signed int _t270;
				void* _t271;
				void* _t273;

				_t213 = __ecx;
				E00A718CA(__ecx, __edx);
				E00A7302D(__ecx,  *((intOrPtr*)(_t271 + 0x138)));
				_t237 = 0;
				if( *(_t213 + 0x1c) +  *(_t213 + 0x1c) != 0) {
					_t235 = 0;
					do {
						_t210 =  *((intOrPtr*)(_t213 + 0x18));
						_t235 = _t235 + 0x4ae4;
						_t237 = _t237 + 1;
						 *((char*)(_t210 + _t235 - 0x13)) = 0;
						 *((char*)(_t210 + _t235 - 0x11)) = 0;
					} while (_t237 <  *(_t213 + 0x1c) +  *(_t213 + 0x1c));
				}
				_t216 = 5;
				memcpy( *((intOrPtr*)(_t213 + 0x18)) + 0x18, _t213 + 0x80, _t216 << 2);
				E00A7EE90( *((intOrPtr*)(_t213 + 0x18)) + 0x30, _t213 + 0x94, 0x4a9c);
				_t273 = _t271 + 0x18;
				_t260 = 0;
				 *(_t273 + 0x28) = 0;
				_t265 = 0;
				 *((char*)(_t273 + 0x13)) = 0;
				 *((intOrPtr*)(_t273 + 0x18)) = 0;
				 *((char*)(_t273 + 0x12)) = 0;
				while(1) {
					L4:
					_push(0x00400000 - _t260 & 0xfffffff0);
					_push( *((intOrPtr*)(_t213 + 0x20)) + _t260);
					_t158 = E00A6C248();
					 *(_t273 + 0x2c) = _t158;
					if(_t158 < 0) {
						break;
					}
					_t260 = _t260 + _t158;
					 *(_t273 + 0x20) = _t260;
					if(_t260 != 0) {
						if(_t158 <= 0) {
							goto L54;
						} else {
							if(_t260 >= 0x400) {
								L54:
								while(_t265 < _t260) {
									_t222 = 0;
									 *(_t273 + 0x14) =  *(_t273 + 0x14) & 0;
									 *(_t273 + 0x1c) = 0;
									_t167 =  *(_t213 + 0x1c) +  *(_t213 + 0x1c);
									__eflags = _t167;
									if(_t167 != 0) {
										_t242 =  *((intOrPtr*)(_t273 + 0x18));
										_t270 = 0;
										__eflags = 0;
										do {
											_t256 =  *((intOrPtr*)(_t213 + 0x18)) + _t270;
											 *(_t273 + 0x28) = _t222;
											__eflags =  *((char*)(_t256 + 0x4ad3));
											 *_t256 = _t213;
											if( *((char*)(_t256 + 0x4ad3)) == 0) {
												E00A69E5C(_t256 + 4,  *((intOrPtr*)(_t213 + 0x20)) + _t242);
												_t260 =  *(_t273 + 0x20);
												 *((intOrPtr*)(_t256 + 8)) = 0;
												_t167 = _t260 -  *((intOrPtr*)(_t273 + 0x18));
												__eflags = _t167;
												 *((intOrPtr*)(_t256 + 4)) = 0;
												 *(_t256 + 0x4acc) = _t167;
												if(_t167 != 0) {
													 *((char*)(_t256 + 0x4ad0)) = 0;
													 *((char*)(_t256 + 0x14)) = 0;
													 *((char*)(_t256 + 0x2c)) = 0;
													_t222 =  *(_t273 + 0x1c);
													goto L15;
												}
											} else {
												 *(_t256 + 0x4acc) = _t260;
												L15:
												__eflags =  *(_t273 + 0x2c);
												 *((char*)(_t256 + 0x4ad3)) = 0;
												 *(_t256 + 0x4ae0) = _t222;
												__eflags =  *((char*)(_t256 + 0x14));
												 *((char*)(_t256 + 0x4ad2)) = _t167 & 0xffffff00 |  *(_t273 + 0x2c) == 0x00000000;
												if( *((char*)(_t256 + 0x14)) != 0) {
													L18:
													__eflags =  *((char*)(_t273 + 0x13));
													if( *((char*)(_t273 + 0x13)) != 0) {
														L21:
														 *((char*)(_t256 + 0x4ad1)) = 1;
														 *((char*)(_t273 + 0x13)) = 1;
													} else {
														__eflags =  *((intOrPtr*)(_t256 + 0x18)) - 0x20000;
														if( *((intOrPtr*)(_t256 + 0x18)) > 0x20000) {
															goto L21;
														} else {
															 *(_t273 + 0x14) =  *(_t273 + 0x14) + 1;
														}
													}
													_t270 = _t270 + 0x4ae4;
													_t242 =  *((intOrPtr*)(_t273 + 0x18)) +  *((intOrPtr*)(_t256 + 0x24)) +  *((intOrPtr*)(_t256 + 0x18));
													_t222 = _t222 + 1;
													 *((intOrPtr*)(_t273 + 0x18)) = _t242;
													_t205 = _t260 - _t242;
													__eflags = _t205;
													 *(_t273 + 0x1c) = _t222;
													if(_t205 < 0) {
														L24:
														__eflags = _t205 - 0x400;
														if(_t205 >= 0x400) {
															goto L25;
														}
													} else {
														__eflags =  *((char*)(_t256 + 0x28));
														if( *((char*)(_t256 + 0x28)) == 0) {
															goto L24;
														}
													}
												} else {
													 *((char*)(_t256 + 0x14)) = 1;
													_push(_t256 + 0x18);
													_push(_t256 + 4);
													_t209 = E00A72207(_t213);
													__eflags = _t209;
													if(_t209 == 0) {
														 *((char*)(_t273 + 0x12)) = 1;
													} else {
														_t222 =  *(_t273 + 0x1c);
														goto L18;
													}
												}
											}
											goto L28;
											L25:
											_t167 =  *(_t213 + 0x1c) +  *(_t213 + 0x1c);
											__eflags = _t222 - _t167;
										} while (_t222 < _t167);
									}
									L28:
									_t223 =  *(_t273 + 0x14);
									_t168 = _t223;
									_t254 = _t168 /  *(_t213 + 0x1c);
									__eflags = _t168 %  *(_t213 + 0x1c);
									if(_t168 %  *(_t213 + 0x1c) != 0) {
										_t254 = _t254 + 1;
										__eflags = _t254;
									}
									_t266 = 0;
									__eflags = _t223;
									if(_t223 != 0) {
										_t244 = 0;
										_t264 = _t273 + 0x34;
										_t192 = _t254 * 0x4ae4;
										__eflags = _t192;
										 *((intOrPtr*)(_t273 + 0x24)) = 0;
										 *(_t273 + 0x30) = _t192;
										do {
											_t229 = _t264;
											_t245 = _t244 +  *((intOrPtr*)(_t213 + 0x18));
											_t194 =  *(_t273 + 0x14) - _t266;
											_t264 = _t264 + 8;
											 *_t229 = _t244 +  *((intOrPtr*)(_t213 + 0x18));
											__eflags = _t254 - _t194;
											if(_t254 < _t194) {
												_t194 = _t254;
											}
											__eflags =  *(_t273 + 0x1c) - 1;
											 *(_t229 + 4) = _t194;
											if( *(_t273 + 0x1c) != 1) {
												E00A6F111( *((intOrPtr*)(_t213 + 0x14)), E00A75A72, _t229);
											} else {
												E00A75490(_t213, _t245);
											}
											_t266 = _t266 + _t254;
											_t244 =  *((intOrPtr*)(_t273 + 0x24)) +  *(_t273 + 0x30);
											 *((intOrPtr*)(_t273 + 0x24)) = _t244;
											__eflags = _t266 -  *(_t273 + 0x14);
										} while (_t266 <  *(_t273 + 0x14));
										_t260 =  *(_t273 + 0x20);
									}
									_t267 =  *(_t273 + 0x1c);
									__eflags = _t267;
									if(_t267 == 0) {
										_t265 =  *((intOrPtr*)(_t273 + 0x18));
										goto L66;
									} else {
										E00A6F473( *((intOrPtr*)(_t213 + 0x14)));
										 *(_t273 + 0x14) = 0;
										__eflags = _t267;
										if(_t267 == 0) {
											L50:
											_t172 =  *((intOrPtr*)(_t273 + 0x12));
											goto L51;
										} else {
											_t257 = 0;
											__eflags = 0;
											do {
												_t269 =  *((intOrPtr*)(_t213 + 0x18)) + _t257;
												__eflags =  *((char*)(_t269 + 0x4ad1));
												if( *((char*)(_t269 + 0x4ad1)) != 0) {
													L45:
													_t175 = E00A75AA1(_t213, _t269);
													__eflags = _t175;
													if(_t175 != 0) {
														goto L46;
													}
												} else {
													_t191 = E00A71C60(_t213, _t269);
													__eflags = _t191;
													if(_t191 != 0) {
														__eflags =  *((char*)(_t269 + 0x4ad1));
														if( *((char*)(_t269 + 0x4ad1)) == 0) {
															L46:
															__eflags =  *((char*)(_t269 + 0x4ad0));
															if( *((char*)(_t269 + 0x4ad0)) == 0) {
																__eflags =  *((char*)(_t269 + 0x4ad3));
																if( *((char*)(_t269 + 0x4ad3)) != 0) {
																	_t227 =  *((intOrPtr*)(_t213 + 0x20));
																	_t178 =  *((intOrPtr*)(_t269 + 0x10)) -  *((intOrPtr*)(_t213 + 0x20)) +  *(_t269 + 4);
																	__eflags = _t260 - _t178;
																	if(_t260 > _t178) {
																		_t260 = _t260 - _t178;
																		 *(_t273 + 0x2c) = _t260;
																		E00A7F6F0(_t227, _t178 + _t227, _t260);
																		_t273 = _t273 + 0xc;
																		 *((intOrPtr*)(_t269 + 0x18)) =  *((intOrPtr*)(_t269 + 0x18)) +  *(_t269 + 0x20) -  *(_t269 + 4);
																		 *(_t269 + 0x24) =  *(_t269 + 0x24) & 0x00000000;
																		 *(_t269 + 0x20) =  *(_t269 + 0x20) & 0x00000000;
																		 *(_t269 + 4) =  *(_t269 + 4) & 0x00000000;
																		 *((intOrPtr*)(_t269 + 0x10)) =  *((intOrPtr*)(_t213 + 0x20));
																		__eflags =  *(_t273 + 0x14);
																		if( *(_t273 + 0x14) != 0) {
																			_t185 =  *((intOrPtr*)(_t213 + 0x18));
																			E00A7EE90(_t185, _t269, 0x4ae4);
																			 *((intOrPtr*)( *((intOrPtr*)(_t213 + 0x18)) + 0x4ad4)) =  *((intOrPtr*)(_t185 + 0x4ad4));
																			_t260 =  *(_t273 + 0x2c);
																			 *((intOrPtr*)( *((intOrPtr*)(_t213 + 0x18)) + 0x4adc)) =  *((intOrPtr*)(_t185 + 0x4adc));
																			 *((char*)(_t269 + 0x4ad3)) = 0;
																			goto L60;
																		}
																		goto L61;
																	}
																} else {
																	__eflags =  *((char*)(_t269 + 0x28));
																	if( *((char*)(_t269 + 0x28)) != 0) {
																		_t172 = 1;
																		 *((char*)(_t273 + 0x12)) = 1;
																		L51:
																		__eflags = _t172;
																		if(_t172 == 0) {
																			_t265 =  *((intOrPtr*)(_t273 + 0x18));
																			_t260 = _t260 - _t265;
																			__eflags = _t260 - 0x400;
																			if(_t260 < 0x400) {
																				__eflags = _t260;
																				if(__eflags >= 0) {
																					if(__eflags <= 0) {
																						L61:
																						_t265 = 0;
																						 *((intOrPtr*)(_t273 + 0x18)) = 0;
																						L66:
																						__eflags =  *((char*)(_t273 + 0x12));
																						if( *((char*)(_t273 + 0x12)) == 0) {
																							goto L4;
																						}
																					} else {
																						E00A7F6F0( *((intOrPtr*)(_t213 + 0x20)),  *((intOrPtr*)(_t213 + 0x20)) + _t265, _t260);
																						L60:
																						_t273 = _t273 + 0xc;
																						goto L61;
																					}
																				}
																			} else {
																				_t260 =  *(_t273 + 0x20);
																				goto L54;
																			}
																		}
																	} else {
																		goto L49;
																	}
																}
															}
														} else {
															goto L45;
														}
													}
												}
												goto L67;
												L49:
												_t257 = _t257 + 0x4ae4;
												_t190 =  *(_t273 + 0x14) + 1;
												 *(_t273 + 0x14) = _t190;
												__eflags = _t190 -  *(_t273 + 0x1c);
											} while (_t190 <  *(_t273 + 0x1c));
											goto L50;
										}
									}
									goto L67;
								}
							}
							continue;
						}
					}
					break;
				}
				L67:
				 *(_t213 + 0x70) =  *(_t213 + 0x70) &  *(_t213 + 0xe6dc);
				E00A73638(_t213);
				_t238 =  *(_t273 + 0x28) * 0x4ae4;
				_t161 =  *((intOrPtr*)(_t213 + 0x18));
				_t220 = 5;
				__eflags = _t161 + _t238 + 0x30;
				return E00A7EE90(memcpy(_t213 + 0x80, _t238 + 0x18 + _t161, _t220 << 2), _t161 + _t238 + 0x30, 0x4a9c);
			}

0x00a7507b
0x00a7507d
0x00a7508b
0x00a75093
0x00a75097
0x00a75099
0x00a7509b
0x00a7509b
0x00a7509e
0x00a750a4
0x00a750a5
0x00a750aa
0x00a750b4
0x00a7509b
0x00a750c3
0x00a750d3
0x00a750dc
0x00a750e3
0x00a750e6
0x00a750e8
0x00a750ec
0x00a750ee
0x00a750f2
0x00a750f6
0x00a750fa
0x00a750fa
0x00a75106
0x00a7510c
0x00a7510d
0x00a75112
0x00a75118
0x00000000
0x00000000
0x00a7511e
0x00a75120
0x00a75124
0x00a7512c
0x00000000
0x00a75132
0x00a75138
0x00000000
0x00a75378
0x00a75142
0x00a75144
0x00a75148
0x00a7514c
0x00a7514c
0x00a7514e
0x00a75154
0x00a75158
0x00a75158
0x00a7515a
0x00a7515d
0x00a7515f
0x00a75163
0x00a7516a
0x00a7516c
0x00a7517f
0x00a75184
0x00a7518c
0x00a7518f
0x00a7518f
0x00a75193
0x00a75196
0x00a7519c
0x00a751a2
0x00a751a8
0x00a751ab
0x00a751ae
0x00000000
0x00a751ae
0x00a7516e
0x00a7516e
0x00a751b2
0x00a751b2
0x00a751b7
0x00a751c1
0x00a751c7
0x00a751cb
0x00a751d1
0x00a751ee
0x00a751ee
0x00a751f3
0x00a75204
0x00a75204
0x00a7520b
0x00a751f5
0x00a751f5
0x00a751fc
0x00000000
0x00a751fe
0x00a751fe
0x00a751fe
0x00a751fc
0x00a75213
0x00a75220
0x00a75222
0x00a75225
0x00a75229
0x00a75229
0x00a7522b
0x00a7522f
0x00a75237
0x00a75237
0x00a7523c
0x00000000
0x00000000
0x00a75231
0x00a75231
0x00a75235
0x00000000
0x00000000
0x00a75235
0x00a751d3
0x00a751d6
0x00a751da
0x00a751e0
0x00a751e1
0x00a751e6
0x00a751e8
0x00a7524d
0x00a751ea
0x00a751ea
0x00000000
0x00a751ea
0x00a751e8
0x00a751d1
0x00000000
0x00a7523e
0x00a75241
0x00a75243
0x00a75243
0x00a7524b
0x00a75252
0x00a75252
0x00a75258
0x00a7525d
0x00a7525f
0x00a75261
0x00a75263
0x00a75263
0x00a75263
0x00a75264
0x00a75266
0x00a75268
0x00a7526a
0x00a7526c
0x00a75270
0x00a75270
0x00a75276
0x00a7527a
0x00a7527e
0x00a75282
0x00a75284
0x00a75287
0x00a75289
0x00a7528c
0x00a7528e
0x00a75290
0x00a75292
0x00a75292
0x00a75294
0x00a75299
0x00a7529c
0x00a752b1
0x00a7529e
0x00a752a1
0x00a752a1
0x00a752ba
0x00a752bc
0x00a752c0
0x00a752c4
0x00a752c4
0x00a752ca
0x00a752ca
0x00a752ce
0x00a752d2
0x00a752d4
0x00a7542f
0x00000000
0x00a752da
0x00a752dd
0x00a752e4
0x00a752e8
0x00a752ea
0x00a75356
0x00a75356
0x00000000
0x00a752ec
0x00a752ec
0x00a752ec
0x00a752ee
0x00a752f1
0x00a752f3
0x00a752fa
0x00a75315
0x00a75318
0x00a7531d
0x00a7531f
0x00000000
0x00000000
0x00a752fc
0x00a752ff
0x00a75304
0x00a75306
0x00a7530c
0x00a75313
0x00a75325
0x00a75325
0x00a7532c
0x00a75332
0x00a75339
0x00a75390
0x00a75395
0x00a75398
0x00a7539a
0x00a753a0
0x00a753a7
0x00a753ab
0x00a753b3
0x00a753b9
0x00a753bc
0x00a753c0
0x00a753c7
0x00a753cb
0x00a753d2
0x00a753d4
0x00a753d6
0x00a753ec
0x00a753f4
0x00a753fd
0x00a75401
0x00a75407
0x00000000
0x00a75407
0x00000000
0x00a753d4
0x00a7533b
0x00a7533b
0x00a7533f
0x00a75385
0x00a75387
0x00a7535a
0x00a7535a
0x00a7535c
0x00a75362
0x00a75366
0x00a75368
0x00a7536e
0x00a75419
0x00a7541b
0x00a7541d
0x00a75411
0x00a75411
0x00a75413
0x00a75433
0x00a75433
0x00a75438
0x00000000
0x00000000
0x00a7541f
0x00a75428
0x00a7540e
0x00a7540e
0x00000000
0x00a7540e
0x00a7541d
0x00a75374
0x00a75374
0x00000000
0x00a75374
0x00a7536e
0x00000000
0x00000000
0x00000000
0x00a7533f
0x00a75339
0x00000000
0x00000000
0x00000000
0x00a75313
0x00a75306
0x00000000
0x00a75341
0x00a75345
0x00a7534b
0x00a7534c
0x00a75350
0x00a75350
0x00000000
0x00a752ee
0x00a752ea
0x00000000
0x00a752d4
0x00a75380
0x00000000
0x00a75138
0x00a7512c
0x00000000
0x00a75124
0x00a7543e
0x00a75446
0x00a75449
0x00a7544e
0x00a7545c
0x00a75461
0x00a7546f
0x00a7548d

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 15c01d6870d97783f16353dadd6beb94badcb58f23021f5d5cf988c0170f1a95
Instruction ID: 748d348c6bf5f6c5c12613503f0396ab9b6eb09c44363d5ce613aec77104950d
Opcode Fuzzy Hash: 15c01d6870d97783f16353dadd6beb94badcb58f23021f5d5cf988c0170f1a95
Instruction Fuzzy Hash: 8BC1D071A047419FCB14CF38CC8079ABBE5AF95304F04C56DE8489B642D7B4E959CBDA

Uniqueness

Uniqueness Score: -1.00%

Function 00A6D1BC Relevance: .3, Instructions: 318
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00A6D1BC(void* __ebx, intOrPtr __ecx, void* __esi) {
				void* _t222;
				signed int _t229;
				signed char _t253;
				signed int _t301;
				signed int* _t304;
				signed int* _t309;
				unsigned int _t313;
				signed char _t348;
				unsigned int _t350;
				signed int _t353;
				unsigned int _t356;
				signed int* _t359;
				signed int _t363;
				signed int _t368;
				signed int _t372;
				signed int _t376;
				signed char _t378;
				signed int* _t382;
				signed int _t388;
				signed int _t394;
				signed int _t399;
				intOrPtr _t400;
				signed char _t402;
				signed char _t403;
				signed char _t404;
				unsigned int _t406;
				signed int _t409;
				signed int _t411;
				unsigned int _t412;
				unsigned int _t414;
				unsigned int _t415;
				signed int _t416;
				signed int _t421;
				void* _t422;
				unsigned int _t423;
				signed int _t426;
				intOrPtr _t429;
				signed int* _t430;
				void* _t431;
				void* _t432;

				_t414 =  *(_t431 + 0x64);
				_t429 = __ecx;
				 *((intOrPtr*)(_t431 + 0x1c)) = __ecx;
				if(_t414 != 0) {
					_t415 = _t414 >> 4;
					 *(_t431 + 0x64) = _t415;
					if( *((char*)(__ecx)) == 0) {
						 *((intOrPtr*)(_t431 + 0x30)) = __ecx + 8;
						E00A7EE90(_t431 + 0x54, __ecx + 8, 0x10);
						_t432 = _t431 + 0xc;
						if(_t415 == 0) {
							L13:
							return E00A7EE90( *((intOrPtr*)(_t432 + 0x30)), _t432 + 0x50, 0x10);
						}
						_t399 =  *(_t432 + 0x60);
						 *(_t432 + 0x1c) = _t399 + 8;
						_t229 =  *(_t432 + 0x70);
						_t400 = _t399 - _t229;
						 *((intOrPtr*)(_t432 + 0x2c)) = _t400;
						_t359 = _t229 + 8;
						 *(_t432 + 0x20) = _t359;
						do {
							_t421 =  *(_t429 + 4);
							 *(_t432 + 0x28) = _t359 + _t400 + 0xfffffff8;
							E00A6D18A(_t432 + 0x4c, _t359 + _t400 + 0xfffffff8, (_t421 << 4) + 0x18 + _t429);
							_t402 =  *(_t432 + 0x44);
							 *(_t432 + 0x68) =  *(0xa9ee40 + (_t402 & 0x000000ff) * 4) ^  *(0xa9fa40 + ( *(_t432 + 0x4b) & 0x000000ff) * 4) ^  *(0xa9f640 + ( *(_t432 + 0x4e) & 0x000000ff) * 4);
							_t348 =  *(_t432 + 0x50);
							_t363 =  *(_t432 + 0x68) ^  *(0xa9f240 + (_t348 & 0x000000ff) * 4);
							 *(_t432 + 0x68) = _t363;
							 *(_t432 + 0x34) = _t363;
							_t403 =  *(_t432 + 0x48);
							_t368 =  *(0xa9f240 + (_t402 & 0x000000ff) * 4) ^  *(0xa9ee40 + (_t403 & 0x000000ff) * 4) ^  *(0xa9fa40 + ( *(_t432 + 0x4f) & 0x000000ff) * 4) ^  *(0xa9f640 + ( *(_t432 + 0x52) & 0x000000ff) * 4);
							 *(_t432 + 0x70) = _t368;
							 *(_t432 + 0x38) = _t368;
							_t404 =  *(_t432 + 0x4c);
							 *(_t432 + 0x10) =  *(0xa9f640 + ( *(_t432 + 0x46) & 0x000000ff) * 4) ^  *(0xa9f240 + (_t403 & 0x000000ff) * 4);
							_t372 =  *(_t432 + 0x10) ^  *(0xa9ee40 + (_t404 & 0x000000ff) * 4) ^  *(0xa9fa40 + ( *(_t432 + 0x53) & 0x000000ff) * 4);
							 *(_t432 + 0x10) = _t372;
							 *(_t432 + 0x3c) = _t372;
							 *(_t432 + 0x14) =  *(0xa9fa40 + ( *(_t432 + 0x47) & 0x000000ff) * 4) ^  *(0xa9f640 + ( *(_t432 + 0x4a) & 0x000000ff) * 4);
							_t376 =  *(_t432 + 0x14) ^  *(0xa9f240 + (_t404 & 0x000000ff) * 4) ^  *(0xa9ee40 + (_t348 & 0x000000ff) * 4);
							_t422 = _t421 - 1;
							 *(_t432 + 0x14) = _t376;
							 *(_t432 + 0x40) = _t376;
							if(_t422 <= 1) {
								goto L9;
							}
							_t416 =  *(_t432 + 0x68);
							_t309 = (_t422 + 2 << 4) + _t429;
							 *(_t432 + 0x14) = _t309;
							_t430 = _t309;
							 *((intOrPtr*)(_t432 + 0x18)) = _t422 - 1;
							do {
								_t411 =  *_t430;
								 *(_t432 + 0x68) =  *(_t430 - 8) ^ _t416;
								_t430 = _t430 - 0x10;
								_t313 = _t430[5] ^ _t376;
								_t412 = _t411 ^  *(_t432 + 0x10);
								 *(_t432 + 0x14) = _t313;
								_t356 = _t430[3] ^  *(_t432 + 0x70);
								_t416 =  *(0xa9f240 + (_t313 >> 0x00000008 & 0x000000ff) * 4) ^  *(0xa9f640 + (_t412 >> 0x00000010 & 0x000000ff) * 4) ^  *(0xa9fa40 + (_t356 >> 0x18) * 4) ^  *(0xa9ee40 + ( *(_t432 + 0x68) & 0x000000ff) * 4);
								 *(_t432 + 0x34) = _t416;
								 *(_t432 + 0x70) =  *(0xa9f640 + ( *(_t432 + 0x14) >> 0x00000010 & 0x000000ff) * 4) ^  *(0xa9fa40 + (_t412 >> 0x18) * 4);
								_t388 =  *(_t432 + 0x70) ^  *(0xa9f240 + ( *(_t432 + 0x68) >> 0x00000008 & 0x000000ff) * 4) ^  *(0xa9ee40 + (_t356 & 0x000000ff) * 4);
								 *(_t432 + 0x70) = _t388;
								 *(_t432 + 0x38) = _t388;
								_t394 =  *(0xa9fa40 + ( *(_t432 + 0x14) >> 0x18) * 4) ^  *(0xa9f240 + (_t356 >> 0x00000008 & 0x000000ff) * 4) ^  *(0xa9f640 + ( *(_t432 + 0x68) >> 0x00000010 & 0x000000ff) * 4) ^  *(0xa9ee40 + (_t412 & 0x000000ff) * 4);
								 *(_t432 + 0x10) = _t394;
								 *(_t432 + 0x3c) = _t394;
								_t376 =  *(0xa9f240 + (_t412 >> 0x00000008 & 0x000000ff) * 4) ^  *(0xa9f640 + (_t356 >> 0x00000010 & 0x000000ff) * 4) ^  *(0xa9fa40 + ( *(_t432 + 0x68) >> 0x18) * 4) ^  *(0xa9ee40 + ( *(_t432 + 0x14) & 0x000000ff) * 4);
								_t135 = _t432 + 0x18;
								 *_t135 =  *((intOrPtr*)(_t432 + 0x18)) - 1;
								 *(_t432 + 0x40) = _t376;
							} while ( *_t135 != 0);
							_t429 =  *((intOrPtr*)(_t432 + 0x24));
							 *(_t432 + 0x68) = _t416;
							_t415 =  *(_t432 + 0x6c);
							 *(_t432 + 0x14) = _t376;
							L9:
							_t253 =  *(_t429 + 0x28) ^  *(_t432 + 0x68);
							 *(_t432 + 0x6c) = _t253;
							 *(_t432 + 0x44) = _t253;
							_t378 =  *(_t429 + 0x34) ^  *(_t432 + 0x14);
							 *(_t432 + 0x34) =  *((intOrPtr*)((_t253 & 0x000000ff) + 0xa9dd20));
							_t406 =  *(_t429 + 0x30) ^  *(_t432 + 0x10);
							_t350 =  *(_t429 + 0x2c) ^  *(_t432 + 0x70);
							 *((char*)(_t432 + 0x35)) =  *((intOrPtr*)((_t378 >> 0x00000008 & 0x000000ff) + 0xa9dd20));
							_t423 =  *(_t432 + 0x6c);
							 *(_t432 + 0x4c) = _t406;
							 *(_t432 + 0x48) = _t350;
							 *((char*)(_t432 + 0x36)) =  *((intOrPtr*)((_t406 >> 0x00000010 & 0x000000ff) + 0xa9dd20));
							 *(_t432 + 0x50) = _t378;
							 *((char*)(_t432 + 0x37)) =  *((intOrPtr*)((_t350 >> 0x18) + 0xa9dd20));
							 *(_t432 + 0x38) =  *((intOrPtr*)((_t350 & 0x000000ff) + 0xa9dd20));
							 *((char*)(_t432 + 0x39)) =  *((intOrPtr*)((_t423 >> 0x00000008 & 0x000000ff) + 0xa9dd20));
							 *((char*)(_t432 + 0x3a)) =  *((intOrPtr*)((_t378 >> 0x00000010 & 0x000000ff) + 0xa9dd20));
							_t170 = (_t406 >> 0x18) + 0xa9dd20; // 0x54cbe9de
							 *((char*)(_t432 + 0x3b)) =  *_t170;
							 *(_t432 + 0x3c) =  *((intOrPtr*)((_t406 & 0x000000ff) + 0xa9dd20));
							 *((char*)(_t432 + 0x3d)) =  *((intOrPtr*)((_t350 >> 0x00000008 & 0x000000ff) + 0xa9dd20));
							 *((char*)(_t432 + 0x3e)) =  *((intOrPtr*)((_t423 >> 0x00000010 & 0x000000ff) + 0xa9dd20));
							 *((char*)(_t432 + 0x3f)) =  *((intOrPtr*)((_t378 >> 0x18) + 0xa9dd20));
							 *(_t432 + 0x40) =  *((intOrPtr*)((_t378 & 0x000000ff) + 0xa9dd20));
							_t409 =  *(_t432 + 0x34) ^  *(_t429 + 0x18);
							 *((char*)(_t432 + 0x41)) =  *((intOrPtr*)((_t406 >> 0x00000008 & 0x000000ff) + 0xa9dd20));
							 *((char*)(_t432 + 0x42)) =  *((intOrPtr*)((_t350 >> 0x00000010 & 0x000000ff) + 0xa9dd20));
							 *((char*)(_t432 + 0x43)) =  *((intOrPtr*)((_t423 >> 0x18) + 0xa9dd20));
							_t301 =  *(_t432 + 0x40) ^  *(_t429 + 0x24);
							_t426 =  *(_t432 + 0x38) ^  *(_t429 + 0x1c);
							_t353 =  *(_t432 + 0x3c) ^  *(_t429 + 0x20);
							 *(_t432 + 0x6c) = _t301;
							if( *((char*)(_t429 + 1)) != 0) {
								_t409 = _t409 ^  *(_t432 + 0x54);
								_t426 = _t426 ^  *(_t432 + 0x58);
								_t353 = _t353 ^  *(_t432 + 0x5c);
								 *(_t432 + 0x6c) = _t301 ^  *(_t432 + 0x60);
							}
							 *(_t432 + 0x54) =  *( *(_t432 + 0x28));
							_t304 =  *(_t432 + 0x1c);
							 *(_t432 + 0x58) =  *(_t304 - 4);
							 *(_t432 + 0x5c) =  *_t304;
							 *(_t432 + 0x60) = _t304[1];
							_t382 =  *(_t432 + 0x20);
							 *(_t432 + 0x1c) =  &(_t304[4]);
							 *(_t382 - 8) = _t409;
							_t382[1] =  *(_t432 + 0x6c);
							_t400 =  *((intOrPtr*)(_t432 + 0x2c));
							 *(_t382 - 4) = _t426;
							 *_t382 = _t353;
							_t359 =  &(_t382[4]);
							_t415 = _t415 - 1;
							 *(_t432 + 0x20) = _t359;
							 *(_t432 + 0x6c) = _t415;
						} while (_t415 != 0);
						goto L13;
					}
					return E00A6D67E(__ecx,  *((intOrPtr*)(_t431 + 0x68)), _t415,  *((intOrPtr*)(_t431 + 0x68)));
				}
				return _t222;
			}

0x00a6d1c1
0x00a6d1c5
0x00a6d1c7
0x00a6d1cd
0x00a6d1d3
0x00a6d1da
0x00a6d1de
0x00a6d1f9
0x00a6d202
0x00a6d207
0x00a6d20c
0x00a6d663
0x00000000
0x00a6d673
0x00a6d212
0x00a6d21b
0x00a6d21f
0x00a6d223
0x00a6d225
0x00a6d229
0x00a6d22c
0x00a6d230
0x00a6d230
0x00a6d240
0x00a6d24d
0x00a6d252
0x00a6d278
0x00a6d27c
0x00a6d287
0x00a6d28e
0x00a6d292
0x00a6d299
0x00a6d2bf
0x00a6d2cb
0x00a6d2cf
0x00a6d2dd
0x00a6d2e8
0x00a6d2ff
0x00a6d30b
0x00a6d30f
0x00a6d326
0x00a6d33b
0x00a6d342
0x00a6d343
0x00a6d347
0x00a6d34e
0x00000000
0x00000000
0x00a6d354
0x00a6d35e
0x00a6d361
0x00a6d365
0x00a6d367
0x00a6d36b
0x00a6d370
0x00a6d373
0x00a6d377
0x00a6d37d
0x00a6d37f
0x00a6d383
0x00a6d392
0x00a6d3c2
0x00a6d3d3
0x00a6d3e5
0x00a6d401
0x00a6d40a
0x00a6d40e
0x00a6d447
0x00a6d44e
0x00a6d452
0x00a6d47f
0x00a6d486
0x00a6d486
0x00a6d48b
0x00a6d48b
0x00a6d495
0x00a6d499
0x00a6d49d
0x00a6d4a1
0x00a6d4a5
0x00a6d4a8
0x00a6d4ac
0x00a6d4b0
0x00a6d4ba
0x00a6d4c7
0x00a6d4d3
0x00a6d4da
0x00a6d4e4
0x00a6d4f0
0x00a6d4f4
0x00a6d4f8
0x00a6d502
0x00a6d50b
0x00a6d515
0x00a6d522
0x00a6d534
0x00a6d546
0x00a6d54f
0x00a6d555
0x00a6d565
0x00a6d57a
0x00a6d58f
0x00a6d59e
0x00a6d5ab
0x00a6d5b6
0x00a6d5bf
0x00a6d5cc
0x00a6d5d6
0x00a6d5e6
0x00a6d5e9
0x00a6d5ec
0x00a6d5f3
0x00a6d5f7
0x00a6d5f9
0x00a6d5fd
0x00a6d601
0x00a6d609
0x00a6d609
0x00a6d613
0x00a6d617
0x00a6d61e
0x00a6d624
0x00a6d62e
0x00a6d632
0x00a6d636
0x00a6d63a
0x00a6d641
0x00a6d644
0x00a6d648
0x00a6d64b
0x00a6d64d
0x00a6d650
0x00a6d653
0x00a6d657
0x00a6d657
0x00000000
0x00a6d662
0x00000000
0x00a6d1e9
0x00a6d67b

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1c15d153a4e68bd6e24d353543e1ad6ec3cadac80cd45420d37d359113fd6a9
Instruction ID: c626d7d4b5d97c678db2e75fb200be529c4930b8889376a88ff47f9d1fd5103f
Opcode Fuzzy Hash: f1c15d153a4e68bd6e24d353543e1ad6ec3cadac80cd45420d37d359113fd6a9
Instruction Fuzzy Hash: 0FE148746183948FC344CF69D89087ABBF0BB8A300F49496EF9D58B352C634E955DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A6DC24 Relevance: .3, Instructions: 292
COMMONCrypto

Download Yara Rule

C-Code - Quality: 83%

			E00A6DC24() {
				void* _t236;
				signed int _t247;
				signed int _t271;
				signed int _t272;
				signed int _t294;
				intOrPtr _t295;
				signed int _t305;
				signed int _t308;
				signed int _t312;
				signed int _t316;
				signed int _t317;
				signed int _t323;
				signed int _t326;
				signed int _t336;
				signed int _t347;
				signed int _t351;
				intOrPtr* _t357;
				intOrPtr _t358;
				signed int _t359;
				void* _t377;
				signed int _t386;
				signed int _t389;
				signed int _t391;
				signed int _t394;
				signed int _t399;
				signed int _t402;
				signed int _t405;
				signed int _t408;
				void* _t410;
				signed int* _t411;
				signed int _t412;
				signed int* _t413;
				intOrPtr _t414;
				void* _t416;
				void* _t417;

				if( *((char*)(_t416 + 0x28)) == 0) {
					_t412 =  *(_t416 + 0x34);
					 *(_t416 + 0x30) = _t412;
				} else {
					_t412 =  *(_t416 + 0x30);
					E00A7EE90(_t412,  *((intOrPtr*)(_t416 + 0x38)), 0x40);
					_t416 = _t416 + 0xc;
				}
				_t305 = 5;
				if( *0xaa1490 == 0) {
					_t358 = 0;
					_t411 = 0xaa0e54;
					do {
						_t6 = _t358 + 1; // 0x1
						 *((intOrPtr*)(_t411 - 4)) = _t358;
						asm("cdq");
						_t12 = _t358 + 2; // 0x2
						 *_t411 = _t6 % _t305;
						asm("cdq");
						_t17 = _t358 + 3; // 0x3
						_t411[1] = _t12 % _t305;
						asm("cdq");
						_t23 = _t358 + 4; // 0x4
						_t411[2] = _t17 % _t305;
						asm("cdq");
						_t411[3] = _t23 % _t305;
						_t411 =  &(_t411[5]);
						if(_t358 == 0) {
							_t358 = 4;
						} else {
							_t358 = _t358 - 1;
						}
					} while (_t411 < 0xaa1494);
					 *0xaa1490 = 1;
				}
				_t236 = memcpy(_t416 + 0x14,  *(_t416 + 0x2c), _t305 << 2);
				_t417 = _t416 + 0xc;
				_t326 = _t412;
				 *(_t417 + 0x38) = _t236;
				 *(_t417 + 0x34) = _t326;
				_t413 = 0xaa0e5c;
				do {
					_t35 = _t413 - 8; // 0x0
					asm("rol eax, 0x8");
					_t36 =  &(_t413[1]); // 0x0
					asm("ror ebx, 0x8");
					_t308 =  *_t326 & 0xff00ff00 |  *_t326 & 0x00ff00ff;
					 *_t326 = _t308;
					_t359 =  *(_t417 + 0x14 +  *_t413 * 4);
					_t40 = _t413 - 0xc; // 0x0
					_t44 = _t413 - 4; // 0x0
					_t413 =  &(_t413[5]);
					asm("rol ecx, 0x5");
					 *((intOrPtr*)(_t417 + 0x14 +  *_t36 * 4)) =  *((intOrPtr*)(_t417 + 0x14 +  *_t36 * 4)) + (( *(_t417 + 0x14 +  *_t44 * 4) ^ _t359) &  *(_t417 + 0x14 +  *_t35 * 4) ^ _t359) +  *((intOrPtr*)(_t417 + 0x14 +  *_t40 * 4)) + 0x5a827999 + _t308;
					_t326 =  *(_t417 + 0x34) + 4;
					asm("ror dword [esp+edi*4+0x14], 0x2");
					_t386 = 0xaa0f9c;
					 *(_t417 + 0x34) = _t326;
				} while (_t413 < 0xaa0f9c);
				_t414 =  *((intOrPtr*)(_t417 + 0x30));
				_t247 = 0x10;
				 *(_t417 + 0x10) = _t247;
				 *(_t417 + 0x34) = 0xaa0fec;
				do {
					_t62 = _t247 - 3; // 0xd
					_t360 = _t62;
					_t63 = _t360 - 5; // 0x8
					_t399 = _t247 & 0x0000000f;
					_t64 = _t360 + 5; // 0x12
					_t312 =  *(_t414 + (_t63 & 0x0000000f) * 4) ^  *(_t414 + (_t64 & 0x0000000f) * 4) ^  *(_t414 + (_t62 & 0x0000000f) * 4) ^  *(_t414 + _t399 * 4);
					_t73 = _t386 - 8; // 0x0
					asm("rol ebx, 1");
					 *(_t414 + _t399 * 4) = _t312;
					asm("rol ecx, 0x5");
					 *(_t417 + 0x14 +  *( *(_t417 + 0x38) + 4) * 4) =  *(_t417 + 0x14 +  *( *(_t417 + 0x38) + 4) * 4) + (( *(_t417 + 0x14 +  *( *(_t417 + 0x38) - 4) * 4) ^  *(_t417 + 0x14 +  *_t386 * 4)) &  *(_t417 + 0x14 +  *_t73 * 4) ^  *(_t417 + 0x14 +  *_t386 * 4)) +  *((intOrPtr*)(_t417 + 0x14 +  *( *(_t417 + 0x38) - 0xc) * 4)) + 0x5a827999 + _t312;
					asm("ror dword [esp+edi*4+0x14], 0x2");
					_t386 =  *(_t417 + 0x38) + 0x14;
					_t247 =  *(_t417 + 0x10) + 1;
					 *(_t417 + 0x38) = _t386;
					 *(_t417 + 0x10) = _t247;
				} while (_t386 < 0xaa0fec);
				_t336 = 0x14;
				 *(_t417 + 0x38) = _t336;
				do {
					_t104 = _t336 - 3; // 0x11
					_t363 = _t104;
					_t105 = _t363 - 5; // 0xc
					_t389 = 0xf;
					_t106 = _t363 + 5; // 0x16
					_t402 = _t336 & _t389;
					_t339 =  *(_t417 + 0x34);
					_t316 =  *(_t414 + (_t105 & _t389) * 4) ^  *(_t414 + (_t106 & _t389) * 4) ^  *(_t414 + (_t104 & _t389) * 4) ^  *(_t414 + _t402 * 4);
					asm("rol ebx, 1");
					_t116 = _t339 - 0xc; // 0x0
					_t117 = _t339 - 8; // 0x0
					 *(_t414 + _t402 * 4) = _t316;
					_t120 = _t339 + 4; // 0x0
					_t124 = _t339 - 4; // 0x0
					asm("rol edx, 0x5");
					 *((intOrPtr*)(_t417 + 0x14 +  *_t120 * 4)) =  *((intOrPtr*)(_t417 + 0x14 +  *_t120 * 4)) + ( *(_t417 + 0x14 +  *_t124 * 4) ^  *(_t417 + 0x14 +  *( *(_t417 + 0x34)) * 4) ^  *(_t417 + 0x14 +  *_t117 * 4)) + 0x6ed9eba1 +  *((intOrPtr*)(_t417 + 0x14 +  *_t116 * 4)) + _t316;
					asm("ror dword [esp+edi*4+0x14], 0x2");
					_t271 =  *(_t417 + 0x34) + 0x14;
					_t336 =  *(_t417 + 0x38) + 1;
					 *(_t417 + 0x34) = _t271;
					 *(_t417 + 0x38) = _t336;
				} while (_t271 < 0xaa117c);
				_t272 = 0x28;
				_t317 = 0xaa1178;
				 *(_t417 + 0x34) = _t272;
				 *(_t417 + 0x38) = 0xaa1178;
				do {
					_t146 = _t272 - 3; // 0x25
					_t367 = _t146;
					_t147 = _t367 - 5; // 0x20
					_t148 = _t367 + 5; // 0x2a
					_t391 = 0xf;
					_t405 = _t272 & _t391;
					_t347 =  *(_t414 + (_t147 & _t391) * 4) ^  *(_t414 + (_t148 & _t391) * 4) ^  *(_t414 + (_t146 & _t391) * 4) ^  *(_t414 + _t405 * 4);
					asm("rol ecx, 1");
					 *(_t414 + _t405 * 4) = _t347;
					_t159 = _t317 - 4; // 0x0
					_t163 = _t317 + 8; // 0x0
					 *(_t417 + 0x10) = _t347;
					asm("rol edx, 0x5");
					 *((intOrPtr*)(_t417 + 0x14 +  *_t163 * 4)) =  *((intOrPtr*)(_t417 + 0x14 +  *_t163 * 4)) + ( *(_t417 + 0x14 +  *( *(_t417 + 0x38) + 4) * 4) & ( *(_t417 + 0x14 +  *_t159 * 4) |  *(_t417 + 0x14 +  *_t317 * 4)) |  *(_t417 + 0x14 +  *_t159 * 4) &  *(_t417 + 0x14 +  *_t317 * 4)) +  *(_t417 + 0x14 +  *( *(_t417 + 0x38) - 8) * 4) + 0x8f1bbcdc +  *(_t417 + 0x10);
					asm("ror dword [esp+ebp*4+0x14], 0x2");
					_t317 =  *(_t417 + 0x38) + 0x14;
					_t414 =  *((intOrPtr*)(_t417 + 0x30));
					_t272 =  *(_t417 + 0x34) + 1;
					 *(_t417 + 0x34) = _t272;
					 *(_t417 + 0x38) = _t317;
				} while (_t317 < 0xaa1308);
				_t351 = 0x3c;
				 *(_t417 + 0x34) = _t351;
				 *(_t417 + 0x38) = 0xaa130c;
				do {
					_t191 = _t351 - 3; // 0x39
					_t372 = _t191;
					_t192 = _t372 - 5; // 0x34
					_t394 = 0xf;
					_t193 = _t372 + 5; // 0x3e
					_t408 = _t351 & _t394;
					_t354 =  *(_t417 + 0x38);
					_t323 =  *(_t414 + (_t192 & _t394) * 4) ^  *(_t414 + (_t193 & _t394) * 4) ^  *(_t414 + (_t191 & _t394) * 4) ^  *(_t414 + _t408 * 4);
					asm("rol ebx, 1");
					 *(_t414 + _t408 * 4) = _t323;
					asm("rol edx, 0x5");
					 *(_t417 + 0x14 +  *( *(_t417 + 0x38) + 4) * 4) =  *(_t417 + 0x14 +  *( *(_t417 + 0x38) + 4) * 4) + ( *(_t417 + 0x14 +  *( *(_t417 + 0x38) - 4) * 4) ^  *(_t417 + 0x14 +  *( *(_t417 + 0x38)) * 4) ^  *(_t417 + 0x14 +  *( *(_t417 + 0x38) - 8) * 4)) + 0xca62c1d6 +  *((intOrPtr*)(_t417 + 0x14 +  *(_t354 - 0xc) * 4)) + _t323;
					asm("ror dword [esp+edi*4+0x14], 0x2");
					_t294 =  *(_t417 + 0x38) + 0x14;
					_t351 =  *(_t417 + 0x34) + 1;
					 *(_t417 + 0x38) = _t294;
					 *(_t417 + 0x34) = _t351;
				} while (_t294 < 0xaa149c);
				_t357 =  *((intOrPtr*)(_t417 + 0x2c));
				_t377 = _t417 + 0x14 - _t357;
				_t410 = 5;
				do {
					_t295 =  *((intOrPtr*)(_t377 + _t357));
					 *_t357 =  *_t357 + _t295;
					_t357 = _t357 + 4;
					_t410 = _t410 - 1;
				} while (_t410 != 0);
				return _t295;
			}

0x00a6dc30
0x00a6dc47
0x00a6dc4b
0x00a6dc32
0x00a6dc32
0x00a6dc3d
0x00a6dc42
0x00a6dc42
0x00a6dc58
0x00a6dc59
0x00a6dc5b
0x00a6dc5d
0x00a6dc62
0x00a6dc62
0x00a6dc65
0x00a6dc68
0x00a6dc6b
0x00a6dc6e
0x00a6dc70
0x00a6dc73
0x00a6dc76
0x00a6dc79
0x00a6dc7c
0x00a6dc7f
0x00a6dc82
0x00a6dc85
0x00a6dc88
0x00a6dc8d
0x00a6dc94
0x00a6dc8f
0x00a6dc8f
0x00a6dc8f
0x00a6dc95
0x00a6dc9d
0x00a6dc9d
0x00a6dcb3
0x00a6dcb3
0x00a6dcb5
0x00a6dcb7
0x00a6dcbb
0x00a6dcbf
0x00a6dcc4
0x00a6dcc8
0x00a6dccb
0x00a6dcd3
0x00a6dcd6
0x00a6dcdf
0x00a6dce4
0x00a6dce6
0x00a6dcea
0x00a6dcf1
0x00a6dcf4
0x00a6dcf7
0x00a6dd14
0x00a6dd18
0x00a6dd1b
0x00a6dd20
0x00a6dd25
0x00a6dd29
0x00a6dd2d
0x00a6dd33
0x00a6dd34
0x00a6dd38
0x00a6dd40
0x00a6dd40
0x00a6dd40
0x00a6dd45
0x00a6dd48
0x00a6dd4e
0x00a6dd65
0x00a6dd69
0x00a6dd74
0x00a6dd76
0x00a6dd88
0x00a6dda4
0x00a6dda8
0x00a6ddb5
0x00a6ddb8
0x00a6ddb9
0x00a6ddbd
0x00a6ddc1
0x00a6ddcf
0x00a6ddd0
0x00a6ddd4
0x00a6ddd4
0x00a6ddd4
0x00a6ddd9
0x00a6ddde
0x00a6dde1
0x00a6dde8
0x00a6ddf2
0x00a6ddfa
0x00a6ddfe
0x00a6de00
0x00a6de03
0x00a6de06
0x00a6de0a
0x00a6de11
0x00a6de16
0x00a6de32
0x00a6de3a
0x00a6de3f
0x00a6de42
0x00a6de43
0x00a6de47
0x00a6de4b
0x00a6de54
0x00a6de55
0x00a6de5a
0x00a6de5e
0x00a6de62
0x00a6de62
0x00a6de62
0x00a6de67
0x00a6de6a
0x00a6de6f
0x00a6de76
0x00a6de84
0x00a6de8a
0x00a6de8c
0x00a6de90
0x00a6de97
0x00a6de9a
0x00a6deb2
0x00a6decd
0x00a6ded5
0x00a6deda
0x00a6dee1
0x00a6dee5
0x00a6dee6
0x00a6deea
0x00a6deee
0x00a6defc
0x00a6df02
0x00a6df06
0x00a6df0a
0x00a6df0a
0x00a6df0a
0x00a6df0f
0x00a6df14
0x00a6df17
0x00a6df1e
0x00a6df28
0x00a6df30
0x00a6df34
0x00a6df3c
0x00a6df4c
0x00a6df68
0x00a6df70
0x00a6df75
0x00a6df78
0x00a6df79
0x00a6df7d
0x00a6df81
0x00a6df88
0x00a6df92
0x00a6df94
0x00a6df95
0x00a6df95
0x00a6df98
0x00a6df9a
0x00a6df9d
0x00a6df9d
0x00a6dfa9

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 154252abd680b4d23138f9be6e80e8e33aef797c9d8d9961971fbdf5b38326a6
Instruction ID: 5082d21f592699ce492611730f4b514bfdd7c3e1c5700405914ffa130c6c2a2a
Opcode Fuzzy Hash: 154252abd680b4d23138f9be6e80e8e33aef797c9d8d9961971fbdf5b38326a6
Instruction Fuzzy Hash: 96C16676A053009FC704DF18E988A5AF7E1FFC8314FAA996DE9868B341D331E905CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00A7246B Relevance: .3, Instructions: 264
COMMONCrypto

Download Yara Rule

C-Code - Quality: 77%

			E00A7246B(void* __ecx, void* __edx) {
				void* __edi;
				signed int _t82;
				signed int _t88;
				signed int _t93;
				signed int _t94;
				signed int _t95;
				signed int _t98;
				signed int _t99;
				intOrPtr _t116;
				signed int _t127;
				void* _t135;
				signed int _t137;
				signed int _t138;
				signed int _t148;
				signed int _t150;
				void* _t152;
				signed int _t154;
				intOrPtr* _t155;
				intOrPtr* _t164;
				signed int _t167;
				void* _t168;
				signed int _t171;
				void* _t176;
				unsigned int _t178;
				signed int _t181;
				signed int _t182;
				intOrPtr* _t183;
				void* _t184;
				signed int _t186;
				signed int _t187;
				intOrPtr* _t188;
				signed int _t191;
				signed int _t197;
				void* _t200;

				_t176 = __edx;
				_t184 = __ecx;
				_t183 = __ecx + 4;
				if( *_t183 <=  *((intOrPtr*)(__ecx + 0x78)) - 0x19) {
					L2:
					E00A69E83(_t183,  ~( *(_t184 + 8)) & 0x00000007);
					_t82 = E00A69E9A(_t183);
					_t204 = _t82 & 0x00008000;
					if((_t82 & 0x00008000) == 0) {
						_t137 = 0;
						 *((intOrPtr*)(_t184 + 0xe654)) = 0;
						 *((intOrPtr*)(_t184 + 0x98c8)) = 0;
						 *((intOrPtr*)(_t184 + 0x98cc)) = 0;
						__eflags = _t82 & 0x00004000;
						if((_t82 & 0x00004000) == 0) {
							E00A7D1E0(_t183, _t184 + 0xe4c0, 0, 0x194);
							_t200 = _t200 + 0xc;
						}
						E00A69E83(_t183, 2);
						do {
							 *(_t200 + 0x14) = E00A69E9A(_t183) >> 0x0000000c & 0x000000ff;
							E00A69E83(_t183, 4);
							_t88 =  *(_t200 + 0x10);
							__eflags = _t88 - 0xf;
							if(_t88 != 0xf) {
								 *(_t200 + _t137 + 0x14) = _t88;
								goto L16;
							}
							_t186 = E00A69E9A(_t183) >> 0x0000000c & 0x000000ff;
							E00A69E83(_t183, 4);
							__eflags = _t186;
							if(_t186 != 0) {
								_t187 = _t186 + 2;
								while(1) {
									__eflags = _t187;
									if(_t187 <= 0) {
										break;
									}
									_t187 = _t187 - 1;
									__eflags = _t137 - 0x14;
									if(_t137 >= 0x14) {
										break;
									}
									 *(_t200 + _t137 + 0x14) = 0;
									_t137 = _t137 + 1;
									__eflags = _t137;
								}
								_t137 = _t137 - 1;
								goto L16;
							}
							 *(_t200 + _t137 + 0x14) = 0xf;
							L16:
							_t137 = _t137 + 1;
							__eflags = _t137 - 0x14;
						} while (_t137 < 0x14);
						_push(0x14);
						_t188 = _t184 + 0x3c44;
						_push(_t188);
						_push(_t200 + 0x1c);
						E00A71AD3();
						_t138 = 0;
						__eflags = 0;
						do {
							__eflags =  *_t183 -  *((intOrPtr*)(_t184 + 0x78)) - 5;
							if( *_t183 <=  *((intOrPtr*)(_t184 + 0x78)) - 5) {
								L20:
								_t93 = E00A69E9F(_t183);
								_t94 =  *(_t188 + 0x84);
								_t178 = _t93 & 0x0000fffe;
								__eflags = _t178 -  *((intOrPtr*)(_t188 + 4 + _t94 * 4));
								if(_t178 >=  *((intOrPtr*)(_t188 + 4 + _t94 * 4))) {
									_t148 = 0xf;
									_t95 = _t94 + 1;
									 *(_t200 + 0x10) = _t148;
									__eflags = _t95 - _t148;
									if(_t95 >= _t148) {
										L28:
										_t150 =  *(_t183 + 4) +  *(_t200 + 0x10);
										 *_t183 =  *_t183 + (_t150 >> 3);
										_t98 =  *(_t200 + 0x10);
										 *(_t183 + 4) = _t150 & 0x00000007;
										_t152 = 0x10;
										_t181 = (_t178 -  *((intOrPtr*)(_t188 + _t98 * 4)) >> _t152 - _t98) +  *((intOrPtr*)(_t188 + 0x44 + _t98 * 4));
										__eflags = _t181 -  *_t188;
										asm("sbb eax, eax");
										_t99 = _t98 & _t181;
										__eflags = _t99;
										_t154 =  *(_t188 + 0xc88 + _t99 * 2) & 0x0000ffff;
										L29:
										__eflags = _t154 - 0x10;
										if(_t154 >= 0x10) {
											__eflags = _t154 - 0x12;
											if(__eflags >= 0) {
												_t155 = _t183;
												if(__eflags != 0) {
													_t191 = (E00A69E9A(_t155) >> 9) + 0xb;
													__eflags = _t191;
													_push(7);
												} else {
													_t191 = (E00A69E9A(_t155) >> 0xd) + 3;
													_push(3);
												}
												E00A69E83(_t183);
												while(1) {
													__eflags = _t191;
													if(_t191 <= 0) {
														break;
													}
													_t191 = _t191 - 1;
													__eflags = _t138 - 0x194;
													if(_t138 >= 0x194) {
														goto L38;
													}
													 *(_t200 + _t138 + 0x28) = 0;
													_t138 = _t138 + 1;
												}
												L36:
												_t188 = _t184 + 0x3c44;
												goto L37;
											}
											__eflags = _t154 - 0x10;
											_t164 = _t183;
											if(_t154 != 0x10) {
												_t197 = (E00A69E9A(_t164) >> 9) + 0xb;
												__eflags = _t197;
												_push(7);
											} else {
												_t197 = (E00A69E9A(_t164) >> 0xd) + 3;
												_push(3);
											}
											E00A69E83(_t183);
											__eflags = _t138;
											if(_t138 > 0) {
												while(1) {
													__eflags = _t197;
													if(_t197 <= 0) {
														break;
													}
													_t197 = _t197 - 1;
													__eflags = _t138 - 0x194;
													if(_t138 >= 0x194) {
														goto L38;
													}
													 *(_t200 + _t138 + 0x28) =  *((intOrPtr*)(_t200 + _t138 + 0x27));
													_t138 = _t138 + 1;
													__eflags = _t138;
												}
											}
											goto L36;
										}
										 *(_t200 + _t138 + 0x28) =  *((intOrPtr*)(_t138 + _t184 + 0xe4c0)) + _t154 & 0x0000000f;
										_t138 = _t138 + 1;
										goto L37;
									}
									_t167 = 4 + _t95 * 4 + _t188;
									__eflags = _t167;
									while(1) {
										__eflags = _t178 -  *_t167;
										if(_t178 <  *_t167) {
											break;
										}
										_t95 = _t95 + 1;
										_t167 = _t167 + 4;
										__eflags = _t95 - 0xf;
										if(_t95 < 0xf) {
											continue;
										}
										goto L28;
									}
									 *(_t200 + 0x10) = _t95;
									goto L28;
								}
								_t168 = 0x10;
								_t182 = _t178 >> _t168 - _t94;
								_t171 = ( *(_t182 + _t188 + 0x88) & 0x000000ff) +  *(_t183 + 4);
								 *_t183 =  *_t183 + (_t171 >> 3);
								 *(_t183 + 4) = _t171 & 0x00000007;
								_t154 =  *(_t188 + 0x488 + _t182 * 2) & 0x0000ffff;
								goto L29;
							}
							_t127 = E00A730D0(_t184);
							__eflags = _t127;
							if(_t127 == 0) {
								L39:
								_t116 = 0;
								L52:
								return _t116;
							}
							goto L20;
							L37:
							__eflags = _t138 - 0x194;
						} while (_t138 < 0x194);
						L38:
						 *((char*)(_t184 + 0xe658)) = 1;
						__eflags =  *_t183 -  *((intOrPtr*)(_t184 + 0x78));
						if( *_t183 <=  *((intOrPtr*)(_t184 + 0x78))) {
							_push(0x12b);
							_push(_t184 + 0x94);
							_push(_t200 + 0x30);
							E00A71AD3();
							_push(0x3c);
							_push(_t184 + 0xf80);
							_push(_t200 + 0x15b);
							E00A71AD3();
							_push(0x11);
							_push(_t184 + 0x1e6c);
							_push(_t200 + 0x197);
							E00A71AD3();
							_push(0x1c);
							_push(_t184 + 0x2d58);
							_push(_t200 + 0x1a8);
							E00A71AD3();
							E00A7EE90(_t184 + 0xe4c0, _t200 + 0x2c, 0x194);
							_t116 = 1;
							goto L52;
						}
						goto L39;
					}
					 *((intOrPtr*)(_t184 + 0xe654)) = 1;
					_push(_t184 + 0xe4bc);
					_push(_t184);
					return E00A71219(_t176, _t204);
				}
				_t135 = E00A730D0(__ecx);
				if(_t135 != 0) {
					goto L2;
				}
				return _t135;
			}

0x00a7246b
0x00a72472
0x00a72478
0x00a72480
0x00a7248f
0x00a7249a
0x00a724a1
0x00a724a6
0x00a724ab
0x00a724d0
0x00a724d2
0x00a724d8
0x00a724de
0x00a724e4
0x00a724e9
0x00a724f8
0x00a724fd
0x00a724fd
0x00a72504
0x00a7250a
0x00a7251b
0x00a7251f
0x00a72524
0x00a72528
0x00a7252b
0x00a72566
0x00000000
0x00a72566
0x00a7253b
0x00a7253e
0x00a72543
0x00a72545
0x00a7254e
0x00a7255f
0x00a7255f
0x00a72561
0x00000000
0x00000000
0x00a72553
0x00a72554
0x00a72557
0x00000000
0x00000000
0x00a72559
0x00a7255e
0x00a7255e
0x00a7255e
0x00a72563
0x00000000
0x00a72563
0x00a72547
0x00a7256a
0x00a7256a
0x00a7256b
0x00a7256b
0x00a72570
0x00a72572
0x00a7257a
0x00a7257f
0x00a72580
0x00a72585
0x00a72585
0x00a72587
0x00a7258d
0x00a7258f
0x00a725a0
0x00a725a2
0x00a725a9
0x00a725af
0x00a725b5
0x00a725b9
0x00a725e6
0x00a725e7
0x00a725e8
0x00a725ec
0x00a725ee
0x00a7260c
0x00a7260f
0x00a7261b
0x00a7261d
0x00a72621
0x00a72626
0x00a7262f
0x00a72633
0x00a72636
0x00a72638
0x00a72638
0x00a7263a
0x00a72642
0x00a72642
0x00a72645
0x00a72659
0x00a7265c
0x00a726cf
0x00a726d1
0x00a726ee
0x00a726ee
0x00a726f1
0x00a726d3
0x00a726dd
0x00a726e0
0x00a726e0
0x00a726f5
0x00a726fa
0x00a726fa
0x00a726fc
0x00000000
0x00000000
0x00a726fe
0x00a726ff
0x00a72705
0x00000000
0x00000000
0x00a72707
0x00a7270c
0x00a7270c
0x00a72690
0x00a72690
0x00000000
0x00a72690
0x00a7265e
0x00a72661
0x00a72663
0x00a72680
0x00a72680
0x00a72683
0x00a72665
0x00a7266f
0x00a72672
0x00a72672
0x00a72687
0x00a7268c
0x00a7268e
0x00a726c9
0x00a726c9
0x00a726cb
0x00000000
0x00000000
0x00a726b7
0x00a726b8
0x00a726be
0x00000000
0x00000000
0x00a726c4
0x00a726c8
0x00a726c8
0x00a726c8
0x00a726cd
0x00000000
0x00a7268e
0x00a72652
0x00a72656
0x00000000
0x00a72656
0x00a725f7
0x00a725f7
0x00a725f9
0x00a725f9
0x00a725fb
0x00000000
0x00000000
0x00a725fd
0x00a725fe
0x00a72601
0x00a72604
0x00000000
0x00000000
0x00000000
0x00a72606
0x00a72608
0x00000000
0x00a72608
0x00a725bd
0x00a725c0
0x00a725ca
0x00a725d2
0x00a725d7
0x00a725da
0x00000000
0x00a725da
0x00a72593
0x00a72598
0x00a7259a
0x00a726b0
0x00a726b0
0x00a7278a
0x00000000
0x00a7278b
0x00000000
0x00a72696
0x00a72696
0x00a72696
0x00a726a2
0x00a726a4
0x00a726ab
0x00a726ae
0x00a7270f
0x00a7271c
0x00a72721
0x00a72722
0x00a72727
0x00a72731
0x00a72739
0x00a7273a
0x00a7273f
0x00a72749
0x00a72751
0x00a72752
0x00a72757
0x00a72761
0x00a72769
0x00a7276a
0x00a72780
0x00a72788
0x00000000
0x00a72788
0x00000000
0x00a726ae
0x00a724b3
0x00a724bd
0x00a724be
0x00000000
0x00a724c5
0x00a72482
0x00a72489
0x00000000
0x00000000
0x00a72794

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deb67c1c36161e11bcd3f47a836e4f3802cee9eb89df2e8024ca02dbd4d9c1c0
Instruction ID: 379b61da7da54436045883cc7f8cf1e778229adde44eaebfb42e21269191ddf5
Opcode Fuzzy Hash: deb67c1c36161e11bcd3f47a836e4f3802cee9eb89df2e8024ca02dbd4d9c1c0
Instruction Fuzzy Hash: 1C9158712007458BD724EF68DEA1BBF73E5EF90300F10C92EE59A87282EA79D544C752

Uniqueness

Uniqueness Score: -1.00%

Function 00A82168 Relevance: .2, Instructions: 237
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 86%

			E00A82168(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _t52;
				signed int _t54;
				signed int _t55;
				void* _t56;
				signed char _t60;
				signed char _t62;
				signed int _t64;
				void* _t65;
				signed int _t66;
				signed char _t75;
				signed char _t78;
				void* _t86;
				void* _t88;
				signed char _t90;
				signed char _t92;
				signed int _t93;
				signed int _t96;
				signed int _t98;
				signed int _t99;
				signed int _t103;
				signed int* _t104;
				void* _t106;
				signed int _t112;
				unsigned int _t114;
				signed char _t116;
				void* _t124;
				unsigned int _t125;
				void* _t126;
				signed int _t127;
				short _t128;
				void* _t131;
				void* _t133;
				void* _t135;
				signed int _t136;
				void* _t137;
				void* _t139;
				void* _t140;

				_t126 = __edi;
				_t52 =  *0xa991b8; // 0x3197ea2d
				_v8 = _t52 ^ _t136;
				_t135 = __ecx;
				_t103 = 0;
				_t124 = 0x41;
				_t54 =  *(__ecx + 0x32) & 0x0000ffff;
				_t106 = 0x58;
				_t139 = _t54 - 0x64;
				if(_t139 > 0) {
					__eflags = _t54 - 0x70;
					if(__eflags > 0) {
						_t55 = _t54 - 0x73;
						__eflags = _t55;
						if(_t55 == 0) {
							L9:
							_t56 = E00A828AF(_t135);
							L10:
							if(_t56 != 0) {
								__eflags =  *((intOrPtr*)(_t135 + 0x30)) - _t103;
								if( *((intOrPtr*)(_t135 + 0x30)) != _t103) {
									L71:
									L72:
									return E00A7CABF(_v8 ^ _t136);
								}
								_t125 =  *(_t135 + 0x20);
								_push(_t126);
								_v16 = _t103;
								_t60 = _t125 >> 4;
								_v12 = _t103;
								_t127 = 0x20;
								__eflags = 1 & _t60;
								if((1 & _t60) == 0) {
									L46:
									_t112 =  *(_t135 + 0x32) & 0x0000ffff;
									__eflags = _t112 - 0x78;
									if(_t112 == 0x78) {
										L48:
										_t62 = _t125 >> 5;
										__eflags = _t62 & 0x00000001;
										if((_t62 & 0x00000001) == 0) {
											L50:
											__eflags = 0;
											L51:
											__eflags = _t112 - 0x61;
											if(_t112 == 0x61) {
												L54:
												_t64 = 1;
												L55:
												_t128 = 0x30;
												__eflags = _t64;
												if(_t64 != 0) {
													L57:
													_t65 = 0x58;
													 *((short*)(_t136 + _t103 * 2 - 0xc)) = _t128;
													__eflags = _t112 - _t65;
													if(_t112 == _t65) {
														L60:
														_t66 = 1;
														L61:
														__eflags = _t66;
														asm("cbw");
														 *((short*)(_t136 + _t103 * 2 - 0xa)) = ((_t66 & 0xffffff00 | _t66 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x78;
														_t103 = _t103 + 2;
														__eflags = _t103;
														L62:
														_t131 =  *((intOrPtr*)(_t135 + 0x24)) -  *((intOrPtr*)(_t135 + 0x38)) - _t103;
														__eflags = _t125 & 0x0000000c;
														if((_t125 & 0x0000000c) == 0) {
															E00A81B38(_t135 + 0x448, 0x20, _t131, _t135 + 0x18);
															_t137 = _t137 + 0x10;
														}
														E00A82A33(_t135 + 0x448,  &_v16, _t103, _t135 + 0x18,  *((intOrPtr*)(_t135 + 0xc)));
														_t114 =  *(_t135 + 0x20);
														_t104 = _t135 + 0x18;
														_t75 = _t114 >> 3;
														__eflags = _t75 & 0x00000001;
														if((_t75 & 0x00000001) != 0) {
															_t116 = _t114 >> 2;
															__eflags = _t116 & 0x00000001;
															if((_t116 & 0x00000001) == 0) {
																E00A81B38(_t135 + 0x448, 0x30, _t131, _t104);
																_t137 = _t137 + 0x10;
															}
														}
														E00A829A8(_t135, 0);
														__eflags =  *_t104;
														if( *_t104 >= 0) {
															_t78 =  *(_t135 + 0x20) >> 2;
															__eflags = _t78 & 0x00000001;
															if((_t78 & 0x00000001) != 0) {
																E00A81B38(_t135 + 0x448, 0x20, _t131, _t104);
															}
														}
														goto L71;
													}
													_t86 = 0x41;
													__eflags = _t112 - _t86;
													if(_t112 == _t86) {
														goto L60;
													}
													_t66 = 0;
													goto L61;
												}
												__eflags = _t64;
												if(_t64 == 0) {
													goto L62;
												}
												goto L57;
											}
											_t133 = 0x41;
											__eflags = _t112 - _t133;
											if(_t112 == _t133) {
												goto L54;
											}
											_t64 = 0;
											goto L55;
										}
										goto L51;
									}
									_t88 = 0x58;
									__eflags = _t112 - _t88;
									if(_t112 != _t88) {
										goto L50;
									}
									goto L48;
								}
								_t90 = _t125 >> 6;
								__eflags = 1 & _t90;
								if((1 & _t90) == 0) {
									__eflags = 1 & _t125;
									if((1 & _t125) == 0) {
										_t92 = _t125 >> 1;
										__eflags = 1 & _t92;
										if((1 & _t92) == 0) {
											goto L46;
										}
										_v16 = _t127;
										L45:
										_t103 = 1;
										goto L46;
									}
									_push(0x2b);
									L40:
									_pop(_t93);
									_v16 = _t93;
									goto L45;
								}
								_push(0x2d);
								goto L40;
							}
							L11:
							goto L72;
						}
						_t96 = _t55;
						__eflags = _t96;
						if(__eflags == 0) {
							L28:
							_push(_t103);
							_push(0xa);
							L29:
							_t56 = E00A826BA(_t135, _t126, __eflags);
							goto L10;
						}
						__eflags = _t96 - 3;
						if(__eflags != 0) {
							goto L11;
						}
						_push(0);
						L13:
						_push(0x10);
						goto L29;
					}
					if(__eflags == 0) {
						_t56 = E00A82897(__ecx);
						goto L10;
					}
					__eflags = _t54 - 0x67;
					if(_t54 <= 0x67) {
						L30:
						_t56 = E00A824B0(_t103, _t135);
						goto L10;
					}
					__eflags = _t54 - 0x69;
					if(_t54 == 0x69) {
						L27:
						_t3 = _t135 + 0x20;
						 *_t3 =  *(_t135 + 0x20) | 0x00000010;
						__eflags =  *_t3;
						goto L28;
					}
					__eflags = _t54 - 0x6e;
					if(_t54 == 0x6e) {
						_t56 = E00A82804(__ecx, _t124);
						goto L10;
					}
					__eflags = _t54 - 0x6f;
					if(_t54 != 0x6f) {
						goto L11;
					}
					_t56 = E00A82878(__ecx);
					goto L10;
				}
				if(_t139 == 0) {
					goto L27;
				}
				_t140 = _t54 - _t106;
				if(_t140 > 0) {
					_t98 = _t54 - 0x5a;
					__eflags = _t98;
					if(_t98 == 0) {
						_t56 = E00A8244D(__ecx);
						goto L10;
					}
					_t99 = _t98 - 7;
					__eflags = _t99;
					if(_t99 == 0) {
						goto L30;
					}
					__eflags = _t99;
					if(__eflags != 0) {
						goto L11;
					}
					L17:
					_t56 = E00A82622(_t135, __eflags, _t103);
					goto L10;
				}
				if(_t140 == 0) {
					_push(1);
					goto L13;
				}
				if(_t54 == _t124) {
					goto L30;
				}
				if(_t54 == 0x43) {
					goto L17;
				}
				if(_t54 <= 0x44) {
					goto L11;
				}
				if(_t54 <= 0x47) {
					goto L30;
				}
				if(_t54 != 0x53) {
					goto L11;
				}
				goto L9;
			}

0x00a82168
0x00a82170
0x00a82177
0x00a8217c
0x00a8217e
0x00a82182
0x00a82185
0x00a82189
0x00a8218a
0x00a8218d
0x00a821fa
0x00a821fd
0x00a8224c
0x00a8224c
0x00a8224f
0x00a821bb
0x00a821bd
0x00a821c2
0x00a821c4
0x00a8226a
0x00a8226d
0x00a823b3
0x00a823b5
0x00a823c4
0x00a823c4
0x00a82273
0x00a82278
0x00a8227b
0x00a8227e
0x00a82282
0x00a82288
0x00a82289
0x00a8228b
0x00a822b5
0x00a822b5
0x00a822b9
0x00a822bc
0x00a822c6
0x00a822c8
0x00a822cb
0x00a822cd
0x00a822d3
0x00a822d3
0x00a822d5
0x00a822d5
0x00a822d8
0x00a822e6
0x00a822e6
0x00a822e8
0x00a822ea
0x00a822eb
0x00a822ed
0x00a822f3
0x00a822f5
0x00a822f6
0x00a822fb
0x00a822fe
0x00a8230c
0x00a8230c
0x00a8230e
0x00a8230e
0x00a82319
0x00a8231b
0x00a82320
0x00a82320
0x00a82323
0x00a82329
0x00a8232b
0x00a8232e
0x00a8233e
0x00a82343
0x00a82343
0x00a82358
0x00a8235d
0x00a82360
0x00a82365
0x00a82368
0x00a8236a
0x00a8236c
0x00a8236f
0x00a82372
0x00a8237f
0x00a82384
0x00a82384
0x00a82372
0x00a8238b
0x00a82390
0x00a82393
0x00a82398
0x00a8239b
0x00a8239d
0x00a823aa
0x00a823af
0x00a8239d
0x00000000
0x00a823b2
0x00a82302
0x00a82303
0x00a82306
0x00000000
0x00000000
0x00a82308
0x00000000
0x00a82308
0x00a822ef
0x00a822f1
0x00000000
0x00000000
0x00000000
0x00a822f1
0x00a822dc
0x00a822dd
0x00a822e0
0x00000000
0x00000000
0x00a822e2
0x00000000
0x00a822e2
0x00000000
0x00a822cf
0x00a822c0
0x00a822c1
0x00a822c4
0x00000000
0x00000000
0x00000000
0x00a822c4
0x00a8228f
0x00a82292
0x00a82294
0x00a8229f
0x00a822a1
0x00a822a9
0x00a822ab
0x00a822ad
0x00000000
0x00000000
0x00a822af
0x00a822b3
0x00a822b3
0x00000000
0x00a822b3
0x00a822a3
0x00a82298
0x00a82298
0x00a82299
0x00000000
0x00a82299
0x00a82296
0x00000000
0x00a82296
0x00a821ca
0x00000000
0x00a821ca
0x00a82256
0x00a82256
0x00a82259
0x00a8222b
0x00a8222b
0x00a8222c
0x00a8222e
0x00a82230
0x00000000
0x00a82230
0x00a8225b
0x00a8225e
0x00000000
0x00000000
0x00a82264
0x00a821d3
0x00a821d3
0x00000000
0x00a821d3
0x00a821ff
0x00a82242
0x00000000
0x00a82242
0x00a82201
0x00a82204
0x00a82237
0x00a82239
0x00000000
0x00a82239
0x00a82206
0x00a82209
0x00a82227
0x00a82227
0x00a82227
0x00a82227
0x00000000
0x00a82227
0x00a8220b
0x00a8220e
0x00a82220
0x00000000
0x00a82220
0x00a82210
0x00a82213
0x00000000
0x00000000
0x00a82217
0x00000000
0x00a82217
0x00a8218f
0x00000000
0x00000000
0x00a82195
0x00a82197
0x00a821d7
0x00a821d7
0x00a821da
0x00a821f3
0x00000000
0x00a821f3
0x00a821dc
0x00a821dc
0x00a821df
0x00000000
0x00000000
0x00a821e2
0x00a821e5
0x00000000
0x00000000
0x00a821e7
0x00a821ea
0x00000000
0x00a821ea
0x00a82199
0x00a821d1
0x00000000
0x00a821d1
0x00a8219d
0x00000000
0x00000000
0x00a821a6
0x00000000
0x00000000
0x00a821ab
0x00000000
0x00000000
0x00a821b0
0x00000000
0x00000000
0x00a821b9
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8aa07c003a6202942ebafc7c2c4dbe6cb2c9c4ca95361fdf0fcd77029a1cba0
Instruction ID: 5671a9b751cfa96b691e8e2cd6bf478e1b60f4f45b4e9a45c52aa89e18cb613a
Opcode Fuzzy Hash: a8aa07c003a6202942ebafc7c2c4dbe6cb2c9c4ca95361fdf0fcd77029a1cba0
Instruction Fuzzy Hash: 3061AB7170070867DF38BB288D69BFE73A9EB51300F240A1AE983DF281E615DD828765

Uniqueness

Uniqueness Score: -1.00%

Function 00A72795 Relevance: .2, Instructions: 232
COMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E00A72795(void* __ecx) {
				signed int _t70;
				signed int _t71;
				signed int _t72;
				signed int _t75;
				signed int _t76;
				signed int _t77;
				signed int _t82;
				signed int _t83;
				signed int _t110;
				signed int _t111;
				intOrPtr _t113;
				signed int _t114;
				signed int _t115;
				signed int _t121;
				signed int _t123;
				void* _t125;
				intOrPtr* _t127;
				intOrPtr* _t136;
				void* _t137;
				signed int _t140;
				unsigned int _t145;
				signed int _t148;
				signed int _t149;
				signed int _t151;
				intOrPtr* _t153;
				signed int _t156;
				signed int _t162;
				intOrPtr* _t166;
				void* _t168;
				void* _t169;

				_t168 = __ecx;
				if( *((char*)( *((intOrPtr*)(_t169 + 8)) + 0x11)) != 0) {
					_t166 =  *((intOrPtr*)(_t169 + 0x1d8));
					__eflags =  *((char*)(_t166 + 8));
					if( *((char*)(_t166 + 8)) != 0) {
						L5:
						_t151 = 0;
						__eflags = 0;
						do {
							_t110 = E00A69E9A(_t166) >> 0x0000000c & 0x000000ff;
							E00A69E83(_t166, 4);
							__eflags = _t110 - 0xf;
							if(_t110 != 0xf) {
								 *(_t169 + _t151 + 0x18) = _t110;
								goto L15;
							}
							_t114 = E00A69E9A(_t166) >> 0x0000000c & 0x000000ff;
							E00A69E83(_t166, 4);
							__eflags = _t114;
							if(_t114 != 0) {
								_t115 = _t114 + 2;
								while(1) {
									__eflags = _t115;
									if(_t115 <= 0) {
										break;
									}
									_t115 = _t115 - 1;
									__eflags = _t151 - 0x14;
									if(_t151 >= 0x14) {
										break;
									}
									 *(_t169 + _t151 + 0x18) = 0;
									_t151 = _t151 + 1;
									__eflags = _t151;
								}
								_t151 = _t151 - 1;
								goto L15;
							}
							 *(_t169 + _t151 + 0x18) = 0xf;
							L15:
							_t151 = _t151 + 1;
							__eflags = _t151 - 0x14;
						} while (_t151 < 0x14);
						_push(0x14);
						_t153 =  *((intOrPtr*)(_t169 + 0x1e8)) + 0x3bb0;
						_push(_t153);
						_push(_t169 + 0x18);
						 *((intOrPtr*)(_t169 + 0x1c)) = _t153;
						E00A71AD3();
						_t111 = 0;
						__eflags = 0;
						do {
							__eflags =  *((char*)(_t166 + 8));
							if( *((char*)(_t166 + 8)) != 0) {
								L20:
								_t70 = E00A69E9F(_t166);
								_t71 =  *(_t153 + 0x84);
								_t145 = _t70 & 0x0000fffe;
								__eflags = _t145 -  *((intOrPtr*)(_t153 + 4 + _t71 * 4));
								if(_t145 >=  *((intOrPtr*)(_t153 + 4 + _t71 * 4))) {
									_t121 = 0xf;
									_t72 = _t71 + 1;
									 *(_t169 + 0x14) = _t121;
									__eflags = _t72 - _t121;
									if(_t72 >= _t121) {
										L28:
										_t123 =  *(_t166 + 4) +  *(_t169 + 0x14);
										 *_t166 =  *_t166 + (_t123 >> 3);
										_t75 =  *(_t169 + 0x14);
										 *(_t166 + 4) = _t123 & 0x00000007;
										_t125 = 0x10;
										_t148 = (_t145 -  *((intOrPtr*)(_t153 + _t75 * 4)) >> _t125 - _t75) +  *((intOrPtr*)(_t153 + 0x44 + _t75 * 4));
										__eflags = _t148 -  *_t153;
										asm("sbb eax, eax");
										_t76 = _t75 & _t148;
										__eflags = _t76;
										_t77 =  *(_t153 + 0xc88 + _t76 * 2) & 0x0000ffff;
										L29:
										__eflags = _t77 - 0x10;
										if(_t77 >= 0x10) {
											_t127 = _t166;
											__eflags = _t77 - 0x12;
											if(__eflags >= 0) {
												if(__eflags != 0) {
													_t156 = (E00A69E9A(_t127) >> 9) + 0xb;
													__eflags = _t156;
													_push(7);
												} else {
													_t156 = (E00A69E9A(_t127) >> 0xd) + 3;
													_push(3);
												}
												E00A69E83(_t166);
												while(1) {
													__eflags = _t156;
													if(_t156 <= 0) {
														break;
													}
													_t156 = _t156 - 1;
													__eflags = _t111 - 0x1ae;
													if(_t111 >= 0x1ae) {
														goto L38;
													}
													 *(_t169 + _t111 + 0x2c) = 0;
													_t111 = _t111 + 1;
												}
												L36:
												_t153 =  *((intOrPtr*)(_t169 + 0x10));
												goto L37;
											}
											__eflags = _t77 - 0x10;
											if(_t77 != 0x10) {
												_t162 = (E00A69E9A(_t127) >> 9) + 0xb;
												__eflags = _t162;
												_push(7);
											} else {
												_t162 = (E00A69E9A(_t127) >> 0xd) + 3;
												_push(3);
											}
											E00A69E83(_t166);
											__eflags = _t111;
											if(_t111 > 0) {
												while(1) {
													__eflags = _t162;
													if(_t162 <= 0) {
														break;
													}
													_t162 = _t162 - 1;
													__eflags = _t111 - 0x1ae;
													if(_t111 >= 0x1ae) {
														goto L38;
													}
													 *(_t169 + _t111 + 0x2c) =  *((intOrPtr*)(_t169 + _t111 + 0x2b));
													_t111 = _t111 + 1;
													__eflags = _t111;
												}
											}
											goto L36;
										}
										 *(_t169 + _t111 + 0x2c) = _t77;
										_t111 = _t111 + 1;
										goto L37;
									}
									_t136 = _t153 + (_t72 + 1) * 4;
									while(1) {
										__eflags = _t145 -  *_t136;
										if(_t145 <  *_t136) {
											break;
										}
										_t72 = _t72 + 1;
										_t136 = _t136 + 4;
										__eflags = _t72 - 0xf;
										if(_t72 < 0xf) {
											continue;
										}
										goto L28;
									}
									 *(_t169 + 0x14) = _t72;
									goto L28;
								}
								_t137 = 0x10;
								_t149 = _t145 >> _t137 - _t71;
								_t140 = ( *(_t149 + _t153 + 0x88) & 0x000000ff) +  *(_t166 + 4);
								 *_t166 =  *_t166 + (_t140 >> 3);
								 *(_t166 + 4) = _t140 & 0x00000007;
								_t77 =  *(_t153 + 0x488 + _t149 * 2) & 0x0000ffff;
								goto L29;
							}
							__eflags =  *_t166 -  *((intOrPtr*)(_t168 + 0x78)) - 5;
							if( *_t166 <=  *((intOrPtr*)(_t168 + 0x78)) - 5) {
								goto L20;
							}
							_t82 = E00A7314C(_t168);
							__eflags = _t82;
							if(_t82 == 0) {
								L40:
								_t83 = 0;
								L53:
								L54:
								return _t83;
							}
							goto L20;
							L37:
							__eflags = _t111 - 0x1ae;
						} while (_t111 < 0x1ae);
						L38:
						__eflags =  *((char*)(_t166 + 8));
						if( *((char*)(_t166 + 8)) != 0) {
							L52:
							_t113 =  *((intOrPtr*)(_t169 + 0x1e8));
							_push(0x132);
							_push(_t113);
							_push(_t169 + 0x2c);
							E00A71AD3();
							_push(0x40);
							_push(_t113 + 0xeec);
							_push(_t169 + 0x166);
							E00A71AD3();
							_push(0x10);
							_push(_t113 + 0x1dd8);
							_push(_t169 + 0x1a6);
							E00A71AD3();
							_push(0x2c);
							_push(_t113 + 0x2cc4);
							_push(_t169 + 0x1b6);
							E00A71AD3();
							_t83 = 1;
							goto L53;
						}
						__eflags =  *_t166 -  *((intOrPtr*)(_t168 + 0x78));
						if( *_t166 <=  *((intOrPtr*)(_t168 + 0x78))) {
							goto L52;
						}
						goto L40;
					}
					__eflags =  *_t166 -  *((intOrPtr*)(__ecx + 0x78)) - 0x19;
					if( *_t166 <=  *((intOrPtr*)(__ecx + 0x78)) - 0x19) {
						goto L5;
					}
					_t83 = E00A7314C(__ecx);
					__eflags = _t83;
					if(_t83 == 0) {
						goto L54;
					}
					goto L5;
				}
				return 1;
			}

0x00a727a4
0x00a727a6
0x00a727b0
0x00a727b7
0x00a727bb
0x00a727d4
0x00a727d5
0x00a727d5
0x00a727d8
0x00a727e6
0x00a727e9
0x00a727ee
0x00a727f1
0x00a7282c
0x00000000
0x00a7282c
0x00a72801
0x00a72804
0x00a72809
0x00a7280b
0x00a72814
0x00a72825
0x00a72825
0x00a72827
0x00000000
0x00000000
0x00a72819
0x00a7281a
0x00a7281d
0x00000000
0x00000000
0x00a7281f
0x00a72824
0x00a72824
0x00a72824
0x00a72829
0x00000000
0x00a72829
0x00a7280d
0x00a72830
0x00a72830
0x00a72831
0x00a72831
0x00a72841
0x00a72843
0x00a7284b
0x00a7284c
0x00a7284d
0x00a72851
0x00a72856
0x00a72856
0x00a72858
0x00a72858
0x00a7285c
0x00a72877
0x00a72879
0x00a72880
0x00a72886
0x00a7288c
0x00a72890
0x00a728bd
0x00a728be
0x00a728bf
0x00a728c3
0x00a728c5
0x00a728e0
0x00a728e3
0x00a728ef
0x00a728f1
0x00a728f5
0x00a728fa
0x00a72902
0x00a72906
0x00a72908
0x00a7290a
0x00a7290a
0x00a7290c
0x00a72914
0x00a72914
0x00a72917
0x00a72920
0x00a72922
0x00a72925
0x00a72993
0x00a729b0
0x00a729b0
0x00a729b3
0x00a72995
0x00a7299f
0x00a729a2
0x00a729a2
0x00a729b7
0x00a729bc
0x00a729bc
0x00a729be
0x00000000
0x00000000
0x00a729c0
0x00a729c1
0x00a729c7
0x00000000
0x00000000
0x00a729c9
0x00a729ce
0x00a729ce
0x00a72957
0x00a72957
0x00000000
0x00a72957
0x00a72927
0x00a7292a
0x00a72947
0x00a72947
0x00a7294a
0x00a7292c
0x00a72936
0x00a72939
0x00a72939
0x00a7294e
0x00a72953
0x00a72955
0x00a7298d
0x00a7298d
0x00a7298f
0x00000000
0x00000000
0x00a7297b
0x00a7297c
0x00a72982
0x00000000
0x00000000
0x00a72988
0x00a7298c
0x00a7298c
0x00a7298c
0x00a72991
0x00000000
0x00a72955
0x00a72919
0x00a7291d
0x00000000
0x00a7291d
0x00a728ca
0x00a728cd
0x00a728cd
0x00a728cf
0x00000000
0x00000000
0x00a728d1
0x00a728d2
0x00a728d5
0x00a728d8
0x00000000
0x00000000
0x00000000
0x00a728da
0x00a728dc
0x00000000
0x00a728dc
0x00a72894
0x00a72897
0x00a728a1
0x00a728a9
0x00a728ae
0x00a728b1
0x00000000
0x00a728b1
0x00a72864
0x00a72866
0x00000000
0x00000000
0x00a7286a
0x00a7286f
0x00a72871
0x00a72974
0x00a72974
0x00a72a34
0x00a72a36
0x00000000
0x00a72a36
0x00000000
0x00a7295b
0x00a7295b
0x00a7295b
0x00a72967
0x00a72967
0x00a7296b
0x00a729d1
0x00a729d1
0x00a729dc
0x00a729e1
0x00a729e2
0x00a729e5
0x00a729ea
0x00a729f4
0x00a729fc
0x00a729fd
0x00a72a02
0x00a72a0c
0x00a72a14
0x00a72a15
0x00a72a1a
0x00a72a24
0x00a72a2c
0x00a72a2d
0x00a72a32
0x00000000
0x00a72a32
0x00a7296f
0x00a72972
0x00000000
0x00000000
0x00000000
0x00a72972
0x00a727c3
0x00a727c5
0x00000000
0x00000000
0x00a727c7
0x00a727cc
0x00a727ce
0x00000000
0x00000000
0x00000000
0x00a727ce
0x00000000

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2159eab0ef01fe9ebe9e691002bc0bb4939235ccb6eb8f09a76cbd4cd62e086a
Instruction ID: 29c48ee4f3a46c9a893370846ba5dbfccda1cee8bf6c71ebcd0c4617f94ce1c3
Opcode Fuzzy Hash: 2159eab0ef01fe9ebe9e691002bc0bb4939235ccb6eb8f09a76cbd4cd62e086a
Instruction Fuzzy Hash: 337166716047419BDB24DF29CD80BBE73E5EBD1304F24C92DE98D87282CA31D985C792

Uniqueness

Uniqueness Score: -1.00%

Function 00A6E2E1 Relevance: .2, Instructions: 201
COMMONCrypto

Download Yara Rule

C-Code - Quality: 84%

			E00A6E2E1() {
				intOrPtr _t145;
				signed int _t148;
				signed int _t168;
				unsigned int* _t174;
				signed int _t175;
				unsigned int _t178;
				signed int _t191;
				unsigned int _t196;
				intOrPtr _t198;
				void* _t202;
				signed int* _t204;
				signed int _t205;
				intOrPtr* _t206;
				void* _t220;
				void* _t223;
				signed int _t224;
				void* _t226;
				void* _t227;

				_t204 =  *(_t226 + 0x148);
				if(_t204 != 0) {
					 *((intOrPtr*)(_t226 + 0x34)) = E00A82CE8( *(_t204[0xa]));
					 *((intOrPtr*)(_t226 + 0x3c)) = E00A82CE8( *((intOrPtr*)(_t204[0xa] + 4)));
					 *((intOrPtr*)(_t226 + 0x44)) = E00A82CE8( *((intOrPtr*)(_t204[0xa] + 8)));
					 *((intOrPtr*)(_t226 + 0x4c)) = E00A82CE8( *((intOrPtr*)(_t204[0xa] + 0xc)));
					 *((intOrPtr*)(_t226 + 0x54)) = E00A82CE8( *((intOrPtr*)(_t204[0xa] + 0x10)));
					 *((intOrPtr*)(_t226 + 0x5c)) = E00A82CE8( *((intOrPtr*)(_t204[0xa] + 0x14)));
					 *((intOrPtr*)(_t226 + 0x64)) = E00A82CE8( *((intOrPtr*)(_t204[0xa] + 0x18)));
					 *((intOrPtr*)(_t226 + 0x6c)) = E00A82CE8( *((intOrPtr*)(_t204[0xa] + 0x1c)));
					 *((intOrPtr*)(_t226 + 0x74)) = E00A82CE8( *((intOrPtr*)(_t204[0xa] + 0x20)));
					 *((intOrPtr*)(_t226 + 0x7c)) = E00A82CE8( *((intOrPtr*)(_t204[0xa] + 0x24)));
					 *((intOrPtr*)(_t226 + 0x84)) = E00A82CE8( *((intOrPtr*)(_t204[0xa] + 0x28)));
					 *((intOrPtr*)(_t226 + 0x8c)) = E00A82CE8( *((intOrPtr*)(_t204[0xa] + 0x2c)));
					_t223 = 0x30;
					 *((intOrPtr*)(_t226 + 0x94)) = E00A82CE8( *((intOrPtr*)(_t204[0xa] + _t223)));
					 *((intOrPtr*)(_t226 + 0x9c)) = E00A82CE8( *((intOrPtr*)(_t204[0xa] + 0x34)));
					 *((intOrPtr*)(_t226 + 0xa4)) = E00A82CE8( *((intOrPtr*)(_t204[0xa] + 0x38)));
					_t145 = E00A82CE8( *((intOrPtr*)(_t204[0xa] + 0x3c)));
					_t227 = _t226 + 0x40;
					 *((intOrPtr*)(_t227 + 0x6c)) = _t145;
					_t174 = _t227 + 0x68;
					do {
						_t178 =  *(_t174 - 0x34);
						_t196 =  *_t174;
						asm("rol esi, 0xe");
						_t174 =  &(_t174[1]);
						asm("ror eax, 0x7");
						asm("rol eax, 0xd");
						asm("rol ecx, 0xf");
						_t174[1] = (_t178 ^ _t178 ^ _t178 >> 0x00000003) + (_t196 ^ _t196 ^ _t196 >> 0x0000000a) +  *((intOrPtr*)(_t174 - 0x3c)) +  *((intOrPtr*)(_t174 - 0x18));
						_t223 = _t223 - 1;
					} while (_t223 != 0);
					_t148 =  *_t204;
					_t198 = 0;
					_t175 = _t204[4];
					_t224 = _t148;
					 *(_t227 + 0x2c) = _t148;
					 *(_t227 + 0x1c) = _t204[1];
					 *(_t227 + 0x18) = _t204[2];
					 *(_t227 + 0x20) = _t204[3];
					 *(_t227 + 0x10) = _t204[5];
					 *(_t227 + 0x14) = _t204[6];
					_t205 =  *(_t227 + 0x1c);
					 *(_t227 + 0x24) = _t204[7];
					 *((intOrPtr*)(_t227 + 0x28)) = 0;
					do {
						asm("rol eax, 0x7");
						asm("ror esi, 0xb");
						asm("ror eax, 0x6");
						_t76 = _t198 + 0xa8f690; // 0x428a2f98
						_t220 = (_t175 ^ _t175 ^ _t175) + ( !_t175 &  *(_t227 + 0x14) ^  *(_t227 + 0x10) & _t175) +  *_t76 +  *((intOrPtr*)(_t227 + _t198 + 0x30)) +  *(_t227 + 0x24);
						 *(_t227 + 0x24) =  *(_t227 + 0x14);
						 *(_t227 + 0x14) =  *(_t227 + 0x10);
						asm("rol eax, 0xa");
						asm("ror edx, 0xd");
						 *(_t227 + 0x10) = _t175;
						asm("ror eax, 0x2");
						_t175 =  *(_t227 + 0x20) + _t220;
						_t202 = (_t224 ^ _t224 ^ _t224) + (( *(_t227 + 0x18) ^ _t205) & _t224 ^  *(_t227 + 0x18) & _t205);
						 *(_t227 + 0x20) =  *(_t227 + 0x18);
						_t191 = _t205;
						_t205 = _t224;
						 *(_t227 + 0x18) = _t191;
						_t224 = _t202 + _t220;
						_t198 =  *((intOrPtr*)(_t227 + 0x28)) + 4;
						 *((intOrPtr*)(_t227 + 0x28)) = _t198;
					} while (_t198 < 0x100);
					 *(_t227 + 0x1c) = _t205;
					_t206 =  *((intOrPtr*)(_t227 + 0x154));
					 *((intOrPtr*)(_t206 + 8)) =  *((intOrPtr*)(_t206 + 8)) + _t191;
					 *((intOrPtr*)(_t206 + 0xc)) =  *((intOrPtr*)(_t206 + 0xc)) +  *(_t227 + 0x18);
					 *((intOrPtr*)(_t206 + 0x14)) =  *((intOrPtr*)(_t206 + 0x14)) +  *((intOrPtr*)(_t227 + 8));
					 *((intOrPtr*)(_t206 + 0x18)) =  *((intOrPtr*)(_t206 + 0x18)) +  *((intOrPtr*)(_t227 + 0xc));
					 *((intOrPtr*)(_t206 + 0x10)) =  *((intOrPtr*)(_t206 + 0x10)) + _t175;
					 *_t206 =  *(_t227 + 0x2c) + _t224;
					_t168 =  *(_t227 + 0x14);
					 *((intOrPtr*)(_t206 + 4)) =  *((intOrPtr*)(_t206 + 4)) + _t168;
					 *((intOrPtr*)(_t206 + 0x1c)) =  *((intOrPtr*)(_t206 + 0x1c)) +  *(_t227 + 0x1c);
					return _t168;
				}
				E00A6DC0C(_t226 + 0x128, 0x20);
				return E00A6DC0C(_t226 + 0x28, 0x100);
			}

0x00a6e2e8
0x00a6e2f1
0x00a6e323
0x00a6e332
0x00a6e341
0x00a6e350
0x00a6e35f
0x00a6e36e
0x00a6e37d
0x00a6e38c
0x00a6e39b
0x00a6e3aa
0x00a6e3b9
0x00a6e3cb
0x00a6e3d7
0x00a6e3e0
0x00a6e3f2
0x00a6e404
0x00a6e411
0x00a6e416
0x00a6e419
0x00a6e41d
0x00a6e421
0x00a6e421
0x00a6e426
0x00a6e42a
0x00a6e42d
0x00a6e430
0x00a6e43e
0x00a6e441
0x00a6e453
0x00a6e456
0x00a6e456
0x00a6e45b
0x00a6e45d
0x00a6e45f
0x00a6e462
0x00a6e464
0x00a6e46b
0x00a6e472
0x00a6e479
0x00a6e480
0x00a6e487
0x00a6e48e
0x00a6e492
0x00a6e496
0x00a6e49a
0x00a6e49e
0x00a6e4a3
0x00a6e4b0
0x00a6e4c3
0x00a6e4cf
0x00a6e4d3
0x00a6e4db
0x00a6e4e1
0x00a6e4e4
0x00a6e4e9
0x00a6e4f3
0x00a6e4f6
0x00a6e50c
0x00a6e50e
0x00a6e512
0x00a6e514
0x00a6e516
0x00a6e51a
0x00a6e521
0x00a6e524
0x00a6e528
0x00a6e538
0x00a6e53e
0x00a6e547
0x00a6e54e
0x00a6e555
0x00a6e55c
0x00a6e55f
0x00a6e566
0x00a6e568
0x00a6e56c
0x00a6e56f
0x00000000
0x00a6e572
0x00a6e2fd
0x00000000

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55655d10b96700e9c754b66dccb56260d7de3601bf130b1e27c96aeb1372b419
Instruction ID: c4f7f04647008b860ddb05389786489f4c4ff357b30f7325d3aaca69c7e907d2
Opcode Fuzzy Hash: 55655d10b96700e9c754b66dccb56260d7de3601bf130b1e27c96aeb1372b419
Instruction Fuzzy Hash: 3B81E3B5A047019FD754EF2AC981A5AFBE1BF88310F458A2DF588D7621D731E864CF82

Uniqueness

Uniqueness Score: -1.00%

Function 00A6D7BA Relevance: .2, Instructions: 154
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00A6D7BA(intOrPtr __ecx, signed char _a4) {
				char _v12;
				signed int _v13;
				signed int _v14;
				signed int _v15;
				signed int _v16;
				signed char _v17;
				signed char _v18;
				signed char _v19;
				signed char _v20;
				char _v28;
				signed int _v29;
				signed int _v30;
				signed int _v31;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				signed char _t96;
				signed int _t117;
				signed int* _t121;
				signed int* _t122;
				void* _t124;
				signed int _t125;
				signed int _t126;
				signed int _t127;
				void* _t129;
				void* _t130;
				signed int _t131;
				char* _t132;
				void* _t133;
				signed int _t135;
				intOrPtr _t137;
				signed char* _t139;
				void* _t141;
				void* _t161;
				void* _t164;

				_t137 = __ecx;
				_t135 = _a4 - 6;
				_v40 = __ecx;
				_v36 = _t135;
				_t96 = E00A7EE90( &_v32, _a4, 0x20);
				_t141 =  &_v40 + 0xc;
				_t117 = 0;
				_t133 = 0;
				_t126 = 0;
				if(_t135 <= 0) {
					L10:
					if(_t117 <= _a4) {
						_t127 = 0xa9de20;
						do {
							_v32 = _v32 ^  *(( *(_t141 + 0x15 + _t135 * 4) & 0x000000ff) + 0xa9dc20);
							_v31 = _v31 ^  *(( *(_t141 + 0x16 + _t135 * 4) & 0x000000ff) + 0xa9dc20);
							_v30 = _v30 ^  *(( *(_t141 + 0x17 + _t135 * 4) & 0x000000ff) + 0xa9dc20);
							_v29 = _v29 ^  *(( *(_t141 + 0x14 + _t135 * 4) & 0x000000ff) + 0xa9dc20);
							_t96 =  *_t127;
							_v32 = _v32 ^ _t96;
							_v36 = _t127 + 1;
							if(_t135 == 8) {
								_t121 =  &_v28;
								_a4 = 3;
								do {
									_t129 = 4;
									do {
										 *_t121 =  *_t121 ^  *(_t121 - 4);
										_t121 =  &(_t121[0]);
										_t129 = _t129 - 1;
									} while (_t129 != 0);
									_t58 =  &_a4;
									 *_t58 = _a4 - 1;
								} while ( *_t58 != 0);
								_t122 =  &_v12;
								_a4 = 3;
								_v16 = _v16 ^  *((_v20 & 0x000000ff) + 0xa9dc20);
								_v15 = _v15 ^  *((_v19 & 0x000000ff) + 0xa9dc20);
								_v14 = _v14 ^  *((_v18 & 0x000000ff) + 0xa9dc20);
								_v13 = _v13 ^  *((_v17 & 0x000000ff) + 0xa9dc20);
								do {
									_t130 = 4;
									do {
										_t96 =  *((intOrPtr*)(_t122 - 4));
										 *_t122 =  *_t122 ^ _t96;
										_t122 =  &(_t122[0]);
										_t130 = _t130 - 1;
									} while (_t130 != 0);
									_t79 =  &_a4;
									 *_t79 = _a4 - 1;
								} while ( *_t79 != 0);
							} else {
								if(_t135 > 1) {
									_t132 =  &_v28;
									_a4 = _t135 - 1;
									do {
										_t124 = 0;
										do {
											_t96 =  *((intOrPtr*)(_t132 + _t124 - 4));
											 *(_t132 + _t124) =  *(_t132 + _t124) ^ _t96;
											_t124 = _t124 + 1;
										} while (_t124 < 4);
										_t132 = _t132 + 4;
										_t53 =  &_a4;
										 *_t53 = _a4 - 1;
									} while ( *_t53 != 0);
								}
							}
							_t131 = 0;
							if(_t135 <= 0) {
								L37:
								_t164 = _t117 - _a4;
							} else {
								while(_t117 <= _a4) {
									if(_t131 >= _t135) {
										L33:
										_t161 = _t133 - 4;
									} else {
										_t96 =  &(( &_v32)[_t131]);
										_a4 = _t96;
										while(_t133 < 4) {
											 *((intOrPtr*)(_t137 + 0x18 + (_t133 + _t117 * 4) * 4)) =  *_t96;
											_t131 = _t131 + 1;
											_t96 = _a4 + 4;
											_t133 = _t133 + 1;
											_a4 = _t96;
											if(_t131 < _t135) {
												continue;
											} else {
												goto L33;
											}
											goto L34;
										}
									}
									L34:
									if(_t161 == 0) {
										_t117 = _t117 + 1;
										_t133 = 0;
									}
									if(_t131 < _t135) {
										continue;
									} else {
										goto L37;
									}
									goto L38;
								}
							}
							L38:
							_t127 = _v36;
						} while (_t164 <= 0);
					}
				} else {
					while(_t117 <= _a4) {
						if(_t126 < _t135) {
							_t139 =  &(( &_v32)[_t126]);
							while(_t133 < 4) {
								_t125 = _t133 + _t117 * 4;
								_t96 =  *_t139;
								_t126 = _t126 + 1;
								_t139 =  &_a4;
								_t133 = _t133 + 1;
								 *(_v40 + 0x18 + _t125 * 4) = _t96;
								_t135 = _v36;
								if(_t126 < _t135) {
									continue;
								}
								break;
							}
							_t137 = _v40;
						}
						if(_t133 == 4) {
							_t117 = _t117 + 1;
							_t133 = 0;
						}
						if(_t126 < _t135) {
							continue;
						} else {
							goto L10;
						}
						goto L39;
					}
				}
				L39:
				return _t96;
			}

0x00a6d7c0
0x00a6d7d0
0x00a6d7d3
0x00a6d7d8
0x00a6d7dc
0x00a6d7e1
0x00a6d7e4
0x00a6d7e6
0x00a6d7e8
0x00a6d7ec
0x00a6d833
0x00a6d836
0x00a6d83c
0x00a6d841
0x00a6d850
0x00a6d85f
0x00a6d86e
0x00a6d87d
0x00a6d881
0x00a6d883
0x00a6d888
0x00a6d88f
0x00a6d8c0
0x00a6d8c4
0x00a6d8cc
0x00a6d8ce
0x00a6d8cf
0x00a6d8d2
0x00a6d8d4
0x00a6d8d5
0x00a6d8d5
0x00a6d8da
0x00a6d8da
0x00a6d8da
0x00a6d8e6
0x00a6d8ea
0x00a6d8f8
0x00a6d907
0x00a6d916
0x00a6d925
0x00a6d929
0x00a6d92b
0x00a6d92c
0x00a6d92c
0x00a6d92f
0x00a6d931
0x00a6d932
0x00a6d932
0x00a6d937
0x00a6d937
0x00a6d937
0x00a6d891
0x00a6d894
0x00a6d89d
0x00a6d8a1
0x00a6d8a5
0x00a6d8a5
0x00a6d8a7
0x00a6d8a7
0x00a6d8ab
0x00a6d8ae
0x00a6d8af
0x00a6d8b4
0x00a6d8b7
0x00a6d8b7
0x00a6d8b7
0x00a6d8be
0x00a6d894
0x00a6d93e
0x00a6d942
0x00a6d983
0x00a6d983
0x00000000
0x00a6d944
0x00a6d94b
0x00a6d977
0x00a6d977
0x00a6d94d
0x00a6d951
0x00a6d954
0x00a6d958
0x00a6d962
0x00a6d966
0x00a6d96b
0x00a6d96e
0x00a6d96f
0x00a6d975
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00a6d975
0x00a6d958
0x00a6d97a
0x00a6d97a
0x00a6d97c
0x00a6d97d
0x00a6d97d
0x00a6d981
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00a6d981
0x00a6d944
0x00a6d986
0x00a6d986
0x00a6d986
0x00a6d841
0x00000000
0x00a6d7ee
0x00a6d7f9
0x00a6d7ff
0x00a6d803
0x00a6d80c
0x00a6d80f
0x00a6d812
0x00a6d813
0x00a6d816
0x00a6d817
0x00a6d81b
0x00a6d821
0x00000000
0x00000000
0x00000000
0x00a6d821
0x00a6d823
0x00a6d823
0x00a6d82a
0x00a6d82c
0x00a6d82d
0x00a6d82d
0x00a6d831
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00a6d831
0x00a6d7ee
0x00a6d997
0x00a6d997

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 636b8f9328b2d5120378cd7af32826c52ae9b73c48ea01593331070e541daac3
Instruction ID: 57221debd05807eefd330672d36c35dbc1cf7a78ccc84c7a2fe8de5c413af925
Opcode Fuzzy Hash: 636b8f9328b2d5120378cd7af32826c52ae9b73c48ea01593331070e541daac3
Instruction Fuzzy Hash: 4E51C031E083954ED712CF35828456EBFF1AFDA354F59489EE4D54B213C230DA8ADB92

Uniqueness

Uniqueness Score: -1.00%

Function 00A72207 Relevance: .1, Instructions: 112
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00A72207(unsigned int __ecx) {
				intOrPtr _t39;
				signed int _t47;
				intOrPtr _t48;
				signed int _t55;
				signed int _t61;
				signed int _t66;
				intOrPtr _t78;
				signed int _t82;
				unsigned char _t84;
				signed int* _t86;
				intOrPtr _t87;
				unsigned int _t88;
				unsigned int _t89;
				signed int _t90;
				void* _t91;

				_t88 =  *(_t91 + 0x1c);
				_t61 = 0;
				_t86 =  *(_t91 + 0x24);
				_t89 = __ecx;
				 *(_t91 + 0x14) = __ecx;
				_t86[3] = 0;
				if( *((intOrPtr*)(_t88 + 8)) != 0 ||  *_t88 <=  *((intOrPtr*)(__ecx + 0x78)) - 7 || E00A7314C(__ecx) != 0) {
					E00A69E83(_t88,  ~( *(_t88 + 4)) & 0x00000007);
					 *(_t91 + 0x14) = E00A69E9A(_t88) >> 8;
					E00A69E83(_t88, 8);
					_t66 =  *(_t91 + 0x10) & 0x000000ff;
					_t39 = (_t66 >> 0x00000003 & 0x00000003) + 1;
					 *((intOrPtr*)(_t91 + 0x20)) = _t39;
					if(_t39 == 4) {
						goto L3;
					}
					_t86[3] = _t39 + 2;
					_t86[1] = (_t66 & 0x00000007) + 1;
					 *(_t91 + 0x1c) = E00A69E9A(_t88) >> 8;
					E00A69E83(_t88, 8);
					if( *((intOrPtr*)(_t91 + 0x20)) <= _t61) {
						L9:
						_t84 =  *(_t91 + 0x10);
						 *_t86 = _t61;
						if((_t61 >> 0x00000010 ^ _t61 >> 0x00000008 ^ _t61 ^ _t84 ^ 0x0000005a) !=  *((intOrPtr*)(_t91 + 0x18))) {
							goto L3;
						}
						_t47 =  *_t88;
						_t86[2] = _t47;
						_t23 = _t47 - 1; // -1
						_t48 =  *((intOrPtr*)(_t89 + 0x7c));
						_t78 = _t23 + _t61;
						if(_t48 >= _t78) {
							_t48 = _t78;
						}
						 *((intOrPtr*)(_t89 + 0x7c)) = _t48;
						_t86[4] = _t84 >> 0x00000006 & 0x00000001;
						_t86[4] = _t84 >> 7;
						return 1;
					}
					_t87 =  *((intOrPtr*)(_t91 + 0x20));
					_t90 = _t61;
					do {
						_t55 = E00A69E9A(_t88) >> 8 << _t90;
						_t90 = _t90 + 8;
						_t61 = _t61 + _t55;
						_t82 =  *(_t88 + 4) + 8;
						 *_t88 =  *_t88 + (_t82 >> 3);
						 *(_t88 + 4) = _t82 & 0x00000007;
						_t87 = _t87 - 1;
					} while (_t87 != 0);
					_t86 =  *(_t91 + 0x24);
					_t89 =  *(_t91 + 0x14);
					goto L9;
				} else {
					L3:
					return 0;
				}
			}

0x00a7220d
0x00a72211
0x00a72214
0x00a72218
0x00a7221a
0x00a7221e
0x00a72224
0x00a7224b
0x00a7225e
0x00a72262
0x00a7226b
0x00a72276
0x00a72277
0x00a7227e
0x00000000
0x00000000
0x00a72287
0x00a7228a
0x00a7229b
0x00a7229f
0x00a722a8
0x00a722e3
0x00a722e3
0x00a722f3
0x00a72300
0x00000000
0x00000000
0x00a72306
0x00a72308
0x00a7230b
0x00a7230e
0x00a72311
0x00a72315
0x00a72317
0x00a72317
0x00a72319
0x00a72326
0x00a7232b
0x00000000
0x00a7232b
0x00a722aa
0x00a722ae
0x00a722b0
0x00a722bc
0x00a722be
0x00a722c4
0x00a722c6
0x00a722d1
0x00a722d3
0x00a722d6
0x00a722d6
0x00a722db
0x00a722df
0x00000000
0x00a72239
0x00a72239
0x00000000
0x00a72239

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cd027dfe4e1f9ba484bbf82d4ab58a7f99abf8b0f4a969cd7e275df655a3163
Instruction ID: cc4ed9559c565767cc425ae25685534a20ac0ccb7de1a5c9c4ca67b10e8624f5
Opcode Fuzzy Hash: 6cd027dfe4e1f9ba484bbf82d4ab58a7f99abf8b0f4a969cd7e275df655a3163
Instruction Fuzzy Hash: E031D2B1A047058FCB14DF69C9512AFBBE4FB96300F10892DE499D7742C739E909CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00A65C44 Relevance: .1, Instructions: 76
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00A65C44(signed char _a4, signed char _a8, unsigned int _a12) {
				signed char _t49;
				signed char _t51;
				signed char _t67;
				signed char _t68;
				unsigned int _t72;
				unsigned int _t74;

				_t67 = _a8;
				_t49 = _a4;
				_t74 = _a12;
				if(_t74 != 0) {
					while((_t67 & 0x00000007) != 0) {
						_t49 = _t49 >> 0x00000008 ^  *(0xa99bd8 + ( *_t67 & 0x000000ff ^ _t49 & 0x000000ff) * 4);
						_t67 = _t67 + 1;
						_a8 = _t67;
						_t74 = _t74 - 1;
						if(_t74 != 0) {
							continue;
						}
						goto L3;
					}
				}
				L3:
				if(_t74 >= 8) {
					_t72 = _t74 >> 3;
					do {
						_t51 = _t49 ^  *_t67;
						_t74 = _t74 - 8;
						_t68 =  *(_t67 + 4);
						_t67 = _a8 + 8;
						_a8 = _t67;
						_t49 =  *(0xa99bd8 + (_t68 >> 0x18) * 4) ^  *(0xa99fd8 + (_t68 >> 0x00000010 & 0x000000ff) * 4) ^  *(0xa9a3d8 + (_t68 >> 0x00000008 & 0x000000ff) * 4) ^  *(0xa9abd8 + (_t51 >> 0x18) * 4) ^  *(0xa9afd8 + (_t51 >> 0x00000010 & 0x000000ff) * 4) ^  *(0xa9b3d8 + (_t51 >> 0x00000008 & 0x000000ff) * 4) ^  *(0xa9a7d8 + (_t68 & 0x000000ff) * 4) ^  *(0xa9b7d8 + (_t51 & 0x000000ff) * 4);
						_t72 = _t72 - 1;
					} while (_t72 != 0);
				}
				if(_t74 != 0) {
					do {
						_t49 = _t49 >> 0x00000008 ^  *(0xa99bd8 + ( *_t67 & 0x000000ff ^ _t49 & 0x000000ff) * 4);
						_t67 = _t67 + 1;
						_t74 = _t74 - 1;
					} while (_t74 != 0);
				}
				return _t49;
			}

0x00a65c47
0x00a65c4b
0x00a65c4f
0x00a65c54
0x00a65c56
0x00a65c66
0x00a65c6d
0x00a65c6e
0x00a65c71
0x00a65c74
0x00000000
0x00000000
0x00000000
0x00a65c74
0x00a65c56
0x00a65c76
0x00a65c79
0x00a65c82
0x00a65c85
0x00a65c85
0x00a65c87
0x00a65c8a
0x00a65ce7
0x00a65cea
0x00a65cfe
0x00a65d00
0x00a65d00
0x00a65d05
0x00a65d08
0x00a65d0a
0x00a65d15
0x00a65d1c
0x00a65d1d
0x00a65d1d
0x00a65d0a
0x00a65d27

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3058d1debd204243270e2f723c5032e55b07262c1c73e7fa786da6de7feffe0
Instruction ID: 3da1c428f81a7507b2a8eaeccc94bf83a9fef84cc6baecb15f68152a3168d6aa
Opcode Fuzzy Hash: e3058d1debd204243270e2f723c5032e55b07262c1c73e7fa786da6de7feffe0
Instruction Fuzzy Hash: DE218771F105754BCB08CF6DEC9047A77E1A786301746822FEA468B2D1C935E966D7E0

Uniqueness

Uniqueness Score: -1.00%

Function 00A6E961 Relevance: .0, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00A6E961(intOrPtr __edx) {
				unsigned int _v8;
				signed int _v12;
				char _v20;
				unsigned int _t15;
				void* _t18;
				intOrPtr _t19;
				intOrPtr* _t24;

				_push(_t19);
				_t24 =  &_v20;
				asm("cpuid");
				 *_t24 = 1;
				 *((intOrPtr*)(_t24 + 4)) = _t19;
				 *((intOrPtr*)(_t24 + 8)) = 0;
				 *((intOrPtr*)(_t24 + 0xc)) = __edx;
				if((_v12 & 0x00080000) == 0) {
					if((_v12 & 0x00000200) == 0) {
						_t15 = _v8;
						if((_t15 & 0x04000000) == 0) {
							return _t15 >> 0x00000019 & 0x00000001;
						}
						_push(2);
						L2:
						_pop(_t18);
						return _t18;
					}
					_push(3);
					goto L2;
				}
				_push(4);
				goto L2;
			}

0x00a6e967
0x00a6e96d
0x00a6e971
0x00a6e973
0x00a6e975
0x00a6e978
0x00a6e97b
0x00a6e987
0x00a6e995
0x00a6e99b
0x00a6e9a3
0x00000000
0x00a6e9ac
0x00a6e9a5
0x00a6e98b
0x00a6e98b
0x00000000
0x00a6e98b
0x00a6e997
0x00000000
0x00a6e997
0x00a6e989
0x00000000

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 844661d0b5cd3d9820eae2268a91d75b7a31d2e700459727f9f85433316130d5
Instruction ID: 75c23ed9548e5daeee72c3879e438ec56854b51b13b8bc250a1e944296036ccc
Opcode Fuzzy Hash: 844661d0b5cd3d9820eae2268a91d75b7a31d2e700459727f9f85433316130d5
Instruction Fuzzy Hash: 78F0E27B904709DBE764CF49D846767F7B8EF00304F24881EE99AE2180D271A5508B85

Uniqueness

Uniqueness Score: -1.00%

Function 00A805BB Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 269
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 64%

			E00A805BB(signed int* __ecx, signed int __edx, intOrPtr* _a4, intOrPtr _a8, signed int* _a12, intOrPtr _a16, signed int* _a20, char _a24, intOrPtr _a28, signed int _a32) {
				intOrPtr _v0;
				intOrPtr _v4;
				char _v5;
				char _v12;
				char _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				char _v40;
				signed int _v44;
				char _v48;
				signed int _v52;
				signed int* _v56;
				intOrPtr _v60;
				char _v72;
				intOrPtr* _v80;
				signed int _v100;
				signed int* _v144;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				char _t190;
				signed int* _t198;
				intOrPtr* _t199;
				signed int _t202;
				signed int _t206;
				intOrPtr* _t210;
				signed int _t211;
				signed int _t212;
				signed int _t214;
				signed int _t215;
				signed int _t217;
				signed int _t221;
				void* _t225;
				signed int _t227;
				void* _t231;
				void* _t233;
				char _t234;
				signed int* _t236;
				signed int _t237;
				signed int _t238;
				signed int _t242;
				void* _t244;
				void* _t246;
				void* _t249;
				intOrPtr _t251;
				intOrPtr _t252;
				void* _t254;
				char _t255;
				signed int _t261;
				char* _t265;
				intOrPtr _t271;
				signed int _t276;
				signed int _t277;
				signed int _t280;
				char _t281;
				intOrPtr _t283;
				signed int* _t288;
				intOrPtr* _t289;
				signed int* _t291;
				signed int _t293;
				intOrPtr _t299;
				intOrPtr* _t302;
				signed int _t303;
				void* _t304;
				signed int* _t308;
				void* _t311;
				void* _t312;
				void* _t314;
				void* _t315;
				void* _t316;
				void* _t317;

				_t280 = __edx;
				_t262 = __ecx;
				_t251 = _a8;
				_push(_t302);
				_t288 = _a20;
				_v40 = 0;
				_v5 = 0;
				if(_t288[1] > 0x80) {
					_t190 =  *((intOrPtr*)(_t251 + 8));
				} else {
					_t190 =  *((char*)(_t251 + 8));
				}
				_v12 = _t190;
				if(_t190 < 0xffffffff || _t190 >= _t288[1]) {
					L63:
					E00A83FBE(_t251, _t262, _t280, _t288);
					goto L64;
				} else {
					_t302 = _a4;
					if( *_t302 != 0xe06d7363) {
						_t262 = _a12;
						goto L58;
					} else {
						if( *((intOrPtr*)(_t302 + 0x10)) != 3 ||  *((intOrPtr*)(_t302 + 0x14)) != 0x19930520 &&  *((intOrPtr*)(_t302 + 0x14)) != 0x19930521 &&  *((intOrPtr*)(_t302 + 0x14)) != 0x19930522) {
							L23:
							_t262 = _a12;
							_v16 = _t262;
							goto L25;
						} else {
							_t326 =  *((intOrPtr*)(_t302 + 0x1c));
							if( *((intOrPtr*)(_t302 + 0x1c)) != 0) {
								goto L23;
							} else {
								_t225 = E00A800C5(_t251, _t262, _t280, _t288, _t302, _t326);
								_t327 =  *((intOrPtr*)(_t225 + 0x10));
								if( *((intOrPtr*)(_t225 + 0x10)) == 0) {
									L62:
									return _t225;
								} else {
									_t302 =  *((intOrPtr*)(E00A800C5(_t251, _t262, _t280, _t288, _t302, _t327) + 0x10));
									_t244 = E00A800C5(_t251, _t262, _t280, _t288, _t302, _t327);
									_v40 = 1;
									_v16 =  *((intOrPtr*)(_t244 + 0x14));
									if(_t302 == 0) {
										goto L63;
									} else {
										if( *_t302 != 0xe06d7363 ||  *((intOrPtr*)(_t302 + 0x10)) != 3 ||  *((intOrPtr*)(_t302 + 0x14)) != 0x19930520 &&  *((intOrPtr*)(_t302 + 0x14)) != 0x19930521 &&  *((intOrPtr*)(_t302 + 0x14)) != 0x19930522) {
											L19:
											_t246 = E00A800C5(_t251, _t262, _t280, _t288, _t302, _t334);
											_t335 =  *((intOrPtr*)(_t246 + 0x1c));
											if( *((intOrPtr*)(_t246 + 0x1c)) == 0) {
												L24:
												_t262 = _v16;
												_t190 = _v12;
												L25:
												__eflags =  *_t302 - 0xe06d7363;
												if( *_t302 != 0xe06d7363) {
													L58:
													__eflags = _t288[3];
													if(__eflags <= 0) {
														goto L61;
													} else {
														__eflags = _a24;
														if(__eflags != 0) {
															goto L63;
														} else {
															_push(_a32);
															_push(_a28);
															_push(_t190);
															_push(_t288);
															_push(_a16);
															_push(_t262);
															_push(_t251);
															_push(_t302);
															L67();
															_t314 = _t314 + 0x20;
															goto L61;
														}
													}
												} else {
													__eflags =  *((intOrPtr*)(_t302 + 0x10)) - 3;
													if( *((intOrPtr*)(_t302 + 0x10)) != 3) {
														goto L58;
													} else {
														__eflags =  *((intOrPtr*)(_t302 + 0x14)) - 0x19930520;
														if( *((intOrPtr*)(_t302 + 0x14)) == 0x19930520) {
															L30:
															__eflags = _t288[3];
															if(_t288[3] > 0) {
																_t262 =  &_v24;
																_t233 = E00A7D477( &_v24, _t288, _a28, _t190,  &_v24,  &_v48);
																_t280 = _v24;
																_t314 = _t314 + 0x14;
																__eflags = _t280 - _v48;
																if(_t280 < _v48) {
																	_t47 = _t233 + 0x10; // 0x10
																	_t276 = _t47;
																	_t234 = _v12;
																	_v36 = _t276;
																	do {
																		_t50 = _t276 - 0x10; // 0x0
																		_v60 = _t50;
																		_t288 = _a20;
																		__eflags =  *((intOrPtr*)(_t276 - 0x10)) - _t234;
																		if( *((intOrPtr*)(_t276 - 0x10)) <= _t234) {
																			__eflags = _t234 -  *((intOrPtr*)(_t276 - 0xc));
																			if(_t234 <=  *((intOrPtr*)(_t276 - 0xc))) {
																				_v20 =  *_t276;
																				_t261 =  *(_t276 - 4);
																				__eflags = _t261;
																				_v28 = _t261;
																				_t251 = _a8;
																				if(_t261 > 0) {
																					_t236 =  *( *((intOrPtr*)(_t302 + 0x1c)) + 0xc);
																					_t277 =  *_t236;
																					_t61 =  &(_t236[1]); // 0x4
																					_t285 = _t61;
																					_t237 = _v28;
																					_v52 = _t277;
																					_v56 = _t285;
																					while(1) {
																						_v32 = _t285;
																						_v44 = _t277;
																						__eflags = _t277;
																						if(_t277 <= 0) {
																							goto L41;
																						} else {
																							goto L38;
																						}
																						while(1) {
																							L38:
																							_t238 = E00A80F0B(_v20,  *_t285,  *((intOrPtr*)(_t302 + 0x1c)));
																							_t314 = _t314 + 0xc;
																							__eflags = _t238;
																							if(_t238 != 0) {
																								break;
																							}
																							_t242 = _v44 - 1;
																							_t285 = _v32 + 4;
																							_v44 = _t242;
																							_v32 = _v32 + 4;
																							__eflags = _t242;
																							if(_t242 > 0) {
																								continue;
																							} else {
																								_t237 = _v28;
																								goto L41;
																							}
																							L44:
																							_t280 = _v24;
																							_t276 = _v36;
																							_t234 = _v12;
																							goto L45;
																						}
																						_push(_v40);
																						_v5 = 1;
																						E00A804F6(_t251, _t285, _t302, _t251, _v16, _a16, _t288, _v20,  *_v32, _v60, _a28, _a32);
																						_t314 = _t314 + 0x2c;
																						goto L44;
																						L41:
																						_v20 = _v20 + 0x10;
																						_t237 = _t237 - 1;
																						_v28 = _t237;
																						__eflags = _t237;
																						if(_t237 > 0) {
																							_t277 = _v52;
																							_t285 = _v56;
																							_v32 = _t285;
																							_v44 = _t277;
																							__eflags = _t277;
																							if(_t277 <= 0) {
																								goto L41;
																							} else {
																								goto L38;
																							}
																						}
																						goto L44;
																					}
																				}
																			}
																		}
																		L45:
																		_t280 = _t280 + 1;
																		_t276 = _t276 + 0x14;
																		_v24 = _t280;
																		_v36 = _t276;
																		__eflags = _t280 - _v48;
																	} while (_t280 < _v48);
																}
															}
															__eflags = _a24;
															if(__eflags != 0) {
																_push(1);
																E00A8020C(_t280, __eflags);
																_t262 = _t302;
															}
															__eflags = _v5;
															if(__eflags != 0) {
																L61:
																_t225 = E00A800C5(_t251, _t262, _t280, _t288, _t302, __eflags);
																__eflags =  *(_t225 + 0x1c);
																if( *(_t225 + 0x1c) != 0) {
																	goto L63;
																} else {
																	goto L62;
																}
															} else {
																_t227 =  *_t288 & 0x1fffffff;
																__eflags = _t227 - 0x19930521;
																if(__eflags < 0) {
																	goto L61;
																} else {
																	__eflags = _t288[7];
																	if(_t288[7] != 0) {
																		L53:
																		__eflags = _t288[8] & 0x00000004;
																		if((_t288[8] & 0x00000004) != 0) {
																			goto L63;
																		} else {
																			_push(_t288[7]);
																			L87();
																			_t262 = _t302;
																			__eflags = _t227;
																			if(__eflags != 0) {
																				goto L61;
																			} else {
																				E00A800C5(_t251, _t262, _t280, _t288, _t302, __eflags);
																				E00A800C5(_t251, _t262, _t280, _t288, _t302, __eflags);
																				 *((intOrPtr*)(E00A800C5(_t251, _t262, _t280, _t288, _t302, __eflags) + 0x10)) = _t302;
																				_t231 = E00A800C5(_t251, _t262, _t280, _t288, _t302, __eflags);
																				__eflags = _a32;
																				_t265 = _v16;
																				_push(_t302);
																				 *((intOrPtr*)(_t231 + 0x14)) = _t265;
																				if(_a32 != 0) {
																					goto L65;
																				} else {
																					_push(_t251);
																				}
																				goto L66;
																			}
																		}
																	} else {
																		__eflags = _t288[8] & 0x00000004;
																		if(__eflags == 0) {
																			goto L61;
																		} else {
																			__eflags = _v40;
																			if(__eflags != 0) {
																				goto L61;
																			} else {
																				goto L53;
																			}
																		}
																	}
																}
															}
														} else {
															__eflags =  *((intOrPtr*)(_t302 + 0x14)) - 0x19930521;
															if( *((intOrPtr*)(_t302 + 0x14)) == 0x19930521) {
																goto L30;
															} else {
																__eflags =  *((intOrPtr*)(_t302 + 0x14)) - 0x19930522;
																if( *((intOrPtr*)(_t302 + 0x14)) != 0x19930522) {
																	goto L58;
																} else {
																	goto L30;
																}
															}
														}
													}
												}
											} else {
												_v36 =  *((intOrPtr*)(E00A800C5(_t251, _t262, _t280, _t288, _t302, _t335) + 0x1c));
												_t249 = E00A800C5(_t251, _t262, _t280, _t288, _t302, _t335);
												_push(_v36);
												_push(_t302);
												 *(_t249 + 0x1c) =  *(_t249 + 0x1c) & 0x00000000;
												L87();
												if(_t249 != 0) {
													goto L24;
												} else {
													_push(_v36);
													L100();
													_pop(_t262);
													_t337 = _t249;
													if(_t249 == 0) {
														goto L63;
													} else {
													}
													L64:
													_push(1);
													_push(_t302);
													E00A8020C(_t280, _t337);
													_t265 =  &_v72;
													E00A802BB(_t265);
													E00A7F404( &_v72, 0xa96fcc);
													L65:
													_push(_a32);
													L66:
													E00A7D521(_t265);
													_push(_a16);
													_push(_t251);
													E00A80D47(_t251, _t265, _t280, _t288, _t337);
													_t315 = _t314 + 0x10;
													_push(_t288[7]);
													_t198 = E00A804BC(_t251, _t265, _t280, _t288, _t302, _t337);
													asm("int3");
													_t311 = _t315;
													_push(_t265);
													_push(_t265);
													_push(_t288);
													_t289 = _v80;
													_t338 =  *_t289 - 0x80000003;
													if( *_t289 == 0x80000003) {
														L85:
														return _t198;
													} else {
														_t199 = E00A800C5(_t251, _t265, _t280, _t289, _t302, _t338, _t302, _t251);
														_t252 = _a16;
														_t339 =  *((intOrPtr*)(_t199 + 8));
														if( *((intOrPtr*)(_t199 + 8)) == 0) {
															L73:
															if( *((intOrPtr*)(_t252 + 0xc)) == 0) {
																E00A83FBE(_t252, _t265, _t280, _t289);
																asm("int3");
																_push(_t311);
																_t312 = _t315;
																_t316 = _t315 - 0x18;
																_push(_t252);
																_push(_t302);
																_t303 = _v100;
																_push(_t289);
																__eflags = _t303;
																if(_t303 == 0) {
																	E00A83FBE(_t252, _t265, _t280, _t289);
																	asm("int3");
																	_push(_t312);
																	_push(_t252);
																	_push(_t303);
																	_push(_t289);
																	_t291 = _v144;
																	_t304 = 0;
																	__eflags =  *_t291;
																	if( *_t291 <= 0) {
																		L104:
																		_t202 = 0;
																		__eflags = 0;
																	} else {
																		_t254 = 0;
																		while(1) {
																			_t206 = E00A8006D( *((intOrPtr*)(_t254 + _t291[1] + 4)) + 4, 0xa999f4);
																			__eflags = _t206;
																			if(_t206 == 0) {
																				break;
																			}
																			_t304 = _t304 + 1;
																			_t254 = _t254 + 0x10;
																			__eflags = _t304 -  *_t291;
																			if(_t304 <  *_t291) {
																				continue;
																			} else {
																				goto L104;
																			}
																			goto L105;
																		}
																		_t202 = 1;
																	}
																	L105:
																	return _t202;
																} else {
																	_t293 =  *_t303;
																	_t255 = 0;
																	__eflags = _t293;
																	if(_t293 > 0) {
																		_t281 = 0;
																		_v16 = 0;
																		_t210 =  *((intOrPtr*)( *((intOrPtr*)(_v4 + 0x1c)) + 0xc));
																		_t211 = _t210 + 4;
																		__eflags = _t211;
																		_v28 =  *_t210;
																		_v36 = _t211;
																		do {
																			_t269 = _t211;
																			_t212 = _v28;
																			_v24 = _t211;
																			_v20 = _t212;
																			__eflags = _t212;
																			if(_t212 > 0) {
																				_t214 =  *((intOrPtr*)(_t303 + 4)) + _t281;
																				__eflags = _t214;
																				_v32 = _t214;
																				while(1) {
																					_t215 = E00A80F0B(_t214,  *_t269,  *((intOrPtr*)(_v4 + 0x1c)));
																					_t316 = _t316 + 0xc;
																					__eflags = _t215;
																					if(_t215 != 0) {
																						break;
																					}
																					_t217 = _v20 - 1;
																					_t269 = _v24 + 4;
																					_v20 = _t217;
																					__eflags = _t217;
																					_v24 = _v24 + 4;
																					_t214 = _v32;
																					if(_t217 > 0) {
																						continue;
																					} else {
																					}
																					L96:
																					_t281 = _v16;
																					goto L97;
																				}
																				_t255 = 1;
																				goto L96;
																			}
																			L97:
																			_t211 = _v36;
																			_t281 = _t281 + 0x10;
																			_v16 = _t281;
																			_t293 = _t293 - 1;
																			__eflags = _t293;
																		} while (_t293 != 0);
																	}
																	return _t255;
																}
															} else {
																_t198 = E00A7D477(_t265, _t252, _a24, _a20,  &_v16,  &_v12);
																_t271 = _v16;
																_t317 = _t315 + 0x14;
																_t283 = _v12;
																if(_t271 < _t283) {
																	_t137 =  &(_t198[3]); // 0xc
																	_t308 = _t137;
																	_t198 = _a20;
																	do {
																		if(_t198 >=  *((intOrPtr*)(_t308 - 0xc)) && _t198 <=  *((intOrPtr*)(_t308 - 8))) {
																			_t221 =  *_t308 << 4;
																			if( *((intOrPtr*)(_t308[1] + _t221 - 0xc)) == 0) {
																				L80:
																				_t222 = _t221 + _t308[1] + 0xfffffff0;
																				_t299 = _v0;
																				if(( *(_t221 + _t308[1] + 0xfffffff0) & 0x00000040) == 0) {
																					_push(1);
																					_t155 = _t308 - 0xc; // 0x0
																					E00A804F6(_t252, _t283, _t299, _a4, _a8, _a12, _t252, _t222, 0, _t155, _a24, _a28);
																					_t283 = _v12;
																					_t317 = _t317 + 0x2c;
																					_t271 = _v16;
																				}
																			} else {
																				_t283 = _v12;
																				_t252 = _a16;
																				if( *((char*)( *((intOrPtr*)(_t308[1] + _t221 - 0xc)) + 8)) == 0) {
																					goto L80;
																				}
																			}
																			_t198 = _a20;
																		}
																		_t271 = _t271 + 1;
																		_t308 =  &(_t308[5]);
																		_v16 = _t271;
																	} while (_t271 < _t283);
																}
																goto L84;
															}
														} else {
															__imp__EncodePointer(0);
															_t302 = _t199;
															if( *((intOrPtr*)(E00A800C5(_t252, _t265, _t280, _t289, _t302, _t339) + 8)) == _t302 ||  *_t289 == 0xe0434f4d ||  *_t289 == 0xe0434352) {
																goto L73;
															} else {
																_t198 = E00A7D39A(_t289, _a4, _a8, _a12, _t252, _a24, _a28);
																_t315 = _t315 + 0x1c;
																if(_t198 != 0) {
																	L84:
																	goto L85;
																} else {
																	goto L73;
																}
															}
														}
													}
												}
											}
										} else {
											_t334 =  *((intOrPtr*)(_t302 + 0x1c));
											if( *((intOrPtr*)(_t302 + 0x1c)) == 0) {
												goto L63;
											} else {
												goto L19;
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x00a805bb
0x00a805bb
0x00a805c2
0x00a805c5
0x00a805c7
0x00a805ca
0x00a805ce
0x00a805d9
0x00a805e1
0x00a805db
0x00a805db
0x00a805db
0x00a805e4
0x00a805ea
0x00a808d7
0x00a808d7
0x00000000
0x00a805f9
0x00a805f9
0x00a80602
0x00a808a0
0x00000000
0x00a80608
0x00a8060c
0x00a806e0
0x00a806e0
0x00a806e3
0x00000000
0x00a80631
0x00a80631
0x00a80635
0x00000000
0x00a8063b
0x00a8063b
0x00a80640
0x00a80644
0x00a808d0
0x00a808d6
0x00a8064a
0x00a8064f
0x00a80652
0x00a80657
0x00a8065e
0x00a80663
0x00000000
0x00a80669
0x00a8066f
0x00a8069c
0x00a8069c
0x00a806a1
0x00a806a5
0x00a806e8
0x00a806e8
0x00a806eb
0x00a806ee
0x00a806ee
0x00a806f4
0x00a808a3
0x00a808a3
0x00a808a7
0x00000000
0x00a808a9
0x00a808a9
0x00a808ad
0x00000000
0x00a808af
0x00a808af
0x00a808b2
0x00a808b5
0x00a808b6
0x00a808b7
0x00a808ba
0x00a808bb
0x00a808bc
0x00a808bd
0x00a808c2
0x00000000
0x00a808c2
0x00a808ad
0x00a806fa
0x00a806fa
0x00a806fe
0x00000000
0x00a80704
0x00a80704
0x00a8070b
0x00a80723
0x00a80723
0x00a80727
0x00a80731
0x00a8073a
0x00a8073f
0x00a80742
0x00a80745
0x00a80748
0x00a8074e
0x00a8074e
0x00a80751
0x00a80754
0x00a80757
0x00a80757
0x00a8075a
0x00a8075d
0x00a80760
0x00a80763
0x00a80769
0x00a8076c
0x00a80774
0x00a80777
0x00a8077a
0x00a8077c
0x00a8077f
0x00a80782
0x00a8078b
0x00a8078e
0x00a80790
0x00a80790
0x00a80793
0x00a80796
0x00a80799
0x00a8079c
0x00a8079c
0x00a8079f
0x00a807a2
0x00a807a4
0x00000000
0x00000000
0x00000000
0x00000000
0x00a807a6
0x00a807a6
0x00a807ae
0x00a807b3
0x00a807b6
0x00a807b8
0x00000000
0x00000000
0x00a807c0
0x00a807c1
0x00a807c4
0x00a807c7
0x00a807ca
0x00a807cc
0x00000000
0x00a807ce
0x00a807ce
0x00000000
0x00a807ce
0x00a8080e
0x00a8080e
0x00a80811
0x00a80814
0x00000000
0x00a80814
0x00a807e5
0x00a807ee
0x00a80806
0x00a8080b
0x00000000
0x00a807d1
0x00a807d1
0x00a807d5
0x00a807d6
0x00a807d9
0x00a807db
0x00a807dd
0x00a807e0
0x00a8079c
0x00a8079f
0x00a807a2
0x00a807a4
0x00000000
0x00000000
0x00000000
0x00000000
0x00a807a4
0x00000000
0x00a807db
0x00a8079c
0x00a80782
0x00a8076c
0x00a80817
0x00a80817
0x00a80818
0x00a8081b
0x00a8081e
0x00a80821
0x00a80821
0x00a80757
0x00a80748
0x00a8082a
0x00a8082e
0x00a80830
0x00a80833
0x00a80839
0x00a80839
0x00a8083a
0x00a8083e
0x00a808c5
0x00a808c5
0x00a808ca
0x00a808ce
0x00000000
0x00000000
0x00000000
0x00000000
0x00a80844
0x00a80846
0x00a8084b
0x00a80850
0x00000000
0x00a80852
0x00a80852
0x00a80856
0x00a80864
0x00a80864
0x00a80868
0x00000000
0x00a8086a
0x00a8086a
0x00a8086e
0x00a80874
0x00a80875
0x00a80877
0x00000000
0x00a80879
0x00a80879
0x00a8087e
0x00a80888
0x00a8088b
0x00a80890
0x00a80894
0x00a80897
0x00a80898
0x00a8089b
0x00000000
0x00a8089d
0x00a8089d
0x00a8089d
0x00000000
0x00a8089b
0x00a80877
0x00a80858
0x00a80858
0x00a8085c
0x00000000
0x00a8085e
0x00a8085e
0x00a80862
0x00000000
0x00000000
0x00000000
0x00000000
0x00a80862
0x00a8085c
0x00a80856
0x00a80850
0x00a8070d
0x00a8070d
0x00a80714
0x00000000
0x00a80716
0x00a80716
0x00a8071d
0x00000000
0x00000000
0x00000000
0x00000000
0x00a8071d
0x00a80714
0x00a8070b
0x00a806fe
0x00a806a7
0x00a806af
0x00a806b2
0x00a806b7
0x00a806ba
0x00a806bb
0x00a806bf
0x00a806c8
0x00000000
0x00a806ca
0x00a806ca
0x00a806cd
0x00a806d2
0x00a806d3
0x00a806d5
0x00000000
0x00000000
0x00a806db
0x00a808dc
0x00a808dc
0x00a808de
0x00a808df
0x00a808e6
0x00a808e9
0x00a808f7
0x00a808fc
0x00a808fc
0x00a808ff
0x00a808ff
0x00a80907
0x00a8090a
0x00a8090b
0x00a80910
0x00a80913
0x00a80916
0x00a8091b
0x00a8091d
0x00a8091f
0x00a80920
0x00a80921
0x00a80922
0x00a80925
0x00a8092b
0x00a80a2c
0x00a80a30
0x00a80931
0x00a80933
0x00a80938
0x00a8093b
0x00a8093f
0x00a80986
0x00a8098a
0x00a80a31
0x00a80a36
0x00a80a37
0x00a80a38
0x00a80a3a
0x00a80a3d
0x00a80a3e
0x00a80a3f
0x00a80a42
0x00a80a43
0x00a80a45
0x00a80acd
0x00a80ad2
0x00a80ad3
0x00a80ad6
0x00a80ad7
0x00a80ad8
0x00a80ad9
0x00a80adc
0x00a80ade
0x00a80ae0
0x00a80b07
0x00a80b07
0x00a80b07
0x00a80ae2
0x00a80ae2
0x00a80ae4
0x00a80af4
0x00a80afb
0x00a80afd
0x00000000
0x00000000
0x00a80aff
0x00a80b00
0x00a80b03
0x00a80b05
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00a80b05
0x00a80b0e
0x00a80b0e
0x00a80b09
0x00a80b0d
0x00a80a4b
0x00a80a4b
0x00a80a4d
0x00a80a4f
0x00a80a51
0x00a80a56
0x00a80a58
0x00a80a5e
0x00a80a63
0x00a80a63
0x00a80a66
0x00a80a69
0x00a80a6c
0x00a80a6c
0x00a80a6e
0x00a80a71
0x00a80a74
0x00a80a77
0x00a80a79
0x00a80a7e
0x00a80a7e
0x00a80a80
0x00a80a83
0x00a80a8c
0x00a80a91
0x00a80a94
0x00a80a96
0x00000000
0x00000000
0x00a80a9e
0x00a80a9f
0x00a80aa2
0x00a80aa5
0x00a80aa7
0x00a80aaa
0x00a80aad
0x00000000
0x00000000
0x00a80aaf
0x00a80ab3
0x00a80ab3
0x00000000
0x00a80ab3
0x00a80ab1
0x00000000
0x00a80ab1
0x00a80ab6
0x00a80ab6
0x00a80ab9
0x00a80abc
0x00a80abf
0x00a80abf
0x00a80abf
0x00a80a6c
0x00a80acc
0x00a80acc
0x00a80990
0x00a8099f
0x00a809a4
0x00a809a7
0x00a809aa
0x00a809af
0x00a809b1
0x00a809b1
0x00a809b4
0x00a809b7
0x00a809ba
0x00a809c6
0x00a809cf
0x00a809e4
0x00a809ea
0x00a809ec
0x00a809f2
0x00a809f4
0x00a809f9
0x00a80a0e
0x00a80a13
0x00a80a16
0x00a80a19
0x00a80a19
0x00a809d1
0x00a809d8
0x00a809df
0x00a809e2
0x00000000
0x00000000
0x00a809e2
0x00a80a1c
0x00a80a1c
0x00a80a1f
0x00a80a20
0x00a80a23
0x00a80a26
0x00a809b7
0x00000000
0x00a809af
0x00a80941
0x00a80943
0x00a80949
0x00a80953
0x00000000
0x00a80965
0x00a80976
0x00a8097b
0x00a80980
0x00a80a2a
0x00000000
0x00000000
0x00000000
0x00000000
0x00a80980
0x00a80953
0x00a8093f
0x00a8092b
0x00a806c8
0x00a80692
0x00a80692
0x00a80696
0x00000000
0x00000000
0x00000000
0x00000000
0x00a80696
0x00a8066f
0x00a80663
0x00a80644
0x00a80635
0x00a8060c
0x00a80602

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 00A806BF
_GetRangeOfTrysToCheck.LIBVCRUNTIME ref: 00A8073A
___TypeMatch.LIBVCRUNTIME ref: 00A807AE
___DestructExceptionObject.LIBVCRUNTIME ref: 00A80833
IsInExceptionSpec.LIBVCRUNTIME ref: 00A8086E
FindHandlerForForeignException.LIBVCRUNTIME ref: 00A808BD
___DestructExceptionObject.LIBVCRUNTIME ref: 00A808DF
__CxxThrowException@8.LIBVCRUNTIME ref: 00A808F7
_UnwindNestedFrames.LIBCMT ref: 00A808FF
___FrameUnwindToState.LIBVCRUNTIME ref: 00A8090B
CallUnexpected.LIBVCRUNTIME ref: 00A80916

Strings

csm, xrefs: 00A80669
csm, xrefs: 00A805FC
csm, xrefs: 00A806EE

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: Exception$DestructObjectSpecUnwind$CallCheckException@8FindForeignFrameFramesHandlerMatchNestedRangeStateThrowTrysTypeUnexpected
String ID: csm$csm$csm
API String ID: 410073093-393685449
Opcode ID: d1c016be3258529409ad159f99960c566f727f2d66fe4eded669dfa123495f8d
Instruction ID: 9184263febde4799a280a6c8764e1da3f763627df259d7d537c57edc6cb4b115
Opcode Fuzzy Hash: d1c016be3258529409ad159f99960c566f727f2d66fe4eded669dfa123495f8d
Instruction Fuzzy Hash: FEB1AC71900709EFCFA4FFA4C940EAEBBB4BF18314F108159E85067651D375AA99CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A88D12 Relevance: 19.6, APIs: 13, Instructions: 114
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00A88D12(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t25;
				intOrPtr* _t26;
				intOrPtr _t28;
				intOrPtr* _t29;
				intOrPtr* _t31;
				intOrPtr* _t45;
				intOrPtr* _t46;
				intOrPtr* _t47;
				intOrPtr* _t55;
				intOrPtr* _t70;
				intOrPtr _t74;

				_t74 = _a4;
				_t25 =  *((intOrPtr*)(_t74 + 0x88));
				if(_t25 != 0 && _t25 != 0xa998e0) {
					_t45 =  *((intOrPtr*)(_t74 + 0x7c));
					if(_t45 != 0 &&  *_t45 == 0) {
						_t46 =  *((intOrPtr*)(_t74 + 0x84));
						if(_t46 != 0 &&  *_t46 == 0) {
							E00A851AC(_t46);
							E00A888F1( *((intOrPtr*)(_t74 + 0x88)));
						}
						_t47 =  *((intOrPtr*)(_t74 + 0x80));
						if(_t47 != 0 &&  *_t47 == 0) {
							E00A851AC(_t47);
							E00A889EF( *((intOrPtr*)(_t74 + 0x88)));
						}
						E00A851AC( *((intOrPtr*)(_t74 + 0x7c)));
						E00A851AC( *((intOrPtr*)(_t74 + 0x88)));
					}
				}
				_t26 =  *((intOrPtr*)(_t74 + 0x8c));
				if(_t26 != 0 &&  *_t26 == 0) {
					E00A851AC( *((intOrPtr*)(_t74 + 0x90)) - 0xfe);
					E00A851AC( *((intOrPtr*)(_t74 + 0x94)) - 0x80);
					E00A851AC( *((intOrPtr*)(_t74 + 0x98)) - 0x80);
					E00A851AC( *((intOrPtr*)(_t74 + 0x8c)));
				}
				E00A88E85( *((intOrPtr*)(_t74 + 0x9c)));
				_t28 = 6;
				_t16 = _t74 + 0xa0; // 0xa0
				_t55 = _t16;
				_v8 = _t28;
				_t18 = _t74 + 0x28; // 0x28
				_t70 = _t18;
				do {
					if( *((intOrPtr*)(_t70 - 8)) != 0xa993a8) {
						_t31 =  *_t70;
						if(_t31 != 0 &&  *_t31 == 0) {
							E00A851AC(_t31);
							E00A851AC( *_t55);
						}
						_t28 = _v8;
					}
					if( *((intOrPtr*)(_t70 - 0xc)) != 0) {
						_t29 =  *((intOrPtr*)(_t70 - 4));
						if(_t29 != 0 &&  *_t29 == 0) {
							E00A851AC(_t29);
						}
						_t28 = _v8;
					}
					_t55 = _t55 + 4;
					_t70 = _t70 + 0x10;
					_t28 = _t28 - 1;
					_v8 = _t28;
				} while (_t28 != 0);
				return E00A851AC(_t74);
			}

0x00a88d1a
0x00a88d1e
0x00a88d26
0x00a88d2f
0x00a88d34
0x00a88d3b
0x00a88d43
0x00a88d4b
0x00a88d56
0x00a88d5c
0x00a88d5d
0x00a88d65
0x00a88d6d
0x00a88d78
0x00a88d7e
0x00a88d82
0x00a88d8d
0x00a88d93
0x00a88d34
0x00a88d94
0x00a88d9c
0x00a88daf
0x00a88dc2
0x00a88dd0
0x00a88ddb
0x00a88de0
0x00a88de9
0x00a88df1
0x00a88df2
0x00a88df2
0x00a88df8
0x00a88dfb
0x00a88dfb
0x00a88dfe
0x00a88e05
0x00a88e07
0x00a88e0b
0x00a88e13
0x00a88e1a
0x00a88e20
0x00a88e21
0x00a88e21
0x00a88e28
0x00a88e2a
0x00a88e2f
0x00a88e37
0x00a88e3c
0x00a88e3d
0x00a88e3d
0x00a88e40
0x00a88e43
0x00a88e46
0x00a88e49
0x00a88e49
0x00a88e5b

APIs

___free_lconv_mon.LIBCMT ref: 00A88D56

Part of subcall function 00A888F1: _free.LIBCMT ref: 00A8890E
Part of subcall function 00A888F1: _free.LIBCMT ref: 00A88920
Part of subcall function 00A888F1: _free.LIBCMT ref: 00A88932
Part of subcall function 00A888F1: _free.LIBCMT ref: 00A88944
Part of subcall function 00A888F1: _free.LIBCMT ref: 00A88956
Part of subcall function 00A888F1: _free.LIBCMT ref: 00A88968
Part of subcall function 00A888F1: _free.LIBCMT ref: 00A8897A
Part of subcall function 00A888F1: _free.LIBCMT ref: 00A8898C
Part of subcall function 00A888F1: _free.LIBCMT ref: 00A8899E
Part of subcall function 00A888F1: _free.LIBCMT ref: 00A889B0
Part of subcall function 00A888F1: _free.LIBCMT ref: 00A889C2
Part of subcall function 00A888F1: _free.LIBCMT ref: 00A889D4
Part of subcall function 00A888F1: _free.LIBCMT ref: 00A889E6

_free.LIBCMT ref: 00A88D4B

Part of subcall function 00A851AC: RtlFreeHeap.NTDLL(00000000,00000000,?,00A88A86,00000000,00000000,00000000,00000000,?,00A88AAD,00000000,00000007,00000000,?,00A88EAA,00000000), ref: 00A851C2
Part of subcall function 00A851AC: GetLastError.KERNEL32(00000000,?,00A88A86,00000000,00000000,00000000,00000000,?,00A88AAD,00000000,00000007,00000000,?,00A88EAA,00000000,00000000), ref: 00A851D4

_free.LIBCMT ref: 00A88D6D
_free.LIBCMT ref: 00A88D82
_free.LIBCMT ref: 00A88D8D
_free.LIBCMT ref: 00A88DAF
_free.LIBCMT ref: 00A88DC2
_free.LIBCMT ref: 00A88DD0
_free.LIBCMT ref: 00A88DDB
_free.LIBCMT ref: 00A88E13
_free.LIBCMT ref: 00A88E1A
_free.LIBCMT ref: 00A88E37
_free.LIBCMT ref: 00A88E4F

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 762c0d66b095ebb3c8eb5d27f10af2a5133cbd90e9e9204e42f013324f4dc1b6
Instruction ID: a15e30cce6564fd73bc0325a8e4060e426cbe7749625a7d3bc3a87a8a4cc2869
Opcode Fuzzy Hash: 762c0d66b095ebb3c8eb5d27f10af2a5133cbd90e9e9204e42f013324f4dc1b6
Instruction Fuzzy Hash: 1C312A31A00605AFEB22BB78D949B5B7BE9AF51354F544929F448D7192DF39EC40CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00A85A14 Relevance: 15.1, APIs: 10, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A85A14(char _a4) {
				char _v8;

				_t26 = _a4;
				_t52 =  *_a4;
				if( *_a4 != 0xa912d0) {
					E00A851AC(_t52);
					_t26 = _a4;
				}
				E00A851AC( *((intOrPtr*)(_t26 + 0x3c)));
				E00A851AC( *((intOrPtr*)(_a4 + 0x30)));
				E00A851AC( *((intOrPtr*)(_a4 + 0x34)));
				E00A851AC( *((intOrPtr*)(_a4 + 0x38)));
				E00A851AC( *((intOrPtr*)(_a4 + 0x28)));
				E00A851AC( *((intOrPtr*)(_a4 + 0x2c)));
				E00A851AC( *((intOrPtr*)(_a4 + 0x40)));
				E00A851AC( *((intOrPtr*)(_a4 + 0x44)));
				E00A851AC( *((intOrPtr*)(_a4 + 0x360)));
				_v8 =  &_a4;
				E00A858DA(5,  &_v8);
				_v8 =  &_a4;
				return E00A8592A(4,  &_v8);
			}

0x00a85a1a
0x00a85a1d
0x00a85a25
0x00a85a28
0x00a85a2d
0x00a85a30
0x00a85a34
0x00a85a3f
0x00a85a4a
0x00a85a55
0x00a85a60
0x00a85a6b
0x00a85a76
0x00a85a81
0x00a85a8f
0x00a85a97
0x00a85aa0
0x00a85aa8
0x00a85abc

APIs

_free.LIBCMT ref: 00A85A28

Part of subcall function 00A851AC: RtlFreeHeap.NTDLL(00000000,00000000,?,00A88A86,00000000,00000000,00000000,00000000,?,00A88AAD,00000000,00000007,00000000,?,00A88EAA,00000000), ref: 00A851C2
Part of subcall function 00A851AC: GetLastError.KERNEL32(00000000,?,00A88A86,00000000,00000000,00000000,00000000,?,00A88AAD,00000000,00000007,00000000,?,00A88EAA,00000000,00000000), ref: 00A851D4

_free.LIBCMT ref: 00A85A34
_free.LIBCMT ref: 00A85A3F
_free.LIBCMT ref: 00A85A4A
_free.LIBCMT ref: 00A85A55
_free.LIBCMT ref: 00A85A60
_free.LIBCMT ref: 00A85A6B
_free.LIBCMT ref: 00A85A76
_free.LIBCMT ref: 00A85A81
_free.LIBCMT ref: 00A85A8F

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 4a0c4f7e7d2120f95dce984c84d0bddfffa3099e67ce67dd9f64a451bc662853
Instruction ID: 6c9c5c98a410eec774d8b855fca87d3cb9d2923e1a5c97af73e571285505e303
Opcode Fuzzy Hash: 4a0c4f7e7d2120f95dce984c84d0bddfffa3099e67ce67dd9f64a451bc662853
Instruction Fuzzy Hash: C211A476910508BFDB02FF64CE86DDD3FA5EF45354B1142A1BE088B222DA31DE509B84

Uniqueness

Uniqueness Score: -1.00%

Function 00A8BCED Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 152
fileCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00A8BCED(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, signed int _a8, signed char* _a12, intOrPtr _a16) {
				signed int _v8;
				signed char _v15;
				char _v16;
				void _v24;
				short _v28;
				char _v31;
				void _v32;
				long _v36;
				intOrPtr _v40;
				void* _v44;
				signed int _v48;
				signed char* _v52;
				long _v56;
				int _v60;
				signed int _t78;
				signed int _t80;
				int _t86;
				void* _t94;
				long _t97;
				void _t105;
				void* _t112;
				signed int _t116;
				signed int _t118;
				signed char _t123;
				signed char _t128;
				intOrPtr _t129;
				signed int _t131;
				signed char* _t133;
				intOrPtr* _t135;
				signed int _t136;
				void* _t137;

				_t78 =  *0xa991b8; // 0x3197ea2d
				_v8 = _t78 ^ _t136;
				_t80 = _a8;
				_t118 = _t80 >> 6;
				_t116 = (_t80 & 0x0000003f) * 0x30;
				_t133 = _a12;
				_v52 = _t133;
				_v48 = _t118;
				_v44 =  *((intOrPtr*)( *((intOrPtr*)(0xab8428 + _t118 * 4)) + _t116 + 0x18));
				_v40 = _a16 + _t133;
				_t86 = GetConsoleCP();
				_t135 = _a4;
				_v60 = _t86;
				 *_t135 = 0;
				 *((intOrPtr*)(_t135 + 4)) = 0;
				 *((intOrPtr*)(_t135 + 8)) = 0;
				while(_t133 < _v40) {
					_v28 = 0;
					_v31 =  *_t133;
					_t129 =  *((intOrPtr*)(0xab8428 + _v48 * 4));
					_t123 =  *(_t129 + _t116 + 0x2d);
					if((_t123 & 0x00000004) == 0) {
						if(( *(E00A86A66(_t116, _t129) + ( *_t133 & 0x000000ff) * 2) & 0x00008000) == 0) {
							_push(1);
							_push(_t133);
							goto L8;
						} else {
							if(_t133 >= _v40) {
								_t131 = _v48;
								 *((char*)( *((intOrPtr*)(0xab8428 + _t131 * 4)) + _t116 + 0x2e)) =  *_t133;
								 *( *((intOrPtr*)(0xab8428 + _t131 * 4)) + _t116 + 0x2d) =  *( *((intOrPtr*)(0xab8428 + _t131 * 4)) + _t116 + 0x2d) | 0x00000004;
								 *((intOrPtr*)(_t135 + 4)) =  *((intOrPtr*)(_t135 + 4)) + 1;
							} else {
								_t112 = E00A8577C( &_v28, _t133, 2);
								_t137 = _t137 + 0xc;
								if(_t112 != 0xffffffff) {
									_t133 =  &(_t133[1]);
									goto L9;
								}
							}
						}
					} else {
						_t128 = _t123 & 0x000000fb;
						_v16 =  *((intOrPtr*)(_t129 + _t116 + 0x2e));
						_push(2);
						_v15 = _t128;
						 *(_t129 + _t116 + 0x2d) = _t128;
						_push( &_v16);
						L8:
						_push( &_v28);
						_t94 = E00A8577C();
						_t137 = _t137 + 0xc;
						if(_t94 != 0xffffffff) {
							L9:
							_t133 =  &(_t133[1]);
							_t97 = WideCharToMultiByte(_v60, 0,  &_v28, 1,  &_v24, 5, 0, 0);
							_v56 = _t97;
							if(_t97 != 0) {
								if(WriteFile(_v44,  &_v24, _t97,  &_v36, 0) == 0) {
									L19:
									 *_t135 = GetLastError();
								} else {
									_t48 = _t135 + 8; // 0xff76e900
									 *((intOrPtr*)(_t135 + 4)) =  *_t48 - _v52 + _t133;
									if(_v36 >= _v56) {
										if(_v31 != 0xa) {
											goto L16;
										} else {
											_t105 = 0xd;
											_v32 = _t105;
											if(WriteFile(_v44,  &_v32, 1,  &_v36, 0) == 0) {
												goto L19;
											} else {
												if(_v36 >= 1) {
													 *((intOrPtr*)(_t135 + 8)) =  *((intOrPtr*)(_t135 + 8)) + 1;
													 *((intOrPtr*)(_t135 + 4)) =  *((intOrPtr*)(_t135 + 4)) + 1;
													goto L16;
												}
											}
										}
									}
								}
							}
						}
					}
					goto L20;
					L16:
				}
				L20:
				return E00A7CABF(_v8 ^ _t136);
			}

0x00a8bcf5
0x00a8bcfc
0x00a8bcff
0x00a8bd07
0x00a8bd0b
0x00a8bd17
0x00a8bd1a
0x00a8bd1d
0x00a8bd24
0x00a8bd2c
0x00a8bd2f
0x00a8bd35
0x00a8bd3b
0x00a8bd40
0x00a8bd42
0x00a8bd45
0x00a8bd4a
0x00a8bd54
0x00a8bd5b
0x00a8bd5e
0x00a8bd65
0x00a8bd6c
0x00a8bd98
0x00a8bdbe
0x00a8bdc0
0x00000000
0x00a8bd9a
0x00a8bd9d
0x00a8be64
0x00a8be70
0x00a8be7b
0x00a8be80
0x00a8bda3
0x00a8bdaa
0x00a8bdaf
0x00a8bdb5
0x00a8bdbb
0x00000000
0x00a8bdbb
0x00a8bdb5
0x00a8bd9d
0x00a8bd6e
0x00a8bd72
0x00a8bd75
0x00a8bd7b
0x00a8bd7d
0x00a8bd80
0x00a8bd84
0x00a8bdc1
0x00a8bdc4
0x00a8bdc5
0x00a8bdca
0x00a8bdd0
0x00a8bdd6
0x00a8bde5
0x00a8bdeb
0x00a8bdf1
0x00a8bdf6
0x00a8be12
0x00a8be85
0x00a8be8b
0x00a8be14
0x00a8be14
0x00a8be1c
0x00a8be25
0x00a8be2b
0x00000000
0x00a8be2d
0x00a8be2f
0x00a8be32
0x00a8be4b
0x00000000
0x00a8be4d
0x00a8be51
0x00a8be53
0x00a8be56
0x00000000
0x00a8be56
0x00a8be51
0x00a8be4b
0x00a8be2b
0x00a8be25
0x00a8be12
0x00a8bdf6
0x00a8bdd0
0x00000000
0x00a8be59
0x00a8be59
0x00a8be8d
0x00a8be9f

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00A8C462,00000000,00000000,00000000,00000000,00000000,00A8223E), ref: 00A8BD2F
__fassign.LIBCMT ref: 00A8BDAA
__fassign.LIBCMT ref: 00A8BDC5
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 00A8BDEB
WriteFile.KERNEL32(?,00000000,00000000,00A8C462,00000000,?,?,?,?,?,?,?,?,?,00A8C462,00000000), ref: 00A8BE0A
WriteFile.KERNEL32(?,00000000,00000001,00A8C462,00000000,?,?,?,?,?,?,?,?,?,00A8C462,00000000), ref: 00A8BE43

Strings

@Mqt0Lqt, xrefs: 00A8BE85

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID: @Mqt0Lqt
API String ID: 1324828854-1302913217
Opcode ID: 0ad2f1d35f563f4dbea72b3fb9e491a4cbae802140906abe341aab902eee51e2
Instruction ID: d788f583e0209c33c8a0570c58557c2b6e987a2eac6b414ee83c97a265d1339f
Opcode Fuzzy Hash: 0ad2f1d35f563f4dbea72b3fb9e491a4cbae802140906abe341aab902eee51e2
Instruction Fuzzy Hash: 5651C3B5E10209AFDB10DFA8D885AEEBBF8FF09310F14851AE955E7251E7309951CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A775ED Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 124
memoryCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00A775ED(void* __edx) {
				void* __ecx;
				void* _t20;
				short* _t24;
				void* _t28;
				signed int _t29;
				intOrPtr _t31;
				intOrPtr* _t38;
				void* _t44;
				void* _t58;
				intOrPtr* _t60;
				short* _t62;
				short* _t64;
				intOrPtr* _t67;
				long _t69;
				void* _t71;
				void* _t72;

				_t58 = __edx;
				_t43 = _t44;
				if( *((intOrPtr*)(_t44 + 0x10)) == 0) {
					return _t20;
				}
				 *(_t71 + 4) =  *(_t71 + 4) & 0x00000000;
				_t60 =  *((intOrPtr*)(_t71 + 0x18));
				 *((char*)(_t71 + 0x1c)) = E00A77467(_t60);
				_push(0x200 + E00A816B5(_t60) * 2);
				_t24 = E00A82C59(_t44);
				_t64 = _t24;
				if(_t64 == 0) {
					L16:
					return _t24;
				}
				E00A81693(_t64, L"<html>");
				E00A82C19(_t64, L"<head><meta http-equiv=\"content-type\" content=\"text/html; charset=");
				E00A82C19(_t64, L"utf-8\"></head>");
				_t72 = _t71 + 0x18;
				_t67 = _t60;
				_t28 = 0x20;
				if( *_t60 != _t28) {
					L4:
					_t29 = E00A70101(_t76, _t67, L"<html>", 6);
					asm("sbb al, al");
					_t31 =  ~_t29 + 1;
					 *((intOrPtr*)(_t72 + 0x14)) = _t31;
					if(_t31 != 0) {
						_t9 = _t67 + 0xc; // 0xc
						_t60 = _t9;
					}
					E00A82C19(_t64, _t60);
					if( *((char*)(_t72 + 0x1c)) == 0) {
						E00A82C19(_t64, L"</html>");
					}
					_t79 =  *((char*)(_t72 + 0x1c));
					if( *((char*)(_t72 + 0x1c)) == 0) {
						_push(_t64);
						_t64 = E00A777FB(_t58, _t79);
					}
					_t69 = 9 + E00A816B5(_t64) * 6;
					_t62 = GlobalAlloc(0x40, _t69);
					if(_t62 != 0) {
						_t12 = _t69 - 3; // -3
						_t13 = _t62 + 3; // 0x3
						if(WideCharToMultiByte(0xfde9, 0, _t64, 0xffffffff, _t13, _t12, 0, 0) == 0) {
							 *_t62 = 0;
						} else {
							 *_t62 = 0xbbef;
							 *((char*)(_t62 + 2)) = 0xbf;
						}
					}
					L00A816D0(_t64);
					_t24 =  *0xa99b8c(_t62, 1, _t72 + 0x10);
					if(_t24 >= 0) {
						E00A7749E(_t43,  *((intOrPtr*)(_t43 + 0x10)));
						_t38 =  *((intOrPtr*)(_t72 + 0xc));
						_t24 =  *((intOrPtr*)( *_t38 + 8))(_t38,  *((intOrPtr*)(_t72 + 0xc)));
					}
					goto L16;
				} else {
					goto L3;
				}
				do {
					L3:
					_t67 = _t67 + 2;
					_t76 =  *_t67 - _t28;
				} while ( *_t67 == _t28);
				goto L4;
			}

0x00a775ed
0x00a775f0
0x00a775f6
0x00a77732
0x00a77732
0x00a775fc
0x00a77603
0x00a7760e
0x00a7761e
0x00a7761f
0x00a77624
0x00a7762a
0x00a7772d
0x00000000
0x00a7772e
0x00a77637
0x00a77642
0x00a7764d
0x00a77652
0x00a77655
0x00a77659
0x00a7765d
0x00a77668
0x00a77670
0x00a77677
0x00a77679
0x00a7767b
0x00a7767f
0x00a77681
0x00a77681
0x00a77681
0x00a77686
0x00a77692
0x00a7769a
0x00a776a0
0x00a776a1
0x00a776a6
0x00a776a8
0x00a776b0
0x00a776b0
0x00a776bc
0x00a776c8
0x00a776cc
0x00a776d0
0x00a776d6
0x00a776eb
0x00a776f8
0x00a776ed
0x00a776ed
0x00a776f2
0x00a776f2
0x00a776eb
0x00a776fc
0x00a7770a
0x00a77713
0x00a7771e
0x00a77723
0x00a7772a
0x00a7772a
0x00000000
0x00000000
0x00000000
0x00000000
0x00a7765f
0x00a7765f
0x00a7765f
0x00a77662
0x00a77662
0x00000000

APIs

_wcslen.LIBCMT ref: 00A77612
_wcslen.LIBCMT ref: 00A776B3
GlobalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,?,?,?,?,00A77E1E,?), ref: 00A776C2
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,-00000003,00000000,00000000), ref: 00A776E3

Strings

<html>, xrefs: 00A77631, 00A7766A
utf-8"></head>, xrefs: 00A77647
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 00A7763C
</html>, xrefs: 00A77694

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: _wcslen$AllocByteCharGlobalMultiWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 1116704506-4209811716
Opcode ID: a7086d6f3767b56ca0f63f013c7349045959d80df262a8a716fc2c089fa3b22d
Instruction ID: d9af42e8e00eb8c899a3dc96d8ab99d9c9eeb858b12f3e3e4ff35e6a1d3b1032
Opcode Fuzzy Hash: a7086d6f3767b56ca0f63f013c7349045959d80df262a8a716fc2c089fa3b22d
Instruction Fuzzy Hash: 5B314672108301BED714BB74DC46F6F77ACEF41360F10C52AF458961C1EB71880683A5

Uniqueness

Uniqueness Score: -1.00%

Function 00A800D3 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E00A800D3(void* __ecx, void* __edx) {
				void* _t4;
				void* _t11;
				void* _t16;
				long _t26;
				void* _t29;

				if( *0xa99210 != 0xffffffff) {
					_t26 = GetLastError();
					_t11 = E00A81404(__eflags,  *0xa99210);
					__eflags = _t11 - 0xffffffff;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						__eflags = _t11;
						if(__eflags == 0) {
							_t4 = E00A8143E(__eflags,  *0xa99210, 0xffffffff);
							_pop(_t16);
							__eflags = _t4;
							if(_t4 != 0) {
								_t29 = E00A85277(_t16, 1, 0x28);
								__eflags = _t29;
								if(__eflags == 0) {
									L8:
									_t11 = 0;
									E00A8143E(__eflags,  *0xa99210, 0);
								} else {
									__eflags = E00A8143E(__eflags,  *0xa99210, _t29);
									if(__eflags != 0) {
										_t11 = _t29;
										_t29 = 0;
										__eflags = 0;
									} else {
										goto L8;
									}
								}
								E00A851AC(_t29);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t26);
					return _t11;
				} else {
					return 0;
				}
			}

0x00a800da
0x00a800ed
0x00a800f4
0x00a800f7
0x00a800fa
0x00a80113
0x00a80113
0x00a800fc
0x00a800fc
0x00a800fe
0x00a80108
0x00a8010e
0x00a8010f
0x00a80111
0x00a80121
0x00a80125
0x00a80127
0x00a8013b
0x00a8013b
0x00a80144
0x00a80129
0x00a80137
0x00a80139
0x00a8014d
0x00a8014f
0x00a8014f
0x00000000
0x00000000
0x00000000
0x00a80139
0x00a80152
0x00000000
0x00000000
0x00000000
0x00a80111
0x00a800fe
0x00a8015a
0x00a80164
0x00a800dc
0x00a800de
0x00a800de

APIs

GetLastError.KERNEL32(?,?,00A800CA,00A7D428), ref: 00A800E1
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00A800EF
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00A80108
SetLastError.KERNEL32(00000000,?,00A800CA,00A7D428), ref: 00A8015A

Strings

@Mqt0Lqt, xrefs: 00A800E1

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID: @Mqt0Lqt
API String ID: 3852720340-1302913217
Opcode ID: aa2d3b4478f1f8b54232109c8a741b3af83345d247fb180438359693cf7bf046
Instruction ID: 5229bf69c20a35f3f37135b7fe6c2a99b3f88e6dd0eb20ce721defbf502592ef
Opcode Fuzzy Hash: aa2d3b4478f1f8b54232109c8a741b3af83345d247fb180438359693cf7bf046
Instruction Fuzzy Hash: 7901247238A6117EA76477B8ACCAEA72A58EB11374B20032EF520951E1EF114C169340

Uniqueness

Uniqueness Score: -1.00%

Function 00A7ADB9 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 169
COMMON

Download Yara Rule

C-Code - Quality: 41%

			E00A7ADB9(char _a4, char* _a8, char* _a16, signed short* _a20, signed short* _a24, int _a32, void* _a48, char _a52, intOrPtr _a56, char _a64, struct HWND__* _a4160, signed short* _a4168, intOrPtr _a4172) {
				long _v12;
				void* __edi;
				int _t48;
				signed int _t51;
				signed short* _t52;
				intOrPtr _t63;
				int _t72;
				signed int _t75;
				signed short* _t76;
				signed short* _t78;
				char _t80;
				struct HWND__* _t82;
				signed short _t83;
				signed short* _t85;
				void* _t87;
				void* _t89;
				void* _t92;

				_t48 = 0x1040;
				E00A7C240();
				_t85 = _a4168;
				_t72 = 0;
				if( *_t85 == 0) {
					L50:
					return _t48;
				}
				_t48 = E00A816B5(_t85);
				if(0x1040 >= 0x7f6) {
					goto L50;
				} else {
					_t80 = 0x3c;
					E00A7D1E0(_t80,  &_a4, 0, _t80);
					_t75 =  *_t85 & 0x0000ffff;
					_t78 =  &(_t85[1]);
					_t92 = _t92 + 0xc;
					_a4 = _t80;
					_a8 = 0x1c0;
					_t89 = 0x22;
					if(_t75 != _t89) {
						_t78 = _t85;
					}
					_a20 = _t78;
					_t51 = _t72;
					if(_t75 == 0) {
						L15:
						_t52 = _a24;
						goto L16;
					} else {
						_t76 = _t85;
						_t83 = 0x20;
						do {
							if( *_t76 != _t89) {
								L12:
								if(_t85[_t51] == _t83) {
									L43:
									_t85[_t51] = 0;
									L44:
									_t52 =  &(_t85[_t51 + 1]);
									_a24 = _t52;
									L16:
									if(_t52 == 0 ||  *_t52 == _t72) {
										if(_a4172 == _t72 &&  *0xaa975a != _t72) {
											_a24 = 0xaa975a;
										}
									}
									_a32 = 1;
									_t87 = E00A6AA4A(_t78);
									if(_t87 != 0 && E00A700DF(_t87, L".inf") == 0) {
										_a16 = L"Install";
									}
									if(E00A69820(_a20) != 0) {
										_push(0x800);
										_push( &_a64);
										_push(_a20);
										E00A6A7D3(_t78);
										_a8 =  &_a52;
									}
									_t48 =  *0xa99a88( &_a4);
									if(_t48 != 0) {
										_t82 = _a4160;
										if( *0xaa8750 != _t72 || _a4168 != _t72 ||  *0xab4e1c != _t72) {
											if(_t82 != 0) {
												_push(_t82);
												if( *0xa99ac4() != 0) {
													ShowWindow(_t82, _t72);
													_t72 = 1;
												}
											}
											 *0xa99ac0(_a56, 0x7d0);
											E00A7B266(_a48);
											if( *0xab4e1c != 0 && GetExitCodeProcess(_a48,  &_v12) != 0) {
												_t63 = _v12 + 0x3e8;
												if(_t63 >  *0xab4e20) {
													 *0xab4e20 = _t63;
												}
											}
										}
										CloseHandle(_a48);
										if(_t87 == 0 || E00A700DF(_t87, L".exe") != 0) {
											_t48 = _a4160;
											if( *0xaa8750 != 0 && _t48 == 0) {
												 *0xab4e24 = 0x1b58;
											}
										} else {
											_t48 = _a4160;
										}
										if(_t72 != 0 && _t48 != 0) {
											_t48 = ShowWindow(_t82, 1);
										}
									}
									goto L50;
								}
								if( *((short*)(_t85 + 2 + _t51 * 2)) == 0x2f) {
									if(_t85[_t51] != _t83) {
										goto L44;
									}
									goto L43;
								}
							} else {
								while(1) {
									_t51 = _t51 + 1;
									if(_t85[_t51] == _t72) {
										goto L12;
									}
									if(_t85[_t51] == _t89) {
										_t85[_t51] = _t83;
										goto L12;
									}
								}
								goto L12;
							}
							_t51 = _t51 + 1;
							_t76 =  &(_t85[_t51]);
						} while ( *_t76 != _t72);
						goto L15;
					}
				}
			}

0x00a7adb9
0x00a7adbe
0x00a7adc5
0x00a7adcc
0x00a7add1
0x00a7afe0
0x00a7afe8
0x00a7afe8
0x00a7add8
0x00a7ade3
0x00000000
0x00a7ade9
0x00a7aded
0x00a7adf5
0x00a7adfa
0x00a7adfd
0x00a7ae00
0x00a7ae03
0x00a7ae07
0x00a7ae11
0x00a7ae15
0x00a7ae17
0x00a7ae17
0x00a7ae19
0x00a7ae1d
0x00a7ae22
0x00a7ae62
0x00a7ae62
0x00000000
0x00a7ae24
0x00a7ae26
0x00a7ae28
0x00a7ae29
0x00a7ae2c
0x00a7ae43
0x00a7ae47
0x00a7afb7
0x00a7afb9
0x00a7afbd
0x00a7afbe
0x00a7afc1
0x00a7ae66
0x00a7ae68
0x00a7ae76
0x00a7ae81
0x00a7ae81
0x00a7ae76
0x00a7ae8a
0x00a7ae97
0x00a7ae9b
0x00a7aeac
0x00a7aeac
0x00a7aebf
0x00a7aec1
0x00a7aeca
0x00a7aecb
0x00a7aecf
0x00a7aed8
0x00a7aed8
0x00a7aee1
0x00a7aee9
0x00a7aeef
0x00a7af02
0x00a7af17
0x00a7af19
0x00a7af22
0x00a7af26
0x00a7af28
0x00a7af28
0x00a7af22
0x00a7af33
0x00a7af3d
0x00a7af49
0x00a7af62
0x00a7af6d
0x00a7af6f
0x00a7af6f
0x00a7af6d
0x00a7af49
0x00a7af78
0x00a7af80
0x00a7af98
0x00a7af9f
0x00a7afa5
0x00a7afa5
0x00a7afca
0x00a7afca
0x00a7afca
0x00a7afd3
0x00a7afdc
0x00a7afdc
0x00a7afd3
0x00000000
0x00a7afdf
0x00a7ae53
0x00a7afb5
0x00000000
0x00000000
0x00000000
0x00a7afb5
0x00a7ae2e
0x00a7ae36
0x00a7ae36
0x00a7ae3b
0x00a7ae3d
0x00a7ae3d
0x00a7ae34
0x00a7ae3f
0x00000000
0x00a7ae3f
0x00a7ae34
0x00000000
0x00a7ae36
0x00a7ae59
0x00a7ae5a
0x00a7ae5d
0x00000000
0x00a7ae29
0x00a7ae22

APIs

_wcslen.LIBCMT ref: 00A7ADD8
ShowWindow.USER32(?,00000000,?,?,?,?,?,?,?), ref: 00A7AF26
GetExitCodeProcess.KERNEL32 ref: 00A7AF54
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00A7AF78
ShowWindow.USER32(?,00000001,?,?,?,?,?,?,?), ref: 00A7AFDC

Strings

.inf, xrefs: 00A7AE9D
.exe, xrefs: 00A7AF82

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: ShowWindow$CloseCodeExitHandleProcess_wcslen
String ID: .exe$.inf
API String ID: 783751319-3750412487
Opcode ID: 091e0823c3dd6b57c3eaaec5668ec6e6ba026556d64d9d4cc14efc0f6cb32c15
Instruction ID: 12c2c8ba2d3b2e0543f2630ada83bed0a2260945284d47e4e13ee68163cb25bf
Opcode Fuzzy Hash: 091e0823c3dd6b57c3eaaec5668ec6e6ba026556d64d9d4cc14efc0f6cb32c15
Instruction Fuzzy Hash: 0151FFB0504390BADB32AB64DD10AAFB7F8AFE4340F04C81DF489931A1E7B19985D753

Uniqueness

Uniqueness Score: -1.00%

Function 00A77AD8 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 163
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00A77AD8(void* __ecx, void* __eflags, signed short* _a4) {
				char _v0;
				char _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				signed short* _t22;
				signed short* _t23;
				signed int _t25;
				signed short _t26;
				signed int _t29;
				signed int _t31;
				signed short* _t32;
				void* _t33;
				void* _t39;
				signed short* _t40;
				signed int _t46;
				signed short _t47;
				intOrPtr _t48;
				signed int _t49;
				signed short _t50;
				signed short* _t51;
				signed short* _t53;
				signed short* _t54;
				signed short* _t55;
				signed short* _t64;

				_t42 = __ecx;
				_t54 = _a4;
				_push(2 + E00A816B5(_t54) * 2);
				_t22 = E00A82C59(_t42);
				_t55 = _t22;
				if(_t55 == 0) {
					return _t22;
				}
				_t23 = E00A77467(_t54);
				_t46 =  *_t54 & 0x0000ffff;
				_t53 = _t55;
				_v0 = _t23;
				if(_t46 == 0) {
					L47:
					return _t55;
				}
				_v8 = 0xd;
				_v4 = 0xa;
				_t50 = 0x20;
				_v12 = 0x3e;
				while(1) {
					_t60 = _t46;
					if(_t46 != 0) {
						goto L3;
					}
					L28:
					_t25 = E00A70101(_t60, _t54, L"</p>", 4);
					asm("sbb bl, bl");
					_t39 =  ~_t25 + 1;
					_t61 = _t39;
					if(_t39 != 0 || E00A70101(_t61, _t54, L"<br>", 4) == 0) {
						_t26 = 0xd;
						 *_t53 = _t26;
						_t47 = 0xa;
						_t53[1] = _t47;
						_t53 =  &(_t53[2]);
						if(_t39 != 0) {
							 *_t53 = _t26;
							_t53[1] = _t47;
							_t53 =  &(_t53[2]);
							_t64 = _t53;
						}
					}
					 *_t53 = 0;
					if(E00A70101(_t64, _t54, L"<style>", 7) != 0) {
						_t29 =  *_t54 & 0x0000ffff;
						__eflags = _t29;
						if(_t29 == 0) {
							L42:
							__eflags =  *_t54 - _v12;
							if( *_t54 != _v12) {
								L44:
								_t40 = 0;
								__eflags = 0;
								goto L45;
							}
							L43:
							_t54 =  &(_t54[1]);
							__eflags = _t54;
							goto L44;
						}
						_t48 = _v12;
						while(1) {
							__eflags = _t29 - _t48;
							if(_t29 == _t48) {
								goto L43;
							}
							_t54 =  &(_t54[1]);
							_t29 =  *_t54 & 0x0000ffff;
							__eflags = _t29;
							if(_t29 != 0) {
								continue;
							}
							goto L42;
						}
						goto L43;
					} else {
						_t40 = 0;
						_t66 =  *_t54;
						if( *_t54 == 0) {
							L46:
							goto L47;
						} else {
							goto L34;
						}
						while(1) {
							L34:
							_t33 = E00A70101(_t66, _t54, L"</style>", 8);
							_t54 =  &(_t54[1]);
							if(_t33 == 0) {
								break;
							}
							if( *_t54 != _t40) {
								continue;
							}
							L45:
							_t46 =  *_t54 & 0x0000ffff;
							_t23 = _a4;
							_t50 = 0x20;
							if(_t46 != 0) {
								goto L3;
							}
							goto L46;
						}
						_t54 =  &(_t54[7]);
						goto L45;
					}
					L3:
					__eflags = _t46 - 0x3c;
					if(__eflags == 0) {
						goto L28;
					}
					__eflags = _t23;
					if(_t23 == 0) {
						L19:
						_t31 =  *_t54 & 0x0000ffff;
						__eflags = _t31;
						if(__eflags == 0) {
							goto L28;
						}
						__eflags = _t31 - _t50;
						if(_t31 != _t50) {
							L23:
							 *_t53 = _t31;
							_t53 =  &(_t53[1]);
							__eflags = _t53;
							L24:
							_t54 =  &(_t54[1]);
							__eflags = _t54;
							L25:
							_t23 = _a4;
							_t40 = 0;
							__eflags = 0;
							L26:
							_t46 =  *_t54 & 0x0000ffff;
							continue;
						}
						__eflags = _t53 - _t55;
						if(_t53 == _t55) {
							goto L23;
						}
						__eflags =  *((intOrPtr*)(_t53 - 2)) - _t50;
						if( *((intOrPtr*)(_t53 - 2)) == _t50) {
							goto L24;
						}
						goto L23;
					}
					__eflags = _t46 - _v8;
					if(_t46 == _v8) {
						L7:
						__eflags = _t53 - _t55;
						if(_t53 == _t55) {
							L9:
							 *_t53 = _t50;
							_t53 =  &(_t53[1]);
							__eflags = _t53;
							L10:
							_t54 =  &(_t54[1]);
							goto L26;
						}
						__eflags =  *((intOrPtr*)(_t53 - 2)) - _t50;
						if(__eflags == 0) {
							goto L10;
						}
						goto L9;
					}
					_t9 =  &_v4; // 0xd
					__eflags = _t46 -  *_t9;
					if(_t46 !=  *_t9) {
						__eflags = _t23;
						if(_t23 == 0) {
							goto L19;
						}
						__eflags = _t46 - 0x26;
						if(_t46 != 0x26) {
							goto L19;
						}
						_t32 = 0;
						__eflags = 0;
						do {
							_t51 = _t32 + _t54;
							_t49 =  *_t51 & 0x0000ffff;
							__eflags = _t49;
							if(_t49 == 0) {
								break;
							}
							__eflags = _t49 - 0x3b;
							if(_t49 == 0x3b) {
								_t54 =  &(_t51[1]);
								_t40 = 1;
							}
							_t32 = _t32 + 2;
							__eflags = _t32 - 0x28;
						} while (_t32 < 0x28);
						_t50 = 0x20;
						__eflags = _t40;
						if(_t40 != 0) {
							goto L25;
						}
						goto L19;
					}
					goto L7;
				}
			}

0x00a77ad8
0x00a77add
0x00a77af1
0x00a77af2
0x00a77af7
0x00a77afd
0x00a77c9d
0x00a77c9d
0x00a77b06
0x00a77b0b
0x00a77b0e
0x00a77b10
0x00a77b17
0x00a77c95
0x00000000
0x00a77c95
0x00a77b20
0x00a77b2a
0x00a77b32
0x00a77b33
0x00a77bca
0x00a77bca
0x00a77bcd
0x00000000
0x00000000
0x00a77bd3
0x00a77bdb
0x00a77be4
0x00a77be6
0x00a77be6
0x00a77be9
0x00a77bfe
0x00a77c01
0x00a77c04
0x00a77c05
0x00a77c09
0x00a77c0e
0x00a77c10
0x00a77c13
0x00a77c17
0x00a77c17
0x00a77c17
0x00a77c0e
0x00a77c24
0x00a77c2e
0x00a77c57
0x00a77c5a
0x00a77c5d
0x00a77c73
0x00a77c77
0x00a77c7a
0x00a77c7f
0x00a77c7f
0x00a77c7f
0x00000000
0x00a77c7f
0x00a77c7c
0x00a77c7c
0x00a77c7c
0x00000000
0x00a77c7c
0x00a77c5f
0x00a77c63
0x00a77c63
0x00a77c66
0x00000000
0x00000000
0x00a77c68
0x00a77c6b
0x00a77c6e
0x00a77c71
0x00000000
0x00000000
0x00000000
0x00a77c71
0x00000000
0x00a77c30
0x00a77c30
0x00a77c32
0x00a77c35
0x00a77c94
0x00000000
0x00000000
0x00000000
0x00000000
0x00a77c37
0x00a77c37
0x00a77c3f
0x00a77c44
0x00a77c49
0x00000000
0x00000000
0x00a77c4e
0x00000000
0x00000000
0x00a77c81
0x00a77c81
0x00a77c84
0x00a77c8a
0x00a77c8e
0x00000000
0x00000000
0x00000000
0x00a77c8e
0x00a77c52
0x00000000
0x00a77c52
0x00a77b40
0x00a77b40
0x00a77b44
0x00000000
0x00000000
0x00a77b4a
0x00a77b4c
0x00a77ba1
0x00a77ba1
0x00a77ba4
0x00a77ba7
0x00000000
0x00000000
0x00a77ba9
0x00a77bac
0x00a77bb8
0x00a77bb8
0x00a77bbb
0x00a77bbb
0x00a77bbe
0x00a77bbe
0x00a77bbe
0x00a77bc1
0x00a77bc1
0x00a77bc5
0x00a77bc5
0x00a77bc7
0x00a77bc7
0x00000000
0x00a77bc7
0x00a77bae
0x00a77bb0
0x00000000
0x00000000
0x00a77bb2
0x00a77bb6
0x00000000
0x00000000
0x00000000
0x00a77bb6
0x00a77b4e
0x00a77b53
0x00a77b5c
0x00a77b5c
0x00a77b5e
0x00a77b66
0x00a77b66
0x00a77b69
0x00a77b69
0x00a77b6c
0x00a77b6c
0x00000000
0x00a77b6c
0x00a77b60
0x00a77b64
0x00000000
0x00000000
0x00000000
0x00a77b64
0x00a77b55
0x00a77b55
0x00a77b5a
0x00a77b71
0x00a77b73
0x00000000
0x00000000
0x00a77b75
0x00a77b79
0x00000000
0x00000000
0x00a77b7b
0x00a77b7b
0x00a77b7d
0x00a77b7d
0x00a77b80
0x00a77b83
0x00a77b86
0x00000000
0x00000000
0x00a77b88
0x00a77b8b
0x00a77b8d
0x00a77b90
0x00a77b90
0x00a77b92
0x00a77b95
0x00a77b95
0x00a77b9c
0x00a77b9d
0x00a77b9f
0x00000000
0x00000000
0x00000000
0x00a77b9f
0x00000000
0x00a77b5a

APIs

_wcslen.LIBCMT ref: 00A77AE5

Strings

</p>, xrefs: 00A77BD5
<br>, xrefs: 00A77BED
</style>, xrefs: 00A77C39
0vt>, xrefs: 00A77B4E
>, xrefs: 00A77B33
<style>, xrefs: 00A77C1C

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: _wcslen
String ID: 0vt>$</p>$</style>$<br>$<style>$>
API String ID: 176396367-3509320963
Opcode ID: 1792dee1ba9ca8512a7d4f2ffb9b2f3b024db65caeb7b6fddd9733450a7c5d12
Instruction ID: c85aced40a03a3346bb9bcb353679459b2b571da5730fb0ba507042c240f0f04
Opcode Fuzzy Hash: 1792dee1ba9ca8512a7d4f2ffb9b2f3b024db65caeb7b6fddd9733450a7c5d12
Instruction Fuzzy Hash: 9941166260831295CB31AF548C52B7FB3B0EFA4750F59C82AE9CE57281F7A589858391

Uniqueness

Uniqueness Score: -1.00%

Function 00A68C49 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 137
fileCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00A68C49(void* __ecx) {
				void* _t31;
				short _t32;
				long _t34;
				void* _t39;
				short _t41;
				void* _t65;
				intOrPtr _t68;
				void* _t76;
				intOrPtr _t79;
				void* _t82;
				WCHAR* _t83;
				void* _t85;
				void* _t87;

				E00A7C16C(E00A8ED5B, _t85);
				E00A7C240();
				_t83 =  *(_t85 + 8);
				_t31 = _t85 - 0x4030;
				__imp__GetLongPathNameW(_t83, _t31, 0x800, _t76, _t82, _t65);
				if(_t31 == 0 || _t31 >= 0x800) {
					L20:
					_t32 = 0;
					__eflags = 0;
				} else {
					_t34 = GetShortPathNameW(_t83, _t85 - 0x5030, 0x800);
					if(_t34 == 0) {
						goto L20;
					} else {
						_t92 = _t34 - 0x800;
						if(_t34 >= 0x800) {
							goto L20;
						} else {
							 *(_t85 + 8) = E00A6B1D0(_t92, _t85 - 0x4030);
							_t78 = E00A6B1D0(_t92, _t85 - 0x5030);
							_t68 = 0;
							if( *_t38 == 0) {
								goto L20;
							} else {
								_t39 = E00A700DF( *(_t85 + 8), _t78);
								_t94 = _t39;
								if(_t39 == 0) {
									goto L20;
								} else {
									_t41 = E00A700DF(E00A6B1D0(_t94, _t83), _t78);
									if(_t41 != 0) {
										goto L20;
									} else {
										 *(_t85 - 0x100c) = _t41;
										_t79 = 0;
										while(1) {
											_t96 = _t41;
											if(_t41 != 0) {
												break;
											}
											E00A6E847(_t85 - 0x100c, _t83, 0x800);
											E00A63CE2(E00A6B1D0(_t96, _t85 - 0x100c), 0x800, L"rtmp%d", _t79);
											_t87 = _t87 + 0x10;
											if(E00A69820(_t85 - 0x100c) == 0) {
												_t41 =  *(_t85 - 0x100c);
											} else {
												_t41 = 0;
												 *(_t85 - 0x100c) = 0;
											}
											_t79 = _t79 + 0x7b;
											if(_t79 < 0x2710) {
												continue;
											} else {
												_t99 = _t41;
												if(_t41 == 0) {
													goto L20;
												} else {
													break;
												}
											}
											goto L21;
										}
										E00A6E847(_t85 - 0x3030, _t83, 0x800);
										_push(0x800);
										E00A6B23F(_t99, _t85 - 0x3030,  *(_t85 + 8));
										if(MoveFileW(_t85 - 0x3030, _t85 - 0x100c) == 0) {
											goto L20;
										} else {
											E00A68E1D(_t85 - 0x2030);
											 *((intOrPtr*)(_t85 - 4)) = _t68;
											if(E00A69820(_t83) == 0) {
												_push(0x12);
												_push(_t83);
												_t68 = E00A68F0D(_t85 - 0x2030);
											}
											MoveFileW(_t85 - 0x100c, _t85 - 0x3030);
											if(_t68 != 0) {
												E00A68EBF(_t85 - 0x2030);
												E00A69009(_t85 - 0x2030);
											}
											E00A68E53(_t85 - 0x2030);
											_t32 = 1;
										}
									}
								}
							}
						}
					}
				}
				L21:
				 *[fs:0x0] =  *((intOrPtr*)(_t85 - 0xc));
				return _t32;
			}

0x00a68c4e
0x00a68c58
0x00a68c5f
0x00a68c62
0x00a68c71
0x00a68c79
0x00a68e08
0x00a68e08
0x00a68e08
0x00a68c87
0x00a68c90
0x00a68c98
0x00000000
0x00a68c9e
0x00a68c9e
0x00a68ca0
0x00000000
0x00a68ca6
0x00a68cb2
0x00a68cc1
0x00a68cc3
0x00a68cc8
0x00000000
0x00a68cce
0x00a68cd2
0x00a68cd7
0x00a68cd9
0x00000000
0x00a68cdf
0x00a68ce7
0x00a68cee
0x00000000
0x00a68cf4
0x00a68cf4
0x00a68cfb
0x00a68cfd
0x00a68cfd
0x00a68d00
0x00000000
0x00000000
0x00a68d0f
0x00a68d2c
0x00a68d31
0x00a68d42
0x00a68d4f
0x00a68d44
0x00a68d44
0x00a68d46
0x00a68d46
0x00a68d56
0x00a68d5f
0x00000000
0x00a68d61
0x00a68d61
0x00a68d64
0x00000000
0x00000000
0x00000000
0x00000000
0x00a68d64
0x00000000
0x00a68d5f
0x00a68d78
0x00a68d7d
0x00a68d88
0x00a68da5
0x00000000
0x00a68da7
0x00a68dad
0x00a68db3
0x00a68dbd
0x00a68dbf
0x00a68dc1
0x00a68dcd
0x00a68dcd
0x00a68ddd
0x00a68de1
0x00a68de9
0x00a68df4
0x00a68df4
0x00a68dff
0x00a68e04
0x00a68e04
0x00a68da5
0x00a68cee
0x00a68cd9
0x00a68cc8
0x00a68ca0
0x00a68c98
0x00a68e0a
0x00a68e10
0x00a68e1a

APIs

__EH_prolog.LIBCMT ref: 00A68C4E
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 00A68C71
GetShortPathNameW.KERNEL32 ref: 00A68C90

Part of subcall function 00A6B1D0: _wcslen.LIBCMT ref: 00A6B1D7

Part of subcall function 00A700DF: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,00A6A645,?,?,?,00A6A5F2,?,-00000002,?,00000000,?), ref: 00A700F5

_swprintf.LIBCMT ref: 00A68D2C

Part of subcall function 00A63CE2: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00A63CF5

MoveFileW.KERNEL32(?,?), ref: 00A68DA1
MoveFileW.KERNEL32(?,?), ref: 00A68DDD

Strings

rtmp%d, xrefs: 00A68D15

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf_wcslen
String ID: rtmp%d
API String ID: 3726343395-3303766350
Opcode ID: c91ab5ecc087efb84fa82a1637c12c7812bed22c42e7b55ce06d1bc61ef27610
Instruction ID: ca1f3e9314aeeafcec53626aeefe12177b35aa58fa5218abdd92274825c86406
Opcode Fuzzy Hash: c91ab5ecc087efb84fa82a1637c12c7812bed22c42e7b55ce06d1bc61ef27610
Instruction Fuzzy Hash: 0B416076911159AADF20EBA0CE54EEA737CAF15740F0446A5B509E3042EF39DB85CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00A7ACC3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82
windowCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00A7ACC3(void* __edx, void* __eflags, void* __fp0, struct HWND__* _a4) {
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				short _v4124;
				void* _t10;
				struct HWND__* _t11;
				void* _t21;
				void* _t27;
				void* _t29;
				long _t32;
				struct HWND__* _t34;
				void* _t46;

				_t46 = __fp0;
				_t29 = __edx;
				E00A7C240();
				_t10 = E00A78117(__eflags);
				if(_t10 == 0) {
					return _t10;
				}
				_t11 = GetWindow(_a4, 5);
				_t34 = _t11;
				_t27 = 0;
				_a4 = _t34;
				if(_t34 == 0) {
					L12:
					return _t11;
				} else {
					while(_t27 < 0x200) {
						GetClassNameW(_t34,  &_v4124, 0x800);
						if(E00A700DF( &_v4124, L"STATIC") == 0 && (GetWindowLongW(_t34, 0xfffffff0) & 0x0000001f) == 0xe) {
							_t32 = SendMessageW(_t34, 0x173, 0, 0);
							if(_t32 != 0) {
								 *0xa99a70(_t32, 0x18,  &_v28);
								_t21 = E00A78179(_v20);
								SendMessageW(_t34, 0x172, 0, E00A78226(_t29, _t46, _t32, E00A78136(_v24), _t21));
								if(_t32 !=  *0xab4e10) {
									 *0xa99a68(_t32);
								}
							}
						}
						_t11 = GetWindow(_t34, 2);
						_t34 = _t11;
						if(_t34 != _a4) {
							_t27 = _t27 + 1;
							if(_t34 != 0) {
								continue;
							}
						}
						break;
					}
					goto L12;
				}
			}

0x00a7acc3
0x00a7acc3
0x00a7accb
0x00a7acd0
0x00a7acd7
0x00a7adb6
0x00a7adb6
0x00a7ace4
0x00a7acea
0x00a7acec
0x00a7acee
0x00a7acf3
0x00a7adb1
0x00000000
0x00a7acf9
0x00a7acfa
0x00a7ad13
0x00a7ad2c
0x00a7ad4e
0x00a7ad52
0x00a7ad5b
0x00a7ad64
0x00a7ad82
0x00a7ad8e
0x00a7ad91
0x00a7ad91
0x00a7ad8e
0x00a7ad52
0x00a7ad9a
0x00a7ada0
0x00a7ada5
0x00a7ada7
0x00a7adaa
0x00000000
0x00000000
0x00a7adaa
0x00000000
0x00a7ada5
0x00000000
0x00a7adb0

APIs

GetWindow.USER32(?,00000005), ref: 00A7ACE4
GetClassNameW.USER32(00000000,?,00000800), ref: 00A7AD13

Part of subcall function 00A700DF: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,00A6A645,?,?,?,00A6A5F2,?,-00000002,?,00000000,?), ref: 00A700F5

GetWindowLongW.USER32(00000000,000000F0), ref: 00A7AD31
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 00A7AD48

Part of subcall function 00A78179: GetDC.USER32(00000000), ref: 00A78185
Part of subcall function 00A78179: GetDeviceCaps.GDI32(00000000,0000005A), ref: 00A78194
Part of subcall function 00A78179: ReleaseDC.USER32(00000000,00000000), ref: 00A781A2

Part of subcall function 00A78136: GetDC.USER32(00000000), ref: 00A78142
Part of subcall function 00A78136: GetDeviceCaps.GDI32(00000000,00000058), ref: 00A78151
Part of subcall function 00A78136: ReleaseDC.USER32(00000000,00000000), ref: 00A7815F

SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 00A7AD82
GetWindow.USER32(00000000,00000002), ref: 00A7AD9A

Strings

STATIC, xrefs: 00A7AD19

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: Window$CapsDeviceMessageReleaseSend$ClassCompareLongNameString
String ID: STATIC
API String ID: 3260123180-1882779555
Opcode ID: d85df173d0f2d3bd18cab5f1704ab245792188a01370d3dc0415c8e135161cf4
Instruction ID: 682e9fba2eb266a2ea5db3f127c6f879a63865227350f57cb7d55c737d0b6335
Opcode Fuzzy Hash: d85df173d0f2d3bd18cab5f1704ab245792188a01370d3dc0415c8e135161cf4
Instruction Fuzzy Hash: 302126326402147BEB32ABA8DC4AFFF362CEB50752F40C015F908B6492DF649D438AA5

Uniqueness

Uniqueness Score: -1.00%

Function 00A85B08 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 72%

			E00A85B08(void* __ebx, void* __ecx, void* __edx) {
				void* __edi;
				void* __esi;
				intOrPtr _t2;
				void* _t3;
				void* _t4;
				intOrPtr _t9;
				void* _t11;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t27;
				void* _t29;
				void* _t31;
				void* _t32;
				long _t36;
				long _t37;
				void* _t40;

				_t29 = __edx;
				_t23 = __ecx;
				_t20 = __ebx;
				_t36 = GetLastError();
				_t2 =  *0xa9923c; // 0x3
				_t42 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L2:
					_t3 = E00A85277(_t23, 1, 0x364);
					_t31 = _t3;
					_pop(_t25);
					if(_t31 != 0) {
						_t4 = E00A87137(_t25, _t36, __eflags,  *0xa9923c, _t31);
						__eflags = _t4;
						if(_t4 != 0) {
							E00A8597A(_t25, _t31, 0xab8420);
							E00A851AC(0);
							_t40 = _t40 + 0xc;
							__eflags = _t31;
							if(_t31 == 0) {
								goto L9;
							} else {
								goto L8;
							}
						} else {
							_push(_t31);
							goto L4;
						}
					} else {
						_push(_t3);
						L4:
						E00A851AC();
						_pop(_t25);
						L9:
						SetLastError(_t36);
						E00A85234(_t20, _t29, _t31, _t36);
						asm("int3");
						_push(_t20);
						_push(_t36);
						_push(_t31);
						_t37 = GetLastError();
						_t21 = 0;
						_t9 =  *0xa9923c; // 0x3
						_t45 = _t9 - 0xffffffff;
						if(_t9 == 0xffffffff) {
							L12:
							_t32 = E00A85277(_t25, 1, 0x364);
							_pop(_t27);
							if(_t32 != 0) {
								_t11 = E00A87137(_t27, _t37, __eflags,  *0xa9923c, _t32);
								__eflags = _t11;
								if(_t11 != 0) {
									E00A8597A(_t27, _t32, 0xab8420);
									E00A851AC(_t21);
									__eflags = _t32;
									if(_t32 != 0) {
										goto L19;
									} else {
										goto L18;
									}
								} else {
									_push(_t32);
									goto L14;
								}
							} else {
								_push(_t21);
								L14:
								E00A851AC();
								L18:
								SetLastError(_t37);
							}
						} else {
							_t32 = E00A870E1(_t25, _t37, _t45, _t9);
							if(_t32 != 0) {
								L19:
								SetLastError(_t37);
								_t21 = _t32;
							} else {
								goto L12;
							}
						}
						return _t21;
					}
				} else {
					_t31 = E00A870E1(_t23, _t36, _t42, _t2);
					if(_t31 != 0) {
						L8:
						SetLastError(_t36);
						return _t31;
					} else {
						goto L2;
					}
				}
			}

0x00a85b08
0x00a85b08
0x00a85b08
0x00a85b12
0x00a85b14
0x00a85b19
0x00a85b1c
0x00a85b2a
0x00a85b31
0x00a85b36
0x00a85b39
0x00a85b3c
0x00a85b4e
0x00a85b53
0x00a85b55
0x00a85b60
0x00a85b67
0x00a85b6c
0x00a85b6f
0x00a85b71
0x00000000
0x00000000
0x00000000
0x00000000
0x00a85b57
0x00a85b57
0x00000000
0x00a85b57
0x00a85b3e
0x00a85b3e
0x00a85b3f
0x00a85b3f
0x00a85b44
0x00a85b7f
0x00a85b80
0x00a85b86
0x00a85b8b
0x00a85b8e
0x00a85b8f
0x00a85b90
0x00a85b97
0x00a85b99
0x00a85b9b
0x00a85ba0
0x00a85ba3
0x00a85bb1
0x00a85bbd
0x00a85bc0
0x00a85bc3
0x00a85bd5
0x00a85bda
0x00a85bdc
0x00a85be7
0x00a85bed
0x00a85bf5
0x00a85bf7
0x00000000
0x00000000
0x00000000
0x00000000
0x00a85bde
0x00a85bde
0x00000000
0x00a85bde
0x00a85bc5
0x00a85bc5
0x00a85bc6
0x00a85bc6
0x00a85bf9
0x00a85bfa
0x00a85bfa
0x00a85ba5
0x00a85bab
0x00a85baf
0x00a85c02
0x00a85c03
0x00a85c09
0x00000000
0x00000000
0x00000000
0x00a85baf
0x00a85c10
0x00a85c10
0x00a85b1e
0x00a85b24
0x00a85b28
0x00a85b73
0x00a85b74
0x00a85b7e
0x00000000
0x00000000
0x00000000
0x00a85b28

APIs

GetLastError.KERNEL32(?,?,00A81C64,?,00000000,?,00A81803,00000200,00000000,?), ref: 00A85B0C
_free.LIBCMT ref: 00A85B3F
_free.LIBCMT ref: 00A85B67
SetLastError.KERNEL32(00000000,00000000,?), ref: 00A85B74
SetLastError.KERNEL32(00000000,00000000,?), ref: 00A85B80
_abort.LIBCMT ref: 00A85B86

Strings

@Mqt0Lqt, xrefs: 00A85B0C

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID: @Mqt0Lqt
API String ID: 3160817290-1302913217
Opcode ID: dea107e48b6f5a2dfa535be7201bebce589265e0d00b435e47e518d900244ab7
Instruction ID: 8505ce0ce69ee28898148c9f33416d122aa96dd2dcb0d37def4d6a1eef0f2e28
Opcode Fuzzy Hash: dea107e48b6f5a2dfa535be7201bebce589265e0d00b435e47e518d900244ab7
Instruction Fuzzy Hash: 22F08136D04D017AD612B7786D0EFAE26699FE1761F240125FD16961A2FE2588028364

Uniqueness

Uniqueness Score: -1.00%

Function 00A7749E Relevance: 12.1, APIs: 8, Instructions: 135
windowCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00A7749E(void* __ecx, intOrPtr* _a4) {
				struct tagMSG _v36;
				char _v44;
				char _v48;
				signed int _v52;
				intOrPtr* _v60;
				intOrPtr* _v64;
				signed int _v68;
				long _t35;
				intOrPtr* _t51;
				intOrPtr* _t53;
				intOrPtr* _t55;
				intOrPtr* _t57;
				WCHAR* _t70;
				signed int _t76;
				void* _t82;
				intOrPtr* _t83;
				signed int _t84;
				long _t85;

				_t82 = __ecx;
				_v36.hwnd = 0;
				_v36.message = 0;
				_t35 = GetTickCount();
				_t83 = _a4;
				_t85 = _t35;
				while(1) {
					_push( &_v36);
					_push(_t83);
					if( *((intOrPtr*)( *_t83 + 0x48))() >= 0 && _v44 != 0) {
						break;
					}
					if(GetTickCount() - _t85 > 0x7d0) {
						break;
					} else {
						if(PeekMessageW( &_v36, 0, 0, 0, 0) != 0) {
							GetMessageW( &_v36, 0, 0, 0);
							TranslateMessage( &_v36);
							DispatchMessageW( &_v36);
						}
						continue;
					}
				}
				_t84 =  *((intOrPtr*)( *_t83 + 0x48))(_t83,  &_v44);
				__eflags = _t84;
				if(_t84 < 0) {
					L15:
					__eflags =  *(_t82 + 8);
					if( *(_t82 + 8) != 0) {
						__eflags =  *(_t82 + 0x18);
						if( *(_t82 + 0x18) == 0) {
							__eflags =  *(_t82 + 0x14);
							if(__eflags != 0) {
								_t70 = E00A77AD8(_t82, __eflags,  *(_t82 + 0x14));
								__eflags = _t70;
								if(_t70 != 0) {
									 *0xa99b44( *((intOrPtr*)(_t82 + 4)), 1, 0, 0, 0, 0, 0x204);
									ShowWindow( *(_t82 + 8), 5);
									SetWindowTextW( *(_t82 + 8), _t70);
									L00A816D0(_t70);
								}
							}
						}
					}
					L20:
					__eflags = _t84;
					_t33 = _t84 > 0;
					__eflags = _t33;
					return 0 | _t33;
				}
				_t76 = _v52;
				__eflags = _t76;
				if(_t76 == 0) {
					L13:
					__eflags = _t84;
					if(_t84 < 0) {
						goto L15;
					}
					__eflags = _t76;
					if(_t76 != 0) {
						goto L20;
					}
					goto L15;
				}
				_t84 =  *((intOrPtr*)( *_t76))(_t76, 0xa907cc,  &_v48);
				__eflags = _t84;
				if(_t84 < 0) {
					L12:
					_t51 = _v64;
					 *((intOrPtr*)( *_t51 + 8))(_t51);
					_t76 = _v68;
					goto L13;
				}
				_t53 = _v60;
				_t84 =  *((intOrPtr*)( *_t53 + 0x20))(_t53);
				__eflags = _t84;
				if(_t84 >= 0) {
					_t57 = _v64;
					_t84 =  *((intOrPtr*)( *_t57 + 0x14))(_t57, _v36.lParam);
				}
				_t55 = _v64;
				 *((intOrPtr*)( *_t55 + 8))(_t55);
				goto L12;
			}

0x00a774ad
0x00a774af
0x00a774b3
0x00a774b7
0x00a774b9
0x00a774bd
0x00a774bf
0x00a774c5
0x00a774c6
0x00a774cc
0x00000000
0x00000000
0x00a774de
0x00000000
0x00a774e0
0x00a774f3
0x00a774ff
0x00a7750a
0x00a77515
0x00a77515
0x00000000
0x00a774f3
0x00a774de
0x00a77528
0x00a7752a
0x00a7752c
0x00a7758b
0x00a7758d
0x00a77590
0x00a77592
0x00a77595
0x00a77597
0x00a7759a
0x00a775a6
0x00a775a8
0x00a775aa
0x00a775ba
0x00a775c5
0x00a775cf
0x00a775d6
0x00a775db
0x00a775aa
0x00a7759a
0x00a77595
0x00a775dd
0x00a775df
0x00a775e3
0x00a775e3
0x00a775ea
0x00a775ea
0x00a7752e
0x00a77532
0x00a77534
0x00a77583
0x00a77583
0x00a77585
0x00000000
0x00000000
0x00a77587
0x00a77589
0x00000000
0x00000000
0x00000000
0x00a77589
0x00a77545
0x00a77547
0x00a77549
0x00a77575
0x00a77575
0x00a7757c
0x00a7757f
0x00000000
0x00a7757f
0x00a7754b
0x00a77555
0x00a77557
0x00a77559
0x00a7755b
0x00a77569
0x00a77569
0x00a7756b
0x00a77572
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00A774B7
GetTickCount.KERNEL32 ref: 00A774D5
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00A774EB
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00A774FF
TranslateMessage.USER32(?), ref: 00A7750A
DispatchMessageW.USER32(?), ref: 00A77515
ShowWindow.USER32(?,00000005,?,00000000,?,?,?,?,00000000,00000000,00000000,<html>,00000006), ref: 00A775C5
SetWindowTextW.USER32(?,00000000), ref: 00A775CF

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: Message$CountTickWindow$DispatchPeekShowTextTranslate
String ID:
API String ID: 4150546248-0
Opcode ID: bb19555dafcac6f2c2383af0cb10ecc0ca17b7c611da60acbeaf88110a8d4845
Instruction ID: 215373523d8fc3281fa547dbdf311ea557e8761044abef7afa35b477cfa63737
Opcode Fuzzy Hash: bb19555dafcac6f2c2383af0cb10ecc0ca17b7c611da60acbeaf88110a8d4845
Instruction Fuzzy Hash: 95413871608716AFD711DFA8DC8892FBBE8EF48751B04892DF949D7210DB21EC45CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A7A4CB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 144
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00A7A4CB(intOrPtr __ebx, void* __ecx, void* __edx) {
				intOrPtr _t215;
				void* _t216;
				intOrPtr _t269;
				void* _t282;
				WCHAR* _t283;
				void* _t285;
				WCHAR* _t286;
				void* _t291;

				L0:
				while(1) {
					L0:
					_t282 = __edx;
					_t269 = __ebx;
					if(__ebx != 1) {
						goto L112;
					}
					L96:
					__eax = __ebp - 0x7c84;
					GetTempPathW(0x800, __ebp - 0x7c84) = __ebp - 0x7c84;
					E00A6A7A3(__eflags, __ebp - 0x7c84, 0x800) = 0;
					_push(0);
					_push( *0xa9914c);
					__esi = 0;
					__ebp - 0x7c84 = __ebp - 0x103c;
					__eax = E00A63CE2(__ebp - 0x103c, 0x800, L"%s%s%d", __ebp - 0x7c84);
					while(1) {
						L98:
						__esp = __esp + 0x18;
						__eax = __ebp - 0x103c;
						__eax = GetFileAttributesW(__ebp - 0x103c);
						__eflags = __eax - 0xffffffff;
						if(__eax == 0xffffffff) {
							break;
						}
						L97:
						__esi =  &(__esi->i);
						__eflags = __esi;
						__eax = __ebp - 0x7c84;
						_push(__esi);
						_push( *0xa9914c);
						__ebp - 0x103c = E00A63CE2(__ebp - 0x103c, 0x800, L"%s%s%d", __ebp - 0x7c84);
					}
					L99:
					__ebp - 0x103c = SetDlgItemTextW( *(__ebp + 8), 0x66, __ebp - 0x103c);
					__eflags =  *(__ebp - 0x5c84);
					if( *(__ebp - 0x5c84) == 0) {
						while(1) {
							L164:
							_push(0x1000);
							_t203 = _t291 - 0xe; // -14
							_t204 = _t291 - 0xd; // -13
							_t205 = _t291 - 0x5c84; // -23684
							_t206 = _t291 - 0xfc8c; // -64652
							_push( *((intOrPtr*)(_t291 + 0xc)));
							_t215 = E00A78BD1();
							_t269 =  *((intOrPtr*)(_t291 + 0x10));
							 *((intOrPtr*)(_t291 + 0xc)) = _t215;
							if(_t215 != 0) {
								_t1 = _t291 - 0x5c84; // -23684
								_t216 = _t1;
								_t2 = _t291 - 0x1bc8c; // -113804
								_t285 = _t2;
								_t283 = 6;
								goto L2;
							} else {
								break;
							}
							while(1) {
								L4:
								_t5 = _t291 - 0xfc8c; // -64652
								if(E00A700DF(_t5,  *((intOrPtr*)(0xa99168 + _t286 * 4))) == 0) {
									break;
								}
								L5:
								_t286 =  &(_t286[0]);
								if(_t286 < 0xe) {
									continue;
								} else {
									goto L164;
								}
							}
							L7:
							__eflags = _t286 - 0xd;
							if(__eflags > 0) {
								continue;
							}
							L8:
							switch( *((intOrPtr*)(_t286 * 4 +  &M00A7AA66))) {
								case 0:
									L9:
									__eflags = _t269 - 2;
									if(_t269 != 2) {
										goto L164;
									}
									L10:
									_t288 = 0x800;
									_t8 = _t291 - 0x7c84; // -31876
									E00A781BC(_t8, 0x800);
									_t9 = _t291 - 0xdc8c; // -56460
									_t10 = _t291 - 0x5c84; // -23684
									_t11 = _t291 - 0x7c84; // -31876
									_t224 = E00A6AF10(_t11, _t10, _t9, 0x800);
									_t12 = _t291 - 0x8c8c; // -35980
									E00A69B3D(_t224, _t269, _t12, 0x800);
									_t13 = _t291 - 0xdc8c; // -56460
									 *(_t291 - 4) = _t283;
									_t15 = _t291 - 0x8c8c; // -35980
									E00A69C77(_t15, _t13);
									_t16 = _t291 - 0x3c84; // -15492
									E00A66BA0(_t16);
									_push(_t283);
									_t17 = _t291 - 0x3c84; // -15492
									_t18 = _t291 - 0x8c8c; // -35980
									_t277 = _t18;
									_t230 = E00A69BCA(_t18, _t282, _t17);
									__eflags = _t230;
									if(_t230 == 0) {
										L26:
										 *(_t291 - 4) =  *(_t291 - 4) | 0xffffffff;
										_t49 = _t291 - 0x8c8c; // -35980
										E00A69B53(_t49);
										goto L164;
									} else {
										goto L13;
										L14:
										_t21 = _t291 - 0x103c; // -4156
										_t22 = _t291 - 0x7c84; // -31876
										E00A6AAAE(_t277, __eflags, _t22, _t21, _t288);
										_t23 = _t291 - 0x103c; // -4156
										E00A6A7A3(__eflags, _t23, _t288);
										_t24 = _t291 - 0x7c84; // -31876
										_t290 = E00A816B5(_t24);
										__eflags = _t290 - 4;
										if(_t290 < 4) {
											L16:
											_t26 = _t291 - 0x5c84; // -23684
											_t258 = E00A6AEEC(_t26);
											__eflags = _t258;
											if(_t258 != 0) {
												goto L26;
											}
											L17:
											_t27 = _t291 - 0x3c84; // -15492
											_t260 = E00A816B5(_t27);
											__eflags = 0;
											 *((short*)(_t291 + _t260 * 2 - 0x3c82)) = 0;
											_t31 = _t291 - 0x3c; // -60
											E00A7D1E0(_t283, _t31, _t283, 0x1e);
											_t293 = _t293 + 0x10;
											 *((intOrPtr*)(_t291 - 0x38)) = 3;
											_push(0x14);
											_pop(_t263);
											 *((short*)(_t291 - 0x2c)) = _t263;
											_t34 = _t291 - 0x3c84; // -15492
											 *((intOrPtr*)(_t291 - 0x34)) = _t34;
											_t36 = _t291 - 0x3c; // -60
											_push(_t36);
											 *0xa99a84();
											goto L18;
										}
										L15:
										_t25 = _t291 - 0x103c; // -4156
										_t268 = E00A816B5(_t25);
										__eflags = _t290 - _t268;
										if(_t290 > _t268) {
											goto L17;
										}
										goto L16;
										L18:
										_t37 = _t291 - 0x3c84; // -15492
										_t235 = GetFileAttributesW(_t37);
										__eflags = _t235 - 0xffffffff;
										if(_t235 == 0xffffffff) {
											L25:
											_push(_t283);
											_t45 = _t291 - 0x3c84; // -15492
											_t46 = _t291 - 0x8c8c; // -35980
											_t277 = _t46;
											_t237 = E00A69BCA(_t46, _t282, _t45);
											__eflags = _t237;
											if(_t237 != 0) {
												_t288 = 0x800;
												L13:
												_t19 = _t291 - 0x3c84; // -15492
												SetFileAttributesW(_t19, _t283);
												__eflags =  *((char*)(_t291 - 0x2c78));
												if(__eflags == 0) {
													goto L18;
												}
												goto L14;
											}
											goto L26;
										}
										L19:
										_t38 = _t291 - 0x3c84; // -15492
										_t239 = DeleteFileW(_t38);
										__eflags = _t239;
										if(_t239 != 0) {
											goto L25;
										} else {
											_t289 = _t283;
											_push(_t283);
											goto L22;
											L22:
											_t39 = _t291 - 0x3c84; // -15492
											_t40 = _t291 - 0x103c; // -4156
											E00A63CE2(_t40, 0x800, L"%s.%d.tmp", _t39);
											_t293 = _t293 + 0x14;
											_t41 = _t291 - 0x103c; // -4156
											_t244 = GetFileAttributesW(_t41);
											__eflags = _t244 - 0xffffffff;
											if(_t244 != 0xffffffff) {
												_t289 =  &(_t289[0]);
												__eflags = _t289;
												_push(_t289);
												goto L22;
											} else {
												_t42 = _t291 - 0x103c; // -4156
												_t43 = _t291 - 0x3c84; // -15492
												_t247 = MoveFileW(_t43, _t42);
												__eflags = _t247;
												if(_t247 != 0) {
													_t44 = _t291 - 0x103c; // -4156
													MoveFileExW(_t44, _t283, 4);
												}
												goto L25;
											}
										}
									}
								case 1:
									L27:
									__eflags = __ebx;
									if(__ebx != 0) {
										goto L164;
									}
									L28:
									__eax =  *0xab4e14;
									__eflags =  *0xab4e14;
									__ebx = __ebx & 0xffffff00 |  *0xab4e14 == 0x00000000;
									__eflags = __bl;
									if(__bl == 0) {
										__eax =  *0xab4e14;
										_pop(__ecx);
										_pop(__ecx);
									}
									L30:
									__bh =  *((intOrPtr*)(__ebp - 0xd));
									__eflags = __bh;
									if(__eflags == 0) {
										_t54 = __ebp + 0xc; // 0xc
										__eax = _t54;
										_push(_t54);
										__esi = E00A78D29(__ecx, __edx, __eflags);
										__eax =  *0xab4e14;
									} else {
										_t53 = __ebp - 0x5c84; // -23684
										__esi = _t53;
									}
									__eflags = __bl;
									if(__bl == 0) {
										__edi = __eax;
									}
									__eax = E00A816B5(__esi);
									__eax = __eax + __edi;
									_push(__eax);
									_push( *0xab4e14);
									__eax = E00A816D5(__ecx, __edx);
									__esp = __esp + 0xc;
									__eflags = __eax;
									if(__eax != 0) {
										 *0xab4e14 = __eax;
										__eflags = __bl;
										if(__bl != 0) {
											__ecx = 0;
											__eflags = 0;
											 *__eax = __cx;
										}
										__eax = E00A82C19(__eax, __esi);
										_pop(__ecx);
										_pop(__ecx);
									}
									__eflags = __bh;
									if(__bh == 0) {
										__eax = L00A816D0(__esi);
									}
									goto L164;
								case 2:
									L41:
									__eflags = __ebx;
									if(__ebx == 0) {
										_t57 = __ebp - 0x5c84; // -23684
										_t57 = SetWindowTextW( *(__ebp + 8), _t57);
									}
									goto L164;
								case 3:
									L43:
									__eflags = __ebx;
									if(__ebx != 0) {
										goto L164;
									}
									L44:
									__eflags =  *0xaa875a - __di;
									if( *0xaa875a != __di) {
										goto L164;
									}
									L45:
									__eax = 0;
									_t59 = __ebp - 0x5c84; // -23684
									__edi = _t59;
									_push(0x22);
									 *(__ebp - 0x103c) = __ax;
									_pop(__eax);
									__eflags =  *(__ebp - 0x5c84) - __ax;
									if( *(__ebp - 0x5c84) == __ax) {
										_t62 = __ebp - 0x5c82; // -23682
										__edi = _t62;
									}
									__eax = E00A816B5(__edi);
									__eflags = __eax - 0x800;
									if(__eax >= 0x800) {
										goto L164;
									} else {
										L48:
										__eax =  *__edi & 0x0000ffff;
										_push(0x5c);
										_pop(__esi);
										__eflags = ( *__edi & 0x0000ffff) - 0x2e;
										if(( *__edi & 0x0000ffff) != 0x2e) {
											L52:
											__eflags = __ax - __si;
											if(__ax == __si) {
												L64:
												_t85 = __ebp - 0x103c; // -4156
												_t85 = E00A81693(_t85, __edi);
												__ebx = 0;
												__eflags = 0;
												L65:
												_pop(__ecx);
												_pop(__ecx);
												L66:
												_push(0x22);
												_pop(__eax);
												_t86 = __ebp - 0x103c; // -4156
												__eax = _t86;
												__eax = E00A7F64B(_t86, _t86);
												_pop(__ecx);
												_pop(__ecx);
												__eflags = __eax;
												if(__eax != 0) {
													__eflags = __eax[1] - __bx;
													if(__eax[1] == __bx) {
														__ecx = 0;
														__eflags = 0;
														 *__eax = __cx;
													}
												}
												_t88 = __ebp - 0x103c; // -4156
												__eax = _t88;
												__edi = 0xab4e28;
												__eax = E00A81693(0xab4e28, _t88);
												_pop(__ecx);
												_pop(__ecx);
												_t89 = __ebp - 0x103c; // -4156
												_t89 = E00A78A7C(__edx, _t89, 0x800);
												__esi = GetDlgItem( *(__ebp + 8), 0x66);
												_t91 = __ebp - 0x103c; // -4156
												_t91 = SetWindowTextW(__esi, _t91); // executed
												__ebx =  *0xa99ab8;
												__eax = SendMessageW(__esi, 0x143, __ebx, 0xab4e28);
												_t92 = __ebp - 0x103c; // -4156
												__eax = _t92;
												__eax = E00A816E0(_t92, 0xab4e28, __eax);
												_pop(__ecx);
												_pop(__ecx);
												__eflags = __eax;
												if(__eax != 0) {
													_t93 = __ebp - 0x103c; // -4156
													__eax = SendMessageW(__esi, 0x143, 0, 0);
												}
												goto L164;
											}
											L53:
											__eflags = __ax;
											if(__ax == 0) {
												L55:
												_t66 = __ebp - 0x18; // -24
												__eax = _t66;
												__ebx = 0;
												__eax = RegOpenKeyExW(0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion", 0, 1, _t66); // executed
												__eflags = __eax;
												if(__eax == 0) {
													_t67 = __ebp - 0x14; // -20
													__eax = _t67;
													 *(__ebp - 0x14) = 0x1000;
													_t69 = __ebp - 0x103c; // -4156
													__eax = _t69;
													_t70 = __ebp - 0x1c; // -28
													_t70 = RegQueryValueExW( *(__ebp - 0x18), L"ProgramFilesDir", 0, _t70, _t69, _t67); // executed
													__eax = RegCloseKey( *(__ebp - 0x18)); // executed
													__eax =  *(__ebp - 0x14);
													__ecx = 0x7ff;
													__eax =  *(__ebp - 0x14) >> 1;
													__eflags = __eax - 0x7ff;
													if(__eax >= 0x7ff) {
														__eax = 0x7ff;
													}
													__ecx = 0;
													__eflags = 0;
													 *(__ebp + __eax * 2 - 0x103c) = __cx;
												}
												__eflags =  *(__ebp - 0x103c) - __bx;
												if( *(__ebp - 0x103c) != __bx) {
													_t78 = __ebp - 0x103c; // -4156
													__eax = _t78;
													__eax = E00A816B5(_t78);
													__eflags =  *((intOrPtr*)(__ebp + __eax * 2 - 0x103e)) - __si;
													if( *((intOrPtr*)(__ebp + __eax * 2 - 0x103e)) != __si) {
														_t82 = __ebp - 0x103c; // -4156
														_t82 = E00A82C19(_t82, "\\");
														_pop(__ecx);
														_pop(__ecx);
													}
												}
												__esi = E00A816B5(__edi);
												_t83 = __ebp - 0x103c; // -4156
												__eax = _t83;
												__esi = __esi + E00A816B5(_t83);
												__eflags = __esi - 0x7ff;
												if(__esi >= 0x7ff) {
													goto L66;
												} else {
													L63:
													_t84 = __ebp - 0x103c; // -4156
													_t84 = E00A82C19(_t84, __edi);
													goto L65;
												}
											}
											L54:
											__eflags = __edi[1] - 0x3a;
											if(__edi[1] == 0x3a) {
												goto L64;
											}
											goto L55;
										}
										L49:
										__eflags = __edi[1] - __si;
										if(__edi[1] != __si) {
											goto L52;
										}
										L50:
										__edi =  &(__edi[2]);
										__ebx = 0;
										__eflags =  *__edi - __bx;
										if( *__edi == __bx) {
											goto L164;
										}
										L51:
										_t64 = __ebp - 0x103c; // -4156
										_t64 = E00A81693(_t64, __edi);
										goto L65;
									}
								case 4:
									L71:
									__eflags =  *0xaa8754 - 1;
									__eflags = __eax - 0xaa8754;
									 *__edi =  *__edi + __ecx;
									__eflags =  *(__edx + 6) & __bl;
									 *__eax =  *__eax + __al;
									__eflags =  *__eax;
								case 5:
									L76:
									__eax =  *(__ebp - 0x5c84) & 0x0000ffff;
									__ecx = 0;
									__eax =  *(__ebp - 0x5c84) & 0x0000ffff;
									__eflags = __eax;
									if(__eax == 0) {
										L83:
										 *0xaa1727 = __cl;
										 *0xaa8732 = 1;
										goto L164;
									}
									L77:
									__eax = __eax - 0x30;
									__eflags = __eax;
									if(__eax == 0) {
										L81:
										 *0xaa1727 = __cl;
										L82:
										 *0xaa8732 = __cl;
										goto L164;
									}
									L78:
									__eax = __eax - 1;
									__eflags = __eax;
									if(__eax == 0) {
										goto L83;
									}
									L79:
									__eax = __eax - 1;
									__eflags = __eax;
									if(__eax != 0) {
										goto L164;
									}
									L80:
									 *0xaa1727 = 1;
									goto L82;
								case 6:
									L89:
									__eflags = __ebx - 4;
									if(__ebx != 4) {
										goto L93;
									}
									L90:
									__eax = __ebp - 0x5c84;
									__eax = E00A816E0(__ebp - 0x5c84, __eax, L"<>");
									_pop(__ecx);
									_pop(__ecx);
									__eflags = __eax;
									if(__eax == 0) {
										goto L93;
									}
									L91:
									_push(__edi);
									goto L92;
								case 7:
									goto L0;
								case 8:
									L116:
									__eflags = __ebx - 3;
									if(__ebx == 3) {
										__eflags =  *(__ebp - 0x5c84) - __di;
										if(__eflags != 0) {
											__ebp - 0x5c84 = SetWindowTextW( *(__ebp + 8), __ebp - 0x5c84);
										}
										__eax = __ebp + 0xc;
										_push(__ebp + 0xc);
										 *0xab4e18 = E00A78D29(__ecx, __edx, __eflags);
									}
									 *0xab3e02 = 1;
									goto L164;
								case 9:
									L121:
									__eflags = __ebx - 5;
									if(__ebx != 5) {
										L93:
										 *0xab3e03 = 1;
										goto L164;
									}
									L122:
									_push(1);
									L92:
									__eax = __ebp - 0x5c84;
									_push(__ebp - 0x5c84);
									_push( *(__ebp + 8));
									__eax = E00A7ADB9();
									goto L93;
								case 0xa:
									L123:
									__eflags = __ebx - 6;
									if(__ebx != 6) {
										goto L164;
									}
									L124:
									__eax = 0;
									 *(__ebp - 0x2c3c) = __ax;
									__eax =  *(__ebp - 0x1bc8c) & 0x0000ffff;
									__eax = E00A830A4( *(__ebp - 0x1bc8c) & 0x0000ffff);
									_push(0x800);
									__eflags = __eax - 0x50;
									if(__eax == 0x50) {
										_push(0xaa6732);
										__eax = __ebp - 0x2c3c;
										_push(__ebp - 0x2c3c);
										__eax = E00A6E847();
										 *(__ebp - 0x14) = 2;
									} else {
										__eflags = __eax - 0x54;
										__eax = __ebp - 0x2c3c;
										if(__eflags == 0) {
											_push(0xaa5732);
											_push(__eax);
											__eax = E00A6E847();
											 *(__ebp - 0x14) = 7;
										} else {
											_push(0xaa7732);
											_push(__eax);
											__eax = E00A6E847();
											 *(__ebp - 0x14) = 0x10;
										}
									}
									__eax = 0;
									 *(__ebp - 0x9c8c) = __ax;
									 *(__ebp - 0x1c3c) = __ax;
									__ebp - 0x19c8c = __ebp - 0x6c84;
									__eax = E00A81693(__ebp - 0x6c84, __ebp - 0x19c8c);
									_pop(__ecx);
									_pop(__ecx);
									_push(0x22);
									_pop(__ebx);
									__eflags =  *(__ebp - 0x6c84) - __bx;
									if( *(__ebp - 0x6c84) != __bx) {
										L132:
										__ebp - 0x6c84 = E00A69820(__ebp - 0x6c84);
										__eflags = __al;
										if(__al != 0) {
											goto L149;
										}
										L133:
										__ebx = __edi;
										__esi = __ebp - 0x6c84;
										__eflags =  *(__ebp - 0x6c84) - __bx;
										if( *(__ebp - 0x6c84) == __bx) {
											goto L149;
										}
										L134:
										_push(0x20);
										_pop(__ecx);
										do {
											L135:
											__eax = __esi->i & 0x0000ffff;
											__eflags = __ax - __cx;
											if(__ax == __cx) {
												L137:
												__edi = __eax;
												__eax = 0;
												__esi->i = __ax;
												__ebp - 0x6c84 = E00A69820(__ebp - 0x6c84);
												__eflags = __al;
												if(__al == 0) {
													L144:
													__esi->i = __di;
													L145:
													_push(0x20);
													_pop(__ecx);
													__edi = 0;
													__eflags = 0;
													goto L146;
												}
												L138:
												_push(0x2f);
												_pop(__eax);
												__ebx = __esi;
												__eflags = __di - __ax;
												if(__di != __ax) {
													L140:
													_push(0x20);
													_pop(__eax);
													do {
														L141:
														__esi =  &(__esi->i);
														__eflags = __esi->i - __ax;
													} while (__esi->i == __ax);
													_push(__esi);
													__eax = __ebp - 0x1c3c;
													L143:
													_push(__eax);
													__eax = E00A81693();
													_pop(__ecx);
													_pop(__ecx);
													 *__ebx = __di;
													goto L145;
												}
												L139:
												 *(__ebp - 0x1c3c) = __ax;
												__eax =  &(__esi->i);
												_push( &(__esi->i));
												__eax = __ebp - 0x1c3a;
												goto L143;
											}
											L136:
											_push(0x2f);
											_pop(__edx);
											__eflags = __ax - __dx;
											if(__ax != __dx) {
												goto L146;
											}
											goto L137;
											L146:
											__esi =  &(__esi->i);
											__eflags = __esi->i - __di;
										} while (__esi->i != __di);
										__eflags = __ebx;
										if(__ebx != 0) {
											__eax = 0;
											__eflags = 0;
											 *__ebx = __ax;
										}
										goto L149;
									} else {
										L130:
										__ebp - 0x19c8a = __ebp - 0x6c84;
										E00A81693(__ebp - 0x6c84, __ebp - 0x19c8a) = __ebp - 0x6c82;
										_push(__ebx);
										_push(__ebp - 0x6c82);
										__eax = E00A7F472(__ecx);
										__esp = __esp + 0x10;
										__eflags = __eax;
										if(__eax != 0) {
											__ecx = 0;
											 *__eax = __cx;
											__ebp - 0x1c3c = E00A81693(__ebp - 0x1c3c, __ebp - 0x1c3c);
											_pop(__ecx);
											_pop(__ecx);
										}
										L149:
										__eflags =  *(__ebp - 0x11c8c);
										__ebx = 0x800;
										if( *(__ebp - 0x11c8c) != 0) {
											_push(0x800);
											__eax = __ebp - 0x9c8c;
											_push(__ebp - 0x9c8c);
											__eax = __ebp - 0x11c8c;
											_push(__ebp - 0x11c8c);
											__eax = E00A6A7D3(__edx);
										}
										_push(__ebx);
										__eax = __ebp - 0xbc8c;
										_push(__ebp - 0xbc8c);
										__eax = __ebp - 0x6c84;
										_push(__ebp - 0x6c84);
										__eax = E00A6A7D3(__edx);
										__eflags =  *(__ebp - 0x2c3c);
										if(__eflags == 0) {
											__ebp - 0x2c3c = E00A78CC9(__ecx, __ebp - 0x2c3c,  *(__ebp - 0x14));
										}
										__ebp - 0x2c3c = E00A6A7A3(__eflags, __ebp - 0x2c3c, __ebx);
										__eflags =  *((short*)(__ebp - 0x17c8c));
										if(__eflags != 0) {
											__ebp - 0x17c8c = __ebp - 0x2c3c;
											E00A6E81B(__eflags, __ebp - 0x2c3c, __ebp - 0x17c8c, __ebx) = __ebp - 0x2c3c;
											__eax = E00A6A7A3(__eflags, __ebp - 0x2c3c, __ebx);
										}
										__ebp - 0x2c3c = __ebp - 0xcc8c;
										__eax = E00A81693(__ebp - 0xcc8c, __ebp - 0x2c3c);
										__eflags =  *(__ebp - 0x13c8c);
										__eax = __ebp - 0x13c8c;
										_pop(__ecx);
										_pop(__ecx);
										if(__eflags == 0) {
											__eax = __ebp - 0x19c8c;
										}
										__ebp - 0x2c3c = E00A6E81B(__eflags, __ebp - 0x2c3c, __ebp - 0x2c3c, __ebx);
										__eax = __ebp - 0x2c3c;
										__eflags = E00A6AA4A(__ebp - 0x2c3c);
										if(__eflags == 0) {
											L159:
											__ebp - 0x2c3c = E00A6E81B(__eflags, __ebp - 0x2c3c, L".lnk", __ebx);
											goto L160;
										} else {
											L158:
											__eflags = __eax;
											if(__eflags == 0) {
												L160:
												_push(1);
												__eax = __ebp - 0x2c3c;
												_push(__ebp - 0x2c3c);
												E00A696EF(__ecx, __edx, __ebp) = __ebp - 0xbc8c;
												__ebp - 0xac8c = E00A81693(__ebp - 0xac8c, __ebp - 0xbc8c);
												_pop(__ecx);
												_pop(__ecx);
												__ebp - 0xac8c = E00A6B213(__eflags, __ebp - 0xac8c);
												__ecx =  *(__ebp - 0x1c3c) & 0x0000ffff;
												__eax = __ebp - 0x1c3c;
												__ecx =  ~( *(__ebp - 0x1c3c) & 0x0000ffff);
												__edx = __ebp - 0x9c8c;
												__esi = __ebp - 0xac8c;
												asm("sbb ecx, ecx");
												__ecx =  ~( *(__ebp - 0x1c3c) & 0x0000ffff) & __ebp - 0x00001c3c;
												 *(__ebp - 0x9c8c) & 0x0000ffff =  ~( *(__ebp - 0x9c8c) & 0x0000ffff);
												asm("sbb eax, eax");
												__eax =  ~( *(__ebp - 0x9c8c) & 0x0000ffff) & __ebp - 0x00009c8c;
												 *(__ebp - 0xac8c) & 0x0000ffff =  ~( *(__ebp - 0xac8c) & 0x0000ffff);
												__eax = __ebp - 0x15c8c;
												asm("sbb edx, edx");
												__edx =  ~( *(__ebp - 0xac8c) & 0x0000ffff) & __esi;
												E00A787D8(__ebp - 0x15c8c) = __ebp - 0x2c3c;
												__ebp - 0xbc8c = E00A7803D(__ecx, __edi, __ebp - 0xbc8c, __ebp - 0x2c3c,  ~( *(__ebp - 0xac8c) & 0x0000ffff) & __esi, __ebp - 0xbc8c,  ~( *(__ebp - 0x9c8c) & 0x0000ffff) & __ebp - 0x00009c8c,  ~( *(__ebp - 0x1c3c) & 0x0000ffff) & __ebp - 0x00001c3c);
												__eflags =  *(__ebp - 0xcc8c);
												if( *(__ebp - 0xcc8c) != 0) {
													_push(__edi);
													__eax = __ebp - 0xcc8c;
													_push(__ebp - 0xcc8c);
													_push(5);
													_push(0x1000);
													__eax =  *0xa99a90();
												}
												goto L164;
											}
											goto L159;
										}
									}
								case 0xb:
									L162:
									__eflags = __ebx - 7;
									if(__ebx == 7) {
										 *0xaa8758 = 1;
									}
									goto L164;
								case 0xc:
									L84:
									__eax =  *(__ebp - 0x5c84) & 0x0000ffff;
									__eax = E00A830A4( *(__ebp - 0x5c84) & 0x0000ffff);
									__eflags = __eax - 0x46;
									if(__eax == 0x46) {
										 *0xaa8733 = 1;
									} else {
										__eflags = __eax - 0x55;
										if(__eax == 0x55) {
											 *0xaa874c = 1;
										} else {
											__eax = 0;
											 *0xaa8733 = __al;
											 *0xaa874c = __al;
										}
									}
									goto L164;
								case 0xd:
									L94:
									 *0xab4e1c = 1;
									asm("sbb al, 0x4e");
									asm("stosd");
									 *__ecx =  *__ecx + __al;
									goto L164;
							}
							L2:
							_t216 = E00A788BB(_t216, _t285);
							_t285 = _t285 + 0x2000;
							_t283 = _t283 - 1;
							if(_t283 != 0) {
								goto L2;
							} else {
								_t286 = _t283;
								goto L4;
							}
						}
						L165:
						 *[fs:0x0] =  *((intOrPtr*)(_t291 - 0xc));
						return _t215;
					}
					L100:
					__eflags =  *0xaa874f;
					if( *0xaa874f != 0) {
						goto L164;
					}
					L101:
					__eax = 0;
					 *(__ebp - 0x143c) = __ax;
					__eax = __ebp - 0x5c84;
					_push(__ebp - 0x5c84);
					__eax = E00A7F472(__ecx);
					_pop(__ecx);
					__ecx = 0x2c;
					__eflags = __eax;
					if(__eax != 0) {
						L108:
						__eflags =  *(__ebp - 0x143c);
						if( *(__ebp - 0x143c) == 0) {
							__ebp - 0x1bc8c = __ebp - 0x5c84;
							E00A81693(__ebp - 0x5c84, __ebp - 0x1bc8c) = __ebp - 0x19c8c;
							__ebp - 0x143c = E00A81693(__ebp - 0x143c, __ebp - 0x19c8c);
						}
						__ebp - 0x5c84 = E00A786EA(__ebp - 0x5c84);
						__eax = 0;
						 *(__ebp - 0x4c84) = __ax;
						__ebp - 0x143c = __ebp - 0x5c84;
						__eax = E00A781FE( *(__ebp + 8), __ebp - 0x5c84, __ebp - 0x143c, 0x24);
						__eflags = __eax - 6;
						if(__eax == 6) {
							goto L164;
						} else {
							L111:
							 *0xaa874e = 1;
							 *0xaa1724 = 1;
							__eax =  *0xa99acc( *(__ebp + 8), 1);
							goto L112;
						}
					}
					L102:
					__esi = 0;
					__eflags =  *(__ebp - 0x5c84) - __si;
					if( *(__ebp - 0x5c84) == __si) {
						goto L108;
					}
					L103:
					__eax = __ebp - 0x5c84;
					while(1) {
						L104:
						__eflags =  *__eax - 0x40;
						if( *__eax == 0x40) {
							break;
						}
						L105:
						__esi =  &(__esi->i);
						__eax = __ebp - 0x5c84;
						__eax =  &((__ebp - 0x5c84)[__esi]);
						__eflags =  *__eax - __di;
						if( *__eax != __di) {
							continue;
						}
						L106:
						goto L108;
					}
					L107:
					__ebp - 0x5c82 =  &((__ebp - 0x5c82)[__esi]);
					__ebp - 0x143c = E00A81693(__ebp - 0x143c, __ebp - 0x143c);
					_pop(__ecx);
					__eax = 0;
					__eflags = 0;
					_pop(__ecx);
					 *(__ebp + __esi * 2 - 0x5c84) = __ax;
					goto L108;
					L112:
					__eflags = _t269 - 7;
					if(_t269 == 7) {
						__eflags =  *0xaa8754;
						if( *0xaa8754 == 0) {
							 *0xaa8754 = 2;
						}
						 *0xaa8750 = 1;
					}
					goto L164;
				}
			}

0x00a7a4cb
0x00a7a4cb
0x00a7a4cb
0x00a7a4cb
0x00a7a4cb
0x00a7a4ce
0x00000000
0x00000000
0x00a7a4d4
0x00a7a4d4
0x00a7a4e8
0x00a7a4f4
0x00a7a4f6
0x00a7a4f7
0x00a7a4fd
0x00a7a50b
0x00a7a513
0x00a7a545
0x00a7a545
0x00a7a545
0x00a7a548
0x00a7a54f
0x00a7a551
0x00a7a554
0x00000000
0x00000000
0x00a7a520
0x00a7a520
0x00a7a520
0x00a7a521
0x00a7a527
0x00a7a528
0x00a7a540
0x00a7a540
0x00a7a556
0x00a7a562
0x00a7a568
0x00a7a570
0x00a7aa20
0x00a7aa20
0x00a7aa20
0x00a7aa25
0x00a7aa29
0x00a7aa2d
0x00a7aa34
0x00a7aa3b
0x00a7aa3e
0x00a7aa43
0x00a7aa46
0x00a7aa4b
0x00a79eb0
0x00a79eb0
0x00a79eb6
0x00a79eb6
0x00a79ebc
0x00a79ebc
0x00000000
0x00000000
0x00000000
0x00a79ed1
0x00a79ed1
0x00a79ed8
0x00a79ee6
0x00000000
0x00000000
0x00a79ee8
0x00a79ee8
0x00a79eec
0x00000000
0x00a79eee
0x00000000
0x00a79eee
0x00a79eec
0x00a79ef3
0x00a79ef3
0x00a79ef6
0x00000000
0x00000000
0x00a79efc
0x00a79efc
0x00000000
0x00a79f03
0x00a79f03
0x00a79f06
0x00000000
0x00000000
0x00a79f0c
0x00a79f0c
0x00a79f11
0x00a79f19
0x00a79f1f
0x00a79f26
0x00a79f2d
0x00a79f34
0x00a79f39
0x00a79f3f
0x00a79f44
0x00a79f4a
0x00a79f4e
0x00a79f54
0x00a79f59
0x00a79f5f
0x00a79f64
0x00a79f65
0x00a79f6c
0x00a79f6c
0x00a79f72
0x00a79f77
0x00a79f79
0x00a7a0de
0x00a7a0de
0x00a7a0e2
0x00a7a0e8
0x00000000
0x00a79f7f
0x00a79f85
0x00a79fa7
0x00a79fa8
0x00a79faf
0x00a79fb6
0x00a79fbc
0x00a79fc3
0x00a79fc8
0x00a79fd4
0x00a79fd7
0x00a79fda
0x00a79fed
0x00a79fed
0x00a79ff4
0x00a79ff9
0x00a79ffb
0x00000000
0x00000000
0x00a7a001
0x00a7a001
0x00a7a008
0x00a7a00d
0x00a7a012
0x00a7a01a
0x00a7a01e
0x00a7a023
0x00a7a026
0x00a7a02d
0x00a7a02f
0x00a7a030
0x00a7a034
0x00a7a03a
0x00a7a03d
0x00a7a040
0x00a7a041
0x00000000
0x00a7a041
0x00a79fdc
0x00a79fdc
0x00a79fe3
0x00a79fe9
0x00a79feb
0x00000000
0x00000000
0x00000000
0x00a7a047
0x00a7a047
0x00a7a04e
0x00a7a050
0x00a7a053
0x00a7a0c3
0x00a7a0c3
0x00a7a0c4
0x00a7a0cb
0x00a7a0cb
0x00a7a0d1
0x00a7a0d6
0x00a7a0d8
0x00a79f87
0x00a79f8c
0x00a79f8d
0x00a79f94
0x00a79f9a
0x00a79fa1
0x00000000
0x00000000
0x00000000
0x00a79fa1
0x00000000
0x00a7a0d8
0x00a7a055
0x00a7a055
0x00a7a05c
0x00a7a062
0x00a7a064
0x00000000
0x00a7a066
0x00a7a066
0x00a7a068
0x00a7a069
0x00a7a06d
0x00a7a06d
0x00a7a079
0x00a7a085
0x00a7a08a
0x00a7a08d
0x00a7a094
0x00a7a096
0x00a7a099
0x00a7a06b
0x00a7a06b
0x00a7a06c
0x00000000
0x00a7a09b
0x00a7a09b
0x00a7a0a2
0x00a7a0a9
0x00a7a0af
0x00a7a0b1
0x00a7a0b6
0x00a7a0bd
0x00a7a0bd
0x00000000
0x00a7a0b1
0x00a7a099
0x00a7a064
0x00000000
0x00a7a0f2
0x00a7a0f2
0x00a7a0f4
0x00000000
0x00000000
0x00a7a0fa
0x00a7a0fa
0x00a7a0ff
0x00a7a101
0x00a7a104
0x00a7a106
0x00a7a113
0x00a7a118
0x00a7a119
0x00a7a119
0x00a7a11a
0x00a7a11a
0x00a7a11d
0x00a7a11f
0x00a7a129
0x00a7a129
0x00a7a12c
0x00a7a132
0x00a7a134
0x00a7a121
0x00a7a121
0x00a7a121
0x00a7a121
0x00a7a139
0x00a7a13b
0x00a7a144
0x00a7a144
0x00a7a147
0x00a7a14c
0x00a7a155
0x00a7a156
0x00a7a15c
0x00a7a161
0x00a7a164
0x00a7a166
0x00a7a168
0x00a7a16d
0x00a7a16f
0x00a7a171
0x00a7a171
0x00a7a173
0x00a7a173
0x00a7a178
0x00a7a17d
0x00a7a17e
0x00a7a17e
0x00a7a17f
0x00a7a181
0x00a7a188
0x00a7a18d
0x00000000
0x00000000
0x00a7a193
0x00a7a193
0x00a7a195
0x00a7a19b
0x00a7a1a5
0x00a7a1a5
0x00000000
0x00000000
0x00a7a1b0
0x00a7a1b0
0x00a7a1b2
0x00000000
0x00000000
0x00a7a1b8
0x00a7a1b8
0x00a7a1bf
0x00000000
0x00000000
0x00a7a1c5
0x00a7a1c5
0x00a7a1c7
0x00a7a1c7
0x00a7a1cd
0x00a7a1cf
0x00a7a1d6
0x00a7a1d7
0x00a7a1de
0x00a7a1e0
0x00a7a1e0
0x00a7a1e0
0x00a7a1e7
0x00a7a1ed
0x00a7a1f2
0x00000000
0x00a7a1f8
0x00a7a1f8
0x00a7a1f8
0x00a7a1fb
0x00a7a1fd
0x00a7a1fe
0x00a7a201
0x00a7a229
0x00a7a229
0x00a7a22c
0x00a7a309
0x00a7a309
0x00a7a311
0x00a7a316
0x00a7a316
0x00a7a318
0x00a7a318
0x00a7a319
0x00a7a31a
0x00a7a31a
0x00a7a31c
0x00a7a31e
0x00a7a31e
0x00a7a325
0x00a7a32a
0x00a7a32b
0x00a7a32c
0x00a7a32e
0x00a7a330
0x00a7a334
0x00a7a336
0x00a7a336
0x00a7a338
0x00a7a338
0x00a7a334
0x00a7a33b
0x00a7a33b
0x00a7a341
0x00a7a348
0x00a7a34d
0x00a7a34e
0x00a7a354
0x00a7a35b
0x00a7a36b
0x00a7a36d
0x00a7a375
0x00a7a37d
0x00a7a389
0x00a7a38b
0x00a7a38b
0x00a7a393
0x00a7a398
0x00a7a399
0x00a7a39a
0x00a7a39c
0x00a7a3a2
0x00a7a3b2
0x00a7a3b2
0x00000000
0x00a7a39c
0x00a7a232
0x00a7a232
0x00a7a235
0x00a7a242
0x00a7a242
0x00a7a242
0x00a7a245
0x00a7a255
0x00a7a25b
0x00a7a25d
0x00a7a25f
0x00a7a25f
0x00a7a262
0x00a7a26a
0x00a7a26a
0x00a7a271
0x00a7a27e
0x00a7a287
0x00a7a28d
0x00a7a290
0x00a7a295
0x00a7a297
0x00a7a299
0x00a7a29b
0x00a7a29b
0x00a7a29d
0x00a7a29d
0x00a7a29f
0x00a7a29f
0x00a7a2a7
0x00a7a2ae
0x00a7a2b0
0x00a7a2b0
0x00a7a2b7
0x00a7a2bd
0x00a7a2c5
0x00a7a2c7
0x00a7a2d3
0x00a7a2d8
0x00a7a2d9
0x00a7a2d9
0x00a7a2c5
0x00a7a2e0
0x00a7a2e2
0x00a7a2e2
0x00a7a2ee
0x00a7a2f2
0x00a7a2f8
0x00000000
0x00a7a2fa
0x00a7a2fa
0x00a7a2fa
0x00a7a302
0x00000000
0x00a7a302
0x00a7a2f8
0x00a7a237
0x00a7a237
0x00a7a23c
0x00000000
0x00000000
0x00000000
0x00a7a23c
0x00a7a203
0x00a7a203
0x00a7a207
0x00000000
0x00000000
0x00a7a209
0x00a7a209
0x00a7a20c
0x00a7a20e
0x00a7a211
0x00000000
0x00000000
0x00a7a217
0x00a7a217
0x00a7a21f
0x00000000
0x00a7a21f
0x00000000
0x00a7a3b9
0x00a7a3b9
0x00a7a3ba
0x00a7a3bf
0x00a7a3c1
0x00a7a3c4
0x00a7a3c4
0x00000000
0x00a7a3fa
0x00a7a3fa
0x00a7a401
0x00a7a403
0x00a7a403
0x00a7a405
0x00a7a434
0x00a7a434
0x00a7a43a
0x00000000
0x00a7a43a
0x00a7a407
0x00a7a407
0x00a7a407
0x00a7a40a
0x00a7a423
0x00a7a423
0x00a7a429
0x00a7a429
0x00000000
0x00a7a429
0x00a7a40c
0x00a7a40c
0x00a7a40c
0x00a7a40f
0x00000000
0x00000000
0x00a7a411
0x00a7a411
0x00a7a411
0x00a7a414
0x00000000
0x00000000
0x00a7a41a
0x00a7a41a
0x00000000
0x00000000
0x00a7a487
0x00a7a487
0x00a7a48a
0x00000000
0x00000000
0x00a7a48c
0x00a7a48c
0x00a7a498
0x00a7a49d
0x00a7a49e
0x00a7a49f
0x00a7a4a1
0x00000000
0x00000000
0x00a7a4a3
0x00a7a4a3
0x00000000
0x00000000
0x00000000
0x00000000
0x00a7a696
0x00a7a696
0x00a7a699
0x00a7a69b
0x00a7a6a2
0x00a7a6ae
0x00a7a6ae
0x00a7a6b4
0x00a7a6b7
0x00a7a6bd
0x00a7a6bd
0x00a7a6c2
0x00000000
0x00000000
0x00a7a6ce
0x00a7a6ce
0x00a7a6d1
0x00a7a4b3
0x00a7a4b3
0x00000000
0x00a7a4b3
0x00a7a6d7
0x00a7a6d7
0x00a7a4a4
0x00a7a4a4
0x00a7a4aa
0x00a7a4ab
0x00a7a4ae
0x00000000
0x00000000
0x00a7a6de
0x00a7a6de
0x00a7a6e1
0x00000000
0x00000000
0x00a7a6e7
0x00a7a6e7
0x00a7a6e9
0x00a7a6f0
0x00a7a6f8
0x00a7a6fe
0x00a7a703
0x00a7a706
0x00a7a73b
0x00a7a740
0x00a7a746
0x00a7a747
0x00a7a74c
0x00a7a708
0x00a7a708
0x00a7a70b
0x00a7a711
0x00a7a727
0x00a7a72c
0x00a7a72d
0x00a7a732
0x00a7a713
0x00a7a713
0x00a7a718
0x00a7a719
0x00a7a71e
0x00a7a71e
0x00a7a711
0x00a7a753
0x00a7a755
0x00a7a75c
0x00a7a76a
0x00a7a771
0x00a7a776
0x00a7a777
0x00a7a778
0x00a7a77a
0x00a7a77b
0x00a7a782
0x00a7a7cb
0x00a7a7d2
0x00a7a7d7
0x00a7a7d9
0x00000000
0x00000000
0x00a7a7df
0x00a7a7df
0x00a7a7e1
0x00a7a7e7
0x00a7a7ee
0x00000000
0x00000000
0x00a7a7f0
0x00a7a7f0
0x00a7a7f2
0x00a7a7f3
0x00a7a7f3
0x00a7a7f3
0x00a7a7f6
0x00a7a7f9
0x00a7a803
0x00a7a803
0x00a7a805
0x00a7a807
0x00a7a811
0x00a7a816
0x00a7a818
0x00a7a856
0x00a7a856
0x00a7a859
0x00a7a859
0x00a7a85b
0x00a7a85c
0x00a7a85c
0x00000000
0x00a7a85c
0x00a7a81a
0x00a7a81a
0x00a7a81c
0x00a7a81d
0x00a7a81f
0x00a7a822
0x00a7a837
0x00a7a837
0x00a7a839
0x00a7a83a
0x00a7a83a
0x00a7a83a
0x00a7a83d
0x00a7a83d
0x00a7a842
0x00a7a843
0x00a7a849
0x00a7a849
0x00a7a84a
0x00a7a84f
0x00a7a850
0x00a7a851
0x00000000
0x00a7a851
0x00a7a824
0x00a7a824
0x00a7a82b
0x00a7a82e
0x00a7a82f
0x00000000
0x00a7a82f
0x00a7a7fb
0x00a7a7fb
0x00a7a7fd
0x00a7a7fe
0x00a7a801
0x00000000
0x00000000
0x00000000
0x00a7a85e
0x00a7a85e
0x00a7a861
0x00a7a861
0x00a7a866
0x00a7a868
0x00a7a86a
0x00a7a86a
0x00a7a86c
0x00a7a86c
0x00000000
0x00a7a784
0x00a7a784
0x00a7a78b
0x00a7a797
0x00a7a79d
0x00a7a79e
0x00a7a79f
0x00a7a7a4
0x00a7a7a7
0x00a7a7a9
0x00a7a7af
0x00a7a7b1
0x00a7a7bf
0x00a7a7c4
0x00a7a7c5
0x00a7a7c5
0x00a7a86f
0x00a7a86f
0x00a7a877
0x00a7a87c
0x00a7a87e
0x00a7a87f
0x00a7a885
0x00a7a886
0x00a7a88c
0x00a7a88d
0x00a7a88d
0x00a7a892
0x00a7a893
0x00a7a899
0x00a7a89a
0x00a7a8a0
0x00a7a8a1
0x00a7a8a6
0x00a7a8ae
0x00a7a8ba
0x00a7a8ba
0x00a7a8c7
0x00a7a8cc
0x00a7a8d4
0x00a7a8de
0x00a7a8eb
0x00a7a8f2
0x00a7a8f2
0x00a7a8fe
0x00a7a905
0x00a7a90a
0x00a7a912
0x00a7a918
0x00a7a919
0x00a7a91a
0x00a7a91c
0x00a7a91c
0x00a7a931
0x00a7a936
0x00a7a942
0x00a7a944
0x00a7a955
0x00a7a962
0x00000000
0x00a7a946
0x00a7a946
0x00a7a951
0x00a7a953
0x00a7a967
0x00a7a967
0x00a7a969
0x00a7a96f
0x00a7a975
0x00a7a983
0x00a7a988
0x00a7a989
0x00a7a991
0x00a7a996
0x00a7a99d
0x00a7a9a3
0x00a7a9a5
0x00a7a9ab
0x00a7a9b1
0x00a7a9b3
0x00a7a9bc
0x00a7a9bf
0x00a7a9c1
0x00a7a9ca
0x00a7a9cd
0x00a7a9d3
0x00a7a9d6
0x00a7a9df
0x00a7a9ee
0x00a7a9f3
0x00a7a9fb
0x00a7a9fd
0x00a7a9fe
0x00a7aa04
0x00a7aa05
0x00a7aa07
0x00a7aa0c
0x00a7aa0c
0x00000000
0x00a7a9fb
0x00000000
0x00a7a953
0x00a7a944
0x00000000
0x00a7aa14
0x00a7aa14
0x00a7aa17
0x00a7aa19
0x00a7aa19
0x00000000
0x00000000
0x00a7a446
0x00a7a446
0x00a7a44e
0x00a7a454
0x00a7a457
0x00a7a47b
0x00a7a459
0x00a7a459
0x00a7a45c
0x00a7a46f
0x00a7a45e
0x00a7a45e
0x00a7a460
0x00a7a465
0x00a7a465
0x00a7a45c
0x00000000
0x00000000
0x00a7a4bf
0x00a7a4bf
0x00a7a4c1
0x00a7a4c3
0x00a7a4c4
0x00000000
0x00000000
0x00a79ebd
0x00a79ebf
0x00a79ec4
0x00a79eca
0x00a79ecd
0x00000000
0x00a79ecf
0x00a79ecf
0x00000000
0x00a79ecf
0x00a79ecd
0x00a7aa51
0x00a7aa57
0x00a7aa61
0x00a7aa61
0x00a7a576
0x00a7a576
0x00a7a57d
0x00000000
0x00000000
0x00a7a583
0x00a7a583
0x00a7a585
0x00a7a58c
0x00a7a594
0x00a7a595
0x00a7a59a
0x00a7a59b
0x00a7a59c
0x00a7a59e
0x00a7a5ec
0x00a7a5ec
0x00a7a5f4
0x00a7a5fd
0x00a7a609
0x00a7a617
0x00a7a61c
0x00a7a626
0x00a7a62b
0x00a7a62d
0x00a7a63d
0x00a7a647
0x00a7a64c
0x00a7a64f
0x00000000
0x00a7a655
0x00a7a655
0x00a7a65a
0x00a7a661
0x00a7a668
0x00000000
0x00a7a668
0x00a7a64f
0x00a7a5a0
0x00a7a5a2
0x00a7a5a4
0x00a7a5ab
0x00000000
0x00000000
0x00a7a5ad
0x00a7a5ad
0x00a7a5b3
0x00a7a5b3
0x00a7a5b3
0x00a7a5b7
0x00000000
0x00000000
0x00a7a5b9
0x00a7a5b9
0x00a7a5ba
0x00a7a5c0
0x00a7a5c3
0x00a7a5c6
0x00000000
0x00000000
0x00a7a5c8
0x00000000
0x00a7a5c8
0x00a7a5ca
0x00a7a5d0
0x00a7a5db
0x00a7a5e0
0x00a7a5e1
0x00a7a5e1
0x00a7a5e3
0x00a7a5e4
0x00000000
0x00a7a66e
0x00a7a66e
0x00a7a671
0x00a7a677
0x00a7a67e
0x00a7a680
0x00a7a680
0x00a7a68a
0x00a7a68a
0x00000000
0x00a7a671

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 00A7A4E1

Part of subcall function 00A6A7A3: _wcslen.LIBCMT ref: 00A6A7A9

_swprintf.LIBCMT ref: 00A7A513

Part of subcall function 00A63CE2: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00A63CF5

_swprintf.LIBCMT ref: 00A7A540
GetFileAttributesW.KERNEL32(?), ref: 00A7A54F
SetDlgItemTextW.USER32(?,00000066,?), ref: 00A7A562

Strings

%s%s%d, xrefs: 00A7A506, 00A7A52F

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: _swprintf$AttributesFileItemPathTempText__vswprintf_c_l_wcslen
String ID: %s%s%d
API String ID: 1533948680-1000756122
Opcode ID: 33dcf44547c3d85f61ed41810005cde8465080b7d598de27cdb6e50067da0c18
Instruction ID: aa7ce0e6aa6a228b3281d2722430c4b6a26a9575d89f5f99bbb9e355f0a2c34f
Opcode Fuzzy Hash: 33dcf44547c3d85f61ed41810005cde8465080b7d598de27cdb6e50067da0c18
Instruction Fuzzy Hash: DF515072800219AEEF25DBA0DD84EEE77BCEB54350F50C0A6F509E6091EF749B898F51

Uniqueness

Uniqueness Score: -1.00%

Function 00A6B046 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A6B046(void* __edx, intOrPtr _a4, intOrPtr _a8, char _a12) {
				void* __ebp;
				signed short* _t13;
				signed short* _t16;
				signed short* _t19;
				signed short _t20;
				signed short _t23;
				void* _t25;
				void* _t27;
				short* _t30;
				void* _t31;
				void* _t32;
				intOrPtr* _t38;
				intOrPtr _t43;
				void* _t45;
				signed short* _t46;
				signed short* _t47;
				void* _t48;
				signed short _t49;
				signed short _t50;

				_t43 = _a4;
				_t45 = E00A6AA4A(_t43);
				_t51 = _t45;
				if(_t45 != 0) {
					_t3 = _t45 + 2; // 0x2
					_t30 = _t3;
					__eflags =  *_t30;
					if( *_t30 != 0) {
						L4:
						_t13 = E00A700DF(_t30, L"exe");
						__eflags = _t13;
						if(_t13 == 0) {
							goto L6;
						} else {
							__eflags = E00A700DF(_t30, L"sfx");
							if(__eflags == 0) {
								goto L6;
							}
						}
					} else {
						_t27 = E00A816B5(_t43);
						__eflags = _t27 - _a8 + 0xfffffffd;
						if(_t27 < _a8 + 0xfffffffd) {
							L6:
							E00A81693(_t30, L"rar");
						} else {
							goto L4;
						}
					}
				} else {
					E00A6E81B(_t51, _t43, L".rar", _a8);
					_t45 = E00A6AA4A(_t43);
				}
				_t52 = _a12;
				if(_a12 != 0) {
					_t10 = _t45 + 4; // 0x4
					_t44 = _t10;
					_t16 = E00A6E721( *_t10 & 0x0000ffff);
					__eflags = _t16;
					if(_t16 == 0) {
						L26:
						return E00A81693(_t44, L"00");
					}
					_t46 = _t45 + 6;
					_t19 = E00A6E721( *_t46 & 0x0000ffff);
					__eflags = _t19;
					if(_t19 == 0) {
						goto L26;
					}
					 *_t46 =  *_t46 + 1;
					_t31 = 0x3a;
					__eflags =  *_t46 - _t31;
					if( *_t46 == _t31) {
						_t49 = 0x30;
						while(1) {
							__eflags =  *((short*)(_t46 - 2)) - 0x2e;
							if( *((short*)(_t46 - 2)) == 0x2e) {
								break;
							}
							 *_t46 = _t49;
							_t46 =  &(_t46[0xffffffffffffffff]);
							 *_t46 =  *_t46 + 1;
							__eflags =  *_t46 - _t31;
							if( *_t46 == _t31) {
								continue;
							}
							return _t19;
						}
						_t20 = 0x41;
						 *_t46 = _t20;
						return _t20;
					}
				} else {
					_t19 = E00A6AB3B(_t48, _t52, _t43);
					_t47 = _t19;
					_t32 = 0x3a;
					 *_t47 =  *_t47 + 1;
					if( *_t47 == _t32) {
						_t50 = 0x30;
						while(1) {
							 *_t47 = _t50;
							_t47 = _t47 - 2;
							if(_t47 < _t43) {
								break;
							}
							_t25 = E00A6E721( *_t47 & 0x0000ffff);
							if(_t25 == 0) {
								break;
							}
							 *_t47 =  *_t47 + 1;
							if( *_t47 == _t32) {
								continue;
							}
							return _t25;
						}
						_t38 = _t43 + E00A816B5(_t43) * 2;
						while(1) {
							__eflags = _t38 - _t47;
							if(_t38 == _t47) {
								break;
							}
							 *((short*)(_t38 + 2)) =  *_t38;
							_t38 = _t38 - 2;
							__eflags = _t38;
						}
						_t23 = 0x31;
						_t47[1] = _t23;
						return _t23;
					}
				}
				return _t19;
			}

0x00a6b04a
0x00a6b054
0x00a6b056
0x00a6b058
0x00a6b073
0x00a6b073
0x00a6b076
0x00a6b07a
0x00a6b08e
0x00a6b094
0x00a6b099
0x00a6b09b
0x00000000
0x00a6b09d
0x00a6b0a8
0x00a6b0aa
0x00000000
0x00000000
0x00a6b0aa
0x00a6b07c
0x00a6b07d
0x00a6b08a
0x00a6b08c
0x00a6b0ac
0x00a6b0b2
0x00000000
0x00000000
0x00000000
0x00a6b08c
0x00a6b05a
0x00a6b064
0x00a6b06f
0x00a6b06f
0x00a6b0b9
0x00a6b0be
0x00a6b11e
0x00a6b11e
0x00a6b125
0x00a6b12a
0x00a6b12c
0x00a6b16b
0x00000000
0x00a6b177
0x00a6b12e
0x00a6b135
0x00a6b13a
0x00a6b13c
0x00000000
0x00000000
0x00a6b13e
0x00a6b143
0x00a6b144
0x00a6b147
0x00a6b14b
0x00a6b14c
0x00a6b14c
0x00a6b151
0x00000000
0x00000000
0x00a6b153
0x00a6b156
0x00a6b159
0x00a6b15c
0x00a6b15f
0x00000000
0x00000000
0x00000000
0x00a6b15f
0x00a6b165
0x00a6b166
0x00000000
0x00a6b166
0x00a6b0c0
0x00a6b0c1
0x00a6b0c6
0x00a6b0ca
0x00a6b0cb
0x00a6b0d1
0x00a6b0d9
0x00a6b0da
0x00a6b0da
0x00a6b0dd
0x00a6b0e2
0x00000000
0x00000000
0x00a6b0e8
0x00a6b0ef
0x00000000
0x00000000
0x00a6b0f1
0x00a6b0f7
0x00000000
0x00000000
0x00000000
0x00a6b0f7
0x00a6b102
0x00a6b111
0x00a6b111
0x00a6b113
0x00000000
0x00000000
0x00a6b10a
0x00a6b10e
0x00a6b10e
0x00a6b10e
0x00a6b117
0x00a6b118
0x00000000
0x00a6b118
0x00a6b0d1
0x00a6b17c

APIs

_wcslen.LIBCMT ref: 00A6B07D

Part of subcall function 00A6E81B: _wcslen.LIBCMT ref: 00A6E821

Part of subcall function 00A6AA4A: _wcsrchr.LIBVCRUNTIME ref: 00A6AA61

_wcslen.LIBCMT ref: 00A6B0FC

Strings

.rar, xrefs: 00A6B05E
rar, xrefs: 00A6B0AC
exe, xrefs: 00A6B08E
sfx, xrefs: 00A6B09D

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: _wcslen$_wcsrchr
String ID: .rar$exe$rar$sfx
API String ID: 3513545583-630704357
Opcode ID: d3ec042ff372ddce64c096ed1a6360e4937ce73276f0e32277987206bf830665
Instruction ID: 81186cf114c27b06d4522efeb1471bf3643a8dfeefd8de5b6995194e04887a5f
Opcode Fuzzy Hash: d3ec042ff372ddce64c096ed1a6360e4937ce73276f0e32277987206bf830665
Instruction Fuzzy Hash: 2E310722450311A5D6366F708962A7BA7B8EF12754B204A1EF9D2A70C2F76149C28371

Uniqueness

Uniqueness Score: -1.00%

Function 00A77CB5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E00A77CB5(intOrPtr* __ecx, void* __eflags, intOrPtr _a4, struct HWND__* _a8, intOrPtr _a12, char _a20) {
				struct tagRECT _v20;
				intOrPtr _v28;
				intOrPtr _v36;
				intOrPtr _t36;
				struct HWND__* _t40;
				intOrPtr* _t47;
				void* _t52;
				WCHAR* _t59;
				struct HWND__* _t60;

				_t60 = _a8;
				_t47 = __ecx;
				 *(__ecx + 8) = _t60;
				 *((char*)(__ecx + 0x1e)) = _a20;
				ShowWindow(_t60, 0);
				E00A77A22(_t47, _a4);
				 *(_t47 + 0x14) = _a8;
				 *((intOrPtr*)(_t47 + 0x18)) = _a12;
				GetWindowRect(_t60,  &_v20);
				 *0xa99b54(0,  *0xa99af8(_t60,  &_v20, 2));
				if( *(_t47 + 4) != 0) {
					 *0xa99b08( *(_t47 + 4));
				}
				_t36 = _v36;
				_t40 =  *0xa99b10(0, L"RarHtmlClassName", 0, 0x40000000, _t36 + 1, _v36, _v28 - _t36 - 2, _v28 - _v36,  *0xa99af8(_t60, 0,  *_t47, _t47, _t52));
				 *(_t47 + 4) = _t40;
				if( *((intOrPtr*)(_t47 + 0x10)) != 0) {
					__eflags = _t40;
					if(_t40 != 0) {
						ShowWindow(_t40, 5);
						return  *0xa99b04( *(_t47 + 4));
					}
				} else {
					if(_t60 != 0 &&  *((intOrPtr*)(_t47 + 0x18)) == 0) {
						_t66 =  *(_t47 + 0x14);
						if( *(_t47 + 0x14) != 0) {
							_t40 = E00A77AD8(_t47, _t66,  *(_t47 + 0x14));
							_t59 = _t40;
							if(_t59 != 0) {
								ShowWindow(_t60, 5);
								SetWindowTextW(_t60, _t59);
								return L00A816D0(_t59);
							}
						}
					}
				}
				return _t40;
			}

0x00a77cbe
0x00a77cc2
0x00a77cc8
0x00a77ccb
0x00a77cce
0x00a77cda
0x00a77ce3
0x00a77cea
0x00a77cf3
0x00a77d0a
0x00a77d14
0x00a77d19
0x00a77d19
0x00a77d1f
0x00a77d5a
0x00a77d60
0x00a77d67
0x00a77da1
0x00a77da3
0x00a77da8
0x00000000
0x00a77db1
0x00a77d69
0x00a77d6b
0x00a77d72
0x00a77d75
0x00a77d7c
0x00a77d81
0x00a77d85
0x00a77d8a
0x00a77d92
0x00000000
0x00a77d9e
0x00a77d85
0x00a77d75
0x00a77d6b
0x00a77dbd

APIs

ShowWindow.USER32(?,00000000), ref: 00A77CCE
GetWindowRect.USER32(?,?), ref: 00A77CF3
ShowWindow.USER32(?,00000005,?), ref: 00A77D8A
SetWindowTextW.USER32(?,00000000), ref: 00A77D92
ShowWindow.USER32(00000000,00000005), ref: 00A77DA8

Strings

RarHtmlClassName, xrefs: 00A77D54

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: 74e28eda02c9754a9d0d6ea997f46eed11c21a9214366aa7e9e1ddd0028bf5bc
Instruction ID: 1bc1546cf34abea173a3d9162a53e79c85fd7c5d4b36266b5b77edcd9f11b83b
Opcode Fuzzy Hash: 74e28eda02c9754a9d0d6ea997f46eed11c21a9214366aa7e9e1ddd0028bf5bc
Instruction Fuzzy Hash: 7131C035205210BFE721DFA8AD48A6F7BA8FF48750F04841AFD499A156CB34D901CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A78E44 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 96
windowCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E00A78E44(void* __ecx, void* __edx, void* __eflags, void* __fp0, struct HWND__* _a4, intOrPtr _a8, signed short _a12, intOrPtr _a16) {
				void* __ebp;
				long _t8;
				long _t9;
				void* _t24;
				signed short _t26;
				struct HWND__* _t27;
				intOrPtr _t32;
				void* _t33;
				struct HWND__* _t36;
				void* _t44;

				_t44 = __fp0;
				_t31 = __edx;
				_t26 = _a12;
				_t36 = _a4;
				_t32 = _a8;
				if(E00A61506(__edx, _t36, _t32, _t26, _a16, L"LICENSEDLG", 0, 0) != 0) {
					L15:
					__eflags = 1;
					return 1;
				}
				_t33 = _t32 - 0x110;
				if(_t33 == 0) {
					_t8 =  *0xab3e04;
					__eflags = _t8;
					if(_t8 != 0) {
						SendMessageW(_t36, 0x80, 1, _t8);
					}
					_t9 =  *0xab4e10;
					__eflags = _t9;
					if(__eflags != 0) {
						SendDlgItemMessageW(_t36, 0x66, 0x172, 0, _t9);
					}
					E00A7ACC3(_t31, __eflags, _t44, _t36);
					_t27 = GetDlgItem(_t36, 0x65);
					SendMessageW(_t27, 0x435, 0, 0x10000);
					SendMessageW(_t27, 0x443, 0,  *0xa99b6c(0xf));
					E00A79E5A(_t31, _t36,  *0xaa172c, 3);
					__eflags =  *0xab4e18;
					if(__eflags == 0) {
						L13:
						_push(1);
						L14:
						 *0xa99acc(_t36);
					} else {
						 *0xa99ae0(_t36);
						_push(0);
						E00A77CB5( *0xaa873c, __eflags,  *0xa9bbe0, _t27,  *0xab4e18, 0);
						L00A816D0( *0xab4e18);
					}
					goto L15;
				}
				if(_t33 != 1) {
					L5:
					return 0;
				}
				_t24 = (_t26 & 0x0000ffff) - 1;
				if(_t24 == 0) {
					goto L13;
				}
				if(_t24 == 1) {
					_push(0);
					goto L14;
				}
				goto L5;
			}

0x00a78e44
0x00a78e44
0x00a78e45
0x00a78e4b
0x00a78e52
0x00a78e6b
0x00a78f4e
0x00a78f50
0x00000000
0x00a78f50
0x00a78e71
0x00a78e77
0x00a78e9c
0x00a78ea7
0x00a78ea9
0x00a78eb4
0x00a78eb4
0x00a78eb6
0x00a78ebb
0x00a78ebd
0x00a78ec9
0x00a78ec9
0x00a78ed0
0x00a78ee4
0x00a78eec
0x00a78efe
0x00a78f09
0x00a78f0e
0x00a78f14
0x00a78f45
0x00a78f45
0x00a78f47
0x00a78f48
0x00a78f16
0x00a78f17
0x00a78f23
0x00a78f32
0x00a78f3d
0x00a78f42
0x00000000
0x00a78f14
0x00a78e7c
0x00a78e8f
0x00000000
0x00a78e8f
0x00a78e81
0x00a78e84
0x00000000
0x00000000
0x00a78e8d
0x00a78e96
0x00000000
0x00a78e96
0x00000000

APIs

SendMessageW.USER32(?,00000080,00000001,?), ref: 00A78EB4
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 00A78EC9
GetDlgItem.USER32(?,00000065), ref: 00A78ED8
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 00A78EEC
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00A78EFE

Strings

LICENSEDLG, xrefs: 00A78E58

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: MessageSend$Item
String ID: LICENSEDLG
API String ID: 3888421826-2177901306
Opcode ID: 2f7fedc826464c6372c7a1b5c17a4e11cf52caa812ba43e9120c016422934788
Instruction ID: 69648396bf39152c705145a02ce1f6b7e73b8afcb066a62c8a47e5fc6f8d2dae
Opcode Fuzzy Hash: 2f7fedc826464c6372c7a1b5c17a4e11cf52caa812ba43e9120c016422934788
Instruction Fuzzy Hash: A021DB323802047BD611EBB5ED4DFAB3B5DEB49791F05C405F209950E1CFAA99039671

Uniqueness

Uniqueness Score: -1.00%

Function 00A88A94 Relevance: 10.6, APIs: 7, Instructions: 65
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00A88A94(intOrPtr _a4) {
				void* _t18;
				intOrPtr _t45;

				_t45 = _a4;
				if(_t45 != 0) {
					E00A88A58(_t45, 7);
					_t2 = _t45 + 0x1c; // 0x1c
					E00A88A58(_t2, 7);
					_t3 = _t45 + 0x38; // 0x38
					E00A88A58(_t3, 0xc);
					_t4 = _t45 + 0x68; // 0x68
					E00A88A58(_t4, 0xc);
					_t5 = _t45 + 0x98; // 0x98
					E00A88A58(_t5, 2);
					E00A851AC( *((intOrPtr*)(_t45 + 0xa0)));
					E00A851AC( *((intOrPtr*)(_t45 + 0xa4)));
					E00A851AC( *((intOrPtr*)(_t45 + 0xa8)));
					_t9 = _t45 + 0xb4; // 0xb4
					E00A88A58(_t9, 7);
					_t10 = _t45 + 0xd0; // 0xd0
					E00A88A58(_t10, 7);
					_t11 = _t45 + 0xec; // 0xec
					E00A88A58(_t11, 0xc);
					_t12 = _t45 + 0x11c; // 0x11c
					E00A88A58(_t12, 0xc);
					_t13 = _t45 + 0x14c; // 0x14c
					E00A88A58(_t13, 2);
					E00A851AC( *((intOrPtr*)(_t45 + 0x154)));
					E00A851AC( *((intOrPtr*)(_t45 + 0x158)));
					E00A851AC( *((intOrPtr*)(_t45 + 0x15c)));
					return E00A851AC( *((intOrPtr*)(_t45 + 0x160)));
				}
				return _t18;
			}

0x00a88a9a
0x00a88a9f
0x00a88aa8
0x00a88aad
0x00a88ab3
0x00a88ab8
0x00a88abe
0x00a88ac3
0x00a88ac9
0x00a88ace
0x00a88ad7
0x00a88ae2
0x00a88aed
0x00a88af8
0x00a88afd
0x00a88b06
0x00a88b0b
0x00a88b14
0x00a88b1c
0x00a88b25
0x00a88b2a
0x00a88b33
0x00a88b38
0x00a88b41
0x00a88b4c
0x00a88b57
0x00a88b62
0x00000000
0x00a88b72
0x00a88b77

APIs

Part of subcall function 00A88A58: _free.LIBCMT ref: 00A88A81

_free.LIBCMT ref: 00A88AE2

Part of subcall function 00A851AC: RtlFreeHeap.NTDLL(00000000,00000000,?,00A88A86,00000000,00000000,00000000,00000000,?,00A88AAD,00000000,00000007,00000000,?,00A88EAA,00000000), ref: 00A851C2
Part of subcall function 00A851AC: GetLastError.KERNEL32(00000000,?,00A88A86,00000000,00000000,00000000,00000000,?,00A88AAD,00000000,00000007,00000000,?,00A88EAA,00000000,00000000), ref: 00A851D4

_free.LIBCMT ref: 00A88AED
_free.LIBCMT ref: 00A88AF8
_free.LIBCMT ref: 00A88B4C
_free.LIBCMT ref: 00A88B57
_free.LIBCMT ref: 00A88B62
_free.LIBCMT ref: 00A88B6D

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 31c8cb2a68751e9ba9d5abfbd719d282f1c7ec6da7f78de6818c66f52ba2065d
Instruction ID: dc897f4b84e5c4a68c29c31cc2a9974082902e64312a41df9a5e9e06a036bd70
Opcode Fuzzy Hash: 31c8cb2a68751e9ba9d5abfbd719d282f1c7ec6da7f78de6818c66f52ba2065d
Instruction Fuzzy Hash: 501151B1940B44BEE632BBB0CD0BFCBBB9C5F01740F810D16B6A966092DE79F5454750

Uniqueness

Uniqueness Score: -1.00%

Function 00A85B8C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 53
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 82%

			E00A85B8C(void* __ecx, void* __edx) {
				void* __esi;
				intOrPtr _t2;
				void* _t4;
				void* _t10;
				void* _t11;
				void* _t13;
				void* _t16;
				long _t17;

				_t11 = __ecx;
				_t17 = GetLastError();
				_t10 = 0;
				_t2 =  *0xa9923c; // 0x3
				_t20 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L2:
					_t16 = E00A85277(_t11, 1, 0x364);
					_pop(_t13);
					if(_t16 != 0) {
						_t4 = E00A87137(_t13, _t17, __eflags,  *0xa9923c, _t16);
						__eflags = _t4;
						if(_t4 != 0) {
							E00A8597A(_t13, _t16, 0xab8420);
							E00A851AC(_t10);
							__eflags = _t16;
							if(_t16 != 0) {
								goto L9;
							} else {
								goto L8;
							}
						} else {
							_push(_t16);
							goto L4;
						}
					} else {
						_push(_t10);
						L4:
						E00A851AC();
						L8:
						SetLastError(_t17);
					}
				} else {
					_t16 = E00A870E1(_t11, _t17, _t20, _t2);
					if(_t16 != 0) {
						L9:
						SetLastError(_t17);
						_t10 = _t16;
					} else {
						goto L2;
					}
				}
				return _t10;
			}

0x00a85b8c
0x00a85b97
0x00a85b99
0x00a85b9b
0x00a85ba0
0x00a85ba3
0x00a85bb1
0x00a85bbd
0x00a85bc0
0x00a85bc3
0x00a85bd5
0x00a85bda
0x00a85bdc
0x00a85be7
0x00a85bed
0x00a85bf5
0x00a85bf7
0x00000000
0x00000000
0x00000000
0x00000000
0x00a85bde
0x00a85bde
0x00000000
0x00a85bde
0x00a85bc5
0x00a85bc5
0x00a85bc6
0x00a85bc6
0x00a85bf9
0x00a85bfa
0x00a85bfa
0x00a85ba5
0x00a85bab
0x00a85baf
0x00a85c02
0x00a85c03
0x00a85c09
0x00000000
0x00000000
0x00000000
0x00a85baf
0x00a85c10

APIs

GetLastError.KERNEL32(?,00000000,?,00A8562D,00A852C9,?,00A85B36,00000001,00000364,?,00A81803,00000200,00000000,?), ref: 00A85B91
_free.LIBCMT ref: 00A85BC6
_free.LIBCMT ref: 00A85BED
SetLastError.KERNEL32(00000000,00000000,?), ref: 00A85BFA
SetLastError.KERNEL32(00000000,00000000,?), ref: 00A85C03

Strings

@Mqt0Lqt, xrefs: 00A85B91

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: ErrorLast$_free
String ID: @Mqt0Lqt
API String ID: 3170660625-1302913217
Opcode ID: 1b332e597567cee7e4e6c148e65be471f158d83af0c952e509d7cababd5c65a5
Instruction ID: 5eeb90bcdb7a91169d1605c0576446b106dcbf874dcf664be9ac5a5c0e6eaf27
Opcode Fuzzy Hash: 1b332e597567cee7e4e6c148e65be471f158d83af0c952e509d7cababd5c65a5
Instruction Fuzzy Hash: 9C01D676E05E017BDB12B7745D8AE5F266D9BD1774B340129FC0592152FF20CC028710

Uniqueness

Uniqueness Score: -1.00%

Function 00A7BBE7 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 77%

			E00A7BBE7() {
				intOrPtr _t1;
				_Unknown_base(*)()* _t3;
				void* _t5;
				_Unknown_base(*)()* _t6;
				struct HINSTANCE__* _t14;

				_t1 =  *0xab7e60;
				if(_t1 != 1) {
					if(_t1 == 0) {
						_t14 = GetModuleHandleW(L"KERNEL32.DLL");
						if(_t14 != 0) {
							_t3 = GetProcAddress(_t14, "AcquireSRWLockExclusive");
							if(_t3 == 0) {
								goto L5;
							} else {
								 *0xab7e64 = _t3;
								_t6 = GetProcAddress(_t14, "ReleaseSRWLockExclusive");
								if(_t6 == 0) {
									goto L5;
								} else {
									 *0xab7e68 = _t6;
								}
							}
						} else {
							L5:
							_t14 = 1;
						}
						asm("lock cmpxchg [edx], ecx");
						if(0 != 0 || _t14 != 1) {
							if(0 != 1) {
								_t5 = 1;
							} else {
								goto L12;
							}
						} else {
							L12:
							_t5 = 0;
						}
						return _t5;
					} else {
						return 1;
					}
				} else {
					return 0;
				}
			}

0x00a7bbe7
0x00a7bbf2
0x00a7bbfa
0x00a7bc0c
0x00a7bc10
0x00a7bc1c
0x00a7bc24
0x00000000
0x00a7bc26
0x00a7bc2c
0x00a7bc31
0x00a7bc39
0x00000000
0x00a7bc3b
0x00a7bc3b
0x00a7bc3b
0x00a7bc39
0x00a7bc12
0x00a7bc12
0x00a7bc12
0x00a7bc12
0x00a7bc49
0x00a7bc4f
0x00a7bc57
0x00a7bc5d
0x00000000
0x00000000
0x00000000
0x00a7bc59
0x00a7bc59
0x00a7bc59
0x00a7bc59
0x00a7bc61
0x00a7bbfc
0x00a7bbff
0x00a7bbff
0x00a7bbf4
0x00a7bbf7
0x00a7bbf7

Strings

AcquireSRWLockExclusive, xrefs: 00A7BC16
ReleaseSRWLockExclusive, xrefs: 00A7BC26
KERNEL32.DLL, xrefs: 00A7BC01

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID:
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 0-1718035505
Opcode ID: 0cf96096c0ff031a4d0ad3cbf94dddad85e4de206991fe1a9b024a1eda04a715
Instruction ID: 200c2f36281d0b3c978a001d6ef3e4a4740657a1fbce8d2ba6501c5be19ab567
Opcode Fuzzy Hash: 0cf96096c0ff031a4d0ad3cbf94dddad85e4de206991fe1a9b024a1eda04a715
Instruction Fuzzy Hash: EE01F9F13612229F0F228FA45CC4F9637D85E49352324C1BAE519D3211EF91CC86E7B0

Uniqueness

Uniqueness Score: -1.00%

Function 00A77913 Relevance: 9.1, APIs: 6, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A77913(signed int _a4, intOrPtr _a8, signed int* _a12) {
				signed int _t16;
				signed int _t22;
				void* _t25;
				signed int _t27;
				signed int* _t31;

				_t31 = _a12;
				if(_t31 != 0) {
					_t29 = _a8;
					_t25 = 0x10;
					if(E00A7D710(_a8, 0xa9077c, _t25) == 0) {
						L18:
						_t27 = _a4;
						 *_t31 = _t27;
						L19:
						 *((intOrPtr*)( *_t27 + 4))(_t27);
						_t16 = 0;
						L21:
						return _t16;
					}
					if(E00A7D710(_t29, 0xa907bc, _t25) != 0) {
						if(E00A7D710(_t29, 0xa9079c, _t25) != 0) {
							if(E00A7D710(_t29, 0xa9076c, _t25) != 0) {
								if(E00A7D710(_t29, 0xa907ec, _t25) != 0) {
									if(E00A7D710(_t29, 0xa9075c, _t25) != 0) {
										 *_t31 =  *_t31 & 0x00000000;
										_t16 = 0x80004002;
										goto L21;
									}
									goto L18;
								}
								_t27 = _a4;
								if(_t27 == 0) {
									L15:
									_t22 = 0;
									L16:
									 *_t31 = _t22;
									goto L19;
								}
								_t22 = _t27 + 0x10;
								goto L16;
							}
							_t27 = _a4;
							if(_t27 == 0) {
								goto L15;
							}
							_t22 = _t27 + 0xc;
							goto L16;
						}
						_t27 = _a4;
						if(_t27 == 0) {
							goto L15;
						}
						_t22 = _t27 + 8;
						goto L16;
					}
					_t27 = _a4;
					if(_t27 == 0) {
						goto L15;
					}
					_t22 = _t27 + 4;
					goto L16;
				}
				return 0x80004003;
			}

0x00a77917
0x00a7791c
0x00a7792a
0x00a7792f
0x00a77941
0x00a779dc
0x00a779dc
0x00a779df
0x00a779e1
0x00a779e4
0x00a779e7
0x00a779f3
0x00000000
0x00a779f4
0x00a77958
0x00a77977
0x00a77996
0x00a779b5
0x00a779da
0x00a779eb
0x00a779ee
0x00000000
0x00a779ee
0x00000000
0x00a779da
0x00a779b7
0x00a779bc
0x00a779c3
0x00a779c3
0x00a779c5
0x00a779c5
0x00000000
0x00a779c5
0x00a779be
0x00000000
0x00a779be
0x00a77998
0x00a7799d
0x00000000
0x00000000
0x00a7799f
0x00000000
0x00a7799f
0x00a77979
0x00a7797e
0x00000000
0x00000000
0x00a77980
0x00000000
0x00a77980
0x00a7795a
0x00a7795f
0x00000000
0x00000000
0x00a77961
0x00000000
0x00a77961
0x00000000

APIs

_memcmp.LIBVCRUNTIME ref: 00A77937
_memcmp.LIBVCRUNTIME ref: 00A7794E

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: b8a97c8da1165779cf98acb0f0773141cf873089f35a78f62a5ba9c6620c135f
Instruction ID: a9375a69820ccd48437422c01cd2fd1bbdc2349cdc8e55a062ad125b51069f37
Opcode Fuzzy Hash: b8a97c8da1165779cf98acb0f0773141cf873089f35a78f62a5ba9c6620c135f
Instruction Fuzzy Hash: F021A17230A205BBDF949B209C81F3F37B89F51795B24C82DFE4DAA106F322DD019651

Uniqueness

Uniqueness Score: -1.00%

Function 00A6F1AC Relevance: 9.1, APIs: 6, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00A6F1AC(void* __ecx, void* __edx) {
				void* __esi;
				signed int _t11;
				intOrPtr _t12;
				intOrPtr _t14;
				signed int _t15;
				void* _t16;
				intOrPtr _t17;
				intOrPtr _t18;
				void* _t24;
				signed int _t29;
				void* _t31;

				_t24 = __edx;
				_t16 = __ecx;
				E00A7C16C(E00A8EE26, _t31);
				_push(_t16);
				EnterCriticalSection(0xaa14a0);
				_t17 =  *0xaa14bc; // 0x0
				_t29 = 0;
				_t18 = _t17 + 1;
				 *0xaa14bc = _t18;
				_t34 = _t17;
				if(_t17 == 0) {
					_t14 = E00A7C12B(_t24, 0, _t34, 0x1b8);
					 *((intOrPtr*)(_t31 - 0x10)) = _t14;
					 *(_t31 - 4) = 0;
					if(_t14 == 0) {
						_t15 = 0;
					} else {
						_t15 = E00A6EFDA(_t14, 0x20);
					}
					 *(_t31 - 4) =  *(_t31 - 4) | 0xffffffff;
					_t18 =  *0xaa14bc; // 0x0
					 *0xaa14b8 = _t15;
				}
				_t37 = _t18 - 1;
				if(_t18 <= 1) {
					LeaveCriticalSection(0xaa14a0);
					_t11 =  *0xaa14b8; // 0x111a6e8
				} else {
					_t12 = E00A7C12B(_t24, _t29, _t37, 0x1b8);
					 *((intOrPtr*)(_t31 - 0x10)) = _t12;
					 *(_t31 - 4) = 1;
					if(_t12 != 0) {
						_t29 = E00A6EFDA(_t12, 0x20);
					}
					LeaveCriticalSection(0xaa14a0);
					_t11 = _t29;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t31 - 0xc));
				return _t11;
			}

0x00a6f1ac
0x00a6f1ac
0x00a6f1b1
0x00a6f1b6
0x00a6f1bf
0x00a6f1c5
0x00a6f1cb
0x00a6f1cf
0x00a6f1d0
0x00a6f1d6
0x00a6f1d8
0x00a6f1df
0x00a6f1e5
0x00a6f1e8
0x00a6f1ed
0x00a6f1fa
0x00a6f1ef
0x00a6f1f3
0x00a6f1f3
0x00a6f1fc
0x00a6f200
0x00a6f206
0x00a6f206
0x00a6f20b
0x00a6f20e
0x00a6f240
0x00a6f246
0x00a6f210
0x00a6f215
0x00a6f21b
0x00a6f21e
0x00a6f227
0x00a6f232
0x00a6f232
0x00a6f235
0x00a6f23b
0x00a6f23b
0x00a6f250
0x00a6f25a

APIs

__EH_prolog.LIBCMT ref: 00A6F1B1
EnterCriticalSection.KERNEL32(00AA14A0,00000000,?,?,00A6A1DD,?,00A6C325,?,00000000,?,00000001,?,?,00A7311E,?,00008000), ref: 00A6F1BF
new.LIBCMT ref: 00A6F1DF
new.LIBCMT ref: 00A6F215
LeaveCriticalSection.KERNEL32(00AA14A0,?,00A6A1DD,?,00A6C325,?,00000000,?,00000001,?,?,00A7311E,?,00008000,?), ref: 00A6F235
LeaveCriticalSection.KERNEL32(00AA14A0,?,00A6A1DD,?,00A6C325,?,00000000,?,00000001,?,?,00A7311E,?,00008000,?), ref: 00A6F240

Part of subcall function 00A6EFDA: InitializeCriticalSection.KERNEL32(000001A0,00AA14A0,00000000,?,?,00A6F232,00000020,?,00A6A1DD,?,00A6C325,?,00000000,?,00000001,?), ref: 00A6F013
Part of subcall function 00A6EFDA: CreateSemaphoreW.KERNEL32(00000000,00000000,00000020,00000000,?,00A6A1DD,?,00A6C325,?,00000000,?,00000001,?,?,00A7311E,?), ref: 00A6F01D
Part of subcall function 00A6EFDA: CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,00A6A1DD,?,00A6C325,?,00000000,?,00000001,?,?,00A7311E,?), ref: 00A6F02D

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: CriticalSection$CreateLeave$EnterEventH_prologInitializeSemaphore
String ID:
API String ID: 3919453512-0
Opcode ID: 7a6968752cb0812724527d2c757e8880a46d60970407ce1d12e3245478be8231
Instruction ID: 73a478093e02c007a8fc22c14c1b7610b46fcd1dea1c2f57d972d2554354390e
Opcode Fuzzy Hash: 7a6968752cb0812724527d2c757e8880a46d60970407ce1d12e3245478be8231
Instruction Fuzzy Hash: 38117379A04212EFC714EBA8EC5566D76B4EB4AB60F10823EF806D72D1DB7448028B54

Uniqueness

Uniqueness Score: -1.00%

Function 00A6AC19 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 146
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A6AC19(void* __edx, signed short* _a4, intOrPtr _a8, intOrPtr _a12) {
				short _v4100;
				signed short* _t29;
				long _t31;
				signed short* _t32;
				void* _t38;
				signed short* _t55;
				void* _t56;
				signed short* _t74;
				signed short* _t76;
				void* _t78;

				E00A7C240();
				_t74 = _a4;
				if( *_t74 != 0) {
					E00A6ADCD(_t74);
					_t78 = E00A816B5(_t74);
					_t29 = E00A6ADF9(_t74);
					__eflags = _t29;
					if(_t29 == 0) {
						_t31 = GetCurrentDirectoryW(0x7ff,  &_v4100);
						__eflags = _t31;
						if(_t31 == 0) {
							L23:
							_t32 = 0;
							__eflags = 0;
							L24:
							L25:
							L26:
							return _t32;
						}
						__eflags = _t31 - 0x7ff;
						if(_t31 > 0x7ff) {
							goto L23;
						}
						__eflags = E00A6AED4( *_t74 & 0x0000ffff);
						if(__eflags == 0) {
							E00A6A7A3(__eflags,  &_v4100, 0x800);
							_t38 = E00A816B5( &_v4100);
							__eflags = _a12 - _t38 + 4 + _t78;
							if(_a12 <= _t38 + 4 + _t78) {
								goto L23;
							}
							_t80 = _a8;
							E00A82B91(_a8, L"\\\\?\\", 4);
							E00A81693(_t80 + 8,  &_v4100);
							__eflags =  *_t74 - 0x2e;
							if(__eflags == 0) {
								__eflags = E00A6AED4(_t74[1] & 0x0000ffff);
								if(__eflags != 0) {
									__eflags = _t74;
								}
							}
							E00A6E81B(__eflags, _t80, _t74, _a12);
							L22:
							_t32 = 1;
							goto L24;
						}
						_t12 = _t78 + 6; // 0x6
						__eflags = _a12 - _t12;
						if(_a12 <= _t12) {
							goto L23;
						}
						_t81 = _a8;
						E00A82B91(_a8, L"\\\\?\\", 4);
						E00A82B91(_t81 + 8,  &_v4100, 2);
						E00A81693(_t81 + 0xc, _t74);
						goto L22;
					}
					_t55 = E00A6ADCD(_t74);
					__eflags = _t55;
					if(_t55 == 0) {
						_t56 = 0x5c;
						__eflags =  *_t74 - _t56;
						if( *_t74 != _t56) {
							L11:
							_t32 = 0;
							goto L25;
						}
						_t76 =  &(_t74[1]);
						__eflags =  *_t76 - _t56;
						if( *_t76 != _t56) {
							goto L11;
						}
						_t6 = _t78 + 6; // 0x6
						__eflags = _a12 - _t6;
						if(_a12 <= _t6) {
							goto L11;
						}
						_t82 = _a8;
						E00A82B91(_a8, L"\\\\?\\", 4);
						E00A81693(_t82 + 8, L"UNC");
						E00A81693(_t82 + 0xe, _t76);
						L10:
						_t32 = 1;
						goto L25;
					}
					_t2 = _t78 + 4; // 0x4
					__eflags = _a12 - _t2;
					if(_a12 <= _t2) {
						goto L11;
					}
					_t83 = _a8;
					E00A82B91(_a8, L"\\\\?\\", 4);
					E00A81693(_t83 + 8, _t74);
					goto L10;
				}
				_t32 = 0;
				goto L26;
			}

0x00a6ac21
0x00a6ac27
0x00a6ac2e
0x00a6ac39
0x00a6ac46
0x00a6ac48
0x00a6ac4d
0x00a6ac4f
0x00a6ace5
0x00a6aceb
0x00a6aced
0x00a6adb5
0x00a6adb5
0x00a6adb5
0x00a6adb7
0x00a6adb8
0x00a6adb9
0x00a6adbd
0x00a6adbd
0x00a6acf3
0x00a6acf5
0x00000000
0x00000000
0x00a6ad04
0x00a6ad06
0x00a6ad51
0x00a6ad5d
0x00a6ad68
0x00a6ad6b
0x00000000
0x00000000
0x00a6ad6d
0x00a6ad78
0x00a6ad88
0x00a6ad90
0x00a6ad94
0x00a6ada0
0x00a6ada2
0x00a6ada4
0x00a6ada4
0x00a6ada2
0x00a6adac
0x00a6adb1
0x00a6adb1
0x00000000
0x00a6adb1
0x00a6ad08
0x00a6ad0b
0x00a6ad0e
0x00000000
0x00000000
0x00a6ad14
0x00a6ad1f
0x00a6ad31
0x00a6ad3b
0x00000000
0x00a6ad40
0x00a6ac56
0x00a6ac5b
0x00a6ac5d
0x00a6ac88
0x00a6ac89
0x00a6ac8c
0x00a6acd0
0x00a6acd0
0x00000000
0x00a6acd0
0x00a6ac8e
0x00a6ac91
0x00a6ac94
0x00000000
0x00000000
0x00a6ac96
0x00a6ac99
0x00a6ac9c
0x00000000
0x00000000
0x00a6ac9e
0x00a6aca9
0x00a6acb7
0x00a6acc1
0x00a6acc9
0x00a6acc9
0x00000000
0x00a6acc9
0x00a6ac5f
0x00a6ac62
0x00a6ac65
0x00000000
0x00000000
0x00a6ac67
0x00a6ac72
0x00a6ac7c
0x00000000
0x00a6ac81
0x00a6ac30
0x00000000

APIs

_wcslen.LIBCMT ref: 00A6AC3F

Strings

UNC, xrefs: 00A6ACB1
\\?\, xrefs: 00A6AC6C, 00A6ACA3, 00A6AD19, 00A6AD72

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: _wcslen
String ID: UNC$\\?\
API String ID: 176396367-253988292
Opcode ID: d5b72c8294e4625f1a37ae9a5274bfe78ec96fe1f268feaed77cdfc70e68a39d
Instruction ID: ebde861a134ce7e7e9d8af3faef357a1c280adebf612c4f5549971459bf74046
Opcode Fuzzy Hash: d5b72c8294e4625f1a37ae9a5274bfe78ec96fe1f268feaed77cdfc70e68a39d
Instruction Fuzzy Hash: EB41D2B6840205ABDB20BFA0CC46FEB73BCAF24701F044466F955A7141F774DA819BA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A6C4F4 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 134
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00A6C4F4(intOrPtr* __ecx, char _a8, char _a20, char _a4103, char _a4104, char _a4116, intOrPtr _a8216, intOrPtr _a8220, signed int _a8224, intOrPtr _a8228, intOrPtr _a8232) {
				char _v24;
				short* _t22;
				intOrPtr _t24;
				signed int _t37;
				void* _t46;
				intOrPtr* _t49;
				intOrPtr _t51;
				signed int _t59;
				void* _t64;
				void* _t67;
				intOrPtr* _t68;
				intOrPtr _t70;
				void* _t72;
				signed int _t73;
				void* _t80;
				void* _t81;

				_t22 = 0x2014;
				E00A7C240();
				_t49 = __ecx;
				_t70 = _a8216;
				if( *__ecx == 0) {
					L21:
					if(_t70 != _a8220) {
						_t22 = E00A81693(_a8220, _t70);
					}
					goto L23;
				} else {
					_t64 = 0xa8f5c0;
					_t24 = _a8228;
					if(_t24 == 0) {
						_t64 = 0xa8f5c4;
					} else {
						_t46 = _t24 - 1;
						if(_t46 == 0) {
							_t64 = 0xa8f5c8;
						} else {
							if(_t46 == 1) {
								_t64 = 0xa8f5cc;
							}
						}
					}
					_t67 = E00A65C44(0xffffffff, _t64, 1);
					if(_a8220 != 0) {
						E00A6FED3(_a8232,  &_a4116, 0x1000);
						_t67 = E00A65C44(_t67,  &_a4104, E00A81720( &_a4104));
					}
					E00A6FED3(_t70,  &_a20, 0x1000);
					_a4103 = 0;
					E00A63CE2( &_v24, 0xa, L"%08x",  !(E00A65C44(_t67,  &_a8, E00A81720( &_a8))));
					_t81 = _t81 + 0x10;
					_t56 = _t49;
					_t22 = E00A6C9A1(_t49,  &_v24);
					if(_t22 == 0) {
						goto L21;
					} else {
						_t14 = _t22 + 0x12; // 0x12
						_t68 = _t14;
						_t80 = 0x22;
						if( *_t68 == _t80) {
							_t68 = _t68 + 2;
						}
						_push(0xc);
						_push(_t68);
						_t72 = E00A7F472(_t56);
						if(_t72 == 0) {
							_t73 = 0xff;
						} else {
							_t73 = _t72 - _t68 >> 1;
						}
						_t37 = _a8224;
						_t59 = _t37 - 1;
						if(_t73 > _t59) {
							asm("sbb esi, esi");
							_t73 =  ~_t37 & _t59;
						}
						_t51 = _a8220;
						if(_t73 != 0) {
							E00A82B91(_t51, _t68, _t73);
							_t81 = _t81 + 0xc;
						}
						 *((short*)(_t51 + _t73 * 2)) = 0;
						_t22 = E00A7F64B(_t51, _t80);
						if(_t22 != 0) {
							 *_t22 = 0;
						}
						L23:
						return _t22;
					}
				}
			}

0x00a6c4f4
0x00a6c4f9
0x00a6c4ff
0x00a6c503
0x00a6c50e
0x00a6c652
0x00a6c659
0x00a6c663
0x00a6c669
0x00000000
0x00a6c514
0x00a6c51b
0x00a6c520
0x00a6c523
0x00a6c53d
0x00a6c525
0x00a6c525
0x00a6c528
0x00a6c536
0x00a6c52a
0x00a6c52d
0x00a6c52f
0x00a6c52f
0x00a6c52d
0x00a6c528
0x00a6c554
0x00a6c55b
0x00a6c56d
0x00a6c58f
0x00a6c58f
0x00a6c598
0x00a6c5a1
0x00a6c5cb
0x00a6c5d0
0x00a6c5d7
0x00a6c5da
0x00a6c5e1
0x00000000
0x00a6c5e3
0x00a6c5e5
0x00a6c5e5
0x00a6c5e8
0x00a6c5ec
0x00a6c5ee
0x00a6c5ee
0x00a6c5f1
0x00a6c5f3
0x00a6c5f9
0x00a6c5ff
0x00a6c607
0x00a6c601
0x00a6c603
0x00a6c603
0x00a6c60c
0x00a6c613
0x00a6c618
0x00a6c61e
0x00a6c620
0x00a6c620
0x00a6c622
0x00a6c62b
0x00a6c630
0x00a6c635
0x00a6c635
0x00a6c63c
0x00a6c640
0x00a6c649
0x00a6c64d
0x00a6c64d
0x00a6c66a
0x00a6c674
0x00a6c674
0x00a6c5e1

APIs

_strlen.LIBCMT ref: 00A6C57A
_strlen.LIBCMT ref: 00A6C5AA
_swprintf.LIBCMT ref: 00A6C5CB
_wcsrchr.LIBVCRUNTIME ref: 00A6C640

Strings

%08x, xrefs: 00A6C5BF

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: _strlen$_swprintf_wcsrchr
String ID: %08x
API String ID: 2422602752-3682738293
Opcode ID: 0fbe487f1779b7c95a2876e7f8741da179255038abcb8a485bebd8dd79cd14c3
Instruction ID: be7f3bf8333b7b7d760373440d256c1c3b0aced1e80145406e30a7e4a1c4b5ae
Opcode Fuzzy Hash: 0fbe487f1779b7c95a2876e7f8741da179255038abcb8a485bebd8dd79cd14c3
Instruction Fuzzy Hash: 5F411A329043516AD734AB24CD49EBB73FCEB44720F10153AF9CAD7192EA35ED448766

Uniqueness

Uniqueness Score: -1.00%

Function 00A7FD30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00A7FD30(void* __ebx, void* __edi, void* __esi, void* __eflags, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				void* _t48;
				char _t50;
				signed int _t56;
				intOrPtr _t57;
				void* _t58;
				intOrPtr _t61;
				char _t66;
				intOrPtr _t73;
				intOrPtr _t75;
				signed int _t77;
				char _t79;
				intOrPtr _t82;
				intOrPtr _t91;
				intOrPtr _t93;
				intOrPtr* _t97;
				void* _t101;
				void* _t103;
				void* _t111;

				_t73 = _a8;
				_v5 = 0;
				_t95 = _t73 + 0x10;
				_v16 = 1;
				_v20 = _t73 + 0x10;
				_v12 =  *(_t73 + 8) ^  *0xa991b8;
				_t48 = E00A7FCF0( *(_t73 + 8) ^  *0xa991b8, _t73 + 0x10);
				_t91 = _a12;
				_push(_t91);
				E00A80F99(_t48);
				_t50 = _a4;
				_t103 = _t101 - 0x1c + 0xc;
				if(( *(_t50 + 4) & 0x00000066) != 0) {
					__eflags =  *((intOrPtr*)(_t73 + 0xc)) - 0xfffffffe;
					if( *((intOrPtr*)(_t73 + 0xc)) != 0xfffffffe) {
						E00A810E7(_t73, 0xfffffffe, _t95, 0xa991b8);
						goto L18;
					}
					goto L19;
				} else {
					_v32 = _t50;
					_v28 = _t91;
					_t93 =  *((intOrPtr*)(_t73 + 0xc));
					 *((intOrPtr*)(_t73 - 4)) =  &_v32;
					if(_t93 == 0xfffffffe) {
						L19:
						return _v16;
					} else {
						do {
							_t77 = _v12;
							_t19 = _t93 + 2; // 0x3
							_t56 = _t93 + _t19 * 2;
							_t75 =  *((intOrPtr*)(_t77 + _t56 * 4));
							_t57 = _t77 + _t56 * 4;
							_t78 =  *((intOrPtr*)(_t57 + 4));
							_v24 = _t57;
							if( *((intOrPtr*)(_t57 + 4)) == 0) {
								_t79 = _v5;
								goto L12;
							} else {
								_t58 = E00A8109E(_t78, _t95);
								_t79 = 1;
								_v5 = 1;
								_t111 = _t58;
								if(_t111 < 0) {
									_v16 = 0;
									L18:
									E00A7FCF0(_v12, _t95);
									goto L19;
								} else {
									if(_t111 <= 0) {
										goto L12;
									} else {
										_t59 = _a4;
										if( *_a4 == 0xe06d7363) {
											_t113 =  *0xa90974;
											if( *0xa90974 != 0) {
												_t59 = E00A8E6D0(_t113, 0xa90974);
												_t103 = _t103 + 4;
												if(_t59 != 0) {
													_t97 =  *0xa90974; // 0xa8020c
													L00A7CB5A();
													_t59 =  *_t97(_a4, 1);
													_t95 = _v20;
													_t103 = _t103 + 8;
												}
											}
										}
										E00A810CE(_t59, _a8, _a4);
										_t61 = _a8;
										if( *((intOrPtr*)(_t61 + 0xc)) != _t93) {
											E00A810E7(_t61, _t93, _t95, 0xa991b8);
											_t61 = _a8;
										}
										 *((intOrPtr*)(_t61 + 0xc)) = _t75;
										E00A7FCF0(_v12, _t95);
										_t82 =  *((intOrPtr*)(_v24 + 8));
										E00A810B5();
										asm("int3");
										E00A81517();
										E00A814C1();
										if(E00A810FE() != 0) {
											_t66 = E00A80165(_t82, __eflags);
											__eflags = _t66;
											if(_t66 != 0) {
												E00A8004E();
												return 1;
											} else {
												E00A8113A();
												goto L23;
											}
										} else {
											L23:
											return 0;
										}
									}
								}
							}
							goto L27;
							L12:
							_t93 = _t75;
							__eflags = _t75 - 0xfffffffe;
						} while (_t75 != 0xfffffffe);
						__eflags = _t79;
						if(_t79 != 0) {
							goto L18;
						}
						goto L19;
					}
				}
				L27:
			}

0x00a7fd37
0x00a7fd3c
0x00a7fd43
0x00a7fd4e
0x00a7fd55
0x00a7fd58
0x00a7fd5b
0x00a7fd60
0x00a7fd63
0x00a7fd64
0x00a7fd69
0x00a7fd6c
0x00a7fd73
0x00a7fe2d
0x00a7fe31
0x00a7fe40
0x00000000
0x00a7fe40
0x00000000
0x00a7fd79
0x00a7fd79
0x00a7fd7f
0x00a7fd82
0x00a7fd85
0x00a7fd8b
0x00a7fe51
0x00a7fe5a
0x00a7fd91
0x00a7fd91
0x00a7fd91
0x00a7fd94
0x00a7fd97
0x00a7fd9a
0x00a7fd9d
0x00a7fda0
0x00a7fda3
0x00a7fda8
0x00a7fe10
0x00000000
0x00a7fdaa
0x00a7fdac
0x00a7fdb1
0x00a7fdb3
0x00a7fdb6
0x00a7fdb8
0x00a7fe24
0x00a7fe45
0x00a7fe49
0x00000000
0x00a7fdba
0x00a7fdba
0x00000000
0x00a7fdbc
0x00a7fdbc
0x00a7fdc5
0x00a7fdc7
0x00a7fdce
0x00a7fdd5
0x00a7fdda
0x00a7fddf
0x00a7fde1
0x00a7fdee
0x00a7fdf3
0x00a7fdf5
0x00a7fdf8
0x00a7fdf8
0x00a7fddf
0x00a7fdce
0x00a7fe01
0x00a7fe06
0x00a7fe0c
0x00a7fe65
0x00a7fe6a
0x00a7fe6a
0x00a7fe71
0x00a7fe74
0x00a7fe81
0x00a7fe84
0x00a7fe89
0x00a7fe8a
0x00a7fe8f
0x00a7fe9b
0x00a7fea0
0x00a7fea5
0x00a7fea7
0x00a7feb0
0x00a7feb7
0x00a7fea9
0x00a7fea9
0x00000000
0x00a7fea9
0x00a7fe9d
0x00a7fe9d
0x00a7fe9f
0x00a7fe9f
0x00a7fe9b
0x00a7fdba
0x00a7fdb8
0x00000000
0x00a7fe13
0x00a7fe13
0x00a7fe15
0x00a7fe15
0x00a7fe1e
0x00a7fe20
0x00000000
0x00a7fe22
0x00000000
0x00a7fe20
0x00a7fd8b
0x00000000

APIs

_ValidateLocalCookies.LIBCMT ref: 00A7FD5B
__IsNonwritableInCurrentImage.LIBCMT ref: 00A7FDD5

Part of subcall function 00A8E6D0: __FindPESection.LIBCMT ref: 00A8E729

_ValidateLocalCookies.LIBCMT ref: 00A7FE49
_ValidateLocalCookies.LIBCMT ref: 00A7FE74

Strings

csm, xrefs: 00A7FDBF

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentFindImageNonwritableSection
String ID: csm
API String ID: 1685366865-1018135373
Opcode ID: 6bff381241d1379746501f0eccd753097cc050bd4b3803d9bf781228e9dd8b7b
Instruction ID: 51e87d8779294761721c9c810a1dc7523c750b31a3a7f387f9e2cc3edc0da714
Opcode Fuzzy Hash: 6bff381241d1379746501f0eccd753097cc050bd4b3803d9bf781228e9dd8b7b
Instruction Fuzzy Hash: 1141A430A00209AFCF10DF59CC85AAEBBB5AF45324F14C169EC199B253D735DE56CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A777FB Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 113
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00A777FB(void* __edx, void* __eflags) {
				void* __ecx;
				signed int _t30;
				signed short* _t35;
				signed int _t38;
				void* _t45;
				void* _t46;
				signed short* _t49;
				void* _t52;
				void* _t54;
				void* _t55;
				signed short* _t56;
				void* _t57;
				signed short* _t59;
				signed short* _t61;
				signed short* _t62;
				void* _t63;
				void* _t64;

				_t61 =  *(_t63 + 0x10);
				_push(0x200 + E00A816B5(_t61) * 0xc);
				_t56 = E00A82C59(0x200 + E00A816B5(_t61) * 0xc);
				 *(_t63 + 0x14) = _t56;
				if(_t56 != 0) {
					E00A81693(_t56, L"<style>body{font-family:\"Arial\";font-size:12;}</style>");
					_t38 = E00A816B5(_t56);
					_t64 = _t63 + 0xc;
					_t59 = _t61;
					if( *_t61 == 0) {
						L19:
						_t56[_t38] = 0;
						L00A816D0(_t61);
						return _t56;
					}
					_t45 = 0xd;
					_t54 = 0xa;
					do {
						_t30 =  *_t59 & 0x0000ffff;
						if(_t30 != _t45 || _t59[1] != _t54) {
							L12:
							if(_t59 <= _t61) {
								L17:
								_t56[_t38] = _t30;
								_t38 = _t38 + 1;
								goto L18;
							}
							_t46 = 0x20;
							if(_t30 != _t46 ||  *((intOrPtr*)(_t59 - 2)) != _t46) {
								goto L17;
							} else {
								E00A81693( &(_t56[_t38]), L"&nbsp;");
								_t38 = _t38 + 6;
								goto L16;
							}
						} else {
							_t55 = 0xd;
							_t4 =  &(_t59[2]); // 0x4
							_t49 = _t4;
							 *(_t64 + 0x14) = _t49;
							_t54 = 0xa;
							if( *_t49 != _t55 || _t59[3] != _t54) {
								goto L12;
							} else {
								_t62 =  &(_t56[_t38]);
								_t57 = _t54;
								while(_t59[3] == _t57) {
									E00A81693(_t62, L"<br>");
									_t59 =  *(_t64 + 0x18);
									_t38 = _t38 + 4;
									_t35 =  &(_t59[2]);
									_t62 =  &(_t62[4]);
									_t52 = 0xd;
									 *(_t64 + 0x10) = _t35;
									if( *_t35 == _t52) {
										continue;
									}
									break;
								}
								_t56 =  *(_t64 + 0x14);
								_t59 =  &(_t59[1]);
								_t61 =  *(_t64 + 0x1c);
								L16:
								_t54 = 0xa;
								goto L18;
							}
						}
						L18:
						_t59 =  &(_t59[1]);
						_t45 = 0xd;
					} while ( *_t59 != 0);
					goto L19;
				}
				return _t61;
			}

0x00a777fe
0x00a77812
0x00a77818
0x00a7781a
0x00a77822
0x00a77833
0x00a7783e
0x00a77840
0x00a77845
0x00a7784b
0x00a778fb
0x00a778fe
0x00a77902
0x00000000
0x00a7790b
0x00a77853
0x00a77856
0x00a77857
0x00a77857
0x00a7785d
0x00a778bb
0x00a778bd
0x00a778e5
0x00a778e5
0x00a778e9
0x00000000
0x00a778e9
0x00a778c1
0x00a778c5
0x00000000
0x00a778cd
0x00a778d6
0x00a778dd
0x00000000
0x00a778dd
0x00a77865
0x00a77867
0x00a77868
0x00a77868
0x00a77870
0x00a77874
0x00a77875
0x00000000
0x00a7787d
0x00a7787e
0x00a77881
0x00a77882
0x00a7788e
0x00a77893
0x00a77897
0x00a7789e
0x00a778a1
0x00a778a4
0x00a778a5
0x00a778ac
0x00000000
0x00000000
0x00000000
0x00a778ac
0x00a778ae
0x00a778b2
0x00a778b5
0x00a778e0
0x00a778e2
0x00000000
0x00a778e2
0x00a77875
0x00a778ea
0x00a778ea
0x00a778f1
0x00a778f2
0x00000000
0x00a77857
0x00000000

APIs

_wcslen.LIBCMT ref: 00A77804
_wcslen.LIBCMT ref: 00A77839

Strings

<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00A7782D
<br>, xrefs: 00A77888
 , xrefs: 00A778D0

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: _wcslen
String ID:  $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 176396367-864536935
Opcode ID: c31c83c5fa82de0dcb86e3c4053b0aa676dde8e0951388cdfcd22b20933a5efc
Instruction ID: 2e12df949e9b6907c56d70e7d2645a7a855cf9ba52b70bd75031c5d9f482ea69
Opcode Fuzzy Hash: c31c83c5fa82de0dcb86e3c4053b0aa676dde8e0951388cdfcd22b20933a5efc
Instruction Fuzzy Hash: 22312E326483015AE624BB24DC46A7E73A4EB50710F64C43FF49957190F7A0A9C1C3A6

Uniqueness

Uniqueness Score: -1.00%

Function 00A7AC31 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00A7AC31(void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR* _a16) {
				void* _t12;
				WCHAR* _t16;
				void* _t17;
				struct HWND__* _t18;
				intOrPtr _t19;
				void* _t20;
				signed short _t23;

				_t16 = _a16;
				_t23 = _a12;
				_t19 = _a8;
				_t18 = _a4;
				if(E00A61506(_t17, _t18, _t19, _t23, _t16, L"RENAMEDLG", 0, 0) != 0) {
					L10:
					return 1;
				}
				_t20 = _t19 - 0x110;
				if(_t20 == 0) {
					 *0xab5e30 = _t16;
					SetDlgItemTextW(_t18, 0x65, _t16);
					SetDlgItemTextW(_t18, 0x66,  *0xab5e30);
					goto L10;
				}
				if(_t20 != 1) {
					L5:
					return 0;
				}
				_t12 = (_t23 & 0x0000ffff) - 1;
				if(_t12 == 0) {
					GetDlgItemTextW(_t18, 0x66,  *0xab5e30, 0x800);
					_push(1);
					L7:
					 *0xa99acc(_t18);
					goto L10;
				}
				if(_t12 == 1) {
					_push(0);
					goto L7;
				}
				goto L5;
			}

0x00a7ac32
0x00a7ac37
0x00a7ac3c
0x00a7ac41
0x00a7ac59
0x00a7acb9
0x00000000
0x00a7acbb
0x00a7ac5b
0x00a7ac61
0x00a7aca6
0x00a7acac
0x00a7acb7
0x00000000
0x00a7acb7
0x00a7ac66
0x00a7ac75
0x00000000
0x00a7ac75
0x00a7ac6b
0x00a7ac6e
0x00a7ac92
0x00a7ac98
0x00a7ac7b
0x00a7ac7c
0x00000000
0x00a7ac7c
0x00a7ac73
0x00a7ac79
0x00000000
0x00a7ac79
0x00000000

APIs

GetDlgItemTextW.USER32(?,00000066,00000800), ref: 00A7AC92
SetDlgItemTextW.USER32(?,00000065,?), ref: 00A7ACAC
SetDlgItemTextW.USER32(?,00000066), ref: 00A7ACB7

Strings

PH]w, xrefs: 00A7AC92
RENAMEDLG, xrefs: 00A7AC49

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: ItemText
String ID: PH]w$RENAMEDLG
API String ID: 3367045223-14874849
Opcode ID: 0433c8a7b10aed58f12008448c7ddf0d4ed3f4befa8586111b2e245bcc064828
Instruction ID: f54fc907ed010d3210a553d33a1fae8fdc736c487cbf8cff3badefd3399456cf
Opcode Fuzzy Hash: 0433c8a7b10aed58f12008448c7ddf0d4ed3f4befa8586111b2e245bcc064828
Instruction Fuzzy Hash: 2601F933A402147BD2139BE56D48F3F7B7DF796B41F048519F305A64A1C693AC029762

Uniqueness

Uniqueness Score: -1.00%

Function 00A842DA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E00A842DA(void* __ecx, void* __esi, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				signed int _t10;
				struct HINSTANCE__** _t12;
				intOrPtr* _t23;
				signed int _t25;

				_t10 =  *0xa991b8; // 0x3197ea2d
				_v8 = _t10 ^ _t25;
				_v12 = _v12 & 0x00000000;
				_t12 =  &_v12;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t12, __ecx, __ecx);
				if(_t12 != 0) {
					_t23 = GetProcAddress(_v12, "CorExitProcess");
					if(_t23 != 0) {
						 *0xa8f21c(_a4);
						 *_t23();
					}
				}
				if(_v12 != 0) {
					FreeLibrary(_v12);
				}
				return E00A7CABF(_v8 ^ _t25);
			}

0x00a842e1
0x00a842e8
0x00a842eb
0x00a842ef
0x00a842fa
0x00a84302
0x00a84313
0x00a84317
0x00a8431e
0x00a84324
0x00a84324
0x00a84326
0x00a8432b
0x00a84330
0x00a84330
0x00a84343

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00A842CF,?,?,00A8426F,?,00A97048,0000000C,00A84382,?,00000002), ref: 00A842FA
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00A8430D
FreeLibrary.KERNEL32(00000000,?,?,?,00A842CF,?,?,00A8426F,?,00A97048,0000000C,00A84382,?,00000002,00000000), ref: 00A84330

Strings

CorExitProcess, xrefs: 00A84305
mscoree.dll, xrefs: 00A842F3

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: d057e17c243e4dc9bbdf7a5cfa020747334d4233f4c10f4aaaa8e626c0588632
Instruction ID: c2d12dc84329388ffa3dde30ba91260b0654cd5cc7a2d004c57c6e7dbe8e2d67
Opcode Fuzzy Hash: d057e17c243e4dc9bbdf7a5cfa020747334d4233f4c10f4aaaa8e626c0588632
Instruction Fuzzy Hash: A9F04434A4021ABFCB11EF94DC09BDEBFB5EF08752F504169B805E6150DB719E51CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A6DA91 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A6DA91(struct HINSTANCE__** __ecx) {
				void* _t5;
				struct HINSTANCE__* _t6;
				struct HINSTANCE__** _t9;

				_t9 = __ecx;
				if(__ecx[1] == 0) {
					_t6 = E00A6E9B3(L"Crypt32.dll");
					 *__ecx = _t6;
					if(_t6 != 0) {
						_t9[2] = GetProcAddress(_t6, "CryptProtectMemory");
						_t6 = GetProcAddress( *_t9, "CryptUnprotectMemory");
						_t9[3] = _t6;
					}
					_t9[1] = 1;
					return _t6;
				}
				return _t5;
			}

0x00a6da92
0x00a6da98
0x00a6da9f
0x00a6daa4
0x00a6daa8
0x00a6dabd
0x00a6dac0
0x00a6dac6
0x00a6dac6
0x00a6dac9
0x00000000
0x00a6dac9
0x00a6dace

APIs

Part of subcall function 00A6E9B3: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00A6E9CE
Part of subcall function 00A6E9B3: LoadLibraryW.KERNELBASE(?,?,00A6DAA4,Crypt32.dll,?,00A6DB27,?,00A6DB0A,?,?,?,?), ref: 00A6E9F0

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00A6DAB0
GetProcAddress.KERNEL32(00AA0E40,CryptUnprotectMemory), ref: 00A6DAC0

Strings

CryptUnprotectMemory, xrefs: 00A6DAB6
Crypt32.dll, xrefs: 00A6DA9A
CryptProtectMemory, xrefs: 00A6DAAA

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: b6afb40261c390962fa8a59f5d95a8ebcccb0a3a7a8de80ce40b2ff0a8eb1efa
Instruction ID: 1c4bd813fe17ce96475e6e06db72d7ffce400da104a7a67e4c41823ede840311
Opcode Fuzzy Hash: b6afb40261c390962fa8a59f5d95a8ebcccb0a3a7a8de80ce40b2ff0a8eb1efa
Instruction Fuzzy Hash: 67E04FB09587437ECB00EBB59D08A05FBB47F54751B248535A014D2651EBB4D0A1CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A84B3B Relevance: 7.6, APIs: 5, Instructions: 129
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 83%

			E00A84B3B(signed int* __ecx, signed int __edx) {
				signed int _v8;
				intOrPtr* _v12;
				signed int _v16;
				signed int _t28;
				signed int _t29;
				intOrPtr _t33;
				signed int _t37;
				signed int _t38;
				signed int _t40;
				void* _t50;
				signed int _t56;
				intOrPtr* _t57;
				signed int _t68;
				signed int _t71;
				signed int _t72;
				signed int _t74;
				signed int _t75;
				signed int _t78;
				signed int _t80;
				signed int* _t81;
				signed int _t85;
				void* _t86;

				_t72 = __edx;
				_v12 = __ecx;
				_t28 =  *__ecx;
				_t81 =  *_t28;
				if(_t81 != 0) {
					_t29 =  *0xa991b8; // 0x3197ea2d
					_t56 =  *_t81 ^ _t29;
					_t78 = _t81[1] ^ _t29;
					_t83 = _t81[2] ^ _t29;
					asm("ror edi, cl");
					asm("ror esi, cl");
					asm("ror ebx, cl");
					if(_t78 != _t83) {
						L14:
						 *_t78 = E00A849FC( *((intOrPtr*)( *((intOrPtr*)(_v12 + 4)))));
						_t33 = E00A7C410(_t56);
						_t57 = _v12;
						 *((intOrPtr*)( *((intOrPtr*)( *_t57)))) = _t33;
						_t24 = _t78 + 4; // 0x4
						 *((intOrPtr*)( *((intOrPtr*)( *_t57)) + 4)) = E00A7C410(_t24);
						 *((intOrPtr*)( *((intOrPtr*)( *_t57)) + 8)) = E00A7C410(_t83);
						_t37 = 0;
						L15:
						return _t37;
					}
					_t38 = 0x200;
					_t85 = _t83 - _t56 >> 2;
					if(_t85 <= 0x200) {
						_t38 = _t85;
					}
					_t80 = _t38 + _t85;
					if(_t80 == 0) {
						_t80 = 0x20;
					}
					if(_t80 < _t85) {
						L9:
						_push(4);
						_t80 = _t85 + 4;
						_push(_t80);
						_v8 = E00A881B7(_t56);
						_t40 = E00A851AC(0);
						_t68 = _v8;
						_t86 = _t86 + 0x10;
						if(_t68 != 0) {
							goto L11;
						}
						_t37 = _t40 | 0xffffffff;
						goto L15;
					} else {
						_push(4);
						_push(_t80);
						_v8 = E00A881B7(_t56);
						E00A851AC(0);
						_t68 = _v8;
						_t86 = _t86 + 0x10;
						if(_t68 != 0) {
							L11:
							_t56 = _t68;
							_v8 = _t68 + _t85 * 4;
							_t83 = _t68 + _t80 * 4;
							_t78 = _v8;
							_push(0x20);
							asm("ror eax, cl");
							_t71 = _t78;
							_v16 = 0 ^  *0xa991b8;
							asm("sbb edx, edx");
							_t74 =  !_t72 & _t68 + _t80 * 0x00000004 - _t78 + 0x00000003 >> 0x00000002;
							_v8 = _t74;
							if(_t74 == 0) {
								goto L14;
							}
							_t75 = _v16;
							_t50 = 0;
							do {
								_t50 = _t50 + 1;
								 *_t71 = _t75;
								_t71 = _t71 + 4;
							} while (_t50 != _v8);
							goto L14;
						}
						goto L9;
					}
				}
				return _t28 | 0xffffffff;
			}

0x00a84b3b
0x00a84b45
0x00a84b49
0x00a84b4b
0x00a84b4f
0x00a84b59
0x00a84b6a
0x00a84b6f
0x00a84b71
0x00a84b73
0x00a84b75
0x00a84b77
0x00a84b7b
0x00a84c35
0x00a84c43
0x00a84c45
0x00a84c4a
0x00a84c51
0x00a84c53
0x00a84c61
0x00a84c70
0x00a84c73
0x00a84c75
0x00000000
0x00a84c76
0x00a84b83
0x00a84b88
0x00a84b8d
0x00a84b8f
0x00a84b8f
0x00a84b91
0x00a84b96
0x00a84b9a
0x00a84b9a
0x00a84b9d
0x00a84bbc
0x00a84bbc
0x00a84bbe
0x00a84bc1
0x00a84bca
0x00a84bcd
0x00a84bd2
0x00a84bd5
0x00a84bda
0x00000000
0x00000000
0x00a84bdc
0x00000000
0x00a84b9f
0x00a84b9f
0x00a84ba1
0x00a84baa
0x00a84bad
0x00a84bb2
0x00a84bb5
0x00a84bba
0x00a84be4
0x00a84be7
0x00a84be9
0x00a84bec
0x00a84bf4
0x00a84bfa
0x00a84c01
0x00a84c03
0x00a84c0b
0x00a84c1a
0x00a84c1e
0x00a84c20
0x00a84c23
0x00000000
0x00000000
0x00a84c25
0x00a84c28
0x00a84c2a
0x00a84c2a
0x00a84c2b
0x00a84c2d
0x00a84c30
0x00000000
0x00a84c2a
0x00000000
0x00a84bba
0x00a84b9d
0x00000000

APIs

_free.LIBCMT ref: 00A84BAD
_free.LIBCMT ref: 00A84BCD

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 25b3b5665d039eab189ee18dbd90c603bdd7e9e44911948a61615f97a7049b9d
Instruction ID: 8f311a0e9103094cdde6c4f5c22ead2f935867dfff81ea0ac09a346d2aa38923
Opcode Fuzzy Hash: 25b3b5665d039eab189ee18dbd90c603bdd7e9e44911948a61615f97a7049b9d
Instruction Fuzzy Hash: 8541C476A002049FDB14EF78C985A6EB7B5EF88724F2585ADE915EB341DB31ED01CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00A88134 Relevance: 7.6, APIs: 5, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00A88134() {
				int _v8;
				void* __ecx;
				void* _t6;
				int _t7;
				char* _t13;
				int _t17;
				void* _t19;
				char* _t25;
				WCHAR* _t27;

				_t27 = GetEnvironmentStringsW();
				if(_t27 == 0) {
					L7:
					_t13 = 0;
				} else {
					_t6 = E00A880FD(_t27);
					_pop(_t19);
					_t17 = _t6 - _t27 >> 1;
					_t7 = WideCharToMultiByte(0, 0, _t27, _t17, 0, 0, 0, 0);
					_v8 = _t7;
					if(_t7 == 0) {
						goto L7;
					} else {
						_t25 = E00A851E6(_t19, _t7);
						if(_t25 == 0 || WideCharToMultiByte(0, 0, _t27, _t17, _t25, _v8, 0, 0) == 0) {
							_t13 = 0;
						} else {
							_t13 = _t25;
							_t25 = 0;
						}
						E00A851AC(_t25);
					}
				}
				if(_t27 != 0) {
					FreeEnvironmentStringsW(_t27);
				}
				return _t13;
			}

0x00a88143
0x00a88149
0x00a881a1
0x00a881a1
0x00a8814b
0x00a8814c
0x00a88151
0x00a8815a
0x00a88160
0x00a88166
0x00a8816b
0x00000000
0x00a8816d
0x00a88173
0x00a88178
0x00a88196
0x00a88190
0x00a88190
0x00a88192
0x00a88192
0x00a88199
0x00a8819e
0x00a8816b
0x00a881a5
0x00a881a8
0x00a881a8
0x00a881b6

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00A8813D
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A88160

Part of subcall function 00A851E6: RtlAllocateHeap.NTDLL(00000000,?,?,?,00A8199A,?,0000015D,?,?,?,?,00A82519,000000FF,00000000,?,?), ref: 00A85218

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00A88186
_free.LIBCMT ref: 00A88199
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00A881A8

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 801377d0367b50523393f760f8fdbae22e6baea088a6a7e9731bb61ff200a819
Instruction ID: 5d27006b42f23cbd36d1d4ff02a57a9f99da8638834310ce1a0031f1e2a89104
Opcode Fuzzy Hash: 801377d0367b50523393f760f8fdbae22e6baea088a6a7e9731bb61ff200a819
Instruction Fuzzy Hash: 3D018872601616BF672177B6ED8CD7B6A7DDAC2B643950329FE04D6140DE648C0383B1

Uniqueness

Uniqueness Score: -1.00%

Function 00A889EF Relevance: 7.5, APIs: 5, Instructions: 40
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00A889EF(intOrPtr* _a4) {
				intOrPtr _t6;
				intOrPtr* _t21;
				void* _t23;
				void* _t24;
				void* _t25;
				void* _t26;
				void* _t27;

				_t21 = _a4;
				if(_t21 != 0) {
					_t23 =  *_t21 -  *0xa998e0; // 0xa998d4
					if(_t23 != 0) {
						E00A851AC(_t7);
					}
					_t24 =  *((intOrPtr*)(_t21 + 4)) -  *0xa998e4; // 0xab8894
					if(_t24 != 0) {
						E00A851AC(_t8);
					}
					_t25 =  *((intOrPtr*)(_t21 + 8)) -  *0xa998e8; // 0xab8894
					if(_t25 != 0) {
						E00A851AC(_t9);
					}
					_t26 =  *((intOrPtr*)(_t21 + 0x30)) -  *0xa99910; // 0xa998d8
					if(_t26 != 0) {
						E00A851AC(_t10);
					}
					_t6 =  *((intOrPtr*)(_t21 + 0x34));
					_t27 = _t6 -  *0xa99914; // 0xab8898
					if(_t27 != 0) {
						return E00A851AC(_t6);
					}
				}
				return _t6;
			}

0x00a889f5
0x00a889fa
0x00a889fe
0x00a88a04
0x00a88a07
0x00a88a0c
0x00a88a10
0x00a88a16
0x00a88a19
0x00a88a1e
0x00a88a22
0x00a88a28
0x00a88a2b
0x00a88a30
0x00a88a34
0x00a88a3a
0x00a88a3d
0x00a88a42
0x00a88a43
0x00a88a46
0x00a88a4c
0x00000000
0x00a88a54
0x00a88a4c
0x00a88a57

APIs

_free.LIBCMT ref: 00A88A07

Part of subcall function 00A851AC: RtlFreeHeap.NTDLL(00000000,00000000,?,00A88A86,00000000,00000000,00000000,00000000,?,00A88AAD,00000000,00000007,00000000,?,00A88EAA,00000000), ref: 00A851C2
Part of subcall function 00A851AC: GetLastError.KERNEL32(00000000,?,00A88A86,00000000,00000000,00000000,00000000,?,00A88AAD,00000000,00000007,00000000,?,00A88EAA,00000000,00000000), ref: 00A851D4

_free.LIBCMT ref: 00A88A19
_free.LIBCMT ref: 00A88A2B
_free.LIBCMT ref: 00A88A3D
_free.LIBCMT ref: 00A88A4F

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 82bd80cd3a4e7c8d0f9f2736721e9579bf6f84b0e8488c134d2c653a324ea806
Instruction ID: abb5ef3db376f83f7a447f9ba046d0da11b83316bf4792678de76f42b9273d11
Opcode Fuzzy Hash: 82bd80cd3a4e7c8d0f9f2736721e9579bf6f84b0e8488c134d2c653a324ea806
Instruction Fuzzy Hash: 85F04F32A04600ABD626FFA8F589D1BB7D9AA45750395080FF408D7561CF34FC808760

Uniqueness

Uniqueness Score: -1.00%

Function 00A70101 Relevance: 7.5, APIs: 5, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A70101(void* __eflags, short* _a4, short* _a8, int _a12) {
				void* _t10;
				int _t22;
				int _t23;

				_t10 = E00A816B5(_a4);
				_t23 = _a12;
				if(_t10 + 1 >= _t23) {
					_t22 = _t23;
				} else {
					_t4 = E00A816B5(_a4) + 1; // 0x1
					_t22 = _t4;
				}
				if(E00A816B5(_a8) + 1 < _t23) {
					_t7 = E00A816B5(_a8) + 1; // 0x1
					_t23 = _t7;
				}
				return CompareStringW(0x400, 0x1001, _a4, _t22, _a8, _t23) - 2;
			}

0x00a70109
0x00a7010e
0x00a70115
0x00a70125
0x00a70117
0x00a70120
0x00a70120
0x00a70120
0x00a70133
0x00a7013e
0x00a7013e
0x00a7013e
0x00a7015f

APIs

_wcslen.LIBCMT ref: 00A70109
_wcslen.LIBCMT ref: 00A7011A
_wcslen.LIBCMT ref: 00A7012A
_wcslen.LIBCMT ref: 00A70138
CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,?,00000000,?,00A6A4D1,__rar_,00000000,00000006,?,?,00000000), ref: 00A70153

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: _wcslen$CompareString
String ID:
API String ID: 3397213944-0
Opcode ID: 237e508e4b2f2d7457b109c5e47e1c1f643df385e699cdb48e5de1683607eb48
Instruction ID: 8cb3b5d963c2135769ad7701252c8bd53a00ad410169a86a97cb88ed39becd7b
Opcode Fuzzy Hash: 237e508e4b2f2d7457b109c5e47e1c1f643df385e699cdb48e5de1683607eb48
Instruction Fuzzy Hash: FFF01732108014BFCF126F61ED49CCA3F2AEB84764B25C126FA5A5E161DA3295629B94

Uniqueness

Uniqueness Score: -1.00%

Function 00A84D8D Relevance: 7.5, APIs: 5, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00A84D8D(signed int __ecx) {
				intOrPtr _t7;

				asm("lock xadd [eax], ecx");
				if((__ecx | 0xffffffff) == 0) {
					_t7 =  *0xa998d0; // 0x10e68c8
					if(_t7 != 0xa996b0) {
						E00A851AC(_t7);
						 *0xa998d0 = 0xa996b0;
					}
				}
				E00A851AC( *0xab8418);
				 *0xab8418 = 0;
				E00A851AC( *0xab841c);
				 *0xab841c = 0;
				E00A851AC( *0xab8868);
				 *0xab8868 = 0;
				E00A851AC( *0xab886c);
				 *0xab886c = 0;
				return 1;
			}

0x00a84d96
0x00a84d9a
0x00a84d9c
0x00a84da8
0x00a84dab
0x00a84db1
0x00a84db1
0x00a84da8
0x00a84dbd
0x00a84dca
0x00a84dd0
0x00a84ddb
0x00a84de1
0x00a84dec
0x00a84df2
0x00a84dfa
0x00a84e03

APIs

_free.LIBCMT ref: 00A84DAB

Part of subcall function 00A851AC: RtlFreeHeap.NTDLL(00000000,00000000,?,00A88A86,00000000,00000000,00000000,00000000,?,00A88AAD,00000000,00000007,00000000,?,00A88EAA,00000000), ref: 00A851C2
Part of subcall function 00A851AC: GetLastError.KERNEL32(00000000,?,00A88A86,00000000,00000000,00000000,00000000,?,00A88AAD,00000000,00000007,00000000,?,00A88EAA,00000000,00000000), ref: 00A851D4

_free.LIBCMT ref: 00A84DBD
_free.LIBCMT ref: 00A84DD0
_free.LIBCMT ref: 00A84DE1
_free.LIBCMT ref: 00A84DF2

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 67de464bd606f95496c0d2a617ac2be91f3f365b903634d3d5dc0d989aa18fb5
Instruction ID: 89b6119e1be11b785c87f1589b90c7745faf0090a349842591063f51514a6907
Opcode Fuzzy Hash: 67de464bd606f95496c0d2a617ac2be91f3f365b903634d3d5dc0d989aa18fb5
Instruction Fuzzy Hash: A8F0B270950621AFEA03FFAEBC4554A3EE9A71A724741831AF81896272CF394943DFD0

Uniqueness

Uniqueness Score: -1.00%

Function 00A620A6 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 407
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00A620A6(intOrPtr __ecx) {
				signed int _t124;
				void* _t125;
				signed int _t126;
				signed int _t128;
				unsigned int _t129;
				signed int _t133;
				signed int _t150;
				signed int _t153;
				signed int _t158;
				signed char _t161;
				signed char _t162;
				signed char _t194;
				signed char _t206;
				signed int _t207;
				signed int _t210;
				intOrPtr _t214;
				void* _t221;
				signed int _t223;
				signed int _t224;
				signed char _t239;
				intOrPtr _t240;
				intOrPtr _t243;
				intOrPtr _t246;
				intOrPtr _t282;
				signed int _t283;
				intOrPtr _t285;
				signed int _t289;
				void* _t290;
				void* _t291;
				void* _t293;
				void* _t294;
				void* _t295;
				void* _t296;
				void* _t297;
				void* _t298;
				void* _t299;
				void* _t300;
				intOrPtr* _t302;
				signed int _t305;
				void* _t306;
				char* _t307;
				void* _t308;
				void* _t309;
				signed int _t315;
				signed int _t328;

				E00A7C240();
				_t285 =  *((intOrPtr*)(_t309 + 0x20bc));
				 *((intOrPtr*)(_t309 + 8)) = __ecx;
				_t282 =  *((intOrPtr*)(_t285 + 0x14));
				_t124 = _t282 -  *((intOrPtr*)(_t309 + 0x20c0));
				if(_t124 <  *(_t285 + 0x18)) {
					L86:
					return _t124;
				}
				_t283 = _t282 - _t124;
				 *(_t285 + 0x18) = _t124;
				if(_t283 >= 2) {
					_t214 =  *((intOrPtr*)(_t309 + 0x20c8));
					while(1) {
						_t124 = E00A6BEDC();
						if((_t124 | _t283) == 0) {
							break;
						}
						_t289 =  *(_t285 + 0x18);
						_t221 =  *((intOrPtr*)(_t285 + 0x14)) - _t289;
						if(_t221 == 0) {
							break;
						}
						_t315 = _t283;
						if(_t315 > 0 || _t315 >= 0 && _t124 > _t221) {
							break;
						} else {
							_t305 = _t289 + _t124;
							 *(_t309 + 0x24) = _t305;
							_t125 = E00A6BEDC();
							_t306 = _t305 -  *(_t285 + 0x18);
							_t290 = _t125;
							_t223 = 0;
							_t126 = _t283;
							 *(_t309 + 0x20) = _t126;
							 *(_t309 + 0x1c) = 0;
							if( *((intOrPtr*)(_t214 + 4)) != 1 || _t290 != 1 || _t126 != 0) {
								L19:
								if( *((intOrPtr*)(_t214 + 4)) == 2 ||  *((intOrPtr*)(_t214 + 4)) == 3) {
									_t328 = _t126;
									if(_t328 > 0 || _t328 >= 0 && _t290 > 7) {
										goto L84;
									} else {
										_t291 = _t290 - 1;
										if(_t291 == 0) {
											_t128 = E00A6BEDC();
											__eflags = _t128;
											if(_t128 == 0) {
												_t129 = E00A6BEDC();
												 *(_t214 + 0x10b1) = _t129 & 0x00000001;
												 *(_t214 + 0x10ba) = _t129 >> 0x00000001 & 0x00000001;
												_t133 = E00A6BD8F(_t285) & 0x000000ff;
												 *(_t214 + 0x10dc) = _t133;
												__eflags = _t133 - 0x18;
												if(_t133 > 0x18) {
													E00A63C6F( *((intOrPtr*)(_t309 + 0x14)), _t214 + 0x20);
												}
												E00A6BE3E(_t285, _t214 + 0x1091, 0x10);
												E00A6BE3E(_t285, _t214 + 0x10a1, 0x10);
												__eflags =  *(_t214 + 0x10b1);
												if( *(_t214 + 0x10b1) != 0) {
													_t292 = _t214 + 0x10b2;
													E00A6BE3E(_t285, _t214 + 0x10b2, 8);
													E00A6BE3E(_t285, _t309 + 0x2c, 4);
													E00A6E222(_t309 + 0x54);
													E00A6E268(_t309 + 0x5c, _t214 + 0x10b2, 8);
													_push(_t309 + 0x2c);
													E00A6E17B(_t309 + 0x58);
													_t150 = E00A7D710(_t309 + 0x30, _t309 + 0x30, 4);
													_t309 = _t309 + 0xc;
													asm("sbb al, al");
													__eflags =  *((intOrPtr*)(_t214 + 4)) - 3;
													 *(_t214 + 0x10b1) =  ~_t150 + 1;
													if( *((intOrPtr*)(_t214 + 4)) == 3) {
														_t153 = E00A7D710(_t292, 0xa8f310, 8);
														_t309 = _t309 + 0xc;
														__eflags = _t153;
														if(_t153 == 0) {
															 *(_t214 + 0x10b1) = _t153;
														}
													}
												}
												 *((char*)(_t214 + 0x1090)) = 1;
												 *((intOrPtr*)(_t214 + 0x108c)) = 5;
												 *((char*)(_t214 + 0x108b)) = 1;
											} else {
												E00A63C6F( *((intOrPtr*)(_t309 + 0x14)), _t214 + 0x20);
											}
											goto L84;
										}
										_t293 = _t291 - 1;
										if(_t293 == 0) {
											_t158 = E00A6BEDC();
											__eflags = _t158;
											if(_t158 != 0) {
												goto L84;
											}
											_push(0x20);
											 *((intOrPtr*)(_t214 + 0x1060)) = 3;
											_push(_t214 + 0x1064);
											L35:
											E00A6BE3E(_t285);
											goto L84;
										}
										_t294 = _t293 - 1;
										if(_t294 == 0) {
											__eflags = _t223;
											if(__eflags < 0) {
												goto L84;
											}
											if(__eflags > 0) {
												L60:
												_t161 = E00A6BEDC();
												 *(_t309 + 0x12) = _t161;
												_t162 = _t161 & 0x00000001;
												_t239 =  *(_t309 + 0x12);
												 *(_t309 + 0x13) = _t162;
												__eflags = _t239 & 0x00000002;
												if((_t239 & 0x00000002) != 0) {
													_t246 = _t285;
													__eflags = _t162;
													if(__eflags == 0) {
														E00A6F828(_t214 + 0x1030, E00A6BE1E(_t246, __eflags), _t283);
													} else {
														E00A6F4CD(_t214 + 0x1030, E00A6BDDC(_t246), 0);
													}
													_t239 =  *(_t309 + 0x12);
													_t162 =  *(_t309 + 0x13);
												}
												__eflags = _t239 & 0x00000004;
												if((_t239 & 0x00000004) != 0) {
													_t243 = _t285;
													__eflags = _t162;
													if(__eflags == 0) {
														E00A6F828(_t214 + 0x1038, E00A6BE1E(_t243, __eflags), _t283);
													} else {
														E00A6F4CD(_t214 + 0x1038, E00A6BDDC(_t243), 0);
													}
												}
												__eflags =  *(_t309 + 0x12) & 0x00000008;
												if(( *(_t309 + 0x12) & 0x00000008) != 0) {
													__eflags =  *(_t309 + 0x13);
													_t240 = _t285;
													if(__eflags == 0) {
														E00A6F828(_t214 + 0x1040, E00A6BE1E(_t240, __eflags), _t283);
													} else {
														E00A6F4CD(_t214 + 0x1040, E00A6BDDC(_t240), 0);
													}
												}
												goto L84;
											}
											__eflags = _t306 - 9;
											if(_t306 < 9) {
												goto L84;
											}
											goto L60;
										}
										_t295 = _t294 - 1;
										if(_t295 == 0) {
											__eflags = _t223;
											if(__eflags < 0) {
												goto L84;
											}
											if(__eflags > 0) {
												L55:
												E00A6BEDC();
												__eflags = E00A6BEDC();
												if(__eflags != 0) {
													 *((char*)(_t214 + 0x10e3)) = 1;
													E00A63CE2(_t309 + 0x34, 0x14, L";%u", _t176);
													_t309 = _t309 + 0x10;
													E00A6E81B(__eflags,  *(_t309 + 0x1c) + 0x22a0, _t309 + 0x2c, 0x800);
												}
												goto L84;
											}
											__eflags = _t306 - 1;
											if(_t306 < 1) {
												goto L84;
											}
											goto L55;
										}
										_t296 = _t295 - 1;
										if(_t296 == 0) {
											 *((intOrPtr*)(_t214 + 0x10f0)) = E00A6BEDC();
											 *(_t214 + 0x20f4) = E00A6BEDC() & 0x00000001;
											_t297 = E00A6BEDC();
											 *((char*)(_t309 + 0xc4)) = 0;
											__eflags = _t297 - 0x1fff;
											if(_t297 < 0x1fff) {
												E00A6BE3E(_t285, _t309 + 0xc8, _t297);
												 *((char*)(_t309 + _t297 + 0xc4)) = 0;
											}
											E00A6B264(_t309 + 0xc8, _t309 + 0xc8, 0x2000);
											_push(0x800);
											_push(_t214 + 0x10f4);
											_push(_t309 + 0xcc);
											E00A6FD55();
											goto L84;
										}
										_t298 = _t296 - 1;
										if(_t298 == 0) {
											_t194 = E00A6BEDC();
											 *(_t309 + 0x18) = _t194;
											_t307 = _t214 + 0x20f8;
											 *(_t214 + 0x20f6) = _t194 >> 0x00000002 & 0x00000001;
											 *(_t214 + 0x20f7) = _t194 >> 0x00000003 & 0x00000001;
											 *((char*)(_t214 + 0x21f8)) = 0;
											 *_t307 = 0;
											__eflags = _t194 & 0x00000001;
											if((_t194 & 0x00000001) != 0) {
												_t300 = E00A6BEDC();
												__eflags = _t300 - 0xff;
												if(_t300 >= 0xff) {
													_t300 = 0xff;
												}
												E00A6BE3E(_t285, _t307, _t300);
												_t194 =  *(_t309 + 0x18);
												 *((char*)(_t300 + _t307)) = 0;
											}
											__eflags = _t194 & 0x00000002;
											if((_t194 & 0x00000002) != 0) {
												_t299 = E00A6BEDC();
												__eflags = _t299 - 0xff;
												if(_t299 >= 0xff) {
													_t299 = 0xff;
												}
												_t308 = _t214 + 0x21f8;
												E00A6BE3E(_t285, _t308, _t299);
												 *((char*)(_t299 + _t308)) = 0;
											}
											__eflags =  *(_t214 + 0x20f6);
											if( *(_t214 + 0x20f6) != 0) {
												 *((intOrPtr*)(_t214 + 0x22f8)) = E00A6BEDC();
											}
											__eflags =  *(_t214 + 0x20f7);
											if( *(_t214 + 0x20f7) != 0) {
												 *((intOrPtr*)(_t214 + 0x22fc)) = E00A6BEDC();
											}
											 *((char*)(_t214 + 0x20f5)) = 1;
											goto L84;
										}
										if(_t298 != 1) {
											goto L84;
										}
										if( *((intOrPtr*)(_t214 + 4)) == 3 &&  *((intOrPtr*)(_t285 + 0x14)) -  *(_t309 + 0x24) == 1) {
											_t306 = _t306 + 1;
										}
										_t302 = _t214 + 0x1020;
										E00A61F56(_t302, _t306);
										_push(_t306);
										_push( *_t302);
										goto L35;
									}
								} else {
									L84:
									_t224 =  *(_t309 + 0x24);
									 *(_t285 + 0x18) = _t224;
									_t124 =  *((intOrPtr*)(_t285 + 0x14)) - _t224;
									if(_t124 >= 2) {
										continue;
									}
									break;
								}
							} else {
								 *((char*)(_t214 + 0x1e)) = 1;
								_t206 = E00A6BEDC();
								 *(_t309 + 0x18) = _t206;
								if((_t206 & 0x00000001) != 0) {
									_t210 = E00A6BEDC();
									if((_t210 | _t283) != 0) {
										asm("adc eax, edx");
										 *((intOrPtr*)(_t214 + 0x20)) =  *((intOrPtr*)( *((intOrPtr*)(_t309 + 0x14)) + 0x6cd8)) + _t210;
										 *((intOrPtr*)(_t214 + 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t309 + 0x14)) + 0x6cdc));
									}
									_t206 =  *(_t309 + 0x18);
								}
								if((_t206 & 0x00000002) != 0) {
									_t207 = E00A6BEDC();
									if((_t207 | _t283) != 0) {
										asm("adc eax, edx");
										 *((intOrPtr*)(_t214 + 0x30)) =  *((intOrPtr*)( *((intOrPtr*)(_t309 + 0x14)) + 0x6cd8)) + _t207;
										 *((intOrPtr*)(_t214 + 0x34)) =  *((intOrPtr*)( *((intOrPtr*)(_t309 + 0x14)) + 0x6cdc));
									}
								}
								_t223 =  *(_t309 + 0x1c);
								_t126 =  *(_t309 + 0x20);
								goto L19;
							}
						}
					}
				}
			}

0x00a620ab
0x00a620b1
0x00a620b8
0x00a620bc
0x00a620c1
0x00a620cb
0x00a62634
0x00a6263b
0x00a6263b
0x00a620d1
0x00a620d3
0x00a620d9
0x00a620e0
0x00a620e9
0x00a620eb
0x00a620f4
0x00000000
0x00000000
0x00a620fd
0x00a62100
0x00a62102
0x00000000
0x00000000
0x00a62108
0x00a6210a
0x00000000
0x00a6211a
0x00a6211a
0x00a6211f
0x00a62123
0x00a62128
0x00a6212b
0x00a6212d
0x00a6212f
0x00a62135
0x00a62139
0x00a6213d
0x00a621c5
0x00a621c9
0x00a621d5
0x00a621d7
0x00000000
0x00a621e8
0x00a621e8
0x00a621eb
0x00a624fa
0x00a624ff
0x00a62501
0x00a62517
0x00a62525
0x00a6252d
0x00a62538
0x00a6253b
0x00a62541
0x00a62544
0x00a6254e
0x00a6254e
0x00a6255e
0x00a6256e
0x00a62573
0x00a6257a
0x00a62582
0x00a6258b
0x00a62599
0x00a625a3
0x00a625b0
0x00a625b9
0x00a625bf
0x00a625d0
0x00a625d5
0x00a625da
0x00a625de
0x00a625e2
0x00a625e8
0x00a625f2
0x00a625f7
0x00a625fa
0x00a625fc
0x00a625fe
0x00a625fe
0x00a625fc
0x00a625e8
0x00a62604
0x00a6260b
0x00a62615
0x00a62503
0x00a6250b
0x00a6250b
0x00000000
0x00a62501
0x00a621f1
0x00a621f4
0x00a624d3
0x00a624d8
0x00a624da
0x00000000
0x00000000
0x00a624e0
0x00a624e8
0x00a624f2
0x00a62249
0x00a6224b
0x00000000
0x00a6224b
0x00a621fa
0x00a621fd
0x00a623fa
0x00a623fc
0x00000000
0x00000000
0x00a62402
0x00a6240d
0x00a6240f
0x00a62414
0x00a62418
0x00a6241a
0x00a6241e
0x00a62422
0x00a62425
0x00a62427
0x00a62429
0x00a6242b
0x00a6244f
0x00a6242d
0x00a6243b
0x00a6243b
0x00a62454
0x00a62458
0x00a62458
0x00a6245c
0x00a6245f
0x00a62461
0x00a62463
0x00a62465
0x00a62489
0x00a62467
0x00a62475
0x00a62475
0x00a62465
0x00a6248e
0x00a62493
0x00a62499
0x00a6249e
0x00a624a0
0x00a624c7
0x00a624a2
0x00a624b0
0x00a624b0
0x00a624a0
0x00000000
0x00a62493
0x00a62404
0x00a62407
0x00000000
0x00000000
0x00000000
0x00a62407
0x00a62203
0x00a62206
0x00a62397
0x00a62399
0x00000000
0x00000000
0x00a6239f
0x00a623aa
0x00a623ac
0x00a623b8
0x00a623ba
0x00a623ca
0x00a623d4
0x00a623d9
0x00a623f0
0x00a623f0
0x00000000
0x00a623ba
0x00a623a1
0x00a623a4
0x00000000
0x00000000
0x00000000
0x00a623a4
0x00a6220c
0x00a6220f
0x00a62322
0x00a62331
0x00a6233c
0x00a6233e
0x00a62346
0x00a6234c
0x00a62359
0x00a6235e
0x00a6235e
0x00a62374
0x00a62379
0x00a62384
0x00a6238c
0x00a6238d
0x00000000
0x00a6238d
0x00a62215
0x00a62218
0x00a62257
0x00a6225e
0x00a62265
0x00a6226e
0x00a6227c
0x00a62282
0x00a62289
0x00a6228d
0x00a6228f
0x00a62298
0x00a6229f
0x00a622a1
0x00a622a3
0x00a622a3
0x00a622a9
0x00a622ae
0x00a622b2
0x00a622b2
0x00a622b6
0x00a622b8
0x00a622c1
0x00a622c8
0x00a622ca
0x00a622cc
0x00a622cc
0x00a622cf
0x00a622d8
0x00a622dd
0x00a622dd
0x00a622e1
0x00a622e8
0x00a622f1
0x00a622f1
0x00a622f7
0x00a622fe
0x00a62307
0x00a62307
0x00a6230d
0x00000000
0x00a6230d
0x00a6221d
0x00000000
0x00000000
0x00a62227
0x00a62235
0x00a62235
0x00a62238
0x00a62241
0x00a62246
0x00a62247
0x00000000
0x00a62247
0x00a6261c
0x00a6261c
0x00a6261c
0x00a62620
0x00a62626
0x00a6262b
0x00000000
0x00000000
0x00000000
0x00a6262b
0x00a6214c
0x00a6214e
0x00a62152
0x00a62157
0x00a6215d
0x00a62161
0x00a6216a
0x00a62182
0x00a62184
0x00a62187
0x00a62187
0x00a6218a
0x00a6218a
0x00a62190
0x00a62194
0x00a6219d
0x00a621b5
0x00a621b7
0x00a621ba
0x00a621ba
0x00a6219d
0x00a621bd
0x00a621c1
0x00000000
0x00a621c1
0x00a6213d
0x00a6210a
0x00a62633

APIs

_swprintf.LIBCMT ref: 00A623D4

Strings

;%u, xrefs: 00A623C1

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: _swprintf
String ID: ;%u
API String ID: 589789837-535004727
Opcode ID: e4d1b6a0b8861c005c76840397a732976b43e908f49a4e3b8f41397d09bd8989
Instruction ID: 9a9121ee9ac88dea910650e1820fd40f2b1c567fa5ea52d346630a642f109361
Opcode Fuzzy Hash: e4d1b6a0b8861c005c76840397a732976b43e908f49a4e3b8f41397d09bd8989
Instruction Fuzzy Hash: E1E105706046415BCB24EF28C699BEE77BAAF94300F08057DFD89DB287DB659884C772

Uniqueness

Uniqueness Score: -1.00%

Function 00A8C368 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E00A8C368(void* __ebx, void* __edi, void* __esi, signed int _a4, void* _a8, signed int _a12) {
				signed int _v8;
				long _v12;
				struct _OVERLAPPED* _v16;
				long _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				void* _v52;
				signed int _t62;
				intOrPtr _t66;
				signed char _t68;
				signed int _t69;
				signed int _t71;
				signed int _t73;
				signed int _t74;
				signed int _t77;
				intOrPtr _t79;
				signed int _t87;
				signed int _t90;
				signed int _t106;
				signed int _t107;
				signed int _t110;
				intOrPtr _t112;
				signed int _t117;
				signed int _t119;
				void* _t121;
				signed int _t124;
				signed int _t126;
				signed int _t128;
				void* _t129;

				_t62 =  *0xa991b8; // 0x3197ea2d
				_v8 = _t62 ^ _t128;
				_t110 = _a12;
				_v12 = _t110;
				_t124 = _a4;
				_t121 = _a8;
				_v52 = _t121;
				if(_t110 != 0) {
					__eflags = _t121;
					if(_t121 != 0) {
						_push(__ebx);
						_t106 = _t124 >> 6;
						_t119 = (_t124 & 0x0000003f) * 0x30;
						_v32 = _t106;
						_t66 =  *((intOrPtr*)(0xab8428 + _t106 * 4));
						_v48 = _t66;
						_v28 = _t119;
						_t107 =  *((intOrPtr*)(_t66 + _t119 + 0x29));
						__eflags = _t107 - 2;
						if(_t107 == 2) {
							L6:
							_t68 =  !_t110;
							__eflags = _t68 & 0x00000001;
							if((_t68 & 0x00000001) != 0) {
								_t66 = _v48;
								L9:
								__eflags =  *(_t66 + _t119 + 0x28) & 0x00000020;
								if(__eflags != 0) {
									E00A8C5F2(_t124, 0, 0, 2);
									_t129 = _t129 + 0x10;
								}
								_t69 = E00A8BF0D(_t107, _t119, __eflags, _t124);
								__eflags = _t69;
								if(_t69 == 0) {
									_t112 =  *((intOrPtr*)(0xab8428 + _v32 * 4));
									_t71 = _v28;
									__eflags =  *(_t112 + _t71 + 0x28) & 0x00000080;
									if(( *(_t112 + _t71 + 0x28) & 0x00000080) == 0) {
										_v24 = 0;
										_v20 = 0;
										_v16 = 0;
										_t73 = WriteFile( *(_t112 + _t71 + 0x18), _t121, _v12,  &_v20, 0);
										__eflags = _t73;
										if(_t73 == 0) {
											_v24 = GetLastError();
										}
										goto L28;
									}
									_t87 = _t107;
									__eflags = _t87;
									if(_t87 == 0) {
										E00A8BF83(_t107, _t121, _t124,  &_v24, _t124, _t121, _v12);
										goto L17;
									}
									_t90 = _t87 - 1;
									__eflags = _t90;
									if(_t90 == 0) {
										_t89 = E00A8C150(_t107, _t121, _t124,  &_v24, _t124, _t121, _v12);
										goto L17;
									}
									__eflags = _t90 != 1;
									if(_t90 != 1) {
										goto L34;
									}
									_t89 = E00A8C062(_t107, _t121, _t124,  &_v24, _t124, _t121, _v12);
									goto L17;
								} else {
									__eflags = _t107;
									if(_t107 == 0) {
										_t89 = E00A8BCED(_t107, _t121, _t124,  &_v24, _t124, _t121, _v12);
										L17:
										L15:
										L28:
										asm("movsd");
										asm("movsd");
										asm("movsd");
										_t74 = _v40;
										__eflags = _t74;
										if(_t74 != 0) {
											__eflags = _t74 - _v36;
											L40:
											L41:
											return E00A7CABF(_v8 ^ _t128);
										}
										_t77 = _v44;
										__eflags = _t77;
										if(_t77 == 0) {
											_t121 = _v52;
											L34:
											_t117 = _v28;
											_t79 =  *((intOrPtr*)(0xab8428 + _v32 * 4));
											__eflags =  *(_t79 + _t117 + 0x28) & 0x00000040;
											if(( *(_t79 + _t117 + 0x28) & 0x00000040) == 0) {
												L37:
												 *((intOrPtr*)(E00A85628())) = 0x1c;
												_t81 = E00A85615();
												 *_t81 =  *_t81 & 0x00000000;
												__eflags =  *_t81;
												L38:
												goto L40;
											}
											__eflags =  *_t121 - 0x1a;
											if( *_t121 != 0x1a) {
												goto L37;
											}
											goto L40;
										}
										_t126 = 5;
										__eflags = _t77 - _t126;
										if(_t77 != _t126) {
											_t81 = E00A855F2(_t77);
										} else {
											 *((intOrPtr*)(E00A85628())) = 9;
											 *(E00A85615()) = _t126;
										}
										goto L38;
									}
									__eflags = _t107 - 1 - 1;
									if(_t107 - 1 > 1) {
										goto L34;
									}
									E00A8BEA0( &_v24, _t121, _v12);
									goto L15;
								}
							}
							 *(E00A85615()) =  *_t97 & 0x00000000;
							 *((intOrPtr*)(E00A85628())) = 0x16;
							_t81 = E00A85507();
							goto L38;
						}
						__eflags = _t107 - 1;
						if(_t107 != 1) {
							goto L9;
						}
						goto L6;
					}
					 *(E00A85615()) =  *_t99 & _t121;
					 *((intOrPtr*)(E00A85628())) = 0x16;
					E00A85507();
					goto L41;
				}
				goto L41;
			}

0x00a8c370
0x00a8c377
0x00a8c37a
0x00a8c37d
0x00a8c381
0x00a8c385
0x00a8c388
0x00a8c38d
0x00a8c396
0x00a8c398
0x00a8c3b9
0x00a8c3be
0x00a8c3c4
0x00a8c3c7
0x00a8c3ca
0x00a8c3d1
0x00a8c3d4
0x00a8c3d7
0x00a8c3db
0x00a8c3de
0x00a8c3e5
0x00a8c3e7
0x00a8c3e9
0x00a8c3eb
0x00a8c40a
0x00a8c40d
0x00a8c40d
0x00a8c412
0x00a8c41b
0x00a8c420
0x00a8c420
0x00a8c424
0x00a8c42a
0x00a8c42c
0x00a8c46a
0x00a8c471
0x00a8c474
0x00a8c479
0x00a8c4c8
0x00a8c4cb
0x00a8c4ce
0x00a8c4da
0x00a8c4e0
0x00a8c4e2
0x00a8c4ea
0x00a8c4ea
0x00000000
0x00a8c4ed
0x00a8c47e
0x00a8c47e
0x00a8c481
0x00a8c4ba
0x00000000
0x00a8c4ba
0x00a8c483
0x00a8c483
0x00a8c486
0x00a8c4aa
0x00000000
0x00a8c4aa
0x00a8c488
0x00a8c48b
0x00000000
0x00000000
0x00a8c49a
0x00000000
0x00a8c42e
0x00a8c42e
0x00a8c430
0x00a8c45d
0x00a8c462
0x00a8c44d
0x00a8c4f0
0x00a8c4f3
0x00a8c4f4
0x00a8c4f5
0x00a8c4f6
0x00a8c4f9
0x00a8c4fb
0x00a8c560
0x00a8c563
0x00a8c564
0x00a8c573
0x00a8c573
0x00a8c4fd
0x00a8c500
0x00a8c502
0x00a8c528
0x00a8c52b
0x00a8c52e
0x00a8c531
0x00a8c538
0x00a8c53d
0x00a8c548
0x00a8c54d
0x00a8c553
0x00a8c558
0x00a8c558
0x00a8c55b
0x00000000
0x00a8c55b
0x00a8c53f
0x00a8c542
0x00000000
0x00000000
0x00000000
0x00a8c544
0x00a8c506
0x00a8c507
0x00a8c509
0x00a8c520
0x00a8c50b
0x00a8c510
0x00a8c51b
0x00a8c51b
0x00000000
0x00a8c509
0x00a8c434
0x00a8c437
0x00000000
0x00000000
0x00a8c445
0x00000000
0x00a8c44a
0x00a8c42c
0x00a8c3f2
0x00a8c3fa
0x00a8c400
0x00000000
0x00a8c400
0x00a8c3e0
0x00a8c3e3
0x00000000
0x00000000
0x00000000
0x00a8c3e3
0x00a8c39f
0x00a8c3a6
0x00a8c3ac
0x00000000
0x00a8c3b1
0x00000000

Strings

@Mqt0Lqt, xrefs: 00A8C4E4

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID:
String ID: @Mqt0Lqt
API String ID: 0-1302913217
Opcode ID: d20de094d166dd42534326966c618134bf0c085f416c04b8e9af67dd868407b8
Instruction ID: c914bc2621f2a6eb87fb27811ca77e5bc347e229aee090416955acba78c74bb1
Opcode Fuzzy Hash: d20de094d166dd42534326966c618134bf0c085f416c04b8e9af67dd868407b8
Instruction Fuzzy Hash: B251A1B1D5020AAFDF14FFA8C949EBEBBB8AF09724F140159E801A7292D7349941CF71

Uniqueness

Uniqueness Score: -1.00%

Function 00A843D5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00A843D5(void* __ecx, void* __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v12;
				char _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t36;
				struct HINSTANCE__* _t37;
				struct HINSTANCE__* _t43;
				intOrPtr* _t44;
				intOrPtr* _t45;
				CHAR* _t49;
				struct HINSTANCE__* _t50;
				void* _t52;
				struct HINSTANCE__* _t55;
				intOrPtr* _t59;
				struct HINSTANCE__* _t64;
				intOrPtr _t65;

				_t52 = __ecx;
				if(_a4 == 2 || _a4 == 1) {
					E00A87D41(_t52);
					GetModuleFileNameA(0, 0xab82c0, 0x104);
					_t49 =  *0xab8870; // 0x10e3330
					 *0xab8878 = 0xab82c0;
					if(_t49 == 0 ||  *_t49 == 0) {
						_t49 = 0xab82c0;
					}
					_v8 = 0;
					_v16 = 0;
					E00A844F9(_t52, _t49, 0, 0,  &_v8,  &_v16);
					_t64 = E00A8466E(_v8, _v16, 1);
					if(_t64 != 0) {
						E00A844F9(_t52, _t49, _t64, _t64 + _v8 * 4,  &_v8,  &_v16);
						if(_a4 != 1) {
							_v12 = 0;
							_push( &_v12);
							_t50 = E00A8785C(_t49, 0, _t64, _t64);
							if(_t50 == 0) {
								_t59 = _v12;
								_t55 = 0;
								_t36 = _t59;
								if( *_t59 == 0) {
									L15:
									_t37 = 0;
									 *0xab8864 = _t55;
									_v12 = 0;
									_t50 = 0;
									 *0xab8868 = _t59;
									L16:
									E00A851AC(_t37);
									_v12 = 0;
									goto L17;
								} else {
									goto L14;
								}
								do {
									L14:
									_t36 = _t36 + 4;
									_t55 =  &(_t55->i);
								} while ( *_t36 != 0);
								goto L15;
							}
							_t37 = _v12;
							goto L16;
						}
						 *0xab8864 = _v8 - 1;
						_t43 = _t64;
						_t64 = 0;
						 *0xab8868 = _t43;
						goto L10;
					} else {
						_t44 = E00A85628();
						_push(0xc);
						_pop(0);
						 *_t44 = 0;
						L10:
						_t50 = 0;
						L17:
						E00A851AC(_t64);
						return _t50;
					}
				} else {
					_t45 = E00A85628();
					_t65 = 0x16;
					 *_t45 = _t65;
					E00A85507();
					return _t65;
				}
			}

0x00a843d5
0x00a843e2
0x00a84402
0x00a84415
0x00a8441b
0x00a84421
0x00a84429
0x00a84430
0x00a84430
0x00a84435
0x00a8443c
0x00a84443
0x00a84455
0x00a8445c
0x00a8447b
0x00a84487
0x00a844a2
0x00a844a5
0x00a844ac
0x00a844b2
0x00a844b9
0x00a844bc
0x00a844be
0x00a844c2
0x00a844cc
0x00a844cc
0x00a844ce
0x00a844d4
0x00a844d7
0x00a844d9
0x00a844df
0x00a844e0
0x00a844e6
0x00000000
0x00000000
0x00000000
0x00000000
0x00a844c4
0x00a844c4
0x00a844c4
0x00a844c7
0x00a844c8
0x00000000
0x00a844c4
0x00a844b4
0x00000000
0x00a844b4
0x00a8448d
0x00a84492
0x00a84494
0x00a84496
0x00000000
0x00a8445e
0x00a8445e
0x00a84463
0x00a84465
0x00a84466
0x00a8449b
0x00a8449b
0x00a844e9
0x00a844ea
0x00000000
0x00a844f3
0x00a843ea
0x00a843ea
0x00a843f1
0x00a843f2
0x00a843f4
0x00000000
0x00a843f9

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\pK6oGXjugD.exe,00000104), ref: 00A84415
_free.LIBCMT ref: 00A844E0
_free.LIBCMT ref: 00A844EA

Strings

C:\Users\user\Desktop\pK6oGXjugD.exe, xrefs: 00A8440C, 00A84413, 00A84442, 00A8447A

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\pK6oGXjugD.exe
API String ID: 2506810119-3007666685
Opcode ID: 2a485ab346aed85e8608dc960d1c89c35ca52f0bf8b6c4efeb2628724f9817ed
Instruction ID: 6c25d1497a9a2267fa07e59ec4f789c1d455282d1dcc018f12666d5d79069668
Opcode Fuzzy Hash: 2a485ab346aed85e8608dc960d1c89c35ca52f0bf8b6c4efeb2628724f9817ed
Instruction Fuzzy Hash: 9A31A071E04219AFDB21FFD9DD81A9EBBFCEB89310F144166F80497212DA748A41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A8C150 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A8C150(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, signed int _a8, signed short* _a12, intOrPtr _a16) {
				signed int _v8;
				char _v12;
				short _v1716;
				char _v5132;
				intOrPtr _v5136;
				long _v5140;
				void* _v5144;
				int _v5148;
				signed int _t31;
				intOrPtr _t38;
				signed int* _t41;
				int _t45;
				int _t54;
				signed short* _t59;
				signed int _t65;
				signed int _t67;
				signed short* _t69;
				intOrPtr* _t72;
				intOrPtr _t74;
				signed int _t75;

				E00A7C240();
				_t31 =  *0xa991b8; // 0x3197ea2d
				_v8 = _t31 ^ _t75;
				_t54 = 0;
				_t72 = _a4;
				_t59 = _a12;
				_t69 = _t59;
				_v5144 =  *((intOrPtr*)( *((intOrPtr*)(0xab8428 + (_a8 >> 6) * 4)) + 0x18 + (_a8 & 0x0000003f) * 0x30));
				_t38 = _a16 + _t59;
				 *_t72 = 0;
				 *((intOrPtr*)(_t72 + 4)) = 0;
				_v5136 = _t38;
				 *((intOrPtr*)(_t72 + 8)) = 0;
				if(_t59 < _t38) {
					while(1) {
						L1:
						_t74 = _v5136;
						_t41 =  &_v1716;
						while(_t69 < _t74) {
							_t65 =  *_t69 & 0x0000ffff;
							_t69 =  &(_t69[1]);
							if(_t65 == 0xa) {
								_t67 = 0xd;
								 *_t41 = _t67;
								_t41 =  &(_t41[0]);
							}
							 *_t41 = _t65;
							_t41 =  &(_t41[0]);
							if(_t41 <  &_v12) {
								continue;
							}
							break;
						}
						_t45 = WideCharToMultiByte(0xfde9, _t54,  &_v1716, _t41 -  &_v1716 >> 1,  &_v5132, 0xd55, _t54, _t54);
						_t72 = _a4;
						_v5148 = _t45;
						if(_t45 == 0) {
							L11:
							 *_t72 = GetLastError();
						} else {
							while(WriteFile(_v5144,  &(( &_v5132)[_t54]), _t45 - _t54,  &_v5140, 0) != 0) {
								_t54 = _t54 + _v5140;
								_t45 = _v5148;
								if(_t54 < _t45) {
									continue;
								} else {
									 *((intOrPtr*)(_t72 + 4)) = _t69 - _a12;
									if(_t69 < _v5136) {
										_t54 = 0;
										goto L1;
									}
								}
								goto L12;
							}
							goto L11;
						}
						goto L12;
					}
				}
				L12:
				return E00A7CABF(_v8 ^ _t75);
			}

0x00a8c15a
0x00a8c15f
0x00a8c166
0x00a8c180
0x00a8c182
0x00a8c18a
0x00a8c18d
0x00a8c18f
0x00a8c198
0x00a8c19a
0x00a8c19c
0x00a8c19f
0x00a8c1a5
0x00a8c1aa
0x00a8c1b0
0x00a8c1b0
0x00a8c1b0
0x00a8c1b6
0x00a8c1bc
0x00a8c1c0
0x00a8c1c3
0x00a8c1c9
0x00a8c1cd
0x00a8c1ce
0x00a8c1d1
0x00a8c1d1
0x00a8c1d4
0x00a8c1d7
0x00a8c1df
0x00000000
0x00000000
0x00000000
0x00a8c1df
0x00a8c203
0x00a8c209
0x00a8c20c
0x00a8c214
0x00a8c262
0x00a8c268
0x00a8c216
0x00a8c216
0x00a8c23b
0x00a8c241
0x00a8c249
0x00000000
0x00a8c24b
0x00a8c250
0x00a8c259
0x00a8c25b
0x00000000
0x00a8c25b
0x00a8c259
0x00000000
0x00a8c249
0x00000000
0x00a8c216
0x00000000
0x00a8c214
0x00a8c1b0
0x00a8c26a
0x00a8c27c

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,00000D55,00000000,00000000,00000000,00000000,?,?,00A8C4AF,00000000,00000000,00000000), ref: 00A8C203
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,00A8C4AF,00000000,00000000,00000000,00000000,00000000,00A8223E,00000000,00A8223E,00A972B8), ref: 00A8C231
GetLastError.KERNEL32(?,00A8C4AF,00000000,00000000,00000000,00000000,00000000,00A8223E,00000000,00A8223E,00A972B8,00000010,00A8AEC7,010E9AE8,00A97230,00000010), ref: 00A8C262

Strings

@Mqt0Lqt, xrefs: 00A8C262

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: @Mqt0Lqt
API String ID: 2456169464-1302913217
Opcode ID: 2c3b8a06d045d588418a8ec2cc78ae2e3d89fe5d0621534edd93f090b6818713
Instruction ID: 3c34256b00a41c004f0765a8929826216b82a966b32144cc38f90d76c62ffaa8
Opcode Fuzzy Hash: 2c3b8a06d045d588418a8ec2cc78ae2e3d89fe5d0621534edd93f090b6818713
Instruction Fuzzy Hash: 3E317075A0021A9FCB14DF99DC819EAB7B9EB18710F1445AEE90AD7291E630AD81CF70

Uniqueness

Uniqueness Score: -1.00%

Function 00A79CEB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00A79CEB(void* __ebx, void* __eflags, signed short _a2, signed int _a4, char _a6, intOrPtr _a8196) {
				char _v0;
				void* _t15;
				void* _t19;
				void* _t22;
				void* _t25;
				WCHAR* _t31;
				void* _t32;
				void* _t33;
				void* _t36;
				void* _t42;

				_t36 = __ebx;
				E00A7C240();
				_t42 = 0;
				_t15 = E00A6E63C(__eflags, _a8196,  &_v0, 0x1000);
				_t39 = _t15;
				if(_t15 == 0) {
					L25:
					return _t15;
				} else {
					do {
						_t42 = _t42 + 1;
						if(_t42 != 1 && (_v0 == 0x2f || _v0 == 0x2d)) {
							_t19 = CharUpperW(_a2 & 0x0000ffff) - 0x44;
							if(_t19 == 0) {
								_push(0x800);
								_push( &_a4);
								_push(0xaa875a);
								L22:
								E00A6E847();
								goto L23;
							}
							_t22 = _t19 - 1;
							if(_t22 == 0) {
								__eflags = CharUpperW(_a4 & 0x0000ffff) - 0x4c;
								if(__eflags == 0) {
									__eflags = _a6;
									if(__eflags == 0) {
										 *0xaa8759 = 1;
									}
								}
								goto L23;
							}
							_t25 = _t22 - 0xb;
							if(_t25 == 0) {
								E00A6DBC1(_t36, 0xaaa75a,  &_a4);
								goto L23;
							}
							if(_t25 != 3) {
								goto L23;
							}
							_t31 = CharUpperW(_a4 & 0x0000ffff);
							if(_t31 == 0) {
								L15:
								 *0xaa8754 = 1;
								L16:
								 *0xaa874f = 1;
								goto L23;
							}
							_t32 = _t31 - 0x31;
							if(_t32 == 0) {
								goto L15;
							}
							_t33 = _t32 - 1;
							if(_t33 == 0) {
								 *0xaa8754 = 2;
								goto L16;
							}
							_t61 = _t33 != 0x1e;
							if(_t33 != 0x1e) {
								goto L23;
							}
							_push(0x800);
							_push( &_a6);
							_push(0xaa975a);
							goto L22;
						}
						L23:
						_t15 = E00A6E63C(_t61, _t39,  &_v0, 0x1000);
						_t39 = _t15;
					} while (_t15 != 0);
					goto L25;
				}
			}

0x00a79ceb
0x00a79cf0
0x00a79d00
0x00a79d0a
0x00a79d0f
0x00a79d13
0x00a79e0c
0x00a79e14
0x00a79d19
0x00a79d1f
0x00a79d1f
0x00a79d23
0x00a79d48
0x00a79d4b
0x00a79de1
0x00a79de6
0x00a79de7
0x00a79dec
0x00a79dec
0x00000000
0x00a79dec
0x00a79d51
0x00a79d54
0x00a79dcb
0x00a79dce
0x00a79dd0
0x00a79dd6
0x00a79dd8
0x00a79dd8
0x00a79dd6
0x00000000
0x00a79dce
0x00a79d56
0x00a79d59
0x00a79db9
0x00000000
0x00a79db9
0x00a79d5e
0x00000000
0x00000000
0x00a79d6f
0x00a79d72
0x00a79d9c
0x00a79d9c
0x00a79da6
0x00a79da6
0x00000000
0x00a79da6
0x00a79d74
0x00a79d77
0x00000000
0x00000000
0x00a79d79
0x00a79d7c
0x00a79d90
0x00000000
0x00a79d90
0x00a79d7e
0x00a79d81
0x00000000
0x00000000
0x00a79d83
0x00a79d88
0x00a79d89
0x00000000
0x00a79d89
0x00a79df1
0x00a79dfc
0x00a79e01
0x00a79e03
0x00000000
0x00a79e0b

APIs

CharUpperW.USER32(?,?,?,?,00001000), ref: 00A79D43
CharUpperW.USER32(?,?,?,?,?,00001000), ref: 00A79D6A

Strings

-, xrefs: 00A79D31

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: CharUpper
String ID: -
API String ID: 9403516-2547889144
Opcode ID: d490e064610078f309c3c4816ec434fedfeb4f514b5a6c206a303d4d44ea11ae
Instruction ID: b37f7e6ef8ce941d6c0f1aa6906ca3b7b16cf9add6d574076975d83808e5a416
Opcode Fuzzy Hash: d490e064610078f309c3c4816ec434fedfeb4f514b5a6c206a303d4d44ea11ae
Instruction Fuzzy Hash: 5321C7724043429AD731EB79CD4AB7777A9EB45350F14C81BF59C82183EB78C949C322

Uniqueness

Uniqueness Score: -1.00%

Function 00A78628 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E00A78628(void* __edx, void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR** _a16) {
				void* _t12;
				void* _t16;
				void* _t22;
				WCHAR** _t24;
				void* _t25;
				intOrPtr _t27;
				void* _t28;
				struct HWND__* _t30;
				signed short _t31;

				_t24 = _a16;
				_t31 = _a12;
				_t30 = _a4;
				_t27 = _a8;
				if(E00A61506(__edx, _t30, _t27, _t31, _t24, L"ASKNEXTVOL", 0, 0) != 0) {
					L14:
					__eflags = 1;
					return 1;
				}
				_t28 = _t27 - 0x110;
				if(_t28 == 0) {
					_push( *_t24);
					 *0xab7e38 = _t24;
					L13:
					SetDlgItemTextW(_t30, 0x65, ??);
					goto L14;
				}
				if(_t28 != 1) {
					L6:
					return 0;
				}
				_t12 = (_t31 & 0x0000ffff) - 1;
				if(_t12 == 0) {
					GetDlgItemTextW(_t30, 0x65,  *( *0xab7e38), ( *0xab7e38)[1]);
					_push(1);
					L10:
					 *0xa99acc(_t30);
					goto L14;
				}
				_t16 = _t12 - 1;
				if(_t16 == 0) {
					_push(0);
					goto L10;
				}
				if(_t16 == 0x64) {
					_push(0);
					_push(E00A6B1D0(__eflags,  *( *0xab7e38)));
					_t22 = E00A61310(_t25, __edx, _t30, E00A6CD14(0x8e),  *( *0xab7e38));
					__eflags = _t22;
					if(_t22 == 0) {
						goto L14;
					}
					_push( *( *0xab7e38));
					goto L13;
				}
				goto L6;
			}

0x00a78629
0x00a7862e
0x00a78633
0x00a78638
0x00a78650
0x00a786e0
0x00a786e2
0x00000000
0x00a786e2
0x00a78656
0x00a7865c
0x00a786cf
0x00a786d1
0x00a786d7
0x00a786da
0x00000000
0x00a786da
0x00a78661
0x00a78675
0x00000000
0x00a78675
0x00a78666
0x00a78669
0x00a786c5
0x00a786cb
0x00a786af
0x00a786b0
0x00000000
0x00a786b0
0x00a7866b
0x00a7866e
0x00a786ad
0x00000000
0x00a786ad
0x00a78673
0x00a7867e
0x00a78687
0x00a7869b
0x00a786a0
0x00a786a2
0x00000000
0x00000000
0x00a786a9
0x00000000
0x00a786a9
0x00000000

APIs

GetDlgItemTextW.USER32(?,00000065,?,?), ref: 00A786C5
SetDlgItemTextW.USER32(?,00000065,?), ref: 00A786DA

Strings

PH]w, xrefs: 00A786C5
ASKNEXTVOL, xrefs: 00A78640

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: ItemText
String ID: ASKNEXTVOL$PH]w
API String ID: 3367045223-1206701287
Opcode ID: 41097065e2faae148fa128f3cedefbea5ba64583b14d84e10406b3778b081378
Instruction ID: 58798c13de1217c40767f2ee4bf4729a291ee4afb55c1797e84d22ca2b1a5890
Opcode Fuzzy Hash: 41097065e2faae148fa128f3cedefbea5ba64583b14d84e10406b3778b081378
Instruction Fuzzy Hash: E911D632284100BFD6129FA8DD0DF6A3BA9FF46741F058551F205AB4B1CFA59C02D766

Uniqueness

Uniqueness Score: -1.00%

Function 00A78B2B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00A78B2B(void* __ecx, void* __edx, void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR* _a16) {
				short _v260;
				void* __ebx;
				void* _t15;
				signed short _t24;
				struct HWND__* _t28;
				intOrPtr _t29;
				void* _t30;

				_t24 = _a12;
				_t29 = _a8;
				_t28 = _a4;
				if(E00A61506(__edx, _t28, _t29, _t24, _a16, L"GETPASSWORD1", 0, 0) != 0) {
					L10:
					return 1;
				}
				_t30 = _t29 - 0x110;
				if(_t30 == 0) {
					SetDlgItemTextW(_t28, 0x66, _a16);
					goto L10;
				}
				if(_t30 != 1) {
					L5:
					return 0;
				}
				_t15 = (_t24 & 0x0000ffff) - 1;
				if(_t15 == 0) {
					GetDlgItemTextW(_t28, 0x65,  &_v260, 0x80);
					E00A6DBC1(_t24, 0xab3d00,  &_v260);
					E00A6DC0C( &_v260, 0x80);
					_push(1);
					L7:
					 *0xa99acc(_t28);
					goto L10;
				}
				if(_t15 == 1) {
					_push(0);
					goto L7;
				}
				goto L5;
			}

0x00a78b35
0x00a78b39
0x00a78b3d
0x00a78b56
0x00a78bc5
0x00000000
0x00a78bc7
0x00a78b58
0x00a78b5e
0x00a78bbf
0x00000000
0x00a78bbf
0x00a78b63
0x00a78b72
0x00000000
0x00a78b72
0x00a78b68
0x00a78b6b
0x00a78b91
0x00a78ba3
0x00a78bb0
0x00a78bb5
0x00a78b78
0x00a78b79
0x00000000
0x00a78b79
0x00a78b70
0x00a78b76
0x00000000
0x00a78b76
0x00000000

APIs

GetDlgItemTextW.USER32(?,00000065,?,00000080), ref: 00A78B91
SetDlgItemTextW.USER32(?,00000066,?), ref: 00A78BBF

Strings

PH]w, xrefs: 00A78B91
GETPASSWORD1, xrefs: 00A78B44

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: ItemText
String ID: GETPASSWORD1$PH]w
API String ID: 3367045223-2070105971
Opcode ID: 48222dd43e2b606bfc6b5a0af2bd7f8c471fde1857baa2e38f18138967638cc9
Instruction ID: bcf04ab3e45e89f13dab629e1b9093799f6360aa7a4907d0105bb8f66006e588
Opcode Fuzzy Hash: 48222dd43e2b606bfc6b5a0af2bd7f8c471fde1857baa2e38f18138967638cc9
Instruction Fuzzy Hash: 3D110873A8021876DB119F749D8DFFF3B7CFB99751F048455FA49F6080CAA999018660

Uniqueness

Uniqueness Score: -1.00%

Function 00A8C9CA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A8C9CA(void* __eflags, signed int _a4) {
				intOrPtr _t13;
				void* _t21;
				signed int _t33;
				long _t35;

				_t33 = _a4;
				if(E00A88887(_t33) != 0xffffffff) {
					_t13 =  *0xab8428; // 0x10e5cc0
					if(_t33 != 1 || ( *(_t13 + 0x88) & 0x00000001) == 0) {
						if(_t33 != 2 || ( *(_t13 + 0x58) & 0x00000001) == 0) {
							goto L7;
						} else {
							goto L6;
						}
					} else {
						L6:
						_t21 = E00A88887(2);
						if(E00A88887(1) == _t21) {
							goto L1;
						}
						L7:
						if(CloseHandle(E00A88887(_t33)) != 0) {
							goto L1;
						}
						_t35 = GetLastError();
						L9:
						E00A887F6(_t33);
						 *((char*)( *((intOrPtr*)(0xab8428 + (_t33 >> 6) * 4)) + 0x28 + (_t33 & 0x0000003f) * 0x30)) = 0;
						if(_t35 == 0) {
							return 0;
						}
						return E00A855F2(_t35) | 0xffffffff;
					}
				}
				L1:
				_t35 = 0;
				goto L9;
			}

0x00a8c9d1
0x00a8c9de
0x00a8c9e4
0x00a8c9ec
0x00a8c9fa
0x00000000
0x00000000
0x00000000
0x00000000
0x00a8ca02
0x00a8ca02
0x00a8ca04
0x00a8ca16
0x00000000
0x00000000
0x00a8ca18
0x00a8ca28
0x00000000
0x00000000
0x00a8ca30
0x00a8ca32
0x00a8ca33
0x00a8ca4b
0x00a8ca52
0x00000000
0x00a8ca60
0x00000000
0x00a8ca5b
0x00a8c9ec
0x00a8c9e0
0x00a8c9e0
0x00000000

APIs

CloseHandle.KERNEL32(00000000,00000000,00000000,?,00A8C8E8,00000000,00A972F8,0000000C), ref: 00A8CA20
GetLastError.KERNEL32(?,00A8C8E8,00000000,00A972F8,0000000C), ref: 00A8CA2A
__dosmaperr.LIBCMT ref: 00A8CA55

Strings

@Mqt0Lqt, xrefs: 00A8CA2A

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID: @Mqt0Lqt
API String ID: 2583163307-1302913217
Opcode ID: 0261b96658026a5657e409ff049884f15ab3dad13e9230953c2d5eb120f20caa
Instruction ID: e75c9a6edfaeec3b242c31e2ab61984effa7b8a8fae789350a5b71e96f48bc90
Opcode Fuzzy Hash: 0261b96658026a5657e409ff049884f15ab3dad13e9230953c2d5eb120f20caa
Instruction Fuzzy Hash: A8014E33A041541AC63CF378694677DB76A4B817B0F690369F815D71D2DE74DC818770

Uniqueness

Uniqueness Score: -1.00%

Function 00A6EFDA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E00A6EFDA(long* __ecx, long _a4) {
				void* __esi;
				void* __ebp;
				long _t11;
				void* _t14;
				long _t23;
				long* _t25;

				_t19 = __ecx;
				_t11 = _a4;
				_t25 = __ecx;
				_t23 = 0x20;
				 *__ecx = _t11;
				if(_t11 > _t23) {
					 *__ecx = _t23;
				}
				if( *_t25 == 0) {
					 *_t25 = 1;
				}
				_t25[0x21] = 0;
				if( *_t25 > _t23) {
					 *_t25 = _t23;
				}
				_t3 =  &(_t25[0x68]); // 0x1a0
				_t25[0x65] = 0;
				InitializeCriticalSection(_t3);
				_t25[0x66] = CreateSemaphoreW(0, 0, _t23, 0);
				_t14 = CreateEventW(0, 1, 1, 0);
				_t25[0x67] = _t14;
				if(_t25[0x66] == 0 || _t14 == 0) {
					_push(L"\nThread pool initialization failed.");
					_push(0xa9bbf8);
					E00A669DF(E00A669E4(_t19), 0xa9bbf8, _t25, 2);
				}
				_t25[0x63] = 0;
				_t25[0x64] = 0;
				_t25[0x22] = 0;
				return _t25;
			}

0x00a6efda
0x00a6efda
0x00a6efe2
0x00a6efe6
0x00a6efe7
0x00a6efeb
0x00a6efed
0x00a6efed
0x00a6eff6
0x00a6eff8
0x00a6eff8
0x00a6effa
0x00a6f002
0x00a6f004
0x00a6f004
0x00a6f006
0x00a6f00c
0x00a6f013
0x00a6f027
0x00a6f02d
0x00a6f033
0x00a6f03f
0x00a6f045
0x00a6f04f
0x00a6f05b
0x00a6f05b
0x00a6f061
0x00a6f069
0x00a6f06f
0x00a6f078

APIs

InitializeCriticalSection.KERNEL32(000001A0,00AA14A0,00000000,?,?,00A6F232,00000020,?,00A6A1DD,?,00A6C325,?,00000000,?,00000001,?), ref: 00A6F013
CreateSemaphoreW.KERNEL32(00000000,00000000,00000020,00000000,?,00A6A1DD,?,00A6C325,?,00000000,?,00000001,?,?,00A7311E,?), ref: 00A6F01D
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,00A6A1DD,?,00A6C325,?,00000000,?,00000001,?,?,00A7311E,?), ref: 00A6F02D

Strings

Thread pool initialization failed., xrefs: 00A6F045

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 9d3f456c0c3bc0c9238157d4644556a2478118c569355491560badbd964c1d0a
Instruction ID: 52ef6ff7f28028d0837dba1be78dcdb86eb7a451bca20e507686679b2fdcfe73
Opcode Fuzzy Hash: 9d3f456c0c3bc0c9238157d4644556a2478118c569355491560badbd964c1d0a
Instruction Fuzzy Hash: B41173B5500705AFD3305F699D85AA7FBFCFB55355F20483EF2DA86141EA716840CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00A78A7C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52
registryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00A78A7C(void* __edx, intOrPtr _a4, intOrPtr _a8) {
				int _v8;
				void* _v12;
				int _v16;
				char _v4112;
				short _v8208;
				long _t19;
				signed int _t30;
				void* _t36;

				_t19 = 0x200c;
				E00A7C240();
				if( *0xaa8758 != 0) {
					E00A79E17(__edx, _a4,  &_v8208);
					_t19 = RegOpenKeyExW(0x80000001, L"Software\\WinRAR SFX", 0, 1,  &_v12);
					if(0x200c == 0) {
						_v8 = 0x1000;
						if(RegQueryValueExW(_v12,  &_v8208, 0,  &_v16,  &_v4112,  &_v8) == 0) {
							_t30 = _v8 >> 1;
							_v8 = _t30;
							if(_t30 >= 0x7ff) {
								_t30 = 0x7ff;
							}
							 *((short*)(_t36 + _t30 * 2 - 0x100c)) = 0;
							E00A6E847(_a4,  &_v4112, _a8);
						}
						return RegCloseKey(_v12);
					}
				}
				return _t19;
			}

0x00a78a7f
0x00a78a84
0x00a78a90
0x00a78aa0
0x00a78ab7
0x00a78abf
0x00a78ac4
0x00a78aeb
0x00a78af5
0x00a78af7
0x00a78afc
0x00a78afe
0x00a78afe
0x00a78b05
0x00a78b17
0x00a78b17
0x00000000
0x00a78b1f
0x00a78abf
0x00a78b28

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\WinRAR SFX,00000000,00000001,?,?,?), ref: 00A78AB7
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?), ref: 00A78AE3
RegCloseKey.ADVAPI32(?), ref: 00A78B1F

Strings

Software\WinRAR SFX, xrefs: 00A78AAD

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Software\WinRAR SFX
API String ID: 3677997916-754673328
Opcode ID: 0daab2cd0196b16286cf771d65f39e540e972ac1ddcefa8a40565878dae775c1
Instruction ID: 3beaac9406f9c509ea8fd8445edeec311b1e2f5cf0f07f5da6bd21ace204538e
Opcode Fuzzy Hash: 0daab2cd0196b16286cf771d65f39e540e972ac1ddcefa8a40565878dae775c1
Instruction Fuzzy Hash: 48115E7564020CFAEB11DB94CD84FEE77B8EB08300F00C0AAF908E6190DB759E91DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A8C574 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00A8C574(void* __ecx, void* __eflags, signed int _a4, union _LARGE_INTEGER _a8, union _LARGE_INTEGER* _a12, intOrPtr _a16) {
				signed int _v8;
				void* _v12;
				void* _t15;
				signed int _t19;
				signed int _t32;
				signed int _t33;
				signed int _t36;

				_t36 = _a4;
				_push(_t32);
				_t15 = E00A88887(_t36);
				_t33 = _t32 | 0xffffffff;
				if(_t15 != _t33) {
					_push(_a16);
					if(SetFilePointerEx(_t15, _a8, _a12,  &_v12) != 0) {
						if((_v12 & _v8) == _t33) {
							goto L2;
						} else {
							_t19 = _v12;
							_t39 = (_t36 & 0x0000003f) * 0x30;
							 *( *((intOrPtr*)(0xab8428 + (_t36 >> 6) * 4)) + _t39 + 0x28) =  *( *((intOrPtr*)(0xab8428 + (_t36 >> 6) * 4)) + 0x28 + (_t36 & 0x0000003f) * 0x30) & 0x000000fd;
						}
					} else {
						E00A855F2(GetLastError());
						goto L2;
					}
				} else {
					 *((intOrPtr*)(E00A85628())) = 9;
					L2:
					_t19 = _t33;
				}
				return _t19;
			}

0x00a8c57c
0x00a8c57f
0x00a8c581
0x00a8c586
0x00a8c58c
0x00a8c59f
0x00a8c5b5
0x00a8c5d0
0x00000000
0x00a8c5d2
0x00a8c5d2
0x00a8c5dd
0x00a8c5e7
0x00a8c5e7
0x00a8c5b7
0x00a8c5be
0x00000000
0x00a8c5c3
0x00a8c58e
0x00a8c593
0x00a8c599
0x00a8c599
0x00a8c59b
0x00a8c5f1

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000002,00A8223E,00000000,00000000,00000000,00000000,00000000,?,00A8C608,00A8223E,00000000,00000002,00000000), ref: 00A8C5AD
GetLastError.KERNEL32(?,00A8C608,00A8223E,00000000,00000002,00000000,?,00A8C420,00000000,00000000,00000000,00000002,00000000,00A8223E,00000000,00A8223E), ref: 00A8C5B7
__dosmaperr.LIBCMT ref: 00A8C5BE

Strings

@Mqt0Lqt, xrefs: 00A8C5B7

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: ErrorFileLastPointer__dosmaperr
String ID: @Mqt0Lqt
API String ID: 2336955059-1302913217
Opcode ID: c894422deec6089ce1b28d7631592b4827f81637e274680b63d052b09471e06d
Instruction ID: e58ed3829a9d94c4fe67dc1082b0c93d829623fead932005400df61543192b8a
Opcode Fuzzy Hash: c894422deec6089ce1b28d7631592b4827f81637e274680b63d052b09471e06d
Instruction Fuzzy Hash: 3B014C37A10515AFCF09FFE9EC058AE7B29EB89330B240259F81197190FE30ED418BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A7B2E4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A7B2E4(long _a4, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				long _v0;
				_Unknown_base(*)()* _t16;
				int _t22;
				WCHAR* _t25;

				 *0xab3e08 = _a12;
				 *0xab3e0c = _a16;
				 *0xaaa85c = _a20;
				if( *0xaa8732 == 0) {
					if( *0xaa1727 == 0) {
						_t16 = E00A7994E;
						_t25 = L"REPLACEFILEDLG";
						while(1) {
							_t22 = DialogBoxParamW( *0xa9bbe0, _t25,  *0xaa8744, _t16, _a4);
							if(_t22 != 4) {
								break;
							}
							if(DialogBoxParamW( *0xa9bbdc, L"RENAMEDLG",  *0xaa1720, E00A7AC31, _v0) != 0) {
								break;
							}
						}
						return _t22;
					}
					return 1;
				}
				return 0;
			}

0x00a7b2ef
0x00a7b2f8
0x00a7b301
0x00a7b306
0x00a7b313
0x00a7b324
0x00a7b329
0x00a7b350
0x00a7b364
0x00a7b369
0x00000000
0x00000000
0x00a7b34e
0x00000000
0x00000000
0x00a7b34e
0x00000000
0x00a7b370
0x00000000
0x00a7b317
0x00000000

Strings

RENAMEDLG, xrefs: 00A7B33F
REPLACEFILEDLG, xrefs: 00A7B329, 00A7B35B

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 65c7e29beb060e4cddbbf2b18353d55fc7d04825e813e10a8fcfce1787e25899
Instruction ID: 5d2bc628cf40dfcf833fd8fdc99da256301e504afcb32fb3f00d7a066ac1404a
Opcode Fuzzy Hash: 65c7e29beb060e4cddbbf2b18353d55fc7d04825e813e10a8fcfce1787e25899
Instruction Fuzzy Hash: C001B1B2214205BFCB01CBA9EC84E17BBE8E749390F04C42AF548965B0D3258C429F71

Uniqueness

Uniqueness Score: -1.00%

Function 00A674D7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000020,?), ref: 00A674E6
GetLastError.KERNEL32 ref: 00A6752C
CloseHandle.KERNEL32(?), ref: 00A6753B

Strings

@Mqt0Lqt, xrefs: 00A6752C

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: CloseCurrentErrorHandleLastProcess
String ID: @Mqt0Lqt
API String ID: 1009092642-1302913217
Opcode ID: 9c57324a175a5dd528a1c1393b9e2ba007691e0fbdd180478ede7313bd495e5d
Instruction ID: 69a07349e8bb1f2e8bb7e9c770a58cf827b6de57f79df2e1878c877478f174cd
Opcode Fuzzy Hash: 9c57324a175a5dd528a1c1393b9e2ba007691e0fbdd180478ede7313bd495e5d
Instruction Fuzzy Hash: E20146B0600209BFEB10DFE4ED89AAF7BBCEB04344F500065B802E2161EB318E159B71

Uniqueness

Uniqueness Score: -1.00%

Function 00A6CA0C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00A6CA0C(intOrPtr* __ecx) {
				char _v2052;
				struct HRSRC__* _t6;
				signed int _t10;
				char _t12;
				intOrPtr* _t19;

				_t19 = __ecx;
				_t6 = FindResourceW(GetModuleHandleW(0), 0xa8f5b0, 5);
				if(_t6 == 0) {
					E00A6C4F4(_t19, 0xa8f5b8,  &_v2052, 0x400, 1, 0xa8f5b8);
					_t10 = E00A816E0( &_v2052,  &_v2052, 0xa8f5b0);
					asm("sbb al, al");
					_t12 =  ~_t10 + 1;
					 *((char*)(_t19 + 0x10)) = _t12;
					return _t12;
				}
				 *((char*)(_t19 + 0x10)) = 1;
				return _t6;
			}

0x00a6ca19
0x00a6ca2a
0x00a6ca32
0x00a6ca51
0x00a6ca5e
0x00a6ca66
0x00a6ca68
0x00a6ca6b
0x00000000
0x00a6ca6b
0x00a6ca34
0x00000000

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00A6CA1B
FindResourceW.KERNEL32(00000000,RTL,00000005), ref: 00A6CA2A

Strings

LTR, xrefs: 00A6CA3A, 00A6CA45, 00A6CA4E
RTL, xrefs: 00A6CA23, 00A6CA28, 00A6CA5C

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: LTR$RTL
API String ID: 3537982541-719208805
Opcode ID: da410fee6e8113359d6a847c229a7740acf323d323476790d8528d6a044c3702
Instruction ID: 123a8d8d9092b71065b0a5171fce01e4bcdf561146a0c9fe25e078129475e647
Opcode Fuzzy Hash: da410fee6e8113359d6a847c229a7740acf323d323476790d8528d6a044c3702
Instruction Fuzzy Hash: 27F02B326042142AE734B6F55C0AF77377CD781B10F10467DF545D70C1DF91990A47A0

Uniqueness

Uniqueness Score: -1.00%

Function 00A6FA9D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00A6FA9D(void* __ecx, void* __eflags, intOrPtr _a4) {
				char _v4612;
				long _t10;
				void* _t13;
				signed int _t15;

				E00A7C240();
				_push(_t15);
				E00A63CE2( &_v4612, 0x900, E00A6CD14(0x83), _a4);
				_t10 = GetLastError();
				_t13 = E00A781FE( *0xaa1720,  &_v4612, E00A6CD14(0x96), 0x35);
				SetLastError(_t10);
				return _t15 & 0xffffff00 | _t13 == 0x00000004;
			}

0x00a6faa5
0x00a6faaa
0x00a6fac6
0x00a6face
0x00a6faf0
0x00a6fafc
0x00a6fb09

APIs

Part of subcall function 00A6CD14: LoadStringW.USER32(?,?,00000200,?), ref: 00A6CD59
Part of subcall function 00A6CD14: LoadStringW.USER32(?,?,00000200,?), ref: 00A6CD6F

_swprintf.LIBCMT ref: 00A6FAC6

Part of subcall function 00A63CE2: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00A63CF5

GetLastError.KERNEL32 ref: 00A6FACE

Part of subcall function 00A781FE: MessageBoxW.USER32(00000096,00000000,?,00A6FAF5), ref: 00A7821C

SetLastError.KERNEL32(00000000,?,00000000,00000096,00000035), ref: 00A6FAFC

Strings

@Mqt0Lqt, xrefs: 00A6FACE

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: ErrorLastLoadString$Message__vswprintf_c_l_swprintf
String ID: @Mqt0Lqt
API String ID: 2205000856-1302913217
Opcode ID: 6c438c2dbfa46832aee48c88b016487be4bc47176cc7b72929da2ac82ebcc3b6
Instruction ID: 9d06b1f4cd59cdefe9690507ea72e5cbfdea5d4dd647bebaf6d475ef8b5df265
Opcode Fuzzy Hash: 6c438c2dbfa46832aee48c88b016487be4bc47176cc7b72929da2ac82ebcc3b6
Instruction Fuzzy Hash: 63F0E2364401196FEB017BE48D06EEA376CFB087D1F004262B504E60A3E925992187B4

Uniqueness

Uniqueness Score: -1.00%

Function 00A78F58 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A78F58(intOrPtr* _a8, char _a12) {
				void* _t4;
				intOrPtr* _t5;
				long _t14;

				if( *0xaa1724 == 0) {
					_t5 = _a8;
					if( *_t5 != 0) {
						_t14 = GetLastError();
						E00A63CB5(0xab5e38, 0x1000, _a8, 0,  &_a12);
						_t5 = E00A787EC(L"%s", 0xab5e38);
						if(_t14 != 0) {
							SetLastError(_t14);
						}
					}
					return _t5;
				}
				return _t4;
			}

0x00a78f5f
0x00a78f61
0x00a78f6b
0x00a78f74
0x00a78f8b
0x00a78f96
0x00a78fa0
0x00a78fa3
0x00a78fa3
0x00a78fa9
0x00000000
0x00a78faa
0x00a78fab

APIs

GetLastError.KERNEL32(?,?,00A6FA13,?,00000000,00000456,?,00A6156B), ref: 00A78F6E
__vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00A78F8B

Part of subcall function 00A787EC: wvsprintfW.USER32(?,?,00000456), ref: 00A78812

SetLastError.KERNEL32(00000000,?,00A6FA13,?,00000000,00000456,?,00A6156B), ref: 00A78FA3

Strings

@Mqt0Lqt, xrefs: 00A78F6E

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: ErrorLast$__vswprintf_c_lwvsprintf
String ID: @Mqt0Lqt
API String ID: 2089174073-1302913217
Opcode ID: 7d78a847e67c23e9b964aa4aa6356fca412b8b1318599f539defe3ebe6ff44fc
Instruction ID: 4e5d0ac7d5ec728b90d7ee5730f0b4f79210eae81595a047a2f812ca0e18d67d
Opcode Fuzzy Hash: 7d78a847e67c23e9b964aa4aa6356fca412b8b1318599f539defe3ebe6ff44fc
Instruction Fuzzy Hash: 64E02B37D456117FC3129B50DD08F9B3678ABC6BA0F048014F80652111DB24484787A2

Uniqueness

Uniqueness Score: -1.00%

Function 00A6F171 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00A6F171(void* __ecx, void* __ebp, void* _a4) {
				void* __esi;
				long _t2;
				void* _t6;

				_t6 = __ecx;
				_t2 = WaitForSingleObject(_a4, 0xffffffff);
				if(_t2 == 0xffffffff) {
					_push(GetLastError());
					return E00A669DF(E00A669E4(_t6, 0xa9bbf8, L"\nWaitForMultipleObjects error %d, GetLastError %d", 0xffffffff), 0xa9bbf8, 0xa9bbf8, 2);
				}
				return _t2;
			}

0x00a6f171
0x00a6f177
0x00a6f180
0x00a6f189
0x00000000
0x00a6f1a8
0x00a6f1a9

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00A6F4B8,?,?,?,?,?,00A69FBE,?,?,?,?,00A8EB81,000000FF), ref: 00A6F177
GetLastError.KERNEL32(?,?,?,?,?,00A69FBE,?,?,?,?,00A8EB81,000000FF), ref: 00A6F183

Part of subcall function 00A669E4: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00A66A02

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00A6F18C
@Mqt0Lqt, xrefs: 00A6F183

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d$@Mqt0Lqt
API String ID: 1091760877-1995732503
Opcode ID: 1ec2ba346d579e0ad7225d9caba2803a934d5c54d37ecbe30e9be3d930302b87
Instruction ID: af50606d5fe6ea47f35c0c17dd41540173fbf068b9e4829e02a29f65c49771b7
Opcode Fuzzy Hash: 1ec2ba346d579e0ad7225d9caba2803a934d5c54d37ecbe30e9be3d930302b87
Instruction Fuzzy Hash: A9D05E32A484327EDA003378AD0AE6E3925AF52770F640B35F636951FADF200C4247E1

Uniqueness

Uniqueness Score: -1.00%

Function 00A85D3B Relevance: 6.3, APIs: 4, Instructions: 305
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 75%

			E00A85D3B(void* __edx, signed int* _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				char _v40;
				intOrPtr _v48;
				char _v52;
				void* __ebx;
				void* __edi;
				void* _t86;
				signed int _t92;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				void* _t101;
				void* _t102;
				void* _t104;
				void* _t107;
				void* _t109;
				void* _t111;
				void* _t115;
				char* _t116;
				void* _t119;
				signed int _t121;
				signed int _t128;
				signed int* _t129;
				signed int _t136;
				signed int _t137;
				char _t138;
				signed int _t139;
				signed int _t142;
				signed int _t146;
				signed int _t151;
				char _t156;
				char _t157;
				void* _t161;
				unsigned int _t162;
				signed int _t164;
				signed int _t166;
				signed int _t170;
				void* _t171;
				signed int* _t172;
				signed int _t174;
				signed int _t181;
				signed int _t182;
				signed int _t183;
				signed int _t184;
				signed int _t185;
				signed int _t186;
				signed int _t187;

				_t171 = __edx;
				_t181 = _a24;
				if(_t181 < 0) {
					_t181 = 0;
				}
				_t184 = _a8;
				 *_t184 = 0;
				E00A81C26(0,  &_v52, _t171, _a36);
				_t5 = _t181 + 0xb; // 0xb
				if(_a12 > _t5) {
					_t172 = _a4;
					_t142 = _t172[1];
					_v36 =  *_t172;
					__eflags = (_t142 >> 0x00000014 & 0x000007ff) - 0x7ff;
					if((_t142 >> 0x00000014 & 0x000007ff) != 0x7ff) {
						L11:
						__eflags = _t142 & 0x80000000;
						if((_t142 & 0x80000000) != 0) {
							 *_t184 = 0x2d;
							_t184 = _t184 + 1;
							__eflags = _t184;
						}
						__eflags = _a28;
						_v16 = 0x3ff;
						_t136 = ((0 | _a28 == 0x00000000) - 0x00000001 & 0xffffffe0) + 0x27;
						__eflags = _t172[1] & 0x7ff00000;
						_v32 = _t136;
						_t86 = 0x30;
						if((_t172[1] & 0x7ff00000) != 0) {
							 *_t184 = 0x31;
							_t185 = _t184 + 1;
							__eflags = _t185;
						} else {
							 *_t184 = _t86;
							_t185 = _t184 + 1;
							_t164 =  *_t172 | _t172[1] & 0x000fffff;
							__eflags = _t164;
							if(_t164 != 0) {
								_v16 = 0x3fe;
							} else {
								_v16 = _v16 & _t164;
							}
						}
						_t146 = _t185;
						_t186 = _t185 + 1;
						_v28 = _t146;
						__eflags = _t181;
						if(_t181 != 0) {
							 *_t146 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v48 + 0x88))))));
						} else {
							 *_t146 = 0;
						}
						_t92 = _t172[1] & 0x000fffff;
						__eflags = _t92;
						_v20 = _t92;
						if(_t92 > 0) {
							L23:
							_t33 =  &_v8;
							 *_t33 = _v8 & 0x00000000;
							__eflags =  *_t33;
							_t147 = 0xf0000;
							_t93 = 0x30;
							_v12 = _t93;
							_v20 = 0xf0000;
							do {
								__eflags = _t181;
								if(_t181 <= 0) {
									break;
								}
								_t119 = E00A7C3C0( *_t172 & _v8, _v12, _t172[1] & _t147 & 0x000fffff);
								_t161 = 0x30;
								_t121 = _t119 + _t161 & 0x0000ffff;
								__eflags = _t121 - 0x39;
								if(_t121 > 0x39) {
									_t121 = _t121 + _t136;
									__eflags = _t121;
								}
								_t162 = _v20;
								_t172 = _a4;
								 *_t186 = _t121;
								_t186 = _t186 + 1;
								_v8 = (_t162 << 0x00000020 | _v8) >> 4;
								_t147 = _t162 >> 4;
								_t93 = _v12 - 4;
								_t181 = _t181 - 1;
								_v20 = _t162 >> 4;
								_v12 = _t93;
								__eflags = _t93;
							} while (_t93 >= 0);
							__eflags = _t93;
							if(_t93 < 0) {
								goto L39;
							}
							_t115 = E00A7C3C0( *_t172 & _v8, _v12, _t172[1] & _t147 & 0x000fffff);
							__eflags = _t115 - 8;
							if(_t115 <= 8) {
								goto L39;
							}
							_t54 = _t186 - 1; // 0xa82240
							_t116 = _t54;
							_t138 = 0x30;
							while(1) {
								_t156 =  *_t116;
								__eflags = _t156 - 0x66;
								if(_t156 == 0x66) {
									goto L33;
								}
								__eflags = _t156 - 0x46;
								if(_t156 != 0x46) {
									_t139 = _v32;
									__eflags = _t116 - _v28;
									if(_t116 == _v28) {
										_t57 = _t116 - 1;
										 *_t57 =  *(_t116 - 1) + 1;
										__eflags =  *_t57;
									} else {
										_t157 =  *_t116;
										__eflags = _t157 - 0x39;
										if(_t157 != 0x39) {
											 *_t116 = _t157 + 1;
										} else {
											 *_t116 = _t139 + 0x3a;
										}
									}
									goto L39;
								}
								L33:
								 *_t116 = _t138;
								_t116 = _t116 - 1;
							}
						} else {
							__eflags =  *_t172;
							if( *_t172 <= 0) {
								L39:
								__eflags = _t181;
								if(_t181 > 0) {
									_push(_t181);
									_t111 = 0x30;
									_push(_t111);
									_push(_t186);
									E00A7D1E0(_t181);
									_t186 = _t186 + _t181;
									__eflags = _t186;
								}
								_t94 = _v28;
								__eflags =  *_t94;
								if( *_t94 == 0) {
									_t186 = _t94;
								}
								__eflags = _a28;
								 *_t186 = ((_t94 & 0xffffff00 | _a28 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x70;
								_t174 = _a4[1];
								_t100 = E00A7C3C0( *_a4, 0x34, _t174);
								_t137 = 0;
								_t151 = (_t100 & 0x000007ff) - _v16;
								__eflags = _t151;
								asm("sbb ebx, ebx");
								if(__eflags < 0) {
									L47:
									 *(_t186 + 1) = 0x2d;
									_t187 = _t186 + 2;
									__eflags = _t187;
									_t151 =  ~_t151;
									asm("adc ebx, 0x0");
									_t137 =  ~_t137;
									goto L48;
								} else {
									if(__eflags > 0) {
										L46:
										 *(_t186 + 1) = 0x2b;
										_t187 = _t186 + 2;
										L48:
										_t182 = _t187;
										_t101 = 0x30;
										 *_t187 = _t101;
										__eflags = _t137;
										if(__eflags < 0) {
											L56:
											__eflags = _t187 - _t182;
											if(_t187 != _t182) {
												L60:
												_push(0);
												_push(0xa);
												_push(_t137);
												_push(_t151);
												_t102 = E00A7C700();
												_v32 = _t174;
												 *_t187 = _t102 + 0x30;
												_t187 = _t187 + 1;
												__eflags = _t187;
												L61:
												_t104 = 0x30;
												_t183 = 0;
												__eflags = 0;
												 *_t187 = _t151 + _t104;
												 *(_t187 + 1) = 0;
												goto L62;
											}
											__eflags = _t137;
											if(__eflags < 0) {
												goto L61;
											}
											if(__eflags > 0) {
												goto L60;
											}
											__eflags = _t151 - 0xa;
											if(_t151 < 0xa) {
												goto L61;
											}
											goto L60;
										}
										if(__eflags > 0) {
											L51:
											_push(0);
											_push(0x3e8);
											_push(_t137);
											_push(_t151);
											_t107 = E00A7C700();
											_v32 = _t174;
											 *_t187 = _t107 + 0x30;
											_t187 = _t187 + 1;
											__eflags = _t187 - _t182;
											if(_t187 != _t182) {
												L55:
												_push(0);
												_push(0x64);
												_push(_t137);
												_push(_t151);
												_t109 = E00A7C700();
												_v32 = _t174;
												 *_t187 = _t109 + 0x30;
												_t187 = _t187 + 1;
												__eflags = _t187;
												goto L56;
											}
											L52:
											__eflags = _t137;
											if(__eflags < 0) {
												goto L56;
											}
											if(__eflags > 0) {
												goto L55;
											}
											__eflags = _t151 - 0x64;
											if(_t151 < 0x64) {
												goto L56;
											}
											goto L55;
										}
										__eflags = _t151 - 0x3e8;
										if(_t151 < 0x3e8) {
											goto L52;
										}
										goto L51;
									}
									__eflags = _t151;
									if(_t151 < 0) {
										goto L47;
									}
									goto L46;
								}
							}
							goto L23;
						}
					}
					__eflags = 0;
					if(0 != 0) {
						goto L11;
					} else {
						_t183 = E00A8603E(0, _t142, 0, _t172, _t184, _a12, _a16, _a20, _t181, 0, _a32, 0);
						__eflags = _t183;
						if(_t183 == 0) {
							_t128 = E00A8E9F0(_t184, 0x65);
							_pop(_t166);
							__eflags = _t128;
							if(_t128 != 0) {
								__eflags = _a28;
								_t170 = ((_t166 & 0xffffff00 | _a28 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x70;
								__eflags = _t170;
								 *_t128 = _t170;
								 *((char*)(_t128 + 3)) = 0;
							}
							_t183 = 0;
						} else {
							 *_t184 = 0;
						}
						goto L62;
					}
				} else {
					_t129 = E00A85628();
					_t183 = 0x22;
					 *_t129 = _t183;
					E00A85507();
					L62:
					if(_v40 != 0) {
						 *(_v52 + 0x350) =  *(_v52 + 0x350) & 0xfffffffd;
					}
					return _t183;
				}
			}

0x00a85d3b
0x00a85d46
0x00a85d4d
0x00a85d4f
0x00a85d4f
0x00a85d51
0x00a85d5a
0x00a85d5c
0x00a85d61
0x00a85d67
0x00a85d7d
0x00a85d82
0x00a85d85
0x00a85d92
0x00a85d97
0x00a85deb
0x00a85df3
0x00a85df5
0x00a85df7
0x00a85dfa
0x00a85dfa
0x00a85dfa
0x00a85e00
0x00a85e08
0x00a85e1b
0x00a85e1e
0x00a85e20
0x00a85e23
0x00a85e24
0x00a85e45
0x00a85e48
0x00a85e48
0x00a85e26
0x00a85e26
0x00a85e28
0x00a85e33
0x00a85e33
0x00a85e35
0x00a85e3c
0x00a85e37
0x00a85e37
0x00a85e37
0x00a85e35
0x00a85e49
0x00a85e4b
0x00a85e4c
0x00a85e4f
0x00a85e51
0x00a85e65
0x00a85e53
0x00a85e53
0x00a85e53
0x00a85e6a
0x00a85e6a
0x00a85e6f
0x00a85e72
0x00a85e7d
0x00a85e7d
0x00a85e7d
0x00a85e7d
0x00a85e81
0x00a85e88
0x00a85e89
0x00a85e8c
0x00a85e8f
0x00a85e8f
0x00a85e91
0x00000000
0x00000000
0x00a85ea9
0x00a85eb0
0x00a85eb4
0x00a85eb7
0x00a85eba
0x00a85ebc
0x00a85ebc
0x00a85ebc
0x00a85ebe
0x00a85ec1
0x00a85ec4
0x00a85ec6
0x00a85ece
0x00a85ed4
0x00a85ed7
0x00a85eda
0x00a85edb
0x00a85ede
0x00a85ee1
0x00a85ee1
0x00a85ee6
0x00a85ee9
0x00000000
0x00000000
0x00a85f01
0x00a85f06
0x00a85f0a
0x00000000
0x00000000
0x00a85f0e
0x00a85f0e
0x00a85f11
0x00a85f12
0x00a85f12
0x00a85f14
0x00a85f17
0x00000000
0x00000000
0x00a85f19
0x00a85f1c
0x00a85f23
0x00a85f26
0x00a85f29
0x00a85f3f
0x00a85f3f
0x00a85f3f
0x00a85f2b
0x00a85f2b
0x00a85f2d
0x00a85f30
0x00a85f3b
0x00a85f32
0x00a85f35
0x00a85f35
0x00a85f30
0x00000000
0x00a85f29
0x00a85f1e
0x00a85f1e
0x00a85f20
0x00a85f20
0x00a85e74
0x00a85e74
0x00a85e77
0x00a85f42
0x00a85f42
0x00a85f44
0x00a85f46
0x00a85f49
0x00a85f4a
0x00a85f4b
0x00a85f4c
0x00a85f54
0x00a85f54
0x00a85f54
0x00a85f56
0x00a85f59
0x00a85f5c
0x00a85f5e
0x00a85f5e
0x00a85f60
0x00a85f72
0x00a85f76
0x00a85f79
0x00a85f80
0x00a85f88
0x00a85f88
0x00a85f8b
0x00a85f8d
0x00a85f9e
0x00a85f9e
0x00a85fa2
0x00a85fa2
0x00a85fa5
0x00a85fa7
0x00a85faa
0x00000000
0x00a85f8f
0x00a85f8f
0x00a85f95
0x00a85f95
0x00a85f99
0x00a85fac
0x00a85fac
0x00a85fb0
0x00a85fb1
0x00a85fb3
0x00a85fb5
0x00a85ff6
0x00a85ff6
0x00a85ff8
0x00a86005
0x00a86005
0x00a86007
0x00a86009
0x00a8600a
0x00a8600b
0x00a86012
0x00a86015
0x00a86017
0x00a86017
0x00a86018
0x00a8601a
0x00a8601d
0x00a8601d
0x00a8601f
0x00a86021
0x00000000
0x00a86021
0x00a85ffa
0x00a85ffc
0x00000000
0x00000000
0x00a85ffe
0x00000000
0x00000000
0x00a86000
0x00a86003
0x00000000
0x00000000
0x00000000
0x00a86003
0x00a85fbc
0x00a85fc2
0x00a85fc2
0x00a85fc4
0x00a85fc5
0x00a85fc6
0x00a85fc7
0x00a85fce
0x00a85fd1
0x00a85fd3
0x00a85fd4
0x00a85fd6
0x00a85fe3
0x00a85fe3
0x00a85fe5
0x00a85fe7
0x00a85fe8
0x00a85fe9
0x00a85ff0
0x00a85ff3
0x00a85ff5
0x00a85ff5
0x00000000
0x00a85ff5
0x00a85fd8
0x00a85fd8
0x00a85fda
0x00000000
0x00000000
0x00a85fdc
0x00000000
0x00000000
0x00a85fde
0x00a85fe1
0x00000000
0x00000000
0x00000000
0x00a85fe1
0x00a85fbe
0x00a85fc0
0x00000000
0x00000000
0x00000000
0x00a85fc0
0x00a85f91
0x00a85f93
0x00000000
0x00000000
0x00000000
0x00a85f93
0x00a85f8d
0x00000000
0x00a85e77
0x00a85e72
0x00a85d99
0x00a85d9b
0x00000000
0x00a85d9d
0x00a85db3
0x00a85db8
0x00a85dba
0x00a85dc6
0x00a85dcc
0x00a85dcd
0x00a85dcf
0x00a85dd1
0x00a85ddc
0x00a85ddc
0x00a85ddf
0x00a85de1
0x00a85de1
0x00a85de4
0x00a85dbc
0x00a85dbc
0x00a85dbc
0x00000000
0x00a85dba
0x00a85d69
0x00a85d69
0x00a85d70
0x00a85d71
0x00a85d73
0x00a86025
0x00a86029
0x00a8602e
0x00a8602e
0x00a8603d
0x00a8603d

APIs

_strrchr.LIBCMT ref: 00A85DC6
__alldvrm.LIBCMT ref: 00A85FC7
__alldvrm.LIBCMT ref: 00A85FE9

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: a3a212260803f9943723bbf433e255c54ea352307d3976254987c7e63e53c478
Instruction ID: bffe5a77e931362168fe06ac19ec401c498d051f2188c8d13ba0b4c297deac8a
Opcode Fuzzy Hash: a3a212260803f9943723bbf433e255c54ea352307d3976254987c7e63e53c478
Instruction Fuzzy Hash: EFA14972D04B869FEB26EF28C8817AEBBF5EF55350F1881ADED859B281C6348D41C750

Uniqueness

Uniqueness Score: -1.00%

Function 00A6994B Relevance: 6.1, APIs: 4, Instructions: 127
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00A6994B(void* __edx) {
				signed char _t40;
				void* _t41;
				void* _t52;
				signed char _t70;
				void* _t79;
				signed int* _t81;
				signed int* _t84;
				void* _t85;
				signed int* _t88;
				void* _t90;

				_t79 = __edx;
				E00A7C240();
				_t84 =  *(_t90 + 0x1038);
				_t70 = 1;
				if(_t84 == 0) {
					L2:
					 *(_t90 + 0x11) = 0;
					L3:
					_t81 =  *(_t90 + 0x1040);
					if(_t81 == 0) {
						L5:
						 *(_t90 + 0x13) = 0;
						L6:
						_t88 =  *(_t90 + 0x1044);
						if(_t88 == 0) {
							L8:
							 *(_t90 + 0x12) = 0;
							L9:
							_t40 = E00A69834( *(_t90 + 0x1038));
							 *(_t90 + 0x18) = _t40;
							if(_t40 == 0xffffffff || (_t70 & _t40) == 0) {
								_t70 = 0;
							} else {
								E00A69AE4( *((intOrPtr*)(_t90 + 0x103c)), 0);
							}
							_t41 = CreateFileW( *(_t90 + 0x1050), 0x40000000, 3, 0, 3, 0x2000000, 0);
							 *(_t90 + 0x14) = _t41;
							if(_t41 != 0xffffffff) {
								L16:
								if( *(_t90 + 0x11) != 0) {
									E00A6F65A(_t84, _t90 + 0x1c);
								}
								if( *(_t90 + 0x13) != 0) {
									E00A6F65A(_t81, _t90 + 0x2c);
								}
								if( *(_t90 + 0x12) != 0) {
									E00A6F65A(_t88, _t90 + 0x24);
								}
								_t85 =  *(_t90 + 0x14);
								asm("sbb eax, eax");
								asm("sbb eax, eax");
								asm("sbb eax, eax");
								SetFileTime(_t85,  ~( *(_t90 + 0x1b) & 0x000000ff) & _t90 + 0x00000030,  ~( *(_t90 + 0x16) & 0x000000ff) & _t90 + 0x00000024,  ~( *(_t90 + 0x11) & 0x000000ff) & _t90 + 0x0000001c);
								_t52 = CloseHandle(_t85);
								if(_t70 != 0) {
									_t52 = E00A69AE4( *((intOrPtr*)(_t90 + 0x103c)),  *(_t90 + 0x18));
								}
								goto L24;
							} else {
								_t52 = E00A6AC19(_t79,  *(_t90 + 0x1040), _t90 + 0x38, 0x800);
								if(_t52 == 0) {
									L24:
									return _t52;
								}
								_t52 = CreateFileW(_t90 + 0x4c, 0x40000000, 3, 0, 3, 0x2000000, 0);
								 *(_t90 + 0x14) = _t52;
								if(_t52 == 0xffffffff) {
									goto L24;
								}
								goto L16;
							}
						}
						 *(_t90 + 0x12) = _t70;
						if(( *_t88 | _t88[1]) != 0) {
							goto L9;
						}
						goto L8;
					}
					 *(_t90 + 0x13) = _t70;
					if(( *_t81 | _t81[1]) != 0) {
						goto L6;
					}
					goto L5;
				}
				 *(_t90 + 0x11) = 1;
				if(( *_t84 | _t84[1]) != 0) {
					goto L3;
				}
				goto L2;
			}

0x00a6994b
0x00a69950
0x00a6995c
0x00a69963
0x00a69967
0x00a69974
0x00a69974
0x00a69978
0x00a69978
0x00a69981
0x00a6998e
0x00a6998e
0x00a69992
0x00a69992
0x00a6999b
0x00a699a9
0x00a699a9
0x00a699ad
0x00a699b4
0x00a699b9
0x00a699c0
0x00a699d6
0x00a699c6
0x00a699cf
0x00a699cf
0x00a699f1
0x00a699f7
0x00a699fe
0x00a69a48
0x00a69a4d
0x00a69a56
0x00a69a56
0x00a69a60
0x00a69a69
0x00a69a69
0x00a69a73
0x00a69a7c
0x00a69a7c
0x00a69a8c
0x00a69a90
0x00a69aa0
0x00a69ab0
0x00a69ab6
0x00a69abd
0x00a69ac5
0x00a69ad2
0x00a69ad2
0x00000000
0x00a69a00
0x00a69a11
0x00a69a18
0x00a69ad7
0x00a69ae1
0x00a69ae1
0x00a69a35
0x00a69a3b
0x00a69a42
0x00000000
0x00000000
0x00000000
0x00a69a42
0x00a699fe
0x00a699a3
0x00a699a7
0x00000000
0x00000000
0x00000000
0x00a699a7
0x00a69988
0x00a6998c
0x00000000
0x00000000
0x00000000
0x00a6998c
0x00a6996e
0x00a69972
0x00000000
0x00000000
0x00000000

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000000,?,00A67996,?,?,?), ref: 00A699F1
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00000000,?,00A67996,?,?), ref: 00A69A35
SetFileTime.KERNEL32(?,00000800,?,00000000,?,00000000,?,00A67996,?,?,?,?,?,?,?,?), ref: 00A69AB6
CloseHandle.KERNEL32(?,?,00000000,?,00A67996,?,?,?,?,?,?,?,?,00000800,?,?), ref: 00A69ABD

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: e3baf1de9a1c7dede1d57add33872db23b48b8f924e165423880a3c2e98dc1df
Instruction ID: f318a50cd79d4de27419b6810c4145579f85eb150f3965505405ff6f50b88584
Opcode Fuzzy Hash: e3baf1de9a1c7dede1d57add33872db23b48b8f924e165423880a3c2e98dc1df
Instruction Fuzzy Hash: 3741EB31248381AEE721DF64DC41BEFBBF8AB95340F04092DF6E4931A1D6749A4DDB62

Uniqueness

Uniqueness Score: -1.00%

Function 00A88B78 Relevance: 6.1, APIs: 4, Instructions: 110
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E00A88B78(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, int _a8, char* _a12, int _a16, short* _a20, int _a24, intOrPtr _a28) {
				signed int _v8;
				int _v12;
				char _v16;
				intOrPtr _v24;
				char _v28;
				void* _v40;
				signed int _t34;
				signed int _t40;
				int _t46;
				int _t53;
				void* _t55;
				int _t57;
				signed int _t63;
				int _t67;
				short* _t69;
				signed int _t70;
				short* _t71;

				_t34 =  *0xa991b8; // 0x3197ea2d
				_v8 = _t34 ^ _t70;
				E00A81C26(__ebx,  &_v28, __edx, _a4);
				_t57 = _a24;
				if(_t57 == 0) {
					_t6 = _v24 + 8; // 0xefe85006
					_t53 =  *_t6;
					_t57 = _t53;
					_a24 = _t53;
				}
				_t67 = 0;
				_t40 = MultiByteToWideChar(_t57, 1 + (0 | _a28 != 0x00000000) * 8, _a12, _a16, 0, 0);
				_v12 = _t40;
				if(_t40 == 0) {
					L15:
					if(_v16 != 0) {
						 *(_v28 + 0x350) =  *(_v28 + 0x350) & 0xfffffffd;
					}
					return E00A7CABF(_v8 ^ _t70);
				}
				_t55 = _t40 + _t40;
				asm("sbb eax, eax");
				if((_t55 + 0x00000008 & _t40) == 0) {
					_t69 = 0;
					L11:
					if(_t69 != 0) {
						E00A7D1E0(_t67, _t69, _t67, _t55);
						_t46 = MultiByteToWideChar(_a24, 1, _a12, _a16, _t69, _v12);
						if(_t46 != 0) {
							_t67 = GetStringTypeW(_a8, _t69, _t46, _a20);
						}
					}
					L14:
					E00A86DFF(_t69);
					goto L15;
				}
				asm("sbb eax, eax");
				_t48 = _t40 & _t55 + 0x00000008;
				_t63 = _t55 + 8;
				if((_t40 & _t55 + 0x00000008) > 0x400) {
					asm("sbb eax, eax");
					_t69 = E00A851E6(_t63, _t48 & _t63);
					if(_t69 == 0) {
						goto L14;
					}
					 *_t69 = 0xdddd;
					L9:
					_t69 =  &(_t69[4]);
					goto L11;
				}
				asm("sbb eax, eax");
				E00A8E900();
				_t69 = _t71;
				if(_t69 == 0) {
					goto L14;
				}
				 *_t69 = 0xcccc;
				goto L9;
			}

0x00a88b80
0x00a88b87
0x00a88b93
0x00a88b98
0x00a88b9d
0x00a88ba2
0x00a88ba2
0x00a88ba5
0x00a88ba7
0x00a88ba7
0x00a88bac
0x00a88bc5
0x00a88bcb
0x00a88bd0
0x00a88c6f
0x00a88c73
0x00a88c78
0x00a88c78
0x00a88c94
0x00a88c94
0x00a88bd6
0x00a88bde
0x00a88be2
0x00a88c2e
0x00a88c30
0x00a88c32
0x00a88c37
0x00a88c4e
0x00a88c56
0x00a88c66
0x00a88c66
0x00a88c56
0x00a88c68
0x00a88c69
0x00000000
0x00a88c6e
0x00a88be9
0x00a88beb
0x00a88bed
0x00a88bf5
0x00a88c12
0x00a88c1c
0x00a88c21
0x00000000
0x00000000
0x00a88c23
0x00a88c29
0x00a88c29
0x00000000
0x00a88c29
0x00a88bf9
0x00a88bfd
0x00a88c02
0x00a88c06
0x00000000
0x00000000
0x00a88c08
0x00000000

APIs

MultiByteToWideChar.KERNEL32(?,00000000,EFE85006,00A81D84,00000000,00000000,00A825B2,?,00A825B2,?,00000001,00A81D84,EFE85006,00000001,00A825B2,00A825B2), ref: 00A88BC5
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00A88C4E
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00A88C60
__freea.LIBCMT ref: 00A88C69

Part of subcall function 00A851E6: RtlAllocateHeap.NTDLL(00000000,?,?,?,00A8199A,?,0000015D,?,?,?,?,00A82519,000000FF,00000000,?,?), ref: 00A85218

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: b764b8add32adeed653e1eca905c02500737250ebaebcfd2a60f9007a0d6e08f
Instruction ID: 07ac0dc095d6d8aebcc91460089c5304a9637c02695468b96c849a84880951ae
Opcode Fuzzy Hash: b764b8add32adeed653e1eca905c02500737250ebaebcfd2a60f9007a0d6e08f
Instruction Fuzzy Hash: 3B31BDB2A0120AAFDB24EF65DC85DAE7BA5EF40710B444628FC0496150EF39CD51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A61310 Relevance: 6.1, APIs: 4, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E00A61310(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, char _a16) {
				char _v0;
				char _v1022;
				char _v1024;
				char _v1028;
				intOrPtr _v1064;
				intOrPtr _v1068;
				intOrPtr _v1084;
				intOrPtr _v1088;
				char* _v1104;
				intOrPtr _v1108;
				char _v1112;
				char _v1116;
				void* __edi;
				signed int _t36;
				intOrPtr _t40;
				signed int _t44;
				intOrPtr* _t58;
				void* _t61;
				char _t62;
				signed int _t63;
				void* _t65;
				signed int _t76;

				_t57 = _a16;
				_t59 =  &_v1024;
				if(_a16 != 0) {
					E00A81693( &_v1024, _t57);
					_t65 =  &_v1022 + E00A816B5( &_v1024) * 2;
					E00A81693(_t65, _t57);
					_t59 = _t65 + E00A816B5(_t65) * 2 + 2;
				}
				E00A81693(_t59, E00A6CD14(0xa2));
				_t61 = _t59 + E00A816B5(_t59) * 2 + 2;
				E00A81693(_t61, 0xa8f290);
				_t36 = E00A816B5(_t61);
				 *((short*)(_t61 + 2 + _t36 * 2)) = 0;
				_t62 = 0x58;
				E00A7D1E0(_t57,  &_v1116, 0, _t62);
				_t58 =  *0xa99a44; // 0xa7ba76
				_v1112 = _v0;
				_t40 =  *0xa9bbdc; // 0xa60000
				_v1108 = _t40;
				_v1104 =  &_v1028;
				_v1068 = _a4;
				_v1116 = _t62;
				_v1088 = _a8;
				_v1084 = 0x800;
				_v1064 = 0x1080c;
				_push( &_v1116);
				if(_a16 == 0) {
					_t44 =  *_t58();
				} else {
					_t44 =  *0xa99a48();
				}
				_t63 = _t44;
				if(_t63 == 0) {
					_t44 =  *0xa99a4c();
					if(_t44 == 0x3002) {
						_v0 = 0;
						_push( &_v1116);
						if(_a16 == 0) {
							_t44 =  *_t58();
						} else {
							_t44 =  *0xa99a48();
						}
						_t63 = _t44;
					}
					_t76 = _t63;
				}
				return _t44 & 0xffffff00 | _t76 != 0x00000000;
			}

0x00a61319
0x00a61320
0x00a61326
0x00a6132c
0x00a6133e
0x00a61342
0x00a61353
0x00a61353
0x00a61362
0x00a61375
0x00a61379
0x00a6137f
0x00a61388
0x00a61391
0x00a61395
0x00a613b3
0x00a613b9
0x00a613bd
0x00a613c2
0x00a613ca
0x00a613d5
0x00a613dd
0x00a613e1
0x00a613e5
0x00a613ed
0x00a613f5
0x00a613f6
0x00a61400
0x00a613f8
0x00a613f8
0x00a613f8
0x00a61402
0x00a61406
0x00a61408
0x00a61413
0x00a6141e
0x00a61426
0x00a61427
0x00a61431
0x00a61429
0x00a61429
0x00a61429
0x00a61433
0x00a61433
0x00a61435
0x00a61435
0x00a61443

APIs

_wcslen.LIBCMT ref: 00A61334
_wcslen.LIBCMT ref: 00A61348
_wcslen.LIBCMT ref: 00A61368
_wcslen.LIBCMT ref: 00A6137F

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: ce41ba1cbaa773e96b991c2b44b8b7cfbea3ea1be36df48a66997624f6d42d3b
Instruction ID: 8c9c4986a2836fae9939907207165eb34e68578a0a45ab321b7467835964b07c
Opcode Fuzzy Hash: ce41ba1cbaa773e96b991c2b44b8b7cfbea3ea1be36df48a66997624f6d42d3b
Instruction Fuzzy Hash: 1031A7B15087109BC321EB79CD0999FBBFCAF80350F04492DF9C9A3211EF3499468BA6

Uniqueness

Uniqueness Score: -1.00%

Function 00A78E03 Relevance: 6.0, APIs: 4, Instructions: 30
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A78E03() {
				struct tagMSG _v32;
				int _t6;

				_t6 = PeekMessageW( &_v32, 0, 0, 0, 0);
				if(_t6 != 0) {
					GetMessageW( &_v32, 0, 0, 0);
					TranslateMessage( &_v32);
					return DispatchMessageW( &_v32);
				}
				return _t6;
			}

0x00a78e14
0x00a78e1c
0x00a78e25
0x00a78e2f
0x00000000
0x00a78e39
0x00a78e43

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00A78E14
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00A78E25
TranslateMessage.USER32(?), ref: 00A78E2F
DispatchMessageW.USER32(?), ref: 00A78E39

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: d90af881626c396d1a938bd7187328e062045d4ff864dfc19d60be882fab4660
Instruction ID: bf034097e075e3a920b694ffd7c769d02350b93f9b235cf0c5b563644c21b10a
Opcode Fuzzy Hash: d90af881626c396d1a938bd7187328e062045d4ff864dfc19d60be882fab4660
Instruction Fuzzy Hash: 9CE05971E0212EB78B20EBFAAC4CDDF7F6CEE1A2A17004556B519D2014DA289506C7F0

Uniqueness

Uniqueness Score: -1.00%

Function 00A873D1 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00A873D1(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8, intOrPtr _a12) {
				intOrPtr _v0;
				char _v6;
				char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v36;
				intOrPtr* _v64;
				intOrPtr _v96;
				intOrPtr* _v100;
				CHAR* _v104;
				signed int _v116;
				char _v290;
				signed int _v291;
				struct _WIN32_FIND_DATAA _v336;
				union _FINDEX_INFO_LEVELS _v340;
				signed int _v344;
				signed int _v348;
				intOrPtr _v440;
				intOrPtr* _t80;
				signed int _t82;
				signed int _t87;
				signed int _t91;
				signed int _t93;
				signed int _t95;
				signed int _t96;
				signed int _t100;
				signed int _t103;
				signed int _t108;
				signed int _t111;
				intOrPtr _t113;
				signed char _t115;
				union _FINDEX_INFO_LEVELS _t123;
				signed int _t128;
				signed int _t131;
				void* _t137;
				void* _t139;
				signed int _t140;
				signed int _t143;
				signed int _t145;
				signed int _t147;
				signed int* _t148;
				signed int _t151;
				void* _t154;
				CHAR* _t155;
				char _t158;
				char _t160;
				intOrPtr* _t163;
				void* _t164;
				intOrPtr* _t165;
				signed int _t167;
				void* _t169;
				intOrPtr* _t170;
				signed int _t174;
				signed int _t178;
				signed int _t179;
				intOrPtr* _t184;
				void* _t193;
				intOrPtr _t194;
				signed int _t196;
				signed int _t197;
				signed int _t199;
				signed int _t200;
				signed int _t202;
				union _FINDEX_INFO_LEVELS _t203;
				signed int _t208;
				signed int _t210;
				signed int _t211;
				void* _t213;
				intOrPtr _t214;
				void* _t215;
				signed int _t219;
				void* _t221;
				signed int _t222;
				void* _t223;
				void* _t224;
				void* _t225;
				signed int _t226;
				void* _t227;
				void* _t228;

				_t80 = _a8;
				_t224 = _t223 - 0x20;
				if(_t80 != 0) {
					_t208 = _a4;
					_t160 = 0;
					 *_t80 = 0;
					_t199 = 0;
					_t151 = 0;
					_v36 = 0;
					_v336.cAlternateFileName = 0;
					_v28 = 0;
					__eflags =  *_t208;
					if( *_t208 == 0) {
						L9:
						_v12 = _v12 & 0x00000000;
						_t82 = _t151 - _t199;
						_v8 = _t160;
						_t191 = (_t82 >> 2) + 1;
						__eflags = _t151 - _t199;
						_v16 = (_t82 >> 2) + 1;
						asm("sbb esi, esi");
						_t210 =  !_t208 & _t82 + 0x00000003 >> 0x00000002;
						__eflags = _t210;
						if(_t210 != 0) {
							_t197 = _t199;
							_t158 = _t160;
							do {
								_t184 =  *_t197;
								_t17 = _t184 + 1; // 0x1
								_v8 = _t17;
								do {
									_t143 =  *_t184;
									_t184 = _t184 + 1;
									__eflags = _t143;
								} while (_t143 != 0);
								_t158 = _t158 + 1 + _t184 - _v8;
								_t197 = _t197 + 4;
								_t145 = _v12 + 1;
								_v12 = _t145;
								__eflags = _t145 - _t210;
							} while (_t145 != _t210);
							_t191 = _v16;
							_v8 = _t158;
							_t151 = _v336.cAlternateFileName;
						}
						_t211 = E00A8466E(_t191, _v8, 1);
						_t225 = _t224 + 0xc;
						__eflags = _t211;
						if(_t211 != 0) {
							_t87 = _t211 + _v16 * 4;
							_v20 = _t87;
							_t192 = _t87;
							_v16 = _t87;
							__eflags = _t199 - _t151;
							if(_t199 == _t151) {
								L23:
								_t200 = 0;
								__eflags = 0;
								 *_a8 = _t211;
								goto L24;
							} else {
								_t93 = _t211 - _t199;
								__eflags = _t93;
								_v24 = _t93;
								do {
									_t163 =  *_t199;
									_v12 = _t163 + 1;
									do {
										_t95 =  *_t163;
										_t163 = _t163 + 1;
										__eflags = _t95;
									} while (_t95 != 0);
									_t164 = _t163 - _v12;
									_t35 = _t164 + 1; // 0x1
									_t96 = _t35;
									_push(_t96);
									_v12 = _t96;
									_t100 = E00A8B76B(_t164, _t192, _v20 - _t192 + _v8,  *_t199);
									_t225 = _t225 + 0x10;
									__eflags = _t100;
									if(_t100 != 0) {
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										E00A85517();
										asm("int3");
										_t221 = _t225;
										_push(_t164);
										_t165 = _v64;
										_t47 = _t165 + 1; // 0x1
										_t193 = _t47;
										do {
											_t103 =  *_t165;
											_t165 = _t165 + 1;
											__eflags = _t103;
										} while (_t103 != 0);
										_push(_t199);
										_t202 = _a8;
										_t167 = _t165 - _t193 + 1;
										_v12 = _t167;
										__eflags = _t167 - (_t103 | 0xffffffff) - _t202;
										if(_t167 <= (_t103 | 0xffffffff) - _t202) {
											_push(_t151);
											_t50 = _t202 + 1; // 0x1
											_t154 = _t50 + _t167;
											_t213 = E00A85277(_t167, _t154, 1);
											_t169 = _t211;
											__eflags = _t202;
											if(_t202 == 0) {
												L34:
												_push(_v12);
												_t154 = _t154 - _t202;
												_t108 = E00A8B76B(_t169, _t213 + _t202, _t154, _v0);
												_t226 = _t225 + 0x10;
												__eflags = _t108;
												if(__eflags != 0) {
													goto L37;
												} else {
													_t137 = E00A877A0(_a12, _t193, __eflags, _t213);
													E00A851AC(0);
													_t139 = _t137;
													goto L36;
												}
											} else {
												_push(_t202);
												_t140 = E00A8B76B(_t169, _t213, _t154, _a4);
												_t226 = _t225 + 0x10;
												__eflags = _t140;
												if(_t140 != 0) {
													L37:
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													E00A85517();
													asm("int3");
													_push(_t221);
													_t222 = _t226;
													_t227 = _t226 - 0x150;
													_t111 =  *0xa991b8; // 0x3197ea2d
													_v116 = _t111 ^ _t222;
													_t170 = _v100;
													_push(_t154);
													_t155 = _v104;
													_push(_t213);
													_t214 = _v96;
													_push(_t202);
													_v440 = _t214;
													while(1) {
														__eflags = _t170 - _t155;
														if(_t170 == _t155) {
															break;
														}
														_t113 =  *_t170;
														__eflags = _t113 - 0x2f;
														if(_t113 != 0x2f) {
															__eflags = _t113 - 0x5c;
															if(_t113 != 0x5c) {
																__eflags = _t113 - 0x3a;
																if(_t113 != 0x3a) {
																	_t170 = E00A8B7C0(_t155, _t170);
																	continue;
																}
															}
														}
														break;
													}
													_t194 =  *_t170;
													__eflags = _t194 - 0x3a;
													if(_t194 != 0x3a) {
														L47:
														_t203 = 0;
														__eflags = _t194 - 0x2f;
														if(_t194 == 0x2f) {
															L51:
															_t115 = 1;
															__eflags = 1;
														} else {
															__eflags = _t194 - 0x5c;
															if(_t194 == 0x5c) {
																goto L51;
															} else {
																__eflags = _t194 - 0x3a;
																if(_t194 == 0x3a) {
																	goto L51;
																} else {
																	_t115 = 0;
																}
															}
														}
														asm("sbb eax, eax");
														_v344 =  ~(_t115 & 0x000000ff) & _t170 - _t155 + 0x00000001;
														E00A7D1E0(_t203,  &_v336, _t203, 0x140);
														_t228 = _t227 + 0xc;
														_t215 = FindFirstFileExA(_t155, _t203,  &_v336, _t203, _t203, _t203);
														_t123 = _v340;
														__eflags = _t215 - 0xffffffff;
														if(_t215 != 0xffffffff) {
															_t174 =  *((intOrPtr*)(_t123 + 4)) -  *_t123;
															__eflags = _t174;
															_v348 = _t174 >> 2;
															do {
																__eflags = _v336.cFileName - 0x2e;
																if(_v336.cFileName != 0x2e) {
																	L64:
																	_push(_t123);
																	_push(_v344);
																	_t123 =  &(_v336.cFileName);
																	_push(_t155);
																	_push(_t123);
																	L28();
																	_t228 = _t228 + 0x10;
																	__eflags = _t123;
																	if(_t123 != 0) {
																		goto L54;
																	} else {
																		goto L65;
																	}
																} else {
																	_t178 = _v291;
																	__eflags = _t178;
																	if(_t178 == 0) {
																		goto L65;
																	} else {
																		__eflags = _t178 - 0x2e;
																		if(_t178 != 0x2e) {
																			goto L64;
																		} else {
																			__eflags = _v290;
																			if(_v290 == 0) {
																				goto L65;
																			} else {
																				goto L64;
																			}
																		}
																	}
																}
																goto L58;
																L65:
																_t128 = FindNextFileA(_t215,  &_v336);
																__eflags = _t128;
																_t123 = _v340;
															} while (_t128 != 0);
															_t195 =  *_t123;
															_t179 = _v348;
															_t131 =  *((intOrPtr*)(_t123 + 4)) -  *_t123 >> 2;
															__eflags = _t179 - _t131;
															if(_t179 != _t131) {
																E00A8B320(_t155, _t203, _t215, _t195 + _t179 * 4, _t131 - _t179, 4, E00A873B9);
															}
														} else {
															_push(_t123);
															_push(_t203);
															_push(_t203);
															_push(_t155);
															L28();
															L54:
															_t203 = _t123;
														}
														__eflags = _t215 - 0xffffffff;
														if(_t215 != 0xffffffff) {
															FindClose(_t215);
														}
													} else {
														__eflags = _t170 -  &(_t155[1]);
														if(_t170 ==  &(_t155[1])) {
															goto L47;
														} else {
															_push(_t214);
															_push(0);
															_push(0);
															_push(_t155);
															L28();
														}
													}
													L58:
													__eflags = _v16 ^ _t222;
													return E00A7CABF(_v16 ^ _t222);
												} else {
													goto L34;
												}
											}
										} else {
											_t139 = 0xc;
											L36:
											return _t139;
										}
									} else {
										goto L22;
									}
									goto L68;
									L22:
									_t196 = _v16;
									 *((intOrPtr*)(_v24 + _t199)) = _t196;
									_t199 = _t199 + 4;
									_t192 = _t196 + _v12;
									_v16 = _t196 + _v12;
									__eflags = _t199 - _t151;
								} while (_t199 != _t151);
								goto L23;
							}
						} else {
							_t200 = _t199 | 0xffffffff;
							L24:
							E00A851AC(0);
							goto L25;
						}
					} else {
						while(1) {
							_v8 = 0x3f2a;
							_v6 = _t160;
							_t147 = E00A8B780( *_t208,  &_v8);
							__eflags = _t147;
							if(_t147 != 0) {
								_push( &_v36);
								_push(_t147);
								_push( *_t208);
								L38();
								_t224 = _t224 + 0xc;
							} else {
								_t147 =  &_v36;
								_push(_t147);
								_push(0);
								_push(0);
								_push( *_t208);
								L28();
								_t224 = _t224 + 0x10;
							}
							_t200 = _t147;
							__eflags = _t200;
							if(_t200 != 0) {
								break;
							}
							_t208 = _t208 + 4;
							_t160 = 0;
							__eflags =  *_t208;
							if( *_t208 != 0) {
								continue;
							} else {
								_t151 = _v336.cAlternateFileName;
								_t199 = _v36;
								goto L9;
							}
							goto L68;
						}
						L25:
						E00A8777B( &_v36);
						_t91 = _t200;
						goto L26;
					}
				} else {
					_t148 = E00A85628();
					_t219 = 0x16;
					 *_t148 = _t219;
					E00A85507();
					_t91 = _t219;
					L26:
					return _t91;
				}
				L68:
			}

0x00a873d6
0x00a873d9
0x00a873df
0x00a873f7
0x00a873fa
0x00a873fe
0x00a87400
0x00a87402
0x00a87404
0x00a87407
0x00a8740a
0x00a8740d
0x00a8740f
0x00a87467
0x00a87467
0x00a8746d
0x00a8746f
0x00a8747a
0x00a8747e
0x00a87480
0x00a87483
0x00a87487
0x00a87487
0x00a87489
0x00a8748b
0x00a8748d
0x00a8748f
0x00a8748f
0x00a87491
0x00a87494
0x00a87497
0x00a87497
0x00a87499
0x00a8749a
0x00a8749a
0x00a874a5
0x00a874a7
0x00a874aa
0x00a874ab
0x00a874ae
0x00a874ae
0x00a874b2
0x00a874b5
0x00a874b8
0x00a874b8
0x00a874c6
0x00a874c8
0x00a874cb
0x00a874cd
0x00a874d7
0x00a874da
0x00a874dd
0x00a874df
0x00a874e2
0x00a874e4
0x00a87534
0x00a87537
0x00a87537
0x00a87539
0x00000000
0x00a874e6
0x00a874e8
0x00a874e8
0x00a874ea
0x00a874ed
0x00a874ed
0x00a874f2
0x00a874f5
0x00a874f5
0x00a874f7
0x00a874f8
0x00a874f8
0x00a874fc
0x00a874ff
0x00a874ff
0x00a87502
0x00a87505
0x00a87512
0x00a87517
0x00a8751a
0x00a8751c
0x00a87556
0x00a87557
0x00a87558
0x00a87559
0x00a8755a
0x00a8755b
0x00a87560
0x00a87564
0x00a87566
0x00a87567
0x00a8756a
0x00a8756a
0x00a8756d
0x00a8756d
0x00a8756f
0x00a87570
0x00a87570
0x00a87579
0x00a8757a
0x00a8757d
0x00a87580
0x00a87583
0x00a87585
0x00a8758c
0x00a8758e
0x00a87591
0x00a8759b
0x00a8759e
0x00a8759f
0x00a875a1
0x00a875b5
0x00a875b5
0x00a875b8
0x00a875c2
0x00a875c7
0x00a875ca
0x00a875cc
0x00000000
0x00a875ce
0x00a875d2
0x00a875db
0x00a875e1
0x00000000
0x00a875e4
0x00a875a3
0x00a875a3
0x00a875a9
0x00a875ae
0x00a875b1
0x00a875b3
0x00a875ea
0x00a875ec
0x00a875ed
0x00a875ee
0x00a875ef
0x00a875f0
0x00a875f1
0x00a875f6
0x00a875f9
0x00a875fa
0x00a875fc
0x00a87602
0x00a87609
0x00a8760c
0x00a8760f
0x00a87610
0x00a87613
0x00a87614
0x00a87617
0x00a87618
0x00a87639
0x00a87639
0x00a8763b
0x00000000
0x00000000
0x00a87620
0x00a87622
0x00a87624
0x00a87626
0x00a87628
0x00a8762a
0x00a8762c
0x00a87637
0x00000000
0x00a87637
0x00a8762c
0x00a87628
0x00000000
0x00a87624
0x00a8763d
0x00a8763f
0x00a87642
0x00a8765b
0x00a8765b
0x00a8765d
0x00a87660
0x00a87670
0x00a87672
0x00a87672
0x00a87662
0x00a87662
0x00a87665
0x00000000
0x00a87667
0x00a87667
0x00a8766a
0x00000000
0x00a8766c
0x00a8766c
0x00a8766c
0x00a8766a
0x00a87665
0x00a87680
0x00a87684
0x00a87692
0x00a87697
0x00a876ac
0x00a876ae
0x00a876b4
0x00a876b7
0x00a876e9
0x00a876e9
0x00a876ee
0x00a876f4
0x00a876f4
0x00a876fb
0x00a87715
0x00a87715
0x00a87716
0x00a8771c
0x00a87722
0x00a87723
0x00a87724
0x00a87729
0x00a8772c
0x00a8772e
0x00000000
0x00000000
0x00000000
0x00000000
0x00a876fd
0x00a876fd
0x00a87703
0x00a87705
0x00000000
0x00a87707
0x00a87707
0x00a8770a
0x00000000
0x00a8770c
0x00a8770c
0x00a87713
0x00000000
0x00000000
0x00000000
0x00000000
0x00a87713
0x00a8770a
0x00a87705
0x00000000
0x00a87730
0x00a87738
0x00a8773e
0x00a87740
0x00a87740
0x00a87748
0x00a8774d
0x00a87755
0x00a87758
0x00a8775a
0x00a8776e
0x00a87773
0x00a876b9
0x00a876b9
0x00a876ba
0x00a876bb
0x00a876bc
0x00a876bd
0x00a876c5
0x00a876c5
0x00a876c5
0x00a876c7
0x00a876ca
0x00a876cd
0x00a876cd
0x00a87644
0x00a87647
0x00a87649
0x00000000
0x00a8764b
0x00a8764b
0x00a8764e
0x00a8764f
0x00a87650
0x00a87651
0x00a87656
0x00a87649
0x00a876d5
0x00a876da
0x00a876e5
0x00000000
0x00000000
0x00000000
0x00a875b3
0x00a87587
0x00a87589
0x00a875e5
0x00a875e9
0x00a875e9
0x00000000
0x00000000
0x00000000
0x00000000
0x00a8751e
0x00a87521
0x00a87524
0x00a87527
0x00a8752a
0x00a8752d
0x00a87530
0x00a87530
0x00000000
0x00a874ed
0x00a874cf
0x00a874cf
0x00a8753b
0x00a8753d
0x00000000
0x00a87542
0x00a87411
0x00a87411
0x00a87414
0x00a8741d
0x00a87420
0x00a87427
0x00a87429
0x00a87442
0x00a87443
0x00a87444
0x00a87446
0x00a8744b
0x00a8742b
0x00a8742b
0x00a8742e
0x00a8742f
0x00a87431
0x00a87433
0x00a87435
0x00a8743a
0x00a8743a
0x00a8744e
0x00a87450
0x00a87452
0x00000000
0x00000000
0x00a87458
0x00a8745b
0x00a8745d
0x00a8745f
0x00000000
0x00a87461
0x00a87461
0x00a87464
0x00000000
0x00a87464
0x00000000
0x00a8745f
0x00a87543
0x00a87546
0x00a8754b
0x00000000
0x00a8754e
0x00a873e1
0x00a873e1
0x00a873e8
0x00a873e9
0x00a873eb
0x00a873f0
0x00a8754f
0x00a87553
0x00a87553
0x00000000

APIs

_free.LIBCMT ref: 00A8753D

Part of subcall function 00A85517: IsProcessorFeaturePresent.KERNEL32(00000017,00A85506,0000002C,00A971B0,00A884F6,00000000,00000000,00A85B8B,?,?,00A85513,00000000,00000000,00000000,00000000,00000000), ref: 00A85519
Part of subcall function 00A85517: GetCurrentProcess.KERNEL32(C0000417,00A971B0,0000002C,00A85244,00000016,00A85B8B), ref: 00A8553B
Part of subcall function 00A85517: TerminateProcess.KERNEL32(00000000), ref: 00A85542

Strings

*?, xrefs: 00A87414
., xrefs: 00A876F4

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free
String ID: *?$.
API String ID: 2667617558-3972193922
Opcode ID: 2cf5293e20c824f35ddade2f3844911b540e256f72695f347b493e225ac5cbdd
Instruction ID: c16185b7f929e36ac4b733a29b193819e089ffb969e680ba732a2aed7e5b20b4
Opcode Fuzzy Hash: 2cf5293e20c824f35ddade2f3844911b540e256f72695f347b493e225ac5cbdd
Instruction Fuzzy Hash: 2E51BF71E04219AFDF14EFA8C881AADBBB5EF58314F248169E954E7310E635DE018B50

Uniqueness

Uniqueness Score: -1.00%

Function 00A6A36A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00A6A36A(char _a4, char _a4088, char _a4100, intOrPtr _a8200, intOrPtr _a8204, unsigned int _a8208) {
				signed int _v0;
				intOrPtr _v4;
				short _t29;
				void* _t30;
				signed int _t31;
				short _t40;
				short _t42;
				short _t47;
				short _t48;
				signed int _t53;
				intOrPtr _t55;
				void* _t56;
				unsigned int _t58;
				signed int _t62;
				signed int _t65;
				intOrPtr _t68;

				E00A7C240();
				_t58 = _a8208;
				_t55 = _a8200;
				_t68 = _a8204;
				_t65 = _t58 & 0x0000ffff;
				_v0 = _t58 >> 0x0000001f & 0x00000001;
				_t62 = _v0;
				if(_t65 == 0) {
					L25:
					_v4 = E00A6B1D0(__eflags, _t55);
					_t56 = E00A6B1D0(__eflags, _t68);
					_t29 = E00A70101(__eflags, L"__rar_", _t56, 6);
					__eflags = _t29;
					if(_t29 == 0) {
						goto L9;
					} else {
						_push(_t62);
						_push(_t56);
						_push(_v0);
						__eflags = _t65 - 2;
						if(_t65 != 2) {
							goto L17;
						} else {
							_t31 = E00A6A628();
							asm("sbb eax, eax");
							_t30 =  ~_t31 + 1;
						}
					}
				} else {
					_v0 = E00A816B5(_t55);
					if(_t65 == 2 || _t65 == 3 || E00A6A649(_t55, _t68, _t33, _t62) != 0) {
						L8:
						__eflags = _t65 - 1;
						if(_t65 != 1) {
							E00A6AA6B(_t55,  &_a4, 0x800);
							E00A6AA6B(_t68,  &_a4088, 0x800);
							__eflags = _t65 - 2;
							if(_t65 == 2) {
								L12:
								_t40 = E00A6A628( &_a4,  &_a4100, _t62);
								__eflags = _t40;
								if(_t40 != 0) {
									goto L9;
								} else {
									goto L13;
								}
							} else {
								__eflags = _t65 - 3;
								if(_t65 != 3) {
									L13:
									__eflags = _t65 - 4;
									if(_t65 == 4) {
										L15:
										_t42 = E00A6AEEC( &_a4);
										__eflags = _t42;
										if(_t42 == 0) {
											__eflags = _t65 - 4;
											if(_t65 == 4) {
												L22:
												__eflags = _a4;
												if(__eflags == 0) {
													goto L25;
												} else {
													_t47 = E00A6A649( &_a4,  &_a4100, E00A816B5( &_a4), _t62);
													goto L24;
												}
											} else {
												_t48 = E00A6AEEC(_t55);
												__eflags = _t48;
												if(_t48 != 0) {
													goto L22;
												} else {
													_t47 = E00A6A628( &_a4,  &_a4100, _t62);
													L24:
													__eflags = _t47;
													if(__eflags != 0) {
														goto L9;
													} else {
														goto L25;
													}
												}
											}
										} else {
											_push(_t62);
											_push(_t68);
											_push(_t55);
											L17:
											_t30 = E00A6A4F7();
										}
									} else {
										__eflags = _t65 - 5;
										if(__eflags != 0) {
											goto L25;
										} else {
											goto L15;
										}
									}
								} else {
									goto L12;
								}
							}
						} else {
							L9:
							_t30 = 0;
						}
					} else {
						_t53 =  *(_t68 + _v0 * 2) & 0x0000ffff;
						if(_t53 == 0x5c || _t53 == 0x2f || _t53 == 0) {
							_t30 = 1;
						} else {
							goto L8;
						}
					}
				}
				return _t30;
			}

0x00a6a36f
0x00a6a374
0x00a6a37e
0x00a6a386
0x00a6a393
0x00a6a396
0x00a6a39b
0x00a6a3a1
0x00a6a4b2
0x00a6a4b9
0x00a6a4c4
0x00a6a4cc
0x00a6a4d1
0x00a6a4d3
0x00000000
0x00a6a4d9
0x00a6a4d9
0x00a6a4da
0x00a6a4db
0x00a6a4df
0x00a6a4e2
0x00000000
0x00a6a4e8
0x00a6a4e8
0x00a6a4ef
0x00a6a4f1
0x00a6a4f1
0x00a6a4e2
0x00a6a3a7
0x00a6a3ad
0x00a6a3b5
0x00a6a3e5
0x00a6a3e5
0x00a6a3e8
0x00a6a3f9
0x00a6a40c
0x00a6a411
0x00a6a414
0x00a6a41b
0x00a6a429
0x00a6a42e
0x00a6a430
0x00000000
0x00000000
0x00000000
0x00000000
0x00a6a416
0x00a6a416
0x00a6a419
0x00a6a432
0x00a6a432
0x00a6a435
0x00a6a43c
0x00a6a441
0x00a6a446
0x00a6a448
0x00a6a45f
0x00a6a462
0x00a6a483
0x00a6a483
0x00a6a489
0x00000000
0x00a6a48b
0x00a6a4a5
0x00000000
0x00a6a4a5
0x00a6a464
0x00a6a465
0x00a6a46a
0x00a6a46c
0x00000000
0x00a6a46e
0x00a6a47c
0x00a6a4aa
0x00a6a4aa
0x00a6a4ac
0x00000000
0x00000000
0x00000000
0x00000000
0x00a6a4ac
0x00a6a46c
0x00a6a44a
0x00a6a44a
0x00a6a44b
0x00a6a44c
0x00a6a44d
0x00a6a44d
0x00a6a44d
0x00a6a437
0x00a6a437
0x00a6a43a
0x00000000
0x00000000
0x00000000
0x00000000
0x00a6a43a
0x00000000
0x00000000
0x00000000
0x00a6a419
0x00a6a3ea
0x00a6a3ea
0x00a6a3ea
0x00a6a3ea
0x00a6a3c9
0x00a6a3cd
0x00a6a3d5
0x00a6a3e1
0x00000000
0x00000000
0x00000000
0x00a6a3d5
0x00a6a3b5
0x00a6a45c

APIs

_wcslen.LIBCMT ref: 00A6A3A8
_wcslen.LIBCMT ref: 00A6A491

Strings

__rar_, xrefs: 00A6A4C7

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: _wcslen
String ID: __rar_
API String ID: 176396367-2561138058
Opcode ID: 9541d3e0129499ecd4516db9f7d08fe0f0c018cb921d1dcc942fd5204dc5bddf
Instruction ID: f56b7710894ef90e5f7e11b81ff3d7cf9d776df695c87e181129a1d552706de2
Opcode Fuzzy Hash: 9541d3e0129499ecd4516db9f7d08fe0f0c018cb921d1dcc942fd5204dc5bddf
Instruction Fuzzy Hash: 9E4182765043056AD630AB648D8DDABB3BCABB1704F00482BF996F7142DA64DD858EB3

Uniqueness

Uniqueness Score: -1.00%

Function 00A670EC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 126
timeCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00A670EC(void* __edx) {
				void* __esi;
				void* _t39;
				signed int _t48;
				signed int _t51;
				void* _t55;
				signed int _t56;
				signed int _t62;
				signed int _t71;
				signed int _t74;
				void* _t89;
				intOrPtr* _t95;
				void* _t97;

				_t89 = __edx;
				E00A7C16C(E00A8ECBD, _t97);
				E00A7C240();
				_t95 =  *((intOrPtr*)(_t97 + 0xc));
				if( *_t95 == 0 ||  *((intOrPtr*)(_t95 + 2)) != 0) {
					_push(0x802);
					_t39 = _t97 - 0x1010;
				} else {
					E00A81693(_t97 - 0x1010, 0xa8f410);
					_push(0x800);
					_t39 = _t97 - 0x100c;
				}
				_push(_t95);
				_push(_t39);
				E00A6E847();
				_t92 =  *((intOrPtr*)(_t97 + 8));
				E00A672C1(_t95,  *((intOrPtr*)(_t97 + 8)), _t97 - 0x407c, 0x800);
				if( *((short*)(_t97 - 0x407c)) == 0x3a) {
					__eflags =  *(_t97 + 0x10);
					if(__eflags == 0) {
						E00A6E81B(__eflags, _t97 - 0x1010, _t97 - 0x407c, 0x802);
						E00A66BA0(_t97 - 0x307c);
						_push(0);
						_t48 = E00A69B66(_t97 - 0x307c, _t89, _t95, _t97 - 0x307c);
						_t74 =  *(_t97 - 0x2074);
						_t71 = _t48;
						__eflags = _t74 & 0x00000001;
						if((_t74 & 0x00000001) != 0) {
							__eflags = _t74 & 0xfffffffe;
							E00A69AE4(_t95, _t74 & 0xfffffffe);
						}
						E00A68E1D(_t97 - 0x2034);
						 *(_t97 - 4) =  *(_t97 - 4) & 0x00000000;
						_t51 = E00A69598(_t97 - 0x2034, __eflags, _t97 - 0x1010, 0x11);
						__eflags = _t51;
						if(_t51 != 0) {
							_push(_t97 - 0x2034);
							_push(0);
							_t62 = E00A63878(_t92, _t89);
							__eflags = _t62;
							if(_t62 != 0) {
								E00A68EBF(_t97 - 0x2034);
							}
						}
						E00A68E1D(_t97 - 0x50a0);
						 *(_t97 - 4) = 1;
						__eflags = _t71;
						if(_t71 != 0) {
							_t56 = E00A6915C(_t97 - 0x50a0, _t95, _t95, 5);
							__eflags = _t56;
							if(_t56 != 0) {
								SetFileTime( *(_t97 - 0x509c), _t97 - 0x2054, _t97 - 0x204c, _t97 - 0x2044);
							}
						}
						E00A69AE4(_t95,  *(_t97 - 0x2074));
						E00A68E53(_t97 - 0x50a0);
						_t55 = E00A68E53(_t97 - 0x2034);
					} else {
						_push(0);
						_push(0);
						_t55 = E00A63878(_t92, _t89);
					}
				} else {
					E00A61F25(0x50, _t92 + 0x1e, _t95);
					_t55 = E00A66ACC(0xa9bbf8, 3);
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t97 - 0xc));
				return _t55;
			}

0x00a670ec
0x00a670f1
0x00a670fb
0x00a67102
0x00a67110
0x00a67134
0x00a67139
0x00a67118
0x00a67124
0x00a6712b
0x00a6712c
0x00a6712c
0x00a6713f
0x00a67140
0x00a67141
0x00a67147
0x00a67152
0x00a6715f
0x00a6717e
0x00a67181
0x00a671a4
0x00a671af
0x00a671b4
0x00a671bd
0x00a671c2
0x00a671c8
0x00a671ca
0x00a671cd
0x00a671cf
0x00a671d4
0x00a671d4
0x00a671df
0x00a671e4
0x00a671f7
0x00a671fc
0x00a671fe
0x00a67208
0x00a67209
0x00a6720b
0x00a67210
0x00a67212
0x00a6721a
0x00a6721a
0x00a67212
0x00a67225
0x00a6722a
0x00a6722e
0x00a67230
0x00a6723b
0x00a67240
0x00a67242
0x00a6725f
0x00a6725f
0x00a67242
0x00a6726c
0x00a67277
0x00a67282
0x00a67183
0x00a67183
0x00a67184
0x00a67187
0x00a67187
0x00a67161
0x00a67168
0x00a67174
0x00a67174
0x00a6728d
0x00a67297

APIs

__EH_prolog.LIBCMT ref: 00A670F1

Part of subcall function 00A6E81B: _wcslen.LIBCMT ref: 00A6E821

SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00A6725F

Part of subcall function 00A69AE4: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00A6991A,?,?,?,00A697B3,?,00000001,00000000,?,?), ref: 00A69AF8
Part of subcall function 00A69AE4: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00A6991A,?,?,?,00A697B3,?,00000001,00000000,?,?), ref: 00A69B29

Strings

:, xrefs: 00A67157

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: File$Attributes$H_prologTime_wcslen
String ID: :
API String ID: 3922717191-336475711
Opcode ID: 7770da813a5574ae2c469528de1cca3c0a680bd86e1c3ea0675ad07f7247dcc9
Instruction ID: 7efeee0d376a23a3f4fcf33b3aa3e8e8d3d20c25126fd09beda3a4cec5e7d214
Opcode Fuzzy Hash: 7770da813a5574ae2c469528de1cca3c0a680bd86e1c3ea0675ad07f7247dcc9
Instruction Fuzzy Hash: 5B41E571905118AADB24EBA0CE56EEE737CEF05304F0441DAB645A3182EB756F88CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00A66F8B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00A66F8B(void* __ebx, void* __edx, void* __edi, void* __esi) {
				void* _t23;
				void* _t32;
				intOrPtr _t33;
				void* _t40;
				void* _t44;
				void* _t45;
				void* _t48;

				_t44 = __esi;
				_t40 = __edx;
				_t32 = __ebx;
				E00A7C16C(E00A8EC9D, _t48);
				E00A7C240();
				 *((intOrPtr*)(_t48 - 0x1c)) = 0;
				 *((intOrPtr*)(_t48 - 0x18)) = 0;
				 *((intOrPtr*)(_t48 - 0x14)) = 0;
				 *((intOrPtr*)(_t48 - 0x10)) = 0;
				_t42 =  *((intOrPtr*)(_t48 + 8));
				_push(0);
				 *((intOrPtr*)(_t48 - 4)) = 0;
				_push(_t48 - 0x1c);
				_t23 = E00A63878( *((intOrPtr*)(_t48 + 8)), _t40);
				if(_t23 != 0) {
					if( *0xa9bbd9 == 0) {
						if(E00A674D7(L"SeSecurityPrivilege") != 0) {
							 *0xa9bbd8 = 1;
						}
						E00A674D7(L"SeRestorePrivilege");
						 *0xa9bbd9 = 1;
					}
					_push(_t44);
					_t45 = 7;
					if( *0xa9bbd8 != 0) {
						_t45 = 0xf;
					}
					_t33 =  *((intOrPtr*)(_t48 - 0x1c));
					_t23 =  *0xa99a2c( *((intOrPtr*)(_t48 + 0xc)), _t45, _t33, _t32);
					if(_t23 == 0) {
						if(E00A6AC19(_t40,  *((intOrPtr*)(_t48 + 0xc)), _t48 - 0x101c, 0x800) == 0) {
							L10:
							E00A80F99(E00A61F25(0x4f, _t42 + 0x1e,  *((intOrPtr*)(_t48 + 0xc))));
							_t23 = E00A66ACC(0xa9bbf8, 1);
						} else {
							_t23 =  *0xa99a2c(_t48 - 0x101c, _t45, _t33);
							if(_t23 == 0) {
								goto L10;
							}
						}
					}
				}
				if( *((intOrPtr*)(_t48 - 0x1c)) != 0) {
					_t23 = L00A816D0( *((intOrPtr*)(_t48 - 0x1c)));
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t48 - 0xc));
				return _t23;
			}

0x00a66f8b
0x00a66f8b
0x00a66f8b
0x00a66f90
0x00a66f9a
0x00a66fa2
0x00a66fa5
0x00a66fa8
0x00a66fab
0x00a66fae
0x00a66fb3
0x00a66fb4
0x00a66fba
0x00a66fbb
0x00a66fc2
0x00a66fcf
0x00a66fdd
0x00a66fdf
0x00a66fdf
0x00a66feb
0x00a66ff0
0x00a66ff0
0x00a66ffe
0x00a67001
0x00a67002
0x00a67006
0x00a67006
0x00a67008
0x00a67010
0x00a67018
0x00a67030
0x00a67045
0x00a6705a
0x00a67063
0x00a67032
0x00a6703b
0x00a67043
0x00000000
0x00000000
0x00a67043
0x00a67030
0x00a67069
0x00a6706f
0x00a67074
0x00a67079
0x00a6707d
0x00a67087

APIs

__EH_prolog.LIBCMT ref: 00A66F90

Part of subcall function 00A63878: __EH_prolog.LIBCMT ref: 00A6387D

Part of subcall function 00A674D7: GetCurrentProcess.KERNEL32(00000020,?), ref: 00A674E6
Part of subcall function 00A674D7: GetLastError.KERNEL32 ref: 00A6752C
Part of subcall function 00A674D7: CloseHandle.KERNEL32(?), ref: 00A6753B

Strings

SeSecurityPrivilege, xrefs: 00A66FD1
SeRestorePrivilege, xrefs: 00A66FE6

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: H_prolog$CloseCurrentErrorHandleLastProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 2432491591-639343689
Opcode ID: cb2fd57a1ed4d47a27922fdd2de617e04d9865cf3fbf972c45a92bc65e0fb511
Instruction ID: d104788a86679b8caaac6e043707d80902cc102cea2bb8823de78a458010c2b3
Opcode Fuzzy Hash: cb2fd57a1ed4d47a27922fdd2de617e04d9865cf3fbf972c45a92bc65e0fb511
Instruction Fuzzy Hash: 6121F971A04205BFDF21EFA4ED05FEE7FB9EB04718F104066F444A6281DB794945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A8C062 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A8C062(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, signed int _a8, signed short* _a12, intOrPtr _a16) {
				signed int _v8;
				char _v10;
				void _v5128;
				intOrPtr _v5132;
				long _v5136;
				void* _v5140;
				signed int _t29;
				intOrPtr _t35;
				long _t43;
				signed int _t44;
				signed short* _t47;
				void* _t52;
				signed int _t56;
				signed int* _t58;
				long _t60;
				intOrPtr* _t63;
				signed int _t65;

				E00A7C240();
				_t29 =  *0xa991b8; // 0x3197ea2d
				_v8 = _t29 ^ _t65;
				_t49 = _a8;
				_t47 = _a12;
				_t63 = _a4;
				_t52 =  *( *((intOrPtr*)(0xab8428 + (_a8 >> 6) * 4)) + 0x18 + (_t49 & 0x0000003f) * 0x30);
				_t35 = _a16 + _t47;
				_v5140 = _t52;
				_v5132 = _t35;
				 *_t63 = 0;
				 *((intOrPtr*)(_t63 + 4)) = 0;
				 *((intOrPtr*)(_t63 + 8)) = 0;
				while(_t47 < _t35) {
					_t58 =  &_v5128;
					while(_t47 < _t35) {
						_t44 =  *_t47 & 0x0000ffff;
						_t47 =  &(_t47[1]);
						if(_t44 == 0xa) {
							 *((intOrPtr*)(_t63 + 8)) =  *((intOrPtr*)(_t63 + 8)) + 2;
							_t56 = 0xd;
							 *_t58 = _t56;
							_t58 =  &(_t58[0]);
						}
						 *_t58 = _t44;
						_t58 =  &(_t58[0]);
						_t35 = _v5132;
						if(_t58 <  &_v10) {
							continue;
						}
						break;
					}
					_t60 = _t58 -  &_v5128 & 0xfffffffe;
					if(WriteFile(_t52,  &_v5128, _t60,  &_v5136, 0) == 0) {
						 *_t63 = GetLastError();
					} else {
						_t43 = _v5136;
						 *((intOrPtr*)(_t63 + 4)) =  *((intOrPtr*)(_t63 + 4)) + _t43;
						if(_t43 >= _t60) {
							_t35 = _v5132;
							_t52 = _v5140;
							continue;
						}
					}
					L12:
					return E00A7CABF(_v8 ^ _t65);
				}
				goto L12;
			}

0x00a8c06c
0x00a8c071
0x00a8c078
0x00a8c07b
0x00a8c08a
0x00a8c095
0x00a8c099
0x00a8c0a0
0x00a8c0a2
0x00a8c0aa
0x00a8c0b0
0x00a8c0b2
0x00a8c0b5
0x00a8c12f
0x00a8c0ba
0x00a8c0c0
0x00a8c0c4
0x00a8c0c7
0x00a8c0cd
0x00a8c0cf
0x00a8c0d5
0x00a8c0d6
0x00a8c0d9
0x00a8c0d9
0x00a8c0dc
0x00a8c0e2
0x00a8c0e7
0x00a8c0ed
0x00000000
0x00000000
0x00000000
0x00a8c0ed
0x00a8c100
0x00a8c114
0x00a8c13b
0x00a8c116
0x00a8c116
0x00a8c11c
0x00a8c121
0x00a8c123
0x00a8c129
0x00000000
0x00a8c129
0x00a8c121
0x00a8c13d
0x00a8c14f
0x00a8c14f
0x00000000

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000000,?,?,00A8C49F,00000000,00000000,00000000,00000000,00000000,00A8223E), ref: 00A8C10C
GetLastError.KERNEL32(?,00A8C49F,00000000,00000000,00000000,00000000,00000000,00A8223E,00000000,00A8223E,00A972B8,00000010,00A8AEC7,010E9AE8,00A97230,00000010), ref: 00A8C135

Strings

@Mqt0Lqt, xrefs: 00A8C135

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: @Mqt0Lqt
API String ID: 442123175-1302913217
Opcode ID: 4af81192407e6874c44dc2fab00ca233b0c1b3d8fdd8ed06eba3642fb538cb42
Instruction ID: 142f45ebd83af73daa815ee7362e824e71cfa3fbacb28651f16d1c4da6fae955
Opcode Fuzzy Hash: 4af81192407e6874c44dc2fab00ca233b0c1b3d8fdd8ed06eba3642fb538cb42
Instruction Fuzzy Hash: FE318F71A00219DFCB24DF5ACC809DAB3F5FF48360F2085AAE509D7251E630AD81CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00A78D29 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00A78D29(void* __ecx, void* __edx, void* __eflags, char _a3, char _a4, intOrPtr* _a8200) {
				char _v20;
				char _v21;
				void* __ebp;
				intOrPtr _t19;
				short* _t30;
				intOrPtr* _t33;
				signed int _t43;
				intOrPtr* _t46;
				void* _t51;

				E00A7C240();
				_push(0x80000);
				_t46 = E00A82C59(__ecx);
				if(_t46 == 0) {
					E00A66A1C(0xa9bbf8);
				}
				_t33 = _a8200;
				 *_t46 = 0;
				_t43 = 0;
				while(1) {
					_push(0x1000);
					_push( &_a3);
					_push(0);
					_push(0);
					_push( &_a4);
					_push( *_t33);
					_t19 = E00A78BD1();
					 *_t33 = _t19;
					if(_t19 == 0) {
						break;
					}
					if( *_t46 != 0 || _v20 != 0x7b) {
						if(_v20 == 0x7d || E00A816B5( &_v20) + _t43 > 0x3fffb) {
							break;
						} else {
							E00A82C19(_t46,  &_v20);
							_t43 = E00A816B5(_t46);
							_t51 = _t51 + 0xc;
							if(_t43 == 0) {
								L11:
								if(_v21 == 0) {
									E00A81693(_t46 + _t43 * 2, L"\r\n");
								}
								continue;
							}
							_t6 = _t43 - 1; // -1
							_t30 = _t46 + _t6 * 2;
							while( *_t30 == 0x20) {
								_t30 = _t30 - 2;
								_t43 = _t43 - 1;
								if(_t43 != 0) {
									continue;
								}
								goto L11;
							}
							goto L11;
						}
					} else {
						continue;
					}
				}
				return _t46;
			}

0x00a78d2e
0x00a78d37
0x00a78d41
0x00a78d46
0x00a78d4d
0x00a78d4d
0x00a78d52
0x00a78d5d
0x00a78d60
0x00a78dd2
0x00a78dd2
0x00a78ddb
0x00a78ddc
0x00a78ddd
0x00a78de2
0x00a78de3
0x00a78de5
0x00a78dea
0x00a78dee
0x00000000
0x00000000
0x00a78d67
0x00a78d77
0x00000000
0x00a78d8d
0x00a78d93
0x00a78d9e
0x00a78da0
0x00a78da5
0x00a78dbb
0x00a78dc0
0x00a78dcb
0x00a78dd1
0x00000000
0x00a78dc0
0x00a78da7
0x00a78daa
0x00a78dad
0x00a78db3
0x00a78db6
0x00a78db9
0x00000000
0x00000000
0x00000000
0x00a78db9
0x00000000
0x00a78dad
0x00000000
0x00000000
0x00000000
0x00a78d67
0x00a78e00

APIs

_wcslen.LIBCMT ref: 00A78D7E
_wcslen.LIBCMT ref: 00A78D99

Strings

}, xrefs: 00A78D71

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: _wcslen
String ID: }
API String ID: 176396367-4239843852
Opcode ID: cbd7976e297e430ca5c1cb9e0defb0324bb29360f2e4e338b4b53e6103af1593
Instruction ID: e1466259d7fd0eb9a750629e46657538d1174cfad1e0e687ffe5a4e3172b0100
Opcode Fuzzy Hash: cbd7976e297e430ca5c1cb9e0defb0324bb29360f2e4e338b4b53e6103af1593
Instruction Fuzzy Hash: AC21D1325403165AD730AB64DE49BABB3ECDF90750F04842AF588C2082FE69ED4883A6

Uniqueness

Uniqueness Score: -1.00%

Function 00A8BF83 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A8BF83(void* __ebx, void* __edi, void* __esi, signed int* _a4, signed int _a8, intOrPtr* _a12, intOrPtr _a16) {
				signed int _v8;
				char _v9;
				void _v5128;
				intOrPtr _v5132;
				long _v5136;
				void* _v5140;
				signed int _t31;
				intOrPtr _t37;
				long _t45;
				char _t46;
				intOrPtr* _t49;
				void* _t54;
				char* _t58;
				long _t59;
				signed int* _t62;
				signed int _t64;

				E00A7C240();
				_t31 =  *0xa991b8; // 0x3197ea2d
				_v8 = _t31 ^ _t64;
				_t51 = _a8;
				_t49 = _a12;
				_t62 = _a4;
				_t54 =  *( *((intOrPtr*)(0xab8428 + (_a8 >> 6) * 4)) + 0x18 + (_t51 & 0x0000003f) * 0x30);
				 *_t62 =  *_t62 & 0x00000000;
				_t37 = _a16 + _t49;
				_t62[1] = _t62[1] & 0x00000000;
				_t62[2] = _t62[2] & 0x00000000;
				_v5140 = _t54;
				_v5132 = _t37;
				while(_t49 < _t37) {
					_t58 =  &_v5128;
					while(_t49 < _t37) {
						_t46 =  *_t49;
						_t49 = _t49 + 1;
						if(_t46 == 0xa) {
							_t62[2] = _t62[2] + 1;
							 *_t58 = 0xd;
							_t58 = _t58 + 1;
						}
						 *_t58 = _t46;
						_t58 = _t58 + 1;
						_t37 = _v5132;
						if(_t58 <  &_v9) {
							continue;
						}
						break;
					}
					_t59 = _t58 -  &_v5128;
					if(WriteFile(_t54,  &_v5128, _t59,  &_v5136, 0) == 0) {
						 *_t62 = GetLastError();
					} else {
						_t45 = _v5136;
						_t62[1] = _t62[1] + _t45;
						if(_t45 >= _t59) {
							_t37 = _v5132;
							_t54 = _v5140;
							continue;
						}
					}
					L12:
					return E00A7CABF(_v8 ^ _t64);
				}
				goto L12;
			}

0x00a8bf8d
0x00a8bf92
0x00a8bf99
0x00a8bf9c
0x00a8bfab
0x00a8bfb6
0x00a8bfba
0x00a8bfc1
0x00a8bfc4
0x00a8bfc6
0x00a8bfca
0x00a8bfce
0x00a8bfd4
0x00a8c041
0x00a8bfdc
0x00a8bfe2
0x00a8bfe6
0x00a8bfe8
0x00a8bfeb
0x00a8bfed
0x00a8bff0
0x00a8bff3
0x00a8bff3
0x00a8bff4
0x00a8bff9
0x00a8bffc
0x00a8c002
0x00000000
0x00000000
0x00000000
0x00a8c002
0x00a8c00a
0x00a8c026
0x00a8c04d
0x00a8c028
0x00a8c028
0x00a8c02e
0x00a8c033
0x00a8c035
0x00a8c03b
0x00000000
0x00a8c03b
0x00a8c033
0x00a8c04f
0x00a8c061
0x00a8c061
0x00000000

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000000,?,?,00A8C4BF,00000000,00000000,00000000,00000000,00000000,00A8223E), ref: 00A8C01E
GetLastError.KERNEL32(?,00A8C4BF,00000000,00000000,00000000,00000000,00000000,00A8223E,00000000,00A8223E,00A972B8,00000010,00A8AEC7,010E9AE8,00A97230,00000010), ref: 00A8C047

Strings

@Mqt0Lqt, xrefs: 00A8C047

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: @Mqt0Lqt
API String ID: 442123175-1302913217
Opcode ID: 96a709ea7091f1620d95f35393f9093120096764ab7404c59a2c2c8f9ec6786e
Instruction ID: 8a0df3a576e572624d608470e7d28f0b5cefc34645181fa754413736674eefe1
Opcode Fuzzy Hash: 96a709ea7091f1620d95f35393f9093120096764ab7404c59a2c2c8f9ec6786e
Instruction Fuzzy Hash: C0217E75A00219DFCB14DF59CC80AEAB3F9FB48355F1044AAE54AD7251D730AE85CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00A77735 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00A77735(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4) {
				void* __esi;
				void* __ebp;
				intOrPtr _t17;
				char _t18;
				intOrPtr* _t22;
				void* _t23;
				void* _t25;
				intOrPtr* _t27;
				signed int _t36;
				signed int _t42;
				void* _t43;
				intOrPtr _t44;
				signed int* _t48;

				_t44 = _a4;
				_t43 = __ecx;
				 *((intOrPtr*)(__ecx + 4)) = _t44;
				_t17 = E00A7C12B(__edx, _t44, __eflags, 0x30);
				_a4 = _t17;
				if(_t17 == 0) {
					_t18 = 0;
					__eflags = 0;
				} else {
					_t18 = E00A771D9(_t17);
				}
				 *((intOrPtr*)(_t43 + 0xc)) = _t18;
				if(_t18 == 0) {
					return _t18;
				} else {
					 *((intOrPtr*)(_t18 + 0x18)) = _t44;
					E00A77E33( *((intOrPtr*)(_t43 + 0xc)), L"Shell.Explorer");
					E00A77FCC( *((intOrPtr*)(_t43 + 0xc)), 1);
					E00A77F82( *((intOrPtr*)(_t43 + 0xc)), 1);
					_t22 = E00A77EE7( *((intOrPtr*)(_t43 + 0xc)));
					_t27 = _t22;
					if(_t27 == 0) {
						L7:
						_t36 =  *(_t43 + 0x10);
						__eflags = _t36;
						if(_t36 != 0) {
							_t42 =  *(_t43 + 0x18);
							 *((char*)(_t43 + 0x1d)) = 0;
							_t23 =  *_t36;
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							__eflags = _t42;
							if(_t42 == 0) {
								 *((intOrPtr*)(_t23 + 0x2c))(_t36, L"about:blank");
								_t22 = E00A77EBA(_t43);
							} else {
								_t22 =  *((intOrPtr*)(_t23 + 0x2c))(_t36, _t42);
							}
						}
						L11:
						return _t22;
					}
					_t10 = _t43 + 0x10; // 0x10
					_t48 = _t10;
					_t25 =  *((intOrPtr*)( *_t27))(_t27, 0xa907dc, _t48);
					_t22 =  *((intOrPtr*)( *_t27 + 8))(_t27);
					if(_t25 >= 0) {
						goto L7;
					}
					 *_t48 =  *_t48 & 0x00000000;
					goto L11;
				}
			}

0x00a77736
0x00a7773b
0x00a7773f
0x00a77742
0x00a77747
0x00a7774e
0x00a77759
0x00a77759
0x00a77750
0x00a77752
0x00a77752
0x00a7775b
0x00a77760
0x00a777ee
0x00a77766
0x00a77768
0x00a77773
0x00a7777d
0x00a77787
0x00a7778f
0x00a77794
0x00a77798
0x00a777ba
0x00a777ba
0x00a777bd
0x00a777bf
0x00a777c1
0x00a777c6
0x00a777c9
0x00a777cb
0x00a777cc
0x00a777cd
0x00a777ce
0x00a777cf
0x00a777d1
0x00a777e0
0x00a777e5
0x00a777d3
0x00a777d5
0x00a777d5
0x00a777d1
0x00a777ea
0x00000000
0x00a777eb
0x00a7779c
0x00a7779c
0x00a777a6
0x00a777ad
0x00a777b2
0x00000000
0x00000000
0x00a777b4
0x00000000
0x00a777b4

APIs

new.LIBCMT ref: 00A77742

Strings

Shell.Explorer, xrefs: 00A7776E
about:blank, xrefs: 00A777DA

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID:
String ID: Shell.Explorer$about:blank
API String ID: 0-874089819
Opcode ID: a52e5a9618e2526821509d1fd2c35a4221c09bbc1d16be0b00f13c96be0e7ba3
Instruction ID: 294ff812f8f6c1efc6ed37e16739bdf245fc0006ccbccb7995a96a2089fef5ca
Opcode Fuzzy Hash: a52e5a9618e2526821509d1fd2c35a4221c09bbc1d16be0b00f13c96be0e7ba3
Instruction Fuzzy Hash: C4216F75308716AFD708AB74CCA0E3EB7A9BF44710B05C669F50A8B651DBB1EC01CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A6DB10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E00A6DB10(void* __ebx, void* __edi, intOrPtr _a4, signed int _a8, char _a12, intOrPtr _a16) {
				void* __esi;
				void* __ebp;
				signed int _t14;
				signed char _t15;
				void* _t19;
				signed char _t20;
				void* _t22;
				intOrPtr* _t23;
				void* _t31;
				void* _t32;
				void* _t33;
				intOrPtr _t34;
				signed int _t37;

				_t33 = __edi;
				_t19 = __ebx;
				_t23 =  *0xaa0e48; // 0x0
				if(_t23 == 0) {
					E00A6DA91(0xaa0e40);
					_t23 =  *0xaa0e48; // 0x0
				}
				_t37 = _a8;
				_t31 = _t37 - (_t37 & 0x0000000f);
				_t14 = 0 | _a16 != 0x00000000;
				if(_a12 == 0) {
					_t23 =  *0xaa0e4c; // 0x0
					if(_t23 == 0) {
						goto L10;
					} else {
						_t15 =  *_t23(_a4, _t31, _t14);
						if(_t15 == 0) {
							_push(L"CryptUnprotectMemory failed");
							goto L6;
						}
					}
				} else {
					if(_t23 == 0) {
						L10:
						_push(_t19);
						_t15 = GetCurrentProcessId();
						_t32 = 0;
						_t20 = _t15;
						if(_t37 != 0) {
							_push(_t33);
							_t34 = _a4;
							_t22 = _t20 + 0x4b;
							do {
								_t15 = _t32 + _t22;
								 *(_t32 + _t34) =  *(_t32 + _t34) ^ _t15;
								_t32 = _t32 + 1;
							} while (_t32 < _t37);
						}
					} else {
						_t15 =  *_t23(_a4, _t31, _t14);
						if(_t15 == 0) {
							_push(L"CryptProtectMemory failed");
							L6:
							_push(0xa9bbf8);
							_t15 = E00A669DF(E00A80F99(E00A669E4(_t23)), 0xa9bbf8, 0xa9bbf8, 2);
						}
					}
				}
				return _t15;
			}

0x00a6db10
0x00a6db10
0x00a6db13
0x00a6db1b
0x00a6db22
0x00a6db27
0x00a6db27
0x00a6db2e
0x00a6db38
0x00a6db3f
0x00a6db46
0x00a6db7b
0x00a6db83
0x00000000
0x00a6db85
0x00a6db8a
0x00a6db8e
0x00a6db90
0x00000000
0x00a6db90
0x00a6db8e
0x00a6db48
0x00a6db4a
0x00a6db97
0x00a6db97
0x00a6db98
0x00a6db9e
0x00a6dba0
0x00a6dba4
0x00a6dba6
0x00a6dba7
0x00a6dbaa
0x00a6dbad
0x00a6dbb0
0x00a6dbb3
0x00a6dbb5
0x00a6dbb6
0x00a6dbba
0x00a6db4c
0x00a6db51
0x00a6db55
0x00a6db57
0x00a6db5c
0x00a6db61
0x00a6db74
0x00a6db74
0x00a6db55
0x00a6db4a
0x00a6dbbe

APIs

Part of subcall function 00A6DA91: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00A6DAB0
Part of subcall function 00A6DA91: GetProcAddress.KERNEL32(00AA0E40,CryptUnprotectMemory), ref: 00A6DAC0

GetCurrentProcessId.KERNEL32(?,00000080,?,00A6DB0A), ref: 00A6DB98

Strings

CryptUnprotectMemory failed, xrefs: 00A6DB90
CryptProtectMemory failed, xrefs: 00A6DB57

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: 28f257f4cce0885bd617a5304488e3116f3546a1d8882bb57c90e8020f534fa7
Instruction ID: fa326fc56c1c7103d1613482f304ddd7574f7f729ccecd4be076bb8598bb1c59
Opcode Fuzzy Hash: 28f257f4cce0885bd617a5304488e3116f3546a1d8882bb57c90e8020f534fa7
Instruction Fuzzy Hash: 2A112372B052526FEB19EB35DC11E7E37BAAF85B90B06843DF805DB196EB718C418390

Uniqueness

Uniqueness Score: -1.00%

Function 00A6AAAE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00A6AAAE(void* __ecx, void* __eflags, signed short* _a4, short* _a8, intOrPtr _a12) {
				short _t10;
				void* _t13;
				signed int _t14;
				short* _t20;
				void* _t23;
				signed short* _t27;
				signed int _t29;
				signed int _t31;

				_t20 = _a8;
				_t27 = _a4;
				 *_t20 = 0;
				_t10 = E00A6ADCD(_t27);
				if(_t10 == 0) {
					_t29 = 0x5c;
					if( *_t27 == _t29 && _t27[1] == _t29) {
						_push(_t29);
						_push( &(_t27[2]));
						_t10 = E00A7F472(__ecx);
						_pop(_t23);
						if(_t10 != 0) {
							_push(_t29);
							_push(_t10 + 2);
							_t13 = E00A7F472(_t23);
							if(_t13 == 0) {
								_t14 = E00A816B5(_t27);
							} else {
								_t14 = (_t13 - _t27 >> 1) + 1;
							}
							asm("sbb esi, esi");
							_t31 = _t29 & _t14;
							E00A82B91(_t20, _t27, _t31);
							_t10 = 0;
							 *((short*)(_t20 + _t31 * 2)) = 0;
						}
					}
					return _t10;
				}
				return E00A63CE2(_t20, _a12, L"%c:\\",  *_t27 & 0x0000ffff);
			}

0x00a6aaaf
0x00a6aab6
0x00a6aabb
0x00a6aabe
0x00a6aac5
0x00a6aae2
0x00a6aae6
0x00a6aaf1
0x00a6aaf2
0x00a6aaf3
0x00a6aaf9
0x00a6aafc
0x00a6ab01
0x00a6ab02
0x00a6ab03
0x00a6ab0c
0x00a6ab16
0x00a6ab0e
0x00a6ab12
0x00a6ab12
0x00a6ab20
0x00a6ab22
0x00a6ab27
0x00a6ab2f
0x00a6ab31
0x00a6ab31
0x00a6aafc
0x00000000
0x00a6ab35
0x00000000

APIs

_swprintf.LIBCMT ref: 00A6AAD5

Part of subcall function 00A63CE2: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00A63CF5

Strings

%c:\, xrefs: 00A6AACB

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: __vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 1543624204-3142399695
Opcode ID: 63bcbc7f8ccf4ca98fdc21dbe44ab03f14ffbfe7c5d0fef3d78a4ccbb1b37bb6
Instruction ID: 44ef9c1b150fda3ab54b3120b50b9e6f496eb5554fa93b990b4c9b431aca5506
Opcode Fuzzy Hash: 63bcbc7f8ccf4ca98fdc21dbe44ab03f14ffbfe7c5d0fef3d78a4ccbb1b37bb6
Instruction Fuzzy Hash: 9F01F5235003127DCB307B798C46D6BA7BCEEA63A0750851AF884E6082FA20DC40CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 00A6F25B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49
threadCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00A6F25B() {
				long _v4;
				void* __ecx;
				void* __esi;
				void* __ebp;
				void* _t5;
				int _t8;
				void* _t12;
				void** _t18;
				void* _t22;

				_t12 = 0;
				if( *0xa9bbf8 > 0) {
					_t18 = 0xa9bbfc;
					do {
						_t22 = CreateThread(0, 0x10000, E00A6F40B, 0xa9bbf8, 0,  &_v4);
						if(_t22 == 0) {
							_push(L"CreateThread failed");
							_push(0xa9bbf8);
							E00A669DF(E00A80F99(E00A669E4(0xa9bbf8)), 0xa9bbf8, 0xa9bbf8, 2);
						}
						 *_t18 = _t22;
						 *0x00A9BC7C =  *((intOrPtr*)(0xa9bc7c)) + 1;
						_t8 =  *0xaa149c; // 0x0
						if(_t8 != 0) {
							_t8 = SetThreadPriority( *_t18, _t8);
						}
						_t12 = _t12 + 1;
						_t18 =  &(_t18[1]);
					} while (_t12 <  *0xa9bbf8);
					return _t8;
				}
				return _t5;
			}

0x00a6f260
0x00a6f264
0x00a6f268
0x00a6f26b
0x00a6f285
0x00a6f289
0x00a6f28b
0x00a6f290
0x00a6f2ad
0x00a6f2ad
0x00a6f2b2
0x00a6f2b4
0x00a6f2ba
0x00a6f2c1
0x00a6f2c6
0x00a6f2c6
0x00a6f2cc
0x00a6f2cd
0x00a6f2d0
0x00000000
0x00a6f2d5
0x00a6f2d9

APIs

CreateThread.KERNEL32 ref: 00A6F27F
SetThreadPriority.KERNEL32(000000FF,00000000), ref: 00A6F2C6

Part of subcall function 00A669E4: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00A66A02

Strings

CreateThread failed, xrefs: 00A6F28B

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: a7e9716117e1d95d33f486ee54b3cf61dfc38bd94066cb3b185783a59c044f8f
Instruction ID: 7137aaca13c1a3b9a78a35235f8f72891420608e87a2992da265f6cbe10b4eb1
Opcode Fuzzy Hash: a7e9716117e1d95d33f486ee54b3cf61dfc38bd94066cb3b185783a59c044f8f
Instruction Fuzzy Hash: 2C01D6B6348306BFD720BF64AD52BA277B8FB40715F20443EF942D51C1DAB198418B30

Uniqueness

Uniqueness Score: -1.00%

Function 00A7B147 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
registryCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00A7B147(void* __edx, intOrPtr _a4) {
				void* _v8;
				char _v12;
				char _v4108;
				long _t16;
				void* _t23;

				E00A7C240();
				if( *0xaa8758 != 0 &&  *0xab4e28 != 0) {
					E00A79E17(__edx, 0xab4e28,  &_v4108);
					_t16 =  *0xa99a20(0x80000001, L"Software\\WinRAR SFX", 0, 0, 0, 0x20006, 0,  &_v8,  &_v12, _t23);
					if(_t16 == 0) {
						 *0xa99a14(_v8,  &_v4108, 0, 1, _a4, 2 + E00A816B5(_a4) * 2);
						_t16 = RegCloseKey(_v8);
					}
					return _t16;
				}
				return 0x1008;
			}

0x00a7b14f
0x00a7b15b
0x00a7b174
0x00a7b196
0x00a7b19e
0x00a7b1c1
0x00a7b1ca
0x00a7b1ca
0x00000000
0x00a7b1d0
0x00a7b1d4

APIs

_wcslen.LIBCMT ref: 00A7B1A3
RegCloseKey.ADVAPI32(?), ref: 00A7B1CA

Strings

Software\WinRAR SFX, xrefs: 00A7B18C

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: Close_wcslen
String ID: Software\WinRAR SFX
API String ID: 2160127635-754673328
Opcode ID: 4869bc88d076acf2fedb6bf126df2c49ebcd0e143d6705225f2b787f7f5ed727
Instruction ID: 671806ee1e857ad06d4448443c5e40587b8900454fa6a51bd0246b473a5e6d8e
Opcode Fuzzy Hash: 4869bc88d076acf2fedb6bf126df2c49ebcd0e143d6705225f2b787f7f5ed727
Instruction Fuzzy Hash: C6018F72900128BADB21EB98DC49FDB7FACFF09391F008156B90991461DBB19A95C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00A8C703 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A8C703(void* __edx, void* __eflags) {
				signed int _t35;
				signed int _t36;
				void* _t37;

				E00A7CB60(__edx, 0xa972d8, 0xc);
				_t36 = 0;
				 *(_t37 - 0x1c) = 0;
				E00A887B0( *((intOrPtr*)( *((intOrPtr*)(_t37 + 8)))));
				 *((intOrPtr*)(_t37 - 4)) = 0;
				_t35 =  *( *( *(_t37 + 0xc)));
				_t34 = _t35 >> 6;
				if(( *( *((intOrPtr*)(0xab8428 + (_t35 >> 6) * 4)) + 0x28 + (_t35 & 0x0000003f) * 0x30) & 0x00000001) == 0) {
					L3:
					 *((intOrPtr*)(E00A85628())) = 9;
					_t36 = _t36 | 0xffffffff;
				} else {
					if(FlushFileBuffers(E00A88887(_t35)) == 0) {
						_t36 = E00A85615();
						 *_t36 = GetLastError();
						goto L3;
					}
				}
				 *(_t37 - 0x1c) = _t36;
				 *((intOrPtr*)(_t37 - 4)) = 0xfffffffe;
				E00A8C78F();
				return E00A7CBA6(_t34);
			}

0x00a8c70a
0x00a8c70f
0x00a8c711
0x00a8c719
0x00a8c71f
0x00a8c727
0x00a8c72b
0x00a8c742
0x00a8c765
0x00a8c76a
0x00a8c770
0x00a8c744
0x00a8c754
0x00a8c75b
0x00a8c763
0x00000000
0x00a8c763
0x00a8c754
0x00a8c773
0x00a8c776
0x00a8c77d
0x00a8c789

APIs

Part of subcall function 00A887B0: EnterCriticalSection.KERNEL32(00000000,?,00A8C2E4,00000000,00A97298,00000014,00A8AF59,00000000,?,00A8223E,00A8223E,00000000,?,00A8C643,00000000,00A8223E), ref: 00A887CB

FlushFileBuffers.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00A8C74C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 00A8C75D

Strings

@Mqt0Lqt, xrefs: 00A8C75D

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: BuffersCriticalEnterErrorFileFlushLastSection
String ID: @Mqt0Lqt
API String ID: 4109680722-1302913217
Opcode ID: 670e406e0ba4f8aa6d855d7decac995fd5dbb8fd40996cc6b6ed7093ea07032c
Instruction ID: 5794d71b546cf90e5aa6de05eef2faab9adacc4878c318682432e334e9dc6eb8
Opcode Fuzzy Hash: 670e406e0ba4f8aa6d855d7decac995fd5dbb8fd40996cc6b6ed7093ea07032c
Instruction Fuzzy Hash: 6201A275E102059FC700FFB8DA06A5D7BB5AF49720B24825AF8509B2A2EB74D9029F94

Uniqueness

Uniqueness Score: -1.00%

Function 00A7FEDC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A7FEDC(struct HINSTANCE__* _a4, WCHAR* _a8, long _a12) {
				long _t7;
				WCHAR* _t9;
				long _t10;

				_t10 = _a12;
				_t9 = _a8;
				_t7 = GetModuleFileNameW(_a4, _t9, _t10);
				if(_t10 != 0) {
					if(_t7 == 0) {
						 *_t9 = 0;
					}
					if(_t7 == _t10) {
						_t7 = GetLastError();
						if(_t7 == 0) {
							 *(_t9 + _t10 * 2 - 2) = _t7;
							return _t7;
						}
					}
				}
				return _t7;
			}

0x00a7fee0
0x00a7fee4
0x00a7feec
0x00a7fef4
0x00a7fef8
0x00a7fefc
0x00a7fefc
0x00a7ff01
0x00a7ff03
0x00a7ff0b
0x00a7ff0d
0x00000000
0x00a7ff0d
0x00a7ff0b
0x00a7ff01
0x00a7ff15

APIs

GetModuleFileNameW.KERNEL32(?,?,?), ref: 00A7FEEC
GetLastError.KERNEL32 ref: 00A7FF03

Strings

@Mqt0Lqt, xrefs: 00A7FF03

Memory Dump Source

Source File: 00000000.00000002.579234228.0000000000A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000000.00000002.579219539.0000000000A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579340823.0000000000A8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579363210.0000000000A99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579402140.0000000000AB8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.579415343.0000000000AB9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a60000_pK6oGXjugD.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: @Mqt0Lqt
API String ID: 2776309574-1302913217
Opcode ID: 3ea1e3a2fc1abc59fc9d971cea52e14101e70c348fbce05b5094148a7ac645c7
Instruction ID: 32ff6775d1389e1d49d26d47b53d1e0724ee8733c756f487566d58c9fdcf8412
Opcode Fuzzy Hash: 3ea1e3a2fc1abc59fc9d971cea52e14101e70c348fbce05b5094148a7ac645c7
Instruction Fuzzy Hash: 19E01A32601226BF8F205FEAAC0496B7BBCFE92B61714C039F909C3120E7219A1197E4

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report pK6oGXjugD.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\????????\locales\am.pak

C:\Program Files (x86)\????????\locales\ar.pak

C:\Program Files (x86)\????????\locales\bg.pak

C:\Program Files (x86)\????????\locales\bn.pak

C:\Program Files (x86)\????????\locales\ca.pak

C:\Program Files (x86)\????????\locales\cs.pak

C:\Program Files (x86)\????????\locales\da.pak

C:\Program Files (x86)\????????\locales\de.pak

C:\Program Files (x86)\????????\locales\el.pak

C:\Program Files (x86)\????????\locales\en-GB.pak

C:\Program Files (x86)\????????\locales\en-US.pak

C:\Program Files (x86)\????????\locales\es-419.pak

C:\Program Files (x86)\????????\locales\es.pak

C:\Program Files (x86)\????????\locales\et.pak

C:\Program Files (x86)\????????\locales\fa.pak

C:\Program Files (x86)\????????\locales\fi.pak

C:\Program Files (x86)\????????\locales\fil.pak

C:\Program Files (x86)\????????\locales\fr.pak

C:\Program Files (x86)\????????\locales\gu.pak

C:\Program Files (x86)\????????\locales\he.pak

C:\Program Files (x86)\????????\locales\hi.pak

C:\Program Files (x86)\????????\locales\hr.pak

C:\Program Files (x86)\????????\locales\hu.pak

C:\Program Files (x86)\????????\locales\id.pak

C:\Program Files (x86)\????????\locales\it.pak

C:\Program Files (x86)\????????\locales\ja.pak

Windows Analysis Report
pK6oGXjugD.exe