Edit tour

Windows Analysis Report
MicrosoftDefaults.exe

Overview

General Information

Sample Name:	MicrosoftDefaults.exe
Analysis ID:	818212
MD5:	23edddfd3f65c753ae87f4d3cf12a215
SHA1:	50df12f1a964abf7a6fc6b3ab10bff2608f49526
SHA256:	d5d6bdc891cf6365e8e738cb60878e54967ccad3e3954b2cd936341db05cd178
Infos:

Detection

Score:	21
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Signatures

Potential context-aware VBS script found (checks for environment specific values)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

DLL planting / hijacking vulnerabilities found

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Binary contains a suspicious time stamp

Found large amount of non-executed APIs

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample may be VM or Sandbox-aware, try analysis on a native machine

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Process Tree

System is w10x64

MicrosoftDefaults.exe (PID: 6124 cmdline: C:\Users\user\Desktop\MicrosoftDefaults.exe MD5: 23EDDDFD3F65C753AE87F4D3CF12A215)

StartupInstaller.exe (PID: 4472 cmdline: C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe MD5: E40AF81D67406FDCD7A1945F5CE454D6)

MEInstaller.exe (PID: 524 cmdline: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe MD5: BBD7C942EF0CD6B1EBD57887641F93CD)

rundll32.exe (PID: 4332 cmdline: C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\ MD5: 73C519F050C20580F8A62C849D49215A)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Users\user\Desktop\MicrosoftDefaults.exe	DLL: VERSION.dll			Jump to behavior
Source: C:\Users\user\Desktop\MicrosoftDefaults.exe	DLL: Cabinet.dll			Jump to behavior

Source: MicrosoftDefaults.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\MicrosoftDefaults.exe	DLL: VERSION.dll			Jump to behavior
Source: C:\Users\user\Desktop\MicrosoftDefaults.exe	DLL: Cabinet.dll			Jump to behavior

Source: MicrosoftDefaults.exe

Static PE information: certificate valid

Source: MicrosoftDefaults.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: wextract.pdb source: MicrosoftDefaults.exe, BrowserSettingsInstaller.exe.0.dr
Source:	Binary string: wextract.pdbGCTL source: MicrosoftDefaults.exe, BrowserSettingsInstaller.exe.0.dr
Source:	Binary string: C:\Users\Administrator\Downloads\StartupInstaller\StartupInstaller\Release\StartupInstaller.pdb source: StartupInstaller.exe, 00000001.00000000.304430477.0000000000F4F000.00000002.00000001.01000000.00000004.sdmp, StartupInstaller.exe, 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: MEInstaller.exe, MEInstaller.exe, 00000002.00000002.830719414.0000000004A32000.00000002.00000001.01000000.0000000A.sdmp, Newtonsoft.Json.dll.0.dr
Source:	Binary string: D:\Ramesh\VSTS\BingGrowthApps\Applications\BingWallpaperApp\Release\DispatchQueue.pdb source: MEInstaller.exe, 00000002.00000002.834121984.000000006C3AB000.00000002.00000001.01000000.00000009.sdmp, DispatchQueue.dll.0.dr
Source:	Binary string: D:\SRR\VSTS\Repos\BingGrowthApps\Applications\DefaultOffer\Release\MEDefMgr.pdb source: MEInstaller.exe, 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\VSTS\BingGrowthApps\Installers\EnhancedEdge\MEInstaller\MEInstaller\obj\Release\MEInstaller.pdb source: MEInstaller.exe, 00000002.00000000.304879627.0000000000042000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: C:\agent\_work\66\s\build\ship\x86\SfxCA.pdb source: BSvcInstaller.msi.0.dr
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA2567 source: MEInstaller.exe, 00000002.00000002.830719414.0000000004A32000.00000002.00000001.01000000.0000000A.sdmp, Newtonsoft.Json.dll.0.dr
Source:	Binary string: C:\EEI\MEProgressBar\obj\Debug\MEProgressBar.pdb source: MEProgressBar.dll.0.dr

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe	Code function: 1_2_00F47DAF FindFirstFileExW,		1_2_00F47DAF
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Code function: 2_2_6BD4A826 FindFirstFileExW,		2_2_6BD4A826

Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertCSRSA4096RootG5.crt0E
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA2.crt0
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertCSRSA4096RootG5.crl0
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0F
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0=
Source: MEInstaller.exe, 00000002.00000003.324162573.0000000005D90000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.323575560.0000000005D8B000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.323703070.0000000005D8B000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.323809625.0000000005D8B000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324031946.0000000005D8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://en.w?
Source: MEInstaller.exe, 00000002.00000003.327601065.0000000005D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://en.wikipw
Source: MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://james.newtonking.com/projects/json
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: MEInstaller.exe, 00000002.00000003.323404229.0000000005D7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wG.)
Source: MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: MEInstaller.exe, 00000002.00000003.327601065.0000000005D7F000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: MEInstaller.exe, 00000002.00000003.326705162.0000000005D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/
Source: MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: MEInstaller.exe, 00000002.00000003.327601065.0000000005D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comF
Source: MEInstaller.exe, 00000002.00000003.327601065.0000000005D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comalic
Source: MEInstaller.exe, 00000002.00000003.327601065.0000000005D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comcomd
Source: MEInstaller.exe, 00000002.00000003.327601065.0000000005D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comcomy
Source: MEInstaller.exe, 00000002.00000003.327601065.0000000005D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comessed
Source: MEInstaller.exe, 00000002.00000003.327601065.0000000005D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comessedn
Source: MEInstaller.exe, 00000002.00000002.832452605.0000000005D70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comico
Source: MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.320177098.0000000005D8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: MEInstaller.exe, 00000002.00000003.320292983.0000000005D8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.comic$
Source: MEInstaller.exe, 00000002.00000003.320262937.0000000005D8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.comicP
Source: MEInstaller.exe, 00000002.00000003.321402262.0000000005D7D000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: MEInstaller.exe, 00000002.00000003.324665972.0000000005D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: MEInstaller.exe, 00000002.00000003.324926210.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324977528.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324217922.0000000005D7B000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324665972.0000000005D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/&
Source: MEInstaller.exe, 00000002.00000003.324926210.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324977528.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324665972.0000000005D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp//
Source: MEInstaller.exe, 00000002.00000003.324926210.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324977528.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.325295970.0000000005D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/4
Source: MEInstaller.exe, 00000002.00000003.323809625.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324926210.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324977528.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324217922.0000000005D7B000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324665972.0000000005D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/J
Source: MEInstaller.exe, 00000002.00000003.325874594.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.323809625.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324926210.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324977528.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324217922.0000000005D7B000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.325295970.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324665972.0000000005D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/W
Source: MEInstaller.exe, 00000002.00000003.323809625.0000000005D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/a-e
Source: MEInstaller.exe, 00000002.00000003.324926210.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324977528.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324217922.0000000005D7B000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.325295970.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324665972.0000000005D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/d
Source: MEInstaller.exe, 00000002.00000003.324926210.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324977528.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324665972.0000000005D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/i/w
Source: MEInstaller.exe, 00000002.00000003.325295970.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324665972.0000000005D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: MEInstaller.exe, 00000002.00000003.325295970.0000000005D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/J
Source: MEInstaller.exe, 00000002.00000003.324926210.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324977528.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.325295970.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324665972.0000000005D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/n
Source: MEInstaller.exe, 00000002.00000003.324217922.0000000005D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/nl-n/
Source: MEInstaller.exe, 00000002.00000003.324926210.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324977528.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.325295970.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324665972.0000000005D83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/tr-t
Source: MEInstaller.exe, 00000002.00000003.326280865.0000000005D8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.monotype.
Source: MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.321927298.0000000005D8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: MEInstaller.exe, MEInstaller.exe, 00000002.00000002.830719414.0000000004A32000.00000002.00000001.01000000.0000000A.sdmp, Newtonsoft.Json.dll.0.dr	String found in binary or memory: https://github.com/JamesNK/Newtonsoft.Json
Source: MEInstaller.exe	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: MEInstaller.exe, 00000002.00000002.828248486.00000000024BE000.00000004.00000800.00020000.00000000.sdmp, MEInstaller.exe.config.0.dr	String found in binary or memory: https://www.msn.com
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: https://www.newtonsoft.com/json
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: MEInstaller.exe, MEInstaller.exe, 00000002.00000002.830719414.0000000004A32000.00000002.00000001.01000000.0000000A.sdmp, Newtonsoft.Json.dll.0.dr	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson

Source: MicrosoftDefaults.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe	Code function: 1_2_00F41150	1_2_00F41150
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe	Code function: 1_2_00F4DDBD	1_2_00F4DDBD
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Code function: 2_2_04A33276	2_2_04A33276
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Code function: 2_2_04A333B9	2_2_04A333B9
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Code function: 2_2_6BD503C1	2_2_6BD503C1
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Code function: 2_2_6BD34A60	2_2_6BD34A60
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Code function: 2_2_6BD48190	2_2_6BD48190
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Code function: 2_2_6BD461BF	2_2_6BD461BF
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Code function: 2_2_6BD3DE50	2_2_6BD3DE50
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Code function: 2_2_6BD3CDF0	2_2_6BD3CDF0
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Code function: 2_2_04A35D9D	2_2_04A35D9D

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Code function: String function: 6BD41850 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe	Code function: String function: 00F433C0 appears 33 times

Source: MicrosoftDefaults.exe	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 7620706 bytes, 11 files, at 0x2c +A "MEInstaller.exe" +A "Newtonsoft.Json.dll", ID 20375, number 1, 278 datablocks, 0x1503 compression
Source: BrowserSettingsInstaller.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 1711254 bytes, 7 files, at 0x2c +A "BrowserSettings.exe" +A "Newtonsoft.Json.dll", ID 13813, number 1, 103 datablocks, 0x1503 compression

Source: MicrosoftDefaults.exe

Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs MicrosoftDefaults.exe

Source: C:\Users\user\Desktop\MicrosoftDefaults.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Section loaded: sfc.dll	Jump to behavior

Source: MicrosoftDefaults.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\MicrosoftDefaults.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\MicrosoftDefaults.exe C:\Users\user\Desktop\MicrosoftDefaults.exe
Source: C:\Users\user\Desktop\MicrosoftDefaults.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\
Source: C:\Users\user\Desktop\MicrosoftDefaults.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe

File created: C:\Users\user\AppData\Local\Microsoft\Dispatcher

Jump to behavior

Source: C:\Users\user\Desktop\MicrosoftDefaults.exe

File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP

Jump to behavior

Source: classification engine

Classification label: sus21.evad.winEXE@6/11@0/0

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe

Code function: 2_2_6BD33D70 SetEdgeAsDefaultBrowser,CoInitializeEx,CoCreateInstance,CoUninitialize,

2_2_6BD33D70

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{35e48840-e42e-40ba-ad05-f0902d406172}
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe	Mutant created: \Sessions\1\BaseNamedObjects\// {9D255ADC-2EB7-47F7-8DE0-7B2F4F9D9EB2}

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe

Code function: 2_2_6BD332A0 LoadResource,LockResource,SizeofResource,

2_2_6BD332A0

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: initial sample

Static PE information: Valid certificate with Microsoft Issuer

Source: MicrosoftDefaults.exe

Static file information: File size 7778712 > 1048576

Source: MicrosoftDefaults.exe

Static PE information: certificate valid

Source: MicrosoftDefaults.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x760400

Source: MicrosoftDefaults.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: MicrosoftDefaults.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: MicrosoftDefaults.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: MicrosoftDefaults.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: MicrosoftDefaults.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: MicrosoftDefaults.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: MicrosoftDefaults.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: MicrosoftDefaults.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wextract.pdb source: MicrosoftDefaults.exe, BrowserSettingsInstaller.exe.0.dr
Source:	Binary string: wextract.pdbGCTL source: MicrosoftDefaults.exe, BrowserSettingsInstaller.exe.0.dr
Source:	Binary string: C:\Users\Administrator\Downloads\StartupInstaller\StartupInstaller\Release\StartupInstaller.pdb source: StartupInstaller.exe, 00000001.00000000.304430477.0000000000F4F000.00000002.00000001.01000000.00000004.sdmp, StartupInstaller.exe, 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: MEInstaller.exe, MEInstaller.exe, 00000002.00000002.830719414.0000000004A32000.00000002.00000001.01000000.0000000A.sdmp, Newtonsoft.Json.dll.0.dr
Source:	Binary string: D:\Ramesh\VSTS\BingGrowthApps\Applications\BingWallpaperApp\Release\DispatchQueue.pdb source: MEInstaller.exe, 00000002.00000002.834121984.000000006C3AB000.00000002.00000001.01000000.00000009.sdmp, DispatchQueue.dll.0.dr
Source:	Binary string: D:\SRR\VSTS\Repos\BingGrowthApps\Applications\DefaultOffer\Release\MEDefMgr.pdb source: MEInstaller.exe, 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\VSTS\BingGrowthApps\Installers\EnhancedEdge\MEInstaller\MEInstaller\obj\Release\MEInstaller.pdb source: MEInstaller.exe, 00000002.00000000.304879627.0000000000042000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: C:\agent\_work\66\s\build\ship\x86\SfxCA.pdb source: BSvcInstaller.msi.0.dr
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA2567 source: MEInstaller.exe, 00000002.00000002.830719414.0000000004A32000.00000002.00000001.01000000.0000000A.sdmp, Newtonsoft.Json.dll.0.dr
Source:	Binary string: C:\EEI\MEProgressBar\obj\Debug\MEProgressBar.pdb source: MEProgressBar.dll.0.dr

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe

Code function: 2_2_6BD41894 push ecx; ret

2_2_6BD418A6

Source: BrowserSettingsInstaller.exe.0.dr	Static PE information: real checksum: 0x1d4b40 should be: 0x1c9a04
Source: MicrosoftDefaults.exe	Static PE information: real checksum: 0x77b01f should be: 0x7700ff

Source: MicrosoftDefaults.exe

Static PE information: 0xB9387306 [Thu Jun 21 06:07:02 2068 UTC]

Source: initial sample

Static PE information: section name: .text entropy: 7.122567683343345

Source: C:\Users\user\Desktop\MicrosoftDefaults.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Jump to dropped file
Source: C:\Users\user\Desktop\MicrosoftDefaults.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEProgressBar.dll	Jump to dropped file
Source: C:\Users\user\Desktop\MicrosoftDefaults.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEDefMgr.dll	Jump to dropped file
Source: C:\Users\user\Desktop\MicrosoftDefaults.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\BrowserSettingsInstaller.exe	Jump to dropped file
Source: C:\Users\user\Desktop\MicrosoftDefaults.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\DispatchQueue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\MicrosoftDefaults.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe	Jump to dropped file
Source: C:\Users\user\Desktop\MicrosoftDefaults.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Newtonsoft.Json.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run BingSvc			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run BingSvc			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Potential context-aware VBS script found (checks for environment specific values)

Source: C:\Users\user\Desktop\MicrosoftDefaults.exe

Dropped file: If InStr(objItem.OSArchitecture, "64") Then

Jump to dropped file

Source: C:\Users\user\Desktop\MicrosoftDefaults.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEProgressBar.dll	Jump to dropped file
Source: C:\Users\user\Desktop\MicrosoftDefaults.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\IXP000.TMP\BrowserSettingsInstaller.exe	Jump to dropped file
Source: C:\Users\user\Desktop\MicrosoftDefaults.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Newtonsoft.Json.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe	API coverage: 9.3 %
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	API coverage: 3.6 %

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe	Code function: 1_2_00F47DAF FindFirstFileExW,		1_2_00F47DAF
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Code function: 2_2_6BD4A826 FindFirstFileExW,		2_2_6BD4A826

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe

Code function: 1_2_00F43162 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_00F43162

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe

Code function: 1_2_00F49EE9 GetProcessHeap,

1_2_00F49EE9

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe	Code function: 1_2_00F48E3C mov eax, dword ptr fs:[00000030h]	1_2_00F48E3C
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe	Code function: 1_2_00F46626 mov eax, dword ptr fs:[00000030h]	1_2_00F46626
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Code function: 2_2_6BD4A3F3 mov eax, dword ptr fs:[00000030h]	2_2_6BD4A3F3
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Code function: 2_2_6BD48B68 mov eax, dword ptr fs:[00000030h]	2_2_6BD48B68

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe	Code function: 1_2_00F432F6 SetUnhandledExceptionFilter,	1_2_00F432F6
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe	Code function: 1_2_00F43162 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00F43162
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe	Code function: 1_2_00F45A27 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00F45A27
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe	Code function: 1_2_00F42A08 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00F42A08
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Code function: 2_2_6BD443B4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6BD443B4
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Code function: 2_2_6BD41541 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6BD41541
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Code function: 2_2_6BD41403 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6BD41403

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Newtonsoft.Json.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe

Code function: 1_2_00F43405 cpuid

1_2_00F43405

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\MicrosoftDefaults.exe

Code function: 0_2_00F07105 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00F07105

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe

Code function: 2_2_6BD31020 GetVersionExW,

2_2_6BD31020

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Scripting	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 Virtualization/Sandbox Evasion	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	1 DLL Search Order Hijacking	1 DLL Side-Loading	1 Disable or Modify Tools	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	1 DLL Search Order Hijacking	1 Process Injection	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	24 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Scripting	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Rundll32	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Software Packing	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 Timestomp	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	1 DLL Side-Loading	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	1 DLL Search Order Hijacking	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
MicrosoftDefaults.exe	0%	ReversingLabs
MicrosoftDefaults.exe	1%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\IXP000.TMP\BrowserSettingsInstaller.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\IXP000.TMP\DispatchQueue.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEDefMgr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEProgressBar.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\IXP000.TMP\Newtonsoft.Json.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe	0%	ReversingLabs

URLs

Source	Detection	Scanner	Label
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/a-e	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/J	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.comessedn	0%	Avira URL Cloud	safe
http://www.fontbureau.comessed	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://wG.)	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/i/w	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/4	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp//	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://en.wikipw	0%	Avira URL Cloud	safe
http://www.fonts.comicP	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/&	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/W	0%	URL Reputation	safe
http://www.fontbureau.comF	0%	URL Reputation	safe
http://www.fontbureau.comcomd	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/J	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/tr-t	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://james.newtonking.com/projects/json	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.monotype.	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/n	0%	URL Reputation	safe
http://www.fontbureau.comalic	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/d	0%	URL Reputation	safe
http://www.fontbureau.comico	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/nl-n/	0%	Avira URL Cloud	safe
http://www.fontbureau.comcomy	0%	Avira URL Cloud	safe
http://en.w?	0%	Avira URL Cloud	safe
http://www.fonts.comic$	0%	Avira URL Cloud	safe

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	818212
Start date and time:	2023-03-02 01:51:04 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	MicrosoftDefaults.exe
Detection:	SUS
Classification:	sus21.evad.winEXE@6/11@0/0
EGA Information:	Successful, ratio: 66.7%
HDC Information:	Successful, ratio: 100% (good quality ratio 91.4%) Quality average: 76.8% Quality standard deviation: 31.2%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, conhost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ctldl.windowsupdate.com
Execution Graph export aborted for target MicrosoftDefaults.exe, PID 6124 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:52:22	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run BingSvc C:\Users\user\AppData\Local\Microsoft\BingSvc\BingSvc.exe
01:52:30	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run BingSvc C:\Users\user\AppData\Local\Microsoft\BingSvc\BingSvc.exe

Joe Sandbox View / Context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Temp\IXP000.TMP\DispatchQueue.dll	BSStartMSI.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\IXP000.TMP\BSvcInstaller.msi

Download File

Process:	C:\Users\user\Desktop\MicrosoftDefaults.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Microsoft Bing Service, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Bing Service., Template: Intel;1033, Revision Number: {DD76ED0B-FC43-4B4E-AD93-7C707F4ACA2C}, Create Time/Date: Sat Sep 10 08:31:44 2022, Last Saved Time/Date: Sat Sep 10 08:31:44 2022, Number of Pages: 300, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
Category:	dropped
Size (bytes):	5312512
Entropy (8bit):	7.9290426505765454
Encrypted:	false
SSDEEP:	98304:Mex9ZBsDZkK0kwy6kaCk+bcbMbVJzk+Aa9/UNo/QDV8hYa3x6IHEPyAZnR5U:XEWK0kwy6XCkgcbMpJI2VKVo1BiyAZRa
MD5:	A209E04C1E279B22E4EDF62C4C5AC100
SHA1:	9E4E614F2CBD670791546FFBB41E9D6CA3E3FA42
SHA-256:	FB4A95C8427B60F6E30010BAFE41A61824266156488D26CE8CA8EFB317820805
SHA-512:	4E2CCDE9F95D8B743753F9471D03EA768E613ACE4C61AF364D5486E83F73187B09812EC40CBA1B65900D6E2CC52DCD56A5EC448D646407C84280A4337AE9EBF1
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\BrowserSettingsInstaller.exe

Download File

Process:	C:\Users\user\Desktop\MicrosoftDefaults.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1869200
Entropy (8bit):	7.973901513317514
Encrypted:	false
SSDEEP:	49152:uLMzAv8uBwMd8hXCdLn8e9ymtIm1XRwDXr:8MziqewCdLnB9y61hwDb
MD5:	8395A75044B8749B0CCF2C64F9CFC0C3
SHA1:	9DFA97CE334D971F1BF591A2118CBF54EC2D75E2
SHA-256:	34D792ECFE770181FC055E3279F754E9043E67AF015D2F7EDDF6E2211E7A2AF9
SHA-512:	1095B1180E016B8E35C2BAC15FC3BCE2665D7E8CCD674DEB564CD1FC57534AC6594BAB467856FFC4492C1C51890B134B5A5528FCC09337407DBDEEED07666550
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........C...C...C.......B.......B.......W.......R...C...........J.....d.B.......B...RichC...................PE..L....s8..................d...........j............@.................................@K....@...... ......................................l............^...'..............T...............................@............................................text....b.......d.................. ..`.data...H............h..............@....idata..R............j..............@..@.rsrc...l............\|..............@..@.reloc...............T..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\CreateShortCut.vbs

Download File

Process:	C:\Users\user\Desktop\MicrosoftDefaults.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	16581
Entropy (8bit):	5.8551830623769865
Encrypted:	false
SSDEEP:	384:UkOxgMFddaVe4j6HvmVfg9J22ufLbbQteG:UkOSZJj6Hv8fu+LbEsG
MD5:	A5C3F20ADE4317E9D3C90107B25E724C
SHA1:	BA35748AA23B1DF70335A1CB983A2F83E7657668
SHA-256:	D1BF3AE24A964737EE5EA9D0143466DAB7769565049778A49830AB86DD63E0FD
SHA-512:	94E44F13FDE869D8E285693FEF685159B7B83B0C6630ED80C268387415C844593EA6D75064237FF03CC4AD9CDDB23A722CACF27A724316F66136AC24D47DAFDB
Malicious:	false
Reputation:	low
Preview:	Dim WSHShell ..Dim MyShortcut ..Dim DesktopPath....Set WSHShell = CreateObject("WScript.Shell") ..If not WSHShell Is Nothing Then ..DesktopPath = WSHShell.SpecialFolders("Desktop") ..Set MyShortcut = WSHShell.CreateShortCut(DesktopPath & "\Microsoft Edge" & ".lnk").. ..Set objWMIService = GetObject("winmgmts:\\.\root\CIMV2")..Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_OperatingSystem", "WQL", wbemFlagReturnImmediately + wbemFlagForwardOnly)....For Each objItem in colItems...If InStr(objItem.OSArchitecture, "64") Then....MyShortcut.TargetPath = "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" ....MyShortcut.WorkingDirectory = "C:\Program Files (x86)\Microsoft\Edge\Application" ...Else....MyShortcut.TargetPath = "C:\Program Files\Microsoft\Edge\Application\msedge.exe" ....MyShortcut.WorkingDirectory = "C:\Program Files\Microsoft\Edge\Application" ...End If..Next....MyShortcut.WindowStyle = 1 ..MyShortcut.Description = "Browse the web"..MyShortcut.Arguments

C:\Users\user\AppData\Local\Temp\IXP000.TMP\DispatchQueue.dll

Download File

Process:	C:\Users\user\Desktop\MicrosoftDefaults.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	158080
Entropy (8bit):	6.57378529370525
Encrypted:	false
SSDEEP:	3072:oo9X5ooAfvWHrgCP0Y6jaJ+681+LnKAC/yOh3eBuPj+jRzpmfyrFBsw5yWXgZ:ood5ooAfvogCyR6HLCb3yuPj+/ssxXgZ
MD5:	3E32206E07EEFAA6E9CE6B3D70E0C1D5
SHA1:	BA3AB0FBD00453E5049D95F61A21D40CB68CF235
SHA-256:	B19E2C644108614CDB2607F850CED43120161B191501618806C0F91842246F9B
SHA-512:	FE43CACD43023E1E09FCCC83C393089FD601F7E03B01207A73D0364858928D413555D7E70E45A43D67E66976079EB980BDD53836643214741AE17895A135A5AF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: BSStartMSI.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........i;...h...h...h..i...h..i$..h..i...hz..i...hz..i...hz..i...h..i...h...h/..h7..i...h7..i...h7..h...h..h...h7..i...hRich...h........................PE..L.....u_...........!................................................................q.....@..........................#..$....$.......P..p............F...#...`......l...p...............................@............................................text...j........................... ..`.rdata..L...........................@..@.data...l....0....... ..............@....rsrc...p....P.......,..............@..@.reloc.......`.......2..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\LocalizedTitles.json

Download File

Process:	C:\Users\user\Desktop\MicrosoftDefaults.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3445
Entropy (8bit):	5.968561828284263
Encrypted:	false
SSDEEP:	96:Cvv8fO5PcnOn60er6v5ecETv4z6DUlbtGa9/czuvW0V5gHJA6:CvEOCOnK6hecgJgxtGS/Wuj5V6
MD5:	8AF65DB3C2B26EC9A7E8DA5F7F9D8533
SHA1:	4B191583F144F2DAAA161185A0324AD394666E3C
SHA-256:	A4DDA96BF7B61EBC3128E1FA32E1E10E920D45A2AAD9B6A27F6B92BF35FCE3CA
SHA-512:	CED9573DEC731ADB787F58DAE173FC74BEEDFD3FA209345F5423826FD480D32B9F5F66D0F54F253E0146A65CA46A224ABEA5BDE21B5055967922D2402CE3BBA9
Malicious:	false
Preview:	{..."LocalizedTitles": [...."..... ....... .....",...."............ .. ........... . ........",...."Optimizirajte pregledavanje weba",...."Optimalizujte svoje proch.zen. webu",...."Optimer din webbrowsing",...."Optimieren Sie das Browsen im Web",...."............... ... ......... ... .... ....",...."Optimise your web browsing",...."Optimizar la exploraci.n web",...."Optimizar la exploraci.n web",...."Optimisez votre navigation sur le Web",...."Optimisez votre navigation sur le Web",...."Optimizirajte pregledavanje weba",...."Optimalkan penjelajahan web Anda",...."Ottimizza l'esplorazione Web",...."Web ........",...."..... ...... ............",....". .. ...",...."Optimaliser nettlesingen",...."Uw browsen op het web optimaliseren",...."Otimizar sua navega..o na Web",...."Otimizar a navega..o na Web",...."Optimize your web browsing",...."Optim

C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEDefMgr.dll

Download File

Process:	C:\Users\user\Desktop\MicrosoftDefaults.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	199560
Entropy (8bit):	6.533665233074508
Encrypted:	false
SSDEEP:	3072:og4G157yceVCsSxoczV+zayB/u/ttJDHmo2os75ochKPpWudz77MMxYOvej9r10N:b4457yLSxdzV+zayABD+8Pgudz7MsiU
MD5:	11B1C577DB79D9D0B05855354715335F
SHA1:	90975A11A2E36CCD427D8893F9396BCE115145A3
SHA-256:	471EC34845A1B22FCC7CC89D672ED71B487C149072617C6E89A746C1D8C926BC
SHA-512:	CE4341F8014E16D63767FCBEFBF5873F57FFA0EF7751AADEB76E7EF8B1D2FC57F4D7BCDB04BA50E7D313BE7A85082870ED450772FAF13712C2FA253C2BF6D9CD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............A..A..A..@..A..@@..A,.@..A,.@...A,.@...A..@..A..@..A..Ar..Al.@..Al.@..Al.PA..A.8A..Al.@..ARich..A................PE..L....._...........!.........................0............................... .......Z....@......................... ...................P................#..............p...........................P...@............0...............................text...=........................... ..`.rdata.......0....... ..............@..@.data...(...........................@....rsrc...P...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe

Download File

Process:	C:\Users\user\Desktop\MicrosoftDefaults.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	660416
Entropy (8bit):	7.1188742390583695
Encrypted:	false
SSDEEP:	12288:njfVSXsusPBkpYtc2uxFBbKA0S6FYYYY9GfVIr6P4WxQz4:nhNusPBkStcYgmWqz4
MD5:	BBD7C942EF0CD6B1EBD57887641F93CD
SHA1:	6AE5F342C576D3FA0DCAFB2481D16A4D3A4D37BC
SHA-256:	66F796E508B4BC70943496800C60AC084637A1B3FE78B727D6013D8434723231
SHA-512:	04B6CB0D6DE657E66172E98E64D8308AF8B2E760D1B3F82189E0513ACDF8DA2E3C5A048E99A3055D57AFCAEE2CFE894BD8F1CEAC78A423A7850ADB52E5B020B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$.)..........."...0......$........... ........@.. .......................`......J.....`.....................................O........!...............'...@..........8............................................ ............... ..H............text........ ...................... ..`.rsrc....!......."..................@..@.reloc.......@......................@..B........................H...................m...h................................................0..........r...ps.....s.......~....s.....~......~......~......~......~....r...p(p.....(......~....r+..p(u...9....~....r+..p(p...~....rI..p(p.....~....r]..p(p.....~....ru..p(p.....~....r...p(p.....(......o....(......(....,....(....+?..(....,6..(....,....(....+#..(....,.r...p(......+.r...p(........r...p(....,.r...p(....+...(.............(....(....r...p.{....( ...(.....,..(....~....-.~......(......&r...p(..

C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe.config

Download File

Process:	C:\Users\user\Desktop\MicrosoftDefaults.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2577
Entropy (8bit):	5.381119504417309
Encrypted:	false
SSDEEP:	48:3yPrjtT2mrjtT2mrgtT2mr8HtT0ta9O1c46bXRlpIp8nBuGztFFtMeM/gKATsKOF:0tJt2t8tkXMR/rG0z87R
MD5:	5B7EB3AF6ACAD627BB9B287053290D26
SHA1:	E411057944168C1CD715D80D962B0A31364F6581
SHA-256:	A6EB8AF8191092C1BA19C9B85F4DFEB5641CB2CB93C2AD53A77672BC71C80408
SHA-512:	93CDDC00EF333E10972B989190E2DDF85E6749F30EFEBADCA69381A4AE480F271E5962D408801DA13E300D9121A01E0FA117C61697C1C2E739E666E83A65BC26
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<configuration>...<configSections>....<section name="Extension" type="System.Configuration.AppSettingsSection, System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />....<section name="Favorites" type="System.Configuration.AppSettingsSection, System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />....<section name="MEDefaultsPCReset" type="System.Configuration.AppSettingsSection, System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />....<section name="PinWebsite" type="System.Configuration.AppSettingsSection, System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />...</configSections>...<startup>....<supportedRuntime version="v4.0" />...</startup>...<appSettings>....<add key="PC" value="EE24" />....<add key="InstallType" value="UI-IP" />....<add key="SetHomePage" value="true" />....<add key="DefaultUI

C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEProgressBar.dll

Download File

Process:	C:\Users\user\Desktop\MicrosoftDefaults.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16792
Entropy (8bit):	6.685850478580629
Encrypted:	false
SSDEEP:	192:HWedcUaRjVu5Za/OXHwNkWewhWJZf8sGGrHnhWgN7awW5Na+WyGI+X01k9z3ALNC:HHZa/OXHwNkRw2rHRN782NrR9zuNwJk
MD5:	A9DC80F325FF97C83D85E40E8A5E340F
SHA1:	E749EA0B1C92196104F3B44A98CAEEFA59687122
SHA-256:	BCB3530B5EDC302E83B6265D2E8C3E01384045622508A19F3A49D7F56F23DC74
SHA-512:	8835709A8C4168C4A525783256599F8A203937EE71C4D29FFCB49F702B17D0943707A19539A27C6B0AEAF750842D6F0A669E8D4DD07734FC312C9F6EF5B39F1F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....[1..........." ..0..............1... ...@....... ....................................`.................................}1..O....@...................'...`.......0..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................1......H.......d%.................................................................}......d}......}.....r...p(....}......}.....(.......(.....&..(......0..l.........o......{....s......{.....{....Yk.{.....{....Yk[..(.........(....k.Zi(........o.......(......o......o......0............{.....+...0..W..............,....}.......{........,....}......}......{.....{........,....{....}......(.......0............{.....+...0..F..........{........,....}.......}.....{.....{........,....{....

C:\Users\user\AppData\Local\Temp\IXP000.TMP\Newtonsoft.Json.dll

Download File

Process:	C:\Users\user\Desktop\MicrosoftDefaults.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	711952
Entropy (8bit):	5.96669864901384
Encrypted:	false
SSDEEP:	12288:WBARJBRZl/j1TbQ7n5WLm4k0X57ZYrgNHgK9C1BSjRlXP36RMGy1NqTU+:WBA/ZTvQD0XY0AJBSjRlXP36RMG7
MD5:	715A1FBEE4665E99E859EDA667FE8034
SHA1:	E13C6E4210043C4976DCDC447EA2B32854F70CC6
SHA-256:	C5C83BBC1741BE6FF4C490C0AEE34C162945423EC577C646538B2D21CE13199E
SHA-512:	BF9744CCB20F8205B2DE39DBE79D34497B4D5C19B353D0F95E87EA7EF7FA1784AEA87E10EFCEF11E4C90451EAA47A379204EB0533AA3018E378DD3511CE0E8AD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...D.}..........." ..0.................. ........... ....................... ............`.....................................O......................../.............T............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H.......d....9..................h.........................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..\|....(......._..{........+,..{\|....3...{{......(....,...{{.....{}.......-.....0...........-.r...ps....z.o......-.~.....~....

C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe

Download File

Process:	C:\Users\user\Desktop\MicrosoftDefaults.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	126344
Entropy (8bit):	6.179287465091944
Encrypted:	false
SSDEEP:	3072:PhQH/acyWvCNOXNq0v2Jnzzx1jmYJX+7v3TcvC:PhQHpfq0uX+r3Tcv
MD5:	E40AF81D67406FDCD7A1945F5CE454D6
SHA1:	73B62801DD70F1F07E50211DC6600D69D7FA9283
SHA-256:	542EBD9F73322FED135381535FFC04ECFFAD064CA749E325D19A8DDDEF7BDFA1
SHA-512:	BA92D96D1FCE1E1BE010313F4050B7C5C570CF7F7D37660837158837A75D5BE7A2B7876D0A76AB5716B400ECC067B5672CD499D1F47544D549BBD6C6755DC055
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'S.F=..F=..F=..->..F=..-8..F=..-9..F=..39..F=..3>..F=..38..F=..-<..F=..F<..F=..34..F=..3..F=..3?..F=.Rich.F=.........PE..L...xi.a.............................-............@......................................@....................................x........................#..............p...............................@...............@............................text...I........................... ..`.rdata..<...........................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.997448798348293
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	MicrosoftDefaults.exe
File size:	7778712
MD5:	23edddfd3f65c753ae87f4d3cf12a215
SHA1:	50df12f1a964abf7a6fc6b3ab10bff2608f49526
SHA256:	d5d6bdc891cf6365e8e738cb60878e54967ccad3e3954b2cd936341db05cd178
SHA512:	12efd73932fe89964d10638bd1dbec6c9ff48b8ad85f30e128b12b29d078ec5b4d501de621583c4ddeaa48e08ec2c76f96484e1dfd894e2b39c49f26ae07bf13
SSDEEP:	196608:Z6/i+wCP9Wxfwhjcb6D4TfqUFNi/iPMGdl0imuc:/OsxfYjcIGhiO9muc
TLSH:	4E763343EBE4C62FECF3427286E56B1744297E395864D7061D02A68F96B1384E121BFF
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........C...C...C.......B.......B.......W.......R...C...........J.....d.B.......B...RichC...................PE..L....s8............

File Icon


Icon Hash:	f8e0e4e8ecccc870

Static PE Info

General

Entrypoint:	0x406a00
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0xB9387306 [Thu Jun 21 06:07:02 2068 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	646167cce332c1c252cdcb1839e0cf48

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	5/12/2022 1:46:02 PM 5/11/2023 1:46:02 PM
Subject Chain	CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	D03E1ED3E72F64CC6C5A636BE32C29AD
Thumbprint SHA-1:	97221B97098F37A135DCC212E2B41E452BCE51F2
Thumbprint SHA-256:	AAE358FD90D5500110EE8BF3BD2C668F834559710DA7D75C266018BB9506F2F6
Serial:	33000002CDF364BFF8D44C5D510000000002CD

Entrypoint Preview

Instruction
call 00007FB0ACD54215h
jmp 00007FB0ACD53B15h
push 00000058h
push 00407268h
call 00007FB0ACD542B7h
xor ebx, ebx
mov dword ptr [ebp-20h], ebx
lea eax, dword ptr [ebp-68h]
push eax
call dword ptr [0040A184h]
mov dword ptr [ebp-04h], ebx
mov eax, dword ptr fs:[00000018h]
mov esi, dword ptr [eax+04h]
mov edi, ebx
mov edx, 004088ACh
mov ecx, esi
xor eax, eax
lock cmpxchg dword ptr [edx], ecx
test eax, eax
je 00007FB0ACD53B2Ah
cmp eax, esi
jne 00007FB0ACD53B19h
xor esi, esi
inc esi
mov edi, esi
jmp 00007FB0ACD53B22h
push 000003E8h
call dword ptr [0040A188h]
jmp 00007FB0ACD53AE9h
xor esi, esi
inc esi
cmp dword ptr [004088B0h], esi
jne 00007FB0ACD53B1Ch
push 0000001Fh
call 00007FB0ACD54045h
pop ecx
jmp 00007FB0ACD53B4Ch
cmp dword ptr [004088B0h], ebx
jne 00007FB0ACD53B3Eh
mov dword ptr [004088B0h], esi
push 004010C4h
push 004010B8h
call 00007FB0ACD53C70h
pop ecx
pop ecx
test eax, eax
je 00007FB0ACD53B29h
mov dword ptr [ebp-04h], FFFFFFFEh
mov eax, 000000FFh
jmp 00007FB0ACD53C49h
mov dword ptr [004081E4h], esi
cmp dword ptr [004088B0h], esi
jne 00007FB0ACD53B2Dh
push 004010B4h
push 004010ACh
call 00007FB0ACD54203h
pop ecx
pop ecx
mov dword ptr [000088B0h], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa28c	0xb4	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x760318	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x768a00	0x2798	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x76d000	0x888	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1410	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1008	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa000	0x288	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x62c4	0x6400	False	0.5751953125	data	6.303948380512371	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x8000	0x1a48	0x200	False	0.609375	data	4.970639543960129	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xa000	0x1052	0x1200	False	0.4136284722222222	data	5.020897034052699	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x760318	0x760400	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x76d000	0x888	0xa00	False	0.751171875	data	6.272863797862526	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
AVI	0xca10	0x2e1a	RIFF (little-endian) data, AVI, 272 x 60, 10.00 fps, video: RLE 8bpp	English	United States
RT_ICON	0xf82c	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States
RT_ICON	0xfe94	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States
RT_ICON	0x1017c	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	English	United States
RT_ICON	0x10364	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States
RT_ICON	0x1048c	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States
RT_ICON	0x11334	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States
RT_ICON	0x11bdc	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States
RT_ICON	0x122a4	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States
RT_ICON	0x1280c	0xd9d2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x201e0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States
RT_ICON	0x22788	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States
RT_ICON	0x23830	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States
RT_ICON	0x241b8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States
RT_DIALOG	0x24620	0x2f2	data	English	United States
RT_DIALOG	0x24914	0x1b0	data	English	United States
RT_DIALOG	0x24ac4	0x166	data	English	United States
RT_DIALOG	0x24c2c	0x1c0	data	English	United States
RT_DIALOG	0x24dec	0x130	data	English	United States
RT_DIALOG	0x24f1c	0x120	data	English	United States
RT_STRING	0x2503c	0x8c	Matlab v4 mat-file (little endian) l, numeric, rows 0, columns 0	English	United States
RT_STRING	0x250c8	0x520	data	English	United States
RT_STRING	0x255e8	0x5cc	data	English	United States
RT_STRING	0x25bb4	0x4b0	data	English	United States
RT_STRING	0x26064	0x44a	data	English	United States
RT_STRING	0x264b0	0x3ce	data	English	United States
RT_RCDATA	0x26880	0x7	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x26888	0x744862	Microsoft Cabinet archive data, many, 7620706 bytes, 11 files, at 0x2c +A "MEInstaller.exe" +A "Newtonsoft.Json.dll", ID 20375, number 1, 278 datablocks, 0x1503 compression	English	United States
RT_RCDATA	0x76b0ec	0x4	data	English	United States
RT_RCDATA	0x76b0f0	0x24	data	English	United States
RT_RCDATA	0x76b114	0x7	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x76b11c	0x7	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x76b124	0x4	data	English	United States
RT_RCDATA	0x76b128	0x7	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x76b130	0x4	data	English	United States
RT_RCDATA	0x76b134	0x15	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x76b14c	0x4	data	English	United States
RT_RCDATA	0x76b150	0x12	data	English	United States
RT_RCDATA	0x76b164	0x7	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x76b16c	0x7	ASCII text, with no line terminators	English	United States
RT_GROUP_ICON	0x76b174	0xbc	data	English	United States
RT_VERSION	0x76b230	0x4fc	data
RT_VERSION	0x76b72c	0x408	data	English	United States
RT_MANIFEST	0x76bb34	0x7e2	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
ADVAPI32.dll	GetTokenInformation, RegDeleteValueA, RegOpenKeyExA, RegQueryInfoKeyA, FreeSid, OpenProcessToken, RegSetValueExA, RegCreateKeyExA, LookupPrivilegeValueA, AllocateAndInitializeSid, RegQueryValueExA, EqualSid, RegCloseKey, AdjustTokenPrivileges
KERNEL32.dll	_lopen, _llseek, CompareStringA, GetLastError, GetFileAttributesA, GetSystemDirectoryA, LoadLibraryA, DeleteFileA, GlobalAlloc, GlobalFree, CloseHandle, WritePrivateProfileStringA, IsDBCSLeadByte, GetWindowsDirectoryA, SetFileAttributesA, GetProcAddress, GlobalLock, LocalFree, RemoveDirectoryA, FreeLibrary, _lclose, CreateDirectoryA, GetPrivateProfileIntA, GetPrivateProfileStringA, GlobalUnlock, ReadFile, SizeofResource, WriteFile, GetDriveTypeA, lstrcmpA, SetFileTime, SetFilePointer, FindResourceA, CreateMutexA, GetVolumeInformationA, ExpandEnvironmentStringsA, GetCurrentDirectoryA, FreeResource, GetVersion, SetCurrentDirectoryA, GetTempPathA, LocalFileTimeToFileTime, CreateFileA, SetEvent, TerminateThread, GetVersionExA, LockResource, GetSystemInfo, CreateThread, ResetEvent, LoadResource, ExitProcess, GetModuleHandleW, CreateProcessA, FormatMessageA, GetTempFileNameA, DosDateTimeToFileTime, CreateEventA, GetExitCodeProcess, FindNextFileA, LocalAlloc, GetShortPathNameA, MulDiv, GetDiskFreeSpaceA, EnumResourceLanguagesA, GetTickCount, GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, QueryPerformanceCounter, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetStartupInfoW, Sleep, FindClose, GetCurrentProcess, FindFirstFileA, WaitForSingleObject, GetModuleFileNameA, LoadLibraryExA
GDI32.dll	GetDeviceCaps
USER32.dll	SetWindowLongA, GetDlgItemTextA, DialogBoxIndirectParamA, ShowWindow, MsgWaitForMultipleObjects, SetWindowPos, GetDC, GetWindowRect, DispatchMessageA, GetDesktopWindow, CharUpperA, SetDlgItemTextA, ExitWindowsEx, MessageBeep, EndDialog, CharPrevA, LoadStringA, CharNextA, EnableWindow, ReleaseDC, SetForegroundWindow, PeekMessageA, GetDlgItem, SendMessageA, SendDlgItemMessageA, MessageBoxA, SetWindowTextA, GetWindowLongA, CallWindowProcA, GetSystemMetrics
msvcrt.dll	_controlfp, ?terminate@@YAXXZ, _acmdln, _initterm, __setusermatherr, _except_handler4_common, memcpy, _ismbblead, __p__fmode, _cexit, _exit, exit, __set_app_type, __getmainargs, _amsg_exit, __p__commode, _XcptFilter, memcpy_s, _vsnprintf, memset
COMCTL32.dll
Cabinet.dll
VERSION.dll	GetFileVersionInfoA, VerQueryValueA, GetFileVersionInfoSizeA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Report size exceeds maximum size, go to the download page of this report and download PCAP to see all network behavior.

Statistics

High Level Behavior Distribution

Click to dive into process behavior distribution

Disassembly

Reset < >

Analysis Process: MicrosoftDefaults.exePID: 6124, Parent PID: 3324COMMON

Non-executed Functions

Function 00F07105 Relevance: 7.6, APIs: 5, Instructions: 50
timethreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F07105() {
				void* _v8;
				struct _FILETIME _v16;
				signed int _v20;
				union _LARGE_INTEGER _v24;
				signed int _t23;
				signed int _t36;
				signed int _t37;
				signed int _t39;

				_v16.dwLowDateTime = _v16.dwLowDateTime & 0x00000000;
				_v16.dwHighDateTime = _v16.dwHighDateTime & 0x00000000;
				_t23 =  *0xf08004; // 0x9cce359
				if(_t23 == 0xbb40e64e || (0xffff0000 & _t23) == 0) {
					GetSystemTimeAsFileTime( &_v16);
					_v8 = _v16.dwHighDateTime ^ _v16.dwLowDateTime;
					_v8 = _v8 ^ GetCurrentProcessId();
					_v8 = _v8 ^ GetCurrentThreadId();
					_v8 = GetTickCount() ^ _v8 ^  &_v8;
					QueryPerformanceCounter( &_v24);
					_t36 = _v20 ^ _v24.LowPart ^ _v8;
					_t39 = _t36;
					if(_t36 == 0xbb40e64e || ( *0xf08004 & 0xffff0000) == 0) {
						_t36 = 0xbb40e64f;
						_t39 = 0xbb40e64f;
					}
					 *0xf08004 = _t39;
				}
				_t37 =  !_t36;
				 *0xf08008 = _t37;
				return _t37;
			}

0x00f0710d
0x00f07111
0x00f07115
0x00f07128
0x00f07132
0x00f0713e
0x00f07147
0x00f07150
0x00f07161
0x00f07168
0x00f07174
0x00f07177
0x00f0717b
0x00f07185
0x00f0718a
0x00f0718a
0x00f0718c
0x00f0718c
0x00f07192
0x00f07195
0x00f0719c

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00F07132
GetCurrentProcessId.KERNEL32 ref: 00F07141
GetCurrentThreadId.KERNEL32 ref: 00F0714A
GetTickCount.KERNEL32 ref: 00F07153
QueryPerformanceCounter.KERNEL32(?), ref: 00F07168

Memory Dump Source

Source File: 00000000.00000002.827436342.0000000000F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000000.00000002.827421073.0000000000F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.827453684.0000000000F08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.827463808.0000000000F0A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.827463808.0000000000F0C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f00000_MicrosoftDefaults.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 8c4264e73427159a6dbb72dacf7e3c1d81af2e27a63b2e6b448dd97ebbbdc80c
Instruction ID: 377c122d0f9f307dbbe9973ac7537fbab09747d9582d2df0238c7a6d37635d00
Opcode Fuzzy Hash: 8c4264e73427159a6dbb72dacf7e3c1d81af2e27a63b2e6b448dd97ebbbdc80c
Instruction Fuzzy Hash: 1C111571D01308EBCB10DFB8DA48A9EBBF5FF48354F6548A5E502E7294EA309A05AF45

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: StartupInstaller.exePID: 4472, Parent PID: 6124COMMON

Execution Graph

Execution Coverage:	3.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	12.8%
Total number of Nodes:	1353
Total number of Limit Nodes:	31

Executed Functions

Function 00F41150 Relevance: 43.1, APIs: 17, Strings: 7, Instructions: 1091
registrysynchronizationprocessCOMMONCrypto

Download Yara Rule

C-Code - Quality: 67%

			E00F41150(void* __ebx, void* __edx, void* __edi, void* __esi) {
				intOrPtr _v4;
				intOrPtr _v8;
				signed int _v12;
				char _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v76;
				char _v80;
				char _v84;
				intOrPtr _v88;
				int** _v92;
				char _v272;
				short _v800;
				short _v804;
				short _v806;
				char _v808;
				short _v820;
				short _v822;
				char _v824;
				char _v848;
				char _v868;
				signed int _v892;
				intOrPtr _v908;
				signed int _v928;
				signed int _v936;
				char _v1080;
				signed int _v1156;
				int* _v1160;
				struct _STARTUPINFOW _v1228;
				signed int _v1232;
				int** _v1240;
				signed int _v1248;
				int** _v1268;
				int _v1276;
				long _v1280;
				signed int _v1284;
				signed int _v1296;
				int* _v1300;
				signed int _v1304;
				int* _v1308;
				short _v1316;
				signed int _v1320;
				int* _v1324;
				int* _v1328;
				short _v1340;
				signed int _v1344;
				intOrPtr _v1348;
				struct _PROCESS_INFORMATION _v1364;
				signed int _v1368;
				int* _v1372;
				signed int _v1376;
				int* _v1380;
				intOrPtr _v1384;
				int* _v1388;
				signed int _v1392;
				short* _v1396;
				signed int _v1400;
				short* _v1404;
				signed int _v1408;
				int* _v1412;
				char _v1420;
				signed int _v1424;
				int* _v1428;
				int* _v1432;
				signed int _v1436;
				char _v1440;
				int* _v1444;
				signed int _v1448;
				int* _v1452;
				int* _v1456;
				signed int _v1460;
				int* _v1464;
				signed int _v1468;
				int* _v1472;
				intOrPtr _v1476;
				int* _v1480;
				int* _v1488;
				signed int _v1492;
				signed int _v1496;
				int** _v1500;
				int** _v1504;
				char _v1508;
				intOrPtr _v1516;
				signed int _v1520;
				signed int _v1564;
				unsigned int _v1568;
				signed int _v1580;
				unsigned int _v1584;
				unsigned int _v1588;
				signed int _v1600;
				short* _v1604;
				signed int _v1612;
				int* _v1624;
				intOrPtr _v1628;
				signed int _v1636;
				unsigned int _v1652;
				int* _v1660;
				signed int _t555;
				long _t561;
				long _t562;
				signed int _t563;
				signed int _t564;
				signed int _t566;
				signed int _t567;
				WCHAR* _t568;
				void* _t570;
				int** _t573;
				signed int _t579;
				signed int _t580;
				signed int _t585;
				signed int _t587;
				signed int _t591;
				signed int _t597;
				intOrPtr _t602;
				signed int _t607;
				int* _t615;
				signed int _t619;
				signed int _t631;
				unsigned int _t633;
				void* _t634;
				void* _t640;
				signed int _t651;
				signed int _t653;
				signed int _t655;
				signed int _t656;
				void* _t657;
				signed int _t659;
				signed int _t660;
				signed int _t677;
				unsigned int _t679;
				void* _t680;
				void* _t681;
				signed int _t683;
				intOrPtr _t686;
				signed int _t700;
				signed int _t701;
				void* _t704;
				void* _t705;
				signed int _t707;
				signed int _t708;
				signed int _t711;
				unsigned int _t713;
				signed int _t717;
				signed int _t718;
				signed int _t722;
				signed int _t727;
				signed int _t729;
				intOrPtr _t734;
				signed int _t736;
				signed int _t738;
				signed int _t745;
				signed int _t752;
				signed int _t759;
				signed short* _t761;
				signed int _t769;
				long _t773;
				intOrPtr _t778;
				signed int _t780;
				signed int _t781;
				short* _t786;
				short* _t788;
				signed int _t792;
				signed int _t795;
				int** _t798;
				intOrPtr _t802;
				intOrPtr _t806;
				signed int _t815;
				char _t818;
				signed int _t821;
				int* _t822;
				intOrPtr _t826;
				intOrPtr _t830;
				intOrPtr _t839;
				int* _t844;
				intOrPtr _t852;
				int* _t869;
				intOrPtr _t873;
				signed int _t877;
				signed char _t884;
				void* _t885;
				intOrPtr* _t886;
				signed int _t889;
				long _t893;
				void* _t894;
				signed int _t895;
				unsigned int _t897;
				signed int _t898;
				signed int* _t899;
				signed int _t910;
				int** _t915;
				signed int _t917;
				signed int _t923;
				signed int _t926;
				signed int _t927;
				signed int _t928;
				unsigned int _t929;
				signed int _t931;
				signed int _t932;
				void* _t940;
				int* _t952;
				void* _t954;
				void* _t957;
				void* _t958;
				signed int _t961;
				intOrPtr* _t962;
				signed int _t966;
				signed int _t969;
				signed short* _t971;
				signed int _t975;
				intOrPtr* _t982;
				intOrPtr* _t986;
				signed int _t993;
				signed int _t996;
				signed int _t1000;
				intOrPtr _t1003;
				intOrPtr _t1004;
				intOrPtr* _t1006;
				signed int _t1011;
				int* _t1013;
				int* _t1014;
				intOrPtr _t1015;
				intOrPtr _t1016;
				int* _t1017;
				int* _t1020;
				intOrPtr _t1021;
				void* _t1022;
				signed int _t1023;
				signed int _t1024;
				signed int _t1026;
				signed int _t1031;
				signed int _t1033;
				intOrPtr _t1034;
				unsigned int _t1036;
				signed int _t1037;
				signed int _t1038;
				intOrPtr* _t1041;
				signed short* _t1043;
				signed short* _t1044;
				void* _t1045;
				void* _t1046;
				signed int _t1047;
				signed int _t1048;
				signed int _t1049;
				signed int _t1050;
				signed int _t1051;
				signed int _t1054;
				signed int _t1055;
				void* _t1056;
				void* _t1057;
				intOrPtr* _t1058;
				void* _t1060;
				signed int _t1061;
				signed int _t1062;
				void* _t1063;
				void* _t1064;
				void* _t1065;
				void* _t1066;
				void* _t1067;
				int* _t1069;
				void* _t1070;
				void* _t1071;
				signed int _t1072;
				signed int _t1074;
				signed int _t1076;
				void* _t1077;
				int** _t1078;
				void* _t1079;
				signed int _t1080;
				unsigned int _t1081;
				signed int _t1082;
				signed int _t1090;
				unsigned int _t1093;
				intOrPtr _t1097;
				void* _t1098;
				void* _t1100;
				short* _t1101;
				signed int _t1106;
				void* _t1107;
				void* _t1108;
				int** _t1109;
				signed int _t1111;
				signed int _t1113;
				short* _t1114;
				unsigned int _t1115;
				signed int _t1117;
				void* _t1119;
				signed int _t1121;
				signed int _t1131;
				void* _t1133;
				void* _t1135;
				void* _t1138;
				signed int _t1139;
				void* _t1141;
				signed int _t1145;
				signed int _t1148;
				void* _t1150;
				void* _t1151;
				void* _t1152;
				signed int _t1164;
				signed int _t1166;
				signed int _t1167;
				signed int _t1171;
				void* _t1172;
				void* _t1178;
				void* _t1179;
				void* _t1180;
				void* _t1181;

				_t1075 = __edi;
				_t1029 = __edx;
				_t894 = __ebx;
				_push("string too long");
				E00F429DA(__ebx, __edx, __edi, __esi);
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_t1145 = _t1164;
				_t1166 = (_t1164 & 0xfffffff0) - 0x568;
				_t555 =  *0xf5c004; // 0x6a58fef8
				_v12 = _t555 ^ _t1166;
				_push(__esi);
				_push(__edi);
				_v1276 = 0;
				_v1228.wShowWindow = 4;
				E00F43E50(__edi,  &_v272, 0, 0xff);
				_t1167 = _t1166 + 0xc;
				_v1228.dwFillAttribute = 0xffffffff;
				_v1228.dwFlags = 0xff;
				CreateMutexW(0, 0, L"// {9D255ADC-2EB7-47F7-8DE0-7B2F4F9D9EB2}"); // executed
				_t561 = RegOpenKeyW(0x80000002, L"SOFTWARE\\Microsoft\\NET Framework Setup\\NDP\\v4\\Full",  &_v1276); // executed
				if(_t561 != 0) {
					L92:
					_t562 = GetLastError();
					__eflags = _t562 - 0xb7;
					if(_t562 != 0xb7) {
						L138();
						__eflags = _v1228.dwXSize - 8;
						_t563 =  &(_v1228.lpReserved);
						_t1076 = StrCmpIW;
						_v1388 = _t563;
						if(_v1228.dwXSize < 8) {
							L97:
							_t1106 = 0;
							asm("o16 nop [eax+eax]");
							while(1) {
								_t564 =  *_t1076(_t563,  *((intOrPtr*)(0xf5a510 + _t1106 * 8)));
								__eflags = _t564;
								if(_t564 == 0) {
									break;
								}
								_t563 = _v1396;
								_t1106 = _t1106 + 1;
								__eflags = _t1106 - 0x5f;
								if(_t1106 < 0x5f) {
									continue;
								} else {
									_t1044 = _v1396;
									__eflags = 0;
									_v808 = 0;
									_t975 = 0x3fffffff;
									_v804 = 0;
									_t761 = _t1044;
									while(1) {
										__eflags =  *_t761;
										if( *_t761 == 0) {
											break;
										}
										_t761 =  &(_t761[1]);
										_t975 = _t975 - 1;
										__eflags = _t975;
										if(_t975 != 0) {
											continue;
										}
										break;
									}
									__eflags = _t975;
									if(_t975 == 0) {
										goto L96;
									} else {
										_t763 = 0x3fffffff - _t975;
										asm("sbb ecx, ecx");
										__eflags = ( ~_t975 & 0x3fffffff - _t975 + _t763) - 2;
										if(( ~_t975 & 0x3fffffff - _t975 + _t763) <= 2) {
											goto L96;
										} else {
											_v808 =  *_t1044 & 0x0000ffff;
											_v806 = _t1044[1] & 0x0000ffff;
											_v804 = 0;
											_t1106 = 0;
											__eflags = 0;
											while(1) {
												_t769 =  *_t1076( &_v808,  *((intOrPtr*)(0xf5a510 + _t1106 * 8)));
												__eflags = _t769;
												if(_t769 == 0) {
													break;
												}
												_t1106 = _t1106 + 1;
												__eflags = _t1106 - 0x5f;
												if(_t1106 < 0x5f) {
													continue;
												} else {
													_v1404 = L"StartupInstaller.exe - This installer could not be started.";
												}
												goto L111;
											}
											_v1404 =  *((intOrPtr*)(0xf5a514 + _t1106 * 8));
										}
									}
								}
								goto L111;
							}
							_v1396 =  *((intOrPtr*)(0xf5a514 + _t1106 * 8));
						} else {
							_t563 = _v1228.lpReserved;
							_v1388 = _t563;
							__eflags = _t563;
							if(_t563 != 0) {
								goto L97;
							} else {
								L96:
								_v1396 = L"StartupInstaller.exe - This installer could not be started.";
							}
						}
						L111:
						__eflags = _v1228.dwX - 8;
						_t566 =  &_v1232;
						_v1392 = _t566;
						if(_v1228.dwX < 8) {
							L114:
							_t1106 = 0;
							__eflags = 0;
							while(1) {
								_t567 =  *_t1076(_t566,  *((intOrPtr*)(0xf5a218 + _t1106 * 8)));
								__eflags = _t567;
								if(_t567 == 0) {
									break;
								}
								_t566 = _v1400;
								_t1106 = _t1106 + 1;
								__eflags = _t1106 - 0x5f;
								if(_t1106 < 0x5f) {
									continue;
								} else {
									_t1043 = _v1400;
									__eflags = 0;
									_v824 = 0;
									_t971 = _t1043;
									_v820 = 0;
									_t752 = 0x3fffffff;
									while(1) {
										__eflags =  *_t971;
										if( *_t971 == 0) {
											break;
										}
										_t971 =  &(_t971[1]);
										_t752 = _t752 - 1;
										__eflags = _t752;
										if(_t752 != 0) {
											continue;
										}
										break;
									}
									__eflags = _t752;
									if(_t752 == 0) {
										L125:
										_t568 = L"This installer requires .Net Framework v4.6 or higher. Please install the required .Net Framework and then try to install Enhance Microsoft Edge.\n\nDo you want to install this .Net Framework version now?";
									} else {
										_t973 = 0x3fffffff - _t752;
										asm("sbb eax, eax");
										__eflags = ( ~_t752 & 0x3fffffff - _t752 + _t973) - 2;
										if(( ~_t752 & 0x3fffffff - _t752 + _t973) <= 2) {
											goto L125;
										} else {
											_v824 =  *_t1043 & 0x0000ffff;
											_v822 = _t1043[1] & 0x0000ffff;
											_v820 = 0;
											_t1106 = 0;
											__eflags = 0;
											while(1) {
												_t759 =  *_t1076( &_v824,  *((intOrPtr*)(0xf5a218 + _t1106 * 8)));
												__eflags = _t759;
												if(_t759 == 0) {
													goto L126;
												}
												_t1106 = _t1106 + 1;
												__eflags = _t1106 - 0x5f;
												if(_t1106 < 0x5f) {
													continue;
												} else {
													goto L125;
												}
												goto L127;
											}
											break;
										}
									}
								}
								goto L127;
							}
							L126:
							_t568 =  *(0xf5a21c + _t1106 * 8);
						} else {
							_t566 = _v1232;
							_v1392 = _t566;
							__eflags = _t566;
							if(_t566 != 0) {
								goto L114;
							} else {
								_t568 = L"This installer requires .Net Framework v4.6 or higher. Please install the required .Net Framework and then try to install Enhance Microsoft Edge.\n\nDo you want to install this .Net Framework version now?";
							}
						}
						L127:
						_t570 = MessageBoxW(0, _t568, _v1404, 0x31) - 1;
						__eflags = _t570;
						if(_t570 == 0) {
							ShellExecuteW(_t570, L"open", L"https://go.microsoft.com/fwlink/?linkid=2134832", _t570, _t570, 1);
						}
						_t1030 = _v1228.lpDesktop;
						__eflags = _t1030 - 8;
						if(_t1030 < 8) {
							goto L133;
						} else {
							_t915 = _v1240;
							_t1030 = 2 + _t1030 * 2;
							_t573 = _t915;
							__eflags = _t1030 - 0x1000;
							if(_t1030 < 0x1000) {
								goto L132;
							} else {
								_t915 =  *(_t915 - 4);
								_t1030 = _t1030 + 0x23;
								__eflags = _t573 - _t915 + 0xfffffffc - 0x1f;
								if(__eflags > 0) {
									goto L137;
								} else {
									goto L132;
								}
							}
						}
					} else {
						_pop(_t1098);
						_pop(_t1138);
						__eflags = _v12 ^ _t1167;
						return E00F429FA(0, _t894, _v12 ^ _t1167, _t1029, _t1098, _t1138);
					}
				} else {
					_t773 = RegOpenKeyW(0x80000002, L"SOFTWARE\\Microsoft\\NET Framework Setup\\NDP\\v4\\Full",  &_v1276); // executed
					if(_t773 != 0) {
						L4:
						_push(0);
						_push(0xf53a68);
						_v1228.lpReserved2 = 0;
						_v1160 = 0;
						_v1156 = 7;
						L190();
						E00F43E50(_t1075,  &_v800, 0, 0x208);
						_t1167 = _t1167 + 0xc;
						GetModuleFileNameW(0,  &_v800, 0x104);
						_t982 =  &_v800;
						_v1388 = 0;
						_v1372 = 0;
						_t1045 = _t982 + 2;
						_v1368 = 7;
						do {
							_t778 =  *_t982;
							_t982 = _t982 + 2;
						} while (_t778 != 0);
						_push(_t982 - _t1045 >> 1);
						_push( &_v800);
						L190();
						_t1139 = _v1380;
						_t1076 =  >=  ? _v1396 :  &_v1396;
						if(_t1139 == 0) {
							L22:
							_t1106 = _t1139 | 0xffffffff;
							__eflags = _t1106;
						} else {
							E00F43E50(_t1076,  &_v1080, 0, 0x100);
							_t1167 = _t1167 + 0xc;
							_t1023 = L"\\/";
							while(1) {
								_t884 =  *_t1023 & 0x0000ffff;
								if(_t884 >= 0x100) {
									break;
								}
								_t1023 = _t1023 + 2;
								 *((char*)(_t1167 + (_t884 & 0x000000ff) + 0x150)) = 1;
								if(_t1023 != 0xf5a1c8) {
									continue;
								} else {
									_t33 = _t1139 - 1; // -1
									_t1028 =  <  ? _t33 : _t1023 | 0xffffffff;
									_t1139 = _t1076 + ( <  ? _t33 : _t1023 | 0xffffffff) * 2;
									while(1) {
										_t889 =  *_t1139 & 0x0000ffff;
										if(_t889 < 0x100 &&  *((char*)(_t1167 + _t889 + 0x150)) != 0) {
											break;
										}
										if(_t1139 == _t1076) {
											goto L22;
										} else {
											_t1139 = _t1139 - 2;
											continue;
										}
										goto L23;
									}
									L21:
									_t1106 = _t1139 - _t1076 >> 1;
								}
								goto L23;
							}
							_t38 = _t1139 - 1; // -1
							_t885 = _t38;
							_t1024 = _t1023 | 0xffffffff;
							__eflags = _t885 - _t1024;
							_t1025 =  <  ? _t885 : _t1024;
							_t1139 = _t1076 + ( <  ? _t885 : _t1024) * 2;
							while(1) {
								L16:
								_t1074 =  *_t1139 & 0x0000ffff;
								_t1026 = 2;
								_t886 = L"\\/";
								while(1) {
									__eflags =  *_t886 - _t1074;
									if( *_t886 == _t1074) {
										goto L21;
									}
									_t886 = _t886 + 2;
									_t1026 = _t1026 - 1;
									__eflags = _t1026;
									if(_t1026 != 0) {
										continue;
									} else {
										__eflags = _t1139 - _t1076;
										if(_t1139 == _t1076) {
											goto L22;
										} else {
											_t1139 = _t1139 - 2;
											goto L16;
										}
									}
									goto L23;
								}
								goto L21;
							}
						}
						L23:
						_t780 = _v1376;
						__eflags = _t780 - 8;
						if(_t780 < 8) {
							L27:
							_t986 =  &_v808;
							_v1396 = 0;
							_v1380 = 0;
							_t1046 = _t986 + 2;
							_v1376 = 7;
							do {
								_t781 =  *_t986;
								_t986 = _t986 + 2;
								__eflags = _t781;
							} while (_t781 != 0);
							_push(_t986 - _t1046 >> 1);
							_push( &_v808);
							L190();
							__eflags = _v1388 - _t1106;
							_v1344 = 0;
							_t1106 =  <  ? _v1388 : _t1106;
							__eflags = _v1384 - 8;
							_push(_t1106);
							_t784 =  >=  ? _v1404 :  &_v1404;
							_push( >=  ? _v1404 :  &_v1404);
							_v1328 = 0;
							_v1324 = 7;
							L190();
							_t1047 = _v1228.dwFillAttribute;
							__eflags = _t1047 - 8;
							if(_t1047 < 8) {
								L33:
								asm("movaps xmm0, [esp+0x50]");
								_t1048 = _v1392;
								asm("movaps [esp+0xe0], xmm0");
								asm("movq xmm0, [esp+0x60]");
								asm("movq [esp+0xf0], xmm0");
								__eflags = _t1048 - 8;
								if(_t1048 < 8) {
									L37:
									_push(1);
									_push("\\");
									_v1412 = 0;
									_v1396 = 0;
									_v1392 = 7;
									L190();
									__eflags = _v1340 - 8;
									_t993 =  >=  ? _v1364.hThread :  &(_v1228.lpTitle);
									_t1076 = _v1404;
									_t786 = _v1400 - _t1076;
									_t1106 = _v1344;
									_v1424 = _t993;
									__eflags = _t1106 - _t786;
									if(_t1106 > _t786) {
										_push(_t1106);
										_push(_t993);
										_push(_t993);
										_v848 = 0;
										_push(_v848);
										_push(_t1106);
										L269();
									} else {
										__eflags = _v1400 - 8;
										_v1404 = _t1106 + _t1076;
										_t1069 =  >=  ? _v1420 :  &_v1420;
										_t852 = _t1106 + _t1106;
										_v848 = _t852;
										_t1101 = _t1076 + _t1076;
										_v1428 = _t1069;
										_v1396 = _t1101;
										__eflags = _t852 + _t993 - _t1069;
										if(_t852 + _t993 <= _t1069) {
											L43:
											_t1076 = _t1106;
										} else {
											__eflags = _t993 - _t1069 + _t1101;
											if(_t993 > _t1069 + _t1101) {
												goto L43;
											} else {
												__eflags = _t1069 - _t993;
												if(_t1069 > _t993) {
													_t1076 = _t1069 - _t993 >> 1;
												} else {
													_t1076 = 0;
												}
											}
										}
										E00F452B0(_v848 + _t1069, _t1069,  &(_v1396[1]));
										_t1106 = _t1076 + _t1076;
										E00F452B0(_v1428, _v1424, _t1106);
										E00F452B0(_v1428 + _t1106, _v1424 + (_t1076 + _v1344) * 2, _v1344 - _t1076 + _v1344 - _t1076);
										_t1167 = _t1167 + 0x24;
										_t786 =  &_v1420;
									}
									asm("movups xmm0, [eax]");
									asm("movups [esp+0x30], xmm0");
									asm("movq xmm0, [eax+0x10]");
									asm("movq [esp+0x40], xmm0");
									 *(_t786 + 0x10) = 0;
									 *(_t786 + 0x14) = 7;
									 *_t786 = 0;
									_t1049 = _v1392;
									_t996 = _v1396;
									_t788 = _t1049 - _t996;
									__eflags = _t788 - 0xf;
									if(_t788 < 0xf) {
										_push(0xf);
										_push(L"MEInstaller.exe");
										_v868 = 0;
										_push(_v868);
										_push(0xf);
										L216();
									} else {
										__eflags = _t1049 - 8;
										_t1106 =  >=  ? _v1412 :  &_v1412;
										_t1076 = _t996 + 0xf;
										_v1396 = _t1076;
										E00F452B0(_t1106 + _t996 * 2, L"MEInstaller.exe", 0x1e);
										_t1167 = _t1167 + 0xc;
										 *((short*)(_t1106 + _t1076 * 2)) = 0;
										_t788 =  &_v1412;
									}
									asm("movups xmm0, [eax]");
									asm("movups [esp+0xb0], xmm0");
									asm("movq xmm0, [eax+0x10]");
									asm("movq [esp+0xc0], xmm0");
									 *(_t788 + 0x10) = 0;
									 *(_t788 + 0x14) = 7;
									 *_t788 = 0;
									_t1050 = _v1408;
									__eflags = _t1050 - 8;
									if(_t1050 < 8) {
										L53:
										_t1051 = _v1436;
										_v1412 = 0;
										_v1408 = 7;
										_v1428 = 0;
										__eflags = _t1051 - 8;
										if(_t1051 < 8) {
											L57:
											_push(0);
											_push(0xf53a68);
											_v1324 = 0;
											_v1308 = 0;
											_v1304 = 7;
											L190();
											_t792 = CommandLineToArgvW(GetCommandLineW(),  &_v1276);
											_t1000 = _v1284;
											_t1076 = _t792;
											_v892 = _t1076;
											__eflags = _t1000 - 1;
											if(_t1000 <= 1) {
												L78:
												__eflags = _v1320 - 8;
												_v1228.cb = 0x44;
												asm("xorps xmm0, xmm0");
												_t1002 =  >=  ? _v1340 :  &_v1340;
												__eflags = _v1296 - 8;
												_t794 =  >=  ? _v1316 :  &_v1316;
												asm("movlpd [esp+0x134], xmm0");
												asm("movlpd [esp+0x13c], xmm0");
												asm("movlpd [esp+0x144], xmm0");
												asm("movlpd [esp+0x14c], xmm0");
												asm("movlpd [esp+0x154], xmm0");
												asm("movlpd [esp+0x15c], xmm0");
												asm("movlpd [esp+0x164], xmm0");
												asm("movlpd [esp+0x16c], xmm0");
												asm("movaps [esp+0xa8], xmm0"); // executed
												_t795 = CreateProcessW( >=  ? _v1316 :  &_v1316,  >=  ? _v1340 :  &_v1340, 0, 0, 0, 0, 0, 0,  &_v1228,  &_v1364); // executed
												__eflags = _t795;
												if(_t795 != 0) {
													WaitForSingleObject(_v1364.hProcess, 0xffffffff);
													GetExitCodeProcess(_v1364.hProcess,  &_v1280);
													_t1106 = CloseHandle;
													CloseHandle(_v1364.hThread);
													CloseHandle(_v1364);
												}
												_t1054 = _v1320;
												__eflags = _t1054 - 8;
												if(_t1054 < 8) {
													L84:
													_t1055 = _v1296;
													_v1324 = 0;
													_v1320 = 7;
													_v1340 = 0;
													__eflags = _t1055 - 8;
													if(_t1055 < 8) {
														L88:
														_t1030 = _v1248;
														_v1300 = 0;
														_v1296 = 7;
														_v1316 = 0;
														__eflags = _t1030 - 8;
														if(_t1030 < 8) {
															L133:
															_pop(_t1077);
															_pop(_t1107);
															__eflags = _v28 ^ _t1167;
															return E00F429FA(_v1228.dwXSize, _t894, _v28 ^ _t1167, _t1030, _t1077, _t1107);
														} else {
															_t915 = _v1268;
															_t1030 = 2 + _t1030 * 2;
															_t798 = _t915;
															__eflags = _t1030 - 0x1000;
															if(_t1030 < 0x1000) {
																L132:
																_push(_t1030);
																E00F42B5A(_t915);
																_t1167 = _t1167 + 8;
																goto L133;
															} else {
																_t915 =  *(_t915 - 4);
																_t1030 = _t1030 + 0x23;
																__eflags = _t798 - _t915 + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	goto L136;
																} else {
																	goto L132;
																}
															}
														}
													} else {
														_t1003 = _v1316;
														_t1056 = 2 + _t1055 * 2;
														_t802 = _t1003;
														__eflags = _t1056 - 0x1000;
														if(_t1056 < 0x1000) {
															L87:
															_push(_t1056);
															E00F42B5A(_t1003);
															_t1167 = _t1167 + 8;
															goto L88;
														} else {
															_t915 =  *(_t1003 - 4);
															_t1030 = _t1056 + 0x23;
															__eflags = _t802 - _t915 + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																goto L136;
															} else {
																goto L87;
															}
														}
													}
												} else {
													_t1004 = _v1340;
													_t1057 = 2 + _t1054 * 2;
													_t806 = _t1004;
													__eflags = _t1057 - 0x1000;
													if(_t1057 < 0x1000) {
														L83:
														_push(_t1057);
														E00F42B5A(_t1004);
														_t1167 = _t1167 + 8;
														goto L84;
													} else {
														_t915 =  *(_t1004 - 4);
														_t1030 = _t1057 + 0x23;
														__eflags = _t806 - _t915 + 0xfffffffc - 0x1f;
														if(__eflags > 0) {
															goto L136;
														} else {
															goto L83;
														}
													}
												}
											} else {
												_t1106 = 0;
												_v1476 = 0;
												__eflags = _t1000;
												if(_t1000 > 0) {
													do {
														_push(1);
														_push(" ");
														_v1444 = 0;
														_v1428 = 0;
														_v1424 = 7;
														L190();
														_t1058 =  *((intOrPtr*)(_t1076 + _t1106 * 4));
														_t1006 = _t1058;
														_v1480 = 0;
														_v1464 = 0;
														_v1460 = 7;
														_t1100 = _t1006 + 2;
														do {
															_t815 =  *_t1006;
															_t1006 = _t1006 + 2;
															__eflags = _t815;
														} while (_t815 != 0);
														_push(_t1006 - _t1100 >> 1);
														_push(_t1058);
														L190();
														_push( &_v1460);
														_push( &_v1488);
														_push(_v908);
														L238();
														__eflags = _v1420 - 8;
														_t818 = _v1440;
														_t1076 = _v1364.dwThreadId;
														_t1060 =  >=  ? _t818 :  &_v1440;
														_t1011 = _v1424;
														_v1476 = _t818;
														_v928 = _t1076;
														__eflags = _t1011 - _v1348 - _t1076;
														if(_t1011 > _v1348 - _t1076) {
															_push(_t1011);
															_push(_t1060);
															_v1508 = 0;
															_push(_v1508);
															_push(_t1011);
															L216();
															_t1013 = _v1456;
														} else {
															_t1076 = _t1076 + _t1011;
															__eflags = _v1348 - 8;
															_t1141 =  >=  ? _v1368 :  &_v1368;
															_v1364.dwThreadId = _t1076;
															E00F452B0(_t1141 + _v928 * 2, _t1060, _t1011 + _t1011);
															_t1013 = _v1476;
															_t1167 = _t1167 + 0xc;
															 *((short*)(_t1141 + _t1076 * 2)) = 0;
															_t1106 = _v1504;
														}
														_t821 = _v1436;
														__eflags = _t821 - 8;
														if(_t821 < 8) {
															L69:
															_t1061 = _v1496;
															__eflags = _t1061 - 8;
															if(_t1061 < 8) {
																L73:
																_t1062 = _v1468;
																__eflags = _t1062 - 8;
																if(_t1062 < 8) {
																	goto L77;
																} else {
																	_t1014 = _v1488;
																	_t1063 = 2 + _t1062 * 2;
																	_t822 = _t1014;
																	__eflags = _t1063 - 0x1000;
																	if(_t1063 < 0x1000) {
																		L76:
																		_push(_t1063);
																		E00F42B5A(_t1014);
																		_t1167 = _t1167 + 8;
																		goto L77;
																	} else {
																		_t915 =  *(_t1014 - 4);
																		_t1030 = _t1063 + 0x23;
																		__eflags = _t822 - _t915 + 0xfffffffc - 0x1f;
																		if(__eflags > 0) {
																			goto L136;
																		} else {
																			goto L76;
																		}
																	}
																}
															} else {
																_t1015 = _v1516;
																_t1064 = 2 + _t1061 * 2;
																_t826 = _t1015;
																__eflags = _t1064 - 0x1000;
																if(_t1064 < 0x1000) {
																	L72:
																	_push(_t1064);
																	E00F42B5A(_t1015);
																	_t1167 = _t1167 + 8;
																	goto L73;
																} else {
																	_t915 =  *(_t1015 - 4);
																	_t1030 = _t1064 + 0x23;
																	__eflags = _t826 - _t915 + 0xfffffffc - 0x1f;
																	if(__eflags > 0) {
																		goto L136;
																	} else {
																		goto L72;
																	}
																}
															}
														} else {
															_t1065 = 2 + _t821 * 2;
															_t830 = _t1013;
															__eflags = _t1065 - 0x1000;
															if(_t1065 < 0x1000) {
																L68:
																_push(_t1065);
																E00F42B5A(_t1013);
																_t1167 = _t1167 + 8;
																goto L69;
															} else {
																_t915 =  *(_t1013 - 4);
																_t1030 = _t1065 + 0x23;
																__eflags = _t830 - _t915 + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	goto L136;
																} else {
																	goto L68;
																}
															}
														}
														goto L293;
														L77:
														_t1076 = _v936;
														_t1106 = _t1106 + 1;
														_v1520 = _t1106;
														__eflags = _t1106 - _v1328;
													} while (_t1106 < _v1328);
												}
												goto L78;
											}
										} else {
											_t1016 = _v1456;
											_t1066 = 2 + _t1051 * 2;
											_t839 = _t1016;
											__eflags = _t1066 - 0x1000;
											if(_t1066 < 0x1000) {
												L56:
												_push(_t1066);
												E00F42B5A(_t1016);
												_t1167 = _t1167 + 8;
												goto L57;
											} else {
												_t915 =  *(_t1016 - 4);
												_t1030 = _t1066 + 0x23;
												__eflags = _t839 - _t915 + 0xfffffffc - 0x1f;
												if(__eflags > 0) {
													goto L135;
												} else {
													goto L56;
												}
											}
										}
									} else {
										_t1017 = _v1428;
										_t1067 = 2 + _t1050 * 2;
										_t844 = _t1017;
										__eflags = _t1067 - 0x1000;
										if(_t1067 < 0x1000) {
											L52:
											_push(_t1067);
											E00F42B5A(_t1017);
											_t1167 = _t1167 + 8;
											goto L53;
										} else {
											_t915 =  *(_t1017 - 4);
											_t1030 = _t1067 + 0x23;
											__eflags = _t844 - _t915 + 0xfffffffc - 0x1f;
											if(__eflags > 0) {
												goto L135;
											} else {
												goto L52;
											}
										}
									}
								} else {
									_t1020 = _v1412;
									_t1070 = 2 + _t1048 * 2;
									_t869 = _t1020;
									__eflags = _t1070 - 0x1000;
									if(_t1070 < 0x1000) {
										L36:
										_push(_t1070);
										E00F42B5A(_t1020);
										_t1167 = _t1167 + 8;
										goto L37;
									} else {
										_t915 =  *(_t1020 - 4);
										_t1030 = _t1070 + 0x23;
										__eflags = _t869 - _t915 + 0xfffffffc - 0x1f;
										if(__eflags > 0) {
											goto L136;
										} else {
											goto L36;
										}
									}
								}
							} else {
								_t1021 = _v1228.dwY;
								_t1071 = 2 + _t1047 * 2;
								_t873 = _t1021;
								__eflags = _t1071 - 0x1000;
								if(_t1071 < 0x1000) {
									L32:
									_push(_t1071);
									E00F42B5A(_t1021);
									_t1167 = _t1167 + 8;
									goto L33;
								} else {
									_t915 =  *(_t1021 - 4);
									_t1030 = _t1071 + 0x23;
									__eflags = _t873 - _t915 + 0xfffffffc - 0x1f;
									if(__eflags > 0) {
										goto L136;
									} else {
										goto L32;
									}
								}
							}
						} else {
							_t1072 = _v1396;
							_t1022 = 2 + _t780 * 2;
							_t877 = _t1072;
							__eflags = _t1022 - 0x1000;
							if(_t1022 < 0x1000) {
								L26:
								_push(_t1022);
								E00F42B5A(_t1072);
								_t1167 = _t1167 + 8;
								goto L27;
							} else {
								_t1030 =  *(_t1072 - 4);
								_t915 = _t1022 + 0x23;
								__eflags = _t877 -  *(_t1072 - 4) + 0xfffffffc - 0x1f;
								if(__eflags > 0) {
									E00F45BE3(_t894, _t915, _t1030, __eflags);
									L135:
									E00F45BE3(_t894, _t915, _t1030, __eflags);
									L136:
									E00F45BE3(_t894, _t915, _t1030, __eflags);
									L137:
									E00F45BE3(_t894, _t915, _t1030, __eflags);
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									_t895 = _t1167;
									_t1171 = (_t1167 - 0x00000008 & 0xfffffff8) + 4;
									_v1424 =  *(_t895 + 4);
									_t1148 = _t1171;
									_t1172 = _t1171 - 0x40;
									_t579 =  *0xf5c004; // 0x6a58fef8
									_t580 = _t579 ^ _t1148;
									_v1448 = _t580;
									 *[fs:0x0] =  &_v1440;
									_t1078 = _t915;
									_v1504 = _t1078;
									_v1500 = _t1078;
									_v1488 = 0;
									_v1500 = _t1078;
									_v1464 = 0;
									_v1492 = 0;
									_v1472 = 0;
									_v1468 = 7;
									_v1488 = 0;
									L190();
									_v1432 = 0;
									__imp__GetUserPreferredUILanguages(8,  &_v1464, 0,  &_v1492, 0xf53a68, 0, _t580, _t1076, _t1106, _t895,  *[fs:0x0], 0xf4e605, 0xffffffff, _t1145, _t894);
									_t585 = _v1492;
									_t917 = 0;
									_v1452 = 0;
									asm("xorps xmm0, xmm0");
									asm("movq [ebp-0x20], xmm0");
									_v1460 = 0;
									_v1456 = 0;
									_v1452 = 0;
									_v1496 = _t585;
									__eflags = _t585;
									if(_t585 == 0) {
										L148:
										_v20 = 1;
										_t587 =  &_v52;
										__imp__GetUserPreferredUILanguages(8, _t587, _t917,  &_v80);
										__eflags = _t587;
										if(_t587 == 0) {
											L166:
											_push(5);
											 *_t1078 = 0;
											_t1078[4] = 0;
											_t1078[5] = 7;
											_push(L"en-us");
											 *_t1078 = 0;
											L190();
											_t1031 = _v48;
											__eflags = _t1031;
											if(_t1031 == 0) {
												L170:
												_t1032 = _v56;
												__eflags = _t1032 - 8;
												if(_t1032 < 8) {
													goto L165;
												} else {
													_t923 = _v76;
													_t1032 = 2 + _t1032 * 2;
													_t591 = _t923;
													__eflags = _t1032 - 0x1000;
													if(_t1032 < 0x1000) {
														goto L164;
													} else {
														_t923 =  *(_t923 - 4);
														_t1032 = _t1032 + 0x23;
														__eflags = _t591 - _t923 + 0xfffffffc - 0x1f;
														if(__eflags <= 0) {
															goto L164;
														} else {
															goto L173;
														}
													}
												}
											} else {
												_t722 = _t1031;
												_t961 = _v40 - _t1031 & 0xfffffffe;
												__eflags = _t961 - 0x1000;
												if(_t961 < 0x1000) {
													L169:
													_push(_t961);
													E00F42B5A(_t1031);
													_t1172 = _t1172 + 8;
													_v48 = 0;
													_v44 = 0;
													_v40 = 0;
													goto L170;
												} else {
													_t1032 =  *(_t1031 - 4);
													_t923 = _t961 + 0x23;
													__eflags = _t722 -  *(_t1031 - 4) + 0xfffffffc - 0x1f;
													if(__eflags > 0) {
														goto L173;
													} else {
														goto L169;
													}
												}
											}
										} else {
											_t1041 = _v48;
											_t727 = _v44 - _t1041;
											__eflags = _t727;
											if(_t727 == 0) {
												goto L166;
											} else {
												__eflags = _v52;
												if(_v52 <= 0) {
													goto L166;
												} else {
													_t962 = _t1041;
													_t1135 = _t962 + 2;
													do {
														_t729 =  *_t962;
														_t962 = _t962 + 2;
														__eflags = _t729;
													} while (_t729 != 0);
													_push(_t962 - _t1135 >> 1);
													_push(_t1041);
													L190();
													__eflags = _v56 - 8;
													_t966 = _v76;
													_t731 =  >=  ? _t966 :  &_v76;
													_v84 =  >=  ? _t966 :  &_v76;
													_t733 =  >=  ? _t966 :  &_v76;
													_t734 = ( >=  ? _t966 :  &_v76) + _v60 * 2;
													_v88 = _t734;
													_t1106 =  >=  ? _t966 :  &_v76;
													__eflags = _t1106 - _t734;
													if(_t1106 != _t734) {
														_t345 =  &_v84;
														 *_t345 = _v84 - _t1106;
														__eflags =  *_t345;
														_t1097 = _v84;
														do {
															 *((short*)(_t1097 + _t1106)) = E00F459F7( *_t1106 & 0x0000ffff);
															_t1172 = _t1172 + 4;
															_t1106 = _t1106 + 2;
															__eflags = _t1106 - _v88;
														} while (_t1106 != _v88);
														_t1078 = _v92;
													}
													__eflags = _v60;
													if(_v60 == 0) {
														goto L166;
													} else {
														asm("movups xmm0, [ebp-0x3c]");
														_t1032 = _v48;
														 *_t1078 = 0;
														_t1078[4] = 0;
														_t1078[5] = 0;
														_v76 = 0;
														asm("movups [edi], xmm0");
														asm("movq xmm0, [ebp-0x2c]");
														asm("movq [edi+0x10], xmm0");
														_v60 = 0;
														_v56 = 7;
														__eflags = _t1032;
														if(_t1032 == 0) {
															L165:
															 *[fs:0x0] = _v28;
															_pop(_t1079);
															_pop(_t1108);
															__eflags = _v36 ^ _t1148;
															return E00F429FA(_t1078, _t895, _v36 ^ _t1148, _t1032, _t1079, _t1108);
														} else {
															_t736 = _t1032;
															_t969 = _v40 - _t1032 & 0xfffffffe;
															__eflags = _t969 - 0x1000;
															if(_t969 < 0x1000) {
																L161:
																_push(_t969);
																E00F42B5A(_t1032);
																_t1032 = _v56;
																_t1172 = _t1172 + 8;
																_v48 = 0;
																_v44 = 0;
																_v40 = 0;
																__eflags = _t1032 - 8;
																if(_t1032 < 8) {
																	goto L165;
																} else {
																	_t923 = _v76;
																	_t1032 = 2 + _t1032 * 2;
																	_t738 = _t923;
																	__eflags = _t1032 - 0x1000;
																	if(_t1032 < 0x1000) {
																		L164:
																		_push(_t1032);
																		E00F42B5A(_t923);
																		goto L165;
																	} else {
																		_t923 =  *(_t923 - 4);
																		_t1032 = _t1032 + 0x23;
																		__eflags = _t738 - _t923 + 0xfffffffc - 0x1f;
																		if(__eflags > 0) {
																			goto L173;
																		} else {
																			goto L164;
																		}
																	}
																}
															} else {
																_t1032 =  *(_t1032 - 4);
																_t923 = _t969 + 0x23;
																__eflags = _t736 - _t1032 + 0xfffffffc - 0x1f;
																if(__eflags > 0) {
																	goto L173;
																} else {
																	goto L161;
																}
															}
														}
													}
												}
											}
										}
									} else {
										__eflags = _t585 - 0x7fffffff;
										if(_t585 > 0x7fffffff) {
											L174:
											L268();
											goto L175;
										} else {
											_t1106 = _t585 + _t585;
											__eflags = _t1106 - 0x1000;
											if(_t1106 < 0x1000) {
												__eflags = _t1106;
												if(__eflags == 0) {
													_t745 = 0;
													__eflags = 0;
												} else {
													_t745 = E00F42B2A(_t1106, __eflags, _t1106);
													_t1172 = _t1172 + 4;
												}
												goto L147;
											} else {
												_t318 = _t1106 + 0x23; // 0x7618f5f3
												_t747 = _t318;
												__eflags = _t318 - _t1106;
												if(__eflags <= 0) {
													L175:
													E00F410B0();
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													_push(_t1106);
													_t1109 = _t923;
													_t597 =  *_t1109;
													__eflags = _t597;
													if(_t597 == 0) {
														L181:
														return _t597;
													} else {
														_t926 = _t1109[2] - _t597 & 0xfffffffe;
														__eflags = _t926 - 0x1000;
														if(_t926 < 0x1000) {
															L180:
															_push(_t926);
															_t597 = E00F42B5A(_t597);
															 *_t1109 = 0;
															_t1109[1] = 0;
															_t1109[2] = 0;
															goto L181;
														} else {
															_t1033 =  *(_t597 - 4);
															_t926 = _t926 + 0x23;
															__eflags = _t597 - _t1033 + 0xfffffffc - 0x1f;
															if(__eflags > 0) {
																E00F45BE3(_t895, _t926, _t1033, __eflags);
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																_push(_t1109);
																_t1111 = _t926;
																_t927 =  *(_t1111 + 0x14);
																__eflags = _t927 - 8;
																if(_t927 < 8) {
																	L188:
																	__eflags = 0;
																	 *(_t1111 + 0x10) = 0;
																	 *(_t1111 + 0x14) = 7;
																	 *_t1111 = 0;
																	return 0;
																} else {
																	_t602 =  *_t1111;
																	_t928 = 2 + _t927 * 2;
																	__eflags = _t928 - 0x1000;
																	if(_t928 < 0x1000) {
																		L187:
																		_push(_t928);
																		E00F42B5A(_t602);
																		goto L188;
																	} else {
																		_t1034 =  *((intOrPtr*)(_t602 - 4));
																		_t928 = _t928 + 0x23;
																		__eflags = _t602 - _t1034 + 0xfffffffc - 0x1f;
																		if(__eflags > 0) {
																			E00F45BE3(_t895, _t928, _t1034, __eflags);
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			_push(_t1148);
																			_t1150 = _t1172;
																			_t1178 = _t1172 - 0xc;
																			_t607 = _v1564;
																			_t1035 = _v1568;
																			_push(_t895);
																			_push(_t1111);
																			_push(_t1078);
																			_t1080 = _t928;
																			_v1584 = _v1568;
																			_v1580 = _t607;
																			_t929 =  *(_t1080 + 0x14);
																			_v1588 = _t929;
																			__eflags = _t607 - _t929;
																			if(_t607 > _t929) {
																				__eflags = _t607 - 0x7ffffffe;
																				if(_t607 > 0x7ffffffe) {
																					L214:
																					E00F41150(_t895, _t1035, _t1080, _t1111);
																					goto L215;
																				} else {
																					_t1131 = _t607 | 0x00000007;
																					__eflags = _t1131 - 0x7ffffffe;
																					if(_t1131 <= 0x7ffffffe) {
																						_t1035 = _t929 >> 1;
																						__eflags = _t929 - 0x7ffffffe - _t1035;
																						if(_t929 <= 0x7ffffffe - _t1035) {
																							_t704 = _t1035 + _t929;
																							__eflags = _t1131 - _t704;
																							_t1111 =  <  ? _t704 : _t1131;
																							_t403 = _t1111 + 1; // 0x6a58fef9
																							_t705 = _t403;
																							__eflags = _t705 - 0x7fffffff;
																							if(_t705 > 0x7fffffff) {
																								goto L213;
																							} else {
																								_t707 = _t705 + _t705;
																								__eflags = _t707 - 0x1000;
																								if(_t707 < 0x1000) {
																									__eflags = _t707;
																									if(__eflags == 0) {
																										_t895 = 0;
																										__eflags = 0;
																									} else {
																										_t717 = E00F42B2A(_t1111, __eflags, _t707);
																										_t1178 = _t1178 + 4;
																										_t895 = _t717;
																									}
																									goto L207;
																								} else {
																									goto L201;
																								}
																							}
																						} else {
																							_t1111 = 0x7ffffffe;
																							_t707 = 0xfffffffe;
																							goto L201;
																						}
																					} else {
																						_t1111 = 0x7ffffffe;
																						_t707 = 0xfffffffe;
																						L201:
																						_t404 = _t707 + 0x23; // 0x100000021
																						_t929 = _t404;
																						__eflags = _t929 - _t707;
																						if(__eflags <= 0) {
																							L213:
																							E00F410B0();
																							goto L214;
																						} else {
																							_t718 = E00F42B2A(_t1111, __eflags, _t929);
																							_t1178 = _t1178 + 4;
																							__eflags = _t718;
																							if(__eflags == 0) {
																								L215:
																								E00F45BE3(_t895, _t929, _t1035, __eflags);
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								asm("int3");
																								_push(_t1150);
																								_t1151 = _t1178;
																								_t1179 = _t1178 - 0x14;
																								_t1036 = _v1588;
																								_push(_t895);
																								_t897 = _t929;
																								_v1612 = _v1580;
																								_t930 = 0x7ffffffe;
																								_push(_t1111);
																								_t1113 =  *(_t897 + 0x10);
																								_v1600 = _t1113;
																								_push(_t1080);
																								__eflags = 0x7ffffffe - _t1113 - _t1036;
																								if(0x7ffffffe - _t1113 < _t1036) {
																									L236:
																									E00F41150(_t897, _t1036, _t1080, _t1113);
																									goto L237;
																								} else {
																									_t677 = _t1113 + _t1036;
																									_t1113 =  *(_t897 + 0x14);
																									_v32 = _t677;
																									_t1090 = _t677 | 0x00000007;
																									_v36 = _t1113;
																									__eflags = _t1090 - 0x7ffffffe;
																									if(_t1090 <= 0x7ffffffe) {
																										_t679 = _t1113 >> 1;
																										_t930 = 0x7ffffffe - _t679;
																										__eflags = _t1113 - _t930;
																										if(_t1113 <= _t930) {
																											_t680 = _t679 + _t1113;
																											__eflags = _t1090 - _t680;
																											_t1080 =  <  ? _t680 : _t1090;
																											_t426 = _t1080 + 1; // 0x7fffffff
																											_t681 = _t426;
																											__eflags = _t681 - 0x7fffffff;
																											if(_t681 > 0x7fffffff) {
																												goto L235;
																											} else {
																												_t683 = _t681 + _t681;
																												__eflags = _t683 - 0x1000;
																												if(_t683 < 0x1000) {
																													__eflags = _t683;
																													if(__eflags == 0) {
																														_t1113 = 0;
																														__eflags = 0;
																													} else {
																														_t700 = E00F42B2A(_t1113, __eflags, _t683);
																														_t1179 = _t1179 + 4;
																														_t1113 = _t700;
																													}
																													goto L229;
																												} else {
																													goto L223;
																												}
																											}
																										} else {
																											_t1080 = 0x7ffffffe;
																											_t683 = 0xfffffffe;
																											goto L223;
																										}
																									} else {
																										_t1080 = 0x7ffffffe;
																										_t683 = 0xfffffffe;
																										L223:
																										_t427 = _t683 + 0x23; // 0x100000021
																										_t930 = _t427;
																										__eflags = _t930 - _t683;
																										if(__eflags <= 0) {
																											L235:
																											E00F410B0();
																											goto L236;
																										} else {
																											_t701 = E00F42B2A(_t1113, __eflags, _t930);
																											_t1179 = _t1179 + 4;
																											__eflags = _t701;
																											if(__eflags == 0) {
																												L237:
																												E00F45BE3(_t897, _t930, _t1036, __eflags);
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												_push(_t1151);
																												_t1152 = _t1179;
																												_t1180 = _t1179 - 0x14;
																												_push(_t897);
																												_t898 = _v1600;
																												_push(_t1113);
																												_t1114 = _v1604;
																												_push(_t1080);
																												_t1081 = _t930;
																												 *_t1081 = 0;
																												 *(_t1081 + 0x10) = 0;
																												 *(_t1081 + 0x14) = 0;
																												_t615 =  *(_t1114 + 0x10);
																												_t1037 =  *(_t898 + 0x10);
																												_t931 =  *(_t898 + 0x14);
																												_v1624 = _t615;
																												_v1628 = _t615 + _t1037;
																												_v1636 = _t1037;
																												__eflags = _t1037 -  *(_t1114 + 0x14) - _v1624;
																												if(_t1037 >  *(_t1114 + 0x14) - _v1624) {
																													L245:
																													_t619 = _v36;
																													_t932 = _t931 - _t1037;
																													__eflags = _t619 - _t932;
																													if(_t619 > _t932) {
																														__eflags = 0x7ffffffe - _v36 - _t1037;
																														if(0x7ffffffe - _v36 < _t1037) {
																															L266:
																															E00F41150(_t898, _t1037, _t1081, _t1114);
																															goto L267;
																														} else {
																															_t655 = _v40 | 0x00000007;
																															__eflags = _t655 - 0x7ffffffe;
																															if(_t655 <= 0x7ffffffe) {
																																_t932 = 0xa;
																																__eflags = _t655 - 0xa;
																																_t656 =  <  ? 0xa : _t655;
																																_v32 = _t656;
																																_t657 = _t656 + 1;
																																__eflags = _t657 - 0x7fffffff;
																																if(_t657 > 0x7fffffff) {
																																	goto L265;
																																} else {
																																	_t659 = _t657 + _t657;
																																	__eflags = _t659 - 0x1000;
																																	if(_t659 < 0x1000) {
																																		__eflags = _t659;
																																		if(__eflags == 0) {
																																			_t660 = 0;
																																			__eflags = 0;
																																		} else {
																																			_t660 = E00F42B2A(_t1114, __eflags, _t659);
																																			_t1180 = _t1180 + 4;
																																		}
																																		goto L260;
																																	} else {
																																		goto L254;
																																	}
																																}
																															} else {
																																_v32 = 0x7ffffffe;
																																_t659 = 0xfffffffe;
																																L254:
																																_t497 = _t659 + 0x23; // 0x100000021
																																_t932 = _t497;
																																__eflags = _t932 - _t659;
																																if(__eflags <= 0) {
																																	L265:
																																	E00F410B0();
																																	goto L266;
																																} else {
																																	_t932 = E00F42B2A(_t1114, __eflags, _t932);
																																	_t1180 = _t1180 + 4;
																																	__eflags = _t932;
																																	if(__eflags == 0) {
																																		L267:
																																		E00F45BE3(_t898, _t932, _t1037, __eflags);
																																		asm("int3");
																																		asm("int3");
																																		asm("int3");
																																		asm("int3");
																																		asm("int3");
																																		asm("int3");
																																		asm("int3");
																																		asm("int3");
																																		asm("int3");
																																		asm("int3");
																																		asm("int3");
																																		_push("vector too long");
																																		E00F429DA(_t898, _t1037, _t1081, _t1114);
																																		asm("int3");
																																		asm("int3");
																																		asm("int3");
																																		asm("int3");
																																		asm("int3");
																																		asm("int3");
																																		_push(_t1152);
																																		_t1181 = _t1180 - 0x10;
																																		_t1038 = _v1636;
																																		_push(_t898);
																																		_t899 = _t932;
																																		_v1660 = _v1624;
																																		_t933 = 0x7ffffffe;
																																		_push(_t1114);
																																		_t1115 = _t899[4];
																																		_v1652 = _t1115;
																																		_push(_t1081);
																																		__eflags = 0x7ffffffe - _t1115 - _t1038;
																																		if(0x7ffffffe - _t1115 < _t1038) {
																																			L290:
																																			E00F41150(_t899, _t1038, _t1081, _t1115);
																																			goto L291;
																																		} else {
																																			_t1081 = _t899[5];
																																			_t631 = _t1115 + _t1038;
																																			_v36 = _t631;
																																			_t1117 = _t631 | 0x00000007;
																																			_v44 = _t1081;
																																			__eflags = _t1117 - 0x7ffffffe;
																																			if(__eflags <= 0) {
																																				_t633 = _t1081 >> 1;
																																				__eflags = _t1081 - 0x7ffffffe - _t633;
																																				if(__eflags <= 0) {
																																					_t634 = _t633 + _t1081;
																																					__eflags = _t1117 - _t634;
																																					_t1115 =  <  ? _t634 : _t1117;
																																				} else {
																																					_t1115 = 0x7ffffffe;
																																				}
																																			} else {
																																				_t1115 = 0x7ffffffe;
																																			}
																																			_t933 =  ~(0 | __eflags > 0x00000000) | _t1115 + 0x00000001;
																																			__eflags = _t933 - 0x7fffffff;
																																			if(_t933 > 0x7fffffff) {
																																				L289:
																																				E00F410B0();
																																				goto L290;
																																			} else {
																																				_t933 = _t933 + _t933;
																																				__eflags = _t933 - 0x1000;
																																				if(_t933 < 0x1000) {
																																					__eflags = _t933;
																																					if(__eflags == 0) {
																																						_t1082 = 0;
																																						__eflags = 0;
																																					} else {
																																						_t651 = E00F42B2A(_t1115, __eflags, _t933);
																																						_t1181 = _t1181 + 4;
																																						_t1082 = _t651;
																																					}
																																					goto L283;
																																				} else {
																																					_t525 = _t933 + 0x23; // 0x23
																																					_t652 = _t525;
																																					__eflags = _t525 - _t933;
																																					if(__eflags <= 0) {
																																						goto L289;
																																					} else {
																																						_t653 = E00F42B2A(_t1115, __eflags, _t652);
																																						_t1181 = _t1181 + 4;
																																						__eflags = _t653;
																																						if(__eflags == 0) {
																																							L291:
																																							E00F45BE3(_t899, _t933, _t1038, __eflags);
																																							asm("int3");
																																							 *(_t933 + 4) =  *(_t933 + 4) & 0x00000000;
																																							_t551 = _t933 + 8;
																																							 *_t551 =  *(_t933 + 8) & 0x00000000;
																																							__eflags =  *_t551;
																																							 *(_t933 + 4) = "bad allocation";
																																							 *_t933 = 0xf4f1a0;
																																							return _t933;
																																						} else {
																																							_t526 = _t653 + 0x23; // 0x23
																																							_t1082 = _t526 & 0xffffffe0;
																																							 *(_t1082 - 4) = _t653;
																																							L283:
																																							_t899[4] = _v36;
																																							_t640 = _v8 + _v8;
																																							_t899[5] = _t1115;
																																							__eflags = _v44 - 8;
																																							_push(_t640);
																																							_push(_v48);
																																							_t1119 = 2 + _v40 * 2;
																																							_v36 = _t640 + _t1082;
																																							_push(_t1082);
																																							if(_v44 < 8) {
																																								E00F452B0();
																																								E00F452B0(_v36, _t899, _t1119);
																																								 *_t899 = _t1082;
																																								return _t899;
																																							} else {
																																								_t1121 =  *_t899;
																																								E00F452B0();
																																								E00F452B0(_v36, _t1121, 2 + _v40 * 2);
																																								_t940 = 2 + _v44 * 2;
																																								__eflags = _t940 - 0x1000;
																																								if(_t940 < 0x1000) {
																																									L287:
																																									_push(_t940);
																																									E00F42B5A(_t1121);
																																									 *_t899 = _t1082;
																																									return _t899;
																																								} else {
																																									_t1038 =  *(_t1121 - 4);
																																									_t933 = _t940 + 0x23;
																																									__eflags = _t1121 - _t1038 - 4 - 0x1f;
																																									if(__eflags > 0) {
																																										goto L291;
																																									} else {
																																										_t1121 = _t1038;
																																										goto L287;
																																									}
																																								}
																																							}
																																						}
																																					}
																																				}
																																			}
																																		}
																																	} else {
																																		_t498 = _t932 + 0x23; // 0x23
																																		_t660 = _t498 & 0xffffffe0;
																																		 *(_t660 - 4) = _t932;
																																		L260:
																																		 *(_t1081 + 0x10) = _v40;
																																		 *_t1081 = _t660;
																																		 *(_t1081 + 0x14) = _v32;
																																		__eflags =  *(_t1114 + 0x14) - 8;
																																		_v44 = _t660;
																																		if( *(_t1114 + 0x14) >= 8) {
																																			_t1114 =  *_t1114;
																																		}
																																		_v32 = _v36 + _v36;
																																		E00F452B0(_t660, _t1114, _v36 + _v36);
																																		__eflags =  *(_t898 + 0x14) - 8;
																																		if( *(_t898 + 0x14) >= 8) {
																																			_t898 =  *_t898;
																																		}
																																		__eflags = _v32 + _v44;
																																		E00F452B0(_v32 + _v44, _t898, 2 + _v48 * 2);
																																		return _t1081;
																																	}
																																}
																															}
																														}
																													} else {
																														asm("movups xmm0, [ebx]");
																														asm("movups [edi], xmm0");
																														asm("movq xmm0, [ebx+0x10]");
																														asm("movq [edi+0x10], xmm0");
																														 *_t898 = 0;
																														 *(_t898 + 0x10) = 0;
																														 *(_t898 + 0x14) = 7;
																														_t903 =  *_t1081;
																														_v32 = _t619 + _t619;
																														E00F452B0(_t619 + _t619 +  *_t1081,  *_t1081, 2 + _t1037 * 2);
																														__eflags =  *(_t1114 + 0x14) - 8;
																														if( *(_t1114 + 0x14) >= 8) {
																															_t1114 =  *_t1114;
																														}
																														E00F452B0(_t903, _t1114, _v32);
																														 *(_t1081 + 0x10) = _v40;
																														return _t1081;
																													}
																												} else {
																													__eflags = _t931 -  *(_t1114 + 0x14);
																													if(_t931 >  *(_t1114 + 0x14)) {
																														goto L245;
																													} else {
																														asm("movups xmm0, [esi]");
																														_t952 = _t1081;
																														asm("movups [edi], xmm0");
																														asm("movq xmm0, [esi+0x10]");
																														asm("movq [edi+0x10], xmm0");
																														 *(_t1114 + 0x10) = 0;
																														 *(_t1114 + 0x14) = 7;
																														 *_t1114 = 0;
																														__eflags =  *(_t1081 + 0x14) - 8;
																														if( *(_t1081 + 0x14) >= 8) {
																															_t952 =  *_t1081;
																														}
																														__eflags =  *(_t898 + 0x14) - 8;
																														if( *(_t898 + 0x14) >= 8) {
																															_t898 =  *_t898;
																														}
																														E00F452B0(_t952 + _v36 * 2, _t898, 2 + _t1037 * 2);
																														 *(_t1081 + 0x10) = _v40;
																														return _t1081;
																													}
																												}
																											} else {
																												_t428 = _t701 + 0x23; // 0x23
																												_t1113 = _t428 & 0xffffffe0;
																												 *(_t1113 - 4) = _t701;
																												L229:
																												 *(_t897 + 0x10) = _v32;
																												 *(_t897 + 0x14) = _t1080;
																												_t954 = _v28 + _v28;
																												_t686 = _v4;
																												_v32 = _t954 + _t1113;
																												_push(_t954);
																												_t1091 = _t686 + _t686;
																												__eflags = _v36 - 8;
																												_v44 = _t686 + _t686;
																												_v28 = _t1113 + (_t686 + _v28) * 2;
																												if(_v36 < 8) {
																													_push(_t897);
																													_push(_t1113);
																													E00F452B0();
																													E00F452B0(_v32, _v40, _t1091);
																													__eflags = 0;
																													 *_v28 = 0;
																													 *_t897 = _t1113;
																													return _t897;
																												} else {
																													_t1093 =  *_t897;
																													_push(_t1093);
																													_push(_t1113);
																													E00F452B0();
																													E00F452B0(_v32, _v40, _v44);
																													_t1179 = _t1179 + 0x18;
																													 *_v28 = 0;
																													_t957 = 2 + _v36 * 2;
																													__eflags = _t957 - 0x1000;
																													if(_t957 < 0x1000) {
																														L233:
																														_push(_t957);
																														E00F42B5A(_t1093);
																														 *_t897 = _t1113;
																														return _t897;
																													} else {
																														_t1036 =  *(_t1093 - 4);
																														_t930 = _t957 + 0x23;
																														_t1080 = _t1093 - _t1036;
																														_t453 = _t1080 - 4; // 0x7ffffffa
																														__eflags = _t453 - 0x1f;
																														if(__eflags > 0) {
																															goto L237;
																														} else {
																															_t1093 = _t1036;
																															goto L233;
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																							} else {
																								_t405 = _t718 + 0x23; // 0x23
																								_t895 = _t405 & 0xffffffe0;
																								 *(_t895 - 4) = _t718;
																								L207:
																								_t708 = _v24;
																								 *(_t1080 + 0x14) = _t1111;
																								 *(_t1080 + 0x10) = _t708;
																								_t1111 = _t708 + _t708;
																								E00F452B0(_t895, _v28, _t1111);
																								_t1178 = _t1178 + 0xc;
																								 *((short*)(_t1111 + _t895)) = 0;
																								_t711 = _v32;
																								__eflags = _t711 - 8;
																								if(_t711 < 8) {
																									L212:
																									 *_t1080 = _t895;
																									return _t1080;
																								} else {
																									_t958 = 2 + _t711 * 2;
																									_t713 =  *_t1080;
																									__eflags = _t958 - 0x1000;
																									if(_t958 < 0x1000) {
																										L211:
																										_push(_t958);
																										E00F42B5A(_t713);
																										goto L212;
																									} else {
																										_t1035 =  *(_t713 - 4);
																										_t929 = _t958 + 0x23;
																										__eflags = _t713 - _t1035 + 0xfffffffc - 0x1f;
																										if(__eflags > 0) {
																											goto L215;
																										} else {
																											_t713 = _t1035;
																											goto L211;
																										}
																									}
																								}
																							}
																						}
																					}
																				}
																			} else {
																				_t910 = _t1080;
																				__eflags = _t929 - 8;
																				if(_t929 >= 8) {
																					_t910 =  *_t1080;
																				}
																				_t1133 = _t607 + _t607;
																				 *(_t1080 + 0x10) = _t607;
																				E00F452B0(_t910, _t1035, _t1133);
																				__eflags = 0;
																				 *((short*)(_t1133 + _t910)) = 0;
																				return _t1080;
																			}
																		} else {
																			_t602 = _t1034;
																			goto L187;
																		}
																	}
																}
															} else {
																_t597 = _t1033;
																goto L180;
															}
														}
													}
												} else {
													_t923 = E00F42B2A(_t1106, __eflags, _t747);
													_t1172 = _t1172 + 4;
													__eflags = _t923;
													if(__eflags == 0) {
														L173:
														E00F45BE3(_t895, _t923, _t1032, __eflags);
														goto L174;
													} else {
														_t319 = _t923 + 0x23; // 0x23
														_t745 = _t319 & 0xffffffe0;
														 *(_t745 - 4) = _t923;
														L147:
														_t1106 = _t1106 + _t745;
														__eflags = _t1106;
														_v48 = _t745;
														_v40 = _t1106;
														E00F43E50(_t1078, _t745, 0, _v84 + _v84);
														_t917 = _v48;
														_t1172 = _t1172 + 0xc;
														_v44 = _t1106;
														goto L148;
													}
												}
											}
										}
									}
								} else {
									goto L26;
								}
							}
						}
					} else {
						_t893 = RegQueryValueExW(_v1276, L"Release", 0,  &(_v1228.wShowWindow),  &_v272,  &(_v1228.dwFlags)); // executed
						if(_t893 != 0) {
							goto L92;
						} else {
							goto L4;
						}
					}
				}
				L293:
			}

0x00f41150
0x00f41150
0x00f41150
0x00f41150
0x00f41155
0x00f4115a
0x00f4115b
0x00f4115c
0x00f4115d
0x00f4115e
0x00f4115f
0x00f41161
0x00f41166
0x00f4116c
0x00f41173
0x00f4117a
0x00f4117b
0x00f41188
0x00f41196
0x00f411a1
0x00f411a6
0x00f411a9
0x00f411b4
0x00f411c8
0x00f411e3
0x00f411e7
0x00f41bad
0x00f41bad
0x00f41bb3
0x00f41bb8
0x00f41bd9
0x00f41bde
0x00f41be6
0x00f41bed
0x00f41bf3
0x00f41bf7
0x00f41c15
0x00f41c15
0x00f41c17
0x00f41c20
0x00f41c28
0x00f41c2a
0x00f41c2c
0x00000000
0x00000000
0x00f41c32
0x00f41c36
0x00f41c37
0x00f41c3a
0x00000000
0x00f41c3c
0x00f41c3c
0x00f41c40
0x00f41c42
0x00f41c49
0x00f41c4e
0x00f41c56
0x00f41c58
0x00f41c58
0x00f41c5c
0x00000000
0x00000000
0x00f41c5e
0x00f41c61
0x00f41c61
0x00f41c64
0x00000000
0x00000000
0x00000000
0x00f41c64
0x00f41c66
0x00f41c68
0x00000000
0x00f41c6a
0x00f41c6f
0x00f41c75
0x00f41c79
0x00f41c7c
0x00000000
0x00f41c7e
0x00f41c81
0x00f41c8d
0x00f41c97
0x00f41c9f
0x00f41c9f
0x00f41ca1
0x00f41cb0
0x00f41cb2
0x00f41cb4
0x00000000
0x00000000
0x00f41cb6
0x00f41cb7
0x00f41cba
0x00000000
0x00f41cbc
0x00f41cbc
0x00f41cbc
0x00000000
0x00f41cba
0x00f41ccd
0x00f41ccd
0x00f41c7c
0x00f41c68
0x00000000
0x00f41c3a
0x00f41cda
0x00f41bf9
0x00f41bf9
0x00f41c00
0x00f41c04
0x00f41c06
0x00000000
0x00f41c08
0x00f41c08
0x00f41c08
0x00f41c08
0x00f41c06
0x00f41cde
0x00f41cde
0x00f41ce6
0x00f41ced
0x00f41cf1
0x00f41d0c
0x00f41d0c
0x00f41d0c
0x00f41d10
0x00f41d18
0x00f41d1a
0x00f41d1c
0x00000000
0x00000000
0x00f41d22
0x00f41d26
0x00f41d27
0x00f41d2a
0x00000000
0x00f41d2c
0x00f41d2c
0x00f41d30
0x00f41d32
0x00f41d39
0x00f41d3b
0x00f41d43
0x00f41d48
0x00f41d48
0x00f41d4c
0x00000000
0x00000000
0x00f41d4e
0x00f41d51
0x00f41d51
0x00f41d54
0x00000000
0x00000000
0x00000000
0x00f41d54
0x00f41d56
0x00f41d58
0x00f41dac
0x00f41dac
0x00f41d5a
0x00f41d5f
0x00f41d65
0x00f41d69
0x00f41d6c
0x00000000
0x00f41d6e
0x00f41d71
0x00f41d7d
0x00f41d87
0x00f41d8f
0x00f41d8f
0x00f41d91
0x00f41da0
0x00f41da2
0x00f41da4
0x00000000
0x00000000
0x00f41da6
0x00f41da7
0x00f41daa
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00f41daa
0x00000000
0x00f41d91
0x00f41d6c
0x00f41d58
0x00000000
0x00f41d2a
0x00f41db3
0x00f41db3
0x00f41cf3
0x00f41cf3
0x00f41cfa
0x00f41cfe
0x00f41d00
0x00000000
0x00f41d02
0x00f41d02
0x00f41d02
0x00f41d00
0x00f41dba
0x00f41dc9
0x00f41dc9
0x00f41dcc
0x00f41ddd
0x00f41ddd
0x00f41de3
0x00f41dea
0x00f41ded
0x00000000
0x00f41def
0x00f41def
0x00f41df6
0x00f41dfd
0x00f41dff
0x00f41e05
0x00000000
0x00f41e07
0x00f41e07
0x00f41e0a
0x00f41e12
0x00f41e15
0x00000000
0x00000000
0x00000000
0x00000000
0x00f41e15
0x00f41e05
0x00f41bba
0x00f41bbc
0x00f41bbd
0x00f41bc5
0x00f41bcf
0x00f41bcf
0x00f411ed
0x00f411fc
0x00f41200
0x00f41236
0x00f41236
0x00f41238
0x00f41244
0x00f4124f
0x00f4125a
0x00f41265
0x00f41279
0x00f4127e
0x00f41290
0x00f41296
0x00f4129d
0x00f412a5
0x00f412ad
0x00f412b0
0x00f412c0
0x00f412c0
0x00f412c3
0x00f412c6
0x00f412d6
0x00f412d7
0x00f412dc
0x00f412ea
0x00f412ee
0x00f412f5
0x00f413ac
0x00f413ac
0x00f413ac
0x00f412fb
0x00f4130a
0x00f4130f
0x00f41312
0x00f41320
0x00f41320
0x00f41326
0x00000000
0x00000000
0x00f4132b
0x00f4132e
0x00f4133c
0x00000000
0x00f4133e
0x00f4133e
0x00f41346
0x00f41349
0x00f41350
0x00f41350
0x00f41356
0x00000000
0x00000000
0x00f41364
0x00000000
0x00f41366
0x00f41366
0x00000000
0x00f41366
0x00000000
0x00f41364
0x00f413a6
0x00f413a8
0x00f413a8
0x00000000
0x00f4133c
0x00f4136b
0x00f4136b
0x00f4136e
0x00f41371
0x00f41373
0x00f41376
0x00f41380
0x00f41380
0x00f41380
0x00f41383
0x00f41388
0x00f41390
0x00f41390
0x00f41393
0x00000000
0x00000000
0x00f41395
0x00f41398
0x00f41398
0x00f4139b
0x00000000
0x00f4139d
0x00f4139d
0x00f4139f
0x00000000
0x00f413a1
0x00f413a1
0x00000000
0x00f413a1
0x00f4139f
0x00000000
0x00f4139b
0x00000000
0x00f41390
0x00f41380
0x00f413af
0x00f413af
0x00f413b3
0x00f413b6
0x00f413eb
0x00f413eb
0x00f413f2
0x00f413fa
0x00f41402
0x00f41405
0x00f41410
0x00f41410
0x00f41413
0x00f41416
0x00f41416
0x00f41426
0x00f41427
0x00f4142c
0x00f41431
0x00f4143d
0x00f41445
0x00f4144a
0x00f4144f
0x00f41450
0x00f41455
0x00f41456
0x00f4145e
0x00f41466
0x00f4146b
0x00f41472
0x00f41475
0x00f414ad
0x00f414ad
0x00f414b2
0x00f414b6
0x00f414be
0x00f414c4
0x00f414cd
0x00f414d0
0x00f41505
0x00f41505
0x00f41507
0x00f41510
0x00f41518
0x00f41520
0x00f41528
0x00f4152d
0x00f4153d
0x00f41542
0x00f41546
0x00f41548
0x00f4154c
0x00f41550
0x00f41552
0x00f415fa
0x00f415fb
0x00f415fc
0x00f415fd
0x00f41609
0x00f41610
0x00f41611
0x00f41558
0x00f41558
0x00f41560
0x00f41568
0x00f4156d
0x00f41570
0x00f41577
0x00f4157b
0x00f4157f
0x00f41583
0x00f41585
0x00f4159e
0x00f4159e
0x00f41587
0x00f4158a
0x00f4158c
0x00000000
0x00f4158e
0x00f4158e
0x00f41590
0x00f4159a
0x00f41592
0x00f41592
0x00f41592
0x00f41590
0x00f4158c
0x00f415b3
0x00f415bb
0x00f415c7
0x00f415ec
0x00f415f1
0x00f415f4
0x00f415f4
0x00f41616
0x00f4161b
0x00f41620
0x00f41625
0x00f4162b
0x00f41632
0x00f41639
0x00f4163c
0x00f41642
0x00f41646
0x00f41648
0x00f4164b
0x00f4167f
0x00f41681
0x00f41686
0x00f41692
0x00f41699
0x00f4169b
0x00f4164d
0x00f4164d
0x00f41656
0x00f4165b
0x00f41663
0x00f4166b
0x00f41670
0x00f41675
0x00f41679
0x00f41679
0x00f416a0
0x00f416a5
0x00f416ad
0x00f416b2
0x00f416bb
0x00f416c2
0x00f416c9
0x00f416cc
0x00f416d0
0x00f416d3
0x00f41708
0x00f41708
0x00f4170e
0x00f41716
0x00f4171e
0x00f41723
0x00f41726
0x00f4175b
0x00f4175b
0x00f4175d
0x00f41769
0x00f41774
0x00f4177f
0x00f4178a
0x00f4179e
0x00f417a4
0x00f417ab
0x00f417ad
0x00f417b4
0x00f417b7
0x00f419b4
0x00f419b4
0x00f419cb
0x00f419df
0x00f419e9
0x00f419f8
0x00f41a02
0x00f41a0e
0x00f41a17
0x00f41a20
0x00f41a29
0x00f41a32
0x00f41a3b
0x00f41a44
0x00f41a4d
0x00f41a56
0x00f41a5e
0x00f41a64
0x00f41a66
0x00f41a71
0x00f41a86
0x00f41a93
0x00f41a99
0x00f41aa2
0x00f41aa2
0x00f41aa4
0x00f41aab
0x00f41aae
0x00f41ae6
0x00f41ae6
0x00f41aef
0x00f41afa
0x00f41b05
0x00f41b0d
0x00f41b10
0x00f41b48
0x00f41b48
0x00f41b51
0x00f41b5c
0x00f41b67
0x00f41b6f
0x00f41b72
0x00f41e21
0x00f41e2f
0x00f41e30
0x00f41e31
0x00f41e3b
0x00f41b78
0x00f41b78
0x00f41b7f
0x00f41b86
0x00f41b88
0x00f41b8e
0x00f41e17
0x00f41e17
0x00f41e19
0x00f41e1e
0x00000000
0x00f41b94
0x00f41b94
0x00f41b97
0x00f41b9f
0x00f41ba2
0x00000000
0x00f41ba8
0x00000000
0x00f41ba8
0x00f41ba2
0x00f41b8e
0x00f41b12
0x00f41b12
0x00f41b19
0x00f41b20
0x00f41b22
0x00f41b28
0x00f41b3e
0x00f41b3e
0x00f41b40
0x00f41b45
0x00000000
0x00f41b2a
0x00f41b2a
0x00f41b2d
0x00f41b35
0x00f41b38
0x00000000
0x00000000
0x00000000
0x00000000
0x00f41b38
0x00f41b28
0x00f41ab0
0x00f41ab0
0x00f41ab7
0x00f41abe
0x00f41ac0
0x00f41ac6
0x00f41adc
0x00f41adc
0x00f41ade
0x00f41ae3
0x00000000
0x00f41ac8
0x00f41ac8
0x00f41acb
0x00f41ad3
0x00f41ad6
0x00000000
0x00000000
0x00000000
0x00000000
0x00f41ad6
0x00f41ac6
0x00f417bd
0x00f417bd
0x00f417bf
0x00f417c3
0x00f417c5
0x00f417d0
0x00f417d0
0x00f417d2
0x00f417db
0x00f417e3
0x00f417eb
0x00f417f3
0x00f417f8
0x00f417fb
0x00f417fd
0x00f41805
0x00f4180d
0x00f41815
0x00f41820
0x00f41820
0x00f41823
0x00f41826
0x00f41826
0x00f4182f
0x00f41830
0x00f41835
0x00f4183e
0x00f41843
0x00f41844
0x00f4184f
0x00f41854
0x00f4185d
0x00f41861
0x00f41868
0x00f4186b
0x00f4186f
0x00f4187c
0x00f41883
0x00f41885
0x00f418cf
0x00f418d0
0x00f418d1
0x00f418d6
0x00f418da
0x00f418e2
0x00f418e7
0x00f41887
0x00f41887
0x00f4188c
0x00f4189c
0x00f418ac
0x00f418b7
0x00f418bc
0x00f418c0
0x00f418c5
0x00f418c9
0x00f418c9
0x00f418eb
0x00f418ef
0x00f418f2
0x00f41923
0x00f41923
0x00f41927
0x00f4192a
0x00f4195f
0x00f4195f
0x00f41963
0x00f41966
0x00000000
0x00f41968
0x00f41968
0x00f4196c
0x00f41973
0x00f41975
0x00f4197b
0x00f41991
0x00f41991
0x00f41993
0x00f41998
0x00000000
0x00f4197d
0x00f4197d
0x00f41980
0x00f41988
0x00f4198b
0x00000000
0x00000000
0x00000000
0x00000000
0x00f4198b
0x00f4197b
0x00f4192c
0x00f4192c
0x00f41930
0x00f41937
0x00f41939
0x00f4193f
0x00f41955
0x00f41955
0x00f41957
0x00f4195c
0x00000000
0x00f41941
0x00f41941
0x00f41944
0x00f4194c
0x00f4194f
0x00000000
0x00000000
0x00000000
0x00000000
0x00f4194f
0x00f4193f
0x00f418f4
0x00f418f4
0x00f418fb
0x00f418fd
0x00f41903
0x00f41919
0x00f41919
0x00f4191b
0x00f41920
0x00000000
0x00f41905
0x00f41905
0x00f41908
0x00f41910
0x00f41913
0x00000000
0x00000000
0x00000000
0x00000000
0x00f41913
0x00f41903
0x00000000
0x00f4199b
0x00f4199b
0x00f419a2
0x00f419a3
0x00f419a7
0x00f419a7
0x00f417d0
0x00000000
0x00f417c5
0x00f41728
0x00f41728
0x00f4172c
0x00f41733
0x00f41735
0x00f4173b
0x00f41751
0x00f41751
0x00f41753
0x00f41758
0x00000000
0x00f4173d
0x00f4173d
0x00f41740
0x00f41748
0x00f4174b
0x00000000
0x00000000
0x00000000
0x00000000
0x00f4174b
0x00f4173b
0x00f416d5
0x00f416d5
0x00f416d9
0x00f416e0
0x00f416e2
0x00f416e8
0x00f416fe
0x00f416fe
0x00f41700
0x00f41705
0x00000000
0x00f416ea
0x00f416ea
0x00f416ed
0x00f416f5
0x00f416f8
0x00000000
0x00000000
0x00000000
0x00000000
0x00f416f8
0x00f416e8
0x00f414d2
0x00f414d2
0x00f414d6
0x00f414dd
0x00f414df
0x00f414e5
0x00f414fb
0x00f414fb
0x00f414fd
0x00f41502
0x00000000
0x00f414e7
0x00f414e7
0x00f414ea
0x00f414f2
0x00f414f5
0x00000000
0x00000000
0x00000000
0x00000000
0x00f414f5
0x00f414e5
0x00f41477
0x00f41477
0x00f4147e
0x00f41485
0x00f41487
0x00f4148d
0x00f414a3
0x00f414a3
0x00f414a5
0x00f414aa
0x00000000
0x00f4148f
0x00f4148f
0x00f41492
0x00f4149a
0x00f4149d
0x00000000
0x00000000
0x00000000
0x00000000
0x00f4149d
0x00f4148d
0x00f413b8
0x00f413b8
0x00f413bc
0x00f413c3
0x00f413c5
0x00f413cb
0x00f413e1
0x00f413e1
0x00f413e3
0x00f413e8
0x00000000
0x00f413cd
0x00f413cd
0x00f413d0
0x00f413d8
0x00f413db
0x00f41e3e
0x00f41e43
0x00f41e43
0x00f41e48
0x00f41e48
0x00f41e4d
0x00f41e4d
0x00f41e52
0x00f41e53
0x00f41e54
0x00f41e55
0x00f41e56
0x00f41e57
0x00f41e58
0x00f41e59
0x00f41e5a
0x00f41e5b
0x00f41e5c
0x00f41e5d
0x00f41e5e
0x00f41e5f
0x00f41e61
0x00f41e69
0x00f41e70
0x00f41e74
0x00f41e85
0x00f41e88
0x00f41e8d
0x00f41e8f
0x00f41e98
0x00f41e9e
0x00f41ea0
0x00f41ea3
0x00f41ea8
0x00f41eb8
0x00f41ebb
0x00f41ec2
0x00f41ec9
0x00f41ed0
0x00f41ed7
0x00f41edb
0x00f41ee3
0x00f41ef3
0x00f41ef9
0x00f41efc
0x00f41efe
0x00f41f05
0x00f41f08
0x00f41f0d
0x00f41f10
0x00f41f13
0x00f41f16
0x00f41f19
0x00f41f1b
0x00f41f8d
0x00f41f90
0x00f41f96
0x00f41f9c
0x00f41fa2
0x00f41fa4
0x00f42124
0x00f42124
0x00f42128
0x00f4212e
0x00f42137
0x00f4213e
0x00f42143
0x00f42146
0x00f4214b
0x00f4214e
0x00f42150
0x00f42193
0x00f42193
0x00f42196
0x00f42199
0x00000000
0x00f4219f
0x00f4219f
0x00f421a2
0x00f421a9
0x00f421ab
0x00f421b1
0x00000000
0x00f421b7
0x00f421b7
0x00f421ba
0x00f421c2
0x00f421c5
0x00000000
0x00000000
0x00000000
0x00000000
0x00f421c5
0x00f421b1
0x00f42152
0x00f42155
0x00f42159
0x00f4215c
0x00f42162
0x00f42174
0x00f42174
0x00f42176
0x00f4217b
0x00f4217e
0x00f42185
0x00f4218c
0x00000000
0x00f42164
0x00f42164
0x00f42167
0x00f4216f
0x00f42172
0x00000000
0x00000000
0x00000000
0x00000000
0x00f42172
0x00f42162
0x00f41faa
0x00f41fad
0x00f41fb0
0x00f41fb0
0x00f41fb4
0x00000000
0x00f41fba
0x00f41fba
0x00f41fbe
0x00000000
0x00f41fc4
0x00f41fc4
0x00f41fc6
0x00f41fd0
0x00f41fd0
0x00f41fd3
0x00f41fd6
0x00f41fd6
0x00f41fdf
0x00f41fe0
0x00f41fe4
0x00f41fe9
0x00f41ff0
0x00f41ff6
0x00f41ff9
0x00f41fff
0x00f42002
0x00f42008
0x00f4200b
0x00f4200e
0x00f42010
0x00f42012
0x00f42012
0x00f42012
0x00f42015
0x00f42020
0x00f42029
0x00f4202d
0x00f42030
0x00f42033
0x00f42033
0x00f42038
0x00f42038
0x00f4203b
0x00f4203f
0x00000000
0x00f42045
0x00f42045
0x00f42049
0x00f4204e
0x00f42054
0x00f4205b
0x00f42062
0x00f42066
0x00f42069
0x00f4206e
0x00f42073
0x00f4207a
0x00f42081
0x00f42083
0x00f42104
0x00f42109
0x00f42111
0x00f42112
0x00f42116
0x00f42123
0x00f42085
0x00f42088
0x00f4208c
0x00f4208f
0x00f42095
0x00f420ab
0x00f420ab
0x00f420ad
0x00f420b2
0x00f420b5
0x00f420b8
0x00f420bf
0x00f420c6
0x00f420cd
0x00f420d0
0x00000000
0x00f420d2
0x00f420d2
0x00f420d5
0x00f420dc
0x00f420de
0x00f420e4
0x00f420fa
0x00f420fa
0x00f420fc
0x00000000
0x00f420e6
0x00f420e6
0x00f420e9
0x00f420f1
0x00f420f4
0x00000000
0x00000000
0x00000000
0x00000000
0x00f420f4
0x00f420e4
0x00f42097
0x00f42097
0x00f4209a
0x00f420a2
0x00f420a5
0x00000000
0x00000000
0x00000000
0x00000000
0x00f420a5
0x00f42095
0x00f42083
0x00f4203f
0x00f41fbe
0x00f41fb4
0x00f41f1d
0x00f41f1d
0x00f41f22
0x00f421d0
0x00f421d0
0x00000000
0x00f41f28
0x00f41f28
0x00f41f2b
0x00f41f31
0x00f41f5c
0x00f41f5e
0x00f41f6b
0x00f41f6b
0x00f41f60
0x00f41f61
0x00f41f66
0x00f41f66
0x00000000
0x00f41f33
0x00f41f33
0x00f41f33
0x00f41f36
0x00f41f38
0x00f421d5
0x00f421d5
0x00f421da
0x00f421db
0x00f421dc
0x00f421dd
0x00f421de
0x00f421df
0x00f421e0
0x00f421e1
0x00f421e3
0x00f421e5
0x00f421e7
0x00f42229
0x00f4222a
0x00f421e9
0x00f421ee
0x00f421f1
0x00f421f7
0x00f4220b
0x00f4220b
0x00f4220d
0x00f42212
0x00f4221b
0x00f42222
0x00000000
0x00f421f9
0x00f421f9
0x00f421fc
0x00f42204
0x00f42207
0x00f4222b
0x00f42230
0x00f42231
0x00f42232
0x00f42233
0x00f42234
0x00f42235
0x00f42236
0x00f42237
0x00f42238
0x00f42239
0x00f4223a
0x00f4223b
0x00f4223c
0x00f4223d
0x00f4223e
0x00f4223f
0x00f42240
0x00f42241
0x00f42243
0x00f42246
0x00f42249
0x00f42278
0x00f42278
0x00f4227a
0x00f42281
0x00f42288
0x00f4228c
0x00f4224b
0x00f4224b
0x00f4224d
0x00f42254
0x00f4225a
0x00f4226e
0x00f4226e
0x00f42270
0x00000000
0x00f4225c
0x00f4225c
0x00f4225f
0x00f42267
0x00f4226a
0x00f4228d
0x00f42292
0x00f42293
0x00f42294
0x00f42295
0x00f42296
0x00f42297
0x00f42298
0x00f42299
0x00f4229a
0x00f4229b
0x00f4229c
0x00f4229d
0x00f4229e
0x00f4229f
0x00f422a0
0x00f422a1
0x00f422a3
0x00f422a6
0x00f422a9
0x00f422ac
0x00f422ad
0x00f422ae
0x00f422af
0x00f422b1
0x00f422b4
0x00f422b7
0x00f422ba
0x00f422bd
0x00f422bf
0x00f422ec
0x00f422f1
0x00f423ea
0x00f423ea
0x00000000
0x00f422f7
0x00f422f9
0x00f422fc
0x00f42302
0x00f42317
0x00f4231b
0x00f4231d
0x00f4232b
0x00f4232e
0x00f42330
0x00f42333
0x00f42333
0x00f42336
0x00f4233b
0x00000000
0x00f42341
0x00f42341
0x00f42343
0x00f42348
0x00f42371
0x00f42373
0x00f42382
0x00f42382
0x00f42375
0x00f42376
0x00f4237b
0x00f4237e
0x00f4237e
0x00000000
0x00000000
0x00000000
0x00000000
0x00f42348
0x00f4231f
0x00f4231f
0x00f42324
0x00000000
0x00f42324
0x00f42304
0x00f42304
0x00f42309
0x00f4234a
0x00f4234a
0x00f4234a
0x00f4234d
0x00f4234f
0x00f423e5
0x00f423e5
0x00000000
0x00f42355
0x00f42356
0x00f4235b
0x00f4235e
0x00f42360
0x00f423ef
0x00f423ef
0x00f423f4
0x00f423f5
0x00f423f6
0x00f423f7
0x00f423f8
0x00f423f9
0x00f423fa
0x00f423fb
0x00f423fc
0x00f423fd
0x00f423fe
0x00f423ff
0x00f42400
0x00f42401
0x00f42403
0x00f42409
0x00f4240c
0x00f4240d
0x00f4240f
0x00f42412
0x00f42417
0x00f4241a
0x00f4241f
0x00f42422
0x00f42423
0x00f42425
0x00f42572
0x00f42572
0x00000000
0x00f4242b
0x00f4242b
0x00f4242e
0x00f42433
0x00f42436
0x00f42439
0x00f4243c
0x00f4243e
0x00f4244b
0x00f4244d
0x00f4244f
0x00f42451
0x00f4245f
0x00f42461
0x00f42463
0x00f42466
0x00f42466
0x00f42469
0x00f4246e
0x00000000
0x00f42474
0x00f42474
0x00f42476
0x00f4247b
0x00f424a4
0x00f424a6
0x00f424b5
0x00f424b5
0x00f424a8
0x00f424a9
0x00f424ae
0x00f424b1
0x00f424b1
0x00000000
0x00000000
0x00000000
0x00000000
0x00f4247b
0x00f42453
0x00f42453
0x00f42458
0x00000000
0x00f42458
0x00f42440
0x00f42440
0x00f42442
0x00f4247d
0x00f4247d
0x00f4247d
0x00f42480
0x00f42482
0x00f4256d
0x00f4256d
0x00000000
0x00f42488
0x00f42489
0x00f4248e
0x00f42491
0x00f42493
0x00f42577
0x00f42577
0x00f4257c
0x00f4257d
0x00f4257e
0x00f4257f
0x00f42580
0x00f42581
0x00f42583
0x00f42586
0x00f42587
0x00f4258a
0x00f4258b
0x00f4258e
0x00f4258f
0x00f42591
0x00f42597
0x00f4259e
0x00f425a5
0x00f425a8
0x00f425ab
0x00f425ae
0x00f425b3
0x00f425bc
0x00f425bf
0x00f425c1
0x00f42626
0x00f42626
0x00f42629
0x00f4262b
0x00f4262d
0x00f4269d
0x00f4269f
0x00f4277b
0x00f4277b
0x00000000
0x00f426a5
0x00f426a8
0x00f426ab
0x00f426b0
0x00f426c0
0x00f426c5
0x00f426c7
0x00f426ca
0x00f426cd
0x00f426ce
0x00f426d3
0x00000000
0x00f426d9
0x00f426d9
0x00f426db
0x00f426e0
0x00f4270b
0x00f4270d
0x00f4271a
0x00f4271a
0x00f4270f
0x00f42710
0x00f42715
0x00f42715
0x00000000
0x00000000
0x00000000
0x00000000
0x00f426e0
0x00f426b2
0x00f426b2
0x00f426b9
0x00f426e2
0x00f426e2
0x00f426e2
0x00f426e5
0x00f426e7
0x00f42776
0x00f42776
0x00000000
0x00f426ed
0x00f426f3
0x00f426f5
0x00f426f8
0x00f426fa
0x00f42780
0x00f42780
0x00f42785
0x00f42786
0x00f42787
0x00f42788
0x00f42789
0x00f4278a
0x00f4278b
0x00f4278c
0x00f4278d
0x00f4278e
0x00f4278f
0x00f42790
0x00f42795
0x00f4279a
0x00f4279b
0x00f4279c
0x00f4279d
0x00f4279e
0x00f4279f
0x00f427a0
0x00f427a3
0x00f427a9
0x00f427ac
0x00f427ad
0x00f427af
0x00f427b2
0x00f427b7
0x00f427ba
0x00f427bf
0x00f427c2
0x00f427c3
0x00f427c5
0x00f42900
0x00f42900
0x00000000
0x00f427cb
0x00f427cb
0x00f427ce
0x00f427d3
0x00f427d6
0x00f427d9
0x00f427dc
0x00f427de
0x00f427e6
0x00f427ea
0x00f427ec
0x00f427f5
0x00f427f7
0x00f427f9
0x00f427ee
0x00f427ee
0x00f427ee
0x00f427e0
0x00f427e0
0x00f427e0
0x00f42808
0x00f4280a
0x00f42810
0x00f428fb
0x00f428fb
0x00000000
0x00f42816
0x00f42816
0x00f42818
0x00f4281e
0x00f42847
0x00f42849
0x00f42858
0x00f42858
0x00f4284b
0x00f4284c
0x00f42851
0x00f42854
0x00f42854
0x00000000
0x00f42820
0x00f42820
0x00f42820
0x00f42823
0x00f42825
0x00000000
0x00f4282b
0x00f4282c
0x00f42831
0x00f42834
0x00f42836
0x00f42905
0x00f42905
0x00f4290a
0x00f4290b
0x00f42911
0x00f42911
0x00f42911
0x00f42915
0x00f4291c
0x00f42922
0x00f4283c
0x00f4283c
0x00f4283f
0x00f42842
0x00f4285a
0x00f4285d
0x00f42863
0x00f42865
0x00f42868
0x00f4286f
0x00f42870
0x00f42876
0x00f4287d
0x00f42880
0x00f42881
0x00f428dc
0x00f428e6
0x00f428ee
0x00f428f8
0x00f42883
0x00f42883
0x00f42885
0x00f42899
0x00f428a4
0x00f428ab
0x00f428b1
0x00f428c5
0x00f428c5
0x00f428c7
0x00f428cf
0x00f428d9
0x00f428b3
0x00f428b3
0x00f428b6
0x00f428be
0x00f428c1
0x00000000
0x00f428c3
0x00f428c3
0x00000000
0x00f428c3
0x00f428c1
0x00f428b1
0x00f42881
0x00f42836
0x00f42825
0x00f4281e
0x00f42810
0x00f42700
0x00f42700
0x00f42703
0x00f42706
0x00f4271c
0x00f4271f
0x00f42725
0x00f42727
0x00f4272a
0x00f4272e
0x00f42731
0x00f42733
0x00f42733
0x00f4273d
0x00f42740
0x00f42748
0x00f4274c
0x00f4274e
0x00f4274e
0x00f4275e
0x00f42763
0x00f42773
0x00f42773
0x00f426fa
0x00f426e7
0x00f426b0
0x00f4262f
0x00f4262f
0x00f42634
0x00f42637
0x00f4263c
0x00f42641
0x00f42647
0x00f42655
0x00f4265c
0x00f42660
0x00f42667
0x00f4266f
0x00f42673
0x00f42675
0x00f42675
0x00f4267c
0x00f42687
0x00f42692
0x00f42692
0x00f425c3
0x00f425c3
0x00f425c6
0x00000000
0x00f425c8
0x00f425c8
0x00f425cd
0x00f425cf
0x00f425d2
0x00f425d7
0x00f425dc
0x00f425e3
0x00f425ea
0x00f425ed
0x00f425f1
0x00f425f3
0x00f425f3
0x00f425f5
0x00f425f9
0x00f425fb
0x00f425fb
0x00f4260d
0x00f42618
0x00f42623
0x00f42623
0x00f425c6
0x00f42499
0x00f42499
0x00f4249c
0x00f4249f
0x00f424b7
0x00f424ba
0x00f424c0
0x00f424c3
0x00f424c6
0x00f424cc
0x00f424cf
0x00f424d0
0x00f424d6
0x00f424da
0x00f424e0
0x00f424e3
0x00f42542
0x00f42543
0x00f42544
0x00f42550
0x00f4255b
0x00f4255d
0x00f42563
0x00f4256a
0x00f424e5
0x00f424e5
0x00f424e7
0x00f424e8
0x00f424e9
0x00f424f7
0x00f42501
0x00f42504
0x00f4250a
0x00f42511
0x00f42517
0x00f4252b
0x00f4252b
0x00f4252d
0x00f42535
0x00f4253f
0x00f42519
0x00f42519
0x00f4251c
0x00f4251f
0x00f42521
0x00f42524
0x00f42527
0x00000000
0x00f42529
0x00f42529
0x00000000
0x00f42529
0x00f42527
0x00f42517
0x00f424e3
0x00f42493
0x00f42482
0x00f4243e
0x00f42366
0x00f42366
0x00f42369
0x00f4236c
0x00f42384
0x00f42384
0x00f42387
0x00f4238a
0x00f4238d
0x00f42395
0x00f4239c
0x00f4239f
0x00f423a3
0x00f423a6
0x00f423a9
0x00f423d8
0x00f423d8
0x00f423e2
0x00f423ab
0x00f423ab
0x00f423b2
0x00f423b4
0x00f423ba
0x00f423ce
0x00f423ce
0x00f423d0
0x00000000
0x00f423bc
0x00f423bc
0x00f423bf
0x00f423c7
0x00f423ca
0x00000000
0x00f423cc
0x00f423cc
0x00000000
0x00f423cc
0x00f423ca
0x00f423ba
0x00f423a9
0x00f42360
0x00f4234f
0x00f42302
0x00f422c1
0x00f422c1
0x00f422c3
0x00f422c6
0x00f422c8
0x00f422c8
0x00f422ca
0x00f422cd
0x00f422d3
0x00f422db
0x00f422dd
0x00f422e9
0x00f422e9
0x00f4226c
0x00f4226c
0x00000000
0x00f4226c
0x00f4226a
0x00f4225a
0x00f42209
0x00f42209
0x00000000
0x00f42209
0x00f42207
0x00f421f7
0x00f41f3e
0x00f41f44
0x00f41f46
0x00f41f49
0x00f41f4b
0x00f421cb
0x00f421cb
0x00000000
0x00f41f51
0x00f41f51
0x00f41f54
0x00f41f57
0x00f41f6d
0x00f41f70
0x00f41f70
0x00f41f72
0x00f41f75
0x00f41f7f
0x00f41f84
0x00f41f87
0x00f41f8a
0x00000000
0x00f41f8a
0x00f41f4b
0x00f41f38
0x00f41f31
0x00f41f22
0x00000000
0x00000000
0x00000000
0x00f413db
0x00f413cb
0x00f41202
0x00f41228
0x00f41230
0x00000000
0x00000000
0x00000000
0x00000000
0x00f41230
0x00f41200
0x00000000

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00F41155

Part of subcall function 00F429DA: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00F429E6

CreateMutexW.KERNELBASE(00000000,00000000,// {9D255ADC-2EB7-47F7-8DE0-7B2F4F9D9EB2}), ref: 00F411C8
RegOpenKeyW.ADVAPI32(80000002,SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full,?), ref: 00F411E3
RegOpenKeyW.ADVAPI32(80000002,SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full,?), ref: 00F411FC
RegQueryValueExW.KERNELBASE(?,Release,00000000,?,?,?), ref: 00F41228
GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,?,?,000000FF,00000000,7618F5D0), ref: 00F41290
GetCommandLineW.KERNEL32(?,00F53A68,00000000,0000000F,00000000,MEInstaller.exe,0000000F,?,00000000), ref: 00F41797
CommandLineToArgvW.SHELL32(00000000), ref: 00F4179E
CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00F41A5E
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00F41A71
GetExitCodeProcess.KERNEL32 ref: 00F41A86
CloseHandle.KERNEL32(?), ref: 00F41A99
CloseHandle.KERNEL32(?), ref: 00F41AA2
GetLastError.KERNEL32 ref: 00F41BAD
GetUserPreferredUILanguages.KERNEL32(00000008,00000000,00000000,00000000,00F53A68,00000000,6A58FEF8,00000000,?), ref: 00F41EF3

Strings

// {9D255ADC-2EB7-47F7-8DE0-7B2F4F9D9EB2}, xrefs: 00F411BF
Release, xrefs: 00F4121C
en-us, xrefs: 00F4213E
SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full, xrefs: 00F411D9, 00F411F2
string too long, xrefs: 00F41150
MEInstaller.exe, xrefs: 00F4165E, 00F41681
D, xrefs: 00F419CB

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID: CloseCommandCreateHandleLineOpenProcess$ArgvCodeErrorExitFileLanguagesLastModuleMutexNameObjectPreferredQuerySingleUserValueWaitXinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: // {9D255ADC-2EB7-47F7-8DE0-7B2F4F9D9EB2}$D$MEInstaller.exe$Release$SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full$en-us$string too long
API String ID: 2287834115-796906764
Opcode ID: 650bd71c8fc48b9746ed04516455edd9805fdd959023185faf725f12bffdf8b9
Instruction ID: 0b9d3c8a9d78be8f80cf4bcf8fd49d1250cc5788eaa720a348e1aacd2a7cdc99
Opcode Fuzzy Hash: 650bd71c8fc48b9746ed04516455edd9805fdd959023185faf725f12bffdf8b9
Instruction Fuzzy Hash: 9B92F171A043418BD724CF28DC45BAEBBE5FFC4304F504A2DF88997291E774AA85DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00F432F6 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 3
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00F432F6() {
				_Unknown_base(*)()* _t1;

				_t1 = SetUnhandledExceptionFilter(E00F43302); // executed
				return _t1;
			}

0x00f432fb
0x00f43301

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00003302,00F42C43), ref: 00F432FB

Strings

Pdhv, xrefs: 00F432FB

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID: Pdhv
API String ID: 3192549508-2983560932
Opcode ID: 2e1248d81d350d6fe6a69a42068954ff9e54fb2c55d5d25f55d5e1bc277b6a94
Instruction ID: 6476917bcbe83a2b0a826d936b8df590796edd54ead03967f37b57d9e55aef02
Opcode Fuzzy Hash: 2e1248d81d350d6fe6a69a42068954ff9e54fb2c55d5d25f55d5e1bc277b6a94
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00F461D6 Relevance: 3.0, APIs: 2, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00F461D6(void* __eax, void* __ebx, void* __ecx, void* __edx) {

				 *((intOrPtr*)(__ebx + __eax + 0x33)) =  *((intOrPtr*)(__ebx + __eax + 0x33)) + __edx;
			}

0x00f461db

APIs

Part of subcall function 00F48DB8: GetEnvironmentStringsW.KERNEL32 ref: 00F48DC1
Part of subcall function 00F48DB8: _free.LIBCMT ref: 00F48E20
Part of subcall function 00F48DB8: FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00F48E2F

_free.LIBCMT ref: 00F46216
_free.LIBCMT ref: 00F4621D

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID: _free$EnvironmentStrings$Free
String ID:
API String ID: 2490078468-0
Opcode ID: eeafc59dce032e9cdfd876c556278a4bd448c0182aa0c308f27915179e9c65c1
Instruction ID: 20e16238a7f1138e087a6aa1e6d3a108b39576b3ffd1b825a9fa6e13543e5960
Opcode Fuzzy Hash: eeafc59dce032e9cdfd876c556278a4bd448c0182aa0c308f27915179e9c65c1
Instruction Fuzzy Hash: 6BE06523A4D71026AB2177397C426AE3E454B93375B520326ED20D71C3DFA8890671D6

Uniqueness

Uniqueness Score: -1.00%

Function 00F48E6D Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E00F48E6D(void* __edi, void* __eflags) {
				intOrPtr _v12;
				char _t17;
				void* _t18;
				intOrPtr* _t32;
				char _t35;
				void* _t37;

				_push(_t27);
				_t17 = E00F47973(0x40, 0x38); // executed
				_t35 = _t17;
				_v12 = _t35;
				if(_t35 != 0) {
					_t2 = _t35 + 0xe00; // 0xe00
					_t18 = _t2;
					__eflags = _t35 - _t18;
					if(__eflags != 0) {
						_t3 = _t35 + 0x20; // 0x20
						_t32 = _t3;
						_t37 = _t18;
						do {
							_t4 = _t32 - 0x20; // 0x0
							E00F49D42(__eflags, _t4, 0xfa0, 0);
							 *(_t32 - 8) =  *(_t32 - 8) | 0xffffffff;
							 *(_t32 + 0xd) =  *(_t32 + 0xd) & 0x000000f8;
							 *_t32 = 0;
							_t32 = _t32 + 0x38;
							 *((intOrPtr*)(_t32 - 0x34)) = 0;
							 *((intOrPtr*)(_t32 - 0x30)) = 0xa0a0000;
							 *((char*)(_t32 - 0x2c)) = 0xa;
							 *((intOrPtr*)(_t32 - 0x2a)) = 0;
							 *((char*)(_t32 - 0x26)) = 0;
							__eflags = _t32 - 0x20 - _t37;
						} while (__eflags != 0);
						_t35 = _v12;
					}
				} else {
					_t35 = 0;
				}
				E00F479D0(0);
				return _t35;
			}

0x00f48e73
0x00f48e7a
0x00f48e7f
0x00f48e83
0x00f48e8a
0x00f48e90
0x00f48e90
0x00f48e96
0x00f48e98
0x00f48e9b
0x00f48e9b
0x00f48e9e
0x00f48ea0
0x00f48ea6
0x00f48eaa
0x00f48eaf
0x00f48eb3
0x00f48eb7
0x00f48eb9
0x00f48ebc
0x00f48ec2
0x00f48ec9
0x00f48ecd
0x00f48ed0
0x00f48ed3
0x00f48ed3
0x00f48ed7
0x00f48eda
0x00f48e8c
0x00f48e8c
0x00f48e8c
0x00f48edc
0x00f48ee7

APIs

Part of subcall function 00F47973: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00F4777B,00000001,00000364,00000006,000000FF,?,?,00F439C2,?), ref: 00F479B4

_free.LIBCMT ref: 00F48EDC

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 6fc99cc7ca8216a9ca7b6aff411c7ed7c2f0fdf07ceb2dcba78c793af90cefce
Instruction ID: 885213133e5329432ac8969de7bf01cad09ddecbe35068523872d85709c8a771
Opcode Fuzzy Hash: 6fc99cc7ca8216a9ca7b6aff411c7ed7c2f0fdf07ceb2dcba78c793af90cefce
Instruction Fuzzy Hash: 6A014972A08316ABC3209FA8C88198EFFD8EB447F0F140629E955A76C0E7706C11C7E4

Uniqueness

Uniqueness Score: -1.00%

Function 00F47973 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00F47973(signed int _a4, signed int _a8) {
				void* _t8;
				signed int _t13;
				signed int _t18;
				long _t19;

				_t18 = _a4;
				if(_t18 == 0) {
					L2:
					_t19 = _t18 * _a8;
					if(_t19 == 0) {
						_t19 = _t19 + 1;
					}
					while(1) {
						_t8 = RtlAllocateHeap( *0xf5d338, 8, _t19); // executed
						if(_t8 != 0) {
							break;
						}
						__eflags = E00F4689B();
						if(__eflags == 0) {
							L8:
							 *((intOrPtr*)(E00F47035(__eflags))) = 0xc;
							__eflags = 0;
							return 0;
						}
						__eflags = E00F45C43(__eflags, _t19);
						if(__eflags == 0) {
							goto L8;
						}
					}
					return _t8;
				}
				_t13 = 0xffffffe0;
				if(_t13 / _t18 < _a8) {
					goto L8;
				}
				goto L2;
			}

0x00f47979
0x00f4797e
0x00f4798c
0x00f4798c
0x00f47992
0x00f47994
0x00f47994
0x00f479ab
0x00f479b4
0x00f479bc
0x00000000
0x00000000
0x00f4799c
0x00f4799e
0x00f479c0
0x00f479c5
0x00f479cb
0x00000000
0x00f479cb
0x00f479a7
0x00f479a9
0x00000000
0x00000000
0x00f479a9
0x00000000
0x00f479ab
0x00f47984
0x00f4798a
0x00000000
0x00000000
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00F4777B,00000001,00000364,00000006,000000FF,?,?,00F439C2,?), ref: 00F479B4

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b950221a1f03ce4277322e981eb057ad60b157292a648cce8c2f18d98dd55188
Instruction ID: 8f6bc65e19da441bb41885fa02faac54266af777d267210c6c84d88bf7191dfa
Opcode Fuzzy Hash: b950221a1f03ce4277322e981eb057ad60b157292a648cce8c2f18d98dd55188
Instruction Fuzzy Hash: 77F08932A097246BDF217B369C05B5B7F589F81B70F154121FC08E7191DB20E805B6E1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00F43162 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00F43162(intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4) {
				char _v0;
				struct _EXCEPTION_POINTERS _v12;
				intOrPtr _v80;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v608;
				intOrPtr _v612;
				void* _v616;
				intOrPtr _v620;
				char _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				intOrPtr _v636;
				intOrPtr _v640;
				intOrPtr _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				intOrPtr _v656;
				intOrPtr _v660;
				intOrPtr _v664;
				intOrPtr _v668;
				char _v808;
				char* _t39;
				long _t49;
				intOrPtr _t51;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t57;
				intOrPtr _t58;
				intOrPtr _t59;
				intOrPtr* _t60;

				_t59 = __esi;
				_t58 = __edi;
				_t57 = __edx;
				if(IsProcessorFeaturePresent(0x17) != 0) {
					_t55 = _a4;
					asm("int 0x29");
				}
				E00F43358(_t34);
				 *_t60 = 0x2cc;
				_v632 = E00F43E50(_t58,  &_v808, 0, 3);
				_v636 = _t55;
				_v640 = _t57;
				_v644 = _t51;
				_v648 = _t59;
				_v652 = _t58;
				_v608 = ss;
				_v620 = cs;
				_v656 = ds;
				_v660 = es;
				_v664 = fs;
				_v668 = gs;
				asm("pushfd");
				_pop( *_t15);
				_v624 = _v0;
				_t39 =  &_v0;
				_v612 = _t39;
				_v808 = 0x10001;
				_v628 =  *((intOrPtr*)(_t39 - 4));
				E00F43E50(_t58,  &_v92, 0, 0x50);
				_v92 = 0x40000015;
				_v88 = 1;
				_v80 = _v0;
				_t28 = IsDebuggerPresent() - 1; // -1
				_v12.ExceptionRecord =  &_v92;
				asm("sbb bl, bl");
				_v12.ContextRecord =  &_v808;
				_t54 =  ~_t28 + 1;
				SetUnhandledExceptionFilter(0);
				_t49 = UnhandledExceptionFilter( &_v12);
				if(_t49 == 0 && _t54 == 0) {
					_push(3);
					return E00F43358(_t49);
				}
				return _t49;
			}

0x00f43162
0x00f43162
0x00f43162
0x00f43176
0x00f43178
0x00f4317b
0x00f4317b
0x00f4317f
0x00f43184
0x00f4319c
0x00f431a2
0x00f431a8
0x00f431ae
0x00f431b4
0x00f431ba
0x00f431c0
0x00f431c7
0x00f431ce
0x00f431d5
0x00f431dc
0x00f431e3
0x00f431ea
0x00f431eb
0x00f431f4
0x00f431fa
0x00f431fd
0x00f43203
0x00f43212
0x00f4321e
0x00f43229
0x00f43230
0x00f43237
0x00f43242
0x00f4324a
0x00f43253
0x00f43255
0x00f43258
0x00f4325a
0x00f43264
0x00f4326c
0x00f43272
0x00000000
0x00f43279
0x00f4327c

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00F4316E
IsDebuggerPresent.KERNEL32 ref: 00F4323A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00F4325A
UnhandledExceptionFilter.KERNEL32(?), ref: 00F43264

Strings

Pdhv, xrefs: 00F4325A

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID: Pdhv
API String ID: 254469556-2983560932
Opcode ID: 88ca5f3a4f2bfb7ebeb5a0a1512fc178ba9ffdd9c27af99302568ece069a44d3
Instruction ID: 6dab99f73e544567d201a752d3eeda890c906f0f1e870872627adce38bbd56be
Opcode Fuzzy Hash: 88ca5f3a4f2bfb7ebeb5a0a1512fc178ba9ffdd9c27af99302568ece069a44d3
Instruction Fuzzy Hash: 8E311A79D0121C9BDF20DFA4DD497CDBBB8AF18300F1040AAE80DAB250EB745B889F44

Uniqueness

Uniqueness Score: -1.00%

Function 00F45A27 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 78%

			E00F45A27(intOrPtr __ebx, intOrPtr __edx, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				struct _EXCEPTION_POINTERS _v812;
				void* __edi;
				signed int _t40;
				char* _t47;
				char* _t49;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				intOrPtr _t66;
				int _t67;
				intOrPtr _t68;
				signed int _t69;

				_t68 = __esi;
				_t65 = __edx;
				_t60 = __ebx;
				_t40 =  *0xf5c004; // 0x6a58fef8
				_t41 = _t40 ^ _t69;
				_v8 = _t40 ^ _t69;
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E00F43358(_t41);
					_pop(_t61);
				}
				E00F43E50(_t66,  &_v804, 0, 0x50);
				E00F43E50(_t66,  &_v724, 0, 0x2cc);
				_v812.ExceptionRecord =  &_v804;
				_t47 =  &_v724;
				_v812.ContextRecord = _t47;
				_v548 = _t47;
				_v552 = _t61;
				_v556 = _t65;
				_v560 = _t60;
				_v564 = _t68;
				_v568 = _t66;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_v540 = _v0;
				_t49 =  &_v0;
				_v528 = _t49;
				_v724 = 0x10001;
				_v544 =  *((intOrPtr*)(_t49 - 4));
				_v804 = _a8;
				_v800 = _a12;
				_v792 = _v0;
				_t67 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				if(UnhandledExceptionFilter( &_v812) == 0 && _t67 == 0 && _a4 != 0xffffffff) {
					_push(_a4);
					_t57 = E00F43358(_t57);
				}
				return E00F429FA(_t57, _t60, _v8 ^ _t69, _t65, _t67, _t68);
			}

0x00f45a27
0x00f45a27
0x00f45a27
0x00f45a32
0x00f45a37
0x00f45a39
0x00f45a41
0x00f45a43
0x00f45a46
0x00f45a4b
0x00f45a4b
0x00f45a57
0x00f45a6a
0x00f45a78
0x00f45a7e
0x00f45a84
0x00f45a8a
0x00f45a90
0x00f45a96
0x00f45a9c
0x00f45aa2
0x00f45aa8
0x00f45aae
0x00f45ab5
0x00f45abc
0x00f45ac3
0x00f45aca
0x00f45ad1
0x00f45ad8
0x00f45ad9
0x00f45ae2
0x00f45ae8
0x00f45aeb
0x00f45af1
0x00f45afe
0x00f45b07
0x00f45b10
0x00f45b19
0x00f45b27
0x00f45b29
0x00f45b3e
0x00f45b4a
0x00f45b4d
0x00f45b52
0x00f45b5f

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00F45B1F
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00F45B29
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00F45B36

Strings

Pdhv, xrefs: 00F45B29

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: Pdhv
API String ID: 3906539128-2983560932
Opcode ID: 41bf49a85e3af7c4d7327198383c58c22272548c7b1964ac950f7bc803b331da
Instruction ID: 26b9b54846a3035343409d8466351094c8da3598da0dbf64fe88e4d11e7f51f3
Opcode Fuzzy Hash: 41bf49a85e3af7c4d7327198383c58c22272548c7b1964ac950f7bc803b331da
Instruction Fuzzy Hash: 1831D47590131CABCB21DF68DC8878DBBB8AF48710F5041EAE80CA7251E7349F859F44

Uniqueness

Uniqueness Score: -1.00%

Function 00F46626 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00F46626(int _a4) {
				void* _t14;

				if(E00F48E3C(_t14) != 1 && ( *( *[fs:0x30] + 0x68) >> 0x00000008 & 0x00000001) == 0) {
					TerminateProcess(GetCurrentProcess(), _a4);
				}
				E00F46668(_t14, _a4);
				ExitProcess(_a4);
			}

0x00f46633
0x00f4664f
0x00f4664f
0x00f46658
0x00f46661

APIs

GetCurrentProcess.KERNEL32(00F47695,?,00F46625,?,?,00F47695,?,00F47695), ref: 00F46648
TerminateProcess.KERNEL32(00000000,?,00F46625,?,?,00F47695,?,00F47695), ref: 00F4664F
ExitProcess.KERNEL32 ref: 00F46661

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: ced688c27d96457357cbbfb94cd249d56ff32ae61a3784b681e81d121887bad5
Instruction ID: 12338dafdfef8fab9b7b2dc8aa8904bd993111ee12646fb495c62bfce845e120
Opcode Fuzzy Hash: ced688c27d96457357cbbfb94cd249d56ff32ae61a3784b681e81d121887bad5
Instruction Fuzzy Hash: 1DE0B635401108ABDB116FA8ED0DA5D3F6AEB92791B418428FD09CA132CB39DD92EA51

Uniqueness

Uniqueness Score: -1.00%

Function 00F4DDBD Relevance: 1.8, APIs: 1, Instructions: 274
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 100%

			E00F4DDBD(long _a4, signed int* _a8, signed char _a12, signed int _a16, intOrPtr* _a20, unsigned int* _a24, intOrPtr _a28) {
				signed int _t172;
				signed int _t175;
				signed int _t178;
				signed int* _t179;
				signed char _t193;
				signed int _t196;
				signed int _t200;
				signed int _t203;
				void* _t204;
				void* _t207;
				signed int _t210;
				void* _t211;
				signed int _t226;
				unsigned int* _t241;
				signed char _t243;
				signed int* _t251;
				unsigned int* _t257;
				signed int* _t258;
				signed char _t260;
				long _t263;
				signed int* _t266;

				 *(_a4 + 4) = 0;
				_t263 = 0xc000000d;
				 *(_a4 + 8) = 0;
				 *(_a4 + 0xc) = 0;
				_t243 = _a12;
				if((_t243 & 0x00000010) != 0) {
					_t263 = 0xc000008f;
					 *(_a4 + 4) =  *(_a4 + 4) | 1;
				}
				if((_t243 & 0x00000002) != 0) {
					_t263 = 0xc0000093;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000002;
				}
				if((_t243 & 0x00000001) != 0) {
					_t263 = 0xc0000091;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000004;
				}
				if((_t243 & 0x00000004) != 0) {
					_t263 = 0xc000008e;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
				}
				if((_t243 & 0x00000008) != 0) {
					_t263 = 0xc0000090;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000010;
				}
				_t266 = _a8;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 << 4) ^  *(_a4 + 8)) & 0x00000010;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 +  *_t266) ^  *(_a4 + 8)) & 0x00000008;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 >> 1) ^  *(_a4 + 8)) & 0x00000004;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 >> 3) ^  *(_a4 + 8)) & 0x00000002;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 >> 5) ^  *(_a4 + 8)) & 1;
				_t260 = E00F4C225(_a4);
				if((_t260 & 0x00000001) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000010;
				}
				if((_t260 & 0x00000004) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000008;
				}
				if((_t260 & 0x00000008) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000004;
				}
				if((_t260 & 0x00000010) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000002;
				}
				if((_t260 & 0x00000020) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 1;
				}
				_t172 =  *_t266 & 0x00000c00;
				if(_t172 == 0) {
					 *_a4 =  *_a4 & 0xfffffffc;
				} else {
					if(_t172 == 0x400) {
						_t258 = _a4;
						_t226 =  *_t258 & 0xfffffffd | 1;
						L26:
						 *_t258 = _t226;
						L29:
						_t175 =  *_t266 & 0x00000300;
						if(_t175 == 0) {
							_t251 = _a4;
							_t178 =  *_t251 & 0xffffffeb | 0x00000008;
							L35:
							 *_t251 = _t178;
							L36:
							_t179 = _a4;
							_t255 = (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *_t179 =  *_t179 ^ (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *(_a4 + 0x20) =  *(_a4 + 0x20) | 1;
							if(_a28 == 0) {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe3 | 0x00000002;
								 *((long long*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t255 = _a4;
								_t241 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe3 | 0x00000002;
								 *(_a4 + 0x50) =  *_t241;
							} else {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe1;
								 *((intOrPtr*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t241 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe1;
								 *(_a4 + 0x50) =  *_t241;
							}
							E00F4C191(_t255);
							RaiseException(_t263, 0, 1,  &_a4);
							_t257 = _a4;
							_t193 = _t257[2];
							if((_t193 & 0x00000010) != 0) {
								 *_t266 =  *_t266 & 0xfffffffe;
								_t193 = _t257[2];
							}
							if((_t193 & 0x00000008) != 0) {
								 *_t266 =  *_t266 & 0xfffffffb;
								_t193 = _t257[2];
							}
							if((_t193 & 0x00000004) != 0) {
								 *_t266 =  *_t266 & 0xfffffff7;
								_t193 = _t257[2];
							}
							if((_t193 & 0x00000002) != 0) {
								 *_t266 =  *_t266 & 0xffffffef;
								_t193 = _t257[2];
							}
							if((_t193 & 0x00000001) != 0) {
								 *_t266 =  *_t266 & 0xffffffdf;
							}
							_t196 =  *_t257 & 0x00000003;
							if(_t196 == 0) {
								 *_t266 =  *_t266 & 0xfffff3ff;
							} else {
								_t207 = _t196 - 1;
								if(_t207 == 0) {
									_t210 =  *_t266 & 0xfffff7ff | 0x00000400;
									L55:
									 *_t266 = _t210;
									L58:
									_t200 =  *_t257 >> 0x00000002 & 0x00000007;
									if(_t200 == 0) {
										_t203 =  *_t266 & 0xfffff3ff | 0x00000300;
										L64:
										 *_t266 = _t203;
										L65:
										if(_a28 == 0) {
											 *_t241 = _t257[0x14];
										} else {
											 *_t241 = _t257[0x14];
										}
										return _t203;
									}
									_t204 = _t200 - 1;
									if(_t204 == 0) {
										_t203 =  *_t266 & 0xfffff3ff | 0x00000200;
										goto L64;
									}
									_t203 = _t204 - 1;
									if(_t203 == 0) {
										 *_t266 =  *_t266 & 0xfffff3ff;
									}
									goto L65;
								}
								_t211 = _t207 - 1;
								if(_t211 == 0) {
									_t210 =  *_t266 & 0xfffffbff | 0x00000800;
									goto L55;
								}
								if(_t211 == 1) {
									 *_t266 =  *_t266 | 0x00000c00;
								}
							}
							goto L58;
						}
						if(_t175 == 0x200) {
							_t251 = _a4;
							_t178 =  *_t251 & 0xffffffe7 | 0x00000004;
							goto L35;
						}
						if(_t175 == 0x300) {
							 *_a4 =  *_a4 & 0xffffffe3;
						}
						goto L36;
					}
					if(_t172 == 0x800) {
						_t258 = _a4;
						_t226 =  *_t258 & 0xfffffffe | 0x00000002;
						goto L26;
					}
					if(_t172 == 0xc00) {
						 *_a4 =  *_a4 | 0x00000003;
					}
				}
			}

0x00f4ddcb
0x00f4ddd2
0x00f4ddd7
0x00f4dddd
0x00f4dde0
0x00f4dde6
0x00f4ddeb
0x00f4ddf0
0x00f4ddf0
0x00f4ddf6
0x00f4ddfb
0x00f4de00
0x00f4de00
0x00f4de07
0x00f4de0c
0x00f4de11
0x00f4de11
0x00f4de18
0x00f4de1d
0x00f4de22
0x00f4de22
0x00f4de29
0x00f4de2e
0x00f4de33
0x00f4de33
0x00f4de3b
0x00f4de4b
0x00f4de5d
0x00f4de6f
0x00f4de82
0x00f4de94
0x00f4de9c
0x00f4dea1
0x00f4dea6
0x00f4dea6
0x00f4dead
0x00f4deb2
0x00f4deb2
0x00f4deb9
0x00f4debe
0x00f4debe
0x00f4dec5
0x00f4deca
0x00f4deca
0x00f4ded1
0x00f4ded6
0x00f4ded6
0x00f4dee0
0x00f4dee2
0x00f4df1c
0x00f4dee4
0x00f4dee9
0x00f4df0d
0x00f4df15
0x00f4df09
0x00f4df09
0x00f4df1f
0x00f4df26
0x00f4df28
0x00f4df4a
0x00f4df52
0x00f4df55
0x00f4df55
0x00f4df57
0x00f4df57
0x00f4df62
0x00f4df68
0x00f4df6d
0x00f4df74
0x00f4dfae
0x00f4dfb9
0x00f4dfbf
0x00f4dfc2
0x00f4dfc5
0x00f4dfd1
0x00f4dfd9
0x00f4df76
0x00f4df79
0x00f4df85
0x00f4df8b
0x00f4df91
0x00f4df94
0x00f4df9d
0x00f4df9d
0x00f4dfdc
0x00f4dfea
0x00f4dff0
0x00f4dff3
0x00f4dff8
0x00f4dffa
0x00f4dffd
0x00f4dffd
0x00f4e002
0x00f4e004
0x00f4e007
0x00f4e007
0x00f4e00c
0x00f4e00e
0x00f4e011
0x00f4e011
0x00f4e016
0x00f4e018
0x00f4e01b
0x00f4e01b
0x00f4e020
0x00f4e022
0x00f4e022
0x00f4e02f
0x00f4e032
0x00f4e069
0x00f4e034
0x00f4e034
0x00f4e037
0x00f4e062
0x00f4e057
0x00f4e057
0x00f4e06b
0x00f4e073
0x00f4e076
0x00f4e095
0x00f4e09a
0x00f4e09a
0x00f4e09c
0x00f4e0a1
0x00f4e0ad
0x00f4e0a3
0x00f4e0a6
0x00f4e0a6
0x00f4e0b2
0x00f4e0b2
0x00f4e078
0x00f4e07b
0x00f4e08a
0x00000000
0x00f4e08a
0x00f4e07d
0x00f4e080
0x00f4e082
0x00f4e082
0x00000000
0x00f4e080
0x00f4e039
0x00f4e03c
0x00f4e052
0x00000000
0x00f4e052
0x00f4e041
0x00f4e043
0x00f4e043
0x00f4e041
0x00000000
0x00f4e032
0x00f4df2f
0x00f4df3d
0x00f4df45
0x00000000
0x00f4df45
0x00f4df33
0x00f4df38
0x00f4df38
0x00000000
0x00f4df33
0x00f4def0
0x00f4defe
0x00f4df06
0x00000000
0x00f4df06
0x00f4def4
0x00f4def9
0x00f4def9
0x00f4def4

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00F4DDB8,?,?,00000008,?,?,00F4DA50,00000000), ref: 00F4DFEA

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 3241965f73ddf0b551a8e31e278110c89f52b055d68448377f4bda451fb89c5e
Instruction ID: 7c690a79ba153fb14b8a99f331946b5684d1716ae7b73311aa9fe9295991f05e
Opcode Fuzzy Hash: 3241965f73ddf0b551a8e31e278110c89f52b055d68448377f4bda451fb89c5e
Instruction Fuzzy Hash: 4BB13B32610609DFD725CF2CC48AB657FA0FF45364F258658E8AACF2A1C335E991DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00F43405 Relevance: 1.6, APIs: 1, Instructions: 144
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00F43405(signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _t60;
				signed int _t61;
				signed int _t62;
				signed int _t63;
				signed int _t66;
				signed int _t67;
				signed int _t73;
				intOrPtr _t74;
				intOrPtr _t75;
				intOrPtr* _t77;
				signed int _t78;
				intOrPtr* _t82;
				signed int _t85;
				signed int _t90;
				intOrPtr* _t93;
				signed int _t96;
				signed int _t99;
				signed int _t104;

				_t90 = __edx;
				 *0xf5ccb8 =  *0xf5ccb8 & 0x00000000;
				 *0xf5c010 =  *0xf5c010 | 0x00000001;
				if(IsProcessorFeaturePresent(0xa) == 0) {
					L23:
					return 0;
				}
				_v20 = _v20 & 0x00000000;
				_push(_t74);
				_t93 =  &_v40;
				asm("cpuid");
				_t75 = _t74;
				 *_t93 = 0;
				 *((intOrPtr*)(_t93 + 4)) = _t74;
				 *((intOrPtr*)(_t93 + 8)) = 0;
				 *(_t93 + 0xc) = _t90;
				_v16 = _v40;
				_v12 = _v28 ^ 0x49656e69;
				_v8 = _v36 ^ 0x756e6547;
				_push(_t75);
				asm("cpuid");
				_t77 =  &_v40;
				 *_t77 = 1;
				 *((intOrPtr*)(_t77 + 4)) = _t75;
				 *((intOrPtr*)(_t77 + 8)) = 0;
				 *(_t77 + 0xc) = _t90;
				if((_v8 | _v32 ^ 0x6c65746e | _v12) != 0) {
					L9:
					_t96 =  *0xf5ccbc; // 0x2
					L10:
					_t85 = _v32;
					_t60 = 7;
					_v8 = _t85;
					if(_v16 < _t60) {
						_t78 = _v20;
					} else {
						_push(_t77);
						asm("cpuid");
						_t82 =  &_v40;
						 *_t82 = _t60;
						 *((intOrPtr*)(_t82 + 4)) = _t77;
						 *((intOrPtr*)(_t82 + 8)) = 0;
						_t85 = _v8;
						 *(_t82 + 0xc) = _t90;
						_t78 = _v36;
						if((_t78 & 0x00000200) != 0) {
							 *0xf5ccbc = _t96 | 0x00000002;
						}
					}
					_t61 =  *0xf5c010; // 0x6f
					_t62 = _t61 | 0x00000002;
					 *0xf5ccb8 = 1;
					 *0xf5c010 = _t62;
					if((_t85 & 0x00100000) != 0) {
						_t63 = _t62 | 0x00000004;
						 *0xf5ccb8 = 2;
						 *0xf5c010 = _t63;
						if((_t85 & 0x08000000) != 0 && (_t85 & 0x10000000) != 0) {
							asm("xgetbv");
							_v24 = _t63;
							_v20 = _t90;
							_t104 = 6;
							if((_v24 & _t104) == _t104) {
								_t66 =  *0xf5c010; // 0x6f
								_t67 = _t66 | 0x00000008;
								 *0xf5ccb8 = 3;
								 *0xf5c010 = _t67;
								if((_t78 & 0x00000020) != 0) {
									 *0xf5ccb8 = 5;
									 *0xf5c010 = _t67 | 0x00000020;
									if((_t78 & 0xd0030000) == 0xd0030000 && (_v24 & 0x000000e0) == 0xe0) {
										 *0xf5c010 =  *0xf5c010 | 0x00000040;
										 *0xf5ccb8 = _t104;
									}
								}
							}
						}
					}
					goto L23;
				}
				_t73 = _v40 & 0x0fff3ff0;
				if(_t73 == 0x106c0 || _t73 == 0x20660 || _t73 == 0x20670 || _t73 == 0x30650 || _t73 == 0x30660 || _t73 == 0x30670) {
					_t99 =  *0xf5ccbc; // 0x2
					_t96 = _t99 | 0x00000001;
					 *0xf5ccbc = _t96;
					goto L10;
				} else {
					goto L9;
				}
			}

0x00f43405
0x00f43408
0x00f43412
0x00f43423
0x00f435d2
0x00f435d5
0x00f435d5
0x00f43429
0x00f4342f
0x00f43434
0x00f43438
0x00f4343c
0x00f4343d
0x00f4343f
0x00f43442
0x00f43447
0x00f43450
0x00f43461
0x00f4346c
0x00f43472
0x00f43473
0x00f43478
0x00f4347b
0x00f43480
0x00f43488
0x00f4348b
0x00f4348e
0x00f434d3
0x00f434d3
0x00f434d9
0x00f434d9
0x00f434de
0x00f434df
0x00f434e5
0x00f43516
0x00f434e7
0x00f434e9
0x00f434ea
0x00f434ef
0x00f434f2
0x00f434f4
0x00f434f7
0x00f434fa
0x00f434fd
0x00f43500
0x00f43509
0x00f4350e
0x00f4350e
0x00f43509
0x00f43519
0x00f4351e
0x00f43521
0x00f4352b
0x00f43536
0x00f4353c
0x00f4353f
0x00f43549
0x00f43554
0x00f43560
0x00f43563
0x00f43566
0x00f43571
0x00f43576
0x00f43578
0x00f4357d
0x00f43580
0x00f4358a
0x00f43592
0x00f43597
0x00f435a1
0x00f435af
0x00f435c2
0x00f435c9
0x00f435c9
0x00f435af
0x00f43592
0x00f43576
0x00f43554
0x00000000
0x00f435d1
0x00f43493
0x00f4349d
0x00f434c2
0x00f434c8
0x00f434cb
0x00000000
0x00000000
0x00000000
0x00000000

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00F4341B

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 3b64eab28fb69ca914af0eedf3f7f27af9a408d68970d6003d989a3c26693933
Instruction ID: 84bbb4266df1de573a923219ab8475aae9bc89b2bab8bf6a4c5bd621e724ccad
Opcode Fuzzy Hash: 3b64eab28fb69ca914af0eedf3f7f27af9a408d68970d6003d989a3c26693933
Instruction Fuzzy Hash: 90518271E04319CFDB15CF98D8857AABBF0FB44319F24846AD906E7291D3749A40EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F47DAF Relevance: 1.6, APIs: 1, Instructions: 140
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00F47DAF(void* __ecx, void* __esi, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr* _a16) {
				signed int _v8;
				signed int _v12;
				union _FINDEX_INFO_LEVELS _v28;
				intOrPtr* _v32;
				intOrPtr _v36;
				signed int _v48;
				struct _WIN32_FIND_DATAW _v604;
				char _v605;
				intOrPtr* _v612;
				union _FINDEX_INFO_LEVELS _v616;
				union _FINDEX_INFO_LEVELS _v620;
				union _FINDEX_INFO_LEVELS _v624;
				signed int _v628;
				union _FINDEX_INFO_LEVELS _v632;
				union _FINDEX_INFO_LEVELS _v636;
				signed int _v640;
				signed int _v644;
				union _FINDEX_INFO_LEVELS _v648;
				union _FINDEX_INFO_LEVELS _v652;
				union _FINDEX_INFO_LEVELS _v656;
				union _FINDEX_INFO_LEVELS _v660;
				signed int _v664;
				union _FINDEX_INFO_LEVELS _v668;
				union _FINDEX_INFO_LEVELS _v672;
				void* __ebx;
				void* __edi;
				intOrPtr _t68;
				signed int _t73;
				signed int _t75;
				char _t77;
				signed char _t78;
				signed int _t84;
				signed int _t94;
				signed int _t97;
				union _FINDEX_INFO_LEVELS _t98;
				union _FINDEX_INFO_LEVELS _t100;
				intOrPtr* _t106;
				signed int _t109;
				intOrPtr _t116;
				signed int _t118;
				signed int _t121;
				signed int _t123;
				void* _t126;
				union _FINDEX_INFO_LEVELS _t127;
				void* _t128;
				intOrPtr* _t130;
				intOrPtr* _t133;
				signed int _t135;
				intOrPtr* _t138;
				signed int _t143;
				signed int _t149;
				void* _t155;
				signed int _t158;
				intOrPtr _t160;
				void* _t161;
				void* _t165;
				void* _t166;
				signed int _t167;
				signed int _t170;
				void* _t171;
				signed int _t172;
				void* _t173;
				void* _t174;

				_push(__ecx);
				_t133 = _a4;
				_t2 = _t133 + 1; // 0x1
				_t155 = _t2;
				do {
					_t68 =  *_t133;
					_t133 = _t133 + 1;
				} while (_t68 != 0);
				_t158 = _a12;
				_t135 = _t133 - _t155 + 1;
				_v8 = _t135;
				if(_t135 <=  !_t158) {
					_push(__esi);
					_t5 = _t158 + 1; // 0x1
					_t126 = _t5 + _t135;
					_t165 = E00F47973(_t126, 1);
					__eflags = _t158;
					if(_t158 == 0) {
						L7:
						_push(_v8);
						_t126 = _t126 - _t158;
						_t73 = E00F4B201(_t165 + _t158, _t126, _a4);
						_t172 = _t171 + 0x10;
						__eflags = _t73;
						if(_t73 != 0) {
							goto L12;
						} else {
							_t130 = _a16;
							_t118 = E00F481AA(_t130);
							_v8 = _t118;
							__eflags = _t118;
							if(_t118 == 0) {
								 *( *(_t130 + 4)) = _t165;
								_t167 = 0;
								_t14 = _t130 + 4;
								 *_t14 =  *(_t130 + 4) + 4;
								__eflags =  *_t14;
							} else {
								E00F479D0(_t165);
								_t167 = _v8;
							}
							E00F479D0(0);
							_t121 = _t167;
							goto L4;
						}
					} else {
						_push(_t158);
						_t123 = E00F4B201(_t165, _t126, _a8);
						_t172 = _t171 + 0x10;
						__eflags = _t123;
						if(_t123 != 0) {
							L12:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E00F45C00();
							asm("int3");
							_t170 = _t172;
							_t173 = _t172 - 0x298;
							_t75 =  *0xf5c004; // 0x6a58fef8
							_v48 = _t75 ^ _t170;
							_t138 = _v32;
							_t156 = _v28;
							_push(_t126);
							_push(0);
							_t160 = _v36;
							_v648 = _t156;
							__eflags = _t138 - _t160;
							if(_t138 != _t160) {
								while(1) {
									_t116 =  *_t138;
									__eflags = _t116 - 0x2f;
									if(_t116 == 0x2f) {
										break;
									}
									__eflags = _t116 - 0x5c;
									if(_t116 != 0x5c) {
										__eflags = _t116 - 0x3a;
										if(_t116 != 0x3a) {
											_t138 = E00F4B250(_t160, _t138);
											__eflags = _t138 - _t160;
											if(_t138 != _t160) {
												continue;
											}
										}
									}
									break;
								}
								_t156 = _v612;
							}
							_t77 =  *_t138;
							_v605 = _t77;
							__eflags = _t77 - 0x3a;
							if(_t77 != 0x3a) {
								L23:
								_t127 = 0;
								__eflags = _t77 - 0x2f;
								if(__eflags == 0) {
									L26:
									_t78 = 1;
								} else {
									__eflags = _t77 - 0x5c;
									if(__eflags == 0) {
										goto L26;
									} else {
										__eflags = _t77 - 0x3a;
										_t78 = 0;
										if(__eflags == 0) {
											goto L26;
										}
									}
								}
								_v672 = _t127;
								_v668 = _t127;
								_push(_t165);
								asm("sbb eax, eax");
								_v664 = _t127;
								_v660 = _t127;
								_v640 =  ~(_t78 & 0x000000ff) & _t138 - _t160 + 0x00000001;
								_v656 = _t127;
								_v652 = _t127;
								_t84 = E00F47BA3(_t138 - _t160 + 1, _t160,  &_v672, E00F480B7(_t156, __eflags));
								_t174 = _t173 + 0xc;
								asm("sbb eax, eax");
								_t166 = FindFirstFileExW( !( ~_t84) & _v664, _t127,  &_v604, _t127, _t127, _t127);
								__eflags = _t166 - 0xffffffff;
								if(_t166 != 0xffffffff) {
									_t143 =  *((intOrPtr*)(_v612 + 4)) -  *_v612;
									__eflags = _t143;
									_t144 = _t143 >> 2;
									_v644 = _t143 >> 2;
									do {
										_v636 = _t127;
										_v632 = _t127;
										_v628 = _t127;
										_v624 = _t127;
										_v620 = _t127;
										_v616 = _t127;
										_t94 = E00F47AD4( &(_v604.cFileName),  &_v636,  &_v605, E00F480B7(_t156, __eflags));
										_t174 = _t174 + 0x10;
										asm("sbb eax, eax");
										_t97 =  !( ~_t94) & _v628;
										__eflags =  *_t97 - 0x2e;
										if( *_t97 != 0x2e) {
											L34:
											_push(_v612);
											_t98 = E00F47DAF(_t144, _t166, _t97, _t160, _v640);
											_t174 = _t174 + 0x10;
											_v648 = _t98;
											__eflags = _t98;
											if(_t98 != 0) {
												__eflags = _v616 - _t127;
												if(_v616 != _t127) {
													E00F479D0(_v628);
													_t98 = _v648;
												}
												_t127 = _t98;
											} else {
												goto L35;
											}
										} else {
											_t144 =  *((intOrPtr*)(_t97 + 1));
											__eflags = _t144;
											if(_t144 == 0) {
												goto L35;
											} else {
												__eflags = _t144 - 0x2e;
												if(_t144 != 0x2e) {
													goto L34;
												} else {
													__eflags =  *((intOrPtr*)(_t97 + 2)) - _t127;
													if( *((intOrPtr*)(_t97 + 2)) == _t127) {
														goto L35;
													} else {
														goto L34;
													}
												}
											}
										}
										L43:
										FindClose(_t166);
										goto L44;
										L35:
										__eflags = _v616 - _t127;
										if(_v616 != _t127) {
											E00F479D0(_v628);
											_pop(_t144);
										}
										__eflags = FindNextFileW(_t166,  &_v604);
									} while (__eflags != 0);
									_t106 = _v612;
									_t149 = _v644;
									_t156 =  *_t106;
									_t109 =  *((intOrPtr*)(_t106 + 4)) -  *_t106 >> 2;
									__eflags = _t149 - _t109;
									if(_t149 != _t109) {
										E00F4AC60(_t156, _t156 + _t149 * 4, _t109 - _t149, 4, E00F47A0A);
									}
									goto L43;
								} else {
									_push(_v612);
									_t127 = E00F47DAF( &_v604, _t166, _t160, _t127, _t127);
								}
								L44:
								__eflags = _v652;
								_pop(_t165);
								if(_v652 != 0) {
									E00F479D0(_v664);
								}
								_t100 = _t127;
							} else {
								__eflags = _t138 - _t160 + 1;
								if(_t138 == _t160 + 1) {
									_t77 = _v605;
									goto L23;
								} else {
									_push(_t156);
									_t100 = E00F47DAF(_t138, _t165, _t160, 0, 0);
								}
							}
							_pop(_t161);
							__eflags = _v12 ^ _t170;
							_pop(_t128);
							return E00F429FA(_t100, _t128, _v12 ^ _t170, _t156, _t161, _t165);
						} else {
							goto L7;
						}
					}
				} else {
					_t121 = 0xc;
					L4:
					return _t121;
				}
			}

0x00f47db4
0x00f47db5
0x00f47db8
0x00f47db8
0x00f47dbb
0x00f47dbb
0x00f47dbd
0x00f47dbe
0x00f47dc3
0x00f47dca
0x00f47dcd
0x00f47dd2
0x00f47ddb
0x00f47ddc
0x00f47ddf
0x00f47de9
0x00f47ded
0x00f47def
0x00f47e03
0x00f47e03
0x00f47e06
0x00f47e10
0x00f47e15
0x00f47e18
0x00f47e1a
0x00000000
0x00f47e1c
0x00f47e1c
0x00f47e21
0x00f47e28
0x00f47e2b
0x00f47e2d
0x00f47e3e
0x00f47e40
0x00f47e42
0x00f47e42
0x00f47e42
0x00f47e2f
0x00f47e30
0x00f47e35
0x00f47e38
0x00f47e47
0x00f47e4d
0x00000000
0x00f47e50
0x00f47df1
0x00f47df1
0x00f47df7
0x00f47dfc
0x00f47dff
0x00f47e01
0x00f47e53
0x00f47e55
0x00f47e56
0x00f47e57
0x00f47e58
0x00f47e59
0x00f47e5a
0x00f47e5f
0x00f47e63
0x00f47e65
0x00f47e6b
0x00f47e72
0x00f47e75
0x00f47e78
0x00f47e7b
0x00f47e7c
0x00f47e7d
0x00f47e80
0x00f47e86
0x00f47e88
0x00f47e8a
0x00f47e8a
0x00f47e8c
0x00f47e8e
0x00000000
0x00000000
0x00f47e90
0x00f47e92
0x00f47e94
0x00f47e96
0x00f47ea1
0x00f47ea3
0x00f47ea5
0x00000000
0x00000000
0x00f47ea5
0x00f47e96
0x00000000
0x00f47e92
0x00f47ea7
0x00f47ea7
0x00f47ead
0x00f47eaf
0x00f47eb5
0x00f47eb7
0x00f47ed9
0x00f47ed9
0x00f47edb
0x00f47edd
0x00f47ee9
0x00f47ee9
0x00f47edf
0x00f47edf
0x00f47ee1
0x00000000
0x00f47ee3
0x00f47ee3
0x00f47ee5
0x00f47ee7
0x00000000
0x00000000
0x00f47ee7
0x00f47ee1
0x00f47ef1
0x00f47ef9
0x00f47eff
0x00f47f00
0x00f47f02
0x00f47f0a
0x00f47f10
0x00f47f16
0x00f47f1c
0x00f47f30
0x00f47f35
0x00f47f40
0x00f47f56
0x00f47f58
0x00f47f5b
0x00f47f7e
0x00f47f7e
0x00f47f80
0x00f47f83
0x00f47f89
0x00f47f89
0x00f47f8f
0x00f47f95
0x00f47f9b
0x00f47fa1
0x00f47fa7
0x00f47fc8
0x00f47fcd
0x00f47fd2
0x00f47fd6
0x00f47fdc
0x00f47fdf
0x00f47ff2
0x00f47ff2
0x00f48000
0x00f48005
0x00f48008
0x00f4800e
0x00f48010
0x00f4806e
0x00f48074
0x00f4807c
0x00f48081
0x00f48087
0x00f48088
0x00000000
0x00000000
0x00000000
0x00f47fe1
0x00f47fe1
0x00f47fe4
0x00f47fe6
0x00000000
0x00f47fe8
0x00f47fe8
0x00f47feb
0x00000000
0x00f47fed
0x00f47fed
0x00f47ff0
0x00000000
0x00000000
0x00000000
0x00000000
0x00f47ff0
0x00f47feb
0x00f47fe6
0x00f4808a
0x00f4808b
0x00000000
0x00f48012
0x00f48012
0x00f48018
0x00f48020
0x00f48025
0x00f48025
0x00f48034
0x00f48034
0x00f4803c
0x00f48042
0x00f48048
0x00f4804f
0x00f48052
0x00f48054
0x00f48064
0x00f48069
0x00000000
0x00f47f5d
0x00f47f5d
0x00f47f6e
0x00f47f6e
0x00f48091
0x00f48091
0x00f48098
0x00f48099
0x00f480a1
0x00f480a6
0x00f480a7
0x00f47eb9
0x00f47ebc
0x00f47ebe
0x00f47ed3
0x00000000
0x00f47ec0
0x00f47ec0
0x00f47ec6
0x00f47ecb
0x00f47ebe
0x00f480ac
0x00f480ad
0x00f480af
0x00f480b6
0x00000000
0x00000000
0x00000000
0x00f47e01
0x00f47dd4
0x00f47dd6
0x00f47dd7
0x00f47dd9
0x00f47dd9

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f93a36f10400ccc77ad880ae7dcbcdce23893d2479ba27a64bf0991357b309d3
Instruction ID: 350b9040119a2f47b615e4695ee5f4f28c398a4ca949bab8ec3858a1bbfa31ce
Opcode Fuzzy Hash: f93a36f10400ccc77ad880ae7dcbcdce23893d2479ba27a64bf0991357b309d3
Instruction Fuzzy Hash: 7341A471C08219AFDB20EF69CC89AAABBB9EF45310F1442D9E81D93211DB349E849F50

Uniqueness

Uniqueness Score: -1.00%

Function 00F49EE9 Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F49EE9() {
				signed int _t3;

				_t3 = GetProcessHeap();
				 *0xf5d338 = _t3;
				return _t3 & 0xffffff00 | _t3 != 0x00000000;
			}

0x00f49ee9
0x00f49ef1
0x00f49ef9

APIs

GetProcessHeap.KERNEL32 ref: 00F49EE9

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 7fe48c55e86a02906e50f43694f691c5c7f2c96ef07fe01d79fd3df74393fcf1
Instruction ID: 5a4a6e674890020f2c7799c5080eb5ea16fd9ba912fb2907e17811839bca0cc2
Opcode Fuzzy Hash: 7fe48c55e86a02906e50f43694f691c5c7f2c96ef07fe01d79fd3df74393fcf1
Instruction Fuzzy Hash: AAA00174602349CF97548F36AA892093AA9ABA6AA27158069A909C5660EA248494AA02

Uniqueness

Uniqueness Score: -1.00%

Function 00F48E3C Relevance: .0, Instructions: 22
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00F48E3C(void* __ecx) {
				char _v8;
				intOrPtr _t7;
				char _t13;

				_t13 = 0;
				_v8 = 0;
				_t7 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
				_t16 =  *((intOrPtr*)(_t7 + 8));
				if( *((intOrPtr*)(_t7 + 8)) < 0) {
					L2:
					_t13 = 1;
				} else {
					E00F49BE4(_t16,  &_v8);
					if(_v8 != 1) {
						goto L2;
					}
				}
				return _t13;
			}

0x00f48e49
0x00f48e4b
0x00f48e4e
0x00f48e51
0x00f48e54
0x00f48e65
0x00f48e67
0x00f48e56
0x00f48e5a
0x00f48e63
0x00000000
0x00000000
0x00f48e63
0x00f48e6c

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 229538d156fd22a1852c5877b47bb8296c3c50ef5a21f9898112eb5059fd10f4
Instruction ID: b9c891c0955377d651bd45b39efa8e2392c08ca62a275acc453053839b980d54
Opcode Fuzzy Hash: 229538d156fd22a1852c5877b47bb8296c3c50ef5a21f9898112eb5059fd10f4
Instruction Fuzzy Hash: 6BE08C32A15238EBCB24DBCCC90498AF7ECEB44B50B510096B901E3200C674DF01E7D0

Uniqueness

Uniqueness Score: -1.00%

Function 00F4972F Relevance: 19.6, APIs: 13, Instructions: 113
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00F4972F(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t25;
				intOrPtr* _t26;
				intOrPtr _t28;
				intOrPtr* _t29;
				intOrPtr* _t31;
				intOrPtr* _t45;
				intOrPtr* _t46;
				intOrPtr* _t47;
				intOrPtr* _t55;
				intOrPtr* _t70;
				intOrPtr _t74;

				_t74 = _a4;
				_t25 =  *((intOrPtr*)(_t74 + 0x88));
				if(_t25 != 0 && _t25 != 0xf5c648) {
					_t45 =  *((intOrPtr*)(_t74 + 0x7c));
					if(_t45 != 0 &&  *_t45 == 0) {
						_t46 =  *((intOrPtr*)(_t74 + 0x84));
						if(_t46 != 0 &&  *_t46 == 0) {
							E00F479D0(_t46);
							E00F49308( *((intOrPtr*)(_t74 + 0x88)));
						}
						_t47 =  *((intOrPtr*)(_t74 + 0x80));
						if(_t47 != 0 &&  *_t47 == 0) {
							E00F479D0(_t47);
							E00F49406( *((intOrPtr*)(_t74 + 0x88)));
						}
						E00F479D0( *((intOrPtr*)(_t74 + 0x7c)));
						E00F479D0( *((intOrPtr*)(_t74 + 0x88)));
					}
				}
				_t26 =  *((intOrPtr*)(_t74 + 0x8c));
				if(_t26 != 0 &&  *_t26 == 0) {
					E00F479D0( *((intOrPtr*)(_t74 + 0x90)) - 0xfe);
					E00F479D0( *((intOrPtr*)(_t74 + 0x94)) - 0x80);
					E00F479D0( *((intOrPtr*)(_t74 + 0x98)) - 0x80);
					E00F479D0( *((intOrPtr*)(_t74 + 0x8c)));
				}
				E00F498A0( *((intOrPtr*)(_t74 + 0x9c)));
				_t28 = 6;
				_t55 = _t74 + 0xa0;
				_v8 = _t28;
				_t70 = _t74 + 0x28;
				do {
					if( *((intOrPtr*)(_t70 - 8)) != 0xf5c120) {
						_t31 =  *_t70;
						if(_t31 != 0 &&  *_t31 == 0) {
							E00F479D0(_t31);
							E00F479D0( *_t55);
						}
						_t28 = _v8;
					}
					if( *((intOrPtr*)(_t70 - 0xc)) != 0) {
						_t29 =  *((intOrPtr*)(_t70 - 4));
						if(_t29 != 0 &&  *_t29 == 0) {
							E00F479D0(_t29);
						}
						_t28 = _v8;
					}
					_t55 = _t55 + 4;
					_t70 = _t70 + 0x10;
					_t28 = _t28 - 1;
					_v8 = _t28;
				} while (_t28 != 0);
				return E00F479D0(_t74);
			}

0x00f49737
0x00f4973b
0x00f49743
0x00f4974c
0x00f49751
0x00f49758
0x00f49760
0x00f49768
0x00f49773
0x00f49779
0x00f4977a
0x00f49782
0x00f4978a
0x00f49795
0x00f4979b
0x00f4979f
0x00f497aa
0x00f497b0
0x00f49751
0x00f497b1
0x00f497b9
0x00f497cc
0x00f497df
0x00f497ed
0x00f497f8
0x00f497fd
0x00f49806
0x00f4980e
0x00f4980f
0x00f49815
0x00f49818
0x00f4981b
0x00f49822
0x00f49824
0x00f49828
0x00f49830
0x00f49837
0x00f4983d
0x00f4983e
0x00f4983e
0x00f49845
0x00f49847
0x00f4984c
0x00f49854
0x00f49859
0x00f4985a
0x00f4985a
0x00f4985d
0x00f49860
0x00f49863
0x00f49866
0x00f49866
0x00f49876

APIs

___free_lconv_mon.LIBCMT ref: 00F49773

Part of subcall function 00F49308: _free.LIBCMT ref: 00F49325
Part of subcall function 00F49308: _free.LIBCMT ref: 00F49337
Part of subcall function 00F49308: _free.LIBCMT ref: 00F49349
Part of subcall function 00F49308: _free.LIBCMT ref: 00F4935B
Part of subcall function 00F49308: _free.LIBCMT ref: 00F4936D
Part of subcall function 00F49308: _free.LIBCMT ref: 00F4937F
Part of subcall function 00F49308: _free.LIBCMT ref: 00F49391
Part of subcall function 00F49308: _free.LIBCMT ref: 00F493A3
Part of subcall function 00F49308: _free.LIBCMT ref: 00F493B5
Part of subcall function 00F49308: _free.LIBCMT ref: 00F493C7
Part of subcall function 00F49308: _free.LIBCMT ref: 00F493D9
Part of subcall function 00F49308: _free.LIBCMT ref: 00F493EB
Part of subcall function 00F49308: _free.LIBCMT ref: 00F493FD

_free.LIBCMT ref: 00F49768

Part of subcall function 00F479D0: HeapFree.KERNEL32(00000000,00000000,?,00F49499,?,00000000,?,?,?,00F494C0,?,00000007,?,?,00F498C6,?), ref: 00F479E6
Part of subcall function 00F479D0: GetLastError.KERNEL32(?,?,00F49499,?,00000000,?,?,?,00F494C0,?,00000007,?,?,00F498C6,?,?), ref: 00F479F8

_free.LIBCMT ref: 00F4978A
_free.LIBCMT ref: 00F4979F
_free.LIBCMT ref: 00F497AA
_free.LIBCMT ref: 00F497CC
_free.LIBCMT ref: 00F497DF
_free.LIBCMT ref: 00F497ED
_free.LIBCMT ref: 00F497F8
_free.LIBCMT ref: 00F49830
_free.LIBCMT ref: 00F49837
_free.LIBCMT ref: 00F49854
_free.LIBCMT ref: 00F4986C

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 152c158619f5cdd7f2de64ace09e23bee8c13974fee79847fed3b0b9b7c31c7e
Instruction ID: 398a56d16b5407e016a0af302701b5f4cfb93b373ccc9e8cbe2c127a0ed02472
Opcode Fuzzy Hash: 152c158619f5cdd7f2de64ace09e23bee8c13974fee79847fed3b0b9b7c31c7e
Instruction Fuzzy Hash: 88314B31A0C301AFEB20AE3CEC45B577BE8AF01360F54482AEC59D7191DBB5AC80EB54

Uniqueness

Uniqueness Score: -1.00%

Function 00F4430B Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 63%

			E00F4430B(signed int __edx, signed char* _a4, signed int _a8, signed int _a12, char _a16, signed int* _a20, signed int _a24, signed int _a28, signed int _a32) {
				signed char* _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				void _v64;
				signed int _v68;
				char _v84;
				intOrPtr _v88;
				signed int _v92;
				intOrPtr _v100;
				void _v104;
				intOrPtr* _v112;
				signed char* _v184;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t202;
				signed int _t203;
				char _t204;
				signed int _t206;
				signed int _t208;
				signed char* _t209;
				signed int _t210;
				signed int _t211;
				signed int _t215;
				void* _t218;
				signed char* _t221;
				void* _t223;
				void* _t225;
				signed char _t229;
				signed int _t230;
				void* _t232;
				void* _t235;
				void* _t238;
				signed char _t245;
				signed int _t250;
				void* _t253;
				signed int* _t255;
				signed int _t256;
				intOrPtr _t257;
				signed int _t258;
				void* _t263;
				void* _t268;
				void* _t269;
				signed int _t273;
				signed char* _t274;
				intOrPtr* _t275;
				signed char _t276;
				signed int _t277;
				signed int _t278;
				intOrPtr* _t280;
				signed int _t281;
				signed int _t282;
				signed int _t287;
				signed int _t294;
				signed int _t295;
				signed int _t298;
				signed int _t300;
				signed char* _t301;
				signed int _t302;
				signed int _t303;
				signed int* _t305;
				signed char* _t308;
				signed int _t318;
				signed int _t319;
				signed int _t321;
				signed int _t330;
				void* _t332;
				void* _t334;
				void* _t335;
				void* _t336;
				void* _t337;

				_t300 = __edx;
				_push(_t319);
				_t305 = _a20;
				_v20 = 0;
				_v28 = 0;
				_t279 = E00F45278(_a8, _a16, _t305);
				_t335 = _t334 + 0xc;
				_v12 = _t279;
				if(_t279 < 0xffffffff || _t279 >= _t305[1]) {
					L66:
					_t202 = E00F46E22(_t274, _t279, _t300, _t305, _t319);
					asm("int3");
					_t332 = _t335;
					_t336 = _t335 - 0x38;
					_push(_t274);
					_t275 = _v112;
					__eflags =  *_t275 - 0x80000003;
					if( *_t275 == 0x80000003) {
						return _t202;
					} else {
						_push(_t319);
						_push(_t305);
						_t203 = E00F43FC6(_t275, _t279, _t300, _t305, _t319);
						__eflags =  *(_t203 + 8);
						if( *(_t203 + 8) != 0) {
							__imp__EncodePointer(0);
							_t319 = _t203;
							_t223 = E00F43FC6(_t275, _t279, _t300, 0, _t319);
							__eflags =  *((intOrPtr*)(_t223 + 8)) - _t319;
							if( *((intOrPtr*)(_t223 + 8)) != _t319) {
								__eflags =  *_t275 - 0xe0434f4d;
								if( *_t275 != 0xe0434f4d) {
									__eflags =  *_t275 - 0xe0434352;
									if( *_t275 != 0xe0434352) {
										_t215 = E00F436AF(_t300, 0, _t319, _t275, _a4, _a8, _a12, _a16, _a24, _a28);
										_t336 = _t336 + 0x1c;
										__eflags = _t215;
										if(_t215 != 0) {
											L83:
											return _t215;
										}
									}
								}
							}
						}
						_t204 = _a16;
						_v28 = _t204;
						_v24 = 0;
						__eflags =  *(_t204 + 0xc);
						if( *(_t204 + 0xc) > 0) {
							_push(_a24);
							E00F435E2(_t275, _t279, 0, _t319,  &_v44,  &_v28, _a20, _a12, _t204);
							_t302 = _v40;
							_t337 = _t336 + 0x18;
							_t215 = _v44;
							_v20 = _t215;
							_v12 = _t302;
							__eflags = _t302 - _v32;
							if(_t302 >= _v32) {
								goto L83;
							}
							_t281 = _t302 * 0x14;
							__eflags = _t281;
							_v16 = _t281;
							do {
								_t282 = 5;
								_t218 = memcpy( &_v64,  *((intOrPtr*)( *_t215 + 0x10)) + _t281, _t282 << 2);
								_t337 = _t337 + 0xc;
								__eflags = _v64 - _t218;
								if(_v64 > _t218) {
									goto L82;
								}
								__eflags = _t218 - _v60;
								if(_t218 > _v60) {
									goto L82;
								}
								_t221 = _v48 + 0xfffffff0 + (_v52 << 4);
								_t287 = _t221[4];
								__eflags = _t287;
								if(_t287 == 0) {
									L80:
									__eflags =  *_t221 & 0x00000040;
									if(( *_t221 & 0x00000040) == 0) {
										_push(0);
										_push(1);
										E00F4428B(_t302, _t275, _a4, _a8, _a12, _a16, _t221, 0,  &_v64, _a24, _a28);
										_t302 = _v12;
										_t337 = _t337 + 0x30;
									}
									goto L82;
								}
								__eflags =  *((char*)(_t287 + 8));
								if( *((char*)(_t287 + 8)) != 0) {
									goto L82;
								}
								goto L80;
								L82:
								_t302 = _t302 + 1;
								_t215 = _v20;
								_t281 = _v16 + 0x14;
								_v12 = _t302;
								_v16 = _t281;
								__eflags = _t302 - _v32;
							} while (_t302 < _v32);
							goto L83;
						}
						E00F46E22(_t275, _t279, _t300, 0, _t319);
						asm("int3");
						_push(_t332);
						_t301 = _v184;
						_push(_t275);
						_push(_t319);
						_push(0);
						_t206 = _t301[4];
						__eflags = _t206;
						if(_t206 == 0) {
							L108:
							_t208 = 1;
							__eflags = 1;
						} else {
							_t280 = _t206 + 8;
							__eflags =  *_t280;
							if( *_t280 == 0) {
								goto L108;
							} else {
								__eflags =  *_t301 & 0x00000080;
								_t308 = _v0;
								if(( *_t301 & 0x00000080) == 0) {
									L90:
									_t276 = _t308[4];
									_t321 = 0;
									__eflags = _t206 - _t276;
									if(_t206 == _t276) {
										L100:
										__eflags =  *_t308 & 0x00000002;
										if(( *_t308 & 0x00000002) == 0) {
											L102:
											_t209 = _a4;
											__eflags =  *_t209 & 0x00000001;
											if(( *_t209 & 0x00000001) == 0) {
												L104:
												__eflags =  *_t209 & 0x00000002;
												if(( *_t209 & 0x00000002) == 0) {
													L106:
													_t321 = 1;
													__eflags = 1;
												} else {
													__eflags =  *_t301 & 0x00000002;
													if(( *_t301 & 0x00000002) != 0) {
														goto L106;
													}
												}
											} else {
												__eflags =  *_t301 & 0x00000001;
												if(( *_t301 & 0x00000001) != 0) {
													goto L104;
												}
											}
										} else {
											__eflags =  *_t301 & 0x00000008;
											if(( *_t301 & 0x00000008) != 0) {
												goto L102;
											}
										}
										_t208 = _t321;
									} else {
										_t185 = _t276 + 8; // 0x6e
										_t210 = _t185;
										while(1) {
											_t277 =  *_t280;
											__eflags = _t277 -  *_t210;
											if(_t277 !=  *_t210) {
												break;
											}
											__eflags = _t277;
											if(_t277 == 0) {
												L96:
												_t211 = _t321;
											} else {
												_t278 =  *((intOrPtr*)(_t280 + 1));
												__eflags = _t278 -  *((intOrPtr*)(_t210 + 1));
												if(_t278 !=  *((intOrPtr*)(_t210 + 1))) {
													break;
												} else {
													_t280 = _t280 + 2;
													_t210 = _t210 + 2;
													__eflags = _t278;
													if(_t278 != 0) {
														continue;
													} else {
														goto L96;
													}
												}
											}
											L98:
											__eflags = _t211;
											if(_t211 == 0) {
												goto L100;
											} else {
												_t208 = 0;
											}
											goto L109;
										}
										asm("sbb eax, eax");
										_t211 = _t210 | 0x00000001;
										__eflags = _t211;
										goto L98;
									}
								} else {
									__eflags =  *_t308 & 0x00000010;
									if(( *_t308 & 0x00000010) != 0) {
										goto L108;
									} else {
										goto L90;
									}
								}
							}
						}
						L109:
						return _t208;
					}
				} else {
					_t274 = _a4;
					if( *_t274 != 0xe06d7363 || _t274[0x10] != 3 || _t274[0x14] != 0x19930520 && _t274[0x14] != 0x19930521 && _t274[0x14] != 0x19930522) {
						L22:
						_t300 = _a12;
						_v8 = _t300;
						goto L24;
					} else {
						_t319 = 0;
						if(_t274[0x1c] != 0) {
							goto L22;
						} else {
							_t225 = E00F43FC6(_t274, _t279, _t300, _t305, 0);
							if( *((intOrPtr*)(_t225 + 0x10)) == 0) {
								L60:
								return _t225;
							} else {
								_t274 =  *(E00F43FC6(_t274, _t279, _t300, _t305, 0) + 0x10);
								_t263 = E00F43FC6(_t274, _t279, _t300, _t305, 0);
								_v28 = 1;
								_v8 =  *((intOrPtr*)(_t263 + 0x14));
								if(_t274 == 0 ||  *_t274 == 0xe06d7363 && _t274[0x10] == 3 && (_t274[0x14] == 0x19930520 || _t274[0x14] == 0x19930521 || _t274[0x14] == 0x19930522) && _t274[0x1c] == _t319) {
									goto L66;
								} else {
									if( *((intOrPtr*)(E00F43FC6(_t274, _t279, _t300, _t305, _t319) + 0x1c)) == _t319) {
										L23:
										_t300 = _v8;
										_t279 = _v12;
										L24:
										_v52 = _t305;
										_v48 = 0;
										__eflags =  *_t274 - 0xe06d7363;
										if( *_t274 != 0xe06d7363) {
											L56:
											__eflags = _t305[3];
											if(_t305[3] <= 0) {
												goto L59;
											} else {
												__eflags = _a24;
												if(_a24 != 0) {
													goto L66;
												} else {
													_push(_a32);
													_push(_a28);
													_push(_t279);
													_push(_t305);
													_push(_a16);
													_push(_t300);
													_push(_a8);
													_push(_t274);
													L67();
													_t335 = _t335 + 0x20;
													goto L59;
												}
											}
										} else {
											__eflags = _t274[0x10] - 3;
											if(_t274[0x10] != 3) {
												goto L56;
											} else {
												__eflags = _t274[0x14] - 0x19930520;
												if(_t274[0x14] == 0x19930520) {
													L29:
													_t319 = _a32;
													__eflags = _t305[3];
													if(_t305[3] > 0) {
														_push(_a28);
														E00F435E2(_t274, _t279, _t305, _t319,  &_v68,  &_v52, _t279, _a16, _t305);
														_t300 = _v64;
														_t335 = _t335 + 0x18;
														_t250 = _v68;
														_v44 = _t250;
														_v16 = _t300;
														__eflags = _t300 - _v56;
														if(_t300 < _v56) {
															_t294 = _t300 * 0x14;
															__eflags = _t294;
															_v32 = _t294;
															do {
																_t295 = 5;
																_t253 = memcpy( &_v104,  *((intOrPtr*)( *_t250 + 0x10)) + _t294, _t295 << 2);
																_t335 = _t335 + 0xc;
																__eflags = _v104 - _t253;
																if(_v104 <= _t253) {
																	__eflags = _t253 - _v100;
																	if(_t253 <= _v100) {
																		_t298 = 0;
																		_v20 = 0;
																		__eflags = _v92;
																		if(_v92 != 0) {
																			_t255 =  *(_t274[0x1c] + 0xc);
																			_t303 =  *_t255;
																			_t256 =  &(_t255[1]);
																			__eflags = _t256;
																			_v36 = _t256;
																			_t257 = _v88;
																			_v40 = _t303;
																			_v24 = _t257;
																			do {
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				_t318 = _v36;
																				_t330 = _t303;
																				__eflags = _t330;
																				if(_t330 <= 0) {
																					goto L40;
																				} else {
																					while(1) {
																						_push(_t274[0x1c]);
																						_t258 =  &_v84;
																						_push( *_t318);
																						_push(_t258);
																						L86();
																						_t335 = _t335 + 0xc;
																						__eflags = _t258;
																						if(_t258 != 0) {
																							break;
																						}
																						_t330 = _t330 - 1;
																						_t318 = _t318 + 4;
																						__eflags = _t330;
																						if(_t330 > 0) {
																							continue;
																						} else {
																							_t298 = _v20;
																							_t257 = _v24;
																							_t303 = _v40;
																							goto L40;
																						}
																						goto L43;
																					}
																					_push(_a24);
																					_push(_v28);
																					E00F4428B(_t303, _t274, _a8, _v8, _a16, _a20,  &_v84,  *_t318,  &_v104, _a28, _a32);
																					_t335 = _t335 + 0x30;
																				}
																				L43:
																				_t300 = _v16;
																				goto L44;
																				L40:
																				_t298 = _t298 + 1;
																				_t257 = _t257 + 0x10;
																				_v20 = _t298;
																				_v24 = _t257;
																				__eflags = _t298 - _v92;
																			} while (_t298 != _v92);
																			goto L43;
																		}
																	}
																}
																L44:
																_t300 = _t300 + 1;
																_t250 = _v44;
																_t294 = _v32 + 0x14;
																_v16 = _t300;
																_v32 = _t294;
																__eflags = _t300 - _v56;
															} while (_t300 < _v56);
															_t305 = _a20;
															_t319 = _a32;
														}
													}
													__eflags = _a24;
													if(__eflags != 0) {
														_push(1);
														E00F43A1A(_t274, _t305, _t319, __eflags);
														_t279 = _t274;
													}
													__eflags = ( *_t305 & 0x1fffffff) - 0x19930521;
													if(( *_t305 & 0x1fffffff) < 0x19930521) {
														L59:
														_t225 = E00F43FC6(_t274, _t279, _t300, _t305, _t319);
														__eflags =  *(_t225 + 0x1c);
														if( *(_t225 + 0x1c) != 0) {
															goto L66;
														} else {
															goto L60;
														}
													} else {
														__eflags = _t305[7];
														if(_t305[7] != 0) {
															L52:
															_t229 = _t305[8] >> 2;
															__eflags = _t229 & 0x00000001;
															if((_t229 & 0x00000001) == 0) {
																_push(_t305[7]);
																_t230 = E00F44D1A(_t274, _t305, _t319, _t274);
																_pop(_t279);
																__eflags = _t230;
																if(_t230 == 0) {
																	goto L63;
																} else {
																	goto L59;
																}
															} else {
																 *(E00F43FC6(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
																_t238 = E00F43FC6(_t274, _t279, _t300, _t305, _t319);
																_t290 = _v8;
																 *((intOrPtr*)(_t238 + 0x14)) = _v8;
																goto L61;
															}
														} else {
															_t245 = _t305[8] >> 2;
															__eflags = _t245 & 0x00000001;
															if((_t245 & 0x00000001) == 0) {
																goto L59;
															} else {
																__eflags = _a28;
																if(_a28 != 0) {
																	goto L59;
																} else {
																	goto L52;
																}
															}
														}
													}
												} else {
													__eflags = _t274[0x14] - 0x19930521;
													if(_t274[0x14] == 0x19930521) {
														goto L29;
													} else {
														__eflags = _t274[0x14] - 0x19930522;
														if(_t274[0x14] != 0x19930522) {
															goto L56;
														} else {
															goto L29;
														}
													}
												}
											}
										}
									} else {
										_v16 =  *((intOrPtr*)(E00F43FC6(_t274, _t279, _t300, _t305, _t319) + 0x1c));
										_t268 = E00F43FC6(_t274, _t279, _t300, _t305, _t319);
										_push(_v16);
										 *(_t268 + 0x1c) = _t319;
										_t269 = E00F44D1A(_t274, _t305, _t319, _t274);
										_pop(_t290);
										if(_t269 != 0) {
											goto L23;
										} else {
											_t305 = _v16;
											_t356 =  *_t305 - _t319;
											if( *_t305 <= _t319) {
												L61:
												E00F46DE6(_t274, _t290, _t300, _t305, _t319, __eflags);
											} else {
												while(1) {
													_t290 =  *((intOrPtr*)(_t319 + _t305[1] + 4));
													if(E00F449AE( *((intOrPtr*)(_t319 + _t305[1] + 4)), _t356, 0xf5c8c0) != 0) {
														goto L62;
													}
													_t319 = _t319 + 0x10;
													_t273 = _v20 + 1;
													_v20 = _t273;
													_t356 = _t273 -  *_t305;
													if(_t273 >=  *_t305) {
														goto L61;
													} else {
														continue;
													}
													goto L62;
												}
											}
											L62:
											_push(1);
											_push(_t274);
											E00F43A1A(_t274, _t305, _t319, __eflags);
											_t279 =  &_v64;
											E00F44996( &_v64);
											E00F43BD3( &_v64, 0xf5b0cc);
											L63:
											 *(E00F43FC6(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
											_t232 = E00F43FC6(_t274, _t279, _t300, _t305, _t319);
											_t279 = _v8;
											 *(_t232 + 0x14) = _v8;
											__eflags = _t319;
											if(_t319 == 0) {
												_t319 = _a8;
											}
											E00F437D5(_t279, _t319, _t274);
											E00F44C1A(_a8, _a16, _t305);
											_t235 = E00F44DD7(_t305);
											_t335 = _t335 + 0x10;
											_push(_t235);
											E00F44B91(_t274, _t279, _t300, _t305, _t319, __eflags);
											goto L66;
										}
									}
								}
							}
						}
					}
				}
			}

0x00f4430b
0x00f44312
0x00f44314
0x00f4431d
0x00f44323
0x00f4432b
0x00f4432d
0x00f44330
0x00f44336
0x00f446af
0x00f446af
0x00f446b4
0x00f446b6
0x00f446b8
0x00f446bb
0x00f446bc
0x00f446bf
0x00f446c5
0x00f447e4
0x00f446cb
0x00f446cb
0x00f446cc
0x00f446cd
0x00f446d4
0x00f446d7
0x00f446da
0x00f446e0
0x00f446e2
0x00f446e7
0x00f446ea
0x00f446ec
0x00f446f2
0x00f446f4
0x00f446fa
0x00f4470f
0x00f44714
0x00f44717
0x00f44719
0x00f447e0
0x00000000
0x00f447e1
0x00f44719
0x00f446fa
0x00f446f2
0x00f446ea
0x00f4471f
0x00f44722
0x00f44725
0x00f44728
0x00f4472b
0x00f44731
0x00f44743
0x00f44748
0x00f4474b
0x00f4474e
0x00f44751
0x00f44754
0x00f44757
0x00f4475a
0x00000000
0x00000000
0x00f44760
0x00f44760
0x00f44763
0x00f44766
0x00f44775
0x00f44776
0x00f44776
0x00f44778
0x00f4477b
0x00000000
0x00000000
0x00f4477d
0x00f44780
0x00000000
0x00000000
0x00f4478e
0x00f44790
0x00f44793
0x00f44795
0x00f4479d
0x00f4479d
0x00f447a0
0x00f447a2
0x00f447a4
0x00f447c0
0x00f447c5
0x00f447c8
0x00f447c8
0x00000000
0x00f447a0
0x00f44797
0x00f4479b
0x00000000
0x00000000
0x00000000
0x00f447cb
0x00f447ce
0x00f447cf
0x00f447d2
0x00f447d5
0x00f447d8
0x00f447db
0x00f447db
0x00000000
0x00f44766
0x00f447e5
0x00f447ea
0x00f447eb
0x00f447ee
0x00f447f1
0x00f447f2
0x00f447f3
0x00f447f4
0x00f447f7
0x00f447f9
0x00f44871
0x00f44873
0x00f44873
0x00f447fb
0x00f447fb
0x00f447fe
0x00f44801
0x00000000
0x00f44803
0x00f44803
0x00f44806
0x00f44809
0x00f44810
0x00f44810
0x00f44813
0x00f44815
0x00f44817
0x00f44849
0x00f44849
0x00f4484c
0x00f44853
0x00f44853
0x00f44856
0x00f44859
0x00f44860
0x00f44860
0x00f44863
0x00f4486a
0x00f4486c
0x00f4486c
0x00f44865
0x00f44865
0x00f44868
0x00000000
0x00000000
0x00f44868
0x00f4485b
0x00f4485b
0x00f4485e
0x00000000
0x00000000
0x00f4485e
0x00f4484e
0x00f4484e
0x00f44851
0x00000000
0x00000000
0x00f44851
0x00f4486d
0x00f44819
0x00f44819
0x00f44819
0x00f4481c
0x00f4481c
0x00f4481e
0x00f44820
0x00000000
0x00000000
0x00f44822
0x00f44824
0x00f44838
0x00f44838
0x00f44826
0x00f44826
0x00f44829
0x00f4482c
0x00000000
0x00f4482e
0x00f4482e
0x00f44831
0x00f44834
0x00f44836
0x00000000
0x00000000
0x00000000
0x00000000
0x00f44836
0x00f4482c
0x00f44841
0x00f44841
0x00f44843
0x00000000
0x00f44845
0x00f44845
0x00f44845
0x00000000
0x00f44843
0x00f4483c
0x00f4483e
0x00f4483e
0x00000000
0x00f4483e
0x00f4480b
0x00f4480b
0x00f4480e
0x00000000
0x00000000
0x00000000
0x00000000
0x00f4480e
0x00f44809
0x00f44801
0x00f44874
0x00f44878
0x00f44878
0x00f44345
0x00f44345
0x00f4434e
0x00f4444b
0x00f4444b
0x00f4444e
0x00000000
0x00f4437d
0x00f4437d
0x00f44382
0x00000000
0x00f44388
0x00f44388
0x00f44390
0x00f44649
0x00f4464d
0x00f44396
0x00f4439b
0x00f4439e
0x00f443a3
0x00f443aa
0x00f443af
0x00000000
0x00f443e7
0x00f443ef
0x00f44453
0x00f44453
0x00f44456
0x00f44459
0x00f4445b
0x00f4445e
0x00f44461
0x00f44467
0x00f44618
0x00f44618
0x00f4461b
0x00000000
0x00f4461d
0x00f4461d
0x00f44620
0x00000000
0x00f44626
0x00f44626
0x00f44629
0x00f4462c
0x00f4462d
0x00f4462e
0x00f44631
0x00f44632
0x00f44635
0x00f44636
0x00f4463b
0x00000000
0x00f4463b
0x00f44620
0x00f4446d
0x00f4446d
0x00f44471
0x00000000
0x00f44477
0x00f44477
0x00f4447e
0x00f44496
0x00f44496
0x00f44499
0x00f4449c
0x00f444a2
0x00f444b2
0x00f444b7
0x00f444ba
0x00f444bd
0x00f444c0
0x00f444c3
0x00f444c6
0x00f444c9
0x00f444cf
0x00f444cf
0x00f444d2
0x00f444d5
0x00f444e4
0x00f444e5
0x00f444e5
0x00f444e7
0x00f444ea
0x00f444f0
0x00f444f3
0x00f444f9
0x00f444fb
0x00f444fe
0x00f44501
0x00f4450a
0x00f4450d
0x00f4450f
0x00f4450f
0x00f44512
0x00f44515
0x00f44518
0x00f4451b
0x00f4451e
0x00f44523
0x00f44524
0x00f44525
0x00f44526
0x00f44527
0x00f4452a
0x00f4452c
0x00f4452e
0x00000000
0x00f44530
0x00f44530
0x00f44530
0x00f44533
0x00f44536
0x00f44538
0x00f44539
0x00f4453e
0x00f44541
0x00f44543
0x00000000
0x00000000
0x00f44545
0x00f44546
0x00f44549
0x00f4454b
0x00000000
0x00f4454d
0x00f4454d
0x00f44550
0x00f44553
0x00000000
0x00f44553
0x00000000
0x00f4454b
0x00f44567
0x00f4456d
0x00f4458a
0x00f4458f
0x00f4458f
0x00f44592
0x00f44592
0x00000000
0x00f44556
0x00f44556
0x00f44557
0x00f4455a
0x00f4455d
0x00f44560
0x00f44560
0x00000000
0x00f44565
0x00f44501
0x00f444f3
0x00f44595
0x00f44598
0x00f44599
0x00f4459c
0x00f4459f
0x00f445a2
0x00f445a5
0x00f445a5
0x00f445ae
0x00f445b1
0x00f445b1
0x00f444c9
0x00f445b4
0x00f445b8
0x00f445ba
0x00f445bd
0x00f445c3
0x00f445c3
0x00f445cb
0x00f445d0
0x00f4463e
0x00f4463e
0x00f44643
0x00f44647
0x00000000
0x00000000
0x00000000
0x00000000
0x00f445d2
0x00f445d2
0x00f445d6
0x00f445e8
0x00f445eb
0x00f445ee
0x00f445f0
0x00f44607
0x00f4460b
0x00f44611
0x00f44612
0x00f44614
0x00000000
0x00f44616
0x00000000
0x00f44616
0x00f445f2
0x00f445f7
0x00f445fa
0x00f445ff
0x00f44602
0x00000000
0x00f44602
0x00f445d8
0x00f445db
0x00f445de
0x00f445e0
0x00000000
0x00f445e2
0x00f445e2
0x00f445e6
0x00000000
0x00000000
0x00000000
0x00000000
0x00f445e6
0x00f445e0
0x00f445d6
0x00f44480
0x00f44480
0x00f44487
0x00000000
0x00f44489
0x00f44489
0x00f44490
0x00000000
0x00000000
0x00000000
0x00000000
0x00f44490
0x00f44487
0x00f4447e
0x00f44471
0x00f443f1
0x00f443f9
0x00f443fc
0x00f44401
0x00f44405
0x00f44408
0x00f4440e
0x00f44411
0x00000000
0x00f44413
0x00f44413
0x00f44416
0x00f44418
0x00f4464e
0x00f4464e
0x00000000
0x00f4441e
0x00f44426
0x00f44431
0x00000000
0x00000000
0x00f4443a
0x00f4443d
0x00f4443e
0x00f44441
0x00f44443
0x00000000
0x00f44449
0x00000000
0x00f44449
0x00000000
0x00f44443
0x00f4441e
0x00f44653
0x00f44653
0x00f44655
0x00f44656
0x00f4465d
0x00f44660
0x00f4466e
0x00f44673
0x00f44678
0x00f4467b
0x00f44680
0x00f44683
0x00f44686
0x00f44688
0x00f4468a
0x00f4468a
0x00f4468f
0x00f4469b
0x00f446a1
0x00f446a6
0x00f446a9
0x00f446aa
0x00000000
0x00f446aa
0x00f44411
0x00f443ef
0x00f443af
0x00f44390
0x00f44382
0x00f4434e

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 00F44408
type_info::operator==.LIBVCRUNTIME ref: 00F4442A
___TypeMatch.LIBVCRUNTIME ref: 00F44539
IsInExceptionSpec.LIBVCRUNTIME ref: 00F4460B
_UnwindNestedFrames.LIBCMT ref: 00F4468F
CallUnexpected.LIBVCRUNTIME ref: 00F446AA

Strings

csm, xrefs: 00F44348
csm, xrefs: 00F44461
csm, xrefs: 00F443B5

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 04dea43f90112a476a4646ec2ddf7263a4a7bea493187e6f8ebd83e769cf1742
Instruction ID: 1b7020d17e0403b34f193f9cd378972c20a7d7d8c40963458148f19056c11893
Opcode Fuzzy Hash: 04dea43f90112a476a4646ec2ddf7263a4a7bea493187e6f8ebd83e769cf1742
Instruction Fuzzy Hash: 63B14571C00209AFDF28DFA4C881AAEBFB5BF05320B15415AEC147B212D735EA51EFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F474C1 Relevance: 15.1, APIs: 10, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00F474C1(void* __ebx, void* __edi, void* __esi, char _a4) {
				void* _v5;
				char _v12;
				char _v16;
				char _v20;
				void* __ebp;
				char _t55;
				char _t61;
				void* _t67;
				intOrPtr _t68;
				void* _t72;
				void* _t73;

				_t73 = __esi;
				_t72 = __edi;
				_t67 = __ebx;
				_t36 = _a4;
				_t68 =  *_a4;
				_t77 = _t68 - 0xf4fcc8;
				if(_t68 != 0xf4fcc8) {
					E00F479D0(_t68);
					_t36 = _a4;
				}
				E00F479D0( *((intOrPtr*)(_t36 + 0x3c)));
				E00F479D0( *((intOrPtr*)(_a4 + 0x30)));
				E00F479D0( *((intOrPtr*)(_a4 + 0x34)));
				E00F479D0( *((intOrPtr*)(_a4 + 0x38)));
				E00F479D0( *((intOrPtr*)(_a4 + 0x28)));
				E00F479D0( *((intOrPtr*)(_a4 + 0x2c)));
				E00F479D0( *((intOrPtr*)(_a4 + 0x40)));
				E00F479D0( *((intOrPtr*)(_a4 + 0x44)));
				E00F479D0( *((intOrPtr*)(_a4 + 0x360)));
				_v16 =  &_a4;
				_t55 = 5;
				_v12 = _t55;
				_v20 = _t55;
				_push( &_v12);
				_push( &_v16);
				_push( &_v20);
				E00F472ED(_t67, _t72, _t73, _t77);
				_v16 =  &_a4;
				_t61 = 4;
				_v20 = _t61;
				_v12 = _t61;
				_push( &_v20);
				_push( &_v16);
				_push( &_v12);
				return E00F47358(_t67, _t72, _t73, _t77);
			}

0x00f474c1
0x00f474c1
0x00f474c1
0x00f474c6
0x00f474cc
0x00f474ce
0x00f474d4
0x00f474d7
0x00f474dc
0x00f474df
0x00f474e3
0x00f474ee
0x00f474f9
0x00f47504
0x00f4750f
0x00f4751a
0x00f47525
0x00f47530
0x00f4753e
0x00f47549
0x00f47551
0x00f47552
0x00f47555
0x00f4755b
0x00f4755f
0x00f47563
0x00f47564
0x00f4756e
0x00f47574
0x00f47575
0x00f47578
0x00f4757e
0x00f47582
0x00f47586
0x00f4758d

APIs

_free.LIBCMT ref: 00F474D7

Part of subcall function 00F479D0: HeapFree.KERNEL32(00000000,00000000,?,00F49499,?,00000000,?,?,?,00F494C0,?,00000007,?,?,00F498C6,?), ref: 00F479E6
Part of subcall function 00F479D0: GetLastError.KERNEL32(?,?,00F49499,?,00000000,?,?,?,00F494C0,?,00000007,?,?,00F498C6,?,?), ref: 00F479F8

_free.LIBCMT ref: 00F474E3
_free.LIBCMT ref: 00F474EE
_free.LIBCMT ref: 00F474F9
_free.LIBCMT ref: 00F47504
_free.LIBCMT ref: 00F4750F
_free.LIBCMT ref: 00F4751A
_free.LIBCMT ref: 00F47525
_free.LIBCMT ref: 00F47530
_free.LIBCMT ref: 00F4753E

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: bf12dd71731398afadd09e2d06232237c5c5f6dd1e72f5f9d4635b7775ac27a2
Instruction ID: 32b0af34ff195a183e8adb0251dafb3367c2068aefd670796ae4f334c1454cc5
Opcode Fuzzy Hash: bf12dd71731398afadd09e2d06232237c5c5f6dd1e72f5f9d4635b7775ac27a2
Instruction Fuzzy Hash: DC21967690820CBFCB41EF98DC81DDE7FB9AF18350F0045A6FA159B122DB75EA449B80

Uniqueness

Uniqueness Score: -1.00%

Function 00F43C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E00F43C80(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				char _t52;
				signed int _t59;
				intOrPtr _t60;
				void* _t61;
				intOrPtr* _t62;
				intOrPtr _t64;
				intOrPtr _t67;
				intOrPtr _t72;
				intOrPtr* _t76;
				intOrPtr _t77;
				signed int _t81;
				char _t83;
				intOrPtr _t86;
				intOrPtr _t93;
				intOrPtr _t96;
				intOrPtr* _t98;
				void* _t102;
				void* _t104;
				void* _t111;

				_t89 = __edx;
				_t76 = _a4;
				_push(__edi);
				_v5 = 0;
				_v16 = 1;
				 *_t76 = E00F4E570(__ecx,  *_t76);
				_t77 = _a8;
				_t6 = _t77 + 0x10; // 0x11
				_t96 = _t6;
				_push(_t96);
				_v20 = _t96;
				_v12 =  *(_t77 + 8) ^  *0xf5c004;
				E00F43C40(_t77, __edx, __edi, _t96,  *(_t77 + 8) ^  *0xf5c004);
				E00F44E3C(_a12);
				_t52 = _a4;
				_t104 = _t102 - 0x1c + 0x10;
				_t93 =  *((intOrPtr*)(_t77 + 0xc));
				if(( *(_t52 + 4) & 0x00000066) != 0) {
					__eflags = _t93 - 0xfffffffe;
					if(_t93 != 0xfffffffe) {
						_t89 = 0xfffffffe;
						E00F44FC0(_t77, 0xfffffffe, _t96, 0xf5c004);
						goto L13;
					}
					goto L14;
				} else {
					_v32 = _t52;
					_v28 = _a12;
					 *((intOrPtr*)(_t77 - 4)) =  &_v32;
					if(_t93 == 0xfffffffe) {
						L14:
						return _v16;
					} else {
						do {
							_t81 = _v12;
							_t59 = _t93 + (_t93 + 2) * 2;
							_t77 =  *((intOrPtr*)(_t81 + _t59 * 4));
							_t60 = _t81 + _t59 * 4;
							_t82 =  *((intOrPtr*)(_t60 + 4));
							_v24 = _t60;
							if( *((intOrPtr*)(_t60 + 4)) == 0) {
								_t83 = _v5;
								goto L7;
							} else {
								_t89 = _t96;
								_t61 = E00F44F60(_t82, _t96);
								_t83 = 1;
								_v5 = 1;
								_t111 = _t61;
								if(_t111 < 0) {
									_v16 = 0;
									L13:
									_push(_t96);
									E00F43C40(_t77, _t89, _t93, _t96, _v12);
									goto L14;
								} else {
									if(_t111 > 0) {
										_t62 = _a4;
										__eflags =  *_t62 - 0xe06d7363;
										if( *_t62 == 0xe06d7363) {
											__eflags =  *0xf4f1ec;
											if(__eflags != 0) {
												_t72 = E00F4E3E0(__eflags, 0xf4f1ec);
												_t104 = _t104 + 4;
												__eflags = _t72;
												if(_t72 != 0) {
													_t98 =  *0xf4f1ec; // 0xf43a1a
													 *0xf4f140(_a4, 1);
													 *_t98();
													_t96 = _v20;
													_t104 = _t104 + 8;
												}
												_t62 = _a4;
											}
										}
										_t90 = _t62;
										E00F44FA0(_t62, _a8, _t62);
										_t64 = _a8;
										__eflags =  *((intOrPtr*)(_t64 + 0xc)) - _t93;
										if( *((intOrPtr*)(_t64 + 0xc)) != _t93) {
											_t90 = _t93;
											E00F44FC0(_t64, _t93, _t96, 0xf5c004);
											_t64 = _a8;
										}
										_push(_t96);
										 *((intOrPtr*)(_t64 + 0xc)) = _t77;
										E00F43C40(_t77, _t90, _t93, _t96, _v12);
										_t86 =  *((intOrPtr*)(_v24 + 8));
										E00F44F80();
										asm("int3");
										__eflags = E00F44FD7();
										if(__eflags != 0) {
											_t67 = E00F44066(_t86, __eflags);
											__eflags = _t67;
											if(_t67 != 0) {
												return 1;
											} else {
												E00F45013();
												goto L24;
											}
										} else {
											L24:
											__eflags = 0;
											return 0;
										}
									} else {
										goto L7;
									}
								}
							}
							goto L28;
							L7:
							_t93 = _t77;
						} while (_t77 != 0xfffffffe);
						if(_t83 != 0) {
							goto L13;
						}
						goto L14;
					}
				}
				L28:
			}

0x00f43c80
0x00f43c87
0x00f43c8b
0x00f43c8c
0x00f43c92
0x00f43c9e
0x00f43ca0
0x00f43ca6
0x00f43ca6
0x00f43caf
0x00f43cb1
0x00f43cb4
0x00f43cb7
0x00f43cbf
0x00f43cc4
0x00f43cc7
0x00f43cca
0x00f43cd1
0x00f43d2d
0x00f43d30
0x00f43d38
0x00f43d3f
0x00000000
0x00f43d3f
0x00000000
0x00f43cd3
0x00f43cd3
0x00f43cd9
0x00f43cdf
0x00f43ce5
0x00f43d50
0x00f43d59
0x00f43ce7
0x00f43ce7
0x00f43ce7
0x00f43ced
0x00f43cf0
0x00f43cf3
0x00f43cf6
0x00f43cf9
0x00f43cfe
0x00f43d14
0x00000000
0x00f43d00
0x00f43d00
0x00f43d02
0x00f43d07
0x00f43d09
0x00f43d0c
0x00f43d0e
0x00f43d24
0x00f43d44
0x00f43d44
0x00f43d48
0x00000000
0x00f43d10
0x00f43d10
0x00f43d5a
0x00f43d5d
0x00f43d63
0x00f43d65
0x00f43d6c
0x00f43d73
0x00f43d78
0x00f43d7b
0x00f43d7d
0x00f43d7f
0x00f43d8c
0x00f43d92
0x00f43d94
0x00f43d97
0x00f43d97
0x00f43d9a
0x00f43d9a
0x00f43d6c
0x00f43da0
0x00f43da2
0x00f43da7
0x00f43daa
0x00f43dad
0x00f43db5
0x00f43db9
0x00f43dbe
0x00f43dbe
0x00f43dc1
0x00f43dc5
0x00f43dc8
0x00f43dd5
0x00f43dd8
0x00f43ddd
0x00f43de3
0x00f43de5
0x00f43dea
0x00f43def
0x00f43df1
0x00f43dfc
0x00f43df3
0x00f43df3
0x00000000
0x00f43df3
0x00f43de7
0x00f43de7
0x00f43de7
0x00f43de9
0x00f43de9
0x00f43d12
0x00000000
0x00f43d12
0x00f43d10
0x00f43d0e
0x00000000
0x00f43d17
0x00f43d17
0x00f43d19
0x00f43d20
0x00000000
0x00f43d22
0x00000000
0x00f43d20
0x00f43ce5
0x00000000

APIs

_ValidateLocalCookies.LIBCMT ref: 00F43CB7
___except_validate_context_record.LIBVCRUNTIME ref: 00F43CBF
_ValidateLocalCookies.LIBCMT ref: 00F43D48
__IsNonwritableInCurrentImage.LIBCMT ref: 00F43D73
_ValidateLocalCookies.LIBCMT ref: 00F43DC8

Strings

csm, xrefs: 00F43D5D

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: ac0f7e0a75f14dde51db42ca7c96030c1ab5386f3f1496db3061e162f528d06b
Instruction ID: 4953ed9e4672fa444204dc1c043ae62fa43777b8a82cd87e80406433bf7b2f4b
Opcode Fuzzy Hash: ac0f7e0a75f14dde51db42ca7c96030c1ab5386f3f1496db3061e162f528d06b
Instruction Fuzzy Hash: D441AC34E00218AFCF10DF68CC84A9EBFB5AF45328F148155ED19AB392D735EA55EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F49A9A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00F49A9A(void* __ecx, signed int* _a4, intOrPtr _a8) {
				signed int* _v8;
				void** _t12;
				void* _t16;
				void* _t18;
				signed int _t22;
				WCHAR* _t23;
				void** _t26;
				signed int* _t29;
				void* _t32;
				void* _t34;

				_t29 = _a4;
				while(_t29 != _a8) {
					_t22 =  *_t29;
					_t12 = 0xf5d258 + _t22 * 4;
					_t32 =  *_t12;
					_v8 = _t12;
					if(_t32 == 0) {
						_t23 =  *(0xf50a78 + _t22 * 4);
						_t32 = LoadLibraryExW(_t23, 0, 0x800);
						if(_t32 != 0) {
							L12:
							_t26 = _v8;
							 *_t26 = _t32;
							if( *_t26 != 0) {
								FreeLibrary(_t32);
							}
							L14:
							if(_t32 != 0) {
								_t16 = _t32;
								L18:
								return _t16;
							}
							L15:
							_t29 =  &(_t29[1]);
							continue;
						}
						_t18 = GetLastError();
						if(_t18 != 0x57) {
							L9:
							_t32 = 0;
							L10:
							if(_t32 != 0) {
								goto L12;
							}
							 *_v8 = _t18 | 0xffffffff;
							goto L15;
						}
						_t18 = E00F46F48(_t23, L"api-ms-", 7);
						_t34 = _t34 + 0xc;
						if(_t18 == 0) {
							goto L9;
						}
						_t18 = E00F46F48(_t23, L"ext-ms-", 7);
						_t34 = _t34 + 0xc;
						if(_t18 == 0) {
							goto L9;
						}
						_t18 = LoadLibraryExW(_t23, _t32, _t32);
						_t32 = _t18;
						goto L10;
					}
					if(_t32 == 0xffffffff) {
						goto L15;
					}
					goto L14;
				}
				_t16 = 0;
				goto L18;
			}

0x00f49aa3
0x00f49b4d
0x00f49aab
0x00f49aad
0x00f49ab4
0x00f49ab6
0x00f49abc
0x00f49ac9
0x00f49ade
0x00f49ae2
0x00f49b34
0x00f49b34
0x00f49b39
0x00f49b3d
0x00f49b40
0x00f49b40
0x00f49b46
0x00f49b48
0x00f49b5d
0x00f49b58
0x00f49b5c
0x00f49b5c
0x00f49b4a
0x00f49b4a
0x00000000
0x00f49b4a
0x00f49ae4
0x00f49aed
0x00f49b24
0x00f49b24
0x00f49b26
0x00f49b28
0x00000000
0x00000000
0x00f49b30
0x00000000
0x00f49b30
0x00f49af7
0x00f49afc
0x00f49b01
0x00000000
0x00000000
0x00f49b0b
0x00f49b10
0x00f49b15
0x00000000
0x00000000
0x00f49b1a
0x00f49b20
0x00000000
0x00f49b20
0x00f49ac1
0x00000000
0x00000000
0x00000000
0x00f49ac7
0x00f49b56
0x00000000

Strings

ext-ms-, xrefs: 00F49B05
api-ms-, xrefs: 00F49AF1

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 1cdf67c65f2fe30c0afbcee01a0483a71e170b761ac1293d4fb41a6ca7bb2c99
Instruction ID: cdca226addadd3259ee46739f72c37805eeeeaace20d3db4ee1ed014c164aa0e
Opcode Fuzzy Hash: 1cdf67c65f2fe30c0afbcee01a0483a71e170b761ac1293d4fb41a6ca7bb2c99
Instruction Fuzzy Hash: 4421D532F09214ABCB318B68AC45B1B7F59DBD2770F250120ED06A7291D6B4EE04B5E1

Uniqueness

Uniqueness Score: -1.00%

Function 00F494A7 Relevance: 10.6, APIs: 7, Instructions: 65
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00F494A7(intOrPtr _a4) {
				void* _t18;

				_t45 = _a4;
				if(_a4 != 0) {
					E00F4946F(_t45, 7);
					E00F4946F(_t45 + 0x1c, 7);
					E00F4946F(_t45 + 0x38, 0xc);
					E00F4946F(_t45 + 0x68, 0xc);
					E00F4946F(_t45 + 0x98, 2);
					E00F479D0( *((intOrPtr*)(_t45 + 0xa0)));
					E00F479D0( *((intOrPtr*)(_t45 + 0xa4)));
					E00F479D0( *((intOrPtr*)(_t45 + 0xa8)));
					E00F4946F(_t45 + 0xb4, 7);
					E00F4946F(_t45 + 0xd0, 7);
					E00F4946F(_t45 + 0xec, 0xc);
					E00F4946F(_t45 + 0x11c, 0xc);
					E00F4946F(_t45 + 0x14c, 2);
					E00F479D0( *((intOrPtr*)(_t45 + 0x154)));
					E00F479D0( *((intOrPtr*)(_t45 + 0x158)));
					E00F479D0( *((intOrPtr*)(_t45 + 0x15c)));
					return E00F479D0( *((intOrPtr*)(_t45 + 0x160)));
				}
				return _t18;
			}

0x00f494ad
0x00f494b2
0x00f494bb
0x00f494c6
0x00f494d1
0x00f494dc
0x00f494ea
0x00f494f5
0x00f49500
0x00f4950b
0x00f49519
0x00f49527
0x00f49538
0x00f49546
0x00f49554
0x00f4955f
0x00f4956a
0x00f49575
0x00000000
0x00f49585
0x00f4958a

APIs

Part of subcall function 00F4946F: _free.LIBCMT ref: 00F49494

_free.LIBCMT ref: 00F494F5

Part of subcall function 00F479D0: HeapFree.KERNEL32(00000000,00000000,?,00F49499,?,00000000,?,?,?,00F494C0,?,00000007,?,?,00F498C6,?), ref: 00F479E6
Part of subcall function 00F479D0: GetLastError.KERNEL32(?,?,00F49499,?,00000000,?,?,?,00F494C0,?,00000007,?,?,00F498C6,?,?), ref: 00F479F8

_free.LIBCMT ref: 00F49500
_free.LIBCMT ref: 00F4950B
_free.LIBCMT ref: 00F4955F
_free.LIBCMT ref: 00F4956A
_free.LIBCMT ref: 00F49575
_free.LIBCMT ref: 00F49580

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 04646944c7fafe64dacf3c00833f378f1ae823a9dda3dd6f71df57f78d4bdcf1
Instruction ID: 775a52d8a11f9d9df7ccadce5a9495c4e7165dbc20f046b213cc73c7008a1d7e
Opcode Fuzzy Hash: 04646944c7fafe64dacf3c00833f378f1ae823a9dda3dd6f71df57f78d4bdcf1
Instruction Fuzzy Hash: A1110DB168CB04BAD520F7B0DC07FCB7F9C9F04740F408C65BBA966162DBADB9056660

Uniqueness

Uniqueness Score: -1.00%

Function 00F4B589 Relevance: 9.3, APIs: 6, Instructions: 317
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 84%

			E00F4B589(void* __eflags, intOrPtr _a4, signed int _a8, signed char* _a12, intOrPtr _a16) {
				signed int _v8;
				char _v16;
				char _v23;
				char _v24;
				void _v32;
				signed int _v33;
				signed char _v40;
				signed int _v44;
				intOrPtr _v48;
				char _v51;
				void _v52;
				long _v56;
				char _v60;
				intOrPtr _v68;
				char _v72;
				struct _OVERLAPPED* _v76;
				signed char _v80;
				signed int _v84;
				signed int _v88;
				char _v92;
				intOrPtr _v96;
				long _v100;
				signed char* _v104;
				signed char* _v108;
				void* _v112;
				intOrPtr _v116;
				char _v120;
				int _v124;
				intOrPtr _v128;
				struct _OVERLAPPED* _v132;
				struct _OVERLAPPED* _v136;
				struct _OVERLAPPED* _v140;
				struct _OVERLAPPED* _v144;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t170;
				signed int _t172;
				int _t178;
				intOrPtr _t183;
				intOrPtr _t186;
				void* _t188;
				void* _t190;
				long _t193;
				void _t198;
				signed char* _t202;
				void* _t206;
				struct _OVERLAPPED* _t211;
				void* _t220;
				long _t224;
				intOrPtr _t225;
				char _t227;
				void* _t237;
				signed int _t242;
				intOrPtr _t245;
				signed int _t248;
				signed int _t249;
				signed int _t251;
				intOrPtr _t253;
				void* _t259;
				intOrPtr _t260;
				signed int _t261;
				signed char _t264;
				intOrPtr _t267;
				signed char* _t269;
				signed int _t272;
				signed int _t273;
				signed int _t277;
				signed int _t278;
				intOrPtr _t279;
				signed int _t280;
				struct _OVERLAPPED* _t282;
				struct _OVERLAPPED* _t284;
				signed int _t285;
				void* _t286;
				void* _t287;

				_t170 =  *0xf5c004; // 0x6a58fef8
				_v8 = _t170 ^ _t285;
				_t172 = _a8;
				_t264 = _t172 >> 6;
				_t242 = (_t172 & 0x0000003f) * 0x38;
				_t269 = _a12;
				_v108 = _t269;
				_v80 = _t264;
				_v112 =  *((intOrPtr*)(_t242 +  *((intOrPtr*)(0xf5d050 + _t264 * 4)) + 0x18));
				_v44 = _t242;
				_v96 = _a16 + _t269;
				_t178 = GetConsoleOutputCP();
				_t241 = 0;
				_v124 = _t178;
				E00F45870( &_v72, _t264, 0);
				_t273 = 0;
				_v92 = 0;
				_v88 = 0;
				_v84 = 0;
				_t245 =  *((intOrPtr*)(_v68 + 8));
				_v128 = _t245;
				_v104 = _t269;
				if(_t269 >= _v96) {
					L48:
					__eflags = _v60 - _t241;
				} else {
					while(1) {
						_t248 = _v44;
						_v51 =  *_t269;
						_v76 = _t241;
						_v40 = 1;
						_t186 =  *((intOrPtr*)(0xf5d050 + _v80 * 4));
						_v48 = _t186;
						if(_t245 != 0xfde9) {
							goto L19;
						}
						_t211 = _t241;
						_t267 = _v48 + 0x2e + _t248;
						_v116 = _t267;
						while( *((intOrPtr*)(_t267 + _t211)) != _t241) {
							_t211 =  &(_t211->Internal);
							if(_t211 < 5) {
								continue;
							}
							break;
						}
						_t264 = _v96 - _t269;
						_v40 = _t211;
						if(_t211 <= 0) {
							_t72 = ( *_t269 & 0x000000ff) + 0xf5c758; // 0x0
							_t253 =  *_t72 + 1;
							_v48 = _t253;
							__eflags = _t253 - _t264;
							if(_t253 > _t264) {
								__eflags = _t264;
								if(_t264 <= 0) {
									goto L40;
								} else {
									_t278 = _v44;
									do {
										 *((char*)( *((intOrPtr*)(0xf5d050 + _v80 * 4)) + _t278 + _t241 + 0x2e)) =  *((intOrPtr*)(_t241 + _t269));
										_t241 =  &(_t241->Internal);
										__eflags = _t241 - _t264;
									} while (_t241 < _t264);
									goto L39;
								}
							} else {
								_v144 = _t241;
								__eflags = _t253 - 4;
								_v140 = _t241;
								_v56 = _t269;
								_v40 = (_t253 == 4) + 1;
								_t220 = E00F4C2A1( &_v144,  &_v76,  &_v56, (_t253 == 4) + 1,  &_v144);
								_t287 = _t286 + 0x10;
								__eflags = _t220 - 0xffffffff;
								if(_t220 == 0xffffffff) {
									goto L48;
								} else {
									_t279 = _v48;
									goto L18;
								}
							}
						} else {
							_t224 =  *((char*)(( *(_t248 + _v48 + 0x2e) & 0x000000ff) + 0xf5c758)) + 1;
							_v56 = _t224;
							_t225 = _t224 - _v40;
							_v48 = _t225;
							if(_t225 > _t264) {
								__eflags = _t264;
								if(_t264 > 0) {
									_t280 = _t248;
									do {
										_t227 =  *((intOrPtr*)(_t241 + _t269));
										_t259 =  *((intOrPtr*)(0xf5d050 + _v80 * 4)) + _t280 + _t241;
										_t241 =  &(_t241->Internal);
										 *((char*)(_t259 + _v40 + 0x2e)) = _t227;
										_t280 = _v44;
										__eflags = _t241 - _t264;
									} while (_t241 < _t264);
									L39:
									_t273 = _v88;
								}
								L40:
								_t277 = _t273 + _t264;
								__eflags = _t277;
								L41:
								__eflags = _v60;
								_v88 = _t277;
							} else {
								_t264 = _v40;
								_t282 = _t241;
								_t260 = _v116;
								do {
									 *((char*)(_t285 + _t282 - 0xc)) =  *((intOrPtr*)(_t260 + _t282));
									_t282 =  &(_t282->Internal);
								} while (_t282 < _t264);
								_t283 = _v48;
								_t261 = _v44;
								if(_v48 > 0) {
									E00F452B0( &_v16 + _t264, _t269, _t283);
									_t261 = _v44;
									_t286 = _t286 + 0xc;
									_t264 = _v40;
								}
								_t272 = _v80;
								_t284 = _t241;
								do {
									 *( *((intOrPtr*)(0xf5d050 + _t272 * 4)) + _t261 + _t284 + 0x2e) = _t241;
									_t284 =  &(_t284->Internal);
								} while (_t284 < _t264);
								_t269 = _v104;
								_t279 = _v48;
								_v120 =  &_v16;
								_v136 = _t241;
								_v132 = _t241;
								_v40 = (_v56 == 4) + 1;
								_t237 = E00F4C2A1( &_v136,  &_v76,  &_v120, (_v56 == 4) + 1,  &_v136);
								_t287 = _t286 + 0x10;
								if(_t237 == 0xffffffff) {
									goto L48;
								} else {
									L18:
									_t269 = _t269 - 1 + _t279;
									L27:
									_t269 =  &(_t269[1]);
									_v104 = _t269;
									_t193 = E00F48CCA(_v124, _t241,  &_v76, _v40,  &_v32, 5, _t241, _t241);
									_t286 = _t287 + 0x20;
									_v56 = _t193;
									if(_t193 == 0) {
										goto L48;
									} else {
										if(WriteFile(_v112,  &_v32, _t193,  &_v100, _t241) == 0) {
											L47:
											_v92 = GetLastError();
											goto L48;
										} else {
											_t273 = _v84 - _v108 + _t269;
											_v88 = _t273;
											if(_v100 < _v56) {
												goto L48;
											} else {
												if(_v51 != 0xa) {
													L34:
													if(_t269 >= _v96) {
														goto L48;
													} else {
														_t245 = _v128;
														continue;
													}
												} else {
													_t198 = 0xd;
													_v52 = _t198;
													if(WriteFile(_v112,  &_v52, 1,  &_v100, _t241) == 0) {
														goto L47;
													} else {
														if(_v100 < 1) {
															goto L48;
														} else {
															_v84 = _v84 + 1;
															_t273 = _t273 + 1;
															_v88 = _t273;
															goto L34;
														}
													}
												}
											}
										}
									}
								}
							}
						}
						goto L49;
						L19:
						_t264 =  *((intOrPtr*)(_t248 + _t186 + 0x2d));
						__eflags = _t264 & 0x00000004;
						if((_t264 & 0x00000004) == 0) {
							_v33 =  *_t269;
							_t188 = E00F4958B(_t264);
							_t249 = _v33 & 0x000000ff;
							__eflags =  *((intOrPtr*)(_t188 + _t249 * 2)) - _t241;
							if( *((intOrPtr*)(_t188 + _t249 * 2)) >= _t241) {
								_push(1);
								_push(_t269);
								goto L26;
							} else {
								_t100 =  &(_t269[1]); // 0x1
								_t202 = _t100;
								_v56 = _t202;
								__eflags = _t202 - _v96;
								if(_t202 >= _v96) {
									_t264 = _v80;
									_t251 = _v44;
									_t241 = _v33;
									 *((char*)(_t251 +  *((intOrPtr*)(0xf5d050 + _t264 * 4)) + 0x2e)) = _v33;
									 *(_t251 +  *((intOrPtr*)(0xf5d050 + _t264 * 4)) + 0x2d) =  *(_t251 +  *((intOrPtr*)(0xf5d050 + _t264 * 4)) + 0x2d) | 0x00000004;
									_t277 = _t273 + 1;
									goto L41;
								} else {
									_t206 = E00F4ABFA( &_v76, _t269, 2);
									_t287 = _t286 + 0xc;
									__eflags = _t206 - 0xffffffff;
									if(_t206 == 0xffffffff) {
										goto L48;
									} else {
										_t269 = _v56;
										goto L27;
									}
								}
							}
						} else {
							_t264 = _t264 & 0x000000fb;
							_v24 =  *((intOrPtr*)(_t248 + _t186 + 0x2e));
							_v23 =  *_t269;
							_push(2);
							 *(_t248 + _v48 + 0x2d) = _t264;
							_push( &_v24);
							L26:
							_push( &_v76);
							_t190 = E00F4ABFA();
							_t287 = _t286 + 0xc;
							__eflags = _t190 - 0xffffffff;
							if(_t190 == 0xffffffff) {
								goto L48;
							} else {
								goto L27;
							}
						}
						goto L49;
					}
				}
				L49:
				if(__eflags != 0) {
					_t183 = _v72;
					_t165 = _t183 + 0x350;
					 *_t165 =  *(_t183 + 0x350) & 0xfffffffd;
					__eflags =  *_t165;
				}
				__eflags = _v8 ^ _t285;
				asm("movsd");
				asm("movsd");
				asm("movsd");
				return E00F429FA(_a4, _t241, _v8 ^ _t285, _t264, _a4,  &_v92);
			}

0x00f4b594
0x00f4b59b
0x00f4b59e
0x00f4b5a6
0x00f4b5a9
0x00f4b5b6
0x00f4b5b9
0x00f4b5bc
0x00f4b5c3
0x00f4b5cb
0x00f4b5ce
0x00f4b5d1
0x00f4b5d7
0x00f4b5d9
0x00f4b5e0
0x00f4b5ea
0x00f4b5ec
0x00f4b5ef
0x00f4b5f2
0x00f4b5f5
0x00f4b5f8
0x00f4b5fb
0x00f4b601
0x00f4b90c
0x00f4b90c
0x00000000
0x00f4b607
0x00f4b60f
0x00f4b612
0x00f4b618
0x00f4b61b
0x00f4b622
0x00f4b629
0x00f4b62c
0x00000000
0x00000000
0x00f4b635
0x00f4b63a
0x00f4b63c
0x00f4b63f
0x00f4b644
0x00f4b648
0x00000000
0x00000000
0x00000000
0x00f4b648
0x00f4b64d
0x00f4b64f
0x00f4b654
0x00f4b70e
0x00f4b715
0x00f4b716
0x00f4b719
0x00f4b71b
0x00f4b8bf
0x00f4b8c1
0x00000000
0x00f4b8c3
0x00f4b8c3
0x00f4b8c6
0x00f4b8d5
0x00f4b8d9
0x00f4b8da
0x00f4b8da
0x00000000
0x00f4b8de
0x00f4b721
0x00f4b723
0x00f4b729
0x00f4b72c
0x00f4b738
0x00f4b741
0x00f4b74c
0x00f4b751
0x00f4b754
0x00f4b757
0x00000000
0x00f4b75d
0x00f4b75d
0x00000000
0x00f4b75d
0x00f4b757
0x00f4b65a
0x00f4b669
0x00f4b66a
0x00f4b66d
0x00f4b670
0x00f4b675
0x00f4b88b
0x00f4b88d
0x00f4b88f
0x00f4b891
0x00f4b89b
0x00f4b8a3
0x00f4b8a5
0x00f4b8a6
0x00f4b8aa
0x00f4b8ad
0x00f4b8ad
0x00f4b8b1
0x00f4b8b1
0x00f4b8b1
0x00f4b8b4
0x00f4b8b4
0x00f4b8b4
0x00f4b8b6
0x00f4b8b6
0x00f4b8ba
0x00f4b67b
0x00f4b67b
0x00f4b67e
0x00f4b680
0x00f4b683
0x00f4b686
0x00f4b68a
0x00f4b68b
0x00f4b68f
0x00f4b692
0x00f4b697
0x00f4b6a1
0x00f4b6a6
0x00f4b6a9
0x00f4b6ac
0x00f4b6ac
0x00f4b6af
0x00f4b6b2
0x00f4b6b4
0x00f4b6bd
0x00f4b6c1
0x00f4b6c2
0x00f4b6c6
0x00f4b6cc
0x00f4b6d5
0x00f4b6e2
0x00f4b6e9
0x00f4b6ed
0x00f4b6f8
0x00f4b6fd
0x00f4b703
0x00000000
0x00f4b709
0x00f4b760
0x00f4b761
0x00f4b7e4
0x00f4b7eb
0x00f4b7f3
0x00f4b7fb
0x00f4b800
0x00f4b803
0x00f4b808
0x00000000
0x00f4b80e
0x00f4b823
0x00f4b903
0x00f4b909
0x00000000
0x00f4b829
0x00f4b832
0x00f4b834
0x00f4b83a
0x00000000
0x00f4b840
0x00f4b844
0x00f4b87a
0x00f4b87d
0x00000000
0x00f4b883
0x00f4b883
0x00000000
0x00f4b883
0x00f4b846
0x00f4b848
0x00f4b84a
0x00f4b863
0x00000000
0x00f4b869
0x00f4b86d
0x00000000
0x00f4b873
0x00f4b873
0x00f4b876
0x00f4b877
0x00000000
0x00f4b877
0x00f4b86d
0x00f4b863
0x00f4b844
0x00f4b83a
0x00f4b823
0x00f4b808
0x00f4b703
0x00f4b675
0x00000000
0x00f4b765
0x00f4b765
0x00f4b769
0x00f4b76c
0x00f4b78e
0x00f4b791
0x00f4b796
0x00f4b79a
0x00f4b79e
0x00f4b7cc
0x00f4b7ce
0x00000000
0x00f4b7a0
0x00f4b7a0
0x00f4b7a0
0x00f4b7a3
0x00f4b7a6
0x00f4b7a9
0x00f4b8e0
0x00f4b8e3
0x00f4b8e6
0x00f4b8f0
0x00f4b8fb
0x00f4b900
0x00000000
0x00f4b7af
0x00f4b7b6
0x00f4b7bb
0x00f4b7be
0x00f4b7c1
0x00000000
0x00f4b7c7
0x00f4b7c7
0x00000000
0x00f4b7c7
0x00f4b7c1
0x00f4b7a9
0x00f4b76e
0x00f4b772
0x00f4b775
0x00f4b77a
0x00f4b780
0x00f4b782
0x00f4b789
0x00f4b7cf
0x00f4b7d2
0x00f4b7d3
0x00f4b7d8
0x00f4b7db
0x00f4b7de
0x00000000
0x00000000
0x00000000
0x00000000
0x00f4b7de
0x00000000
0x00f4b76c
0x00f4b607
0x00f4b90f
0x00f4b90f
0x00f4b911
0x00f4b914
0x00f4b914
0x00f4b914
0x00f4b914
0x00f4b926
0x00f4b928
0x00f4b929
0x00f4b92a
0x00f4b934

APIs

GetConsoleOutputCP.KERNEL32(?,?,?), ref: 00F4B5D1
__fassign.LIBCMT ref: 00F4B7B6
__fassign.LIBCMT ref: 00F4B7D3
WriteFile.KERNEL32(?,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00F4B81B
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00F4B85B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00F4B903

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: b760c805ca6e499785d5010659a2f9f6043e1000eb9ffeebd99e03c4c61fcc26
Instruction ID: d785fd691dc8f917fb6fc168cc207c095ae951dfbb8d3c85b9f58e2c21cca0b5
Opcode Fuzzy Hash: b760c805ca6e499785d5010659a2f9f6043e1000eb9ffeebd99e03c4c61fcc26
Instruction Fuzzy Hash: 9DC18A75D0125C9FCF14CFA8C880AEDBFB9AF48314F28416AE955BB342D7319A46DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00F43FD4 Relevance: 9.1, APIs: 6, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E00F43FD4(void* __ecx) {
				void* _t4;
				void* _t8;
				void* _t11;
				void* _t13;
				void* _t14;
				void* _t18;
				void* _t23;
				long _t24;
				void* _t27;

				_t13 = __ecx;
				if( *0xf5c020 != 0xffffffff) {
					_t24 = GetLastError();
					_t11 = E00F4519B(_t13, __eflags,  *0xf5c020);
					_t14 = _t23;
					__eflags = _t11 - 0xffffffff;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						__eflags = _t11;
						if(__eflags == 0) {
							_t4 = E00F451D6(_t14, __eflags,  *0xf5c020, 0xffffffff);
							__eflags = _t4;
							if(_t4 != 0) {
								_push(0x28);
								_t27 = E00F46EC0();
								_t18 = 1;
								__eflags = _t27;
								if(__eflags == 0) {
									L8:
									_t11 = 0;
									E00F451D6(_t18, __eflags,  *0xf5c020, 0);
								} else {
									_t8 = E00F451D6(_t18, __eflags,  *0xf5c020, _t27);
									_pop(_t18);
									__eflags = _t8;
									if(__eflags != 0) {
										_t11 = _t27;
										_t27 = 0;
										__eflags = 0;
									} else {
										goto L8;
									}
								}
								E00F468D7(_t27);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t24);
					return _t11;
				} else {
					return 0;
				}
			}

0x00f43fd4
0x00f43fdb
0x00f43fee
0x00f43ff5
0x00f43ff7
0x00f43ff8
0x00f43ffb
0x00f44014
0x00f44014
0x00f43ffd
0x00f43ffd
0x00f43fff
0x00f44009
0x00f44010
0x00f44012
0x00f44019
0x00f44022
0x00f44025
0x00f44026
0x00f44028
0x00f4403c
0x00f4403c
0x00f44045
0x00f4402a
0x00f44031
0x00f44037
0x00f44038
0x00f4403a
0x00f4404e
0x00f44050
0x00f44050
0x00000000
0x00000000
0x00000000
0x00f4403a
0x00f44053
0x00000000
0x00000000
0x00000000
0x00f44012
0x00f43fff
0x00f4405b
0x00f44065
0x00f43fdd
0x00f43fdf
0x00f43fdf

APIs

GetLastError.KERNEL32(?,?,00F43FCB,00F43BC6,00F43346), ref: 00F43FE2
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00F43FF0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00F44009
SetLastError.KERNEL32(00000000,00F43FCB,00F43BC6,00F43346), ref: 00F4405B

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 933d9f124d4970986b032749f83b8b75257eb101ef17af771cff972891f8167d
Instruction ID: cd984159f3fb9f81b020d34eb5fee4af3677faed9baaac9128deafc0f783d3a8
Opcode Fuzzy Hash: 933d9f124d4970986b032749f83b8b75257eb101ef17af771cff972891f8167d
Instruction Fuzzy Hash: 2501F1339097159EA7242A78AC86B273FA4EB567793300239FF22910F2EE521814F590

Uniqueness

Uniqueness Score: -1.00%

Function 00F4823C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F4823C(intOrPtr* _a4, intOrPtr _a8, intOrPtr _a16) {
				intOrPtr _t14;
				intOrPtr _t15;
				intOrPtr _t17;
				intOrPtr _t36;
				intOrPtr* _t38;
				intOrPtr _t39;

				_t38 = _a4;
				if(_t38 != 0) {
					__eflags =  *_t38;
					if( *_t38 != 0) {
						_t14 = E00F48CCA(_a16, 0, _t38, 0xffffffff, 0, 0, 0, 0);
						__eflags = _t14;
						if(__eflags != 0) {
							_t36 = _a8;
							__eflags = _t14 -  *((intOrPtr*)(_t36 + 0xc));
							if(_t14 <=  *((intOrPtr*)(_t36 + 0xc))) {
								L10:
								_t15 = E00F48CCA(_a16, 0, _t38, 0xffffffff,  *((intOrPtr*)(_t36 + 8)),  *((intOrPtr*)(_t36 + 0xc)), 0, 0);
								__eflags = _t15;
								if(__eflags != 0) {
									 *((intOrPtr*)(_t36 + 0x10)) = _t15 - 1;
									_t17 = 0;
									__eflags = 0;
								} else {
									E00F46FFF(GetLastError());
									_t17 =  *((intOrPtr*)(E00F47035(__eflags)));
								}
								L13:
								L14:
								return _t17;
							}
							_t17 = E00F48303(_t36, _t14);
							__eflags = _t17;
							if(_t17 != 0) {
								goto L13;
							}
							goto L10;
						}
						E00F46FFF(GetLastError());
						_t17 =  *((intOrPtr*)(E00F47035(__eflags)));
						goto L14;
					}
					_t39 = _a8;
					__eflags =  *((intOrPtr*)(_t39 + 0xc));
					if( *((intOrPtr*)(_t39 + 0xc)) != 0) {
						L5:
						 *((char*)( *((intOrPtr*)(_t39 + 8)))) = 0;
						_t17 = 0;
						 *((intOrPtr*)(_t39 + 0x10)) = 0;
						goto L14;
					}
					_t17 = E00F48303(_t39, 1);
					__eflags = _t17;
					if(_t17 != 0) {
						goto L14;
					}
					goto L5;
				}
				E00F4832A(_a8);
				return 0;
			}

0x00f48242
0x00f48247
0x00f4825b
0x00f4825e
0x00f48290
0x00f48298
0x00f4829a
0x00f482b3
0x00f482b6
0x00f482b9
0x00f482c7
0x00f482d6
0x00f482de
0x00f482e0
0x00f482f9
0x00f482fc
0x00f482fc
0x00f482e2
0x00f482e9
0x00f482f4
0x00f482f4
0x00f482fe
0x00f482ff
0x00000000
0x00f482ff
0x00f482be
0x00f482c3
0x00f482c5
0x00000000
0x00000000
0x00000000
0x00f482c5
0x00f482a3
0x00f482ae
0x00000000
0x00f482ae
0x00f48260
0x00f48263
0x00f48266
0x00f48279
0x00f4827c
0x00f4827e
0x00f48280
0x00000000
0x00f48280
0x00f4826c
0x00f48271
0x00f48273
0x00000000
0x00000000
0x00000000
0x00f48273
0x00f4824c
0x00000000

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe, xrefs: 00F48241

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe
API String ID: 0-123155926
Opcode ID: 25fded91d1e3868bdc67eb6aec3e6dd3b80773ddefcc171185a04811f9e09e9a
Instruction ID: a79a47e23c05cd00f01a509b8a1115c79f8b7fc250ec8adadd54fd8d90d2516d
Opcode Fuzzy Hash: 25fded91d1e3868bdc67eb6aec3e6dd3b80773ddefcc171185a04811f9e09e9a
Instruction Fuzzy Hash: 5421CF71A04609AF9B20AF79CC8092F7FADAF023F47104625FE2496150EF75ED42B7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00F45042 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00F45042(void* __ecx, signed int* _a4, intOrPtr _a8) {
				WCHAR* _v8;
				signed int _t11;
				WCHAR* _t12;
				struct HINSTANCE__* _t16;
				struct HINSTANCE__* _t18;
				signed int* _t22;
				signed int* _t26;
				struct HINSTANCE__* _t29;
				WCHAR* _t31;
				void* _t32;

				_t26 = _a4;
				while(_t26 != _a8) {
					_t11 =  *_t26;
					_t22 = 0xf5cd44 + _t11 * 4;
					_t29 =  *_t22;
					if(_t29 == 0) {
						_t12 =  *(0xf4fbb0 + _t11 * 4);
						_v8 = _t12;
						_t29 = LoadLibraryExW(_t12, 0, 0x800);
						if(_t29 != 0) {
							L13:
							 *_t22 = _t29;
							if( *_t22 != 0) {
								FreeLibrary(_t29);
							}
							L15:
							_t16 = _t29;
							L12:
							return _t16;
						}
						_t18 = GetLastError();
						if(_t18 != 0x57) {
							L8:
							 *_t22 = _t18 | 0xffffffff;
							L9:
							_t26 =  &(_t26[1]);
							continue;
						}
						_t31 = _v8;
						_t18 = E00F46F48(_t31, L"api-ms-", 7);
						_t32 = _t32 + 0xc;
						if(_t18 == 0) {
							goto L8;
						}
						_t18 = LoadLibraryExW(_t31, 0, 0);
						_t29 = _t18;
						if(_t29 != 0) {
							goto L13;
						}
						goto L8;
					}
					if(_t29 != 0xffffffff) {
						goto L15;
					}
					goto L9;
				}
				_t16 = 0;
				goto L12;
			}

0x00f45049
0x00f450bd
0x00f4504e
0x00f45050
0x00f45057
0x00f4505b
0x00f45064
0x00f45073
0x00f4507c
0x00f45080
0x00f450c9
0x00f450cb
0x00f450cf
0x00f450d2
0x00f450d2
0x00f450d8
0x00f450d8
0x00f450c4
0x00f450c8
0x00f450c8
0x00f45082
0x00f4508b
0x00f450b5
0x00f450b8
0x00f450ba
0x00f450ba
0x00000000
0x00f450ba
0x00f4508d
0x00f45098
0x00f4509d
0x00f450a2
0x00000000
0x00000000
0x00f450a9
0x00f450af
0x00f450b3
0x00000000
0x00000000
0x00000000
0x00f450b3
0x00f45060
0x00000000
0x00000000
0x00000000
0x00f45062
0x00f450c2
0x00000000

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,00F45103,?,?,00F5CCEC,00000000,?,00F4522E,00000004,InitializeCriticalSectionEx,00F4FCA4,InitializeCriticalSectionEx,00000000), ref: 00F450D2

Strings

api-ms-, xrefs: 00F45092

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 2447a72a36b7c53644816d5b858ad32ee9600bd1c26982870f6f747ef8f1cdbf
Instruction ID: 6363670ca6fb4604cb2e415d4418a62c017f0b61ed91766cd71071e814357b54
Opcode Fuzzy Hash: 2447a72a36b7c53644816d5b858ad32ee9600bd1c26982870f6f747ef8f1cdbf
Instruction Fuzzy Hash: 2611CD3AD41B266BCB32AB5C9C447593B549F52F70F140160ED15E72C1D760ED0466D2

Uniqueness

Uniqueness Score: -1.00%

Function 00F46668 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 25%

			E00F46668(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t14;

				_v8 = _v8 & 0x00000000;
				_t8 =  &_v8;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t8, __ecx);
				if(_t8 != 0) {
					_t8 = GetProcAddress(_v8, "CorExitProcess");
					_t14 = _t8;
					if(_t14 != 0) {
						 *0xf4f140(_a4);
						_t8 =  *_t14();
					}
				}
				if(_v8 != 0) {
					return FreeLibrary(_v8);
				}
				return _t8;
			}

0x00f4666e
0x00f46672
0x00f4667d
0x00f46685
0x00f46690
0x00f46696
0x00f4669a
0x00f466a1
0x00f466a7
0x00f466a7
0x00f466a9
0x00f466ae
0x00000000
0x00f466b3
0x00f466ba

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00F4665D,00F47695,?,00F46625,?,?,00F47695), ref: 00F4667D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00F46690
FreeLibrary.KERNEL32(00000000,?,?,00F4665D,00F47695,?,00F46625,?,?,00F47695), ref: 00F466B3

Strings

mscoree.dll, xrefs: 00F46676
CorExitProcess, xrefs: 00F46688

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e335d99b6f0a7dc199a2e5f9a2a74ac826cd533b7c1e83519f7f4dff995eac97
Instruction ID: 8f0374eb9cfb00e1a7c1200c47a787d4a8f31c630e9145c32e1038f0554d98a5
Opcode Fuzzy Hash: e335d99b6f0a7dc199a2e5f9a2a74ac826cd533b7c1e83519f7f4dff995eac97
Instruction Fuzzy Hash: 01F08C35D00218FFDB119B94DC09B9EBEB8EF92766F110074EC09E61A1CB708E08FA91

Uniqueness

Uniqueness Score: -1.00%

Function 00F49406 Relevance: 7.5, APIs: 5, Instructions: 40
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00F49406(intOrPtr* _a4) {
				intOrPtr _t6;
				intOrPtr* _t21;
				void* _t23;
				void* _t24;
				void* _t25;
				void* _t26;
				void* _t27;

				_t21 = _a4;
				if(_t21 != 0) {
					_t23 =  *_t21 -  *0xf5c648; // 0xf5c698
					if(_t23 != 0) {
						E00F479D0(_t7);
					}
					_t24 =  *((intOrPtr*)(_t21 + 4)) -  *0xf5c64c; // 0xf5d330
					if(_t24 != 0) {
						E00F479D0(_t8);
					}
					_t25 =  *((intOrPtr*)(_t21 + 8)) -  *0xf5c650; // 0xf5d330
					if(_t25 != 0) {
						E00F479D0(_t9);
					}
					_t26 =  *((intOrPtr*)(_t21 + 0x30)) -  *0xf5c678; // 0xf5c69c
					if(_t26 != 0) {
						E00F479D0(_t10);
					}
					_t6 =  *((intOrPtr*)(_t21 + 0x34));
					_t27 = _t6 -  *0xf5c67c; // 0xf5d334
					if(_t27 != 0) {
						return E00F479D0(_t6);
					}
				}
				return _t6;
			}

0x00f4940c
0x00f49411
0x00f49415
0x00f4941b
0x00f4941e
0x00f49423
0x00f49427
0x00f4942d
0x00f49430
0x00f49435
0x00f49439
0x00f4943f
0x00f49442
0x00f49447
0x00f4944b
0x00f49451
0x00f49454
0x00f49459
0x00f4945a
0x00f4945d
0x00f49463
0x00000000
0x00f4946b
0x00f49463
0x00f4946e

APIs

_free.LIBCMT ref: 00F4941E

Part of subcall function 00F479D0: HeapFree.KERNEL32(00000000,00000000,?,00F49499,?,00000000,?,?,?,00F494C0,?,00000007,?,?,00F498C6,?), ref: 00F479E6
Part of subcall function 00F479D0: GetLastError.KERNEL32(?,?,00F49499,?,00000000,?,?,?,00F494C0,?,00000007,?,?,00F498C6,?,?), ref: 00F479F8

_free.LIBCMT ref: 00F49430
_free.LIBCMT ref: 00F49442
_free.LIBCMT ref: 00F49454
_free.LIBCMT ref: 00F49466

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 238dad3d6e918f71b630d2e6a10087cba1e164369e7a6ad83e9225f3aae8e686
Instruction ID: bab54a3342034d220d6ece6780903df3c1b9c0808f8e00a3a10e68d3a799ab68
Opcode Fuzzy Hash: 238dad3d6e918f71b630d2e6a10087cba1e164369e7a6ad83e9225f3aae8e686
Instruction Fuzzy Hash: E6F06272A0C3047B8620FB6CF8C2C177BD9AA14721B648C06F909D7A11C778FC80B6E4

Uniqueness

Uniqueness Score: -1.00%

Function 00F47BC0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00F47BC0(void* __esi, signed int* _a4, signed int _a8, intOrPtr _a12) {
				intOrPtr _v0;
				signed int _v6;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr* _v72;
				intOrPtr* _v104;
				intOrPtr* _v108;
				intOrPtr _v112;
				signed int _v124;
				struct _WIN32_FIND_DATAW _v608;
				char _v609;
				intOrPtr* _v616;
				union _FINDEX_INFO_LEVELS _v620;
				union _FINDEX_INFO_LEVELS _v624;
				union _FINDEX_INFO_LEVELS _v628;
				signed int _v632;
				union _FINDEX_INFO_LEVELS _v636;
				union _FINDEX_INFO_LEVELS _v640;
				signed int _v644;
				signed int _v648;
				union _FINDEX_INFO_LEVELS _v652;
				union _FINDEX_INFO_LEVELS _v656;
				union _FINDEX_INFO_LEVELS _v660;
				union _FINDEX_INFO_LEVELS _v664;
				signed int _v668;
				union _FINDEX_INFO_LEVELS _v672;
				union _FINDEX_INFO_LEVELS _v676;
				intOrPtr _v724;
				void* __ebx;
				void* __edi;
				intOrPtr* _t131;
				signed int _t132;
				signed int _t134;
				signed int _t139;
				signed int _t140;
				intOrPtr* _t150;
				signed int _t152;
				intOrPtr _t153;
				signed int _t157;
				signed int _t159;
				signed int _t164;
				signed int _t166;
				char _t168;
				signed char _t169;
				signed int _t175;
				union _FINDEX_INFO_LEVELS _t179;
				signed int _t185;
				union _FINDEX_INFO_LEVELS _t188;
				intOrPtr* _t196;
				signed int _t199;
				intOrPtr _t204;
				signed int _t206;
				signed int _t209;
				signed int _t211;
				signed int _t212;
				signed int _t213;
				signed int _t215;
				signed int _t217;
				signed int _t218;
				signed int* _t219;
				signed int _t222;
				void* _t225;
				union _FINDEX_INFO_LEVELS _t226;
				void* _t227;
				intOrPtr _t229;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				signed int _t236;
				intOrPtr* _t239;
				signed int _t241;
				intOrPtr* _t244;
				signed int _t249;
				signed int _t255;
				signed int _t257;
				signed int _t263;
				intOrPtr* _t264;
				signed int _t272;
				signed int _t274;
				intOrPtr* _t275;
				void* _t277;
				signed int _t280;
				signed int _t283;
				signed int _t285;
				intOrPtr _t287;
				void* _t288;
				signed int* _t292;
				signed int _t293;
				signed int _t295;
				signed int _t296;
				signed int _t297;
				signed int _t299;
				void* _t300;
				void* _t301;
				signed int _t302;
				void* _t306;
				signed int _t307;
				void* _t308;
				void* _t309;
				void* _t310;
				signed int _t311;
				void* _t312;
				void* _t313;

				_t131 = _a8;
				_t309 = _t308 - 0x28;
				_push(__esi);
				_t317 = _t131;
				if(_t131 != 0) {
					_t292 = _a4;
					_t222 = 0;
					 *_t131 = 0;
					_t283 = 0;
					_t132 =  *_t292;
					_t232 = 0;
					_v608.cAlternateFileName = 0;
					_v40 = 0;
					_v36 = 0;
					__eflags = _t132;
					if(_t132 == 0) {
						L9:
						_v8 = _t222;
						_t134 = _t232 - _t283;
						_t293 = _t283;
						_v12 = _t293;
						_t271 = (_t134 >> 2) + 1;
						_t136 = _t134 + 3 >> 2;
						__eflags = _t232 - _t293;
						_v16 = (_t134 >> 2) + 1;
						asm("sbb esi, esi");
						_t295 =  !_t293 & _t134 + 0x00000003 >> 0x00000002;
						__eflags = _t295;
						if(_t295 != 0) {
							_t213 = _t283;
							_t280 = _t222;
							do {
								_t264 =  *_t213;
								_t20 = _t264 + 1; // 0x1
								_v20 = _t20;
								do {
									_t215 =  *_t264;
									_t264 = _t264 + 1;
									__eflags = _t215;
								} while (_t215 != 0);
								_t222 = _t222 + 1 + _t264 - _v20;
								_t213 = _v12 + 4;
								_t280 = _t280 + 1;
								_v12 = _t213;
								__eflags = _t280 - _t295;
							} while (_t280 != _t295);
							_t271 = _v16;
							_v8 = _t222;
							_t222 = 0;
							__eflags = 0;
						}
						_t296 = E00F4617B(_t136, _t271, _v8, 1);
						_t310 = _t309 + 0xc;
						__eflags = _t296;
						if(_t296 != 0) {
							_v12 = _t283;
							_t139 = _t296 + _v16 * 4;
							_t233 = _t139;
							_v28 = _t139;
							_t140 = _t283;
							_v16 = _t233;
							__eflags = _t140 - _v40;
							if(_t140 == _v40) {
								L24:
								_v12 = _t222;
								 *_a8 = _t296;
								_t297 = _t222;
								goto L25;
							} else {
								_t274 = _t296 - _t283;
								__eflags = _t274;
								_v32 = _t274;
								do {
									_t150 =  *_t140;
									_t275 = _t150;
									_v24 = _t150;
									_v20 = _t275 + 1;
									do {
										_t152 =  *_t275;
										_t275 = _t275 + 1;
										__eflags = _t152;
									} while (_t152 != 0);
									_t153 = _t275 - _v20 + 1;
									_push(_t153);
									_v20 = _t153;
									_t157 = E00F4B201(_t233, _v28 - _t233 + _v8, _v24);
									_t310 = _t310 + 0x10;
									__eflags = _t157;
									if(_t157 != 0) {
										_push(_t222);
										_push(_t222);
										_push(_t222);
										_push(_t222);
										_push(_t222);
										E00F45C00();
										asm("int3");
										_t306 = _t310;
										_push(_t233);
										_t239 = _v72;
										_t65 = _t239 + 1; // 0x1
										_t277 = _t65;
										do {
											_t159 =  *_t239;
											_t239 = _t239 + 1;
											__eflags = _t159;
										} while (_t159 != 0);
										_push(_t283);
										_t285 = _a8;
										_t241 = _t239 - _t277 + 1;
										_v12 = _t241;
										__eflags = _t241 -  !_t285;
										if(_t241 <=  !_t285) {
											_push(_t222);
											_push(_t296);
											_t68 = _t285 + 1; // 0x1
											_t225 = _t68 + _t241;
											_t300 = E00F47973(_t225, 1);
											__eflags = _t285;
											if(_t285 == 0) {
												L40:
												_push(_v12);
												_t225 = _t225 - _t285;
												_t164 = E00F4B201(_t300 + _t285, _t225, _v0);
												_t311 = _t310 + 0x10;
												__eflags = _t164;
												if(_t164 != 0) {
													goto L45;
												} else {
													_t229 = _a12;
													_t206 = E00F481AA(_t229);
													_v12 = _t206;
													__eflags = _t206;
													if(_t206 == 0) {
														 *( *(_t229 + 4)) = _t300;
														_t302 = 0;
														_t77 = _t229 + 4;
														 *_t77 =  *(_t229 + 4) + 4;
														__eflags =  *_t77;
													} else {
														E00F479D0(_t300);
														_t302 = _v12;
													}
													E00F479D0(0);
													_t209 = _t302;
													goto L37;
												}
											} else {
												_push(_t285);
												_t211 = E00F4B201(_t300, _t225, _a4);
												_t311 = _t310 + 0x10;
												__eflags = _t211;
												if(_t211 != 0) {
													L45:
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													E00F45C00();
													asm("int3");
													_push(_t306);
													_t307 = _t311;
													_t312 = _t311 - 0x298;
													_t166 =  *0xf5c004; // 0x6a58fef8
													_v124 = _t166 ^ _t307;
													_t244 = _v108;
													_t278 = _v104;
													_push(_t225);
													_push(0);
													_t287 = _v112;
													_v724 = _t278;
													__eflags = _t244 - _t287;
													if(_t244 != _t287) {
														while(1) {
															_t204 =  *_t244;
															__eflags = _t204 - 0x2f;
															if(_t204 == 0x2f) {
																break;
															}
															__eflags = _t204 - 0x5c;
															if(_t204 != 0x5c) {
																__eflags = _t204 - 0x3a;
																if(_t204 != 0x3a) {
																	_t244 = E00F4B250(_t287, _t244);
																	__eflags = _t244 - _t287;
																	if(_t244 != _t287) {
																		continue;
																	}
																}
															}
															break;
														}
														_t278 = _v616;
													}
													_t168 =  *_t244;
													_v609 = _t168;
													__eflags = _t168 - 0x3a;
													if(_t168 != 0x3a) {
														L56:
														_t226 = 0;
														__eflags = _t168 - 0x2f;
														if(__eflags == 0) {
															L59:
															_t169 = 1;
														} else {
															__eflags = _t168 - 0x5c;
															if(__eflags == 0) {
																goto L59;
															} else {
																__eflags = _t168 - 0x3a;
																_t169 = 0;
																if(__eflags == 0) {
																	goto L59;
																}
															}
														}
														_v676 = _t226;
														_v672 = _t226;
														_push(_t300);
														asm("sbb eax, eax");
														_v668 = _t226;
														_v664 = _t226;
														_v644 =  ~(_t169 & 0x000000ff) & _t244 - _t287 + 0x00000001;
														_v660 = _t226;
														_v656 = _t226;
														_t175 = E00F47BA3(_t244 - _t287 + 1, _t287,  &_v676, E00F480B7(_t278, __eflags));
														_t313 = _t312 + 0xc;
														asm("sbb eax, eax");
														_t179 = FindFirstFileExW( !( ~_t175) & _v668, _t226,  &_v608, _t226, _t226, _t226);
														_t301 = _t179;
														__eflags = _t301 - 0xffffffff;
														if(_t301 != 0xffffffff) {
															_t249 =  *((intOrPtr*)(_v616 + 4)) -  *_v616;
															__eflags = _t249;
															_v648 = _t249 >> 2;
															do {
																_v640 = _t226;
																_v636 = _t226;
																_v632 = _t226;
																_v628 = _t226;
																_v624 = _t226;
																_v620 = _t226;
																_t185 = E00F47AD4( &(_v608.cFileName),  &_v640,  &_v609, E00F480B7(_t278, __eflags));
																_t313 = _t313 + 0x10;
																asm("sbb eax, eax");
																_t188 =  !( ~_t185) & _v632;
																__eflags =  *_t188 - 0x2e;
																if( *_t188 != 0x2e) {
																	L67:
																	_push(_v616);
																	_push(_v644);
																	_push(_t287);
																	_push(_t188);
																	L33();
																	_t313 = _t313 + 0x10;
																	_v652 = _t188;
																	__eflags = _t188;
																	if(_t188 != 0) {
																		__eflags = _v620 - _t226;
																		if(_v620 != _t226) {
																			E00F479D0(_v632);
																			_t188 = _v652;
																		}
																		_t226 = _t188;
																	} else {
																		goto L68;
																	}
																} else {
																	_t255 =  *((intOrPtr*)(_t188 + 1));
																	__eflags = _t255;
																	if(_t255 == 0) {
																		goto L68;
																	} else {
																		__eflags = _t255 - 0x2e;
																		if(_t255 != 0x2e) {
																			goto L67;
																		} else {
																			__eflags =  *((intOrPtr*)(_t188 + 2)) - _t226;
																			if( *((intOrPtr*)(_t188 + 2)) == _t226) {
																				goto L68;
																			} else {
																				goto L67;
																			}
																		}
																	}
																}
																L76:
																FindClose(_t301);
																goto L77;
																L68:
																__eflags = _v620 - _t226;
																if(_v620 != _t226) {
																	E00F479D0(_v632);
																}
																__eflags = FindNextFileW(_t301,  &_v608);
															} while (__eflags != 0);
															_t196 = _v616;
															_t257 = _v648;
															_t278 =  *_t196;
															_t199 =  *((intOrPtr*)(_t196 + 4)) -  *_t196 >> 2;
															__eflags = _t257 - _t199;
															if(_t257 != _t199) {
																E00F4AC60(_t278, _t278 + _t257 * 4, _t199 - _t257, 4, E00F47A0A);
															}
															goto L76;
														} else {
															_push(_v616);
															_push(_t226);
															_push(_t226);
															_push(_t287);
															L33();
															_t226 = _t179;
														}
														L77:
														__eflags = _v656;
														_pop(_t300);
														if(_v656 != 0) {
															E00F479D0(_v668);
														}
														_t190 = _t226;
													} else {
														_t190 = _t287 + 1;
														__eflags = _t244 - _t287 + 1;
														if(_t244 == _t287 + 1) {
															_t168 = _v609;
															goto L56;
														} else {
															_push(_t278);
															_push(0);
															_push(0);
															_push(_t287);
															L33();
														}
													}
													_pop(_t288);
													__eflags = _v16 ^ _t307;
													_pop(_t227);
													return E00F429FA(_t190, _t227, _v16 ^ _t307, _t278, _t288, _t300);
												} else {
													goto L40;
												}
											}
										} else {
											_t209 = 0xc;
											L37:
											return _t209;
										}
									} else {
										goto L23;
									}
									goto L81;
									L23:
									_t212 = _v12;
									_t263 = _v16;
									 *((intOrPtr*)(_v32 + _t212)) = _t263;
									_t140 = _t212 + 4;
									_t233 = _t263 + _v20;
									_v16 = _t233;
									_v12 = _t140;
									__eflags = _t140 - _v40;
								} while (_t140 != _v40);
								goto L24;
							}
						} else {
							_t297 = _t296 | 0xffffffff;
							_v12 = _t297;
							L25:
							E00F479D0(_t222);
							_pop(_t234);
							goto L26;
						}
					} else {
						while(1) {
							_v8 = 0x3f2a;
							_v6 = _t222;
							_t217 = E00F4B210(_t132,  &_v8);
							_t234 =  *_t292;
							__eflags = _t217;
							if(_t217 != 0) {
								_push( &(_v608.cAlternateFileName));
								_push(_t217);
								_push(_t234);
								L46();
								_t309 = _t309 + 0xc;
								_v12 = _t217;
								_t297 = _t217;
							} else {
								_t218 =  &(_v608.cAlternateFileName);
								_push(_t218);
								_push(_t222);
								_push(_t222);
								_push(_t234);
								L33();
								_t297 = _t218;
								_t309 = _t309 + 0x10;
								_v12 = _t297;
							}
							__eflags = _t297;
							if(_t297 != 0) {
								break;
							}
							_t292 =  &(_a4[1]);
							_a4 = _t292;
							_t132 =  *_t292;
							__eflags = _t132;
							if(_t132 != 0) {
								continue;
							} else {
								_t283 = _v608.cAlternateFileName;
								_t232 = _v40;
								goto L9;
							}
							goto L81;
						}
						_t283 = _v608.cAlternateFileName;
						L26:
						_t272 = _t283;
						_v32 = _t272;
						__eflags = _v40 - _t272;
						asm("sbb ecx, ecx");
						_t236 =  !_t234 & _v40 - _t272 + 0x00000003 >> 0x00000002;
						__eflags = _t236;
						_v28 = _t236;
						if(_t236 != 0) {
							_t299 = _t236;
							do {
								E00F479D0( *_t283);
								_t222 = _t222 + 1;
								_t283 = _t283 + 4;
								__eflags = _t222 - _t299;
							} while (_t222 != _t299);
							_t283 = _v608.cAlternateFileName;
							_t297 = _v12;
						}
						E00F479D0(_t283);
						goto L31;
					}
				} else {
					_t219 = E00F47035(_t317);
					_t297 = 0x16;
					 *_t219 = _t297;
					E00F45BD3();
					L31:
					return _t297;
				}
				L81:
			}

0x00f47bc5
0x00f47bc8
0x00f47bcb
0x00f47bcc
0x00f47bce
0x00f47be4
0x00f47be8
0x00f47beb
0x00f47bed
0x00f47bef
0x00f47bf1
0x00f47bf3
0x00f47bf6
0x00f47bf9
0x00f47bfc
0x00f47bfe
0x00f47c61
0x00f47c63
0x00f47c66
0x00f47c68
0x00f47c6c
0x00f47c75
0x00f47c76
0x00f47c79
0x00f47c7b
0x00f47c7e
0x00f47c82
0x00f47c82
0x00f47c84
0x00f47c86
0x00f47c88
0x00f47c8a
0x00f47c8a
0x00f47c8c
0x00f47c8f
0x00f47c92
0x00f47c92
0x00f47c94
0x00f47c95
0x00f47c95
0x00f47ca0
0x00f47ca2
0x00f47ca5
0x00f47ca6
0x00f47ca9
0x00f47ca9
0x00f47cad
0x00f47cb0
0x00f47cb3
0x00f47cb3
0x00f47cb3
0x00f47cc0
0x00f47cc2
0x00f47cc5
0x00f47cc7
0x00f47cdf
0x00f47ce2
0x00f47ce5
0x00f47ce7
0x00f47cea
0x00f47cec
0x00f47cef
0x00f47cf2
0x00f47d4f
0x00f47d52
0x00f47d55
0x00f47d57
0x00000000
0x00f47cf4
0x00f47cf6
0x00f47cf6
0x00f47cf8
0x00f47cfb
0x00f47cfb
0x00f47cfd
0x00f47cff
0x00f47d05
0x00f47d08
0x00f47d08
0x00f47d0a
0x00f47d0b
0x00f47d0b
0x00f47d12
0x00f47d15
0x00f47d19
0x00f47d26
0x00f47d2b
0x00f47d2e
0x00f47d30
0x00f47da4
0x00f47da5
0x00f47da6
0x00f47da7
0x00f47da8
0x00f47da9
0x00f47dae
0x00f47db2
0x00f47db4
0x00f47db5
0x00f47db8
0x00f47db8
0x00f47dbb
0x00f47dbb
0x00f47dbd
0x00f47dbe
0x00f47dbe
0x00f47dc2
0x00f47dc3
0x00f47dca
0x00f47dcd
0x00f47dd0
0x00f47dd2
0x00f47dda
0x00f47ddb
0x00f47ddc
0x00f47ddf
0x00f47de9
0x00f47ded
0x00f47def
0x00f47e03
0x00f47e03
0x00f47e06
0x00f47e10
0x00f47e15
0x00f47e18
0x00f47e1a
0x00000000
0x00f47e1c
0x00f47e1c
0x00f47e21
0x00f47e28
0x00f47e2b
0x00f47e2d
0x00f47e3e
0x00f47e40
0x00f47e42
0x00f47e42
0x00f47e42
0x00f47e2f
0x00f47e30
0x00f47e35
0x00f47e38
0x00f47e47
0x00f47e4d
0x00000000
0x00f47e50
0x00f47df1
0x00f47df1
0x00f47df7
0x00f47dfc
0x00f47dff
0x00f47e01
0x00f47e53
0x00f47e55
0x00f47e56
0x00f47e57
0x00f47e58
0x00f47e59
0x00f47e5a
0x00f47e5f
0x00f47e62
0x00f47e63
0x00f47e65
0x00f47e6b
0x00f47e72
0x00f47e75
0x00f47e78
0x00f47e7b
0x00f47e7c
0x00f47e7d
0x00f47e80
0x00f47e86
0x00f47e88
0x00f47e8a
0x00f47e8a
0x00f47e8c
0x00f47e8e
0x00000000
0x00000000
0x00f47e90
0x00f47e92
0x00f47e94
0x00f47e96
0x00f47ea1
0x00f47ea3
0x00f47ea5
0x00000000
0x00000000
0x00f47ea5
0x00f47e96
0x00000000
0x00f47e92
0x00f47ea7
0x00f47ea7
0x00f47ead
0x00f47eaf
0x00f47eb5
0x00f47eb7
0x00f47ed9
0x00f47ed9
0x00f47edb
0x00f47edd
0x00f47ee9
0x00f47ee9
0x00f47edf
0x00f47edf
0x00f47ee1
0x00000000
0x00f47ee3
0x00f47ee3
0x00f47ee5
0x00f47ee7
0x00000000
0x00000000
0x00f47ee7
0x00f47ee1
0x00f47ef1
0x00f47ef9
0x00f47eff
0x00f47f00
0x00f47f02
0x00f47f0a
0x00f47f10
0x00f47f16
0x00f47f1c
0x00f47f30
0x00f47f35
0x00f47f40
0x00f47f50
0x00f47f56
0x00f47f58
0x00f47f5b
0x00f47f7e
0x00f47f7e
0x00f47f83
0x00f47f89
0x00f47f89
0x00f47f8f
0x00f47f95
0x00f47f9b
0x00f47fa1
0x00f47fa7
0x00f47fc8
0x00f47fcd
0x00f47fd2
0x00f47fd6
0x00f47fdc
0x00f47fdf
0x00f47ff2
0x00f47ff2
0x00f47ff8
0x00f47ffe
0x00f47fff
0x00f48000
0x00f48005
0x00f48008
0x00f4800e
0x00f48010
0x00f4806e
0x00f48074
0x00f4807c
0x00f48081
0x00f48087
0x00f48088
0x00000000
0x00000000
0x00000000
0x00f47fe1
0x00f47fe1
0x00f47fe4
0x00f47fe6
0x00000000
0x00f47fe8
0x00f47fe8
0x00f47feb
0x00000000
0x00f47fed
0x00f47fed
0x00f47ff0
0x00000000
0x00000000
0x00000000
0x00000000
0x00f47ff0
0x00f47feb
0x00f47fe6
0x00f4808a
0x00f4808b
0x00000000
0x00f48012
0x00f48012
0x00f48018
0x00f48020
0x00f48025
0x00f48034
0x00f48034
0x00f4803c
0x00f48042
0x00f48048
0x00f4804f
0x00f48052
0x00f48054
0x00f48064
0x00f48069
0x00000000
0x00f47f5d
0x00f47f5d
0x00f47f63
0x00f47f64
0x00f47f65
0x00f47f66
0x00f47f6e
0x00f47f6e
0x00f48091
0x00f48091
0x00f48098
0x00f48099
0x00f480a1
0x00f480a6
0x00f480a7
0x00f47eb9
0x00f47eb9
0x00f47ebc
0x00f47ebe
0x00f47ed3
0x00000000
0x00f47ec0
0x00f47ec0
0x00f47ec3
0x00f47ec4
0x00f47ec5
0x00f47ec6
0x00f47ecb
0x00f47ebe
0x00f480ac
0x00f480ad
0x00f480af
0x00f480b6
0x00000000
0x00000000
0x00000000
0x00f47e01
0x00f47dd4
0x00f47dd6
0x00f47dd7
0x00f47dd9
0x00f47dd9
0x00000000
0x00000000
0x00000000
0x00000000
0x00f47d32
0x00f47d32
0x00f47d38
0x00f47d3b
0x00f47d3e
0x00f47d41
0x00f47d44
0x00f47d47
0x00f47d4a
0x00f47d4a
0x00000000
0x00f47cfb
0x00f47cc9
0x00f47cc9
0x00f47ccc
0x00f47d59
0x00f47d5a
0x00f47d5f
0x00000000
0x00f47d5f
0x00f47c00
0x00f47c00
0x00f47c03
0x00f47c0b
0x00f47c0e
0x00f47c15
0x00f47c17
0x00f47c19
0x00f47c34
0x00f47c35
0x00f47c36
0x00f47c37
0x00f47c3c
0x00f47c3f
0x00f47c42
0x00f47c1b
0x00f47c1b
0x00f47c1e
0x00f47c1f
0x00f47c20
0x00f47c21
0x00f47c22
0x00f47c27
0x00f47c29
0x00f47c2c
0x00f47c2c
0x00f47c44
0x00f47c46
0x00000000
0x00000000
0x00f47c4f
0x00f47c52
0x00f47c55
0x00f47c57
0x00f47c59
0x00000000
0x00f47c5b
0x00f47c5b
0x00f47c5e
0x00000000
0x00f47c5e
0x00000000
0x00f47c59
0x00f47cd4
0x00f47d60
0x00f47d63
0x00f47d67
0x00f47d70
0x00f47d73
0x00f47d77
0x00f47d77
0x00f47d79
0x00f47d7c
0x00f47d7e
0x00f47d80
0x00f47d82
0x00f47d87
0x00f47d88
0x00f47d8c
0x00f47d8c
0x00f47d90
0x00f47d93
0x00f47d93
0x00f47d97
0x00000000
0x00f47d9e
0x00f47bd0
0x00f47bd0
0x00f47bd7
0x00f47bd8
0x00f47bda
0x00f47d9f
0x00f47da3
0x00f47da3
0x00000000

APIs

_free.LIBCMT ref: 00F47D5A

Strings

*?, xrefs: 00F47C03

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 8e6dde6846f08074af74a5003a0db7bd5cda2ca9cfa2a059068b8bbb279e2c73
Instruction ID: c2a0b6423e05f705cfba4a477bf5509ca7adfe5bbb66774e69362abfae6085d6
Opcode Fuzzy Hash: 8e6dde6846f08074af74a5003a0db7bd5cda2ca9cfa2a059068b8bbb279e2c73
Instruction Fuzzy Hash: 06614DB5D042199FCB14DFA8C8815EEFBF5EF48320B24816AEC05E7300D735AE419B90

Uniqueness

Uniqueness Score: -1.00%

Function 00F440B4 Relevance: 6.2, APIs: 4, Instructions: 168
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 64%

			E00F440B4(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t52;
				signed int _t53;
				intOrPtr _t54;
				signed int _t58;
				signed int _t61;
				intOrPtr _t71;
				signed int _t75;
				signed int _t79;
				signed int _t81;
				signed int _t84;
				signed int _t85;
				signed int _t97;
				signed int* _t98;
				signed char* _t101;
				signed int _t107;
				void* _t111;

				_push(0x10);
				_push(0xf5b090);
				E00F433C0(__ebx, __edi, __esi);
				_t75 = 0;
				_t52 =  *(_t111 + 0x10);
				_t81 = _t52[1];
				if(_t81 == 0 ||  *((intOrPtr*)(_t81 + 8)) == 0) {
					L30:
					_t53 = 0;
					__eflags = 0;
					goto L31;
				} else {
					_t97 = _t52[2];
					if(_t97 != 0 ||  *_t52 < 0) {
						_t84 =  *_t52;
						_t107 =  *(_t111 + 0xc);
						if(_t84 >= 0) {
							_t107 = _t107 + 0xc + _t97;
						}
						 *(_t111 - 4) = _t75;
						_t101 =  *(_t111 + 0x14);
						if(_t84 >= 0 || ( *_t101 & 0x00000010) == 0) {
							L10:
							_t54 =  *((intOrPtr*)(_t111 + 8));
							__eflags = _t84 & 0x00000008;
							if((_t84 & 0x00000008) == 0) {
								__eflags =  *_t101 & 0x00000001;
								if(( *_t101 & 0x00000001) == 0) {
									_t84 =  *(_t54 + 0x18);
									__eflags = _t101[0x18] - _t75;
									if(_t101[0x18] != _t75) {
										__eflags = _t84;
										if(_t84 == 0) {
											goto L32;
										} else {
											__eflags = _t107;
											if(_t107 == 0) {
												goto L32;
											} else {
												__eflags =  *_t101 & 0x00000004;
												_t79 = 0;
												_t75 = (_t79 & 0xffffff00 | ( *_t101 & 0x00000004) != 0x00000000) + 1;
												__eflags = _t75;
												 *(_t111 - 0x20) = _t75;
												goto L29;
											}
										}
									} else {
										__eflags = _t84;
										if(_t84 == 0) {
											goto L32;
										} else {
											__eflags = _t107;
											if(_t107 == 0) {
												goto L32;
											} else {
												E00F452B0(_t107, E00F43B46(_t84,  &(_t101[8])), _t101[0x14]);
												goto L29;
											}
										}
									}
								} else {
									__eflags =  *(_t54 + 0x18);
									if( *(_t54 + 0x18) == 0) {
										goto L32;
									} else {
										__eflags = _t107;
										if(_t107 == 0) {
											goto L32;
										} else {
											E00F452B0(_t107,  *(_t54 + 0x18), _t101[0x14]);
											__eflags = _t101[0x14] - 4;
											if(_t101[0x14] == 4) {
												__eflags =  *_t107;
												if( *_t107 != 0) {
													_push( &(_t101[8]));
													_push( *_t107);
													goto L21;
												}
											}
											goto L29;
										}
									}
								}
							} else {
								_t84 =  *(_t54 + 0x18);
								goto L12;
							}
						} else {
							_t71 =  *0xf5ccc0; // 0x0
							 *((intOrPtr*)(_t111 - 0x1c)) = _t71;
							if(_t71 == 0) {
								goto L10;
							} else {
								 *0xf4f140();
								_t84 =  *((intOrPtr*)(_t111 - 0x1c))();
								L12:
								if(_t84 == 0 || _t107 == 0) {
									L32:
									E00F46E22(_t75, _t84, _t97, _t101, _t107);
									asm("int3");
									_push(8);
									_push(0xf5b0b0);
									E00F433C0(_t75, _t101, _t107);
									_t98 =  *(_t111 + 0x10);
									_t85 =  *(_t111 + 0xc);
									__eflags =  *_t98;
									if(__eflags >= 0) {
										_t103 = _t85 + 0xc + _t98[2];
										__eflags = _t85 + 0xc + _t98[2];
									} else {
										_t103 = _t85;
									}
									 *(_t111 - 4) =  *(_t111 - 4) & 0x00000000;
									_t108 =  *(_t111 + 0x14);
									_push( *(_t111 + 0x14));
									_push(_t98);
									_push(_t85);
									_t77 =  *((intOrPtr*)(_t111 + 8));
									_push( *((intOrPtr*)(_t111 + 8)));
									_t58 = E00F440B4(_t77, _t103, _t108, __eflags) - 1;
									__eflags = _t58;
									if(_t58 == 0) {
										_t61 = E00F44DB4(_t103, _t108[0x18], E00F43B46( *((intOrPtr*)(_t77 + 0x18)),  &(_t108[8])));
									} else {
										_t61 = _t58 - 1;
										__eflags = _t61;
										if(_t61 == 0) {
											_t61 = E00F44DC4(_t103, _t108[0x18], E00F43B46( *((intOrPtr*)(_t77 + 0x18)),  &(_t108[8])), 1);
										}
									}
									 *(_t111 - 4) = 0xfffffffe;
									 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0x10));
									return _t61;
								} else {
									 *_t107 = _t84;
									_push( &(_t101[8]));
									_push(_t84);
									L21:
									 *_t107 = E00F43B46();
									L29:
									 *(_t111 - 4) = 0xfffffffe;
									_t53 = _t75;
									L31:
									 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0x10));
									return _t53;
								}
							}
						}
					} else {
						goto L30;
					}
				}
			}

0x00f440b4
0x00f440b6
0x00f440bb
0x00f440c0
0x00f440c2
0x00f440c5
0x00f440ca
0x00f441da
0x00f441da
0x00f441da
0x00000000
0x00f440d9
0x00f440d9
0x00f440de
0x00f440e8
0x00f440ea
0x00f440ef
0x00f440f4
0x00f440f4
0x00f440f6
0x00f440f9
0x00f440fe
0x00f44120
0x00f44120
0x00f44123
0x00f44126
0x00f44144
0x00f44147
0x00f44186
0x00f44189
0x00f4418c
0x00f441b1
0x00f441b3
0x00000000
0x00f441b5
0x00f441b5
0x00f441b7
0x00000000
0x00f441b9
0x00f441b9
0x00f441be
0x00f441c2
0x00f441c2
0x00f441c3
0x00000000
0x00f441c3
0x00f441b7
0x00f4418e
0x00f4418e
0x00f44190
0x00000000
0x00f44192
0x00f44192
0x00f44194
0x00000000
0x00f44196
0x00f441a7
0x00000000
0x00f441ac
0x00f44194
0x00f44190
0x00f44149
0x00f44149
0x00f4414d
0x00000000
0x00f44153
0x00f44153
0x00f44155
0x00000000
0x00f4415b
0x00f44162
0x00f4416a
0x00f4416e
0x00f44170
0x00f44173
0x00f44178
0x00f44179
0x00000000
0x00f44179
0x00f44173
0x00000000
0x00f4416e
0x00f44155
0x00f4414d
0x00f44128
0x00f44128
0x00000000
0x00f44128
0x00f44105
0x00f44105
0x00f4410a
0x00f4410f
0x00000000
0x00f44111
0x00f44113
0x00f4411c
0x00f4412b
0x00f4412d
0x00f441ec
0x00f441ec
0x00f441f1
0x00f441f2
0x00f441f4
0x00f441f9
0x00f441fe
0x00f44201
0x00f44204
0x00f44207
0x00f44210
0x00f44210
0x00f44209
0x00f44209
0x00f44209
0x00f44213
0x00f44217
0x00f4421a
0x00f4421b
0x00f4421c
0x00f4421d
0x00f44220
0x00f44229
0x00f44229
0x00f4422c
0x00f44262
0x00f4422e
0x00f4422e
0x00f4422e
0x00f44231
0x00f44248
0x00f44248
0x00f44231
0x00f44267
0x00f44271
0x00f4427d
0x00f4413b
0x00f4413b
0x00f44140
0x00f44141
0x00f4417b
0x00f44182
0x00f441c6
0x00f441c6
0x00f441cd
0x00f441dc
0x00f441df
0x00f441eb
0x00f441eb
0x00f4412d
0x00f4410f
0x00000000
0x00000000
0x00000000
0x00f440de

APIs

___AdjustPointer.LIBCMT ref: 00F4417B
___AdjustPointer.LIBCMT ref: 00F4419E
___AdjustPointer.LIBCMT ref: 00F4423A

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 3bc56b2f551a858f154d670b11e4a163694f0a3bae86188ed24ce679f6f5ca84
Instruction ID: 7f172acee01b7d7034686b2e9822628a25121d5e5ffc9180ae53d37e87f37e1f
Opcode Fuzzy Hash: 3bc56b2f551a858f154d670b11e4a163694f0a3bae86188ed24ce679f6f5ca84
Instruction Fuzzy Hash: 5251B376A002069FDB2ACF50DC41B6A7FA4FFA0711F244529ED0167291E735F990EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F47AD4 Relevance: 6.1, APIs: 4, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F47AD4(intOrPtr* _a4, intOrPtr _a8, intOrPtr _a16) {
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t19;
				intOrPtr _t29;
				char _t31;
				intOrPtr _t38;
				intOrPtr* _t40;
				intOrPtr _t41;

				_t40 = _a4;
				if(_t40 != 0) {
					_t31 = 0;
					__eflags =  *_t40;
					if( *_t40 != 0) {
						_t16 = E00F48CCA(_a16, 0, _t40, 0xffffffff, 0, 0, 0, 0);
						__eflags = _t16;
						if(__eflags != 0) {
							_t38 = _a8;
							__eflags = _t16 -  *((intOrPtr*)(_t38 + 0xc));
							if(__eflags <= 0) {
								L11:
								_t17 = E00F48CCA(_a16, _t31, _t40, 0xffffffff,  *((intOrPtr*)(_t38 + 8)),  *((intOrPtr*)(_t38 + 0xc)), _t31, _t31);
								__eflags = _t17;
								if(__eflags != 0) {
									 *((intOrPtr*)(_t38 + 0x10)) = _t17 - 1;
									_t19 = 0;
									__eflags = 0;
								} else {
									E00F46FFF(GetLastError());
									_t19 =  *((intOrPtr*)(E00F47035(__eflags)));
								}
								L14:
								return _t19;
							}
							_t19 = E00F48110(_t38, __eflags, _t16);
							__eflags = _t19;
							if(_t19 != 0) {
								goto L14;
							}
							goto L11;
						}
						E00F46FFF(GetLastError());
						return  *((intOrPtr*)(E00F47035(__eflags)));
					}
					_t41 = _a8;
					__eflags =  *((intOrPtr*)(_t41 + 0xc));
					if(__eflags != 0) {
						L6:
						 *((char*)( *((intOrPtr*)(_t41 + 8)))) = _t31;
						L2:
						 *((intOrPtr*)(_t41 + 0x10)) = _t31;
						return 0;
					}
					_t29 = E00F48110(_t41, __eflags, 1);
					__eflags = _t29;
					if(_t29 != 0) {
						return _t29;
					}
					goto L6;
				}
				_t41 = _a8;
				E00F480F6(_t41);
				_t31 = 0;
				 *((intOrPtr*)(_t41 + 8)) = 0;
				 *((intOrPtr*)(_t41 + 0xc)) = 0;
				goto L2;
			}

0x00f47adb
0x00f47ae0
0x00f47afe
0x00f47b00
0x00f47b03
0x00f47b30
0x00f47b38
0x00f47b3a
0x00f47b53
0x00f47b56
0x00f47b59
0x00f47b67
0x00f47b76
0x00f47b7e
0x00f47b80
0x00f47b99
0x00f47b9c
0x00f47b9c
0x00f47b82
0x00f47b89
0x00f47b94
0x00f47b94
0x00f47b9e
0x00000000
0x00f47b9e
0x00f47b5e
0x00f47b63
0x00f47b65
0x00000000
0x00000000
0x00000000
0x00f47b65
0x00f47b43
0x00000000
0x00f47b4e
0x00f47b05
0x00f47b08
0x00f47b0b
0x00f47b1e
0x00f47b21
0x00f47af4
0x00f47af4
0x00000000
0x00f47af7
0x00f47b11
0x00f47b16
0x00f47b18
0x00f47ba2
0x00f47ba2
0x00000000
0x00f47b18
0x00f47ae2
0x00f47ae7
0x00f47aec
0x00f47aee
0x00f47af1
0x00000000

APIs

Part of subcall function 00F480F6: _free.LIBCMT ref: 00F48104

Part of subcall function 00F48CCA: WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,00000000,00F4BF11,0000FDE9,00000000,?,?,?,00F4BC8A,0000FDE9,00000000,?), ref: 00F48D76

GetLastError.KERNEL32 ref: 00F47B3C
__dosmaperr.LIBCMT ref: 00F47B43
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 00F47B82
__dosmaperr.LIBCMT ref: 00F47B89

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: d3bd35fdf23f6bb6487444653d4fbab6fd2bb20066f387a83bede5982776f46a
Instruction ID: efa5e3d47fa71d61655c8922c5efdbae0f314f4b0765aa5f6b0115e2d24adeea
Opcode Fuzzy Hash: d3bd35fdf23f6bb6487444653d4fbab6fd2bb20066f387a83bede5982776f46a
Instruction Fuzzy Hash: 5321C4B1A08309AF9B20BF799C8192B7FADEF843B47104525FD2993250EB35DC01A7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00F475D9 Relevance: 6.1, APIs: 4, Instructions: 72
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 72%

			E00F475D9(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t2;
				long _t3;
				intOrPtr _t5;
				long _t6;
				intOrPtr _t9;
				long _t10;
				signed int _t39;
				signed int _t40;
				void* _t43;
				void* _t49;
				signed int _t51;
				signed int _t53;
				signed int _t54;
				long _t56;
				long _t60;
				long _t61;
				void* _t65;

				_t49 = __edx;
				_t43 = __ecx;
				_t60 = GetLastError();
				_t2 =  *0xf5c058; // 0x6
				_t67 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L6:
					_t3 = E00F49D00(__eflags, _t2, 0xffffffff);
					__eflags = _t3;
					if(_t3 == 0) {
						goto L3;
					} else {
						_t51 = E00F47973(1, 0x364);
						_pop(_t43);
						__eflags = _t51;
						if(__eflags != 0) {
							__eflags = E00F49D00(__eflags,  *0xf5c058, _t51);
							if(__eflags != 0) {
								E00F47407(_t51, 0xf5cec4);
								E00F479D0(0);
								_t65 = _t65 + 0xc;
								goto L13;
							} else {
								_t39 = 0;
								E00F49D00(__eflags,  *0xf5c058, 0);
								_push(_t51);
								goto L9;
							}
						} else {
							_t39 = 0;
							__eflags = 0;
							E00F49D00(0,  *0xf5c058, 0);
							_push(0);
							L9:
							E00F479D0();
							_pop(_t43);
							goto L4;
						}
					}
				} else {
					_t51 = E00F49CC1(_t67, _t2);
					if(_t51 == 0) {
						_t2 =  *0xf5c058; // 0x6
						goto L6;
					} else {
						if(_t51 != 0xffffffff) {
							L13:
							_t39 = _t51;
						} else {
							L3:
							_t39 = 0;
							L4:
							_t51 = _t39;
						}
					}
				}
				SetLastError(_t60);
				asm("sbb edi, edi");
				_t53 =  ~_t51 & _t39;
				if(_t53 == 0) {
					E00F46E22(_t39, _t43, _t49, _t53, _t60);
					asm("int3");
					_t5 =  *0xf5c058; // 0x6
					_push(_t60);
					__eflags = _t5 - 0xffffffff;
					if(__eflags == 0) {
						L22:
						_t6 = E00F49D00(__eflags, _t5, 0xffffffff);
						__eflags = _t6;
						if(_t6 == 0) {
							goto L31;
						} else {
							_t60 = E00F47973(1, 0x364);
							_pop(_t43);
							__eflags = _t60;
							if(__eflags != 0) {
								__eflags = E00F49D00(__eflags,  *0xf5c058, _t60);
								if(__eflags != 0) {
									E00F47407(_t60, 0xf5cec4);
									E00F479D0(0);
									_t65 = _t65 + 0xc;
									goto L29;
								} else {
									E00F49D00(__eflags,  *0xf5c058, _t21);
									_push(_t60);
									goto L25;
								}
							} else {
								E00F49D00(__eflags,  *0xf5c058, _t20);
								_push(_t60);
								L25:
								E00F479D0();
								_pop(_t43);
								goto L31;
							}
						}
					} else {
						_t60 = E00F49CC1(__eflags, _t5);
						__eflags = _t60;
						if(__eflags == 0) {
							_t5 =  *0xf5c058; // 0x6
							goto L22;
						} else {
							__eflags = _t60 - 0xffffffff;
							if(_t60 == 0xffffffff) {
								L31:
								E00F46E22(_t39, _t43, _t49, _t53, _t60);
								asm("int3");
								_push(_t39);
								_push(_t60);
								_push(_t53);
								_t61 = GetLastError();
								_t9 =  *0xf5c058; // 0x6
								__eflags = _t9 - 0xffffffff;
								if(__eflags == 0) {
									L38:
									_t10 = E00F49D00(__eflags, _t9, 0xffffffff);
									__eflags = _t10;
									if(_t10 == 0) {
										goto L35;
									} else {
										_t54 = E00F47973(1, 0x364);
										__eflags = _t54;
										if(__eflags != 0) {
											__eflags = E00F49D00(__eflags,  *0xf5c058, _t54);
											if(__eflags != 0) {
												E00F47407(_t54, 0xf5cec4);
												E00F479D0(0);
												goto L45;
											} else {
												_t40 = 0;
												E00F49D00(__eflags,  *0xf5c058, 0);
												_push(_t54);
												goto L41;
											}
										} else {
											_t40 = 0;
											__eflags = 0;
											E00F49D00(0,  *0xf5c058, 0);
											_push(0);
											L41:
											E00F479D0();
											goto L36;
										}
									}
								} else {
									_t54 = E00F49CC1(__eflags, _t9);
									__eflags = _t54;
									if(__eflags == 0) {
										_t9 =  *0xf5c058; // 0x6
										goto L38;
									} else {
										__eflags = _t54 - 0xffffffff;
										if(_t54 != 0xffffffff) {
											L45:
											_t40 = _t54;
										} else {
											L35:
											_t40 = 0;
											__eflags = 0;
											L36:
											_t54 = _t40;
										}
									}
								}
								SetLastError(_t61);
								asm("sbb edi, edi");
								_t56 =  ~_t54 & _t40;
								__eflags = _t56;
								return _t56;
							} else {
								L29:
								__eflags = _t60;
								if(_t60 == 0) {
									goto L31;
								} else {
									return _t60;
								}
							}
						}
					}
				} else {
					return _t53;
				}
			}

0x00f475d9
0x00f475d9
0x00f475e4
0x00f475e6
0x00f475eb
0x00f475ee
0x00f4760c
0x00f4760f
0x00f47614
0x00f47616
0x00000000
0x00f47618
0x00f47624
0x00f47627
0x00f47628
0x00f4762a
0x00f4764f
0x00f47651
0x00f4766a
0x00f47671
0x00f47676
0x00000000
0x00f47653
0x00f47653
0x00f4765c
0x00f47661
0x00000000
0x00f47661
0x00f4762c
0x00f4762c
0x00f4762c
0x00f47635
0x00f4763a
0x00f4763b
0x00f4763b
0x00f47640
0x00000000
0x00f47640
0x00f4762a
0x00f475f0
0x00f475f6
0x00f475fa
0x00f47607
0x00000000
0x00f475fc
0x00f475ff
0x00f47679
0x00f47679
0x00f47601
0x00f47601
0x00f47601
0x00f47603
0x00f47603
0x00f47603
0x00f475ff
0x00f475fa
0x00f4767c
0x00f47684
0x00f47686
0x00f47688
0x00f47690
0x00f47695
0x00f47696
0x00f4769b
0x00f4769c
0x00f4769f
0x00f476b9
0x00f476bc
0x00f476c1
0x00f476c3
0x00000000
0x00f476c5
0x00f476d1
0x00f476d4
0x00f476d5
0x00f476d7
0x00f476fa
0x00f476fc
0x00f47713
0x00f4771a
0x00f4771f
0x00000000
0x00f476fe
0x00f47705
0x00f4770a
0x00000000
0x00f4770a
0x00f476d9
0x00f476e0
0x00f476e5
0x00f476e6
0x00f476e6
0x00f476eb
0x00000000
0x00f476eb
0x00f476d7
0x00f476a1
0x00f476a7
0x00f476a9
0x00f476ab
0x00f476b4
0x00000000
0x00f476ad
0x00f476ad
0x00f476b0
0x00f4772a
0x00f4772a
0x00f4772f
0x00f47732
0x00f47733
0x00f47734
0x00f4773b
0x00f4773d
0x00f47742
0x00f47745
0x00f47763
0x00f47766
0x00f4776b
0x00f4776d
0x00000000
0x00f4776f
0x00f4777b
0x00f4777f
0x00f47781
0x00f477a6
0x00f477a8
0x00f477c1
0x00f477c8
0x00000000
0x00f477aa
0x00f477aa
0x00f477b3
0x00f477b8
0x00000000
0x00f477b8
0x00f47783
0x00f47783
0x00f47783
0x00f4778c
0x00f47791
0x00f47792
0x00f47792
0x00000000
0x00f47797
0x00f47781
0x00f47747
0x00f4774d
0x00f4774f
0x00f47751
0x00f4775e
0x00000000
0x00f47753
0x00f47753
0x00f47756
0x00f477d0
0x00f477d0
0x00f47758
0x00f47758
0x00f47758
0x00f47758
0x00f4775a
0x00f4775a
0x00f4775a
0x00f47756
0x00f47751
0x00f477d3
0x00f477db
0x00f477dd
0x00f477dd
0x00f477e4
0x00f476b2
0x00f47722
0x00f47722
0x00f47724
0x00000000
0x00f47726
0x00f47729
0x00f47729
0x00f47724
0x00f476b0
0x00f476ab
0x00f4768a
0x00f4768f
0x00f4768f

APIs

GetLastError.KERNEL32(?,00000000,?,00F458B0,00000000,?,00F42029,?,00F45916,?,?,?,?,00F45A0F,00F42029,00000000), ref: 00F475DE
_free.LIBCMT ref: 00F4763B
_free.LIBCMT ref: 00F47671
SetLastError.KERNEL32(00000000,00000006,000000FF,?,00F45916,?,?,?,?,00F45A0F,00F42029,00000000,?,00F42029,00000000), ref: 00F4767C

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: a18e88a2858849d9e830d487e5994f0adf999d01dc6267c1b8f2c8f5bcc94988
Instruction ID: 956421aebe283d07506c2f7a54d1636d4d321319d6c3a7f875fe8a59a5bbcda8
Opcode Fuzzy Hash: a18e88a2858849d9e830d487e5994f0adf999d01dc6267c1b8f2c8f5bcc94988
Instruction Fuzzy Hash: 1611C632A0CB457FD611767DAC81E2B3F5B8BC13B9B260624FE19C21E2DB658C05B1A4

Uniqueness

Uniqueness Score: -1.00%

Function 00F47730 Relevance: 6.1, APIs: 4, Instructions: 69
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E00F47730(void* __ecx) {
				intOrPtr _t2;
				signed int _t3;
				signed int _t13;
				signed int _t18;
				long _t21;

				_t21 = GetLastError();
				_t2 =  *0xf5c058; // 0x6
				_t24 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L6:
					_t3 = E00F49D00(__eflags, _t2, 0xffffffff);
					__eflags = _t3;
					if(_t3 == 0) {
						goto L3;
					} else {
						_t18 = E00F47973(1, 0x364);
						__eflags = _t18;
						if(__eflags != 0) {
							__eflags = E00F49D00(__eflags,  *0xf5c058, _t18);
							if(__eflags != 0) {
								E00F47407(_t18, 0xf5cec4);
								E00F479D0(0);
								goto L13;
							} else {
								_t13 = 0;
								E00F49D00(__eflags,  *0xf5c058, 0);
								_push(_t18);
								goto L9;
							}
						} else {
							_t13 = 0;
							__eflags = 0;
							E00F49D00(0,  *0xf5c058, 0);
							_push(0);
							L9:
							E00F479D0();
							goto L4;
						}
					}
				} else {
					_t18 = E00F49CC1(_t24, _t2);
					if(_t18 == 0) {
						_t2 =  *0xf5c058; // 0x6
						goto L6;
					} else {
						if(_t18 != 0xffffffff) {
							L13:
							_t13 = _t18;
						} else {
							L3:
							_t13 = 0;
							L4:
							_t18 = _t13;
						}
					}
				}
				SetLastError(_t21);
				asm("sbb edi, edi");
				return  ~_t18 & _t13;
			}

0x00f4773b
0x00f4773d
0x00f47742
0x00f47745
0x00f47763
0x00f47766
0x00f4776b
0x00f4776d
0x00000000
0x00f4776f
0x00f4777b
0x00f4777f
0x00f47781
0x00f477a6
0x00f477a8
0x00f477c1
0x00f477c8
0x00000000
0x00f477aa
0x00f477aa
0x00f477b3
0x00f477b8
0x00000000
0x00f477b8
0x00f47783
0x00f47783
0x00f47783
0x00f4778c
0x00f47791
0x00f47792
0x00f47792
0x00000000
0x00f47797
0x00f47781
0x00f47747
0x00f4774d
0x00f47751
0x00f4775e
0x00000000
0x00f47753
0x00f47756
0x00f477d0
0x00f477d0
0x00f47758
0x00f47758
0x00f47758
0x00f4775a
0x00f4775a
0x00f4775a
0x00f47756
0x00f47751
0x00f477d3
0x00f477db
0x00f477e4

APIs

GetLastError.KERNEL32(?,?,?,00F4703A,00F47968,?,?,00F439C2,?,?,?,?,?,00F41023,?,?), ref: 00F47735
_free.LIBCMT ref: 00F47792
_free.LIBCMT ref: 00F477C8
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,00F439C2,?,?,?,?,?,00F41023,?,?), ref: 00F477D3

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 16a7339aea55972fbc5213ed2fbe902860db0743430f83ef22cc2a544a69b798
Instruction ID: e79d99070266f07a34462e105ee23e5c0611c868e1b1b6c5535d37706758c2e8
Opcode Fuzzy Hash: 16a7339aea55972fbc5213ed2fbe902860db0743430f83ef22cc2a544a69b798
Instruction Fuzzy Hash: 6A11C232A0C3047FE6113778AC85E2B3E599BC137AB600224FF19C21E1DB658C09F2A0

Uniqueness

Uniqueness Score: -1.00%

Function 00F4CA16 Relevance: 6.0, APIs: 4, Instructions: 29
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00F4CA16(void* _a4, long _a8, DWORD* _a12) {
				void* _t13;

				_t13 = WriteConsoleW( *0xf5c860, _a4, _a8, _a12, 0);
				if(_t13 == 0 && GetLastError() == 6) {
					E00F4C9FF();
					E00F4C9C1();
					_t13 = WriteConsoleW( *0xf5c860, _a4, _a8, _a12, _t13);
				}
				return _t13;
			}

0x00f4ca33
0x00f4ca37
0x00f4ca44
0x00f4ca49
0x00f4ca64
0x00f4ca64
0x00f4ca6a

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,00F4C470,?,00000001,?,?,?,00F4B960,?,?,?), ref: 00F4CA2D
GetLastError.KERNEL32(?,00F4C470,?,00000001,?,?,?,00F4B960,?,?,?,?,?,?,00F4BEAC,00000000), ref: 00F4CA39

Part of subcall function 00F4C9FF: CloseHandle.KERNEL32(FFFFFFFE,00F4CA49,?,00F4C470,?,00000001,?,?,?,00F4B960,?,?,?,?,?), ref: 00F4CA0F

___initconout.LIBCMT ref: 00F4CA49

Part of subcall function 00F4C9C1: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00F4C9F0,00F4C45D,?,?,00F4B960,?,?,?,?), ref: 00F4C9D4

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,00F4C470,?,00000001,?,?,?,00F4B960,?,?,?,?), ref: 00F4CA5E

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 58acd7ff4a6b862f47a27d531cc396aec9b6d35ca86fbc110f3c114c81f9dcb5
Instruction ID: acc90508a3a6d8b170ca33c34798aaf236869d4b1999e4de5abe855409f42ddd
Opcode Fuzzy Hash: 58acd7ff4a6b862f47a27d531cc396aec9b6d35ca86fbc110f3c114c81f9dcb5
Instruction Fuzzy Hash: 93F01C3A90121CBBCF622F95EC0498A3FA6EB59BB2B054020FF5995131C6368960FBD4

Uniqueness

Uniqueness Score: -1.00%

Function 00F46CC7 Relevance: 6.0, APIs: 4, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F46CC7() {

				E00F479D0( *0xf5d354);
				 *0xf5d354 = 0;
				E00F479D0( *0xf5d358);
				 *0xf5d358 = 0;
				E00F479D0( *0xf5d038);
				 *0xf5d038 = 0;
				E00F479D0( *0xf5d03c);
				 *0xf5d03c = 0;
				return 1;
			}

0x00f46cd0
0x00f46cdd
0x00f46ce3
0x00f46cee
0x00f46cf4
0x00f46cff
0x00f46d05
0x00f46d0d
0x00f46d16

APIs

_free.LIBCMT ref: 00F46CD0

Part of subcall function 00F479D0: HeapFree.KERNEL32(00000000,00000000,?,00F49499,?,00000000,?,?,?,00F494C0,?,00000007,?,?,00F498C6,?), ref: 00F479E6
Part of subcall function 00F479D0: GetLastError.KERNEL32(?,?,00F49499,?,00000000,?,?,?,00F494C0,?,00000007,?,?,00F498C6,?,?), ref: 00F479F8

_free.LIBCMT ref: 00F46CE3
_free.LIBCMT ref: 00F46CF4
_free.LIBCMT ref: 00F46D05

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 540858d5c34990e60788c84e81cc1e9b166471dc742e4d168e527480a382aac9
Instruction ID: c5bea3a7b32d1b8d89c153068bb63b7cc793314eef759a11001e2835125d70c9
Opcode Fuzzy Hash: 540858d5c34990e60788c84e81cc1e9b166471dc742e4d168e527480a382aac9
Instruction Fuzzy Hash: 29E0EC7580B36CAA86327F18BC414593F31E744B62B15044BFA0452276C7391557FFDB

Uniqueness

Uniqueness Score: -1.00%

Function 00F45ED1 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00F45ED1(void* __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v12;
				char _v16;
				char* _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				char* _t26;
				intOrPtr* _t36;
				signed int _t37;
				signed int _t40;
				char _t42;
				signed int _t43;
				intOrPtr* _t44;
				intOrPtr* _t45;
				intOrPtr _t48;
				signed int _t49;
				signed int _t54;
				void* _t57;
				intOrPtr* _t58;
				void* _t59;
				signed int _t64;
				signed int _t66;

				_t57 = __edx;
				_t48 = _a4;
				if(_t48 != 0) {
					__eflags = _t48 - 2;
					if(_t48 == 2) {
						L5:
						_push(_t59);
						E00F488F7(_t48, _t59);
						E00F4833E(_t48, _t57, 0, 0xf5cd78, 0, 0xf5cd78, 0x104);
						_t26 =  *0xf5d040; // 0xc03518
						 *0xf5d030 = 0xf5cd78;
						_v20 = _t26;
						__eflags = _t26;
						if(_t26 == 0) {
							L7:
							_t26 = 0xf5cd78;
							_v20 = 0xf5cd78;
							L8:
							_v8 = 0;
							_v16 = 0;
							_t64 = E00F4617B(E00F46007( &_v8, _t26, 0, 0,  &_v8,  &_v16), _v8, _v16, 1);
							__eflags = _t64;
							if(__eflags != 0) {
								E00F46007( &_v8, _v20, _t64, _t64 + _v8 * 4,  &_v8,  &_v16);
								__eflags = _t48 - 1;
								if(_t48 != 1) {
									_v12 = 0;
									_push( &_v12);
									_t49 = E00F48231(_t64, _t64);
									__eflags = _t49;
									if(_t49 == 0) {
										_t58 = _v12;
										_t54 = 0;
										_t36 = _t58;
										__eflags =  *_t58;
										if( *_t58 == 0) {
											L17:
											_t37 = 0;
											 *0xf5d034 = _t54;
											_v12 = 0;
											_t49 = 0;
											 *0xf5d038 = _t58;
											L18:
											E00F479D0(_t37);
											_v12 = 0;
											L19:
											E00F479D0(_t64);
											_t40 = _t49;
											L20:
											return _t40;
										} else {
											goto L16;
										}
										do {
											L16:
											_t36 = _t36 + 4;
											_t54 = _t54 + 1;
											__eflags =  *_t36;
										} while ( *_t36 != 0);
										goto L17;
									}
									_t37 = _v12;
									goto L18;
								}
								_t42 = _v8 - 1;
								__eflags = _t42;
								 *0xf5d034 = _t42;
								_t43 = _t64;
								_t64 = 0;
								 *0xf5d038 = _t43;
								L12:
								_t49 = 0;
								goto L19;
							}
							_t44 = E00F47035(__eflags);
							_push(0xc);
							_pop(0);
							 *_t44 = 0;
							goto L12;
						}
						__eflags =  *_t26;
						if( *_t26 != 0) {
							goto L8;
						}
						goto L7;
					}
					__eflags = _t48 - 1;
					if(__eflags == 0) {
						goto L5;
					}
					_t45 = E00F47035(__eflags);
					_t66 = 0x16;
					 *_t45 = _t66;
					E00F45BD3();
					_t40 = _t66;
					goto L20;
				}
				return 0;
			}

0x00f45ed1
0x00f45eda
0x00f45edf
0x00f45ee9
0x00f45eec
0x00f45f09
0x00f45f09
0x00f45f0a
0x00f45f1d
0x00f45f22
0x00f45f2a
0x00f45f30
0x00f45f33
0x00f45f35
0x00f45f3c
0x00f45f3c
0x00f45f3e
0x00f45f41
0x00f45f44
0x00f45f4b
0x00f45f64
0x00f45f69
0x00f45f6b
0x00f45f8c
0x00f45f94
0x00f45f97
0x00f45fb2
0x00f45fb5
0x00f45fbc
0x00f45fc0
0x00f45fc2
0x00f45fc9
0x00f45fcc
0x00f45fce
0x00f45fd0
0x00f45fd2
0x00f45fdc
0x00f45fdc
0x00f45fde
0x00f45fe4
0x00f45fe7
0x00f45fe9
0x00f45fef
0x00f45ff0
0x00f45ff6
0x00f45ff9
0x00f45ffa
0x00f46000
0x00f46003
0x00000000
0x00000000
0x00000000
0x00000000
0x00f45fd4
0x00f45fd4
0x00f45fd4
0x00f45fd7
0x00f45fd8
0x00f45fd8
0x00000000
0x00f45fd4
0x00f45fc4
0x00000000
0x00f45fc4
0x00f45f9c
0x00f45f9c
0x00f45f9d
0x00f45fa2
0x00f45fa4
0x00f45fa6
0x00f45fab
0x00f45fab
0x00000000
0x00f45fab
0x00f45f6d
0x00f45f72
0x00f45f74
0x00f45f75
0x00000000
0x00f45f75
0x00f45f37
0x00f45f3a
0x00000000
0x00000000
0x00000000
0x00f45f3a
0x00f45eee
0x00f45ef1
0x00000000
0x00000000
0x00f45ef3
0x00f45efa
0x00f45efb
0x00f45efd
0x00f45f02
0x00000000
0x00f45f02
0x00000000

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe, xrefs: 00F45F14, 00F45F1B, 00F45F51

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe
API String ID: 0-123155926
Opcode ID: 1035de47d9b3e52dfa58028960e48861c27ceab60d1683237e4f98582806a6cf
Instruction ID: ffdc1ee1e1fae2a129a42d0ea1a75ccf656b7763c9c5d9a93342d895df98e5a0
Opcode Fuzzy Hash: 1035de47d9b3e52dfa58028960e48861c27ceab60d1683237e4f98582806a6cf
Instruction Fuzzy Hash: 0441A371E00718ABCB21EF99DC819AEBFB8EF85760F100066FD05E7252E7748A45E791

Uniqueness

Uniqueness Score: -1.00%

Function 00F446B5 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 58%

			E00F446B5(void* __ecx, void* __edx, signed char* _a4, signed char* _a8, intOrPtr _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
				signed int _v8;
				signed int _v12;
				intOrPtr* _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				signed int _v36;
				void* _v40;
				intOrPtr _v44;
				signed int _v48;
				intOrPtr _v56;
				void _v60;
				signed char* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t74;
				void* _t75;
				char _t76;
				signed char _t78;
				signed int _t80;
				signed char* _t81;
				signed int _t82;
				signed int _t83;
				intOrPtr* _t87;
				void* _t90;
				signed char* _t93;
				intOrPtr* _t96;
				signed char _t97;
				intOrPtr _t98;
				intOrPtr _t99;
				intOrPtr* _t101;
				signed int _t102;
				signed int _t103;
				signed char _t108;
				signed char* _t111;
				signed int _t112;
				void* _t113;
				signed char* _t116;
				void* _t121;
				signed int _t123;
				void* _t130;
				void* _t131;

				_t110 = __edx;
				_t100 = __ecx;
				_t96 = _a4;
				if( *_t96 == 0x80000003) {
					return _t74;
				} else {
					_push(_t121);
					_push(_t113);
					_t75 = E00F43FC6(_t96, __ecx, __edx, _t113, _t121);
					if( *((intOrPtr*)(_t75 + 8)) != 0) {
						__imp__EncodePointer(0);
						_t121 = _t75;
						if( *((intOrPtr*)(E00F43FC6(_t96, __ecx, __edx, 0, _t121) + 8)) != _t121 &&  *_t96 != 0xe0434f4d &&  *_t96 != 0xe0434352) {
							_t87 = E00F436AF(__edx, 0, _t121, _t96, _a8, _a12, _a16, _a20, _a28, _a32);
							_t130 = _t130 + 0x1c;
							if(_t87 != 0) {
								L16:
								return _t87;
							}
						}
					}
					_t76 = _a20;
					_v24 = _t76;
					_v20 = 0;
					if( *((intOrPtr*)(_t76 + 0xc)) > 0) {
						_push(_a28);
						E00F435E2(_t96, _t100, 0, _t121,  &_v40,  &_v24, _a24, _a16, _t76);
						_t112 = _v36;
						_t131 = _t130 + 0x18;
						_t87 = _v40;
						_v16 = _t87;
						_v8 = _t112;
						if(_t112 < _v28) {
							_t102 = _t112 * 0x14;
							_v12 = _t102;
							do {
								_t103 = 5;
								_t90 = memcpy( &_v60,  *((intOrPtr*)( *_t87 + 0x10)) + _t102, _t103 << 2);
								_t131 = _t131 + 0xc;
								if(_v60 <= _t90 && _t90 <= _v56) {
									_t93 = _v44 + 0xfffffff0 + (_v48 << 4);
									_t108 = _t93[4];
									if(_t108 == 0 ||  *((char*)(_t108 + 8)) == 0) {
										if(( *_t93 & 0x00000040) == 0) {
											_push(0);
											_push(1);
											E00F4428B(_t112, _t96, _a8, _a12, _a16, _a20, _t93, 0,  &_v60, _a28, _a32);
											_t112 = _v8;
											_t131 = _t131 + 0x30;
										}
									}
								}
								_t112 = _t112 + 1;
								_t87 = _v16;
								_t102 = _v12 + 0x14;
								_v8 = _t112;
								_v12 = _t102;
							} while (_t112 < _v28);
						}
						goto L16;
					}
					E00F46E22(_t96, _t100, _t110, 0, _t121);
					asm("int3");
					_t111 = _v68;
					_push(_t96);
					_push(_t121);
					_push(0);
					_t78 = _t111[4];
					if(_t78 == 0) {
						L41:
						_t80 = 1;
					} else {
						_t101 = _t78 + 8;
						if( *_t101 == 0) {
							goto L41;
						} else {
							_t116 = _a4;
							if(( *_t111 & 0x00000080) == 0 || ( *_t116 & 0x00000010) == 0) {
								_t97 = _t116[4];
								_t123 = 0;
								if(_t78 == _t97) {
									L33:
									if(( *_t116 & 0x00000002) == 0 || ( *_t111 & 0x00000008) != 0) {
										_t81 = _a8;
										if(( *_t81 & 0x00000001) == 0 || ( *_t111 & 0x00000001) != 0) {
											if(( *_t81 & 0x00000002) == 0 || ( *_t111 & 0x00000002) != 0) {
												_t123 = 1;
											}
										}
									}
									_t80 = _t123;
								} else {
									_t59 = _t97 + 8; // 0x6e
									_t82 = _t59;
									while(1) {
										_t98 =  *_t101;
										if(_t98 !=  *_t82) {
											break;
										}
										if(_t98 == 0) {
											L29:
											_t83 = _t123;
										} else {
											_t99 =  *((intOrPtr*)(_t101 + 1));
											if(_t99 !=  *((intOrPtr*)(_t82 + 1))) {
												break;
											} else {
												_t101 = _t101 + 2;
												_t82 = _t82 + 2;
												if(_t99 != 0) {
													continue;
												} else {
													goto L29;
												}
											}
										}
										L31:
										if(_t83 == 0) {
											goto L33;
										} else {
											_t80 = 0;
										}
										goto L42;
									}
									asm("sbb eax, eax");
									_t83 = _t82 | 0x00000001;
									goto L31;
								}
							} else {
								goto L41;
							}
						}
					}
					L42:
					return _t80;
				}
			}

0x00f446b5
0x00f446b5
0x00f446bc
0x00f446c5
0x00f447e4
0x00f446cb
0x00f446cb
0x00f446cc
0x00f446cd
0x00f446d7
0x00f446da
0x00f446e0
0x00f446ea
0x00f4470f
0x00f44714
0x00f44719
0x00f447e0
0x00000000
0x00f447e1
0x00f44719
0x00f446ea
0x00f4471f
0x00f44722
0x00f44725
0x00f4472b
0x00f44731
0x00f44743
0x00f44748
0x00f4474b
0x00f4474e
0x00f44751
0x00f44754
0x00f4475a
0x00f44760
0x00f44763
0x00f44766
0x00f44775
0x00f44776
0x00f44776
0x00f4477b
0x00f4478e
0x00f44790
0x00f44795
0x00f447a0
0x00f447a2
0x00f447a4
0x00f447c0
0x00f447c5
0x00f447c8
0x00f447c8
0x00f447a0
0x00f44795
0x00f447ce
0x00f447cf
0x00f447d2
0x00f447d5
0x00f447d8
0x00f447db
0x00f44766
0x00000000
0x00f4475a
0x00f447e5
0x00f447ea
0x00f447ee
0x00f447f1
0x00f447f2
0x00f447f3
0x00f447f4
0x00f447f9
0x00f44871
0x00f44873
0x00f447fb
0x00f447fb
0x00f44801
0x00000000
0x00f44803
0x00f44806
0x00f44809
0x00f44810
0x00f44813
0x00f44817
0x00f44849
0x00f4484c
0x00f44853
0x00f44859
0x00f44863
0x00f4486c
0x00f4486c
0x00f44863
0x00f44859
0x00f4486d
0x00f44819
0x00f44819
0x00f44819
0x00f4481c
0x00f4481c
0x00f44820
0x00000000
0x00000000
0x00f44824
0x00f44838
0x00f44838
0x00f44826
0x00f44826
0x00f4482c
0x00000000
0x00f4482e
0x00f4482e
0x00f44831
0x00f44836
0x00000000
0x00000000
0x00000000
0x00000000
0x00f44836
0x00f4482c
0x00f44841
0x00f44843
0x00000000
0x00f44845
0x00f44845
0x00f44845
0x00000000
0x00f44843
0x00f4483c
0x00f4483e
0x00000000
0x00f4483e
0x00000000
0x00000000
0x00000000
0x00f44809
0x00f44801
0x00f44874
0x00f44878
0x00f44878

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00F446DA

Strings

MOC, xrefs: 00F446EC
RCC, xrefs: 00F446F4

Memory Dump Source

Source File: 00000001.00000002.827539752.0000000000F41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000001.00000002.827528753.0000000000F40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827566651.0000000000F4F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827592711.0000000000F5C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.827606974.0000000000F5E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f40000_StartupInstaller.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 32fda48a944a9303af90cef289c34578493e67da548876797946229fc87c9d3d
Instruction ID: f4b934fff80268fcf4cb0e22fa9262e34349505ebeaf04e6e572fbede9e61c58
Opcode Fuzzy Hash: 32fda48a944a9303af90cef289c34578493e67da548876797946229fc87c9d3d
Instruction Fuzzy Hash: A6415531D00209AFDF15DF98DD81AAEBFB5BF49310F188159FE04B6251D339AA51EB50

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: MEInstaller.exePID: 524, Parent PID: 4472COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	506
Total number of Limit Nodes:	7

Executed Functions

Function 6BD31E80 Relevance: 37.5, APIs: 5, Strings: 16, Instructions: 793
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice,00000000,00020219,?,6BD59058,00000000,6BD58DCC,00000002,338DA2DF), ref: 6BD31F16
RegQueryValueExW.KERNEL32(00000000,Progid,00000000,00000001,?,?), ref: 6BD31F5A
AssocQueryStringW.SHLWAPI(00000001,00000002,.html,00000001,?,00000104), ref: 6BD325C6

Strings

ChromeHTML, xrefs: 6BD320BD
msedge, xrefs: 6BD326C4
safari, xrefs: 6BD3274E
IE.HTTP, xrefs: 6BD32021
.html, xrefs: 6BD325BE
firefox, xrefs: 6BD326F4
FriendlyTypeName, xrefs: 6BD3233C
iexplore, xrefs: 6BD32696
MSEdgeHTM, xrefs: 6BD32055
chrome, xrefs: 6BD32721
FirefoxURL, xrefs: 6BD32089
Progid, xrefs: 6BD31F4F
Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice, xrefs: 6BD31F02
SafariURL, xrefs: 6BD320F1
MicrosoftEdge, xrefs: 6BD32406
Software\Classes\, xrefs: 6BD32273

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID: Query$AssocOpenStringValue
String ID: .html$ChromeHTML$FirefoxURL$FriendlyTypeName$IE.HTTP$MSEdgeHTM$MicrosoftEdge$Progid$SafariURL$Software\Classes\$Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice$chrome$firefox$iexplore$msedge$safari
API String ID: 1082267866-1774982471
Opcode ID: 0aaff38eb7b9529b6ff7560c5285925ff5227d323d952bb749ac6022084046df
Instruction ID: e8dc7e5710ffebbfd8080905f549e51082736fa61ce80d7dd7588c23370dbcf2
Opcode Fuzzy Hash: 0aaff38eb7b9529b6ff7560c5285925ff5227d323d952bb749ac6022084046df
Instruction Fuzzy Hash: 1252C4B1E001289BDF24CB24CC95BDDB775AF45328F1041D9E509AB282D739AF89CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 6BD40A8D Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 51
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6BD5DC7C,00000FA0,?,?,6BD40A6B), ref: 6BD40A99
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,6BD40A6B), ref: 6BD40AA4
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,6BD40A6B), ref: 6BD40AB5
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 6BD40AC7
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 6BD40AD5
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,6BD40A6B), ref: 6BD40AF8
___scrt_fastfail.LIBCMT ref: 6BD40B09
DeleteCriticalSection.KERNEL32(6BD5DC7C,00000007,?,?,6BD40A6B), ref: 6BD40B14
CloseHandle.KERNEL32(00000000,?,?,6BD40A6B), ref: 6BD40B24

Strings

WakeAllConditionVariable, xrefs: 6BD40ACD
api-ms-win-core-synch-l1-2-0.dll, xrefs: 6BD40A9F
SleepConditionVariableCS, xrefs: 6BD40AC1
kernel32.dll, xrefs: 6BD40AB0

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 3578986977-3242537097
Opcode ID: fe83f62a68466619fe45350dd88dcf7b4d016a485a05307895185ae217ea83ea
Instruction ID: 16706d2d1d5a9c267b7dfc799a323533e8bf3c2e4be6037f7fe5e6d4abca80df
Opcode Fuzzy Hash: fe83f62a68466619fe45350dd88dcf7b4d016a485a05307895185ae217ea83ea
Instruction Fuzzy Hash: B6015E77981711BBFF215F78980DE6ABB68AB4A7B17000065B906DE100DEB8C4148671

Uniqueness

Uniqueness Score: -1.00%

Function 6BD411F7 Relevance: 12.1, APIs: 8, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6BD4123E
___scrt_uninitialize_crt.LIBCMT ref: 6BD41258

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 33c64a1c2f674781ddefa58c4e71926a41e6f4c69b907a62e8377f16ca1bacf3
Instruction ID: 00f506f62a067e543877627f4d5ec5284c57b843986083cb11e6362e7072e7cd
Opcode Fuzzy Hash: 33c64a1c2f674781ddefa58c4e71926a41e6f4c69b907a62e8377f16ca1bacf3
Instruction Fuzzy Hash: 0941C472D00634EBDB108F65C846BAE7FB8EB45BB4F014159E824AF240D7389E219BB0

Uniqueness

Uniqueness Score: -1.00%

Function 6BD412A7 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6BD412E4
dllmain_crt_dispatch.LIBCMT ref: 6BD412FB
dllmain_raw.LIBCMT ref: 6BD41343
dllmain_crt_dispatch.LIBCMT ref: 6BD41356
dllmain_raw.LIBCMT ref: 6BD41369

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: c979603357c2aa691d9dd455d4fac4f8183a1b89e5ea6d3267567d8c232e947d
Instruction ID: ccdb99fb34d706dc146a2421d2b10989c23b7c194c0940ae1bc026e5133d5461
Opcode Fuzzy Hash: c979603357c2aa691d9dd455d4fac4f8183a1b89e5ea6d3267567d8c232e947d
Instruction Fuzzy Hash: 5A218372D01A35EFDB218F65C845A6F3F79EB81AB4F014159F824AF610D7388E619BE0

Uniqueness

Uniqueness Score: -1.00%

Function 6BD324B0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 191
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6BD31E80: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice,00000000,00020219,?,6BD59058,00000000,6BD58DCC,00000002,338DA2DF), ref: 6BD31F16
Part of subcall function 6BD31E80: RegQueryValueExW.KERNEL32(00000000,Progid,00000000,00000001,?,?), ref: 6BD31F5A

AssocQueryStringW.SHLWAPI(00000001,00000002,.html,00000001,?,00000104), ref: 6BD325C6

Strings

.html, xrefs: 6BD325BE
iexplore, xrefs: 6BD32696

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID: Query$AssocOpenStringValue
String ID: .html$iexplore
API String ID: 1082267866-828241661
Opcode ID: d1bf8265b1b0ab5abff1ab52d45415c4627b2e0780e0929affddb10fe5ef3608
Instruction ID: ab9362dfb2d8ef2d89d6c88f3a528f68f4dec70144dc083ace08c507e3963bfa
Opcode Fuzzy Hash: d1bf8265b1b0ab5abff1ab52d45415c4627b2e0780e0929affddb10fe5ef3608
Instruction Fuzzy Hash: C7716C76E01229DBCB20CB28CC99BD9B7B5FB45328F1041D6D909AB251D7396F85CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6BD410F0 Relevance: 4.6, APIs: 3, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6BD4113D

Part of subcall function 6BD41945: InitializeSListHead.KERNEL32(6BD5DFF8,6BD41147,6BD5B688,00000010,6BD410D8,?,?,?,6BD41300,?,00000001,?,?,00000001,?,6BD5B6D0), ref: 6BD4194A

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6BD411A7
___scrt_fastfail.LIBCMT ref: 6BD411F1

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID: Initialize$HeadList___scrt_fastfail___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 2097537958-0
Opcode ID: 8ec37872412ef6e45544c3fa2fd9f2b86e196c4ad76c22dae5f5c0b7e7d30a4e
Instruction ID: 2c7717c634b571c0fea1c6d1f96b52d15f16bcf62ce4c1c5cf6f7630d828bbde
Opcode Fuzzy Hash: 8ec37872412ef6e45544c3fa2fd9f2b86e196c4ad76c22dae5f5c0b7e7d30a4e
Instruction Fuzzy Hash: D9210232648261EEEF006FB49402B9C7BA1AF1337DF00405AD8956F1C1DB6D5224DB75

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6BD33D70 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 97
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 6BD33D8F
CoCreateInstance.OLE32(6BD53210,00000000,00000003,6BD59048,00000000), ref: 6BD33DA6
CoUninitialize.OLE32 ref: 6BD33E53

Strings

http, xrefs: 6BD33DBD
.html, xrefs: 6BD33E02
https, xrefs: 6BD33DD2
.pdf, xrefs: 6BD33E1A
.htm, xrefs: 6BD33DEA
MSEdgeHTM, xrefs: 6BD33DC2, 6BD33DD7, 6BD33DEF, 6BD33E07, 6BD33E1F

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize
String ID: .htm$.html$.pdf$MSEdgeHTM$http$https
API String ID: 948891078-1444453974
Opcode ID: 417f26a51cbcce939102d5bc10aa2d3e071436ef9d9a50171d7a5f3964055ef0
Instruction ID: c00cb971fdd545503845eb10f4042c74f0b97946e84d6be4e8d7ba4a839156b8
Opcode Fuzzy Hash: 417f26a51cbcce939102d5bc10aa2d3e071436ef9d9a50171d7a5f3964055ef0
Instruction Fuzzy Hash: 3C316172A00218BFDF20DFA4C848F9E77B9AF59735F1004A9B905EF241C7799945CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6BD332A0 Relevance: 4.5, APIs: 3, Instructions: 47COMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(00000000,00000000,00000002,00000000,6BD5E810,?,6BD32DAD,6BD318C0,?,6BD318C0,office.com,?,?,00000000), ref: 6BD332AC
LockResource.KERNEL32(00000000,?,6BD32DAD,6BD318C0,?,6BD318C0,office.com,?,?,00000000), ref: 6BD332B7
SizeofResource.KERNEL32(00000000,00000000,?,6BD32DAD,6BD318C0,?,6BD318C0,office.com,?,?,00000000), ref: 6BD332C5

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID: Resource$LoadLockSizeof
String ID:
API String ID: 2853612939-0
Opcode ID: c45a8f653161f334ec997b9c49b4d7ecb6ba2542c82e103f0264cfbb08a5bef9
Instruction ID: 93e7ab50cf653c503ad0e5225f7a3aec28f58d684c5811a941a418d9a291021d
Opcode Fuzzy Hash: c45a8f653161f334ec997b9c49b4d7ecb6ba2542c82e103f0264cfbb08a5bef9
Instruction Fuzzy Hash: 91F0FC37A00235D79B311B6B9D85C67F7ACDA83735301092BFD5ADB102E965D84092D0

Uniqueness

Uniqueness Score: -1.00%

Function 6BD31020 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?,338DA2DF), ref: 6BD31060

Strings

Thv, xrefs: 6BD31060

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID: Version
String ID: Thv
API String ID: 1889659487-4269917160
Opcode ID: d7f55c3305616616aad12e27d237e0dd499b2d65fd9bfa9fc2aa6981a294bb00
Instruction ID: b364009d538bd2f8a742abc4d95ed188a7b8a00a3ecaf3b8f972c9b4429bc6d8
Opcode Fuzzy Hash: d7f55c3305616616aad12e27d237e0dd499b2d65fd9bfa9fc2aa6981a294bb00
Instruction Fuzzy Hash: 7D513AB0904B65CED760CF78C44579ABBF0EF0A328F104A5EC4AEDB681D778A548CB55

Uniqueness

Uniqueness Score: -1.00%

Function 6BD4C847 Relevance: 19.6, APIs: 13, Instructions: 113
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___free_lconv_mon.LIBCMT ref: 6BD4C88B

Part of subcall function 6BD4CB80: _free.LIBCMT ref: 6BD4CB9D
Part of subcall function 6BD4CB80: _free.LIBCMT ref: 6BD4CBAF
Part of subcall function 6BD4CB80: _free.LIBCMT ref: 6BD4CBC1
Part of subcall function 6BD4CB80: _free.LIBCMT ref: 6BD4CBD3
Part of subcall function 6BD4CB80: _free.LIBCMT ref: 6BD4CBE5
Part of subcall function 6BD4CB80: _free.LIBCMT ref: 6BD4CBF7
Part of subcall function 6BD4CB80: _free.LIBCMT ref: 6BD4CC09
Part of subcall function 6BD4CB80: _free.LIBCMT ref: 6BD4CC1B
Part of subcall function 6BD4CB80: _free.LIBCMT ref: 6BD4CC2D
Part of subcall function 6BD4CB80: _free.LIBCMT ref: 6BD4CC3F
Part of subcall function 6BD4CB80: _free.LIBCMT ref: 6BD4CC51
Part of subcall function 6BD4CB80: _free.LIBCMT ref: 6BD4CC63
Part of subcall function 6BD4CB80: _free.LIBCMT ref: 6BD4CC75

_free.LIBCMT ref: 6BD4C880

Part of subcall function 6BD4A195: HeapFree.KERNEL32(00000000,00000000,?,6BD4CD11,?,00000000,?,?,?,6BD4CD38,?,00000007,?,?,6BD4C9DE,?), ref: 6BD4A1AB
Part of subcall function 6BD4A195: GetLastError.KERNEL32(?,?,6BD4CD11,?,00000000,?,?,?,6BD4CD38,?,00000007,?,?,6BD4C9DE,?,?), ref: 6BD4A1BD

_free.LIBCMT ref: 6BD4C8A2
_free.LIBCMT ref: 6BD4C8B7
_free.LIBCMT ref: 6BD4C8C2
_free.LIBCMT ref: 6BD4C8E4
_free.LIBCMT ref: 6BD4C8F7
_free.LIBCMT ref: 6BD4C905
_free.LIBCMT ref: 6BD4C910
_free.LIBCMT ref: 6BD4C948
_free.LIBCMT ref: 6BD4C94F
_free.LIBCMT ref: 6BD4C96C
_free.LIBCMT ref: 6BD4C984

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 06410838b585f65449cefeef9ff0552923dc52e1409d5b28689601f099302699
Instruction ID: 82b7690678e2d3cad89919d90db3895c2d6dca8024e460c86734243c9848b66b
Opcode Fuzzy Hash: 06410838b585f65449cefeef9ff0552923dc52e1409d5b28689601f099302699
Instruction Fuzzy Hash: B3318132A04705EFEB114F75D805B5677E9AF05374F1844AAE059EF150DF38E948DB20

Uniqueness

Uniqueness Score: -1.00%

Function 6BD42D24 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 308
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 6BD42E1F
type_info::operator==.LIBVCRUNTIME ref: 6BD42E46
___TypeMatch.LIBVCRUNTIME ref: 6BD42F52
IsInExceptionSpec.LIBVCRUNTIME ref: 6BD4302D
_UnwindNestedFrames.LIBCMT ref: 6BD430B4
CallUnexpected.LIBVCRUNTIME ref: 6BD430CF

Strings

csm, xrefs: 6BD42DCC
csm, xrefs: 6BD42E7D
csm, xrefs: 6BD42D5F

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: c0d3fdeee5393f2e1b06964c79305615321a86ff610384f04f5c579e3a18a3fe
Instruction ID: d99c2c184f941d19ac08eba48d84567ecdcec4a39095b2bb909fc434933c79d3
Opcode Fuzzy Hash: c0d3fdeee5393f2e1b06964c79305615321a86ff610384f04f5c579e3a18a3fe
Instruction Fuzzy Hash: B1C17D71C14209DFCF15CFA8C881A9EBBB5BF04338F0441AAE854AF215D779DA91DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6BD49A78 Relevance: 15.1, APIs: 10, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 6BD49A8E

Part of subcall function 6BD4A195: HeapFree.KERNEL32(00000000,00000000,?,6BD4CD11,?,00000000,?,?,?,6BD4CD38,?,00000007,?,?,6BD4C9DE,?), ref: 6BD4A1AB
Part of subcall function 6BD4A195: GetLastError.KERNEL32(?,?,6BD4CD11,?,00000000,?,?,?,6BD4CD38,?,00000007,?,?,6BD4C9DE,?,?), ref: 6BD4A1BD

_free.LIBCMT ref: 6BD49A9A
_free.LIBCMT ref: 6BD49AA5
_free.LIBCMT ref: 6BD49AB0
_free.LIBCMT ref: 6BD49ABB
_free.LIBCMT ref: 6BD49AC6
_free.LIBCMT ref: 6BD49AD1
_free.LIBCMT ref: 6BD49ADC
_free.LIBCMT ref: 6BD49AE7
_free.LIBCMT ref: 6BD49AF5

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 0b6ee778d64557b9952889436673955ffd09a641c68dd366a83a29024d6aeb71
Instruction ID: f7c165ea0bd802f0394d307e0a915cbf177e816e40123ad23fb294d47a0de250
Opcode Fuzzy Hash: 0b6ee778d64557b9952889436673955ffd09a641c68dd366a83a29024d6aeb71
Instruction Fuzzy Hash: 3821857690010CAFCB42DFA5C881DDE7FB9BF09364F0145A6A516AF121EB35EB58CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6BD427D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6BD42807
___except_validate_context_record.LIBVCRUNTIME ref: 6BD4280F
_ValidateLocalCookies.LIBCMT ref: 6BD42898
__IsNonwritableInCurrentImage.LIBCMT ref: 6BD428C3
_ValidateLocalCookies.LIBCMT ref: 6BD42918

Strings

csm, xrefs: 6BD428AD

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 54a32116499972b2a61cfd759a6a72917df92fc16dcad3d34f6a4a083e5f579d
Instruction ID: 7dfc2b7786e9304d07709e0a221a4e64051bb8f2927c91ee015528783bf3d108
Opcode Fuzzy Hash: 54a32116499972b2a61cfd759a6a72917df92fc16dcad3d34f6a4a083e5f579d
Instruction Fuzzy Hash: 57415B35A10208EBDF14DF68C881A9EBBB5AF45338F1481A5E814DF251DB39DA15CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6BD4B87C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

ext-ms-, xrefs: 6BD4B8E7
api-ms-, xrefs: 6BD4B8D3

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 526e0a93307aa7424e7abcf886f9674917792961e7b6e2d2d7a61a72c7b0123c
Instruction ID: 114de8748b38db20082c28bc4b49bb87344a6e925f3525fb579fa243884c8bfd
Opcode Fuzzy Hash: 526e0a93307aa7424e7abcf886f9674917792961e7b6e2d2d7a61a72c7b0123c
Instruction Fuzzy Hash: B621A536E45224EBEB254F288C85B5E77689F267B0F110560ED96AF2C1D738ED10D6F0

Uniqueness

Uniqueness Score: -1.00%

Function 6BD4CD1F Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6BD4CCE7: _free.LIBCMT ref: 6BD4CD0C

_free.LIBCMT ref: 6BD4CD6D

Part of subcall function 6BD4A195: HeapFree.KERNEL32(00000000,00000000,?,6BD4CD11,?,00000000,?,?,?,6BD4CD38,?,00000007,?,?,6BD4C9DE,?), ref: 6BD4A1AB
Part of subcall function 6BD4A195: GetLastError.KERNEL32(?,?,6BD4CD11,?,00000000,?,?,?,6BD4CD38,?,00000007,?,?,6BD4C9DE,?,?), ref: 6BD4A1BD

_free.LIBCMT ref: 6BD4CD78
_free.LIBCMT ref: 6BD4CD83
_free.LIBCMT ref: 6BD4CDD7
_free.LIBCMT ref: 6BD4CDE2
_free.LIBCMT ref: 6BD4CDED
_free.LIBCMT ref: 6BD4CDF8

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f684ee3bd14a070dd3464a80d5e2c39723c3433437510566982be1aab423c66b
Instruction ID: 65c21c6dbed274e9977e72ab4250642f076c6ac3290e597c2b32b4c1baf9a82a
Opcode Fuzzy Hash: f684ee3bd14a070dd3464a80d5e2c39723c3433437510566982be1aab423c66b
Instruction Fuzzy Hash: 0A112171580B08AAD531ABB0CC07FCB7B9C6F16724F484829E29EAE050DB7DF648C760

Uniqueness

Uniqueness Score: -1.00%

Function 6BD4DBAD Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000001,00000000), ref: 6BD4DBF5
__fassign.LIBCMT ref: 6BD4DDD4
__fassign.LIBCMT ref: 6BD4DDF1
WriteFile.KERNEL32(?,6BD4C37E,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BD4DE39
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6BD4DE79
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BD4DF25

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 78fbbfd4ef4d9355a9ee8a7699f6c5ad15b55ed039e490c7b7e2f63b9384b1e6
Instruction ID: 2c5e311de2ab434cfa5e39265cb5f3566fca8d64559018e1300e9bfff309e4c2
Opcode Fuzzy Hash: 78fbbfd4ef4d9355a9ee8a7699f6c5ad15b55ed039e490c7b7e2f63b9384b1e6
Instruction Fuzzy Hash: FED1BB75D012989FDF11CFA8C8809EDBBB5FF49324F2401AAE855BB241D735AE02CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6BD3CB40 Relevance: 9.2, APIs: 6, Instructions: 231fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,00000001,00000000,00000003,00000080,00000000,338DA2DF,?,?,?), ref: 6BD3CBBF
GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6BD3CBD5
ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 6BD3CC12
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000), ref: 6BD3CC43
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 6BD3CC71
CloseHandle.KERNEL32(00000000), ref: 6BD3CD84

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID: File$ByteCharHandleMultiWide$CloseCreateInformationRead
String ID:
API String ID: 390388180-0
Opcode ID: 16f0d851d62af21a612d1d2c1a4ae1d517180628d53f505cd4ba594946e05e9e
Instruction ID: f22732c6386f9e1949ca93edf79700260bdec2a08b09367ab9a9d4e1a424ab94
Opcode Fuzzy Hash: 16f0d851d62af21a612d1d2c1a4ae1d517180628d53f505cd4ba594946e05e9e
Instruction Fuzzy Hash: 3771E671A002589BDF14CF74CC45FAEBBB5EB46764F144229F41AEF281DB39AA44CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6BD429ED Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6BD4275E,6BD40CFF,6BD410C8,?,6BD41300,?,00000001,?,?,00000001,?,6BD5B6D0,0000000C,6BD413F9), ref: 6BD429FB
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6BD42A09
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6BD42A22
SetLastError.KERNEL32(00000000,6BD41300,?,00000001,?,?,00000001,?,6BD5B6D0,0000000C,6BD413F9,?,00000001,?), ref: 6BD42A74

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: acd7af7e068afdba4a712ea80f5f5cbbedadbca64e928833ad363df277abcc70
Instruction ID: 0cdc04b0e4c64034fde9db15f48de0222c6c704855f8141977efced0a55a6f35
Opcode Fuzzy Hash: acd7af7e068afdba4a712ea80f5f5cbbedadbca64e928833ad363df277abcc70
Instruction Fuzzy Hash: BC01D8339997159EBA300B7CEC86A17A7A4DB0677E7200239E921CD0E0EF59C9456178

Uniqueness

Uniqueness Score: -1.00%

Function 6BD4ACB3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe, xrefs: 6BD4ACB8

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe
API String ID: 0-2525331770
Opcode ID: a4fb05adcf501071cd4d241dcda5c3c52892829d9eb1ceb346594c63dbad2d4e
Instruction ID: 796dd53ce05d6ec890e14a2b72f7dc5d954551c1c40f847fa5cead0e566795a9
Opcode Fuzzy Hash: a4fb05adcf501071cd4d241dcda5c3c52892829d9eb1ceb346594c63dbad2d4e
Instruction Fuzzy Hash: 4921D17AA04605BF9B149F748C8091BB7ADEF013797008534F9188F1A0FB38ED419BB0

Uniqueness

Uniqueness Score: -1.00%

Function 6BD43A93 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,6BD43B54,00000000,?,00000001,00000000,?,6BD43BCB,00000001,FlsFree,6BD53E3C,FlsFree,00000000), ref: 6BD43B23

Strings

api-ms-, xrefs: 6BD43AE3

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 5de6e1a71f72c108bdd8c46cd02e68f46933a16a39b33eac5e00e6886e5abee3
Instruction ID: e92a3f9bae4e5b4d2b41f6a31f025f617b40d844aee0e2516be4239efed774d6
Opcode Fuzzy Hash: 5de6e1a71f72c108bdd8c46cd02e68f46933a16a39b33eac5e00e6886e5abee3
Instruction Fuzzy Hash: 66113332E45625EBEF328F6CDC45B4A77B49F027B0F150271E915EF280D7A8E90096E5

Uniqueness

Uniqueness Score: -1.00%

Function 6BD48BED Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,6BD48B9F,6BD49C78,?,6BD48B67,?,00000000,6BD49C78), ref: 6BD48C02
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6BD48C15
FreeLibrary.KERNEL32(00000000,?,?,6BD48B9F,6BD49C78,?,6BD48B67,?,00000000,6BD49C78), ref: 6BD48C38

Strings

mscoree.dll, xrefs: 6BD48BFB
CorExitProcess, xrefs: 6BD48C0D

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: c9d2f6a2b40328bb586381a2be954455689a9bae6cae24265a737fb8a724153b
Instruction ID: 79b4954389cc1527db01d83b575fc6747d7986092bda04e2881a402af7748e37
Opcode Fuzzy Hash: c9d2f6a2b40328bb586381a2be954455689a9bae6cae24265a737fb8a724153b
Instruction Fuzzy Hash: 45F0123690121CFBEF119B54CA09B9EFB79EF457B5F1000A4F405A9190CB39CA15EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6BD4CC7E Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 6BD4CC96

Part of subcall function 6BD4A195: HeapFree.KERNEL32(00000000,00000000,?,6BD4CD11,?,00000000,?,?,?,6BD4CD38,?,00000007,?,?,6BD4C9DE,?), ref: 6BD4A1AB
Part of subcall function 6BD4A195: GetLastError.KERNEL32(?,?,6BD4CD11,?,00000000,?,?,?,6BD4CD38,?,00000007,?,?,6BD4C9DE,?,?), ref: 6BD4A1BD

_free.LIBCMT ref: 6BD4CCA8
_free.LIBCMT ref: 6BD4CCBA
_free.LIBCMT ref: 6BD4CCCC
_free.LIBCMT ref: 6BD4CCDE

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d87820c30c328276887cfeee6f891960d22f111e5b591dfc7837bdd9becb810a
Instruction ID: a4d5a5fcb6fd51a3d2a4f56f7b9989198ca459eeca4eacdb1184096d5d1a8fe7
Opcode Fuzzy Hash: d87820c30c328276887cfeee6f891960d22f111e5b591dfc7837bdd9becb810a
Instruction Fuzzy Hash: BFF06232500708DB9A01DF64D181C177BEEBA463343580845F01AEF500CB38F885DBB4

Uniqueness

Uniqueness Score: -1.00%

Function 6BD4A637 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6BD4A7D1

Strings

*?, xrefs: 6BD4A67A

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: fe7d301ba8c6df1b144b88e5622cdbdca0e8054ab37c060bca5b6476da677687
Instruction ID: 3d310c2c5528a345f647bdf9c54069dfe3f7bc034b4459e24e812b9b1c0f187e
Opcode Fuzzy Hash: fe7d301ba8c6df1b144b88e5622cdbdca0e8054ab37c060bca5b6476da677687
Instruction Fuzzy Hash: 12614DB5D042199FDB14CFA8C8815EDFBF5EF48324B1481A9D855EB300E739AE419BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6BD385C0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 206COMMON

Download Yara Rule

Strings

\Preferences, xrefs: 6BD38692
Default, xrefs: 6BD3831C
\User Data, xrefs: 6BD34B0A, 6BD35F8A, 6BD36F82, 6BD3864D

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID: FolderPath
String ID: Default$\Preferences$\User Data
API String ID: 1514166925-221605969
Opcode ID: 3de550a82628d9546a9c6e3d3e4e78978a6a2a597ca9c2a47cb7e5f11dfae64c
Instruction ID: 9dc6a67685d683560bee08a7e3e4b4a1df1a5ec2cdd3fdf6ae6ccb725bdf15ce
Opcode Fuzzy Hash: 3de550a82628d9546a9c6e3d3e4e78978a6a2a597ca9c2a47cb7e5f11dfae64c
Instruction Fuzzy Hash: DB71C070A10258DADF10CBB4CD85BCEBBB1AF46328F104558D045EB286DB7DAA84CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6BD31BC0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 203networkCOMMON

Download Yara Rule

APIs

InternetCrackUrlW.WININET(?,00000000,00000000,0000003C), ref: 6BD31C6E

Strings

bing:baseURL, xrefs: 6BD31DA0
bing., xrefs: 6BD31D37, 6BD31D7E
<, xrefs: 6BD31C26

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID: CrackInternet
String ID: <$bing.$bing:baseURL
API String ID: 1381609488-1358390346
Opcode ID: 7ee96df6ed39ed416698e32bbab0e6bcdd32642bda5ea6297ea5ad0a0f89aa4d
Instruction ID: d34b68e413d39ca7e9125097ae82f5fc2bd346c96a83de57a5afef43e3e3b7ab
Opcode Fuzzy Hash: 7ee96df6ed39ed416698e32bbab0e6bcdd32642bda5ea6297ea5ad0a0f89aa4d
Instruction Fuzzy Hash: E0715F71E001399BDB25CF24CC81BDDB3B4EB09364F1405D9D919AB281EB396F948FA1

Uniqueness

Uniqueness Score: -1.00%

Function 6BD42ACD Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6BD42B94
___AdjustPointer.LIBCMT ref: 6BD42BB7
___AdjustPointer.LIBCMT ref: 6BD42C53

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 76b165e3a305076d2d48d3b72416b765e07274d6c77ddc1f04504a3be65a9256
Instruction ID: a3c78ea9ab186e8a27d28e9e311f2dd6f96dae5a2b46ebe6447d30594c4bed3a
Opcode Fuzzy Hash: 76b165e3a305076d2d48d3b72416b765e07274d6c77ddc1f04504a3be65a9256
Instruction Fuzzy Hash: C0513476A14206EFEB148F64D881BAA77B4FF05338F10416DD851CF294E779E980DB60

Uniqueness

Uniqueness Score: -1.00%

Function 6BD4A54B Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6BD4AB6D: _free.LIBCMT ref: 6BD4AB7B

Part of subcall function 6BD4B6C6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,6BD49FF4,?,00000000,00000000), ref: 6BD4B768

GetLastError.KERNEL32 ref: 6BD4A5B3
__dosmaperr.LIBCMT ref: 6BD4A5BA
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 6BD4A5F9
__dosmaperr.LIBCMT ref: 6BD4A600

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 556d8d2d8b8c90fb6397c9ea5b97108e01b143922f6feeff3c1132cc4f950bd1
Instruction ID: 016b9eb6c7d01fe11b4f6908dc74edc5002aacea5252d0a3b20eccbae6fba366
Opcode Fuzzy Hash: 556d8d2d8b8c90fb6397c9ea5b97108e01b143922f6feeff3c1132cc4f950bd1
Instruction Fuzzy Hash: 2421B071A04605AF97109F798D8081BBBBDEF053787008938E9689F150EB38ED509FB0

Uniqueness

Uniqueness Score: -1.00%

Function 6BD49BBC Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,6BD44601,?,?,?,?,6BD44667,00000000,?,?,?,?,6BD44865,?), ref: 6BD49BC1
_free.LIBCMT ref: 6BD49C1E
_free.LIBCMT ref: 6BD49C54
SetLastError.KERNEL32(00000000,0000000D,000000FF,?,6BD44667,00000000,?,?,?,?,6BD44865,?,00000000,?,6BD32669,?), ref: 6BD49C5F

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 8e68545639b4f927fe30942fc1be0c55b876cf927a7de2f91196d9f393fce259
Instruction ID: 77803ab1b9214f57afb8de9921207431e02f3d64afb67e2c3c00e7544f2116f1
Opcode Fuzzy Hash: 8e68545639b4f927fe30942fc1be0c55b876cf927a7de2f91196d9f393fce259
Instruction Fuzzy Hash: 7D11C633688205AFAE1117BA4E86E1F769D9BC277C7200134F5249E1C1EFADCD059130

Uniqueness

Uniqueness Score: -1.00%

Function 6BD49D13 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,6BD4492B,6BD4A3E8,?,?,6BD40A42,?,?,6BD33CA7,00000008), ref: 6BD49D18
_free.LIBCMT ref: 6BD49D75
_free.LIBCMT ref: 6BD49DAB
SetLastError.KERNEL32(00000000,0000000D,000000FF,?,?,?,6BD4492B,6BD4A3E8,?,?,6BD40A42,?,?,6BD33CA7,00000008), ref: 6BD49DB6

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 3a0feea202a29c4bda4dfa71b1c9398770856a77c4a101426ebccc20ea71870f
Instruction ID: 212c4abcb797d4b836796f45ca1b390f548ea9c330f81cf721d664681020302d
Opcode Fuzzy Hash: 3a0feea202a29c4bda4dfa71b1c9398770856a77c4a101426ebccc20ea71870f
Instruction Fuzzy Hash: 7411E5732846046FEE1117BA4D86E1F775ADBC2778B200234F5299E1C1EF6CCD059130

Uniqueness

Uniqueness Score: -1.00%

Function 6BD4EF76 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,6BD4C3EF,00000000,?,?,6BD4E9CB,?,00000001,?,00000001,?,6BD4DF82,00000000,00000000,00000001), ref: 6BD4EF8D
GetLastError.KERNEL32(?,6BD4E9CB,?,00000001,?,00000001,?,6BD4DF82,00000000,00000000,00000001,00000000,00000001,?,6BD4E4D6,6BD4C37E), ref: 6BD4EF99

Part of subcall function 6BD4EF5F: CloseHandle.KERNEL32(FFFFFFFE,6BD4EFA9,?,6BD4E9CB,?,00000001,?,00000001,?,6BD4DF82,00000000,00000000,00000001,00000000,00000001), ref: 6BD4EF6F

___initconout.LIBCMT ref: 6BD4EFA9

Part of subcall function 6BD4EF21: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6BD4EF50,6BD4E9B8,00000001,?,6BD4DF82,00000000,00000000,00000001,00000000), ref: 6BD4EF34

WriteConsoleW.KERNEL32(?,?,6BD4C3EF,00000000,?,6BD4E9CB,?,00000001,?,00000001,?,6BD4DF82,00000000,00000000,00000001,00000000), ref: 6BD4EFBE

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 820b5319be014d6a95ad828fcdeef8a8d7dd6b04293b5426f9ab2322ed4eaa41
Instruction ID: 7bb67dc6cb3ff5a3fbd73ff9e33844aac0010f0d6a61ca8732d77c602b5bd8a7
Opcode Fuzzy Hash: 820b5319be014d6a95ad828fcdeef8a8d7dd6b04293b5426f9ab2322ed4eaa41
Instruction Fuzzy Hash: 84F0F237415118BBDF266FA5CC09D8ABF66FB0A6B1B014450FA1989120CB32C920EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6BD40BFD Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,6BD40B9A,00000064), ref: 6BD40C20
LeaveCriticalSection.KERNEL32(6BD5DC7C,00000000,?,6BD40B9A,00000064,?,6BD338B3,6BD5E778,6BD31AE4,?,00000000,?,338DA2DF,?,00000000), ref: 6BD40C2A
WaitForSingleObjectEx.KERNEL32(00000000,00000000,?,6BD40B9A,00000064,?,6BD338B3,6BD5E778,6BD31AE4,?,00000000,?,338DA2DF,?,00000000), ref: 6BD40C3B
EnterCriticalSection.KERNEL32(6BD5DC7C,?,6BD40B9A,00000064,?,6BD338B3,6BD5E778,6BD31AE4,?,00000000,?,338DA2DF,?,00000000), ref: 6BD40C42

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 6db41e3484feebb288ac9d96c4cbae114ef056e8d42f44c9746dab88ffc29577
Instruction ID: daf5e54707e60428861d77350d50455d057e21c0d3f1584d7bded412eea01ee6
Opcode Fuzzy Hash: 6db41e3484feebb288ac9d96c4cbae114ef056e8d42f44c9746dab88ffc29577
Instruction Fuzzy Hash: B4E01B3B581124E7DE112F64CD08D5EFF24EB0E6B17000055F6066D110CE65D52147F5

Uniqueness

Uniqueness Score: -1.00%

Function 6BD49563 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6BD4956C

Part of subcall function 6BD4A195: HeapFree.KERNEL32(00000000,00000000,?,6BD4CD11,?,00000000,?,?,?,6BD4CD38,?,00000007,?,?,6BD4C9DE,?), ref: 6BD4A1AB
Part of subcall function 6BD4A195: GetLastError.KERNEL32(?,?,6BD4CD11,?,00000000,?,?,?,6BD4CD38,?,00000007,?,?,6BD4C9DE,?,?), ref: 6BD4A1BD

_free.LIBCMT ref: 6BD4957F
_free.LIBCMT ref: 6BD49590
_free.LIBCMT ref: 6BD495A1

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5b3318375ba08a27904bc4a7e308cc28794f53beb92be46b986ce14b1198fa71
Instruction ID: fade94e58c857c4f323526a23ad99fd41e5f740ff85330b7866d95a9b38600e7
Opcode Fuzzy Hash: 5b3318375ba08a27904bc4a7e308cc28794f53beb92be46b986ce14b1198fa71
Instruction Fuzzy Hash: 6DE0B6B3834A349FBE027F34D905449BEA9B75B7653060A5AF4052E210DB398716EB92

Uniqueness

Uniqueness Score: -1.00%

Function 6BD48C7B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe, xrefs: 6BD48CBE, 6BD48CFB

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe
API String ID: 0-2525331770
Opcode ID: 5c9314080fad8aa34872dfd4dff8306c349ad3aa5df013f3ad9e5e066b9023b4
Instruction ID: 0703daf85a48122db6eeca858684a7dcbb1304aa46b10a66b0615c8ca815df14
Opcode Fuzzy Hash: 5c9314080fad8aa34872dfd4dff8306c349ad3aa5df013f3ad9e5e066b9023b4
Instruction Fuzzy Hash: 6C419571E01614EFEB11DFADD88199EBBF8EB99770F1000A6E414AF250D7758A41DBB0

Uniqueness

Uniqueness Score: -1.00%

Function 6BD430DA Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 6BD430FF

Strings

MOC, xrefs: 6BD43111
RCC, xrefs: 6BD43119

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 5c83501ce2761ecefe1fb680c310d7d4dc71b6d537d12db3bbf0d9ea8322480e
Instruction ID: 6b292a27e3465691220d015e280d9d64bcefa44b24005b1cdf7d93db67a100cc
Opcode Fuzzy Hash: 5c83501ce2761ecefe1fb680c310d7d4dc71b6d537d12db3bbf0d9ea8322480e
Instruction Fuzzy Hash: E1418E71900209EFCF15CFA8CC81ADEBBB5FF49324F1440A9FA14AB214D7399A51EB50

Uniqueness

Uniqueness Score: -1.00%

Function 6BD408FF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 6BD33EB0: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,6BD4092E,?,?,6BD5B5E8,?,?,?,?), ref: 6BD33EB5
Part of subcall function 6BD33EB0: GetLastError.KERNEL32(?,?,6BD5B5E8,?,?,?,?), ref: 6BD33EBF

IsDebuggerPresent.KERNEL32(?,?,6BD5B5E8,?,?,?,?), ref: 6BD40932
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,6BD5B5E8,?,?,?,?), ref: 6BD40941

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 6BD4093C

Memory Dump Source

Source File: 00000002.00000002.833909137.000000006BD31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6BD30000, based on PE: true

Associated: 00000002.00000002.833891383.000000006BD30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.833973560.000000006BD53000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834001056.000000006BD5D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.834017889.000000006BD5F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bd30000_MEInstaller.jbxd

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: 22ff57bd817945ebbfbd286ea72d0e7c1ab352b4862d2163b864019c4bffed43
Instruction ID: e01cbdcd3ac0fa2c859ff480260defdcd0586e7d05ca857991f1e497dc1ff4d4
Opcode Fuzzy Hash: 22ff57bd817945ebbfbd286ea72d0e7c1ab352b4862d2163b864019c4bffed43
Instruction Fuzzy Hash: 45E06D716047118BF7719F39D504702BBE4AF063B5F00886DE49ADE200EBBCD448CB61

Uniqueness

Uniqueness Score: -1.00%

Target ID:	0
Start time:	01:51:58
Start date:	02/03/2023
Path:	C:\Users\user\Desktop\MicrosoftDefaults.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\MicrosoftDefaults.exe
Imagebase:	0xf00000
File size:	7778712 bytes
MD5 hash:	23EDDDFD3F65C753AE87F4D3CF12A215
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designersG	MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.comessedn	MEInstaller.exe, 00000002.00000003.327601065.0000000005D7F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/bThe	MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/a-e	MEInstaller.exe, 00000002.00000003.323809625.0000000005D83000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/jp/J	MEInstaller.exe, 00000002.00000003.325295970.0000000005D83000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ntp.msn.com/edge/ntp	MEInstaller.exe	false		high
http://www.tiro.com	MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.321927298.0000000005D8D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.newtonsoft.com/json	Newtonsoft.Json.dll.0.dr	false		high
http://www.fontbureau.com/designers	MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.comessed	MEInstaller.exe, 00000002.00000003.327601065.0000000005D7F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://wG.)	MEInstaller.exe, 00000002.00000003.323404229.0000000005D7D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.sajatypeworks.com	MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/i/w	MEInstaller.exe, 00000002.00000003.324926210.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324977528.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324665972.0000000005D83000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.typography.netD	MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/4	MEInstaller.exe, 00000002.00000003.324926210.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324977528.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.325295970.0000000005D83000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://en.wikipw	MEInstaller.exe, 00000002.00000003.327601065.0000000005D7F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp//	MEInstaller.exe, 00000002.00000003.324926210.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324977528.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324665972.0000000005D83000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com	MEInstaller.exe, 00000002.00000002.828248486.00000000024BE000.00000004.00000800.00020000.00000000.sdmp, MEInstaller.exe.config.0.dr	false		high
http://www.fonts.comicP	MEInstaller.exe, 00000002.00000003.320262937.0000000005D8B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.320177098.0000000005D8B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/&	MEInstaller.exe, 00000002.00000003.324926210.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324977528.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324217922.0000000005D7B000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324665972.0000000005D83000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/JamesNK/Newtonsoft.Json	MEInstaller.exe, MEInstaller.exe, 00000002.00000002.830719414.0000000004A32000.00000002.00000001.01000000.0000000A.sdmp, Newtonsoft.Json.dll.0.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0	MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	MEInstaller.exe, 00000002.00000003.327601065.0000000005D7F000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/W	MEInstaller.exe, 00000002.00000003.325874594.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.323809625.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324926210.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324977528.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324217922.0000000005D7B000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.325295970.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324665972.0000000005D83000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comF	MEInstaller.exe, 00000002.00000003.327601065.0000000005D7F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/nl-n/	MEInstaller.exe, 00000002.00000003.324217922.0000000005D7B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comico	MEInstaller.exe, 00000002.00000002.832452605.0000000005D70000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comcomd	MEInstaller.exe, 00000002.00000003.327601065.0000000005D7F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/J	MEInstaller.exe, 00000002.00000003.323809625.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324926210.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324977528.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324217922.0000000005D7B000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324665972.0000000005D83000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/tr-t	MEInstaller.exe, 00000002.00000003.324926210.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324977528.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.325295970.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324665972.0000000005D83000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/	MEInstaller.exe, 00000002.00000003.325295970.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324665972.0000000005D83000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://james.newtonking.com/projects/json	Newtonsoft.Json.dll.0.dr	false	URL Reputation: safe	unknown
http://www.fontbureau.comcomy	MEInstaller.exe, 00000002.00000003.327601065.0000000005D7F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	MEInstaller.exe, 00000002.00000003.321402262.0000000005D7D000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.monotype.	MEInstaller.exe, 00000002.00000003.326280865.0000000005D8F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	MEInstaller.exe, 00000002.00000003.324665972.0000000005D83000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/n	MEInstaller.exe, 00000002.00000003.324926210.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324977528.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.325295970.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324665972.0000000005D83000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.newtonsoft.com/jsonschema	Newtonsoft.Json.dll.0.dr	false		high
http://www.fontbureau.com/designers8	MEInstaller.exe, 00000002.00000002.832710128.0000000006F82000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.nuget.org/packages/Newtonsoft.Json.Bson	MEInstaller.exe, MEInstaller.exe, 00000002.00000002.830719414.0000000004A32000.00000002.00000001.01000000.0000000A.sdmp, Newtonsoft.Json.dll.0.dr	false		high
http://www.fontbureau.comalic	MEInstaller.exe, 00000002.00000003.327601065.0000000005D7F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/d	MEInstaller.exe, 00000002.00000003.324926210.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324977528.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324217922.0000000005D7B000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.325295970.0000000005D83000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324665972.0000000005D83000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://en.w?	MEInstaller.exe, 00000002.00000003.324162573.0000000005D90000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.323575560.0000000005D8B000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.323703070.0000000005D8B000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.323809625.0000000005D8B000.00000004.00000020.00020000.00000000.sdmp, MEInstaller.exe, 00000002.00000003.324031946.0000000005D8D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.comic$	MEInstaller.exe, 00000002.00000003.320292983.0000000005D8B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.com/designers/	MEInstaller.exe, 00000002.00000003.326705162.0000000005D90000.00000004.00000020.00020000.00000000.sdmp	false		high

Target ID:	1
Start time:	01:52:01
Start date:	02/03/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe
Imagebase:	0xf40000
File size:	126344 bytes
MD5 hash:	E40AF81D67406FDCD7A1945F5CE454D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low

Target ID:	3
Start time:	01:52:12
Start date:	02/03/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\
Imagebase:	0x7ff7de2d0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report MicrosoftDefaults.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Privilege Escalation

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\IXP000.TMP\BSvcInstaller.msi

C:\Users\user\AppData\Local\Temp\IXP000.TMP\BrowserSettingsInstaller.exe

C:\Users\user\AppData\Local\Temp\IXP000.TMP\CreateShortCut.vbs

C:\Users\user\AppData\Local\Temp\IXP000.TMP\DispatchQueue.dll

C:\Users\user\AppData\Local\Temp\IXP000.TMP\LocalizedTitles.json

C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEDefMgr.dll

C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe

C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEInstaller.exe.config

C:\Users\user\AppData\Local\Temp\IXP000.TMP\MEProgressBar.dll

C:\Users\user\AppData\Local\Temp\IXP000.TMP\Newtonsoft.Json.dll

C:\Users\user\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Windows Analysis Report
MicrosoftDefaults.exe

Function 00F07105 Relevance: 7.6, APIs: 5, Instructions: 50
timethreadCOMMON

Function 00F41150 Relevance: 43.1, APIs: 17, Strings: 7, Instructions: 1091
registrysynchronizationprocessCOMMONCrypto

Function 00F432F6 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 3
COMMON

Function 00F461D6 Relevance: 3.0, APIs: 2, Instructions: 31
COMMON

Function 00F48E6D Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Function 00F47973 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Function 00F43162 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73
COMMON

Function 00F45A27 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMONLIBRARYCODE

Function 00F46626 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Function 00F4DDBD Relevance: 1.8, APIs: 1, Instructions: 274
COMMONLIBRARYCODECrypto

Function 00F43405 Relevance: 1.6, APIs: 1, Instructions: 144
COMMON

Function 00F47DAF Relevance: 1.6, APIs: 1, Instructions: 140
COMMON

Function 00F49EE9 Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Function 00F48E3C Relevance: .0, Instructions: 22
COMMONLIBRARYCODE

Function 00F4972F Relevance: 19.6, APIs: 13, Instructions: 113
COMMONLIBRARYCODE

Function 00F4430B Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304
COMMONLIBRARYCODE

Function 00F474C1 Relevance: 15.1, APIs: 10, Instructions: 69
COMMON

Function 00F43C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120
COMMON

Function 00F49A9A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77
COMMONLIBRARYCODE

Function 00F494A7 Relevance: 10.6, APIs: 7, Instructions: 65
COMMONLIBRARYCODE

Function 00F4B589 Relevance: 9.3, APIs: 6, Instructions: 317
fileCOMMONLIBRARYCODE

Function 00F43FD4 Relevance: 9.1, APIs: 6, Instructions: 60
COMMONLIBRARYCODE

Function 00F4823C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83
COMMON

Function 00F45042 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62
COMMONLIBRARYCODE

Function 00F46668 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30
libraryloaderCOMMONLIBRARYCODE

Function 00F49406 Relevance: 7.5, APIs: 5, Instructions: 40
COMMONLIBRARYCODE

Function 00F47BC0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206
COMMON

Function 00F440B4 Relevance: 6.2, APIs: 4, Instructions: 168
COMMONLIBRARYCODE

Function 00F47AD4 Relevance: 6.1, APIs: 4, Instructions: 86
COMMON

Function 00F475D9 Relevance: 6.1, APIs: 4, Instructions: 72
COMMONLIBRARYCODE

Function 00F47730 Relevance: 6.1, APIs: 4, Instructions: 69
COMMONLIBRARYCODE

Function 00F4CA16 Relevance: 6.0, APIs: 4, Instructions: 29
COMMONLIBRARYCODE

Function 00F46CC7 Relevance: 6.0, APIs: 4, Instructions: 19
COMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre