Loading ...

Play interactive tourEdit tour

Analysis Report URGENT MEDICAL REQUIREMENT.exe

Overview

General Information

Sample Name:URGENT MEDICAL REQUIREMENT.exe
Analysis ID:339333
MD5:8272ecc1672ecb390cdedb27df85b20d
SHA1:a77c9fc2b255398f53d28f6e67633c62a0143fa5
SHA256:1a4407fd45881091495f927612c7be23ab6de71949e4192cdc58154986d2c827
Tags:exeGuLoader

Most interesting Screenshot:

Detection

GuLoader
Score:84
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected GuLoader
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Found potential dummy code loops (likely to delay analysis)
Potential time zone aware malware
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected VB6 Downloader Generic
Abnormal high CPU Usage
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Detected potential crypto function
PE file contains strange resources
Program does not show much activity (idle)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Startup

  • System is w10x64
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
Process Memory Space: URGENT MEDICAL REQUIREMENT.exe PID: 6388JoeSecurity_VB6DownloaderGenericYara detected VB6 Downloader GenericJoe Security
    Process Memory Space: URGENT MEDICAL REQUIREMENT.exe PID: 6388JoeSecurity_GuLoaderYara detected GuLoaderJoe Security

      Sigma Overview

      No Sigma rule has matched

      Signature Overview

      Click to jump to signature section

      Show All Signature Results

      AV Detection:

      barindex
      Multi AV Scanner detection for submitted fileShow sources
      Source: URGENT MEDICAL REQUIREMENT.exeVirustotal: Detection: 24%Perma Link
      Source: URGENT MEDICAL REQUIREMENT.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeProcess Stats: CPU usage > 98%
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00422C4B0_2_00422C4B
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_0042206B0_2_0042206B
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_0042526F0_2_0042526F
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004216770_2_00421677
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_0042287B0_2_0042287B
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004226000_2_00422600
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004266130_2_00426613
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004252170_2_00425217
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00427A2B0_2_00427A2B
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004224370_2_00422437
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004276340_2_00427634
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004252C00_2_004252C0
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004276D70_2_004276D7
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004222F70_2_004222F7
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00425AFF0_2_00425AFF
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00422E830_2_00422E83
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004276880_2_00427688
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004254A30_2_004254A3
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_0042274B0_2_0042274B
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00422F5F0_2_00422F5F
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_0042335D0_2_0042335D
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004229670_2_00422967
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_0042797F0_2_0042797F
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004233030_2_00423303
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00425D080_2_00425D08
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004275120_2_00427512
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_0042191B0_2_0042191B
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_0042611F0_2_0042611F
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004259370_2_00425937
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004259D30_2_004259D3
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004221D70_2_004221D7
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004275EB0_2_004275EB
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00422B830_2_00422B83
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004213AB0_2_004213AB
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004227AF0_2_004227AF
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004253AF0_2_004253AF
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00422DB30_2_00422DB3
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00421FBB0_2_00421FBB
      Source: URGENT MEDICAL REQUIREMENT.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
      Source: URGENT MEDICAL REQUIREMENT.exe, 00000000.00000002.1258460847.0000000002090000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameuser32j% vs URGENT MEDICAL REQUIREMENT.exe
      Source: URGENT MEDICAL REQUIREMENT.exe, 00000000.00000002.1257535826.0000000000410000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameHybridizers5.exe vs URGENT MEDICAL REQUIREMENT.exe
      Source: URGENT MEDICAL REQUIREMENT.exeBinary or memory string: OriginalFilenameHybridizers5.exe vs URGENT MEDICAL REQUIREMENT.exe
      Source: URGENT MEDICAL REQUIREMENT.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
      Source: classification engineClassification label: mal84.troj.evad.winEXE@1/0@0/0
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeFile created: C:\Users\user\AppData\Local\Temp\~DFE70F2CB0D79118EF.TMPJump to behavior
      Source: URGENT MEDICAL REQUIREMENT.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dllJump to behavior
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: URGENT MEDICAL REQUIREMENT.exeVirustotal: Detection: 24%

      Data Obfuscation:

      barindex
      Yara detected GuLoaderShow sources
      Source: Yara matchFile source: Process Memory Space: URGENT MEDICAL REQUIREMENT.exe PID: 6388, type: MEMORY
      Yara detected VB6 Downloader GenericShow sources
      Source: Yara matchFile source: Process Memory Space: URGENT MEDICAL REQUIREMENT.exe PID: 6388, type: MEMORY
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00405063 pushfd ; iretd 0_2_00405064
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00406863 pushfd ; iretd 0_2_0040686C
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00405E7C push esp; iretd 0_2_00405E84
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004048F3 pushfd ; iretd 0_2_00404998
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004070B3 pushfd ; iretd 0_2_004070B4
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00426CBE push eax; ret 0_2_00426CBF
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00423BD6 push esp; retf 0_2_00423BD7
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00423BF8 push esp; retf 0_2_00423BFE
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

      Malware Analysis System Evasion:

      barindex
      Contains functionality to detect hardware virtualization (CPUID execution measurement)Show sources
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_0042181B 0_2_0042181B
      Detected RDTSC dummy instruction sequence (likely for instruction hammering)Show sources
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeRDTSC instruction interceptor: First address: 00000000004265EB second address: 00000000004265EB instructions:
      Potential time zone aware malwareShow sources
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeSystem information queried: CurrentTimeZoneInformationJump to behavior
      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
      Source: URGENT MEDICAL REQUIREMENT.exeBinary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
      Tries to detect virtualization through RDTSC time measurementsShow sources
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeRDTSC instruction interceptor: First address: 00000000004265EB second address: 00000000004265EB instructions:
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeRDTSC instruction interceptor: First address: 0000000000426348 second address: 0000000000426348 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F9854B64FA8h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d cmp ch, dh 0x0000001f add edi, edx 0x00000021 cmp ah, 00000069h 0x00000024 dec dword ptr [ebp+000000F8h] 0x0000002a cmp bl, bl 0x0000002c cmp dword ptr [ebp+000000F8h], 00000000h 0x00000033 jne 00007F9854B64F85h 0x00000035 call 00007F9854B64FD8h 0x0000003a call 00007F9854B64FB8h 0x0000003f lfence 0x00000042 mov edx, dword ptr [7FFE0014h] 0x00000048 lfence 0x0000004b ret 0x0000004c mov esi, edx 0x0000004e pushad 0x0000004f rdtsc
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00421847 rdtsc 0_2_00421847
      Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
      Source: URGENT MEDICAL REQUIREMENT.exeBinary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

      Anti Debugging:

      barindex
      Found potential dummy code loops (likely to delay analysis)Show sources
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeProcess Stats: CPU usage > 90% for more than 60s
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00421847 rdtsc 0_2_00421847
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00426031 mov eax, dword ptr fs:[00000030h]0_2_00426031
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00422437 mov eax, dword ptr fs:[00000030h]0_2_00422437
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00425A39 mov eax, dword ptr fs:[00000030h]0_2_00425A39
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_0042223C mov eax, dword ptr fs:[00000030h]0_2_0042223C
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_004232E6 mov eax, dword ptr fs:[00000030h]0_2_004232E6
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_0042249A mov eax, dword ptr fs:[00000030h]0_2_0042249A
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00421F4F mov eax, dword ptr fs:[00000030h]0_2_00421F4F
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00423303 mov eax, dword ptr fs:[00000030h]0_2_00423303
      Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
      Source: URGENT MEDICAL REQUIREMENT.exe, 00000000.00000002.1258241168.0000000000C70000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
      Source: URGENT MEDICAL REQUIREMENT.exe, 00000000.00000002.1258241168.0000000000C70000.00000002.00000001.sdmpBinary or memory string: Progman
      Source: URGENT MEDICAL REQUIREMENT.exe, 00000000.00000002.1258241168.0000000000C70000.00000002.00000001.sdmpBinary or memory string: SProgram Managerl
      Source: URGENT MEDICAL REQUIREMENT.exe, 00000000.00000002.1258241168.0000000000C70000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd,
      Source: URGENT MEDICAL REQUIREMENT.exe, 00000000.00000002.1258241168.0000000000C70000.00000002.00000001.sdmpBinary or memory string: Progmanlock
      Source: C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exeCode function: 0_2_00422E83 cpuid 0_2_00422E83

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection1Virtualization/Sandbox Evasion11OS Credential DumpingSystem Time Discovery1Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
      Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsProcess Injection1LSASS MemorySecurity Software Discovery511Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or Information1Security Account ManagerVirtualization/Sandbox Evasion11SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSProcess Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA SecretsSystem Information Discovery311SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.

      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      URGENT MEDICAL REQUIREMENT.exe24%VirustotalBrowse

      Dropped Files

      No Antivirus matches

      Unpacked PE Files

      No Antivirus matches

      Domains

      No Antivirus matches

      URLs

      No Antivirus matches

      Domains and IPs

      Contacted Domains

      No contacted domains info

      Contacted IPs

      No contacted IP infos

      General Information

      Joe Sandbox Version:31.0.0 Red Diamond
      Analysis ID:339333
      Start date:13.01.2021
      Start time:21:09:25
      Joe Sandbox Product:CloudBasic
      Overall analysis duration:0h 10m 45s
      Hypervisor based Inspection enabled:false
      Report type:full
      Sample file name:URGENT MEDICAL REQUIREMENT.exe
      Cookbook file name:default.jbs
      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
      Number of analysed new started processes analysed:36
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • HCA enabled
      • EGA enabled
      • HDC enabled
      • AMSI enabled
      Analysis Mode:default
      Analysis stop reason:Timeout
      Detection:MAL
      Classification:mal84.troj.evad.winEXE@1/0@0/0
      EGA Information:Failed
      HDC Information:
      • Successful, ratio: 18% (good quality ratio 9.5%)
      • Quality average: 32.5%
      • Quality standard deviation: 34.6%
      HCA Information:Failed
      Cookbook Comments:
      • Adjust boot time
      • Enable AMSI
      • Found application associated with file extension: .exe
      • Override analysis time to 240s for sample files taking high CPU consumption
      Warnings:
      Show All
      • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, HxTsr.exe, RuntimeBroker.exe, WMIADAP.exe, MusNotifyIcon.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe

      Simulations

      Behavior and APIs

      No simulations

      Joe Sandbox View / Context

      IPs

      No context

      Domains

      No context

      ASN

      No context

      JA3 Fingerprints

      No context

      Dropped Files

      No context

      Created / dropped Files

      No created / dropped files found

      Static File Info

      General

      File type:PE32 executable (GUI) Intel 80386, for MS Windows
      Entropy (8bit):5.134415776571089
      TrID:
      • Win32 Executable (generic) a (10002005/4) 99.15%
      • Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81%
      • Generic Win/DOS Executable (2004/3) 0.02%
      • DOS Executable Generic (2002/1) 0.02%
      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
      File name:URGENT MEDICAL REQUIREMENT.exe
      File size:65536
      MD5:8272ecc1672ecb390cdedb27df85b20d
      SHA1:a77c9fc2b255398f53d28f6e67633c62a0143fa5
      SHA256:1a4407fd45881091495f927612c7be23ab6de71949e4192cdc58154986d2c827
      SHA512:e67cefef757b83d16f598b3780cdb34d604cc0cfb89aaff75f01a46d93734fd855d9dbc653dff78f254e87af193491bd3cd8db62986ec5fef64a70aabf03ee20
      SSDEEP:768:IkQzo6k3c8OPfkCdmhrvbQEGF67WCCfElQZ:pQzcsgCq/QNFUaElS
      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L...E4.T.....................0....................@................

      File Icon

      Icon Hash:f030f0c6f030b100

      Static PE Info

      General

      Entrypoint:0x401200
      Entrypoint Section:.text
      Digitally signed:false
      Imagebase:0x400000
      Subsystem:windows gui
      Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
      DLL Characteristics:
      Time Stamp:0x54C53445 [Sun Jan 25 18:21:57 2015 UTC]
      TLS Callbacks:
      CLR (.Net) Version:
      OS Version Major:4
      OS Version Minor:0
      File Version Major:4
      File Version Minor:0
      Subsystem Version Major:4
      Subsystem Version Minor:0
      Import Hash:e4e19abc2b8b3cdf6beb846e51c393a2

      Entrypoint Preview

      Instruction
      push 00401E64h
      call 00007F9854858B25h
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      xor byte ptr [eax], al
      add byte ptr [eax], al
      inc eax
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax+643D901Fh], dl
      clc
      dec ebx
      inc ebp
      mov ch, C9h
      mov bl, 38h
      pop ecx
      sub ah, byte ptr [edi+00000000h]
      add byte ptr [eax], al
      add dword ptr [eax], eax
      add byte ptr [eax], al
      jnc 00007F9854858BA6h
      outsd
      jc 00007F9854858B9Bh
      push eax
      jc 00007F9854858BA1h
      push 00000065h
      arpl word ptr [ecx+esi+00h], si
      je 00007F9854858BABh
      insb
      and byte ptr [00000020h], bh
      add bh, bh
      int3
      xor dword ptr [eax], eax
      add eax, dword ptr [645E3E9Fh]
      test ch, ch
      dec ecx
      test al, 7Eh
      pop edx
      adc al, BAh

      Data Directories

      NameVirtual AddressVirtual Size Is in Section
      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_IMPORT0xd2540x28.text
      IMAGE_DIRECTORY_ENTRY_RESOURCE0x100000x8c0.rsrc
      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
      IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x2280x20
      IMAGE_DIRECTORY_ENTRY_IAT0x10000xc4.text
      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

      Sections

      NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
      .text0x10000xc5f80xd000False0.514047475962data5.83494280245IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      .data0xe0000x11580x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
      .rsrc0x100000x8c00x1000False0.137939453125data1.31495882197IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

      Resources

      NameRVASizeTypeLanguageCountry
      RT_ICON0x103580x568GLS_BINARY_LSB_FIRST
      RT_GROUP_ICON0x103440x14data
      RT_VERSION0x100f00x254dataEnglishUnited States

      Imports

      DLLImport
      MSVBVM60.DLL__vbaCyForInit, _CIcos, _adj_fptan, __vbaFreeVar, __vbaEnd, _adj_fdiv_m64, _adj_fprem1, __vbaStrCat, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaObjSet, _adj_fdiv_m16i, _adj_fdivr_m16i, __vbaVarTstLt, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaCyI2, __vbaStrCmp, __vbaCyI4, _adj_fpatan, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaCyForNext, _CIlog, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaI4Str, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, _CIatan, __vbaStrMove, _allmul, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

      Version Infos

      DescriptionData
      Translation0x0409 0x04b0
      InternalNameHybridizers5
      FileVersion2.00
      CompanyNameAxis Corp
      CommentsAxis Corp
      ProductNameProject1
      ProductVersion2.00
      OriginalFilenameHybridizers5.exe

      Possible Origin

      Language of compilation systemCountry where language is spokenMap
      EnglishUnited States

      Network Behavior

      No network behavior found

      Code Manipulations

      Statistics

      CPU Usage

      Click to jump to process

      Memory Usage

      Click to jump to process

      High Level Behavior Distribution

      Click to dive into process behavior distribution

      System Behavior

      General

      Start time:21:10:15
      Start date:13/01/2021
      Path:C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exe
      Wow64 process (32bit):true
      Commandline:'C:\Users\user\Desktop\URGENT MEDICAL REQUIREMENT.exe'
      Imagebase:0x400000
      File size:65536 bytes
      MD5 hash:8272ECC1672ECB390CDEDB27DF85B20D
      Has elevated privileges:true
      Has administrator privileges:true
      Programmed in:Visual Basic
      Reputation:low

      Disassembly

      Code Analysis

      Reset < >

        Executed Functions

        C-Code - Quality: 52%
        			E0040CF04(signed int _a4) {
        				signed int _v8;
        				intOrPtr _v12;
        				intOrPtr _v16;
        				char _v32;
        				void* _v36;
        				signed int _v56;
        				char _v60;
        				char _v64;
        				char _v68;
        				intOrPtr _v76;
        				char _v84;
        				intOrPtr _v92;
        				signed int _v104;
        				signed int _v108;
        				signed int _v112;
        				intOrPtr _v116;
        				signed int _v120;
        				intOrPtr _v124;
        				intOrPtr _v136;
        				signed int _v140;
        				intOrPtr* _v144;
        				signed int _v148;
        				signed int _v152;
        				intOrPtr _t93;
        				char* _t94;
        				signed int _t95;
        				signed int _t102;
        				signed int _t105;
        				char* _t106;
        				signed int _t116;
        				signed int _t120;
        				signed int _t123;
        				void* _t124;
        				signed int _t139;
        				void* _t142;
        				void* _t144;
        				void* _t145;
        				intOrPtr _t146;
        
        				 *[fs:0x0] = _t146;
        				L004010E0();
        				_v16 = _t146;
        				_v12 = E004010C8;
        				_v8 = _a4 & 0x00000001;
        				_a4 = _a4 & 0x000000fe;
        				_t93 =  *((intOrPtr*)( *_a4 + 4))(_a4, _t144, _t145, _t124,  *[fs:0x0], 0x4010e6);
        				_push(0x53933);
        				L004011E2();
        				_v124 = _t93;
        				_v120 = _t139;
        				_push(1);
        				L004011DC();
        				_v116 = _t93;
        				_v112 = _t139;
        				_push(_v112);
        				_push(_v116);
        				_push(_v120);
        				_push(_v124);
        				_push(0);
        				L004011DC();
        				_push(_t139);
        				_push(_t93);
        				_t94 =  &_v32;
        				_push(_t94);
        				L004011D6();
        				_v136 = _t94;
        				while(_v136 != 0) {
        					_v76 = 0x772813;
        					_v84 = 3;
        					_t95 =  &_v84;
        					_push(_t95);
        					L004011C4();
        					L004011CA();
        					_push(_t95);
        					_push(0x402a44);
        					_push(0x402a4c);
        					L004011BE();
        					L004011CA();
        					_push(_t95);
        					_push(0x402a58);
        					L004011BE();
        					_t139 = _t95;
        					L004011CA();
        					_push(_t95);
        					L004011D0();
        					asm("sbb eax, eax");
        					_v104 =  ~( ~_t95 + 1);
        					_push( &_v64);
        					_push( &_v60);
        					_push( &_v56);
        					_push(3);
        					L004011B8();
        					_t146 = _t146 + 0x10;
        					L004011B2();
        					_t102 = _v104;
        					if(_t102 != 0) {
        						_push(0x402a60);
        						_push(0x402a68);
        						L004011BE();
        						L004011CA();
        						_push(_t102);
        						L004011A6();
        						_push(_t102);
        						L004011AC();
        						_t139 = _t102;
        						L004011CA();
        						_push(_t102);
        						_push(0x402a70);
        						L004011D0();
        						asm("sbb eax, eax");
        						_v104 =  ~( ~_t102 + 1);
        						_push( &_v60);
        						_t36 =  &_v56; // 0x402a70
        						_push(2);
        						L004011B8();
        						_t146 = _t146 + 0xc;
        						if(_v104 != 0) {
        							if( *0x40e010 != 0) {
        								_v144 = 0x40e010;
        							} else {
        								_push(0x40e010);
        								_push(0x4021d8);
        								L00401194();
        								_v144 = 0x40e010;
        							}
        							_t116 =  &_v68;
        							L0040119A();
        							_v104 = _t116;
        							_t120 =  *((intOrPtr*)( *_v104 + 0x50))(_v104,  &_v56, _t116,  *((intOrPtr*)( *((intOrPtr*)( *_v144)) + 0x304))( *_v144));
        							asm("fclex");
        							_v108 = _t120;
        							if(_v108 >= 0) {
        								_v148 = _v148 & 0x00000000;
        							} else {
        								_push(0x50);
        								_push(0x402a74);
        								_push(_v104);
        								_push(_v108);
        								L0040118E();
        								_v148 = _t120;
        							}
        							_v140 = _v56;
        							_v56 = _v56 & 0x00000000;
        							_v76 = _v140;
        							_v84 = 8;
        							_push(0);
        							_t123 =  &_v84;
        							_push(_t123); // executed
        							L004011A0(); // executed
        							_t139 = _t123;
        							L004011CA();
        							L00401188();
        							L004011B2();
        						}
        					}
        					_t105 =  *((intOrPtr*)( *_a4 + 0x2b4))(_a4);
        					asm("fclex");
        					_v104 = _t105;
        					if(_v104 >= 0) {
        						_v152 = _v152 & 0x00000000;
        					} else {
        						_push(0x2b4);
        						_push(0x40292c);
        						_push(_a4);
        						_push(_v104);
        						L0040118E();
        						_v152 = _t105;
        					}
        					_push(_v112);
        					_push(_v116);
        					_push(_v120);
        					_push(_v124);
        					_t106 =  &_v32;
        					_push(_t106);
        					L00401182();
        					_v136 = _t106;
        				}
        				_v92 = 0x1513131a;
        				_t142 =  >=  ? 0x403f1a : _t139;
        				goto __edx;
        			}









































        0x0040cf16
        0x0040cf22
        0x0040cf2a
        0x0040cf2d
        0x0040cf3a
        0x0040cf42
        0x0040cf4d
        0x0040cf50
        0x0040cf55
        0x0040cf5a
        0x0040cf5d
        0x0040cf60
        0x0040cf62
        0x0040cf67
        0x0040cf6a
        0x0040cf6d
        0x0040cf70
        0x0040cf73
        0x0040cf76
        0x0040cf79
        0x0040cf7b
        0x0040cf80
        0x0040cf81
        0x0040cf82
        0x0040cf85
        0x0040cf86
        0x0040cf8b
        0x0040d1ad
        0x0040cf96
        0x0040cf9d
        0x0040cfa4
        0x0040cfa7
        0x0040cfa8
        0x0040cfb2
        0x0040cfb7
        0x0040cfb8
        0x0040cfbd
        0x0040cfc2
        0x0040cfcc
        0x0040cfd1
        0x0040cfd2
        0x0040cfd7
        0x0040cfdc
        0x0040cfe1
        0x0040cfe6
        0x0040cfe7
        0x0040cfee
        0x0040cff3
        0x0040cffa
        0x0040cffe
        0x0040d002
        0x0040d003
        0x0040d005
        0x0040d00a
        0x0040d010
        0x0040d015
        0x0040d01b
        0x0040d021
        0x0040d026
        0x0040d02b
        0x0040d035
        0x0040d03a
        0x0040d03b
        0x0040d040
        0x0040d041
        0x0040d046
        0x0040d04b
        0x0040d050
        0x0040d051
        0x0040d056
        0x0040d05d
        0x0040d062
        0x0040d069
        0x0040d06a
        0x0040d06e
        0x0040d070
        0x0040d075
        0x0040d07e
        0x0040d08b
        0x0040d0a8
        0x0040d08d
        0x0040d08d
        0x0040d092
        0x0040d097
        0x0040d09c
        0x0040d09c
        0x0040d0cc
        0x0040d0d0
        0x0040d0d5
        0x0040d0e4
        0x0040d0e7
        0x0040d0e9
        0x0040d0f0
        0x0040d10c
        0x0040d0f2
        0x0040d0f2
        0x0040d0f4
        0x0040d0f9
        0x0040d0fc
        0x0040d0ff
        0x0040d104
        0x0040d104
        0x0040d116
        0x0040d11c
        0x0040d126
        0x0040d129
        0x0040d130
        0x0040d132
        0x0040d135
        0x0040d136
        0x0040d13b
        0x0040d140
        0x0040d148
        0x0040d150
        0x0040d150
        0x0040d07e
        0x0040d15d
        0x0040d163
        0x0040d165
        0x0040d16c
        0x0040d18b
        0x0040d16e
        0x0040d16e
        0x0040d173
        0x0040d178
        0x0040d17b
        0x0040d17e
        0x0040d183
        0x0040d183
        0x0040d192
        0x0040d195
        0x0040d198
        0x0040d19b
        0x0040d19e
        0x0040d1a1
        0x0040d1a2
        0x0040d1a7
        0x0040d1a7
        0x0040d1ba
        0x0040d1c9
        0x0040d1cc

        APIs
        • __vbaChkstk.MSVBVM60(?,004010E6), ref: 0040CF22
        • __vbaCyI4.MSVBVM60(00053933,?,?,?,?,004010E6), ref: 0040CF55
        • __vbaCyI2.MSVBVM60(00000001,00053933,?,?,?,?,004010E6), ref: 0040CF62
        • __vbaCyI2.MSVBVM60(00000000,?,?,?,?,00000001,00053933,?,?,?,?,004010E6), ref: 0040CF7B
        • __vbaCyForInit.MSVBVM60(?,00000000,?,00000000,?,?,?,?,00000001,00053933,?,?,?,?,004010E6), ref: 0040CF86
        • #591.MSVBVM60(00000003), ref: 0040CFA8
        • __vbaStrMove.MSVBVM60(00000003), ref: 0040CFB2
        • __vbaStrCat.MSVBVM60(00402A4C,00402A44,00000000,00000003), ref: 0040CFC2
        • __vbaStrMove.MSVBVM60(00402A4C,00402A44,00000000,00000003), ref: 0040CFCC
        • __vbaStrCat.MSVBVM60(00402A58,00000000,00402A4C,00402A44,00000000,00000003), ref: 0040CFD7
        • __vbaStrMove.MSVBVM60(00402A58,00000000,00402A4C,00402A44,00000000,00000003), ref: 0040CFE1
        • __vbaStrCmp.MSVBVM60(00000000,00402A58,00000000,00402A4C,00402A44,00000000,00000003), ref: 0040CFE7
        • __vbaFreeStrList.MSVBVM60(00000003,?,?,00000000,00000000,00402A58,00000000,00402A4C,00402A44,00000000,00000003), ref: 0040D005
        • __vbaFreeVar.MSVBVM60(?,?,?,004010E6), ref: 0040D010
        • __vbaStrCat.MSVBVM60(00402A68,00402A60,?,?,?,004010E6), ref: 0040D02B
        • __vbaStrMove.MSVBVM60(00402A68,00402A60,?,?,?,004010E6), ref: 0040D035
        • __vbaI4Str.MSVBVM60(00000000,00402A68,00402A60,?,?,?,004010E6), ref: 0040D03B
        • #537.MSVBVM60(00000000,00000000,00402A68,00402A60,?,?,?,004010E6), ref: 0040D041
        • __vbaStrMove.MSVBVM60(00000000,00000000,00402A68,00402A60,?,?,?,004010E6), ref: 0040D04B
        • __vbaStrCmp.MSVBVM60(00402A70,00000000,00000000,00000000,00402A68,00402A60,?,?,?,004010E6), ref: 0040D056
        • __vbaFreeStrList.MSVBVM60(00000002,p*@,?,00402A70,00000000,00000000,00000000,00402A68,00402A60,?,?,?,004010E6), ref: 0040D070
        • __vbaNew2.MSVBVM60(004021D8,0040E010,00000000,00402A68,00402A60,?,?,?,004010E6), ref: 0040D097
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040D0D0
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1257430657.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1257400809.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1257509895.000000000040E000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1257535826.0000000000410000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$Move$Free$List$#537#591ChkstkInitNew2
        • String ID: `*@$p*@
        • API String ID: 1504116222-2315792387
        • Opcode ID: a47e2da3a3e018320e5cf544e5c7e5680035788907d8bb20acb3264a6b109b26
        • Instruction ID: f6fd0eb29363eb1605864dcf9e0a4ba6ac710850f91799b19080a3aa9bdca146
        • Opcode Fuzzy Hash: a47e2da3a3e018320e5cf544e5c7e5680035788907d8bb20acb3264a6b109b26
        • Instruction Fuzzy Hash: 68811671E00208AFDB15EFE1CD46B9DBBB9BF08304F10457AB605BB2A1DB785A45CB58
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 75%
        			_entry_(signed int __eax, void* __ebx, void* __edx, intOrPtr* __edi, signed int __esi) {
        				intOrPtr* _t26;
        				signed int _t27;
        				signed char _t30;
        				void* _t31;
        				intOrPtr* _t37;
        				void* _t39;
        				intOrPtr* _t40;
        				intOrPtr* _t42;
        				signed int _t43;
        				signed int _t47;
        				void* _t49;
        
        				_t43 = __esi;
        				_t42 = __edi;
        				_t39 = __edx;
        				_push("VB5!6&*"); // executed
        				L004011FA(); // executed
        				 *__eax =  *__eax + __eax;
        				 *__eax =  *__eax + __eax;
        				 *__eax =  *__eax + __eax;
        				 *__eax =  *__eax ^ __eax;
        				 *__eax =  *__eax + __eax;
        				_t26 = __eax + 1;
        				 *_t26 =  *_t26 + _t26;
        				 *_t26 =  *_t26 + _t26;
        				 *_t26 =  *_t26 + _t26;
        				 *((intOrPtr*)(_t26 + 0x643d901f)) =  *((intOrPtr*)(_t26 + 0x643d901f)) + __edx;
        				asm("clc");
        				_pop(_t37);
        				_t27 = _t26 -  *__edi;
        				 *_t27 =  *_t27 + _t27;
        				 *_t27 =  *_t27 + _t27;
        				 *_t27 =  *_t27 + _t27;
        				_t49 =  *_t27;
        				if(_t49 >= 0) {
        					L7:
        					 *0x00000043 =  *0x00000043 + _t27;
        					__eflags =  *0x00000043;
        					goto L8;
        				} else {
        					asm("outsd");
        					if(_t49 < 0) {
        						 *_t27 =  *_t27 + _t27;
        						 *_t27 =  *_t27 + _t27;
        						_t5 = _t27 + 0x4300000b;
        						 *_t5 =  *(_t27 + 0x4300000b) + 0x38;
        						__eflags =  *_t5;
        						goto L7;
        					} else {
        						_push(_t27);
        						if(_t49 < 0) {
        							L8:
        							_t27 = _t27 |  *_t27;
        							 *_t27 =  *_t27 + _t27;
        							__eflags =  *_t27;
        							asm("adc al, [eax]");
        							if(__eflags < 0) {
        								goto L15;
        							} else {
        								asm("arpl [ebp+0x70], sp");
        								if(__eflags == 0) {
        									goto L16;
        								} else {
        									asm("outsd");
        									asm("outsb");
        									if(__eflags >= 0) {
        										goto L17;
        									} else {
        										_t43 =  *0x000000AC * 0x6569726f;
        										__eflags = _t43;
        										goto L12;
        									}
        								}
        							}
        							goto L19;
        						} else {
        							_push(0x65);
        							asm("arpl [ecx+esi], si");
        							if(_t49 == 0) {
        								L12:
        								if(__eflags < 0) {
        									asm("outsd");
        									if(__eflags >= 0) {
        										 *[gs:0x41000801] =  *[gs:0x41000801] + _t37;
        										asm("insb");
        										asm("bound ebp, [ecx+0x7a]");
        										_t47 =  *(_t37 + 0x33) * 0x11900;
        										_t40 = _t39 + 1;
        										 *_t40 =  *_t40 + _t27;
        										 *0x38 =  *0x38 + _t47;
        										asm("out dx, al");
        										_t30 = _t27 |  *_t27;
        										 *((intOrPtr*)(_t47 + _t43 * 2)) =  *((intOrPtr*)(_t47 + _t43 * 2)) + _t37;
        										_t39 = _t40 + _t30;
        										_t27 = _t30 |  *_t30;
        										 *_t27 =  *_t27 + _t27;
        										 *_t37 =  *_t37 + _t27;
        										 *_t37 =  *_t37 + _t27;
        										 *_t27 =  *_t27 + _t39;
        										asm("adc [eax], al");
        										 *_t37 =  *_t37 + _t27;
        										 *_t27 =  *_t27 + _t37;
        										 *((intOrPtr*)(_t27 + 5)) =  *((intOrPtr*)(_t27 + 5)) + _t37;
        										 *_t27 =  *_t27 + _t27;
        										_push(ss);
        										 *_t27 =  *_t27 + _t27;
        										 *_t27 =  *_t27 + _t37;
        										 *_t27 =  *_t27 + _t27;
        										 *_t27 =  *_t27 + _t39;
        										 *_t27 =  *_t27 + _t27;
        										 *_t27 =  *_t27 + _t27;
        										 *_t27 =  *_t27 + _t27;
        										 *_t37 =  *_t37 + _t27;
        										 *_t27 =  *_t27 + _t37;
        										 *_t27 =  *_t27 + _t27;
        										 *_t27 =  *_t27 + _t27;
        										 *_t27 =  *_t27 + _t27;
        										 *_t27 =  *_t27 + _t27;
        										 *_t27 =  *_t27 + _t27;
        										 *_t27 =  *_t27 + _t27;
        										 *_t27 =  *_t27 + _t27;
        										__eflags =  *_t27;
        										L15:
        										 *_t27 =  *_t27 + _t27;
        										 *_t27 =  *_t27 + _t27;
        										 *_t27 =  *_t27 + _t27;
        										 *_t27 =  *_t27 + _t27;
        										 *_t27 =  *_t27 + _t27;
        										__eflags =  *_t27;
        										L16:
        										 *_t27 =  *_t27 + _t27;
        										 *_t27 =  *_t27 + _t27;
        										__eflags =  *_t27;
        										L17:
        										 *_t27 =  *_t27 + _t27;
        										_t17 = _t42 - 0x5eff6061;
        										 *_t17 =  *(_t42 - 0x5eff6061) + 0x38;
        										__eflags =  *_t17;
        									}
        									asm("movsd");
        									asm("movsd");
        									_t19 = _t39 - 0x4dff5556;
        									 *_t19 =  *(_t39 - 0x4dff5556) + _t37;
        									__eflags =  *_t19;
        								}
        								L19:
        								asm("stosb");
        								asm("stosb");
        								asm("stosb");
        								 *((intOrPtr*)(_t39 - 0x4bff4d4e)) =  *((intOrPtr*)(_t39 - 0x4bff4d4e)) + _t39;
        								_t23 = _t43 - 0x3cff4142;
        								 *_t23 =  *(_t43 - 0x3cff4142) + 0x38;
        								__eflags =  *_t23;
        								return 0xb4;
        							} else {
        								asm("insb");
        								 *[gs:0x20] =  *[gs:0x20] & 0x00000038;
        								asm("int3");
        								 *_t27 =  *_t27 ^ _t27;
        								_t31 = _t27 +  *0x645e3e9f;
        								asm("adc al, 0xba");
        								asm("invalid");
        								asm("adc al, 0xa1");
        								return _t31;
        							}
        						}
        					}
        				}
        			}














        0x00401200
        0x00401200
        0x00401200
        0x00401200
        0x00401205
        0x0040120a
        0x0040120c
        0x0040120e
        0x00401210
        0x00401212
        0x00401214
        0x00401215
        0x00401217
        0x00401219
        0x0040121b
        0x00401221
        0x00401229
        0x0040122a
        0x00401230
        0x00401232
        0x00401234
        0x00401234
        0x00401236
        0x004012ac
        0x004012ac
        0x004012ac
        0x00000000
        0x00401238
        0x00401238
        0x00401239
        0x004012a4
        0x004012a6
        0x004012a8
        0x004012a8
        0x004012a8
        0x00000000
        0x0040123b
        0x0040123b
        0x0040123d
        0x004012ae
        0x004012ae
        0x004012b0
        0x004012b0
        0x004012b2
        0x004012b4
        0x00000000
        0x004012b6
        0x004012b6
        0x004012b9
        0x00000000
        0x004012bb
        0x004012bb
        0x004012bc
        0x004012bd
        0x00000000
        0x004012bf
        0x004012bf
        0x004012bf
        0x00000000
        0x004012bf
        0x004012bd
        0x004012b9
        0x00000000
        0x0040123f
        0x0040123f
        0x00401241
        0x00401245
        0x004012c0
        0x004012c0
        0x004012c2
        0x004012c3
        0x004012c5
        0x004012cc
        0x004012cd
        0x004012d0
        0x004012d7
        0x004012d8
        0x004012da
        0x004012dc
        0x004012dd
        0x004012df
        0x004012e3
        0x004012e5
        0x004012e7
        0x004012e9
        0x004012eb
        0x004012ed
        0x004012ef
        0x004012f1
        0x004012f3
        0x004012f5
        0x004012f8
        0x004012fa
        0x004012fb
        0x004012fd
        0x004012ff
        0x00401301
        0x00401303
        0x00401305
        0x00401307
        0x00401309
        0x0040130b
        0x0040130d
        0x0040130f
        0x00401311
        0x00401313
        0x00401315
        0x00401317
        0x00401319
        0x00401319
        0x0040131b
        0x0040131b
        0x0040131d
        0x0040131f
        0x00401321
        0x00401323
        0x00401323
        0x00401324
        0x00401324
        0x00401326
        0x00401326
        0x00401327
        0x00401327
        0x00401329
        0x00401329
        0x00401329
        0x00401329
        0x00401333
        0x00401334
        0x00401335
        0x00401335
        0x00401335
        0x00401335
        0x00401336
        0x00401336
        0x00401337
        0x00401338
        0x00401339
        0x00401341
        0x00401341
        0x00401341
        0x00401347
        0x00401247
        0x00401247
        0x00401248
        0x00401251
        0x00401252
        0x00401254
        0x00401260
        0x00401262
        0x00401266
        0x00401268
        0x00401268
        0x00401245
        0x0040123d
        0x00401239

        APIs
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1257430657.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1257400809.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1257509895.000000000040E000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1257535826.0000000000410000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: #100
        • String ID: VB5!6&*
        • API String ID: 1341478452-3593831657
        • Opcode ID: 84779a57640e14afeb788456cb5c5b5b8d3a10b2e3b862d13816138e7ff8f07f
        • Instruction ID: 6c785548ce27b7335b6fae382d587ed1ec1d2f38020562f4bd2f9d3df2a9ae30
        • Opcode Fuzzy Hash: 84779a57640e14afeb788456cb5c5b5b8d3a10b2e3b862d13816138e7ff8f07f
        • Instruction Fuzzy Hash: 2651FD2554E3C08FCB039B3099762817FB06E27224B4E45EBC891DF5F3D66D980AC766
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        • VirtualAlloc.KERNELBASE(00000000,0000C000,-00000A13), ref: 004041DA
        Memory Dump Source
        • Source File: 00000000.00000002.1257430657.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1257400809.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1257509895.000000000040E000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1257535826.0000000000410000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: 0cb8d6aef863af3ad15a7a95731ce31a798064c5ad3f2ac121fb83cb5336bd30
        • Instruction ID: 2433b9a6f09b68a2a809dbf862e9491bcca07b257b0351067f593adb13c85d38
        • Opcode Fuzzy Hash: 0cb8d6aef863af3ad15a7a95731ce31a798064c5ad3f2ac121fb83cb5336bd30
        • Instruction Fuzzy Hash: B211D092A4B35D2BD7248EF448841927FD4DE53D413601CAFD684EA2C7D85D9156C284
        Uniqueness

        Uniqueness Score: -1.00%

        Non-executed Functions

        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID: P7J$QY5<$j@h$NG$^D
        • API String ID: 0-1229891403
        • Opcode ID: 4c373b8393693aa67e765a5b9d0c5d10936a1fc76e3012b2016ff7e0857fc229
        • Instruction ID: c8a826117fcd8f3e1843b0f0a1be486bf0c56c605dda11a6899863d8884ea550
        • Opcode Fuzzy Hash: 4c373b8393693aa67e765a5b9d0c5d10936a1fc76e3012b2016ff7e0857fc229
        • Instruction Fuzzy Hash: A4D16770740309BFFF201E54ED56BDA3672AF42754FA4811AFE849B281D3BD88C59709
        Uniqueness

        Uniqueness Score: -1.00%

        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID: QY5<$j@h$NG
        • API String ID: 0-1829309596
        • Opcode ID: 91cde6795a838efb7a1d17c22ad2b61d970f7fd38d76fc5f382e03a635fd6afb
        • Instruction ID: 2c5ba2095208b222ab9166f95cf7eb14a61af99fd2d570adc94aad324631121e
        • Opcode Fuzzy Hash: 91cde6795a838efb7a1d17c22ad2b61d970f7fd38d76fc5f382e03a635fd6afb
        • Instruction Fuzzy Hash: E79156707403197BEF211E28ED857DA7B62AF05754FA4412AFE809B282C3FD99C98709
        Uniqueness

        Uniqueness Score: -1.00%

        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID: QY5<$j@h$NG
        • API String ID: 0-1829309596
        • Opcode ID: 566d70fafb9963670bd2b5d53a0f2ebf34076bfad59973fef7c1ec80002ae73f
        • Instruction ID: 8b6f379997976415e6a5cb33e4222ebffbf9deb0aff64d3d5b9cd3e771f02ceb
        • Opcode Fuzzy Hash: 566d70fafb9963670bd2b5d53a0f2ebf34076bfad59973fef7c1ec80002ae73f
        • Instruction Fuzzy Hash: CE813270740209BBFF211E28ED957DA7B62AF05354FA4452AFE809B285C3FD89D9C709
        Uniqueness

        Uniqueness Score: -1.00%

        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID: QY5<$j@h$NG
        • API String ID: 0-1829309596
        • Opcode ID: ebeade990dfe0525a142ff7b9a660959d422564406624e088aa8158fa2b10ff3
        • Instruction ID: f36d99d8499fd00e3800b3c422c30ec1bc03c991698705cc90924ad05ddd1cc3
        • Opcode Fuzzy Hash: ebeade990dfe0525a142ff7b9a660959d422564406624e088aa8158fa2b10ff3
        • Instruction Fuzzy Hash: A6514B707403547BEF321E28EE557DA3A62AF11354F98441AFE809B286C3FD49D9D709
        Uniqueness

        Uniqueness Score: -1.00%

        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID: QY5<$j@h
        • API String ID: 0-2743440188
        • Opcode ID: 4a1e30ad8c7cce819017da62a3a7bfd9dff61845f86e752a8609b693f5e44639
        • Instruction ID: a8187dadbf899592b8ef52f97be79337d94bb06e05a4528d85141c3df8e1f33e
        • Opcode Fuzzy Hash: 4a1e30ad8c7cce819017da62a3a7bfd9dff61845f86e752a8609b693f5e44639
        • Instruction Fuzzy Hash: 2D416670740254ABEF225E68EE947DA7B62AF12320F98542AFEC04B142C3BD49D9D709
        Uniqueness

        Uniqueness Score: -1.00%

        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID: H$~
        • API String ID: 0-3349002487
        • Opcode ID: d3f48040199280cb5c94e0edc4d94db5060531651536ee8390d3e73d9ae7c501
        • Instruction ID: d8e6526f3de0771acd3505dc7e3ff4c4a2779ab0a000b417f550be887c928d35
        • Opcode Fuzzy Hash: d3f48040199280cb5c94e0edc4d94db5060531651536ee8390d3e73d9ae7c501
        • Instruction Fuzzy Hash: 0221F58074B6D266DF215B78A1242977F809F2F364F8A2CDBD5C52A13381AC89C9C64E
        Uniqueness

        Uniqueness Score: -1.00%

        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID: `
        • API String ID: 0-1850852036
        • Opcode ID: 588dc2b189fb5daf3b4d88f1b24f49c23fea120aaf44c38cfecb3f01ad8f14f9
        • Instruction ID: 1708c3da72d4b1e0bf8a52f9ca6940e0291bda8406d3ef12be2b3786e50658a7
        • Opcode Fuzzy Hash: 588dc2b189fb5daf3b4d88f1b24f49c23fea120aaf44c38cfecb3f01ad8f14f9
        • Instruction Fuzzy Hash: FB212834B422A187EF34153CE0663EB6B529F133B0FDB505FCD850718BDA6D58AE860A
        Uniqueness

        Uniqueness Score: -1.00%

        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID: _8
        • API String ID: 0-1159081775
        • Opcode ID: 0e1444bee18a3e59e5c3c3ee1ca924ce182d560e7399b0e30f7bf265f5f9c4d0
        • Instruction ID: 6cb639f21c4288110afcdf30a67a18e945c75f97eb2ee76520d60be489723dde
        • Opcode Fuzzy Hash: 0e1444bee18a3e59e5c3c3ee1ca924ce182d560e7399b0e30f7bf265f5f9c4d0
        • Instruction Fuzzy Hash: 93112714B47AE05BAF21667C60A939BBE00AE12770BD924ABE5804B1068539485FC709
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 31a6d0b8be9b17676305f0234e47f08111a775ba713688ecb8626ce4fd2a9d40
        • Instruction ID: 60b7243efb5827af3fd57f121d185fdaf95cac593729706097e77b06549cb1e5
        • Opcode Fuzzy Hash: 31a6d0b8be9b17676305f0234e47f08111a775ba713688ecb8626ce4fd2a9d40
        • Instruction Fuzzy Hash: E5B1E804B4B9D092DF31BB78F0141A7BB10DE2B720BDE2CC7E4860A127997C8DD9C64A
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: dc731939b0320ea59fc13d98fc1f95bf39689aa9ba4c8a21fbfde8b7905ef5df
        • Instruction ID: e78658673aea31c8e6273d346da422452fbbcb94015f48d2a61836b29afade09
        • Opcode Fuzzy Hash: dc731939b0320ea59fc13d98fc1f95bf39689aa9ba4c8a21fbfde8b7905ef5df
        • Instruction Fuzzy Hash: 84815C31340722EFD7189F28ED91BD673A1FF05350F98432AEC9983281CB79A895CB95
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: b250444e2741f91a00820a491ac6d8fdf36c5042e8c3f8b4b226d6e593b8c99c
        • Instruction ID: 129ea7057fccf11ec4077eb5021acebc47bc29f147b440953c89866ff267013b
        • Opcode Fuzzy Hash: b250444e2741f91a00820a491ac6d8fdf36c5042e8c3f8b4b226d6e593b8c99c
        • Instruction Fuzzy Hash: 1D516B2070D2629FEF255A78E4583AFB7819F12370FD955ABC5818B692D32C4CC9C60E
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 690dca2d8e9d8502b7610516e3ac1272d7b4fd49c4ef185106f97e0fa3014684
        • Instruction ID: 2114de6bcc944d292db35310b94c1fc4f1e5dd3c7e2d05452bed48a2c6fd8d89
        • Opcode Fuzzy Hash: 690dca2d8e9d8502b7610516e3ac1272d7b4fd49c4ef185106f97e0fa3014684
        • Instruction Fuzzy Hash: 7951830474B9D082DF32EB7CF014097BB10AD277A0BDE3CD7E9811A26795B84D99CA4E
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 06b90f5893477f5d7c3b033f3434696cef1e48a66f28a03f3bc58cc8ab6df978
        • Instruction ID: 86c70737645e369459762ce202473a95a0f8f223cefb76860493b09a4a136969
        • Opcode Fuzzy Hash: 06b90f5893477f5d7c3b033f3434696cef1e48a66f28a03f3bc58cc8ab6df978
        • Instruction Fuzzy Hash: B651682070E6628AEF35567CE05839B77419F02370FEC65ABC5818B293D26C49DEC70E
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: ebe3445688bdff0e1c61a26ff8d045c0a4c1897115c91fb60f54d5c579d50759
        • Instruction ID: 919155cac2716a7b9adcecfa27e5656edf51643f193dfafe964e29e512e9d368
        • Opcode Fuzzy Hash: ebe3445688bdff0e1c61a26ff8d045c0a4c1897115c91fb60f54d5c579d50759
        • Instruction Fuzzy Hash: 6B51D40474B9E0C2DF32AB7CF0581977F10AE23760BCD38C7D4815A29799BC4949CA2E
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 58db52ff88710a5b9c76ebe83d1d678266d7232911801dd4c45186e117fceca4
        • Instruction ID: 72a3fa54e403ff7a1e8dff0b260aee13a22660519adbd675a9afb1068e838196
        • Opcode Fuzzy Hash: 58db52ff88710a5b9c76ebe83d1d678266d7232911801dd4c45186e117fceca4
        • Instruction Fuzzy Hash: E651592070E5628EEF255A3CE4583AB7741DF12370FE955ABC9818B292D32C4CC9C64E
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: f9bf2dfc567fb26c996f582edbfe8061e459c438b0114d5019a844e796c06f22
        • Instruction ID: 2b94cc7c2c8ce508efc58d78f9676dc8e73c41d257be588e0896c2fef98273bb
        • Opcode Fuzzy Hash: f9bf2dfc567fb26c996f582edbfe8061e459c438b0114d5019a844e796c06f22
        • Instruction Fuzzy Hash: D1415C30784370BBEB217E38AA557E777A1AF01760FD8455BED814B192C79C8889C60A
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: f1e8aef83ba895933f0ccd13e4077063b515dad57d9f4b4072c55fdc33c1be56
        • Instruction ID: ef8eab73c925b4c3cb031a09651d429a4c45b93bd1f27ac2a54093ee8a086cb9
        • Opcode Fuzzy Hash: f1e8aef83ba895933f0ccd13e4077063b515dad57d9f4b4072c55fdc33c1be56
        • Instruction Fuzzy Hash: 3F41462070D662CFEF255A7CE0583AB3B419F12370FE965ABC5818B292D36C48D9C70E
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 784db44e8bccf2a65dc3e891569bff7f25c08f7ec2a2b6665701551ae78a3ec9
        • Instruction ID: f698c46c744a28bb06d434d48faeba4acf62ddba8afa1a90b679914720dc6baa
        • Opcode Fuzzy Hash: 784db44e8bccf2a65dc3e891569bff7f25c08f7ec2a2b6665701551ae78a3ec9
        • Instruction Fuzzy Hash: 35417A30700721EFDB159F38EA907E7B7A0BF05310F9A4267E89483256C37C6859CB99
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 026c06a9f9b54af1c59d8d57fa6d8f635aad5fd0ac86a4e0471649264a2fbe91
        • Instruction ID: 36f5512a8966e01aecbc878417eee6c1f7d2fc3b4eb743ec82f37590f1773b8c
        • Opcode Fuzzy Hash: 026c06a9f9b54af1c59d8d57fa6d8f635aad5fd0ac86a4e0471649264a2fbe91
        • Instruction Fuzzy Hash: 45319D21745351ABDB14A53CED657D72750AF12370FA902ABECD0C7187D68D884EC319
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 1ee4dbc40ce930a7963b0a65353e9bd475599b72dc7cee0df2ee326b5af06168
        • Instruction ID: 1d9bfa8a2f24c58fdd8b8b8525790d01654d1194b7c478af55eaa2b78e3ea58d
        • Opcode Fuzzy Hash: 1ee4dbc40ce930a7963b0a65353e9bd475599b72dc7cee0df2ee326b5af06168
        • Instruction Fuzzy Hash: E7412970344310EFEB256E34DD59BD973A1AF01794FA4415AED468B1E2C7BCC984CA0A
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 1b999eb9fb24000ad085c2de3fcfcd01b5284a6988bda02e50c78c704e0d5062
        • Instruction ID: 0ec02b8b993b196ebf3e8cbcdcc44c89f81bdb13c4a8e41349ccad856f573859
        • Opcode Fuzzy Hash: 1b999eb9fb24000ad085c2de3fcfcd01b5284a6988bda02e50c78c704e0d5062
        • Instruction Fuzzy Hash: D7416E30745751EBEB258B3CE9907D3B790BF06350F9C41ABDA8087247C7AC58A9C759
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 6946f9a97940e196f6312b41856a8dfafda94e575bb05c95a43d85cf2d053693
        • Instruction ID: 8ca3a7efb3940ea22460a96c6762fbb0fe134fd0a9a035c3e7526b8a2bc052c1
        • Opcode Fuzzy Hash: 6946f9a97940e196f6312b41856a8dfafda94e575bb05c95a43d85cf2d053693
        • Instruction Fuzzy Hash: 4F314931740722AFDB18AE2CDD61BD633A5BF113B0F95432AECD8D3681DB29D84A8644
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 519334dc7ea504f2e37f971dafc9eef6913b905d88f6f3b6d0498332be536a92
        • Instruction ID: ec3d070254b9ea22b3cfbe1f965264f4376615816440cdc8be800b18757cc27b
        • Opcode Fuzzy Hash: 519334dc7ea504f2e37f971dafc9eef6913b905d88f6f3b6d0498332be536a92
        • Instruction Fuzzy Hash: 85F01D05B8F2E067EF2262BCA058057FF509C1767039E28E7E2809BA4B844C09DED31E
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: b0f91d0c9058187029c39349ca49d56db65fcd27684a6c0e2bfe3ff85a7346b5
        • Instruction ID: 850b655495b504464409a770a5d307cd15a6d9c42db7b551e991e3a98296511c
        • Opcode Fuzzy Hash: b0f91d0c9058187029c39349ca49d56db65fcd27684a6c0e2bfe3ff85a7346b5
        • Instruction Fuzzy Hash: D83148307452947BDF215A38FA903D77B72BF02320F995497F9848B116C2AD49EAE709
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: c63c96df0ae3b0b8840af0439db5b1ca346b17b89e28fd03ebe617f28e09aad4
        • Instruction ID: 4a4195816ea51a1544d67a7af468cc244ba2235b40322cfd1ad824255191b9ef
        • Opcode Fuzzy Hash: c63c96df0ae3b0b8840af0439db5b1ca346b17b89e28fd03ebe617f28e09aad4
        • Instruction Fuzzy Hash: 9A31B160B4E391CFEB254B78A15839BBB90AF52330F99A49BD8404B157D32C49D9CB09
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 9701444d2080822904deef6f5438a2df63a30a6c26be89381d321d0ea9aa52fe
        • Instruction ID: 009c6afd1e87d00cdf66cdcc5953633d92e3cf9166500eea0f86480dd34e6540
        • Opcode Fuzzy Hash: 9701444d2080822904deef6f5438a2df63a30a6c26be89381d321d0ea9aa52fe
        • Instruction Fuzzy Hash: 79215B20786370B7EF316A38AA547977751AF02720FD85497ED814B1938ADC49CED60D
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 807cf5abcaa7d9a3030ee7b34d8aa556eccbd686941a4151ec07779e582a96ff
        • Instruction ID: cdd65bb87277e46d6095e2a6c5d510d0ac0304bf0e537b7bd69e269985603798
        • Opcode Fuzzy Hash: 807cf5abcaa7d9a3030ee7b34d8aa556eccbd686941a4151ec07779e582a96ff
        • Instruction Fuzzy Hash: 9E315A147493D09BFF32AA38B8117DB3F526F21320F990497ECC44B563922C0A89D60A
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 5bb79f704964379f3d323c02dc706e3139b8f677dcebcbe7007d219ff23d6b22
        • Instruction ID: 313e059080f7edcf0801277d9a667bdaafc00cfdf367bf1d44cf8ac3ec3edaef
        • Opcode Fuzzy Hash: 5bb79f704964379f3d323c02dc706e3139b8f677dcebcbe7007d219ff23d6b22
        • Instruction Fuzzy Hash: 7C115905B4A2D017EF12D97C609425B6E705D23A32BAD68EBE980CB207D94C4F9ED30A
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 5f0b2abf419bdf54063437a65b81e40fcd03cf0c29e78dccd5f60f5761b8b225
        • Instruction ID: fe31722f8608713ec7cc200103d4a89695ae74ed94da6f2945a601a15afe57e9
        • Opcode Fuzzy Hash: 5f0b2abf419bdf54063437a65b81e40fcd03cf0c29e78dccd5f60f5761b8b225
        • Instruction Fuzzy Hash: 58219D11B021859ADF326F79EC11BE9372AEF63740FD5089EEC99091B6EB3884C0C659
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 83b8fce2f692b2a3bdfb13123dcac1396aa2202be7143d142812cd93ac2bd615
        • Instruction ID: 698331bfeecd386fd4d5b6c0d7e31ef298ee199430d9f9481e5f84ae6f43be00
        • Opcode Fuzzy Hash: 83b8fce2f692b2a3bdfb13123dcac1396aa2202be7143d142812cd93ac2bd615
        • Instruction Fuzzy Hash: B831B11478E2E28BFB225A7CA05425FBB406E13730BAC68DFE6805F14BD6584A9DC70D
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: ae9da4ca935eaef229431f20f92338809ad59c2d063984715cb680083ff248b6
        • Instruction ID: cbcc772fc371ed6f634a0d71a90c577731008b35ea4650f9becc5fbe7b7fe6af
        • Opcode Fuzzy Hash: ae9da4ca935eaef229431f20f92338809ad59c2d063984715cb680083ff248b6
        • Instruction Fuzzy Hash: DB21073074A2E1ABEB32457CB4683937F605F13364F9F11BBD4814729795884CDAC74A
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 4f10c20f134e8299cb725f62dd1c582db3dbecee8b9207c076cb45a2b1845c23
        • Instruction ID: 086d809c226977f47200036e25900b1bd7ba6cf8eb850c0e35e28be39350cab9
        • Opcode Fuzzy Hash: 4f10c20f134e8299cb725f62dd1c582db3dbecee8b9207c076cb45a2b1845c23
        • Instruction Fuzzy Hash: 3A31E8B4306760ABDF345929A344313B7D09F1E750F9806AFC5D616696C3ED88C9C60E
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 9e67bd8fd650aa68426a495402067aef817d2c02f61b58db50b45667f7a90dcd
        • Instruction ID: 506158f3090cdd306379457d92c8fcc3acc02457792981fabc1a408d7fb3900d
        • Opcode Fuzzy Hash: 9e67bd8fd650aa68426a495402067aef817d2c02f61b58db50b45667f7a90dcd
        • Instruction Fuzzy Hash: C9212C2074D3D15BEF71967CA5842537F40BF52724F9C51EFD4818B24BC69C848AC709
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: de3fc316ee1cd2545042fc46b347b2ffc778f1b0968b2aed99beca885cfbae93
        • Instruction ID: 91767b032b213bde5a36f490183333142de9a5b4c10ccf4610f57056df5dbdd6
        • Opcode Fuzzy Hash: de3fc316ee1cd2545042fc46b347b2ffc778f1b0968b2aed99beca885cfbae93
        • Instruction Fuzzy Hash: 8B115C51B862D547EF32193CA8A439B3B505F33760FA81497E541CB267D25849CDC30E
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 44bb438c0a2918d5dde2540950063ec88df11c9f7f2238fcb77d1a3a87131bb0
        • Instruction ID: e90f8ccbfdb7300e4c4e7b85925dc3054388bd588f36d84b3acf4be3d90798a1
        • Opcode Fuzzy Hash: 44bb438c0a2918d5dde2540950063ec88df11c9f7f2238fcb77d1a3a87131bb0
        • Instruction Fuzzy Hash: EE11D81474A3A1A7DB12567CFA90BA37B50AF02360F9C14A7DA414B14BC29C08BED71A
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 159f427fc0e177dd36c5d09d19af0b0d260eb182f3636a7c4235610fde4923d3
        • Instruction ID: 81faa15542931e868c243b91986d64c9551168b4d582c34d8903ae02bd840ab0
        • Opcode Fuzzy Hash: 159f427fc0e177dd36c5d09d19af0b0d260eb182f3636a7c4235610fde4923d3
        • Instruction Fuzzy Hash: 5811E61474A2D087FF21D97CA4943536B609F13361F9D14F7E9818B507C94C8F5EC609
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 8b9ac9fa9d1d79464d5a3d585e51b49a702e59a5443ae6405c6530ae2479110a
        • Instruction ID: 0bf417929d376b476010576893c2425d14f8887cddf95c3ac18bfa9d05f2852f
        • Opcode Fuzzy Hash: 8b9ac9fa9d1d79464d5a3d585e51b49a702e59a5443ae6405c6530ae2479110a
        • Instruction Fuzzy Hash: C0110A24B52AB043EF21653CB058257BB90EA22370BDD946BD9C287306E17D4C9AC74C
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 291a15337feb0bd62a8826320be9c069363217c8cb173374c344f239788ba600
        • Instruction ID: 65ef0fa4f4586c366f0ef05ffa69868efc9527fd004aeb31d66b1e06c591a71a
        • Opcode Fuzzy Hash: 291a15337feb0bd62a8826320be9c069363217c8cb173374c344f239788ba600
        • Instruction Fuzzy Hash: 14016B04B8BAE0C3DF26957CF494317AF405D23224B9C64EBD082CF687D4AD845ECB2A
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 7966efc97ea74993c7d952c7c8f716b287eb952b9488ded29d4963110074d1ab
        • Instruction ID: 5a6e5bd7fcf8313fb0bbeb8a083d8366b3656f6ab28400cdf37623e5b21b150c
        • Opcode Fuzzy Hash: 7966efc97ea74993c7d952c7c8f716b287eb952b9488ded29d4963110074d1ab
        • Instruction Fuzzy Hash: 1B11E00064F3D06BEF235638A658153BF309E536B4BAE24E7E0808F16B88CC095EC71A
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: f0af91b209608e816e8d03409e43fd4dd1156901e905feb993b9d25796c237b3
        • Instruction ID: 5d05985417e813a57baba79143065c7610ab5a03f8bc5a931585d645019241ed
        • Opcode Fuzzy Hash: f0af91b209608e816e8d03409e43fd4dd1156901e905feb993b9d25796c237b3
        • Instruction Fuzzy Hash: 6B01D895B4BBE1C2BF15917CB0E51AB7B508E2263179C64AFD1C28720BD06848DED60D
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 6963a10d10884d4ba10e02dca259dcf30229a16b111e4918dd7e8c7698206cb7
        • Instruction ID: aed6d4683181a17b59c561709f2b188f067000134ff0b03c58fa1bb79e812ee1
        • Opcode Fuzzy Hash: 6963a10d10884d4ba10e02dca259dcf30229a16b111e4918dd7e8c7698206cb7
        • Instruction Fuzzy Hash: 8501B504B4A9D0C7DF62967CE4D4257BF409D2372478D24E7D1815F29BC468485DCB2A
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 23bc4969097dd244425a4a919eb86c75deb990507a020992c917b7a8a0d9fb96
        • Instruction ID: 6bd4eec5ff35151f1ae580652022a86ae2bd5e286fe71364332b6f2fe30dd636
        • Opcode Fuzzy Hash: 23bc4969097dd244425a4a919eb86c75deb990507a020992c917b7a8a0d9fb96
        • Instruction Fuzzy Hash: F8017114B4B2E05BDF22567CA85459F7F509D2377476E28EBE4C05B127808D0DAED709
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 8fba1c15f5d74e8de5398b631363ce05d9798860d2471660c19365475a95804d
        • Instruction ID: e1104c8d2a710e7763e859635896b6a03ecc618035499ec9d9f23d6dcedcdbb8
        • Opcode Fuzzy Hash: 8fba1c15f5d74e8de5398b631363ce05d9798860d2471660c19365475a95804d
        • Instruction Fuzzy Hash: C6F04495B865E0C7EF21567CF444197BB40AF06730B9838D7E2858B21B94B80DEED60D
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 9733a174a693919f4d848b7f8eb42c763a2c281fbb5c2af398305e7dfff3fb77
        • Instruction ID: 0947515afd001d30c04b03e61c2c49506a15553d407b895cf98219d82da2aa3f
        • Opcode Fuzzy Hash: 9733a174a693919f4d848b7f8eb42c763a2c281fbb5c2af398305e7dfff3fb77
        • Instruction Fuzzy Hash: 88F0B470300712CFD614CA18D5E0F9733A6AF16750F968157EC40872A1C728DC84EA1A
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 59f5fd4b6290118eea1bd64cf1ca4ba3be8f583fd68eaff7a3eb614a18e1a64b
        • Instruction ID: 1a1c9803a2b19fe71609677537cdd08e6402abf0aa556fcd534304c575544b53
        • Opcode Fuzzy Hash: 59f5fd4b6290118eea1bd64cf1ca4ba3be8f583fd68eaff7a3eb614a18e1a64b
        • Instruction Fuzzy Hash: 9CC08C323006008FE392CBAAC380B8077E0FF4AA90BD040D8AA2087605C2A8E54086A0
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 11561a390b39e8dc332480078c054f9b4121279fa5a9a8e9615c595202cbae1b
        • Instruction ID: 79c9c5a150c315921718d4a9ed29af55b95d162c321976ba2d0707776181b09f
        • Opcode Fuzzy Hash: 11561a390b39e8dc332480078c054f9b4121279fa5a9a8e9615c595202cbae1b
        • Instruction Fuzzy Hash: 45C048BAB815828FEB01EA08C891B8073B1F724684FC804A0E842CBB91C328ED40CA00
        Uniqueness

        Uniqueness Score: -1.00%

        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID: P7J$QY5<$j@h$NG
        • API String ID: 0-2040537592
        • Opcode ID: bd476e2ff37c2136435bb4cb3b04a145e7c966336204b14fa67af9bbd3426039
        • Instruction ID: e1d16b84a88d780c0983382ca5892219393248d0030487d2fed47dd269c88fc0
        • Opcode Fuzzy Hash: bd476e2ff37c2136435bb4cb3b04a145e7c966336204b14fa67af9bbd3426039
        • Instruction Fuzzy Hash: D4B1677074030A6FEB211E24ED56BDA3772BF42754FA4812AFE849B291D3BC88C5C709
        Uniqueness

        Uniqueness Score: -1.00%

        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1257559800.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID: P7J$QY5<$j@h$NG
        • API String ID: 0-2040537592
        • Opcode ID: 07769925a5c3876b26c5c4c5583c05788b0c561a6392ae08b3e6ec7164bf15cb
        • Instruction ID: 2ada83d6b96956cdc348fe08058e9e3792fef2c6a79c3d43b0dc85f44ac6487a
        • Opcode Fuzzy Hash: 07769925a5c3876b26c5c4c5583c05788b0c561a6392ae08b3e6ec7164bf15cb
        • Instruction Fuzzy Hash: 8EA132B074030AAFEB211E24ED55BDA7772AF02354F94852AFD849B291D7BC88C5CB49
        Uniqueness

        Uniqueness Score: -1.00%