Loading ...

Play interactive tourEdit tour

Analysis Report Remodeller8.exe

Overview

General Information

Sample Name:Remodeller8.exe
Analysis ID:384221
MD5:147eeed85d599916758d6bba7d86b434
SHA1:15a85b8d36ec5baeac941a32450026d610358961
SHA256:60bc4eef19e2c547add07b45bdbd4aeb00ca75fe7269cac5fa71a8ceb87e5cb9
Tags:exeGuLoader
Infos:

Most interesting Screenshot:

Detection

GuLoader
Score:72
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected GuLoader
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Found potential dummy code loops (likely to delay analysis)
Machine Learning detection for sample
Tries to detect virtualization through RDTSC time measurements
Abnormal high CPU Usage
Contains functionality for execution timing, often used to detect debuggers
Creates a DirectInput object (often for capturing keystrokes)
Detected potential crypto function
PE file contains an invalid checksum
PE file contains strange resources
Program does not show much activity (idle)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Startup

  • System is w10x64
  • Remodeller8.exe (PID: 6860 cmdline: 'C:\Users\user\Desktop\Remodeller8.exe' MD5: 147EEED85D599916758D6BBA7D86B434)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000001.00000002.847967336.0000000000530000.00000040.00000001.sdmpJoeSecurity_GuLoaderYara detected GuLoaderJoe Security

    Sigma Overview

    No Sigma rule has matched

    Signature Overview

    Click to jump to signature section

    Show All Signature Results

    AV Detection:

    barindex
    Multi AV Scanner detection for submitted fileShow sources
    Source: Remodeller8.exeVirustotal: Detection: 52%Perma Link
    Source: Remodeller8.exeReversingLabs: Detection: 56%
    Machine Learning detection for sampleShow sources
    Source: Remodeller8.exeJoe Sandbox ML: detected
    Source: Remodeller8.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
    Source: Remodeller8.exe, 00000001.00000002.848068433.00000000006CA000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
    Source: C:\Users\user\Desktop\Remodeller8.exeProcess Stats: CPU usage > 98%
    Source: C:\Users\user\Desktop\Remodeller8.exeCode function: 1_2_0040905F1_2_0040905F
    Source: C:\Users\user\Desktop\Remodeller8.exeCode function: 1_2_004090A71_2_004090A7
    Source: Remodeller8.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
    Source: Remodeller8.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
    Source: Remodeller8.exe, 00000001.00000002.848261257.0000000002370000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameuser32j% vs Remodeller8.exe
    Source: Remodeller8.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
    Source: classification engineClassification label: mal72.troj.evad.winEXE@1/0@0/0
    Source: C:\Users\user\Desktop\Remodeller8.exeFile created: C:\Users\user\AppData\Local\Temp\~DFB617D45F1B8ED128.TMPJump to behavior
    Source: Remodeller8.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
    Source: C:\Users\user\Desktop\Remodeller8.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dllJump to behavior
    Source: C:\Users\user\Desktop\Remodeller8.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: Remodeller8.exeVirustotal: Detection: 52%
    Source: Remodeller8.exeReversingLabs: Detection: 56%

    Data Obfuscation:

    barindex
    Yara detected GuLoaderShow sources
    Source: Yara matchFile source: 00000001.00000002.847967336.0000000000530000.00000040.00000001.sdmp, type: MEMORY
    Source: Remodeller8.exeStatic PE information: real checksum: 0x1ec6a should be: 0x2826d
    Source: C:\Users\user\Desktop\Remodeller8.exeCode function: 1_2_0040201B pushfd ; ret 1_2_00402054
    Source: C:\Users\user\Desktop\Remodeller8.exeCode function: 1_2_004040CB pushfd ; retf 1_2_004040CD
    Source: C:\Users\user\Desktop\Remodeller8.exeCode function: 1_2_00408083 push ebx; ret 1_2_00408084
    Source: C:\Users\user\Desktop\Remodeller8.exeCode function: 1_2_00405086 push ds; retf 1_2_0040508F
    Source: C:\Users\user\Desktop\Remodeller8.exeCode function: 1_2_00403168 pushfd ; retf 1_2_00403169
    Source: C:\Users\user\Desktop\Remodeller8.exeCode function: 1_2_00403E66 pushfd ; ret 1_2_00403E6C
    Source: C:\Users\user\Desktop\Remodeller8.exeCode function: 1_2_0040BB37 push 7600FFCEh; iretd 1_2_0040BB3C
    Source: C:\Users\user\Desktop\Remodeller8.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

    Malware Analysis System Evasion:

    barindex
    Detected RDTSC dummy instruction sequence (likely for instruction hammering)Show sources
    Source: C:\Users\user\Desktop\Remodeller8.exeRDTSC instruction interceptor: First address: 00000000005362CD second address: 00000000005362CD instructions:
    Tries to detect virtualization through RDTSC time measurementsShow sources
    Source: C:\Users\user\Desktop\Remodeller8.exeRDTSC instruction interceptor: First address: 000000000040926C second address: 000000000040926C instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, 31h 0x00000005 packsswb mm5, mm1 0x00000008 pcmpgtw xmm2, xmm3 0x0000000c psrlq xmm1, 0Fh 0x00000011 packssdw mm2, mm4 0x00000014 pxor mm1, mm4 0x00000017 fcomp st(0), st(2) 0x00000019 jmp 00007F09007A6E5Ch 0x0000001b cmp eax, 20h 0x0000001e cmp eax, 000000FBh 0x00000023 cmp ebx, 00000090h 0x00000029 cmp ebx, 000000C3h 0x0000002f cmp ebx, 000000A1h 0x00000035 cmp ebx, 00000090h 0x0000003b cmp ebx, 52h 0x0000003e cmp edi, 02EAFF40h 0x00000044 psrad xmm7, xmm6 0x00000048 paddb xmm5, xmm0 0x0000004c fsqrt 0x0000004e pause 0x00000050 fsubp st(6), st(0) 0x00000052 fld1 0x00000054 jmp 00007F09007A6E5Dh 0x00000056 movd mm1, ebx 0x00000059 movd mm1, ebx 0x0000005c movd mm1, ebx 0x0000005f movd mm1, ebx 0x00000062 jne 00007F09007A6C4Dh 0x00000068 inc edi 0x00000069 cmp ebx, 000000ACh 0x0000006f cmp ebx, 40h 0x00000072 cmp ebx, 4Eh 0x00000075 cmp ebx, 26h 0x00000078 xchg esi, esi 0x0000007a fpatan 0x0000007c punpckhbw mm7, mm3 0x0000007f movd xmm3, ebx 0x00000083 wait 0x00000084 wait 0x00000085 pcmpeqd xmm3, xmm0 0x00000089 jmp 00007F09007A6E5Dh 0x0000008b cmp ebx, 000000E7h 0x00000091 cmp eax, 000000D5h 0x00000096 cmp eax, 000000F4h 0x0000009b cmp eax, 3Bh 0x0000009e cmp eax, 000000ACh 0x000000a3 cmp ebx, 000000B2h 0x000000a9 rdtsc
    Source: C:\Users\user\Desktop\Remodeller8.exeRDTSC instruction interceptor: First address: 00000000005362CD second address: 00000000005362CD instructions:
    Source: C:\Users\user\Desktop\Remodeller8.exeRDTSC instruction interceptor: First address: 0000000000533353 second address: 0000000000533353 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F0900793425h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d test cl, 00000017h 0x00000020 pop ecx 0x00000021 jmp 00007F090079341Ah 0x00000023 cmp bx, 41F8h 0x00000028 cmp eax, ecx 0x0000002a add edi, edx 0x0000002c dec ecx 0x0000002d cmp ecx, 00000000h 0x00000030 jne 00007F09007933C7h 0x00000032 test dx, dx 0x00000035 test ah, dh 0x00000037 push ecx 0x00000038 cld 0x00000039 test ah, ah 0x0000003b call 00007F0900793462h 0x00000040 call 00007F0900793435h 0x00000045 lfence 0x00000048 mov edx, dword ptr [7FFE0014h] 0x0000004e lfence 0x00000051 ret 0x00000052 mov esi, edx 0x00000054 pushad 0x00000055 rdtsc
    Source: C:\Users\user\Desktop\Remodeller8.exeCode function: 1_2_0040905F rdtsc 1_2_0040905F
    Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected

    Anti Debugging:

    barindex
    Found potential dummy code loops (likely to delay analysis)Show sources
    Source: C:\Users\user\Desktop\Remodeller8.exeProcess Stats: CPU usage > 90% for more than 60s
    Source: C:\Users\user\Desktop\Remodeller8.exeCode function: 1_2_0040905F rdtsc 1_2_0040905F
    Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
    Source: Remodeller8.exe, 00000001.00000002.848153018.0000000000E50000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
    Source: Remodeller8.exe, 00000001.00000002.848153018.0000000000E50000.00000002.00000001.sdmpBinary or memory string: Progman
    Source: Remodeller8.exe, 00000001.00000002.848153018.0000000000E50000.00000002.00000001.sdmpBinary or memory string: &Program Manager
    Source: Remodeller8.exe, 00000001.00000002.848153018.0000000000E50000.00000002.00000001.sdmpBinary or memory string: Progmanlock

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection1Virtualization/Sandbox Evasion11Input Capture1Security Software Discovery31Remote ServicesInput Capture1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsProcess Injection1LSASS MemoryVirtualization/Sandbox Evasion11Remote Desktop ProtocolArchive Collected Data1Exfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or Information1Security Account ManagerProcess Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSSystem Information Discovery21Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.

    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    Remodeller8.exe53%VirustotalBrowse
    Remodeller8.exe56%ReversingLabsWin32.Trojan.GuLoader
    Remodeller8.exe100%Joe Sandbox ML

    Dropped Files

    No Antivirus matches

    Unpacked PE Files

    No Antivirus matches

    Domains

    No Antivirus matches

    URLs

    No Antivirus matches

    Domains and IPs

    Contacted Domains

    No contacted domains info

    Contacted IPs

    No contacted IP infos

    General Information

    Joe Sandbox Version:31.0.0 Emerald
    Analysis ID:384221
    Start date:08.04.2021
    Start time:18:53:53
    Joe Sandbox Product:CloudBasic
    Overall analysis duration:0h 6m 56s
    Hypervisor based Inspection enabled:false
    Report type:full
    Sample file name:Remodeller8.exe
    Cookbook file name:default.jbs
    Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
    Number of analysed new started processes analysed:20
    Number of new started drivers analysed:0
    Number of existing processes analysed:0
    Number of existing drivers analysed:0
    Number of injected processes analysed:0
    Technologies:
    • HCA enabled
    • EGA enabled
    • HDC enabled
    • AMSI enabled
    Analysis Mode:default
    Analysis stop reason:Timeout
    Detection:MAL
    Classification:mal72.troj.evad.winEXE@1/0@0/0
    EGA Information:Failed
    HDC Information:
    • Successful, ratio: 97.1% (good quality ratio 37%)
    • Quality average: 20.9%
    • Quality standard deviation: 30.2%
    HCA Information:Failed
    Cookbook Comments:
    • Adjust boot time
    • Enable AMSI
    • Found application associated with file extension: .exe
    • Override analysis time to 240s for sample files taking high CPU consumption
    Warnings:
    Show All
    • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe

    Simulations

    Behavior and APIs

    No simulations

    Joe Sandbox View / Context

    IPs

    No context

    Domains

    No context

    ASN

    No context

    JA3 Fingerprints

    No context

    Dropped Files

    No context

    Created / dropped Files

    No created / dropped files found

    Static File Info

    General

    File type:PE32 executable (GUI) Intel 80386, for MS Windows
    Entropy (8bit):5.623110196923232
    TrID:
    • Win32 Executable (generic) a (10002005/4) 99.15%
    • Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81%
    • Generic Win/DOS Executable (2004/3) 0.02%
    • DOS Executable Generic (2002/1) 0.02%
    • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
    File name:Remodeller8.exe
    File size:110592
    MD5:147eeed85d599916758d6bba7d86b434
    SHA1:15a85b8d36ec5baeac941a32450026d610358961
    SHA256:60bc4eef19e2c547add07b45bdbd4aeb00ca75fe7269cac5fa71a8ceb87e5cb9
    SHA512:dfeeb831eac7d1e2f1f806cac44271a031f3457a8a844a2388cbcfa702c376dc8a98cbf5842bdc950eb70be123ff4cac15189d4b31942c6f96936e5f34d8b75d
    SSDEEP:1536:c11KYD/YRqwXvKQeCPd2vL2M/FPVm9vyIhyEDPVm9vDd2Mf2v:YKawq2vKQJP18VmHsEzVmy
    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L......Y.................0...................@....@................

    File Icon

    Icon Hash:c0c6f2e0e4fefe3f

    Static PE Info

    General

    Entrypoint:0x4013e8
    Entrypoint Section:.text
    Digitally signed:false
    Imagebase:0x400000
    Subsystem:windows gui
    Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
    DLL Characteristics:
    Time Stamp:0x59EB0BB4 [Sat Oct 21 08:56:20 2017 UTC]
    TLS Callbacks:
    CLR (.Net) Version:
    OS Version Major:4
    OS Version Minor:0
    File Version Major:4
    File Version Minor:0
    Subsystem Version Major:4
    Subsystem Version Minor:0
    Import Hash:d1ed0dda3501483d16a7ad09b76f3b08

    Entrypoint Preview

    Instruction
    push 004111D8h
    call 00007F0900AA8AE3h
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    xor byte ptr [eax], al
    add byte ptr [eax], al
    inc eax
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add dh, dh
    mov byte ptr [ecx+0Eh], bh
    shl dword ptr [ebx-0044BAFCh], 13h
    mov dword ptr [00F560B8h], eax
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [ecx], al
    add byte ptr [eax], al
    add byte ptr [edx+00h], al
    push es
    push eax
    add dword ptr [ecx], 53h
    jns 00007F0900AA8B5Eh
    insb
    outsd
    imul esi, dword ptr [bp+di+61h], 6E6F6974h
    add byte ptr [ebx], cl
    add eax, dword ptr [eax]
    add byte ptr [eax], al
    add bh, bh
    int3
    xor dword ptr [eax], eax
    or ebp, ebp
    and dl, byte ptr [bp+di-2Dh]
    pop ecx
    inc ebx
    inc esi
    xchg eax, ebx
    push edi
    dec edx
    test eax, edx
    mov byte ptr [edi-03h], ch
    or al, 79h
    sal byte ptr [eax+32h], 1
    mov dword ptr [esi-73h], eax
    xchg eax, ebp
    mov bp, 593Bh
    insb
    test dword ptr [edx], edi
    dec edi
    lodsd
    xor ebx, dword ptr [ecx-48EE309Ah]
    or al, 00h
    stosb
    add byte ptr [eax-2Dh], ah
    xchg eax, ebx
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    pushfd
    cld
    add byte ptr [eax], al
    retf
    cli
    add byte ptr [eax], al
    add byte ptr [ebx], dl
    add byte ptr [ebp+6Dh], al
    bound esp, dword ptr [ebp+64h]
    jnc 00007F0900AA8B57h
    imul esi, dword ptr [ebx+61h], 6Dh
    imul ebp, dword ptr [esi+65h], 73656E72h
    aaa

    Data Directories

    NameVirtual AddressVirtual Size Is in Section
    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
    IMAGE_DIRECTORY_ENTRY_IMPORT0x136040x28.text
    IMAGE_DIRECTORY_ENTRY_RESOURCE0x160000x5c42.rsrc
    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
    IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x2280x20
    IMAGE_DIRECTORY_ENTRY_IAT0x10000x108.text
    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

    Sections

    NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
    .text0x10000x12aac0x13000False0.417878803454data6.02715738089IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
    .data0x140000x117c0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
    .rsrc0x160000x5c420x6000False0.35986328125data5.27314891378IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

    Resources

    NameRVASizeTypeLanguageCountry
    RT_ICON0x1ad9a0xea8data
    RT_ICON0x1a4f20x8a8data
    RT_ICON0x19f8a0x568GLS_BINARY_LSB_FIRST
    RT_ICON0x179e20x25a8dBase III DBT, version number 0, next free block index 40
    RT_ICON0x1693a0x10a8data
    RT_ICON0x164d20x468GLS_BINARY_LSB_FIRST
    RT_GROUP_ICON0x164780x5adata
    RT_VERSION0x161e00x298dataGuaraniParaguay

    Imports

    DLLImport
    MSVBVM60.DLL_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaLineInputStr, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, _adj_fprem1, __vbaHresultCheckObj, __vbaLenBstrB, _adj_fdiv_m32, __vbaAryDestruct, __vbaOnError, _adj_fdiv_m16i, _adj_fdivr_m16i, __vbaFpR8, __vbaVarTstLt, _CIsin, __vbaChkstk, __vbaFileClose, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, __vbaAryConstruct2, __vbaObjVar, _adj_fpatan, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaFileOpen, __vbaNew2, __vbaR8Str, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, _adj_fdivr_m32, _adj_fdiv_r, __vbaLateMemCall, __vbaVarAdd, __vbaVarDup, __vbaFpI4, _CIatan, __vbaStrMove, _allmul, _CItan, _CIexp, __vbaFreeStr, __vbaFreeObj

    Version Infos

    DescriptionData
    Translation0x0474 0x04b0
    InternalNameRemodeller8
    FileVersion1.00
    CompanyNamePana-sonic
    CommentsPana-sonic
    ProductNamePana-sonic
    ProductVersion1.00
    FileDescriptionPana-sonic
    OriginalFilenameRemodeller8.exe

    Possible Origin

    Language of compilation systemCountry where language is spokenMap
    GuaraniParaguay

    Network Behavior

    No network behavior found

    Code Manipulations

    Statistics

    CPU Usage

    Click to jump to process

    Memory Usage

    Click to jump to process

    System Behavior

    General

    Start time:18:54:41
    Start date:08/04/2021
    Path:C:\Users\user\Desktop\Remodeller8.exe
    Wow64 process (32bit):true
    Commandline:'C:\Users\user\Desktop\Remodeller8.exe'
    Imagebase:0x400000
    File size:110592 bytes
    MD5 hash:147EEED85D599916758D6BBA7D86B434
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Visual Basic
    Yara matches:
    • Rule: JoeSecurity_GuLoader, Description: Yara detected GuLoader, Source: 00000001.00000002.847967336.0000000000530000.00000040.00000001.sdmp, Author: Joe Security
    Reputation:low

    Disassembly

    Code Analysis

    Reset < >

      Executed Functions

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID: 1$2$a$s${
      • API String ID: 4275171209-3929318983
      • Opcode ID: ee297323e25110bf810be2d6b3e52c582bde16d6ee0eb770c7d5dafc89aff2ac
      • Instruction ID: a4f83c31090e95399bc6a78909e32e3d4c50dab0c822ae4d8f0b8e2509562cfb
      • Opcode Fuzzy Hash: ee297323e25110bf810be2d6b3e52c582bde16d6ee0eb770c7d5dafc89aff2ac
      • Instruction Fuzzy Hash: AA52F181A2B70259EFB32020C5D075DA281DF16745F318F37DC61F69E2AB2F8ACA1597
      Uniqueness

      Uniqueness Score: -1.00%

      C-Code - Quality: 40%
      			E0040905F(intOrPtr* __eax, void* __ecx, void* __edx, void* __esi) {
      				signed int _t6;
      				signed int _t7;
      				signed int _t8;
      
      				L0:
      				while(1) {
      					L0:
      					_pop(_t8);
      					asm("clc");
      					asm("loopne 0x76");
      					 *__eax =  *__eax + __eax;
      					asm("sbb eax, [eax]");
      					 *_t8 =  *_t8 + _t8;
      					 *__eax =  *__eax + __eax;
      					asm("sbb eax, [eax]");
      					 *_t8 =  *_t8 + _t8;
      					 *__eax =  *__eax + __eax;
      					asm("sbb eax, [eax]");
      					 *_t8 =  *_t8 + _t8;
      					 *__eax =  *__eax + __eax;
      					asm("sbb eax, [eax]");
      					 *_t8 =  *_t8 + _t8;
      					asm("fidivr dword [edx+0x6dc8210a]");
      					asm("lock mov ecx, 0xb3e75bc5");
      					asm("insb");
      					asm("movsb");
      					asm("sbb [ebx], cl");
      					_t6 = _t8;
      					asm("pushfd");
      					asm("rcl byte [edx+ecx*2+0x6c], cl");
      					if( *_t8 > 0) {
      						break;
      					}
      					L1:
      					_t7 = _t6 | 0x74e0f85b;
      				}
      				L2:
      				asm("in al, 0x3f");
      				 *((intOrPtr*)(__ecx - 0x3f)) =  *((intOrPtr*)(__ecx - 0x3f)) + _t7;
      				asm("adc dl, dh");
      				asm("xlatb");
      				return _t7;
      			}






      0x0040905f
      0x0040905f
      0x0040905f
      0x0040905f
      0x00409060
      0x00409061
      0x00409063
      0x00409065
      0x00409067
      0x00409069
      0x0040906b
      0x0040906d
      0x0040906f
      0x00409071
      0x00409073
      0x00409075
      0x00409077
      0x00409079
      0x0040907c
      0x00409083
      0x0040908a
      0x0040908b
      0x0040908c
      0x0040908e
      0x00409090
      0x00409091
      0x00409095
      0x00000000
      0x00000000
      0x0040905e
      0x0040905e
      0x0040905e
      0x00409097
      0x00409097
      0x0040909c
      0x0040909f
      0x004090a1
      0x004090a4

      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 9241dca59c340bdb26e97f123545de23d30eedbf3d8d498cc892c0d331ca9d3c
      • Instruction ID: 39c8886344b0c9bc433617b5432f821e7c83b37458cc2725d48073dd5dbf4448
      • Opcode Fuzzy Hash: 9241dca59c340bdb26e97f123545de23d30eedbf3d8d498cc892c0d331ca9d3c
      • Instruction Fuzzy Hash: FB522291A2B70249EFB32120C5D075DA280DF16745F318F37D861F69E2EB1F8ACA1697
      Uniqueness

      Uniqueness Score: -1.00%

      C-Code - Quality: 66%
      			E004129FC(void* __ebx, void* __edi, void* __esi, long long __fp0, signed int _a4, intOrPtr _a20) {
      				void* _v3;
      				char _v8;
      				intOrPtr _v16;
      				signed int _v20;
      				intOrPtr _v24;
      				intOrPtr _v28;
      				void* _v52;
      				char _v68;
      				short _v72;
      				char _v80;
      				short _v84;
      				void* _v88;
      				long long _v96;
      				char _v100;
      				char _v104;
      				char _v120;
      				signed int _v124;
      				signed int _v128;
      				char _v136;
      				char _v140;
      				void* _v144;
      				char _v148;
      				char _v156;
      				signed int _v160;
      				signed int _v164;
      				signed int _v188;
      				signed int _v192;
      				signed int _v196;
      				signed int _v200;
      				signed int _t144;
      				signed int _t166;
      				signed int _t177;
      				signed int _t182;
      				signed int _t188;
      				char* _t191;
      				char* _t193;
      				intOrPtr* _t195;
      				char* _t212;
      				void* _t218;
      				void* _t221;
      				intOrPtr _t222;
      
      				_t222 = _t221 - 0x18;
      				 *[fs:0x0] = _t222;
      				L00401260();
      				_v28 = _t222;
      				_v24 = 0x401118;
      				_v20 = _a4 & 0x00000001;
      				_t144 = _a4 & 0xfffffffe;
      				_a4 = _t144;
      				_v16 = 0;
      				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x401266, _t218);
      				_v8 = 1;
      				_v8 = 2;
      				asm("fldz");
      				L004012D8();
      				L0040137A();
      				asm("fcomp qword [0x4011a8]");
      				asm("fnstsw ax");
      				asm("sahf");
      				if(_t144 != 0) {
      					_v8 = 3;
      					_v8 = 4;
      					_v128 = L"Rosenstokkesegedesm";
      					_v136 = 8;
      					L0040136E();
      					_push(2);
      					_push( &_v120);
      					L00401374();
      					_v96 = __fp0;
      					L004013C2();
      				}
      				_v8 = 6;
      				L00401362();
      				L00401368();
      				L004013B6();
      				L004013C2();
      				_v8 = 7;
      				 *((intOrPtr*)( *_a4 + 0x708))(_a4,  &_v156,  &_v120,  &_v120);
      				_v80 = _v156;
      				_v8 = 8;
      				_v140 = 0x3fc5;
      				L0040135C();
      				_v156 =  *0x4011a0;
      				_v80 =  *0x401198;
      				 *((intOrPtr*)( *_a4 + 0x70c))(_a4,  &_v156,  &_v104,  &_v104,  &_v140,  &_v148);
      				_v100 = _v148;
      				L004013AA();
      				_v8 = 9;
      				_v148 = 0x76e32;
      				_t166 =  *((intOrPtr*)( *_a4 + 0x6fc))(_a4,  &_v148, 0x67c7,  &_v140);
      				_v160 = _t166;
      				if(_v160 >= 0) {
      					_v188 = _v188 & 0x00000000;
      				} else {
      					_push(0x6fc);
      					_push(0x41186c);
      					_push(_a4);
      					_push(_v160);
      					L00401356();
      					_v188 = _t166;
      				}
      				_v72 = _v140;
      				_v8 = 0xa;
      				 *((intOrPtr*)( *_a4 + 0x710))(_a4);
      				_v8 = 0xb;
      				_v156 =  *0x401190;
      				_v148 = 0x3ac53e;
      				_v140 = 0x3fc5;
      				_t177 =  *((intOrPtr*)( *_a4 + 0x700))(_a4,  &_v140,  &_v148, 0x2802,  &_v156, 0x33164f, 0x5bf3,  &_v144);
      				_v160 = _t177;
      				if(_v160 >= 0) {
      					_v192 = _v192 & 0x00000000;
      				} else {
      					_push(0x700);
      					_push(0x41186c);
      					_push(_a4);
      					_push(_v160);
      					L00401356();
      					_v192 = _t177;
      				}
      				_v84 = _v144;
      				_v8 = 0xc;
      				L00401350();
      				_v8 = 0xd;
      				_t182 =  *((intOrPtr*)( *_a4 + 0x1b8))(_a4,  &_v140, 0xffffffff);
      				asm("fclex");
      				_v160 = _t182;
      				if(_v160 >= 0) {
      					_v196 = _v196 & 0x00000000;
      				} else {
      					_push(0x1b8);
      					_push(0x41183c);
      					_push(_a4);
      					_push(_v160);
      					L00401356();
      					_v196 = _t182;
      				}
      				_t188 =  *((intOrPtr*)( *_a4 + 0x1bc))(_a4, 0);
      				asm("fclex");
      				_v164 = _t188;
      				if(_v164 >= 0) {
      					_v200 = _v200 & 0x00000000;
      				} else {
      					_push(0x1bc);
      					_push(0x41183c);
      					_push(_a4);
      					_push(_v164);
      					L00401356();
      					_v200 = _t188;
      				}
      				_v8 = 0xe;
      				_v128 = _v128 & 0x00000000;
      				_v124 = _v124 & 0x00000000;
      				_v136 = 6;
      				L0040134A();
      				while(1) {
      					_v8 = 0x10;
      					_v128 = 1;
      					_v136 = 2;
      					_push( &_v68);
      					_push( &_v136);
      					_t191 =  &_v120;
      					_push(_t191);
      					L00401344();
      					_t212 = _t191;
      					L0040134A();
      					_v8 = 0x11;
      					_v128 = 0x2ffff;
      					_v136 = 0x8003;
      					_push( &_v68);
      					_t193 =  &_v136;
      					_push(_t193);
      					L0040133E();
      					if(_t193 == 0) {
      						break;
      					}
      				}
      				_v8 = 0x14;
      				_v128 = 0xff8ac236;
      				do {
      					_t212 = _t212 + 1;
      				} while (_t212 != 0xffcbf01e);
      				_a20 = _t212 + 0x74a08d;
      				_t195 = _a20();
      				asm("in eax, 0xfe");
      				asm("lock add [eax], al");
      				 *_t195 =  *_t195 + _t195;
      				asm("wait");
      				_push(0x412e3d);
      				L004013C2();
      				L004013C2();
      				L004013AA();
      				return _t195;
      			}












































      0x004129ff
      0x00412a0e
      0x00412a1a
      0x00412a22
      0x00412a25
      0x00412a32
      0x00412a38
      0x00412a3b
      0x00412a3e
      0x00412a4d
      0x00412a50
      0x00412a57
      0x00412a5e
      0x00412a60
      0x00412a65
      0x00412a6a
      0x00412a70
      0x00412a72
      0x00412a73
      0x00412a75
      0x00412a7c
      0x00412a83
      0x00412a8a
      0x00412a9d
      0x00412aa2
      0x00412aa7
      0x00412aa8
      0x00412aad
      0x00412ab3
      0x00412ab3
      0x00412ab8
      0x00412ac3
      0x00412acc
      0x00412ad6
      0x00412ade
      0x00412ae3
      0x00412af9
      0x00412b05
      0x00412b08
      0x00412b0f
      0x00412b20
      0x00412b2b
      0x00412b46
      0x00412b5c
      0x00412b68
      0x00412b6e
      0x00412b73
      0x00412b7a
      0x00412b9f
      0x00412ba5
      0x00412bb2
      0x00412bd4
      0x00412bb4
      0x00412bb4
      0x00412bb9
      0x00412bbe
      0x00412bc1
      0x00412bc7
      0x00412bcc
      0x00412bcc
      0x00412be2
      0x00412be6
      0x00412bf5
      0x00412bfb
      0x00412c08
      0x00412c0e
      0x00412c18
      0x00412c54
      0x00412c5a
      0x00412c67
      0x00412c89
      0x00412c69
      0x00412c69
      0x00412c6e
      0x00412c73
      0x00412c76
      0x00412c7c
      0x00412c81
      0x00412c81
      0x00412c97
      0x00412c9b
      0x00412ca4
      0x00412ca9
      0x00412cbf
      0x00412cc5
      0x00412cc7
      0x00412cd4
      0x00412cf6
      0x00412cd6
      0x00412cd6
      0x00412cdb
      0x00412ce0
      0x00412ce3
      0x00412ce9
      0x00412cee
      0x00412cee
      0x00412d12
      0x00412d18
      0x00412d1a
      0x00412d27
      0x00412d49
      0x00412d29
      0x00412d29
      0x00412d2e
      0x00412d33
      0x00412d36
      0x00412d3c
      0x00412d41
      0x00412d41
      0x00412d50
      0x00412d57
      0x00412d5b
      0x00412d5f
      0x00412d72
      0x00412d77
      0x00412d77
      0x00412d7e
      0x00412d85
      0x00412d92
      0x00412d99
      0x00412d9a
      0x00412d9d
      0x00412d9e
      0x00412da3
      0x00412da8
      0x00412dad
      0x00412db4
      0x00412dbb
      0x00412dc8
      0x00412dc9
      0x00412dcf
      0x00412dd0
      0x00412dda
      0x00000000
      0x00000000
      0x00412ddc
      0x00412dde
      0x00412de5
      0x00412dec
      0x00412dec
      0x00412ded
      0x00412dfb
      0x00412dfe
      0x00412e01
      0x00412e06
      0x00412e09
      0x00412e0b
      0x00412e0c
      0x00412e27
      0x00412e2f
      0x00412e37
      0x00412e3c

      APIs
      • __vbaChkstk.MSVBVM60(?,00401266), ref: 00412A1A
      • _CIsin.MSVBVM60(?,?,?,?,00401266), ref: 00412A60
      • __vbaFpR8.MSVBVM60(?,?,?,?,00401266), ref: 00412A65
      • __vbaVarDup.MSVBVM60 ref: 00412A9D
      • #600.MSVBVM60(?,00000002), ref: 00412AA8
      • __vbaFreeVar.MSVBVM60(?,00000002), ref: 00412AB3
      • #612.MSVBVM60(?,?,?,?,?,00401266), ref: 00412AC3
      • __vbaStrVarMove.MSVBVM60(?,?,?,?,?,?,00401266), ref: 00412ACC
      • __vbaStrMove.MSVBVM60(?,?,?,?,?,?,00401266), ref: 00412AD6
      • __vbaFreeVar.MSVBVM60(?,?,?,?,?,?,00401266), ref: 00412ADE
      • __vbaStrCopy.MSVBVM60 ref: 00412B20
      • __vbaFreeStr.MSVBVM60(?,00003FC5,?), ref: 00412B6E
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041186C,000006FC,?,?,?,00003FC5,?), ref: 00412BC7
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041186C,00000700,?,?,?,?,?,?,?,?,?,?,00003FC5,?), ref: 00412C7C
      • __vbaOnError.MSVBVM60(000000FF,?,?,?,?,?,?,?,?,?,?,00003FC5,?), ref: 00412CA4
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041183C,000001B8,?,?,?,?,?,?,?,?,?,?,00003FC5,?), ref: 00412CE9
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041183C,000001BC), ref: 00412D3C
      • __vbaVarMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00003FC5,?), ref: 00412D72
      • __vbaVarAdd.MSVBVM60(?,00000002,?,?,?,?,?,?,?,?,?,?,?,?,?,00003FC5), ref: 00412D9E
      • __vbaVarMove.MSVBVM60(?,00000002,?,?,?,?,?,?,?,?,?,?,?,?,?,00003FC5), ref: 00412DA8
      • __vbaVarTstLt.MSVBVM60(00008003,?,?,00000002,?), ref: 00412DD0
      • __vbaFreeVar.MSVBVM60(00412E3D,?,?,?,?,?,?,?,?,?,?,?,?,00003FC5,?), ref: 00412E27
      • __vbaFreeVar.MSVBVM60(00412E3D,?,?,?,?,?,?,?,?,?,?,?,?,00003FC5,?), ref: 00412E2F
      • __vbaFreeStr.MSVBVM60(00412E3D,?,?,?,?,?,?,?,?,?,?,?,?,00003FC5,?), ref: 00412E37
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: __vba$Free$CheckHresultMove$#600#612ChkstkCopyErrorIsin
      • String ID: Kompetenceomraaders$Rosenstokkesegedesm
      • API String ID: 3051467023-1030129653
      • Opcode ID: 1fb41e740854097113e580c59bd170b12d46786e2ab9960074e0f61ee3e074cc
      • Instruction ID: 7514f026aed3fd060f0f8c9d2a2fff5334c51e6d10be09d262be54c7ecd38e0b
      • Opcode Fuzzy Hash: 1fb41e740854097113e580c59bd170b12d46786e2ab9960074e0f61ee3e074cc
      • Instruction Fuzzy Hash: 55C1F67490021CEFDB10DFA1C949BDDBBB4FF04304F1081AAE549AB2A2DB785A99DF54
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID:
      • String ID: Lzz
      • API String ID: 0-937393292
      • Opcode ID: a313f513fdcfc7ffabdeb74e36e774b545e924a97182bad089d67f544b83d64c
      • Instruction ID: e4d60369a45d2926a6fe00eeaa0dd4c5a2a5758d7f50d60f9b663ec605da34ac
      • Opcode Fuzzy Hash: a313f513fdcfc7ffabdeb74e36e774b545e924a97182bad089d67f544b83d64c
      • Instruction Fuzzy Hash: 6652329192E30259EFB32064C5D172DA280DF26355F318F37D991F54E3AA2F8ACB158B
      Uniqueness

      Uniqueness Score: -1.00%

      C-Code - Quality: 63%
      			_entry_(signed int __eax, char __ebx, signed char __ecx, void* __edx, signed int __edi) {
      				signed char _t54;
      				intOrPtr* _t57;
      				signed int _t63;
      				signed char _t65;
      				intOrPtr* _t67;
      				signed char _t77;
      				signed int _t87;
      				signed int _t90;
      				signed int _t92;
      				void* _t94;
      
      				_t82 = __edi;
      				_t74 = __ecx;
      				_t68 = __ebx;
      				_push("VB5!6&*"); // executed
      				L004013E0(); // executed
      				 *__eax =  *__eax + __eax;
      				 *__eax =  *__eax + __eax;
      				 *__eax =  *__eax + __eax;
      				 *__eax =  *__eax ^ __eax;
      				 *__eax =  *__eax + __eax;
      				_t54 = __eax + 1;
      				 *_t54 =  *_t54 + _t54;
      				 *_t54 =  *_t54 + _t54;
      				 *_t54 =  *_t54 + _t54;
      				_t77 = __edx + __edx;
      				 *((char*)(__ecx + 0xe)) = __ebx;
      				 *(__ebx - 0x44bafc) =  *(__ebx - 0x44bafc) << 0x13;
      				asm("repne mov [0xf560b8], eax");
      				 *_t54 =  *_t54 + _t54;
      				 *_t54 =  *_t54 + _t54;
      				 *__ecx =  *__ecx + _t54;
      				 *_t54 =  *_t54 + _t54;
      				 *_t77 =  *_t77 + _t54;
      				_push(es);
      				_push(_t54);
      				 *__ecx =  *__ecx + 0x53;
      				if( *__ecx < 0) {
      					asm("insb");
      					asm("outsd");
      					 *((intOrPtr*)(__ebx)) =  *((intOrPtr*)(__ebx)) + __ecx;
      					_t63 = _t54 +  *_t54;
      					 *_t63 =  *_t63 + _t63;
      					asm("int3");
      					 *_t63 =  *_t63 ^ _t63;
      					_t92 = _t90;
      					_pop(_t74);
      					_t87 = 1 +  *(_t90 + __edi + 0x61) * 0x6e6f6974;
      					_push(__edi);
      					_t77 = (_t77 &  *(_t92 + __edi - 0x2d)) - 1;
      					 *((char*)(__edi - 3)) = __ecx;
      					_t65 = __ebx + __ebx + 0x00000001 | 0x00000079;
      					 *(_t65 + 0x32) =  *(_t65 + 0x32) << 1;
      					 *[gs:esi-0x73] = _t65;
      					_t90 = 0x593b;
      					asm("insb");
      					_t82 = __edi - 1;
      					asm("lodsd");
      					_t67 = _t92;
      					asm("stosb");
      					 *((intOrPtr*)(_t67 - 0x2d)) =  *((intOrPtr*)(_t67 - 0x2d)) + _t67;
      					_t54 = _t63 ^  *(__ecx - 0x48ee309a);
      					_t68 = _t67;
      					 *_t54 =  *_t54 + _t54;
      					 *_t54 =  *_t54 + _t54;
      					 *_t54 =  *_t54 + _t54;
      					 *_t54 =  *_t54 + _t54;
      					 *_t54 =  *_t54 + _t54;
      					L2:
      					 *_t54 =  *_t54 + _t54;
      					 *_t54 =  *_t54 + _t54;
      					 *_t54 =  *_t54 + _t54;
      					L3:
      					 *_t54 =  *_t54 + _t54;
      					 *_t54 =  *_t54 + _t54;
      					 *_t54 =  *_t54 + _t54;
      					 *_t54 =  *_t54 + _t54;
      					 *_t54 =  *_t54 + _t54;
      					 *_t54 =  *_t54 + _t54;
      					 *_t54 =  *_t54 + _t54;
      					 *_t54 =  *_t54 + _t54;
      					 *_t54 =  *_t54 + _t54;
      					 *_t54 =  *_t54 + _t54;
      					 *((intOrPtr*)(_t94 + _t82 * 8 - 0x5350000)) =  *((intOrPtr*)(_t94 + _t82 * 8 - 0x5350000)) + _t68;
      				}
      				 *_t54 =  *_t54 + _t54;
      				asm("retf");
      				asm("cli");
      				 *_t54 =  *_t54 + _t54;
      				 *_t68 =  *_t68 + _t77;
      				_t27 = _t90 + 0x6d;
      				 *_t27 =  *((intOrPtr*)(_t90 + 0x6d)) + _t54;
      				asm("bound esp, [ebp+0x64]");
      				if( *_t27 >= 0) {
      					L10:
      					 *_t54 =  *_t54 + _t54;
      					 *_t54 =  *_t54 + _t54;
      					asm("o16 fld qword [ebp-0x846e900]");
      					 *_t87 =  *_t87 + _t68;
      					asm("sbb ebx, [eax+eax+0x40]");
      					asm("adc cl, bl");
      					_t77 = _t77 + _t54;
      					_push(0xffffffb9);
      					 *((intOrPtr*)(_t74 + 0x5000b333)) =  *((intOrPtr*)(_t74 + 0x5000b333)) + _t74;
      				} else {
      					_t87 =  *(_t68 + 0x61) * 0x6d;
      					_t90 =  *(_t87 + 0x65) * 0x73656e72;
      					asm("aaa");
      					 *0x65000f01 =  *0x65000f01 + _t74;
      					asm("outsb");
      					asm("fs outsd");
      					if( *0x65000f01 != 0) {
      						asm("gs insb");
      						_t90 =  *(_t82 + 0x6c) * 0x6e697379;
      						 *_t74 =  *_t74 + _t68;
      						 *_t54 =  *_t54 + _t54;
      						_t77 = _t77 + 1;
      						 *_t74 =  *_t74 + _t54;
      						_t32 = _t77 + 0x746c0000;
      						_t33 = _t54;
      						_t54 =  *_t32;
      						 *_t32 = _t33;
      						 *_t54 =  *_t54 + _t54;
      						if( *_t54 <= 0) {
      							goto L2;
      						} else {
      							 *_t54 =  *_t54 + _t54;
      							_t77 = _t77 + 1;
      							_t90 = _t90 - 1;
      							if(_t90 <= 0) {
      								goto L3;
      							} else {
      								 *_t54 =  *_t54 + _t54;
      								 *_t54 =  *_t54 + _t54;
      								 *_t54 =  *_t54 + _t54;
      								if ( *_t54 <= 0) goto L9;
      								 *_t54 =  *_t54 + _t54;
      								 *_t54 =  *_t54 - _t54;
      								 *_t54 =  *_t54 + _t54;
      								asm("adc [ecx], al");
      								 *_t54 =  *_t54 + _t54;
      								 *_t74 =  *_t74 ^ _t54;
      								 *_t54 =  *_t54 + _t54;
      								 *_t54 =  *_t54 + _t54;
      								_t54 = _t54;
      								 *_t54 =  *_t54 + _t54;
      								 *_t54 =  *_t54 + _t54;
      								 *_t77 =  *_t77 | _t54;
      								 *_t54 =  *_t54 + _t54;
      								 *_t54 =  *_t54 + _t54;
      								 *_t54 =  *_t54 + _t54;
      								 *_t54 =  *_t54 + _t54;
      								 *_t54 =  *_t54 + _t54;
      								goto L10;
      							}
      						}
      					}
      				}
      				_push(_t54);
      				 *_t74 =  *_t74 >> _t74;
      				 *((intOrPtr*)(_t82 - 0x4ff0133)) =  *((intOrPtr*)(_t82 - 0x4ff0133)) + _t77;
      				_t57 = 0x648e0000;
      				_push(_t87);
      				 *((intOrPtr*)(_t87 + 0x41)) =  *((intOrPtr*)(_t87 + 0x41)) + _t77;
      				asm("outsd");
      				 *((intOrPtr*)(0x648e0000 + _t87 * 8)) =  *((intOrPtr*)(0x648e0000 + _t87 * 8)) + _t74;
      				 *0x648e0000 =  *0x648e0000 + 0x78fcc6;
      				_push(ds);
      				 *0x39203200 = ss;
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				 *0 =  *0;
      				 *0x648e0000 =  *0x648e0000 + 0x648e0000;
      				asm("sbb eax, [eax]");
      				goto L12;
      				asm("cdq");
      			}













      0x004013e8
      0x004013e8
      0x004013e8
      0x004013e8
      0x004013ed
      0x004013f2
      0x004013f4
      0x004013f6
      0x004013f8
      0x004013fa
      0x004013fc
      0x004013fd
      0x004013ff
      0x00401401
      0x00401403
      0x00401405
      0x00401408
      0x0040140f
      0x00401415
      0x00401417
      0x00401419
      0x0040141b
      0x0040141d
      0x00401420
      0x00401421
      0x00401422
      0x00401425
      0x00401427
      0x00401428
      0x00401431
      0x00401433
      0x00401435
      0x00401439
      0x0040143a
      0x0040143c
      0x00401442
      0x00401444
      0x00401446
      0x00401447
      0x0040144a
      0x0040144d
      0x0040144f
      0x00401452
      0x00401457
      0x0040145b
      0x0040145e
      0x0040145f
      0x00401466
      0x00401468
      0x00401469
      0x0040146c
      0x0040146c
      0x0040146d
      0x0040146f
      0x00401471
      0x00401473
      0x00401475
      0x00401476
      0x00401476
      0x00401478
      0x0040147a
      0x0040147c
      0x0040147c
      0x0040147e
      0x00401480
      0x00401482
      0x00401484
      0x00401486
      0x00401488
      0x0040148a
      0x0040148c
      0x0040148e
      0x00401490
      0x00401490
      0x00401493
      0x00401495
      0x00401496
      0x00401497
      0x00401499
      0x0040149b
      0x0040149b
      0x0040149e
      0x004014a1
      0x00401508
      0x00401508
      0x0040150a
      0x0040150c
      0x00401513
      0x00401515
      0x00401519
      0x0040151b
      0x0040151d
      0x0040151f
      0x004014a3
      0x004014a3
      0x004014a7
      0x004014ae
      0x004014af
      0x004014b5
      0x004014b6
      0x004014b8
      0x004014ba
      0x004014bc
      0x004014c3
      0x004014c5
      0x004014c7
      0x004014c8
      0x004014ca
      0x004014ca
      0x004014ca
      0x004014ca
      0x004014d0
      0x004014d2
      0x00000000
      0x004014d4
      0x004014d4
      0x004014d6
      0x004014d7
      0x004014d8
      0x00000000
      0x004014da
      0x004014da
      0x004014dc
      0x004014de
      0x004014e0
      0x004014e2
      0x004014e4
      0x004014e6
      0x004014e8
      0x004014ea
      0x004014ec
      0x004014ee
      0x004014f0
      0x004014f2
      0x004014f4
      0x004014f6
      0x004014f8
      0x004014fe
      0x00401500
      0x00401502
      0x00401504
      0x00401506
      0x00000000
      0x00401506
      0x004014d8
      0x004014d2
      0x004014b8
      0x00401524
      0x00401525
      0x00401527
      0x00401531
      0x00401536
      0x00401537
      0x0040153a
      0x0040153b
      0x0040153e
      0x00401544
      0x00401545
      0x0040154b
      0x0040154d
      0x0040154f
      0x00401551
      0x00401553
      0x00401555
      0x00401557
      0x00401559
      0x0040155b
      0x0040155d
      0x0040155f
      0x00401561
      0x00401563
      0x00401565
      0x00401567
      0x00401569
      0x0040156b
      0x0040156d
      0x0040156f
      0x00401571
      0x00401573
      0x00401575
      0x00401577
      0x00401579
      0x0040157b
      0x0040157d
      0x0040157f
      0x00401581
      0x00401583
      0x00401585
      0x00401587
      0x00401589
      0x0040158b
      0x0040158d
      0x0040158f
      0x00401591
      0x00401593
      0x00401595
      0x00401597
      0x00401599
      0x0040159b
      0x0040159d
      0x0040159f
      0x004015a1
      0x004015a3
      0x004015a5
      0x004015a7
      0x004015a9
      0x004015ab
      0x004015ad
      0x004015af
      0x004015b1
      0x004015b3
      0x004015b5
      0x004015b7
      0x004015b9
      0x004015bb
      0x004015bd
      0x004015bf
      0x004015c1
      0x004015c3
      0x004015c5
      0x004015c7
      0x004015c9
      0x004015cb
      0x004015cd
      0x004015cf
      0x004015d1
      0x004015d3
      0x004015d5
      0x004015d7
      0x004015d9
      0x004015db
      0x004015dd
      0x004015df
      0x004015e1
      0x004015e3
      0x004015e5
      0x004015e7
      0x004015e9
      0x004015eb
      0x004015ed
      0x004015ef
      0x004015f1
      0x004015f3
      0x004015f5
      0x004015f7
      0x004015f9
      0x004015fb
      0x004015fd
      0x004015ff
      0x00401601
      0x00401603
      0x00401605
      0x00401607
      0x00401609
      0x0040160b
      0x0040160d
      0x0040160f
      0x00401611
      0x00401613
      0x00401615
      0x00401617
      0x00401619
      0x0040161b
      0x0040161d
      0x0040161f
      0x00401621
      0x00401623
      0x00401625
      0x00401627
      0x00401629
      0x0040162b
      0x0040162d
      0x0040162f
      0x00401631
      0x00401633
      0x00401635
      0x00401637
      0x00401639
      0x0040163b
      0x0040163d
      0x0040163f
      0x00401641
      0x00401643
      0x00401645
      0x00401647
      0x00401649
      0x0040164b
      0x0040164d
      0x0040164f
      0x00401651
      0x00401653
      0x00401655
      0x00401657
      0x00401659
      0x0040165b
      0x0040165d
      0x0040165f
      0x00401661
      0x00401663
      0x00401665
      0x00401667
      0x00401669
      0x0040166b
      0x0040166d
      0x0040166f
      0x00401671
      0x00401673
      0x00401675
      0x00401677
      0x00401679
      0x0040167b
      0x0040167d
      0x0040167f
      0x00401681
      0x00401683
      0x00401685
      0x00401687
      0x00401689
      0x0040168b
      0x0040168d
      0x0040168f
      0x00401691
      0x00401693
      0x00401695
      0x00401697
      0x00401699
      0x0040169b
      0x0040169d
      0x0040169f
      0x004016a1
      0x004016a3
      0x004016a5
      0x004016a7
      0x004016a9
      0x004016ab
      0x004016ad
      0x004016af
      0x004016b1
      0x004016b3
      0x004016b5
      0x004016b7
      0x004016b9
      0x004016bb
      0x004016bd
      0x004016bf
      0x004016c1
      0x004016c3
      0x004016c5
      0x004016c7
      0x004016c9
      0x004016cb
      0x004016cd
      0x004016cf
      0x004016d1
      0x004016d3
      0x004016d5
      0x004016d7
      0x004016d9
      0x004016db
      0x004016dd
      0x004016df
      0x004016e1
      0x004016e3
      0x004016e5
      0x004016e7
      0x004016e9
      0x004016eb
      0x004016ed
      0x004016ef
      0x004016f1
      0x004016f3
      0x004016f5
      0x004016f7
      0x004016f9
      0x004016fb
      0x004016fd
      0x004016ff
      0x00401701
      0x00401703
      0x00401705
      0x00401707
      0x00401709
      0x0040170b
      0x0040170d
      0x0040170f
      0x00401711
      0x00401713
      0x00401715
      0x00401717
      0x00401719
      0x0040171b
      0x0040171d
      0x0040171f
      0x00401721
      0x00401723
      0x00401725
      0x00401727
      0x00401729
      0x0040172b
      0x0040172d
      0x0040172f
      0x00401731
      0x00401733
      0x00401735
      0x00401737
      0x00401739
      0x0040173b
      0x0040173d
      0x0040173f
      0x00401741
      0x00401743
      0x00401745
      0x00401747
      0x00401749
      0x0040174b
      0x0040174d
      0x0040174f
      0x00401751
      0x00401753
      0x00401755
      0x00401757
      0x00401759
      0x0040175b
      0x0040175d
      0x0040175f
      0x00401761
      0x00401763
      0x00401765
      0x00401767
      0x00401769
      0x0040176b
      0x0040176d
      0x0040176f
      0x00401771
      0x00401773
      0x00401775
      0x00401777
      0x00401779
      0x0040177b
      0x0040177d
      0x0040177f
      0x00401781
      0x00401783
      0x00401785
      0x00401787
      0x00401789
      0x0040178b
      0x0040178d
      0x0040178f
      0x00401791
      0x00401793
      0x00401795
      0x00401797
      0x00401799
      0x0040179b
      0x0040179d
      0x0040179f
      0x004017a1
      0x004017a3
      0x004017a5
      0x004017a7
      0x004017a9
      0x004017ab
      0x004017ad
      0x004017af
      0x004017b1
      0x004017b3
      0x004017b5
      0x004017b7
      0x004017b9
      0x004017bb
      0x004017bd
      0x004017bf
      0x004017c1
      0x004017c3
      0x004017c5
      0x004017c7
      0x004017c9
      0x004017cb
      0x004017cd
      0x004017cf
      0x004017d1
      0x004017d3
      0x004017d5
      0x004017d7
      0x004017d9
      0x004017db
      0x004017dd
      0x004017df
      0x004017e1
      0x004017e3
      0x004017e5
      0x004017e7
      0x004017e9
      0x004017eb
      0x004017ed
      0x004017ef
      0x004017f1
      0x004017f3
      0x004017f5
      0x004017f7
      0x004017f9
      0x004017fb
      0x004017fd
      0x004017ff
      0x00401801
      0x00401803
      0x00401805
      0x00401807
      0x00401809
      0x0040180b
      0x0040180d
      0x0040180f
      0x00401811
      0x00401813
      0x00401815
      0x00401817
      0x00401819
      0x0040181b
      0x0040181d
      0x0040181f
      0x00401821
      0x00401823
      0x00401825
      0x00401827
      0x00401829
      0x0040182b
      0x0040182d
      0x0040182f
      0x00401831
      0x00401833
      0x00401835
      0x00401837
      0x00401839
      0x0040183b
      0x0040183d
      0x0040183f
      0x00401841
      0x00401843
      0x00401845
      0x00401847
      0x00401849
      0x0040184b
      0x0040184d
      0x0040184f
      0x00401851
      0x00401853
      0x00401855
      0x00401857
      0x00401859
      0x0040185b
      0x0040185d
      0x0040185f
      0x00401861
      0x00401863
      0x00401865
      0x00401867
      0x00401869
      0x0040186b
      0x0040186d
      0x0040186f
      0x00401871
      0x00401873
      0x00401875
      0x00401877
      0x00401879
      0x0040187b
      0x0040187d
      0x0040187f
      0x00401881
      0x00401883
      0x00401885
      0x00401885
      0x004018ed

      APIs
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: #100
      • String ID: VB5!6&*
      • API String ID: 1341478452-3593831657
      • Opcode ID: f372d4e7d897e34540ff05e01851d66b7d623871474b7597f18363515f47db15
      • Instruction ID: adc972e2ca77c21abbb81fe91c5c50d9791f127bb69084f1f367fd113c1edae6
      • Opcode Fuzzy Hash: f372d4e7d897e34540ff05e01851d66b7d623871474b7597f18363515f47db15
      • Instruction Fuzzy Hash: F811336114E3C19FD3138BB998A9555BFB19E5325430E81EFC9C5CF4E3C219880ADBA6
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID: G
      • API String ID: 4275171209-985283518
      • Opcode ID: 3b0fd1b83ef1df0fe23b3919a13e047244230b6bce7b17e478b06dcc21a46b47
      • Instruction ID: 15fe600a5be5055134a2c93d20d31c2c65d921b069e9980b41e9ef2cd878f85e
      • Opcode Fuzzy Hash: 3b0fd1b83ef1df0fe23b3919a13e047244230b6bce7b17e478b06dcc21a46b47
      • Instruction Fuzzy Hash: 19C1009296B70199EFB32020C5D071DA281DF06746F348F37C8A1FA4E1EA6F86CB1597
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 760a1c39c4ffc53157cb55440dc648dd7ed46b5c2a768a7f7e70515954c71fa2
      • Instruction ID: 32ab947532256ecb0d23bf07e51e5e8be06d51e504b91d9ddeed0ecc99aba30a
      • Opcode Fuzzy Hash: 760a1c39c4ffc53157cb55440dc648dd7ed46b5c2a768a7f7e70515954c71fa2
      • Instruction Fuzzy Hash: D5420181A2B70259EFB32020C5D075DA280DF16745F318F37D861F59E2EB6F8ACA1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 8cb012bac0a1120bd929813e02770d12855617b18a2895795545ab43a3961e74
      • Instruction ID: 422810f8f442aed84c3c8eebaa11caf8e57e94cfff5a584d8fc5b692dd9a8df1
      • Opcode Fuzzy Hash: 8cb012bac0a1120bd929813e02770d12855617b18a2895795545ab43a3961e74
      • Instruction Fuzzy Hash: EB52F081A2B70259EFB32020C5D075DA281DF16745F318F37DC61F69E2AB2F8ACA1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: ee4d5e62c1c43d32c6c5ec0900342e65419271ab29d8ddc87575e73ceb3a7275
      • Instruction ID: e6e1f10d49510cbecd2263716ba41dd80c01062e71b426c9e8474d02ae43436b
      • Opcode Fuzzy Hash: ee4d5e62c1c43d32c6c5ec0900342e65419271ab29d8ddc87575e73ceb3a7275
      • Instruction Fuzzy Hash: 5F420081A2B70259EFB32020C5D075DA280DF16745F318F37D861F69E2EB6F8ACA1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 0885e032af6cc4ce2183849d3524b6e60cf1e0f78d0c7fac8e3fa4ccee2a771a
      • Instruction ID: bd89468f95b77a78702bf51bf6d472cdfd15c1277dd0fa6913d851d4fd1a6eab
      • Opcode Fuzzy Hash: 0885e032af6cc4ce2183849d3524b6e60cf1e0f78d0c7fac8e3fa4ccee2a771a
      • Instruction Fuzzy Hash: 8F420281A2B70259EFB32020C5D075DA280DF16745F318F37D861F59E2EB6F8ACA1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 0b1b1ae42f9396e16b84e45d88daf0e321c0025abd466f7bc2019011daeb1f53
      • Instruction ID: c73277cc1f43b016050c447e7f6be49cc63841340d64cc74364eb95c32fa8d04
      • Opcode Fuzzy Hash: 0b1b1ae42f9396e16b84e45d88daf0e321c0025abd466f7bc2019011daeb1f53
      • Instruction Fuzzy Hash: 9B322281A2B70299EFB32020C5D0B5DA280DF16745F318F37D861F55E2EB6F8ACA1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 9ee42d209bc6ee54f3d0b702ef896ccf0ce8dc449e9c0347b97ff12032cef986
      • Instruction ID: 81d523a6c2b7211ae8e45f3536899c3e7c4e6bd498d13410383b92f156d841c9
      • Opcode Fuzzy Hash: 9ee42d209bc6ee54f3d0b702ef896ccf0ce8dc449e9c0347b97ff12032cef986
      • Instruction Fuzzy Hash: 25222281A2B70299EFB32020C5D0B5DA281DF16745F318F37C861F65E2BB5F8ACA1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: e9908b840bbc97b0c18b36dfec3b404aa40a7855b7d0d1ea624ff18a012eb606
      • Instruction ID: 7f4fd6041034b9eb58b48012b0cf3c27882ef2a7132122f9696fa880a08b0a5a
      • Opcode Fuzzy Hash: e9908b840bbc97b0c18b36dfec3b404aa40a7855b7d0d1ea624ff18a012eb606
      • Instruction Fuzzy Hash: 69322281A2B70299EFB32020C5D0B5DA281DF16345F318F37D861F65E2EB5F8ACA1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 56eaab6915adb4df88190869bda3b70bafeb485720276949820e14eb2db24f9c
      • Instruction ID: ed76f003f53c21340dfa47502de2aa5914aae3a8364f06549c0dcd5c287b8481
      • Opcode Fuzzy Hash: 56eaab6915adb4df88190869bda3b70bafeb485720276949820e14eb2db24f9c
      • Instruction Fuzzy Hash: AC322281A2B70259EFB32020C5D0B5DA281DF16745F318F37D861F65E2EB1F8ACA1697
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: ea6807cc36b9973c8aa419f29775de3861205aa73abe4dad62d9397b91a1d761
      • Instruction ID: a6b0569b0c8c77cb18129d1fd8b55e76f03954cb80faf5dd66b5491cc64e19d9
      • Opcode Fuzzy Hash: ea6807cc36b9973c8aa419f29775de3861205aa73abe4dad62d9397b91a1d761
      • Instruction Fuzzy Hash: A2223281A2B70259EFB32020C5D0B5DA281DF16345F318F37D861F65E2EB2F8ACA1597
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 480f7f468db4f9cd2df1b738d4d26260caef2483669a6e5fff133a5991ade5f8
      • Instruction ID: a68a70c13093df9d32f387434a6482c1ed48745c4666b25f29f466452fa096b2
      • Opcode Fuzzy Hash: 480f7f468db4f9cd2df1b738d4d26260caef2483669a6e5fff133a5991ade5f8
      • Instruction Fuzzy Hash: 72222181A2B70299EFB32020C5D0B5DA281DF16745F318F37C861F65E2BB5F8ACA1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 9c2cfbc2d9c09dd2820500f6e15a837d60ca91409fd2b706fd7c2ac6cd2b58d9
      • Instruction ID: 121f11d7b52fa370b13382818a41f830db5d28c09bd62e0d28120412218c9995
      • Opcode Fuzzy Hash: 9c2cfbc2d9c09dd2820500f6e15a837d60ca91409fd2b706fd7c2ac6cd2b58d9
      • Instruction Fuzzy Hash: 04221181A2B70299EFB32020C5D075DA281DF16745F318F37C861F65E2EA2F8ACA1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 0421ddf8b075c5585c2213480626cc81d0dadd7c006e4190430613c75666ef76
      • Instruction ID: 560ff879e292ed0f1bf9a8dbaa7496aff7c2e2badda91668ec1f0e33d041a5da
      • Opcode Fuzzy Hash: 0421ddf8b075c5585c2213480626cc81d0dadd7c006e4190430613c75666ef76
      • Instruction Fuzzy Hash: 9B121181A2B70299EFB32020C5D075DA281DF16745F318F37C861F65E2FA5F8ACA1697
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 0f01c137e1592346b265cd6b9f75d679e4e766ce1ba298f83acb3d03ee3ee5a8
      • Instruction ID: dd91602168152eb3fe15af8b872273e5420dd942bfaa4813369761faae185c8c
      • Opcode Fuzzy Hash: 0f01c137e1592346b265cd6b9f75d679e4e766ce1ba298f83acb3d03ee3ee5a8
      • Instruction Fuzzy Hash: CB121291A2B70299EFB32020C5D0B5DA281DF06745F318F37C861F65E2FA5F8ACA1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 84ab1e64acb4df1e09910f582b8880b5d1c425b578520e36faa0189186508d9b
      • Instruction ID: ee24ec16c394aedde8f6ce8728406b73758de22efbb9160acf783e1714600ffc
      • Opcode Fuzzy Hash: 84ab1e64acb4df1e09910f582b8880b5d1c425b578520e36faa0189186508d9b
      • Instruction Fuzzy Hash: 63121191A2B70299EFB32020C5D075DA281DF06745F318F37C861F65E2FA5F8ACA1697
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: c35aed4367f31b1bc654146aaf8bd56f0dbaf6b043f80ee245eda771e9b2292a
      • Instruction ID: 671a89af80031580deeebabb1af01d6844864a682c11c3a4f9a7b37ba9b0a59b
      • Opcode Fuzzy Hash: c35aed4367f31b1bc654146aaf8bd56f0dbaf6b043f80ee245eda771e9b2292a
      • Instruction Fuzzy Hash: 3A022391A2B70299EFB32020C5D075DA281DF06745F318F37C861F65E1FA5F8ACA1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 43e3feb21d79ef34a938ff2b3cbad02ae989f47e5b1208bedbef48b057f9eb96
      • Instruction ID: c38dda54ee6efdfa3a6d586a091e1b751ad4d339c38ed562b26627f18e683d5d
      • Opcode Fuzzy Hash: 43e3feb21d79ef34a938ff2b3cbad02ae989f47e5b1208bedbef48b057f9eb96
      • Instruction Fuzzy Hash: 89120181A2B70299EFB32020C5D0B5DA281DF16745F318F37C861F65E2AB5F8ACA1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: f8da1fbf31f9f026ed81cb60262292cdc7e0ed2162afc8a6fe43c2890afd094a
      • Instruction ID: 87f65ef151b356d3439d46f117cd9554ef849baef422cfa4b3e1bf89d5e9fc30
      • Opcode Fuzzy Hash: f8da1fbf31f9f026ed81cb60262292cdc7e0ed2162afc8a6fe43c2890afd094a
      • Instruction Fuzzy Hash: 6802129192A70299EFB32020C5D071DA281DF06745F318F37C861F65E1FB5F8ACA1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 93c7391634814093d1b42e90fed97ee94e1976417db9cd18136feaa35d790fce
      • Instruction ID: 1963ad6e2ee8a8376b37f17a79637867e60d6a906bbff037b87ae2bf5e40d180
      • Opcode Fuzzy Hash: 93c7391634814093d1b42e90fed97ee94e1976417db9cd18136feaa35d790fce
      • Instruction Fuzzy Hash: 7C021191A6A70299EFB32020C5D071DA281DF06745F318F37C861F65E2FA6F8ACA1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 6d5e001738265e3c1f061f6d5704d5c9a54820afe43ddbbadc3a75e17785db19
      • Instruction ID: d5d483a66074e92acb5fec1517611e9d506f4869dc865ae297f06dff01ce3ac8
      • Opcode Fuzzy Hash: 6d5e001738265e3c1f061f6d5704d5c9a54820afe43ddbbadc3a75e17785db19
      • Instruction Fuzzy Hash: 35022392A2B70299EFB32020C5D071DA281DF16745F318F37C861F65E1FA6F86CA1597
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: c62b7bb38a47b7ffe6adbaa1953897a0d15ee68de64bdeffe00bd01ce3d79458
      • Instruction ID: 447f60b40203222adc4cb295324b5f40c9c7e228ca3d32fbd93c49b52485d2b9
      • Opcode Fuzzy Hash: c62b7bb38a47b7ffe6adbaa1953897a0d15ee68de64bdeffe00bd01ce3d79458
      • Instruction Fuzzy Hash: E0F1119296B70299EFB32020C5D071DA281DF06746F318F37C8A1F65E1FA6F86CA1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: d02858d02087874006092c7d7ab0beb826b8439ec2e002d6808fc046123e6f85
      • Instruction ID: be404cda46bf70f12cc216e038aa6756e8754abffc131af14920a1845c465ab8
      • Opcode Fuzzy Hash: d02858d02087874006092c7d7ab0beb826b8439ec2e002d6808fc046123e6f85
      • Instruction Fuzzy Hash: 15F1119296B70699EFB32020C5D071DA281DF06746F308F37C8A1F65E1FA6F86CA1597
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: ca903023d265488ec65a6ddc074ecda72ecbd00330ca196632269be54cbc8281
      • Instruction ID: 98656a0c72d10498e78b56e0a5a102616fe9397e06f39a6294f32bf4b796b74a
      • Opcode Fuzzy Hash: ca903023d265488ec65a6ddc074ecda72ecbd00330ca196632269be54cbc8281
      • Instruction Fuzzy Hash: E7F1129296B70299EFB32020C5D071DA281DF06746F308F37C8A1F65E1FA6F86CA1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 774fecc62ae6bd79e7f8c9ceacf6fe3387dd806780faf490476782a10a4243fe
      • Instruction ID: 8b901023af71e0a12537071d3e93efb7dff2686d4e6cd2a43b42bf9a1ca0cfb9
      • Opcode Fuzzy Hash: 774fecc62ae6bd79e7f8c9ceacf6fe3387dd806780faf490476782a10a4243fe
      • Instruction Fuzzy Hash: 32E1219296B30199EFB32020C5D0B1DA281DF06746F348F37C8A1FA4E1FA5F86CA1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: c8b8050ed4e8c0f054ed44b9bbdbe0208caa0a7df108f9d3a1dda13464a990d7
      • Instruction ID: 66b8324c494d7e3328514674aed3b53272f0650084aaafe8fe7508734cd0c93e
      • Opcode Fuzzy Hash: c8b8050ed4e8c0f054ed44b9bbdbe0208caa0a7df108f9d3a1dda13464a990d7
      • Instruction Fuzzy Hash: E1E1009296A70199EFB32120C5D0B1DA281DF06745F348F37C8A1FA4E1EA6F86CB1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 85c7835a17bbe152c8b01fb31bf8a96e4dfe40d450f1d9af603318e10fdb06a7
      • Instruction ID: c0278204383a0082ec3fd6ea55cbaaea40dec7b0ff0a56f59557f0d8a758c25c
      • Opcode Fuzzy Hash: 85c7835a17bbe152c8b01fb31bf8a96e4dfe40d450f1d9af603318e10fdb06a7
      • Instruction Fuzzy Hash: 79E1109296A74199EFB32120C5D071DA281DF06746F308F37C8A1FA4E1EA6F86CB1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 0e2ba632c930e4cc949d850d3c08e869ed0754928c437adb01caa91ab749d2a3
      • Instruction ID: 6bfaa8d63b33be791d80acf93f3aa042cb1d8ad312c309e13c6b8c6afa7d811e
      • Opcode Fuzzy Hash: 0e2ba632c930e4cc949d850d3c08e869ed0754928c437adb01caa91ab749d2a3
      • Instruction Fuzzy Hash: 8CD1119296B34199EFB32020C5D071DA281DF06745F348F37C8A1FA4E2EA5F86CB1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 8ca378e7b3412fee81b5fb3cd39ba0ec43b534fead886866d7163183453205e2
      • Instruction ID: 3f80d2cdcf30500a166d0a761fe72ba7c3c9ba9fb3664ff345693856786a5bd7
      • Opcode Fuzzy Hash: 8ca378e7b3412fee81b5fb3cd39ba0ec43b534fead886866d7163183453205e2
      • Instruction Fuzzy Hash: 2EB1F09196B74199EFB32020C5D071DA281EF06706F348F37C8A1EA4E1AB5F86CF1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: e52a7ec34a5bf181771069489c14cacf7639274a714039b6d2ca0adcc9715cfa
      • Instruction ID: 46e768218e5d15ca0af3aa20001a9bde163f0dc262b54dab2bd13775693c0907
      • Opcode Fuzzy Hash: e52a7ec34a5bf181771069489c14cacf7639274a714039b6d2ca0adcc9715cfa
      • Instruction Fuzzy Hash: 2BD10F9196B30199EFB32120C5D0B1DA281DF06745F348F37C8A1FA4E1EA6F86CB1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 4fe2df84082608bd2f891c39ba7a4aeb41b4c38d4cf75f483455e529adf6fbcc
      • Instruction ID: 6f504091522b5b0f7d98dadc4470b363eab768f0dfe8204e8a76d2aa2d49da13
      • Opcode Fuzzy Hash: 4fe2df84082608bd2f891c39ba7a4aeb41b4c38d4cf75f483455e529adf6fbcc
      • Instruction Fuzzy Hash: FAC1F09296B74199EFB32020C5D071DA281DF06746F348F37C8A1FA4E1AA5F86CB1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 0b10c3cdef5080417d6dfbb0aacb9ce51062281c3e998c2b90f6d8554fae9a69
      • Instruction ID: f93239ddb8d5a9dd4301ce060a4f689e0f5918f91fecc068b278e218947d3747
      • Opcode Fuzzy Hash: 0b10c3cdef5080417d6dfbb0aacb9ce51062281c3e998c2b90f6d8554fae9a69
      • Instruction Fuzzy Hash: 76C1EF9196B74199EFB32020C5D071DA281EF06746F348F37C8A1FA4E1EB6F86CA1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: a7f658ec8d6579e3793574f1cca3068dedf328e9b814a9fcea8dcac10f54c298
      • Instruction ID: 5bea09a14376c5f2bed42b6596cd997797b3e0b108392260ebbc01170a9541ef
      • Opcode Fuzzy Hash: a7f658ec8d6579e3793574f1cca3068dedf328e9b814a9fcea8dcac10f54c298
      • Instruction Fuzzy Hash: 4DB1F09196B70199EFB32020C5D071DA281EF06746F348F37C8A1EA5E1EA6F86CF1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: cdc30722a4ac279145b5d5e2b16e10b36b07d5b502e9303cc83a8b981e2a65f0
      • Instruction ID: c82c05e35a539b739b4bb8e2cc1b2bcd51ae9127ac1a84dc7d901e30187fa2ba
      • Opcode Fuzzy Hash: cdc30722a4ac279145b5d5e2b16e10b36b07d5b502e9303cc83a8b981e2a65f0
      • Instruction Fuzzy Hash: 2CA1028196B74199EFB32020C5D071DA281DF06709F348F37C8A1EA5E2AB6F86CF1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: e35783fadc6d39a6416842ed42ded87a1b2969878344254e201cfc3d8ccc1547
      • Instruction ID: 00cef486c1a18479cf88d66e9fc985ba421990017dac3a299583be402b32c70a
      • Opcode Fuzzy Hash: e35783fadc6d39a6416842ed42ded87a1b2969878344254e201cfc3d8ccc1547
      • Instruction Fuzzy Hash: 44A1E09196B70199EFB32020C5D071DA281EF05705F348F37C8A1EA5E1AA6F86CF1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 95c2967f39708673d1dfb21d47b414ff9b6bfee0f7a9fd827a9ace34bb88095c
      • Instruction ID: 3f5c1acfd3a257580d460ba68a3fb3352c4069585852436e0d3d3595bf95d9a3
      • Opcode Fuzzy Hash: 95c2967f39708673d1dfb21d47b414ff9b6bfee0f7a9fd827a9ace34bb88095c
      • Instruction Fuzzy Hash: 87A1F09196B70199EFB32020C5D075DA281EF06709F348F37C8A1EA5E1AB6F86CF1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: df6f7337a47b92fce5744f4813834b6e75f6b813390271fea41c1cb208e7881b
      • Instruction ID: d0cda14268b6022fefb0c6f1497c18167483aba9ee4192b5288d29fe4e81d5e6
      • Opcode Fuzzy Hash: df6f7337a47b92fce5744f4813834b6e75f6b813390271fea41c1cb208e7881b
      • Instruction Fuzzy Hash: 1BA1E09196B70199EFB32020C5D071DA281EF06709F348F37C8A1EA4E1AB6F86CF1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: a6cb0ff456ff6db7c3f6720a988324813869c990102f5f1cd02484e0ada2ebf9
      • Instruction ID: 0a9837941d7cc09f9e5b742e665202ee8ef0efc897f0c46dbd870d7895eefc7a
      • Opcode Fuzzy Hash: a6cb0ff456ff6db7c3f6720a988324813869c990102f5f1cd02484e0ada2ebf9
      • Instruction Fuzzy Hash: FBA1D09196B70199EFB32020C5D071DA281EF06749F348F37C8A1EA5E1AB6F86CF1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 745552db39782354f578bd2dd655013aac2ce3dbcdaf3d058cd4c6709f90c19f
      • Instruction ID: 5b611c8c7d8fb4cfcd08556d2479f2ebc31ed9641b03638b47129eccb0515fe4
      • Opcode Fuzzy Hash: 745552db39782354f578bd2dd655013aac2ce3dbcdaf3d058cd4c6709f90c19f
      • Instruction Fuzzy Hash: 23A1E09196B70199EFB32020C5D071DA281EF06705F348F37C8A1EA5E1AB6F86CF1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 05d9cc18b2e8650982599004abcb07e3f56e211c3298d2d56fcd090ef0b81f4b
      • Instruction ID: 470923e09a5b1b13eeff4f8b18d302575a94278aa7483b2e52165fa8a04db110
      • Opcode Fuzzy Hash: 05d9cc18b2e8650982599004abcb07e3f56e211c3298d2d56fcd090ef0b81f4b
      • Instruction Fuzzy Hash: ECA1D09196B70199EFB32120C5D071DA281EF06705F348F37C8A1EA5E1AB6F86CF1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 412f80abf1feccd25110c35e56b6bdbf3b8986c1e89da3878fb67a1d560c7618
      • Instruction ID: abf4f926fb536b6ea0a199821fbafdd78b3a8d4280ebb7be0fea093d4888b0ed
      • Opcode Fuzzy Hash: 412f80abf1feccd25110c35e56b6bdbf3b8986c1e89da3878fb67a1d560c7618
      • Instruction Fuzzy Hash: 5BA1F09196B70199EFB32020C5D071DA281EF06705F348F37C8A1EA4E1AB6F86CF1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 69436c586004d98b8c0fe9d27469e693bdeee0aec59c2f7187c5272b8c01d3fe
      • Instruction ID: 46c11cf62db31bd524f09fbc087e51ab968b812c763521f8690e62d1e25600a0
      • Opcode Fuzzy Hash: 69436c586004d98b8c0fe9d27469e693bdeee0aec59c2f7187c5272b8c01d3fe
      • Instruction Fuzzy Hash: B6A1F09196B70199EFB32020C5D071DA281EF06745F348F37C8A1EA4E1AB6F86CF1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: c589c139fa9bd8923bb7cd29a26ee8808ba0657ac8b7cc6f2a5a4791a0619464
      • Instruction ID: 81ab1f46737c70c65d90a74dca86e59cb7ec98d35f8547574c4187e5780ee5da
      • Opcode Fuzzy Hash: c589c139fa9bd8923bb7cd29a26ee8808ba0657ac8b7cc6f2a5a4791a0619464
      • Instruction Fuzzy Hash: 0091DE5196B74199EFB32020C4D071DA281DF0670AF348F37C8A1EA4E1AB6F86CF1297
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 23c898fb4c6ae4c698795a7632929985b51207b92789057034fe402e5216687f
      • Instruction ID: 7d4a9b583e73bdfd3b0b9fd5c8d8cdf5fe3223b6e03bc4da5607b0f792885acd
      • Opcode Fuzzy Hash: 23c898fb4c6ae4c698795a7632929985b51207b92789057034fe402e5216687f
      • Instruction Fuzzy Hash: F6A1E09196B70199EFB32020C5D071DA281EF06705F348F37C8A1EA5E1AB6F86CF1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 99f94369f204040ad5a8d5e6e8bec4f91556c9af33287673463202d181740150
      • Instruction ID: ed478fae72a8c73928e03e03221fc0493c75fc44357ebaf5a326f9b030fd6f4a
      • Opcode Fuzzy Hash: 99f94369f204040ad5a8d5e6e8bec4f91556c9af33287673463202d181740150
      • Instruction Fuzzy Hash: 12A1E19196B70199EFB32020C5D071DA281EF06705F348F37C8A1EA5E1AB6F86CF1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 2444e233779e74660781903260617b80c9388915bb2cf1074c7d2fecf62dde2b
      • Instruction ID: 4de1e141c86af7695fce43753b35beb026f93c5d7845c65e528cf1294fa863aa
      • Opcode Fuzzy Hash: 2444e233779e74660781903260617b80c9388915bb2cf1074c7d2fecf62dde2b
      • Instruction Fuzzy Hash: BCA1E09196B70199EFB32020C5D071DA281EF06709F348F37C8A1EA5E1AB6F86CF1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: c21d84a07fc34b2108eb60a49ceadd7c4169e61a7858c8495224e4f2183d66cd
      • Instruction ID: 2462f163957ba22d34adf1ff46487b35a4690431024680ccd57273759590ba68
      • Opcode Fuzzy Hash: c21d84a07fc34b2108eb60a49ceadd7c4169e61a7858c8495224e4f2183d66cd
      • Instruction Fuzzy Hash: F8A1E19196B70199EFB32020C5D071DA281EF06709F348F37C8A1EA5E1AB6F86CF1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 7a12a78f669ee342252f7636f7a55a324ec980f4fad7c6f0a23ea1231d628977
      • Instruction ID: 6a32b7812e18130bda36bc3f81ba7dba1118f7c2f95953b72f5affdc14cfedea
      • Opcode Fuzzy Hash: 7a12a78f669ee342252f7636f7a55a324ec980f4fad7c6f0a23ea1231d628977
      • Instruction Fuzzy Hash: FBA1E09196B70199EFB32020C5D071DA281EF16709F348F37C8A1EA5E1AB6F86CF1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 48d132996125cdc1507e27000502a8f236cf12edc899e567d1f8a50224bd5189
      • Instruction ID: 965eccd391146320582253083a80bf4cda3a6bc4da2cb6cdc6059a7aaa8327ce
      • Opcode Fuzzy Hash: 48d132996125cdc1507e27000502a8f236cf12edc899e567d1f8a50224bd5189
      • Instruction Fuzzy Hash: BCA1E19196B70199EFB32020C5D071DA281EF06709F348F37C8A1EA5E1AB6F86CF1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 1414b43022ba8a99f4892d6c6ee714ab851c59c232a6e797985946c40b57622d
      • Instruction ID: bd07df4bd7e6e00dfaf94929fb780f0ca16da0bad685589231a2b7625cc98b49
      • Opcode Fuzzy Hash: 1414b43022ba8a99f4892d6c6ee714ab851c59c232a6e797985946c40b57622d
      • Instruction Fuzzy Hash: 2DA1E09196B70199EFB32020C5D071DA281EF16705F348F37C8A1EA5E1AB6F86CF1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 7f7cd0b1bc0beefb6922cdc2683cff3b5f841c230672d666b43f13d754149781
      • Instruction ID: 18bfb9e3ceb2cb2c1fab3ac3fdfe4884e403d54422f274919aef821441af2c38
      • Opcode Fuzzy Hash: 7f7cd0b1bc0beefb6922cdc2683cff3b5f841c230672d666b43f13d754149781
      • Instruction Fuzzy Hash: C2A1E19196B70199EFB32020C5D071DA281EF06705F348F37C8A1EA5E1AB6F86CF1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 83339a830e7e0e7e8adf1e3e4815140017a5dd6cefc13880f58645d8eb6951ee
      • Instruction ID: fbc7ada41383617820701bef6ef135371bbc27a0d9980f6025d1be6c03843cf9
      • Opcode Fuzzy Hash: 83339a830e7e0e7e8adf1e3e4815140017a5dd6cefc13880f58645d8eb6951ee
      • Instruction Fuzzy Hash: F6A1E09196B70199EFB32020C5D071DA281DF16705F348F37C8A1EA5E1AB6F86CF1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 8f7e3c58e1499ac200f0281b85598d7074990e1e4a633b46cc7b68dd7b97e430
      • Instruction ID: 2672f102798ea10ff61af22b1f59dfe9752c2638d2db18a9249c2555e934c37e
      • Opcode Fuzzy Hash: 8f7e3c58e1499ac200f0281b85598d7074990e1e4a633b46cc7b68dd7b97e430
      • Instruction Fuzzy Hash: 21A1E19196B70199EFB32020C5D071DA281DF06705F348F37C8A1EA5E1AB6F86CF1597
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • VirtualAlloc.KERNELBASE(00000000,0000C000,00001000,00000040), ref: 0040A79D
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 7c567ae5d9930560ed5161cab7a2e46c852d911e20e920f98cc5840dc5b84791
      • Instruction ID: 65317f4cc46cdc5997f4b80883aea0e2f9edf314764cb8e58c4ef6bf285363c1
      • Opcode Fuzzy Hash: 7c567ae5d9930560ed5161cab7a2e46c852d911e20e920f98cc5840dc5b84791
      • Instruction Fuzzy Hash: F2A1E19196B70199EFB32020C5D071DA281DF06705F348F37C8A1EA5E1AB6F86CF1597
      Uniqueness

      Uniqueness Score: -1.00%

      Non-executed Functions

      C-Code - Quality: 48%
      			E00412FC4(void* __ebx, void* __ecx, void* __edi, void* __esi, long long __fp0, intOrPtr* _a4) {
      				intOrPtr _v8;
      				intOrPtr _v12;
      				intOrPtr _v24;
      				intOrPtr _v36;
      				char _v48;
      				void* _v56;
      				intOrPtr _v64;
      				intOrPtr _v72;
      				intOrPtr _v80;
      				intOrPtr _v88;
      				char _v92;
      				signed int _v96;
      				signed int _v100;
      				intOrPtr* _v104;
      				signed int _v108;
      				signed int _v116;
      				signed int _v120;
      				char _v124;
      				signed int _v128;
      				signed int _v132;
      				signed int _v136;
      				signed int _t79;
      				signed int _t80;
      				char* _t85;
      				signed int _t90;
      				signed int _t96;
      				signed int _t101;
      				intOrPtr _t105;
      				intOrPtr _t117;
      				void* _t119;
      				signed int _t122;
      				long long _t124;
      				char _t125;
      
      				_t124 = __fp0;
      				_push(0x401266);
      				_push( *[fs:0x0]);
      				 *[fs:0x0] = _t117;
      				_push(0x74);
      				L00401260();
      				_v12 = _t117;
      				_v8 = 0x4011e8;
      				_push(5);
      				_push(0x411a94);
      				_t79 =  &_v48;
      				_push(_t79);
      				L0040132C();
      				_v96 = _v96 & 0x00000000;
      				if(_v96 >= 2) {
      					L00401326();
      					_v116 = _t79;
      				} else {
      					_v116 = _v116 & 0x00000000;
      				}
      				_t80 = _v96;
      				asm("fld1");
      				 *((long long*)(_v36 + _t80 * 8)) = _t124;
      				_v96 = 1;
      				_t119 = _v96 - 2;
      				if(_t119 >= 0) {
      					L00401326();
      					_v120 = _t80;
      				} else {
      					_v120 = _v120 & 0x00000000;
      				}
      				_t105 = _v36;
      				_t125 =  *0x4011e0;
      				 *((long long*)(_t105 + _v96 * 8)) = _t125;
      				_v92 =  &_v48;
      				_push( &_v92);
      				asm("fld1");
      				_push(_t105);
      				_push(_t105);
      				_v56 = _t125;
      				L00401320();
      				L0040137A();
      				asm("fcomp qword [0x4011d8]");
      				asm("fnstsw ax");
      				asm("sahf");
      				if(_t119 != 0) {
      					if( *0x41433c != 0) {
      						_v124 = 0x41433c;
      					} else {
      						_push(0x41433c);
      						_push(0x411a4c);
      						L00401338();
      						_v124 = 0x41433c;
      					}
      					_t28 =  &_v124; // 0x41433c
      					_v96 =  *((intOrPtr*)( *_t28));
      					_t96 =  *((intOrPtr*)( *_v96 + 0x1c))(_v96,  &_v56);
      					asm("fclex");
      					_v100 = _t96;
      					if(_v100 >= 0) {
      						_v128 = _v128 & 0x00000000;
      					} else {
      						_push(0x1c);
      						_push(0x411a3c);
      						_push(_v96);
      						_push(_v100);
      						L00401356();
      						_v128 = _t96;
      					}
      					_v104 = _v56;
      					_v64 = 0x80020004;
      					_v72 = 0xa;
      					L00401260();
      					asm("movsd");
      					asm("movsd");
      					asm("movsd");
      					asm("movsd");
      					_t101 =  *((intOrPtr*)( *_v104 + 0x60))(_v104, L"Magterobringen", 0x10);
      					asm("fclex");
      					_v108 = _t101;
      					_t122 = _v108;
      					if(_t122 >= 0) {
      						_v132 = _v132 & 0x00000000;
      					} else {
      						_push(0x60);
      						_push(0x411a5c);
      						_push(_v104);
      						_push(_v108);
      						L00401356();
      						_v132 = _t101;
      					}
      					L00401332();
      				}
      				asm("fldz");
      				L004012C6();
      				L0040137A();
      				asm("fcomp qword [0x4011d8]");
      				asm("fnstsw ax");
      				asm("sahf");
      				if(_t122 != 0) {
      					_v80 = 0x80020004;
      					_v88 = 0xa;
      					_v64 = 0x80020004;
      					_v72 = 0xa;
      					L00401260();
      					asm("movsd");
      					asm("movsd");
      					asm("movsd");
      					asm("movsd");
      					L00401260();
      					asm("movsd");
      					asm("movsd");
      					asm("movsd");
      					asm("movsd");
      					_t90 =  *((intOrPtr*)( *_a4 + 0x2b0))(_a4, 0x10, 0x10);
      					asm("fclex");
      					_v96 = _t90;
      					if(_v96 >= 0) {
      						_v136 = _v136 & 0x00000000;
      					} else {
      						_push(0x2b0);
      						_push(0x41183c);
      						_push(_a4);
      						_push(_v96);
      						L00401356();
      						_v136 = _t90;
      					}
      				}
      				_v24 = 0x7131b;
      				asm("wait");
      				_push(0x4131fc);
      				_v92 =  &_v48;
      				_t85 =  &_v92;
      				_push(_t85);
      				_push(0);
      				L0040131A();
      				return _t85;
      			}




































      0x00412fc4
      0x00412fc9
      0x00412fd4
      0x00412fd5
      0x00412fdc
      0x00412fdf
      0x00412fe7
      0x00412fea
      0x00412ff1
      0x00412ff3
      0x00412ff8
      0x00412ffb
      0x00412ffc
      0x00413001
      0x00413009
      0x00413011
      0x00413016
      0x0041300b
      0x0041300b
      0x0041300b
      0x00413019
      0x0041301f
      0x00413021
      0x00413024
      0x0041302b
      0x0041302f
      0x00413037
      0x0041303c
      0x00413031
      0x00413031
      0x00413031
      0x00413042
      0x00413045
      0x0041304b
      0x00413051
      0x00413057
      0x00413058
      0x0041305a
      0x0041305b
      0x0041305c
      0x0041305f
      0x00413064
      0x00413069
      0x0041306f
      0x00413071
      0x00413072
      0x0041307f
      0x00413099
      0x00413081
      0x00413081
      0x00413086
      0x0041308b
      0x00413090
      0x00413090
      0x004130a0
      0x004130a5
      0x004130b4
      0x004130b7
      0x004130b9
      0x004130c0
      0x004130d9
      0x004130c2
      0x004130c2
      0x004130c4
      0x004130c9
      0x004130cc
      0x004130cf
      0x004130d4
      0x004130d4
      0x004130e0
      0x004130e3
      0x004130ea
      0x004130f4
      0x004130fe
      0x004130ff
      0x00413100
      0x00413101
      0x0041310f
      0x00413112
      0x00413114
      0x00413117
      0x0041311b
      0x00413134
      0x0041311d
      0x0041311d
      0x0041311f
      0x00413124
      0x00413127
      0x0041312a
      0x0041312f
      0x0041312f
      0x0041313b
      0x0041313b
      0x00413140
      0x00413142
      0x00413147
      0x0041314c
      0x00413152
      0x00413154
      0x00413155
      0x00413157
      0x0041315e
      0x00413165
      0x0041316c
      0x00413176
      0x00413180
      0x00413181
      0x00413182
      0x00413183
      0x00413187
      0x00413191
      0x00413192
      0x00413193
      0x00413194
      0x0041319d
      0x004131a3
      0x004131a5
      0x004131ac
      0x004131cb
      0x004131ae
      0x004131ae
      0x004131b3
      0x004131b8
      0x004131bb
      0x004131be
      0x004131c3
      0x004131c3
      0x004131ac
      0x004131d2
      0x004131d9
      0x004131da
      0x004131ed
      0x004131f0
      0x004131f3
      0x004131f4
      0x004131f6
      0x004131fb

      APIs
      • __vbaChkstk.MSVBVM60(?,00401266), ref: 00412FDF
      • __vbaAryConstruct2.MSVBVM60(?,00411A94,00000005,?,?,?,?,00401266), ref: 00412FFC
      • __vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00411A94,00000005), ref: 00413011
      • __vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00411A94,00000005), ref: 00413037
      • #684.MSVBVM60(?,?,?), ref: 0041305F
      • __vbaFpR8.MSVBVM60(?,?,?), ref: 00413064
      • __vbaNew2.MSVBVM60(00411A4C,0041433C,?,?,?), ref: 0041308B
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000002,00411A3C,0000001C,?,?,?,?,?,?,?), ref: 004130CF
      • __vbaChkstk.MSVBVM60(?,?,?,?,?,?,?), ref: 004130F4
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411A5C,00000060,?,?,?,?,?,?,?), ref: 0041312A
      • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?), ref: 0041313B
      • _CIcos.MSVBVM60(?,?,?), ref: 00413142
      • __vbaFpR8.MSVBVM60(?,?,?), ref: 00413147
      • __vbaChkstk.MSVBVM60(?,?,?), ref: 00413176
      • __vbaChkstk.MSVBVM60(?,?,?), ref: 00413187
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,0041183C,000002B0), ref: 004131BE
      • __vbaAryDestruct.MSVBVM60(00000000,?,004131FC,?,?,?), ref: 004131F6
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: __vba$Chkstk$CheckHresult$BoundsErrorGenerate$#684Construct2DestructFreeIcosNew2
      • String ID: <CA$Magterobringen
      • API String ID: 2333708068-3107163244
      • Opcode ID: cb0711a91a030a3a771fcd9aae896ccfe9e53e198351db3071c1cf6833e43c8f
      • Instruction ID: 4b2f7692d7ec24f4c7bbd15b027e65e9f10a82edc4c36a52089df360a593f91d
      • Opcode Fuzzy Hash: cb0711a91a030a3a771fcd9aae896ccfe9e53e198351db3071c1cf6833e43c8f
      • Instruction Fuzzy Hash: 7E611871D00208EFDB10EFE5C946BDDBBB5BF08705F20406AE905BB2A5C7B95A859F08
      Uniqueness

      Uniqueness Score: -1.00%

      C-Code - Quality: 56%
      			E00412864(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, char* _a8) {
      				intOrPtr _v8;
      				intOrPtr _v12;
      				intOrPtr _v16;
      				char _v28;
      				signed int _v32;
      				char _v48;
      				short _v52;
      				void* _v56;
      				intOrPtr _v64;
      				char _v72;
      				char* _v80;
      				char _v88;
      				short _v92;
      				short _t45;
      				intOrPtr* _t46;
      				signed int _t48;
      				char* _t52;
      				char* _t53;
      				void* _t68;
      				void* _t70;
      				intOrPtr _t71;
      
      				_t71 = _t70 - 0xc;
      				 *[fs:0x0] = _t71;
      				L00401260();
      				_v16 = _t71;
      				_v12 = 0x401108;
      				_v8 = 0;
      				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x4c,  *[fs:0x0], 0x401266, _t68);
      				_v64 = 0x80020004;
      				_v72 = 0xa;
      				_t45 =  &_v72;
      				_push(_t45);
      				L004013C8();
      				_v52 = _t45;
      				L004013C2();
      				_t46 = _a8;
      				_push( *_t46);
      				_push(0x4119f4);
      				L004013BC();
      				if(_t46 != 0) {
      					_v80 = _a8;
      					_v88 = 0x4008;
      					_push(0);
      					_t48 =  &_v88;
      					_push(_t48);
      					L004013B0();
      					L004013B6();
      					_push(_t48);
      					_push(0x4119f4);
      					L004013BC();
      					asm("sbb eax, eax");
      					_v92 =  ~( ~_t48 + 1);
      					L004013AA();
      					_t52 = _v92;
      					if(_t52 == 0) {
      						_t53 = _a8;
      						_push( *_t53);
      						_push(_v52);
      						_push(0xffffffff);
      						_push(1);
      						L004013A4();
      						while(1) {
      							_push(_v52);
      							L0040139E();
      							_t52 = _t53;
      							if(_t52 != 0) {
      								break;
      							}
      							_push(_v52);
      							_push( &_v28);
      							L00401398();
      							_v80 =  &_v28;
      							_v88 = 0x4008;
      							_push(0x10);
      							L00401260();
      							asm("movsd");
      							asm("movsd");
      							asm("movsd");
      							asm("movsd");
      							_push(1);
      							_push("Add");
      							_t53 =  &_v48;
      							_push(_t53);
      							L0040138C();
      							_push(_t53);
      							L00401392();
      							_t71 = _t71 + 0x1c;
      						}
      						_push(_v52);
      						L00401386();
      						L00401380();
      						_v32 = _v32 | 0x0000ffff;
      					} else {
      						_v32 = _v32 & 0x00000000;
      					}
      				} else {
      					_v32 = _v32 & 0x00000000;
      				}
      				_push(0x4129d3);
      				L004013AA();
      				L004013C2();
      				return _t52;
      			}
























      0x00412867
      0x00412876
      0x00412880
      0x00412888
      0x0041288b
      0x00412892
      0x004128a1
      0x004128a4
      0x004128ab
      0x004128b2
      0x004128b5
      0x004128b6
      0x004128bb
      0x004128c2
      0x004128c7
      0x004128ca
      0x004128cc
      0x004128d1
      0x004128d8
      0x004128e7
      0x004128ea
      0x004128f1
      0x004128f3
      0x004128f6
      0x004128f7
      0x00412901
      0x00412906
      0x00412907
      0x0041290c
      0x00412913
      0x00412918
      0x0041291f
      0x00412924
      0x0041292a
      0x00412933
      0x00412936
      0x00412938
      0x0041293b
      0x0041293d
      0x0041293f
      0x00412944
      0x00412944
      0x00412947
      0x0041294c
      0x00412951
      0x00000000
      0x00000000
      0x00412953
      0x00412959
      0x0041295a
      0x00412962
      0x00412965
      0x0041296c
      0x0041296f
      0x00412979
      0x0041297a
      0x0041297b
      0x0041297c
      0x0041297d
      0x0041297f
      0x00412984
      0x00412987
      0x00412988
      0x0041298d
      0x0041298e
      0x00412993
      0x00412993
      0x00412998
      0x0041299b
      0x004129a0
      0x004129a5
      0x0041292c
      0x0041292c
      0x0041292c
      0x004128da
      0x004128da
      0x004128da
      0x004129aa
      0x004129c5
      0x004129cd
      0x004129d2

      APIs
      • __vbaChkstk.MSVBVM60(?,00401266), ref: 00412880
      • #648.MSVBVM60(0000000A), ref: 004128B6
      • __vbaFreeVar.MSVBVM60(0000000A), ref: 004128C2
      • __vbaStrCmp.MSVBVM60(004119F4,?,0000000A), ref: 004128D1
      • #645.MSVBVM60(?,00000000,004119F4,?,0000000A), ref: 004128F7
      • __vbaStrMove.MSVBVM60(?,00000000,004119F4,?,0000000A), ref: 00412901
      • __vbaStrCmp.MSVBVM60(004119F4,00000000,?,00000000,004119F4,?,0000000A), ref: 0041290C
      • __vbaFreeStr.MSVBVM60(004119F4,00000000,?,00000000,004119F4,?,0000000A), ref: 0041291F
      • __vbaFreeStr.MSVBVM60(004129D3,?,?,00000001,000000FF,?,?,004119F4,00000000,?,00000000,004119F4,?,0000000A), ref: 004129C5
      • __vbaFreeVar.MSVBVM60(004129D3,?,?,00000001,000000FF,?,?,004119F4,00000000,?,00000000,004119F4,?,0000000A), ref: 004129CD
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: __vba$Free$#645#648ChkstkMove
      • String ID: Add
      • API String ID: 4182468812-3310826759
      • Opcode ID: 3921ad865fed42d2fa2f4cee3061028c1ae30dbeda84a85d8ca8fcc37c516625
      • Instruction ID: d9c1b43848a894025c9cbb01b3105b1c2c7778d62ff7d536e02444f9eab11421
      • Opcode Fuzzy Hash: 3921ad865fed42d2fa2f4cee3061028c1ae30dbeda84a85d8ca8fcc37c516625
      • Instruction Fuzzy Hash: 63416DB1E10209AADB00EFE5C946BEE7BB4AF04704F10812BB900FB1E1DB7C99558B59
      Uniqueness

      Uniqueness Score: -1.00%

      C-Code - Quality: 60%
      			E00413445(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, intOrPtr* _a4) {
      				intOrPtr _v8;
      				intOrPtr _v12;
      				intOrPtr* _v16;
      				short _v28;
      				short _v32;
      				char _v36;
      				void* _v40;
      				signed int _v44;
      				signed int _v48;
      				void* _v52;
      				signed int _v56;
      				signed int _v68;
      				char _v72;
      				signed int _v76;
      				signed int _v80;
      				void* _t53;
      				signed int _t59;
      				signed int _t64;
      				short _t65;
      				signed int _t68;
      				void* _t74;
      				void* _t76;
      				intOrPtr* _t77;
      
      				_t77 = _t76 - 0xc;
      				 *[fs:0x0] = _t77;
      				L00401260();
      				_v16 = _t77;
      				_v12 = 0x401248;
      				_v8 = 0;
      				_t53 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x38,  *[fs:0x0], 0x401266, _t74);
      				_push(0x411ae0);
      				L004012FC();
      				asm("fcomp qword [0x4011e0]");
      				asm("fnstsw ax");
      				asm("sahf");
      				if(__eflags != 0) {
      					L004012F6();
      					_v52 =  *0x40123c;
      					_v56 =  *0x401238;
      					 *_t77 =  *0x401234;
      					 *_t77 =  *0x401230;
      					_t68 =  *((intOrPtr*)( *_a4 + 0x2c8))(_a4, 6, __ecx, __ecx, __ecx, __ecx, _t53);
      					asm("fclex");
      					_v44 = _t68;
      					if(_v44 >= 0) {
      						_t15 =  &_v68;
      						 *_t15 = _v68 & 0x00000000;
      						__eflags =  *_t15;
      					} else {
      						_push(0x2c8);
      						_push(0x41183c);
      						_push(_a4);
      						_push(_v44);
      						L00401356();
      						_v68 = _t68;
      					}
      				}
      				if( *0x41433c != 0) {
      					_v72 = 0x41433c;
      				} else {
      					_push(0x41433c);
      					_push(0x411a4c);
      					L00401338();
      					_v72 = 0x41433c;
      				}
      				_t19 =  &_v72; // 0x41433c
      				_v44 =  *((intOrPtr*)( *_t19));
      				_t59 =  *((intOrPtr*)( *_v44 + 0x14))(_v44,  &_v36);
      				asm("fclex");
      				_v48 = _t59;
      				if(_v48 >= 0) {
      					_t30 =  &_v76;
      					 *_t30 = _v76 & 0x00000000;
      					__eflags =  *_t30;
      				} else {
      					_push(0x14);
      					_push(0x411a3c);
      					_push(_v44);
      					_push(_v48);
      					L00401356();
      					_v76 = _t59;
      				}
      				_v52 = _v36;
      				_t64 =  *((intOrPtr*)( *_v52 + 0x120))(_v52,  &_v40);
      				asm("fclex");
      				_v56 = _t64;
      				if(_v56 >= 0) {
      					_t43 =  &_v80;
      					 *_t43 = _v80 & 0x00000000;
      					__eflags =  *_t43;
      				} else {
      					_push(0x120);
      					_push(0x411ae4);
      					_push(_v52);
      					_push(_v56);
      					L00401356();
      					_v80 = _t64;
      				}
      				_t65 = _v40;
      				_v32 = _t65;
      				L00401332();
      				_v28 = 0xf6;
      				asm("wait");
      				_push(0x4135d5);
      				return _t65;
      			}


























      0x00413448
      0x00413457
      0x00413461
      0x00413469
      0x0041346c
      0x00413473
      0x00413482
      0x00413485
      0x0041348a
      0x0041348f
      0x00413495
      0x00413497
      0x00413498
      0x004134a0
      0x004134ad
      0x004134b7
      0x004134c1
      0x004134cb
      0x004134d8
      0x004134de
      0x004134e0
      0x004134e7
      0x00413503
      0x00413503
      0x00413503
      0x004134e9
      0x004134e9
      0x004134ee
      0x004134f3
      0x004134f6
      0x004134f9
      0x004134fe
      0x004134fe
      0x004134e7
      0x0041350e
      0x00413528
      0x00413510
      0x00413510
      0x00413515
      0x0041351a
      0x0041351f
      0x0041351f
      0x0041352f
      0x00413534
      0x00413543
      0x00413546
      0x00413548
      0x0041354f
      0x00413568
      0x00413568
      0x00413568
      0x00413551
      0x00413551
      0x00413553
      0x00413558
      0x0041355b
      0x0041355e
      0x00413563
      0x00413563
      0x0041356f
      0x0041357e
      0x00413584
      0x00413586
      0x0041358d
      0x004135a9
      0x004135a9
      0x004135a9
      0x0041358f
      0x0041358f
      0x00413594
      0x00413599
      0x0041359c
      0x0041359f
      0x004135a4
      0x004135a4
      0x004135ad
      0x004135b1
      0x004135b8
      0x004135bd
      0x004135c3
      0x004135c4
      0x00000000

      APIs
      • __vbaChkstk.MSVBVM60(?,00401266), ref: 00413461
      • __vbaR8Str.MSVBVM60(00411AE0,?,?,?,?,00401266), ref: 0041348A
      • __vbaFpI4.MSVBVM60(00411AE0,?,?,?,?,00401266), ref: 004134A0
      • __vbaHresultCheckObj.MSVBVM60(00000000,00401248,0041183C,000002C8), ref: 004134F9
      • __vbaNew2.MSVBVM60(00411A4C,0041433C,00411AE0,?,?,?,?,00401266), ref: 0041351A
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411A3C,00000014), ref: 0041355E
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411AE4,00000120), ref: 0041359F
      • __vbaFreeObj.MSVBVM60 ref: 004135B8
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: __vba$CheckHresult$ChkstkFreeNew2
      • String ID: <CA
      • API String ID: 1616694062-146778150
      • Opcode ID: 50d7ecc1627527cc43d178341f46a3dfdae648352ebd21ec36a47c136f0c8b3f
      • Instruction ID: 789bc9d9ec4d10f45948286056a0cdb37ee8d7ee552f9913c40d72fde95b8f24
      • Opcode Fuzzy Hash: 50d7ecc1627527cc43d178341f46a3dfdae648352ebd21ec36a47c136f0c8b3f
      • Instruction Fuzzy Hash: EF412475A01208EFCB00AF95C949BDEBFB5FF08B45F10406AF501B62A0C7785A95DF69
      Uniqueness

      Uniqueness Score: -1.00%

      C-Code - Quality: 33%
      			E00412E5C(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, intOrPtr* _a4) {
      				intOrPtr _v8;
      				intOrPtr _v12;
      				long long _v28;
      				void* _v32;
      				signed int _v36;
      				signed int _v40;
      				intOrPtr* _v44;
      				signed int _v48;
      				signed int _v56;
      				char _v60;
      				signed int _v64;
      				signed int _v68;
      				signed int _t44;
      				signed int _t50;
      				signed int _t56;
      				intOrPtr _t64;
      
      				_push(0x401266);
      				_push( *[fs:0x0]);
      				 *[fs:0x0] = _t64;
      				_push(0x30);
      				L00401260();
      				_v12 = _t64;
      				_v8 = 0x4011c8;
      				L004012DE();
      				L0040137A();
      				asm("fcomp qword [0x4011b8]");
      				asm("fnstsw ax");
      				asm("sahf");
      				if(__eflags != 0) {
      					_t56 =  *((intOrPtr*)( *_a4 + 0x254))(_a4, 0x30ef);
      					asm("fclex");
      					_v36 = _t56;
      					if(_v36 >= 0) {
      						_t11 =  &_v56;
      						 *_t11 = _v56 & 0x00000000;
      						__eflags =  *_t11;
      					} else {
      						_push(0x254);
      						_push(0x41183c);
      						_push(_a4);
      						_push(_v36);
      						L00401356();
      						_v56 = _t56;
      					}
      				}
      				_t44 = 0;
      				if(0 != 0) {
      					if( *0x41433c != 0) {
      						_v60 = 0x41433c;
      					} else {
      						_push(0x41433c);
      						_push(0x411a4c);
      						L00401338();
      						_v60 = 0x41433c;
      					}
      					_t15 =  &_v60; // 0x41433c
      					_v36 =  *((intOrPtr*)( *_t15));
      					_t50 =  *((intOrPtr*)( *_v36 + 0x1c))(_v36,  &_v32);
      					asm("fclex");
      					_v40 = _t50;
      					if(_v40 >= 0) {
      						_t26 =  &_v64;
      						 *_t26 = _v64 & 0x00000000;
      						__eflags =  *_t26;
      					} else {
      						_push(0x1c);
      						_push(0x411a3c);
      						_push(_v36);
      						_push(_v40);
      						L00401356();
      						_v64 = _t50;
      					}
      					_v44 = _v32;
      					_t44 =  *((intOrPtr*)( *_v44 + 0x50))(_v44);
      					asm("fclex");
      					_v48 = _t44;
      					if(_v48 >= 0) {
      						_t38 =  &_v68;
      						 *_t38 = _v68 & 0x00000000;
      						__eflags =  *_t38;
      					} else {
      						_push(0x50);
      						_push(0x411a5c);
      						_push(_v44);
      						_push(_v48);
      						L00401356();
      						_v68 = _t44;
      					}
      					L00401332();
      				}
      				_v28 =  *0x4011b0;
      				asm("wait");
      				_push(0x412fa9);
      				return _t44;
      			}



















      0x00412e61
      0x00412e6c
      0x00412e6d
      0x00412e74
      0x00412e77
      0x00412e7f
      0x00412e82
      0x00412e8f
      0x00412e94
      0x00412e99
      0x00412e9f
      0x00412ea1
      0x00412ea2
      0x00412eb1
      0x00412eb7
      0x00412eb9
      0x00412ec0
      0x00412edc
      0x00412edc
      0x00412edc
      0x00412ec2
      0x00412ec2
      0x00412ec7
      0x00412ecc
      0x00412ecf
      0x00412ed2
      0x00412ed7
      0x00412ed7
      0x00412ec0
      0x00412ee0
      0x00412ee4
      0x00412ef1
      0x00412f0b
      0x00412ef3
      0x00412ef3
      0x00412ef8
      0x00412efd
      0x00412f02
      0x00412f02
      0x00412f12
      0x00412f17
      0x00412f26
      0x00412f29
      0x00412f2b
      0x00412f32
      0x00412f4b
      0x00412f4b
      0x00412f4b
      0x00412f34
      0x00412f34
      0x00412f36
      0x00412f3b
      0x00412f3e
      0x00412f41
      0x00412f46
      0x00412f46
      0x00412f52
      0x00412f5d
      0x00412f60
      0x00412f62
      0x00412f69
      0x00412f82
      0x00412f82
      0x00412f82
      0x00412f6b
      0x00412f6b
      0x00412f6d
      0x00412f72
      0x00412f75
      0x00412f78
      0x00412f7d
      0x00412f7d
      0x00412f89
      0x00412f89
      0x00412f94
      0x00412f97
      0x00412f98
      0x00000000

      APIs
      • __vbaChkstk.MSVBVM60(?,00401266), ref: 00412E77
      • _CIsqrt.MSVBVM60(?,?,?,?,00401266), ref: 00412E8F
      • __vbaFpR8.MSVBVM60(?,?,?,?,00401266), ref: 00412E94
      • __vbaHresultCheckObj.MSVBVM60(?,?,0041183C,00000254,?,?,?,?,00401266), ref: 00412ED2
      • __vbaNew2.MSVBVM60(00411A4C,0041433C,?,?,?,?,00401266), ref: 00412EFD
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411A3C,0000001C,?,?,?,?,?,?,?,?,?,?,?,00401266), ref: 00412F41
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00411A5C,00000050,?,?,?,?,?,?,?,?,?,?,?,00401266), ref: 00412F78
      • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401266), ref: 00412F89
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: __vba$CheckHresult$ChkstkFreeIsqrtNew2
      • String ID: <CA
      • API String ID: 987039556-146778150
      • Opcode ID: 01fb78609faececba4bff0c666525a3640859a675d6e96d4a76caca9467deb37
      • Instruction ID: 32cba04b0e0dda6bfa0e9c214f2881504b23d8fec925bd0a5b69cc0c3265067f
      • Opcode Fuzzy Hash: 01fb78609faececba4bff0c666525a3640859a675d6e96d4a76caca9467deb37
      • Instruction Fuzzy Hash: 6A41F475A00608EFDF00EFA5DA4ABDDBBB4FF08754F10406AF501B62A1D7B85895DB28
      Uniqueness

      Uniqueness Score: -1.00%

      C-Code - Quality: 57%
      			E00413217(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
      				intOrPtr _v8;
      				intOrPtr _v12;
      				intOrPtr _v16;
      				short _v28;
      				char _v44;
      				intOrPtr _v52;
      				char _v60;
      				intOrPtr _v68;
      				char _v76;
      				intOrPtr _v84;
      				char _v92;
      				char* _v100;
      				intOrPtr _v108;
      				char* _t30;
      				void* _t43;
      				void* _t45;
      				intOrPtr _t46;
      
      				_t46 = _t45 - 0xc;
      				 *[fs:0x0] = _t46;
      				L00401260();
      				_v16 = _t46;
      				_v12 = E004011F8;
      				_v8 = 0;
      				_t30 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x401266, _t43);
      				_push(0x411ab0);
      				L00401314();
      				if(_t30 != 2) {
      					_v84 = 0x80020004;
      					_v92 = 0xa;
      					_v68 = 0x80020004;
      					_v76 = 0xa;
      					_v52 = 0x80020004;
      					_v60 = 0xa;
      					_v100 = L"HEPATATROPHY";
      					_v108 = 8;
      					L0040136E();
      					_push( &_v92);
      					_push( &_v76);
      					_push( &_v60);
      					_push(0);
      					_push( &_v44);
      					L0040130E();
      					_push( &_v92);
      					_push( &_v76);
      					_push( &_v60);
      					_t30 =  &_v44;
      					_push(_t30);
      					_push(4);
      					L00401308();
      				}
      				_push(0x411ad8);
      				L00401302();
      				if(_t30 == 0x61) {
      					_v28 = 0x32bb;
      				}
      				_push(0x413317);
      				return _t30;
      			}




















      0x0041321a
      0x00413229
      0x00413235
      0x0041323d
      0x00413240
      0x00413247
      0x00413256
      0x00413259
      0x0041325e
      0x00413266
      0x00413268
      0x0041326f
      0x00413276
      0x0041327d
      0x00413284
      0x0041328b
      0x00413292
      0x00413299
      0x004132a6
      0x004132ae
      0x004132b2
      0x004132b6
      0x004132b7
      0x004132bc
      0x004132bd
      0x004132c5
      0x004132c9
      0x004132cd
      0x004132ce
      0x004132d1
      0x004132d2
      0x004132d4
      0x004132d9
      0x004132dc
      0x004132e1
      0x004132ea
      0x004132ee
      0x004132ee
      0x004132f4
      0x00000000

      APIs
      • __vbaChkstk.MSVBVM60(?,00401266), ref: 00413235
      • __vbaLenBstrB.MSVBVM60(00411AB0,?,?,?,?,00401266), ref: 0041325E
      • __vbaVarDup.MSVBVM60 ref: 004132A6
      • #595.MSVBVM60(?,00000000,0000000A,0000000A,0000000A), ref: 004132BD
      • __vbaFreeVarList.MSVBVM60(00000004,?,0000000A,0000000A,0000000A,?,00000000,0000000A,0000000A,0000000A), ref: 004132D4
      • #516.MSVBVM60(00411AD8,00411AB0,?,?,?,?,00401266), ref: 004132E1
      Strings
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: __vba$#516#595BstrChkstkFreeList
      • String ID: HEPATATROPHY
      • API String ID: 3121728414-4183309565
      • Opcode ID: acb56d8ef28a298c6acdc5d992464d2b4039d7f033f99a3127eb4d1e8de33d13
      • Instruction ID: c1bf59c79801acfd14a0b171498b3df870606fcf78fe53306b66394dc4d269fe
      • Opcode Fuzzy Hash: acb56d8ef28a298c6acdc5d992464d2b4039d7f033f99a3127eb4d1e8de33d13
      • Instruction Fuzzy Hash: 9D2109B190024CABDB01EFC4C886BCEBFB8EF04704F54416AF501BA291D7789685CBA9
      Uniqueness

      Uniqueness Score: -1.00%

      C-Code - Quality: 54%
      			E00413340(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, intOrPtr* _a4) {
      				intOrPtr _v8;
      				intOrPtr* _v12;
      				void* _v24;
      				char _v32;
      				char _v40;
      				signed int _v60;
      				signed int _v68;
      				void* _t20;
      				char* _t21;
      				signed int _t24;
      				intOrPtr* _t35;
      
      				_push(__ecx);
      				_push(__ecx);
      				_push(0x401266);
      				_push( *[fs:0x0]);
      				 *[fs:0x0] = _t35;
      				_t20 = 0x30;
      				L00401260();
      				_v12 = _t35;
      				_v8 = 0x401220;
      				_push(0x411ae0);
      				L004012FC();
      				asm("fcomp qword [0x4011e0]");
      				asm("fnstsw ax");
      				asm("sahf");
      				if(__eflags != 0) {
      					L004012F6();
      					 *_t35 =  *0x401214;
      					 *_t35 =  *0x401210;
      					 *_t35 =  *0x40120c;
      					 *_t35 =  *0x401208;
      					_t24 =  *((intOrPtr*)( *_a4 + 0x2c8))(_a4, 6, __ecx, __ecx, __ecx, __ecx, _t20);
      					asm("fclex");
      					_v60 = _t24;
      					if(_v60 >= 0) {
      						_t11 =  &_v68;
      						 *_t11 = _v68 & 0x00000000;
      						__eflags =  *_t11;
      					} else {
      						_push(0x2c8);
      						_push(0x41183c);
      						_push(_a4);
      						_push(_v60);
      						L00401356();
      						_v68 = _t24;
      					}
      				}
      				_v32 = 2;
      				_v40 = 2;
      				_t21 =  &_v40;
      				_push(_t21);
      				L004012F0();
      				L004013B6();
      				L004013C2();
      				asm("wait");
      				_push(0x413432);
      				L004013AA();
      				return _t21;
      			}














      0x00413343
      0x00413344
      0x00413345
      0x00413350
      0x00413351
      0x0041335a
      0x0041335b
      0x00413363
      0x00413366
      0x0041336d
      0x00413372
      0x00413377
      0x0041337d
      0x0041337f
      0x00413380
      0x00413388
      0x00413395
      0x0041339f
      0x004133a9
      0x004133b3
      0x004133c0
      0x004133c6
      0x004133c8
      0x004133cf
      0x004133eb
      0x004133eb
      0x004133eb
      0x004133d1
      0x004133d1
      0x004133d6
      0x004133db
      0x004133de
      0x004133e1
      0x004133e6
      0x004133e6
      0x004133cf
      0x004133ef
      0x004133f6
      0x004133fd
      0x00413400
      0x00413401
      0x0041340b
      0x00413413
      0x00413418
      0x00413419
      0x0041342c
      0x00413431

      APIs
      • __vbaChkstk.MSVBVM60(?,00401266), ref: 0041335B
      • __vbaR8Str.MSVBVM60(00411AE0,?,?,?,?,00401266), ref: 00413372
      • __vbaFpI4.MSVBVM60(00411AE0,?,?,?,?,00401266), ref: 00413388
      • __vbaHresultCheckObj.MSVBVM60(?,?,0041183C,000002C8,?,?,?,?,00000000,00411AE0,?,?,?,?,00401266), ref: 004133E1
      • #536.MSVBVM60(?,00411AE0,?,?,?,?,00401266), ref: 00413401
      • __vbaStrMove.MSVBVM60(?,00411AE0,?,?,?,?,00401266), ref: 0041340B
      • __vbaFreeVar.MSVBVM60(?,00411AE0,?,?,?,?,00401266), ref: 00413413
      • __vbaFreeStr.MSVBVM60(00413432,?,00411AE0,?,?,?,?,00401266), ref: 0041342C
      Memory Dump Source
      • Source File: 00000001.00000002.847765767.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000001.00000002.847758534.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000001.00000002.847792062.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000001.00000002.847800065.0000000000416000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: __vba$Free$#536CheckChkstkHresultMove
      • String ID:
      • API String ID: 2640481455-0
      • Opcode ID: 1e0ae455a262d15b238c34de54dfecae627fdacc06d6e4d9f703c6c70ebfc7e6
      • Instruction ID: c17b052567c4644a7fb606ecd6cbad95c4cb04d4cd8e253ef4b9e918ad633bd4
      • Opcode Fuzzy Hash: 1e0ae455a262d15b238c34de54dfecae627fdacc06d6e4d9f703c6c70ebfc7e6
      • Instruction Fuzzy Hash: 70215970A01108EFDB00AF91DA8ABAEBBB4EB04741F1045BEF141B60B1CB785A509B5D
      Uniqueness

      Uniqueness Score: -1.00%