Fig5

Fig5

Figure 5. GetAPIByHash function in Dridex and FriedEx binaries compiled the same day. The highlighted constant is the same in both samples.